hitcon-2017-luaky-sol.py

#!/usr/bin/python

#!/usr/bin/python                                                               
import struct                                                                   
import socket                                                                   
import telnetlib                                                                
import sys, time                                                           
import string
import re

def recv_utils(s,r,ss):
	while all([not(sss in r) for sss in ss]):
		sa = s.recv(4096)
		#print sa
		r += sa
	return r


s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)  
s.connect(('13.113.99.240', 50216)) 

'''
Slime: x = x+1
Alpaca: x = last + x - 1
'''

print recv_utils(s, '', ['AI:'])
c = '''
function xmd(a,b) return a-math.floor(a/b)*b end
function md(a,b) return xmd(xmd(a,b)+b,b) end
nr=0
la=0
ht={}
mth=1
function pS(x) return md(x+3,3) end
c=0x61C88647
m=0 mx=0 m_i=0x100000000 ch=true chprd=0 anr=1
function pA(x)
	local nxt
	anr=anr+1
	if anr==1 then la=0 ch=false return la end
	if anr==2 then
		m=x if x==0 then mx=0xffffffff
		else mx=0xfffffffc+x end
		ch=false
	end
	if ch then
		if md(la+1,3)~=md(x+3,3) then m=c while md(m,3)~=md(mx,3) do m=m+1 end
		else mx=c-1 while md(m,3)~=md(mx,3) do m=m-1 end end
		ch=false
	end    
	if anr>2 then
		m=m-c mx=mx-c
		if m<0 then m=m+m_i end
		if mx<0 then mx=mx+m_i end
	end    
	if (m<c) and (c<=mx) then ch=true nxt=md(la+x-c+m_i,3)
	elseif mx<c then nxt=md(la+x-c+m_i,3)
	elseif m>=c then nxt=md(la+x-c,3) end
	la=md(nxt+2,3)
	return la
end
tbl={}
p3=math.floor(math.pow(3,20))
for i=1,2000000 do a=i r=0 for j=1,20 do a=md(a*48271,0x7FFFFFFF) r=r*3+md(a,3) end tbl[r]=a end
pr=0 cur=1 fd=true nf=0
function pN(x)
	cur=md(cur*48271,0x7FFFFFFF)
	if nr>=60 and fd then
		pr=md(pr*3+md(x+3,3),p3)
		if tbl[pr]~=nil then
			print("F"..tbl[pr].." @ "..nr)
			cur = tbl[pr]
			fd = false
		end
	end
	if fd==false then
		if md(cur,3)~=x then
			nf=nf+1
			if nf>=1 then nf=0
				print("res") fd=true
			end
			print("?? "..nr..": "..md(cur,3).." vs "..x)
		end
	end
	la=md(md(cur*48271,0x7FFFFFFF)+2,3)
	return la
end
function iS()
	local x=false
	local y=0
	la=ht[1]
	for i=2,30 do
		if md(ht[i-1]+1,3)==ht[i] then y=y+1 end
	end
	return y>=24
end
function iA()
	local x=false
	local y=0
	for i=2,30 do if md(ht[i-1]+30,3)==md(ht[i]+30,3) then y=y+1 end end
	return y>=15
end
function play(x)
	nr=md(nr+1,100000)
	if (nr>=1) and (nr<=30) then
		ht[nr]=x
		return 1
	end    
	if nr==31 then
		if iS() then mth=1
		elseif iA() then mth=2 ch=false anr=0
		else mth=3 pr=0 fd=true end
		print("M="..mth)
	end    
	if mth==1 then return pS(x)
	elseif mth==2 then return pA(x) end
	return pN(x)
end
'''
print("Len is %d" % len(c))
assert(len(c)<2048)
s.send(c + (' ' * (2048-len(c))))

t = telnetlib.Telnet()
t.sock = s
t.interact()