Trend Micro CTF 2015 - Writeups

#!/usr/bin/env python

from zio import *
import re
import roman

def text2int(textnum, numwords={}):
    if not numwords:
        units = [
          "zero", "one", "two", "three", "four", "five", "six", "seven", "eight",
          "nine", "ten", "eleven", "twelve", "thirteen", "fourteen", "fifteen",
          "sixteen", "seventeen", "eighteen", "nineteen",
        ]

        tens = ["", "", "twenty", "thirty", "forty", "fifty", "sixty", "seventy", "eighty", "ninety"]

        scales = ["hundred", "thousand", "million", "billion", "trillion"]

        numwords["and"] = (1, 0)
        for idx, word in enumerate(units):    numwords[word] = (1, idx)
        for idx, word in enumerate(tens):     numwords[word] = (1, idx * 10)
        for idx, word in enumerate(scales):   numwords[word] = (10 ** (idx * 3 or 2), 0)

    current = result = 0
    for word in textnum.split():
        if word not in numwords:
          raise Exception("Illegal word: " + word)

        scale, increment = numwords[word]
        current = current * scale + increment
        if scale > 100:
            result += current
            current = 0

    return result + current

def handle_question(quest):
    quest = quest.replace('=','').replace(',','')
    quest = quest.strip()
    quest = re.sub('[IXCMVLD]+', lambda s:str(roman.fromRoman(s.group(0))), quest)
    quest = re.sub('[a-z][a-z\s]+', lambda s:str(text2int(s.group(0))), quest)
    return quest

def main():
    target = ('ctfquest.trendmicro.co.jp', 51740)
    io = zio(target, print_read=COLORED(REPR, 'red'), print_write=True, timeout=999)
    while True:
        cmd = io.read_until('=')
        cmd = handle_question(cmd)
        result = eval(cmd)
        io.write(str(result)+'\n')

if __name__ == '__main__':
    main()

#!/usr/bin/env python

import Image
import re
from urllib2 import urlopen

start_url = 'http://ctfquest.trendmicro.co.jp:43210/click_on_the_different_color'
host = 'http://ctfquest.trendmicro.co.jp:43210'

def judge_pic(name):
    im = Image.open(name)
    w, h = im.size

    # get the major color
    hist = im.histogram()
    r_major = hist[0:255].index(max(hist[0:255]))
    g_major = hist[256:511].index(max(hist[256:511]))
    b_major = hist[512:767].index(max(hist[512:767]))
    major = (r_major, g_major, b_major)

    # travel the image
    for x in range(w):
        for y in range(h):
            if im.getpixel((x,y)) != (255, 255, 255) and im.getpixel((x,y)) != major:
                return x, y

def crawl():
    now_url = start_url
    pic_id = 0
    while True:
        print '[+] open %s' % now_url
        html = urlopen(now_url).read()
        open('{}.html'.format(pic_id), 'w').write(html)

        # extract next stage link
        next_link = re.findall(r'window\.location\.href=\'([/a-z0-9]+?)\?x=\'', html)[0]
        # extract image link
        img_link = re.findall(r'<img src="([^"]+?)"', html)[0]
        print '[+] next stage : %s' % next_link
        print '[+] picture at %s' % img_link
        
        # download the image
        img = urlopen(host+img_link).read()
        open('{}.png'.format(pic_id), 'w').write(img).close()

        x,y = judge_pic('{}.png'.format(pic_id))
        now_url = host + next_link + '?x={}&y={}'.format(x, y)
        pic_id += 1

def main():
    crawl()

if __name__ == '__main__':
    main()