Problem

N/A. Something about QR and anagrams.

Solution

Connect to a server and get a bunch of ascii and ansi QR codes, then are supposed to reply with a text and some numbers.

I solved it using qrtools, png and an anagram solver I found using Google. The anagram solver needs a dictionary to work, so I had to find a sorted word list by frequency (N-gram, the hint in the challenge name).

I generate a png image with the qrcode and then feed it to qrtools to decode a string. This string is an anagram that I then solve with the anagram solver previously mentioned.

Sorry about the mess but here’s the code.

Change to the anaram solver:

  1. def process(words, word):
  2. 	jumbledWord = word
  3. 	filteredWords = [filterWordsBasedOnLength(jumbledWord,word) for word in words]
  4. 	filteredWords = filter(None,filteredWords)
  5.         for dictionaryWord in filteredWords:
  6.             if computeValuForEachWord(dictionaryWord,jumbledWord):
  7.                 print dictionaryWord
  8.                 return dictionaryWord

Solution

  1. from pwn import *
  2. import qrtools
  3. import png
  4. import ana
  5. #context.log_level = 0
  7. r = remote('pool.pwn2win.party', 31337)
  9. global g_i
  10. g_i = 0
  12. def decodeascii(data, fname):
  13.     width = len(data[0]) * 5
  14.     height = len(data) * 5
  15.     f = open(fname, 'wb')
  16.     w = png.Writer(width, height, greyscale=True)
  17.     rows = []
  18.     for i in range(len(data)):
  19.         row = []
  20.         for x in data[i]:
  21.             col = 255 if x == '0' else 0
  22.             row += [col]*5
  23.         rows += [row] * 5
  24.     w.write(f, rows)
  25.     f.close()
  27. def decode(data):
  28.     global g_i
  29.     g_i += 1
  30.     fname = 'qr-%d.png' % g_i
  31.     data = data.split('\n')
  32.     if data[0][0] == '0' or data[0][0] == '1':
  33.         print "ASCII"
  34.         decodeascii(data, fname)
  36.     else:
  37.         print "ANSI"
  38.         newdata = []
  39.         # Mmmm, ctf code is beautiful.
  40.         for line in data:
  41.             line = line.replace(unhex('1b5b376d20201b5b306d'), 'O')
  42.             line = line.replace(unhex('1b5b34396d20201b5b306d'), 'I')
  43.             line = line.replace('O', '0')
  44.             line = line.replace('I', '1')
  45.             newdata.append(line)
  46.             #print "[%s]" % line
  47.         decodeascii(newdata, fname)
  49.     x = qrtools.QR(filename=fname)
  50.     x.decode()
  51.     print x.data
  52.     return x.data
  55. words = [x.strip() for x in open("google-10000-english-usa.txt", "r").read().split()]
  56. words += [x.strip() for x in open("wordsEn.txt", "r").read().split()]
  59. postfix = []
  60. answers = []
  61. part = ""
  62. r.recvuntil('\n')
  63. hax = True
  64. while hax:
  65.     ret = r.recv()
  66.     if ret.find('Phrase') > -1:
  67.         print "Phrase!"
  68.         hax = False
  69.     part += ret
  70.     #print part
  71.     nn = part.find('\n\n')
  72.     if nn >= 0:
  73.         x = part[:nn].strip()
  74.         part = part[nn+2:]
  75.     elif not hax:
  76.         nn = part.find('Phrase')
  77.         x = part[:nn].strip()
  78.     else:
  79.         continue
  81.     append = ""
  82.     print "qr: [%s]" % x
  83.     if x == '': continue
  84.     y = decode(x)
  86.     try:
  87.         int(y)
  88.         postfix.append(y)
  89.     except:
  90.         pass
  92.     rep="0123456789"
  93.     for ch in y:
  94.         if ch in rep:
  95.             y=y.replace(ch,'')
  97.     if y == '': continue
  99.     cap = False
  100.     rep="ABCDEFGHIJKLMNOPQRSTUVWXYZ"
  101.     for ch in y:
  102.         if ch in rep:
  103.             cap = True
  105.     y = y.lower()
  107.     if y.find('.') >= 0:
  108.         y = y.replace(".", "")
  109.         append = "."
  110.     if y.find(',') >= 0:
  111.         y = y.replace(",", "")
  112.         append = ","
  113.     if y.find('!') >= 0:
  114.         y = y.replace("!", "")
  115.         append = "!"
  116.     if y.find('?') >= 0:
  117.         y = y.replace("?", "")
  118.         append = "?"
  119.     if y.find(';') >= 0:
  120.         y = y.replace(";", "")
  121.         append = ";"
  123.     decoded = ana.process(words, y) + append
  124.     if cap:
  125.         if len(decoded) > 1:
  126.             decoded = decoded[0].upper() + decoded[1:]
  127.         else:
  128.             decoded = decoded[0].upper()
  130.     print y, decoded
  131.     answers += [decoded]
  132.     print "progress: [%s]" % ' '.join(answers)
  134. xx = ' '.join(answers)
  135. print xx
  136. xx = xx + " " + postfix[0] + " " + postfix[1]
  137. print xx
  138. r.sendline(xx)
  140. print r.recv()
  141. print r.recv()