add brachiosaure wu

Signed-off-by: Julien CLEMENT <julien.clement@epita.fr>

jujure/static/brachiosaure/check_serial.c

@@ -0,0 +1,14 @@
+uint64_t check_serial(void* user_digest, int64_t serial, int32_t size)
+{
+    void* buff = NULL;
+    int64_t res;
+
+    if (user_digest == NULL || serial == NULL)
+        return 0;
+
+    something_interesting(user_digest, user_digest, &buff, size);
+    res = memcmp(serial, buff, size * size) == 0;
+    free(buff);
+
+    return res;
+}

jujure/static/brachiosaure/dot_product.c

@@ -0,0 +1,49 @@
+uint64_t dot_product(char* A, char* B, char** out, int32_t size)
+{
+    if (A == NULL || B == NULL)
+    {
+        return 0;
+    }
+    int32_t res = 1;
+    int64_t i = 0;
+    int32_t j = 0;
+
+    *out = calloc(size * size, 1);
+
+    while (size > j)
+    {
+        int64_t k = 0;
+        char* A_line = A + i;
+        do
+        {
+            char* B_col = B + k;
+            int64_t col = 0;
+            int32_t sum = 0;
+
+            do
+            {
+                char element;
+                element = A_line[col];
+                element *= B_col[0];
+                col += 1;
+                B_col += size;
+                sum += element;
+            } while (size > col);
+
+            ((*out) + i)[k] = sum; // ith line, kth column
+
+            bool win;
+            if (j != k) // Check if on the diagonal
+                win = sum == 0; // if not check that it is 0
+            else
+                win = sum == 1; // if yes check it is 1
+
+            k += 1;
+            res &= win; // Bitwise and, every number must be correct
+        } while (size > k);
+
+        j += 1;
+        i += size;
+    }
+    return res;
+}

jujure/static/brachiosaure/main.c

@@ -0,0 +1,71 @@
+int32_t main(int32_t argc, char** argv, char** envp) __noreturn
+{
+    int32_t user_status;
+    int32_t serial_status;
+    int32_t status;
+    if (argc == 4)
+    {
+        int32_t user_width = 0;
+        int32_t user_height = 0;
+        void* username_img_data = NULL;
+        void* user_zbar_img = NULL;
+
+        int32_t serial_width = 0;
+        int32_t serial_height = 0;
+        void* serial_img_data = NULL;
+        void* serial_zbar_img = NULL;
+
+        char digest[0x40];
+        strcpy(&digest, argv[1]);
+        void sha512;
+        SHA512_Init(&sha512);
+        SHA512_Update(&sha512, &digest, strlen(argv[1]));
+        SHA512_Final(&digest, &sha512);
+        
+        char qr_data_user[0x40];
+        user_status = get_qr_data(argv[2],
+            &username_img_data,
+            &user_width,
+            &user_height,
+            &user_zbar_img,
+            &qr_data_user,
+            0x40);
+
+        char qr_data_serial[0x40];
+        serial_status = get_qr_data(argv[3],
+            &serial_img_data,
+            &serial_width,
+            &serial_height,
+            &serial_zbar_img,
+            &qr_data_serial,
+            0x40);
+
+        if ((user_status != 0 && serial_status != 0))
+        {
+            char err = (serial_width != user_width)
+                | (serial_height != user_height)
+                | (user_width != user_height)
+                | (memcmp(&digest, &qr_data_user, 0x40) != 0)
+                | (check_serial(&qr_data_user, &qr_data_serial, 8) == 0);
+
+            void* an_interesting_output = NULL;
+            int32_t win = something_interesting(username_img_data, serial_img_data, &an_interesting_output, user_width);
+
+            free(username_img_data);
+            free(serial_img_data);
+            free(an_interesting_output);
+
+            status = ((uint32_t)(err | ((int8_t)win == 0)));
+        }
+    }
+    else
+    {
+        printf("Usage: %s <username> <username.p…", *(int64_t*)argv);
+    }
+    if (((argc != 4 || (argc == 4 && user_status == 0)) || ((argc == 4 && user_status != 0) && serial_status == 0)))
+    {
+        status = 1;
+    }
+    exit(status);
+    /* no return */
+}

jujure/static/brachiosaure/solve_writeup.py

@@ -0,0 +1,192 @@
+#!/usr/bin/env python3
+
+import hashlib
+import qrcode
+from PIL import Image
+import numpy as np
+
+import requests
+
+
+def get_user():
+    r = requests.get("https://brachiosaure.france-cybersecurity-challenge.fr/")
+    name = r.text.split("text-warning\">")[1].split('<')[0]
+    return name
+
+def get_digest(name):
+    m = hashlib.sha512()
+    m.update(name.encode())
+    digest = m.digest()
+    return digest
+
+def linearize_serial(matrix_serial):
+    serial = bytearray()
+
+    for line in matrix_serial:
+        for b in line:
+            serial.append(b % 256)
+    return bytes(serial)
+
+def img_to_matrix(img):
+    array = list(img.getdata())
+    width, height = img.size
+
+    matrix_img = [[array[i * width + j] for j in range(width)] for i in range(height)]
+    return matrix_img
+
+
+def matrix_to_img(mat, path):
+    array = np.uint8(mat)
+    img = Image.fromarray(array)
+    img.save(path)
+
+
+def gen_qrcode(data, path):
+    qr = qrcode.QRCode(version = 1, box_size = 2, border = 2)
+    qr.add_data(data)
+    qr.make()
+    qr_usr = qr.make_image()
+    qr_usr.save(path)
+
+
+
+def identitymatrix(n):
+    return [[int(x == y) for x in range(0, n)] for y in range(0, n)]
+
+
+
+def get_flag(name):
+    files = {
+        "upload1": open(f"{name}_usr.png", "rb"),
+        "upload2": open(f"{name}_serial.png", "rb")
+    }
+    r = requests.post("https://brachiosaure.france-cybersecurity-challenge.fr/login", files=files)
+    for line in r.text.split('\n'):
+        if "FCSC{" in line:
+            print(line)
+
+
+name = get_user()
+digest = get_digest(name)
+
+matrix_usr = [[digest[i * 8 + j] for j in range(8)] for i in range(8)]
+matrix_usr = np.array(matrix_usr)
+
+matrix_serial = np.dot(matrix_usr, matrix_usr)
+serial = linearize_serial(matrix_serial)
+
+
+gen_qrcode(digest, "user.png")
+gen_qrcode(serial, "serial.png")
+
+
+img_usr = Image.open("./user.png", "r")
+img_serial = Image.open("./serial.png", "r")
+
+matrix_img_usr = img_to_matrix(img_usr)
+matrix_img_serial = img_to_matrix(img_serial)
+
+
+def invert(usr, serial):
+    # Add empty and identity matrices to maka it invetible
+    usr = make_invertible(usr)
+    serial = make_invertible(serial)
+
+    n = len(usr)
+    # Total size after redimensionning
+    new_n = n * 2
+
+    # The magic inversion by swapping corners and computing matrix opposite
+    usr_inv = invert_magic(usr)
+    serial_inv = invert_magic(serial)
+
+    # Will hold the final user png
+    new_usr = []
+    # Will hold the final serial png
+    new_serial = []
+
+
+    # Create the new_usr
+    for i in range(new_n):
+        line = [0] * new_n
+        if i < n:
+            for j in range(n):
+                line[j] = usr[i][j]
+        if i >= n:
+            for j in range(n):
+                line[j + n] = int(serial_inv[i - n][j])
+        new_usr.append(line)
+
+
+    # Create the new_serial
+    for i in range(new_n):
+        line = [0] * new_n
+        if i < n:
+            for j in range(n):
+                line[j] = int(usr_inv[i][j])
+        if i >= n:
+            for j in range(n):
+                line[j + n] = serial[i - n][j]
+        new_serial.append(line)
+
+
+    return new_usr, new_serial
+
+
+def make_invertible(mat):
+    res = []
+    n = len(mat)
+    ident = identitymatrix(n)
+
+    # Add the identity matrix below the original
+    for line in ident:
+        mat.append(line)
+
+
+    for i in range(len(mat)):
+        line = mat[i]
+        for j in range(n):
+            # Add the identity matrix at the right of the original
+            if i < n:
+                line.append(ident[i][j])
+            # Add the empty matrix at the bottom right corner
+            else:
+                line.append(0)
+
+    return mat
+
+
+def invert_magic(mat):
+    n_tot = len(mat)
+    n = n_tot // 2
+
+    #Create a new empty matrix to hold the result
+    res = [[0 for _ in range(n)] for _ in range(n)]
+
+    ident = identitymatrix(n)
+
+    # Add the identity matrix below
+    for line in ident:
+        res.append(line)
+
+
+    for i in range(len(mat)):
+        line = res[i]
+        for j in range(n):
+            # Identity matrix on the right
+            if i < n:
+                line.append(ident[i][j])
+
+            # Oposite of the original in the bottom right corner
+            else:
+                el = -mat[i - n][j] % 256
+                line.append(el)
+
+    return res
+
+res_usr, res_serial = invert(matrix_img_usr, matrix_img_serial)
+
+matrix_to_img(res_usr, f"{name}_usr.png")
+matrix_to_img(res_serial, f"{name}_serial.png")
+
+get_flag(name)