ringzer0team和wechall部分计算题

1、ringzer0team coding challenge 15：I saw a little elf

题目每次随机生成一段长度不一的代码，经过一系列base64解码后得到ELF文件（长度固定为8192字节），逆向得到字符串的具体位置，2秒内提交即可。代码如下：

import urllib2
import hashlib
import struct
import base64
import time
from bs4 import BeautifulSoup

#d=x[0x5E6:0x5EA]+x[0x5EE:0x5F0]

def OpenUrl_GetCode():

Request = urllib2.build_opener()
Request.addheaders.append(('Cookie' , 'cookievalue'))
RingZero = Request.open('http://ringzer0team.com/challenges/15')
Binary = BeautifulSoup(str(RingZero.readlines()),'lxml' )#, 'lxml'
Binary = Binary.find('div' , {'class' :'message'})
Binary = Binary.get_text()
Binary = Binary.replace('----- BEGIN Elf Message -----' , '').replace('----- End Elf Message -----' , '')
Binary = Binary[24:-24]
print len(Binary)
return Binary

def Convert_To_Elf_Bytes(Code):
Code1=Code
len1=len(Code)
count=0
try:
while True:
Code1=base64.b64decode(Code1)
len1=len1*3/4
if(len1<10000):
break
count+=1
except:
#print count
print 'Error'
print count
Str=bytearray(Code1[::-1])
f=open('elf1','wb')
f.write(Str)
f.close()
return Str

def GetCode(bytesdata):
byteArrayed=bytesdata[0x5E6:0x5EA]+bytesdata[0x5EE:0x5F0]
str1=[]
for i in byteArrayed:
str1.append(chr(i))

return ''.join(str1)

def Send(Code):
Request = urllib2.build_opener()
Request.addheaders.append(('Cookie' , 'cookievalue'))
RingZero = Request.open('http://ringzer0team.com/challenges/15/%s' % Code)
Bs = BeautifulSoup(str(RingZero.readlines()) , 'lxml')
#text=Bs.get_text()
#print text[:900].encode('utf-8')
#print Bs.contents[0]
Flag = Bs.find('div' , {'class' : 'alert alert-info'})
alert = Bs.find('div' , {'class' : 'alert alert-danger'})

if Flag!=None:
print(Flag.get_text())
#else:
#print alert.get_text()
return Flag

if __name__ == "__main__":
for i in xrange(1):
Code = OpenUrl_GetCode()

#print(Code)
ElfCode = Convert_To_Elf_Bytes(Code)
#print ElfCode
Code = GetCode(ElfCode)
print(Code)
flag=Send(Code)
if flag!=None:
break

2、wechall math challenge ：FlowOverAstronomy

题目每次随机生成字串和等式，求解等式并按要求生成结果

Charset: A@sOqpuSW}{[VbfhtP70E_klG4neDg3wvIa5JLZxF6YoM1rKzN8jU#2]TimdyXHQ9BRcC   使用的字符串依次代表0，1，2...
Input Base: 53 （53进制）
Solution Base: 9 (输出为9进制)
Timelimit: 3.1416 seconds （限定时间）

要计算的等式为：

sAabq * sAeUI * @WW3D * @Z00V * bbEM * sqaSu * @Dx0D * spJEV * rf1a * @8_r * skuV * @FA61 * O[kK * @1Kj * @FUsV * SLxv * @Zs@{ * 14SM * @NJA_ * @w_hw * hDlp * @fUb7 * qJMz+ @fIJg

代码如下：

import urllib2
import hashlib
import struct
import base64
import time
from bs4 import BeautifulSoup

def OpenUrl_GetCode():

Request = urllib2.build_opener()
Request.addheaders.append(('Cookie' , 'cookievalue'))
RingZero = Request.open('http://www.wechall.net/challenge/anto/FlowOverAstronomy/index.php')
Binary = BeautifulSoup(str(RingZero.readlines()),'lxml' )#, 'lxml'
Binary1 = Binary.find('div' , {'id' :'page'})
x=Binary1.get_text()
print x
result=[]
n1=x.find('Charset:')+len('Charset: ')
n2=x.find('Input Base: ')
charset=x[n1:n2]
result.append(charset)
n3=x.find('Solution Base: ')
base1=int(x[n2+12:n3])
result.append(base1)
n4=x.find('Timelimit: ')
base2=int(x[n3+15:n4])
result.append(base2)

n1=x.find("Equation\\n', '\\")
n2=x.find("\\n'",n1+20)
equa=x[n1+len("Equation\\n', '\\"):n2]
equa=equa[1:]
result.append(equa)

return result

def GetCode(a,b,base1,base2):

c=b.split(' * ')
bb=c[-1].split(' + ')
c[-1]=bb[0]
c.append(bb[1])

x={}
for i,ch in enumerate(a):
x[ch]=i

y={}
for i,ch in enumerate(a):
y[i]=ch

nums=[]

for n in c:
num=0
for i in n:
num=num*base1+x[i]
nums.append(num)

result=1
for i,nu in enumerate(nums):
if i==len(nums)-1:
result+=nu
else:
result*=nu

temp=[]
while result!=0:
temp.append(result%base2)
result/=base2

str=''
for j in temp[::-1]:
str+=y[j]

return str

def Send(Code):
Request = urllib2.build_opener()
Request.addheaders.append(('Cookie' , 'cookievalue'))
RingZero = Request.open('http://www.wechall.net/challenge/anto/FlowOverAstronomy/index.php?answer=%s&action=Submit' % Code)
print 'http://www.wechall.net/challenge/anto/FlowOverAstronomy/index.php?action=Submit&answer=%s' % Code
Bs = BeautifulSoup(str(RingZero.readlines()) , 'lxml')
text=Bs.get_text()
print text[:-1].encode('utf-8')
#print Bs.contents[0]

if __name__ == "__main__":

result = OpenUrl_GetCode()

#print(Code)

#print ElfCode
charset=result[0]
base1=result[1]
base2=result[2]
equa=result[3]
print base1,base2,charset,equa
Code = GetCode(charset,equa,base1,base2)
print(Code)
Send(Code)