Rock Paper Scissors — Daily AlpacaHack

code/game.py

import random

FLAG = "Alpaca{REDACTED}"
HANDS = ["r", "p", "s"]
ROUNDS = 1000
TARGET_WIN = int(ROUNDS * 0.6)

def shuffle(items):
    return sorted(items, key=lambda _: random.getrandbits(1))

print("ROCK PAPER SCISSORS GAME")
print(f"Win {TARGET_WIN} times in {ROUNDS} rounds.")
print("Hands: r / p / s")

win = 0
hands = HANDS[:]
for i in range(ROUNDS):
    hands = shuffle(hands)
    opponent = hands[0]
    you = input(f"Round {i+1} > ").strip()
    assert you in HANDS, "Invalid hand."
    result = (HANDS.index(you) - HANDS.index(opponent)) % 3
    win += (result == 1)

    print(f"Opponent: {opponent}, You: {you}")
    print(["Draw", "Win!", "Lose..."][result])
    print(f"Win count: {win}\\n")

if win >= TARGET_WIN:
    print(f"Wow, you broke the game ... Flag: {FLAG}")
else:
    print("Leave the game.")

🤔

• 実験すると、なんかこいつ同じ手をよく出すことがわかる
• sorted は安定ソート
  • 各手の key に 0か1 が割り振られるが、現在の手 (hands[0]) がもう一度出るパターンは以下
    • hands[0] の key に 0 が割り振られる
    • hands[0] の key に 1 が割り振られて、ほかの key がすべて1
    • これは確率が 1/2 + 1/8 = 5/8
    • これは、プログラムに要求されている条件である、勝つ割合 0.6 を上回る
      • ので、まぁまぁの確率で条件を達成できる

solve

from pwn import *

IP = '192.168.1.1' # 書いてね
PORT = 10000

WINNING_HAND = {
    'r': 'p',  # グーにはパー
    'p': 's',  # パーにはチョキ
    's': 'r'   # チョキにはグー
}
next_hand = 'p'

io = remote(IP, PORT)

for i in range(1000):
    io.recvuntil(f"Round {i+1} > ".encode())
    io.sendline(next_hand.encode())
    response = io.recvline().decode()
    opponent_hand = response.split("Opponent: ")[1][0]
    next_hand = WINNING_HAND[opponent_hand]
    print(i)

io.interactive()

以下を得る

99
[*] Switching to interactive mode
Lose...
Win count: 606

Wow, you broke the game ... Flag: Alpaca{REDACTED}
[*] Got EOF while reading in interactive