Nullcon 2020 - dora

dora.py

import cv2 as cv
import numpy as np

def test(method = (cv.TM_CCOEFF)):
    img = cv.imread('input.png', 0)
    fill_color = img[0, 0]

    width, height = img.shape[:2]

    fill_color = int(fill_color)

    img2 = img.copy()

    # All the 6 methods for comparison in a list
    methods = ['cv.TM_CCOEFF', 'cv.TM_CCOEFF_NORMED', 'cv.TM_CCORR',
                'cv.TM_CCORR_NORMED', 'cv.TM_SQDIFF', 'cv.TM_SQDIFF_NORMED']

    img = img2.copy()
    img3 = img2.copy()
    # Apply template Matching
    # reference: https://docs.opencv.org/master/d4/dc6/tutorial_py_template_matching.html

    for t in range(10):
        template = cv.imread('tmpl%d.png' % t, 0)
        w, h = template.shape[::-1]
        res = cv.matchTemplate(img3,template,method)
        min_val, max_val, min_loc, max_loc = cv.minMaxLoc(res)
        # If the method is TM_SQDIFF or TM_SQDIFF_NORMED, take minimum
        if method in [cv.TM_SQDIFF, cv.TM_SQDIFF_NORMED]:
            top_left = min_loc
        else:
            top_left = max_loc
        bottom_right = (top_left[0] + w, top_left[1] + h)
        cv.rectangle(img,top_left, bottom_right, (fill_color, fill_color, fill_color), -1)
        cv.rectangle(img,top_left, bottom_right, (fill_color, fill_color, fill_color), 40)


    x = 0
    y = 0
    max_diff = 0

    for yy in range(0, height):
        for xx in range(0, width):
            if abs(int(img[yy, xx]) - fill_color) > max_diff:
                x = xx
                y = yy
                max_diff = abs(int(img[yy, xx]) - fill_color)
                break
    cv.rectangle(img, (x-10,y-10), (x+10, y+10), (0, 0, 0), 3)
    cv.imwrite('output.png', img)
    # 1 for upper right, 2 for upper left, 3 for lower left, 4 for lower right

    if x < 10 and y < 10:
        return test(cv.TM_SQDIFF)

    if y < height/2:
        if x > width/2:
            return('1')
        else:
            return('2')
    else:
        if x > width/2:
            return('4')
        else:
            return('3')

#test()
#exit(0)

from pwn import *

conn = remote('misc.ctf.nullcon.net', 8000)

r = conn.recvline()
print(r)

while True:
    r = conn.recvline()
    if 'No flag' in r:
        print(r)
        break
    elif len(r) > 100:
        import base64
        open('input.png', 'wb').write(base64.b64decode(r))
    else:
        print(r)
        break
    #print(r)
    print(conn.recvline().strip())
    t = test()

    print('checking ... %s' % t)

    conn.sendline(t)
conn.close()