Guild icon
Project Sekai
🔒 UIUCTF 2023 / ✅-misc-schrodingers-cat
Avatar
Schrodinger's Cat - 500 points
Category: Misc Description: Our boss got mad that our SSH keys were weak, so now we're using a quantum computer to be extra secure! nc schrodingers-cat.chal.uiuc.tf 1337 author: George Files:Tags: No tags.
Sutx pinned a message to this channel. 07/01/2023 11:06 AM
Avatar
$ nc schrodingers-cat.chal.uiuc.tf 1337 == proof-of-work: disabled == Hello, world! Welcome to the Quantum Secure Shell. Instead of dealing with pesky encryption, just embed your commands into our quantum computer! I batched the next command in with yours, hope you're ok with that! ┌─────────────────┐┌───────────────────────┐ q_0: ┤0 ├┤0 ├ │ ││ │ q_1: ┤1 ├┤1 ├ │ ││ │ q_2: ┤2 Your Circ Here ├┤2 echo 'Hello, world!' ├ │ ││ │ q_3: ┤3 ├┤3 ├ │ ││ │ q_4: ┤4 ├┤4 ├ └─────────────────┘└───────────────────────┘ Normalization constant: 419.1873089681986 Executing... Please type your OpenQASM circuit as a base64 encoded string:
11:07
There are known bugs in OpenQASM transpilation — please use Qiskit, and optimize your circuit before serialization. Shendefraude? Bullocks I say! You're way off the Markov.
Avatar
@Violin wants to collaborate 🤝
Avatar
no idea about this
Avatar
added source code for schrodinger's cat
12:33
#!/usr/bin/env python3 from os import system from base64 import b64decode import numpy as np from qiskit import QuantumCircuit import qiskit.quantum_info as qi from qiskit.circuit.library import StatePreparation WIRES = 5 def normalization(msg): assert(len(msg) <= WIRES**2) state = np.array([ord(c) for c in msg.ljust(2**WIRES, ' ')]) norm = np.linalg.norm(state) state = state / norm return (state, norm) def transform(sv, n): legal = lambda c: ord(' ') <= c and c <= ord('~') renormalized = [float(i.real)*n for i in sv] rn_rounded = [round(i) for i in renormalized] if not np.allclose(renormalized, rn_rounded, rtol=0, atol=1e-2): print("Your rehydrated statevector isn't very precise. Try adding at least 6 decimal places of precision, or contact the challenge author if you think this is a mistake.") print(rn_rounded) exit(0) if np.any([not legal(c) for c in rn_rounded]): print("Invalid ASCII characters.") exit(0) return ''.join([chr(n) for n in rn_rounded]) def make_circ(sv, circ): qc = QuantumCircuit(WIRES) qc.append(circ.to_instruction(), range(WIRES)) sp = QuantumCircuit(WIRES, name="echo 'Hello, world!'") sp.append(StatePreparation(sv), range(WIRES)) qc.append(sp.to_instruction(), range(WIRES)) return qc def print_given(sv, n): placeholder = QuantumCircuit(WIRES, name="Your Circ Here") placeholder.i(0) circ = make_circ(sv, placeholder) print(circ.draw(style={ "displaytext": { "state_preparation": "<>" } })) new_sv = qi.Statevector.from_instruction(circ) print(f'Normalization constant: {n}') print("\nExecuting...\n") system(transform(new_sv, n)) def main(): print("Welcome to the Quantum Secure Shell. Instead of dealing with pesky encryption, just embed your commands into our quantum computer! I batched the next command in with yours, hope you're ok with that!") given_sv, given_n = normalization("echo 'Hello, world!'") print_given(given_sv, given_n) try: qasm_str = b64decode(input("\nPlease type your OpenQASM circuit as a base64 encoded string: ")).decode() except: print("Error decoding b64!") exit(0) try: circ = QuantumCircuit.from_qasm_str(qasm_str) circ.remove_final_measurements(inplace=True) except: print("Error processing OpenQASM file! Try decomposing your circuit into basis gates using `transpile`.") exit(0) if circ.num_qubits != WIRES: print(f"Your quantum circuit acts on {circ.num_qubits} instead of {WIRES} qubits!") exit(0) try: norm = float(input("Please enter your normalization constant (precision matters!): ")) except: print("Error processing normalization constant!") exit(0) try: sv_circ = make_circ(given_sv, circ) except: print("Circuit runtime error!") exit(0) print(sv_circ.draw()) command = transform(qi.Statevector.from_instruction(sv_circ), norm) print("\nExecuting...\n") system(command) if __name__ == "__main__": main()
Avatar
@unpickled admin bot wants to collaborate 🤝
Avatar
unpickled admin bot 07/01/2023 1:21 PM
so basically
13:21
looking at this
13:22
the entire idea is our commands starting statevector is the last circuits (hello worlds) ending statevector
13:22
as can be seen by:
13:22
given_sv, given_n = normalization("echo 'Hello, world!'") ... sv_circ = make_circ(given_sv, circ)
Avatar
Avatar
sahuang
$ nc schrodingers-cat.chal.uiuc.tf 1337 == proof-of-work: disabled == Hello, world! Welcome to the Quantum Secure Shell. Instead of dealing with pesky encryption, just embed your commands into our quantum computer! I batched the next command in with yours, hope you're ok with that! ┌─────────────────┐┌───────────────────────┐ q_0: ┤0 ├┤0 ├ │ ││ │ q_1: ┤1 ├┤1 ├ │ ││ │ q_2: ┤2 Your Circ Here ├┤2 echo 'Hello, world!' ├ │ ││ │ q_3: ┤3 ├┤3 ├ │ ││ │ q_4: ┤4 ├┤4 ├ └─────────────────┘└───────────────────────┘ Normalization constant: 419.1873089681986 Executing... Please type your OpenQASM circuit as a base64 encoded string:
unpickled admin bot 07/01/2023 1:24 PM
tho unless im wrong this is backwards :thonk:? that implies that echo 'Hello, World' will have the statevector (sv) from the final sv of your circ, not vice versa
Avatar
i have no idea about the circuit part, end goal we may need to execute some command right? like sh or whatever
13:25
the echo one seems like a placeholder
Avatar
unpickled admin bot 07/01/2023 1:26 PM
no, the echo is batched with ours
13:26
i.e
13:26
our circuit needs to use the ending sv of the echo command
13:26
to run sh
Avatar
unpickled admin bot 07/01/2023 1:28 PM
i think
13:30
hold on isnt it really consistent?
13:30
def normalization(msg): assert(len(msg) <= WIRES**2) state = np.array([ord(c) for c in msg.ljust(2**WIRES, ' ')]) norm = np.linalg.norm(state) state = state / norm return (state, norm) we know the msg, and hence the state and norm?
Avatar
yeah
13:31
can run it locally right
Avatar
unpickled admin bot 07/01/2023 1:31 PM
ye
Avatar
Avatar
sahuang
$ nc schrodingers-cat.chal.uiuc.tf 1337 == proof-of-work: disabled == Hello, world! Welcome to the Quantum Secure Shell. Instead of dealing with pesky encryption, just embed your commands into our quantum computer! I batched the next command in with yours, hope you're ok with that! ┌─────────────────┐┌───────────────────────┐ q_0: ┤0 ├┤0 ├ │ ││ │ q_1: ┤1 ├┤1 ├ │ ││ │ q_2: ┤2 Your Circ Here ├┤2 echo 'Hello, world!' ├ │ ││ │ q_3: ┤3 ├┤3 ├ │ ││ │ q_4: ┤4 ├┤4 ├ └─────────────────┘└───────────────────────┘ Normalization constant: 419.1873089681986 Executing... Please type your OpenQASM circuit as a base64 encoded string:
unpickled admin bot 07/01/2023 1:35 PM
i got a diff normalization constant :thonk:
Avatar
maybe its after they restart or whatever
13:36
try local vs remote
Avatar
unpickled admin bot 07/01/2023 1:37 PM
no im a fucking idiot
13:37
i did "hello world"
13:37
not echo 'Hello, world!' (edited)
13:37
so in theory the challenge should just be
13:37
given the starting statevector of
13:38
array([0.24094241, 0.23617127, 0.24809911, 0.26479809, 0.07633819, 0.09303717, 0.17176093, 0.24094241, 0.25764139, 0.25764139, 0.26479809, 0.10496501, 0.07633819, 0.28388264, 0.26479809, 0.2719548 , 0.25764139, 0.23855684, 0.07872376, 0.09303717, 0.07633819, 0.07633819, 0.07633819, 0.07633819, 0.07633819, 0.07633819, 0.07633819, 0.07633819, 0.07633819, 0.07633819, 0.07633819, 0.07633819]) (edited)
13:38
exec sh
Avatar
whats the middle ops
13:38
its math problem?
Avatar
unpickled admin bot 07/01/2023 1:38 PM
what middle ops?
Avatar
Avatar
unpickled admin bot
exec sh
like how
Avatar
unpickled admin bot 07/01/2023 1:39 PM
good question
Avatar
how it converts to sh
Avatar
unpickled admin bot 07/01/2023 1:39 PM
working on it
Avatar
i gtg, be back at night
Avatar
Avatar
sahuang
#!/usr/bin/env python3 from os import system from base64 import b64decode import numpy as np from qiskit import QuantumCircuit import qiskit.quantum_info as qi from qiskit.circuit.library import StatePreparation WIRES = 5 def normalization(msg): assert(len(msg) <= WIRES**2) state = np.array([ord(c) for c in msg.ljust(2**WIRES, ' ')]) norm = np.linalg.norm(state) state = state / norm return (state, norm) def transform(sv, n): legal = lambda c: ord(' ') <= c and c <= ord('~') renormalized = [float(i.real)*n for i in sv] rn_rounded = [round(i) for i in renormalized] if not np.allclose(renormalized, rn_rounded, rtol=0, atol=1e-2): print("Your rehydrated statevector isn't very precise. Try adding at least 6 decimal places of precision, or contact the challenge author if you think this is a mistake.") print(rn_rounded) exit(0) if np.any([not legal(c) for c in rn_rounded]): print("Invalid ASCII characters.") exit(0) return ''.join([chr(n) for n in rn_rounded]) def make_circ(sv, circ): qc = QuantumCircuit(WIRES) qc.append(circ.to_instruction(), range(WIRES)) sp = QuantumCircuit(WIRES, name="echo 'Hello, world!'") sp.append(StatePreparation(sv), range(WIRES)) qc.append(sp.to_instruction(), range(WIRES)) return qc def print_given(sv, n): placeholder = QuantumCircuit(WIRES, name="Your Circ Here") placeholder.i(0) circ = make_circ(sv, placeholder) print(circ.draw(style={ "displaytext": { "state_preparation": "<>" } })) new_sv = qi.Statevector.from_instruction(circ) print(f'Normalization constant: {n}') print("\nExecuting...\n") system(transform(new_sv, n)) def main(): print("Welcome to the Quantum Secure Shell. Instead of dealing with pesky encryption, just embed your commands into our quantum computer! I batched the next command in with yours, hope you're ok with that!") given_sv, given_n = normalization("echo 'Hello, world!'") print_given(given_sv, given_n) try: qasm_str = b64decode(input("\nPlease type your OpenQASM circuit as a base64 encoded string: ")).decode() except: print("Error decoding b64!") exit(0) try: circ = QuantumCircuit.from_qasm_str(qasm_str) circ.remove_final_measurements(inplace=True) except: print("Error processing OpenQASM file! Try decomposing your circuit into basis gates using `transpile`.") exit(0) if circ.num_qubits != WIRES: print(f"Your quantum circuit acts on {circ.num_qubits} instead of {WIRES} qubits!") exit(0) try: norm = float(input("Please enter your normalization constant (precision matters!): ")) except: print("Error processing normalization constant!") exit(0) try: sv_circ = make_circ(given_sv, circ) except: print("Circuit runtime error!") exit(0) print(sv_circ.draw()) command = transform(qi.Statevector.from_instruction(sv_circ), norm) print("\nExecuting...\n") system(command) if __name__ == "__main__": main()
unpickled admin bot 07/01/2023 1:39 PM
@sahuang just clarifying, unless im blind given_n isnt used after print_given(given_sv, given_n) right
13:39
o
13:39
ok
Avatar
maybe ask Utaha in too
13:40
he is good at LA
Avatar
unpickled admin bot 07/01/2023 1:40 PM
alr
13:40
ponged in #uiuctf-2023-general
Avatar
@jayden wants to collaborate 🤝
Avatar
unpickled admin bot 07/01/2023 1:45 PM
hi jayden!
13:45
array([115, 104, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32])
13:46
target array
13:46
now actually
13:46
we could make it a much easier problem by simply making a comment the 3rd element
13:47
that way the problem is making 3 values, instead of all of them
13:47
a ; would work too
13:48
array([115, 104, 35, idgaf....]) new target ig
13:53
question
13:53
can we not turn this into a 0 state
13:53
by measuring it? (edited)
13:53
if we measure all 5, qiskit should collapse the entire statevector into 0s
13:53
hold on imma test that
Avatar
@Utaha wants to collaborate 🤝
Avatar
unpickled admin bot 07/01/2023 1:57 PM
hi
13:57
tldr, our circuit starts with a known statevector
13:57
and we need to create a quantum circ such that the final is the final/target statevector (of sh#) (edited)
13:58
sh# is much easier than sh, but we still need everything to be in the ascii range
13:58
rn im working on 0ing the entire state
Avatar
Avatar
sahuang
he is good at LA
😅
😂 1
Avatar
Avatar
unpickled admin bot
rn im working on 0ing the entire state
unpickled admin bot 07/01/2023 2:00 PM
in theory if we can 0 the entire state
14:00
we can just get our new statevector added
14:01
the idea to 0 is p much
14:01
measure
14:01
the qubit will collapse to a [0, 0]
14:01
measuring all 5 in theory should let me 0 the entire statevector
Avatar
Avatar
unpickled admin bot
the idea to 0 is p much
unpickled admin bot 07/01/2023 2:02 PM
qasm of that example OPENQASM 2.0; include "qelib1.inc"; qreg q[1]; creg c[1]; h q[0]; measure q[0] -> c[0]; h q[0];
14:03
then in theory
14:03
we can just apply (somehow) the target statevector
14:04
(maybe we have to x everything first, not sure off the top of my head)
Avatar
Avatar
unpickled admin bot
we can just apply (somehow) the target statevector
unpickled admin bot 07/01/2023 2:04 PM
probably by converting the target sv to a gate (edited)
14:04
then win?
14:06
btw the reason why this cheese works
14:06
even though it looks like i dont have any classical bits
14:06
is the check is if circ.num_qubits != WIRES
14:06
only qubits are checked, not classical (edited)
14:07
so trying ┌─┐ q_0: ┤M├──────────── └╥┘┌─┐ q_1: ─╫─┤M├───────── ║ └╥┘┌─┐ q_2: ─╫──╫─┤M├────── ║ ║ └╥┘┌─┐ q_3: ─╫──╫──╫─┤M├─── ║ ║ ║ └╥┘┌─┐ q_4: ─╫──╫──╫──╫─┤M├ ║ ║ ║ ║ └╥┘ c: 1/═╩══╩══╩══╩══╩═ 0 0 0 0 0
14:08
oh wait theres an implicit check
14:08
ASICOJAsdoicjaisodadca thats annoying
14:09
ok we can still measure all
14:10
>>> circ = QuantumCircuit(WIRES) >>> circ.measure_all() >>> circ.draw() ░ ┌─┐ q_0: ─░─┤M├──────────── ░ └╥┘┌─┐ q_1: ─░──╫─┤M├───────── ░ ║ └╥┘┌─┐ q_2: ─░──╫──╫─┤M├────── ░ ║ ║ └╥┘┌─┐ q_3: ─░──╫──╫──╫─┤M├─── ░ ║ ║ ║ └╥┘┌─┐ q_4: ─░──╫──╫──╫──╫─┤M├ ░ ║ ║ ║ ║ └╥┘ meas: 5/════╩══╩══╩══╩══╩═ 0 1 2 3 4 >>> smthng like this maybe
14:10
no qreg
Avatar
Avatar
unpickled admin bot
>>> circ = QuantumCircuit(WIRES) >>> circ.measure_all() >>> circ.draw() ░ ┌─┐ q_0: ─░─┤M├──────────── ░ └╥┘┌─┐ q_1: ─░──╫─┤M├───────── ░ ║ └╥┘┌─┐ q_2: ─░──╫──╫─┤M├────── ░ ║ ║ └╥┘┌─┐ q_3: ─░──╫──╫──╫─┤M├─── ░ ║ ║ ║ └╥┘┌─┐ q_4: ─░──╫──╫──╫──╫─┤M├ ░ ║ ║ ║ ║ └╥┘ meas: 5/════╩══╩══╩══╩══╩═ 0 1 2 3 4 >>> smthng like this maybe
unpickled admin bot 07/01/2023 2:11 PM
nvm this also implies a classical register
14:11
or wait reset?
Avatar
uh idk if I can help on this challenge
Avatar
unpickled admin bot 07/01/2023 2:12 PM
ok got 0s
Avatar
Avatar
Utaha
uh idk if I can help on this challenge
unpickled admin bot 07/01/2023 2:12 PM
o
14:12
uhuhuh
14:12
:<
Avatar
why are the states real numbers not complex
Avatar
unpickled admin bot 07/01/2023 2:12 PM
theyre matrixes
14:12
think of it like this ig
14:13
you can represent 1 qubit as:
14:13
[0,0]
14:13
which is a 2 dimensional vector (complex num)
Avatar
yeah one for real part, one for complex, right?
14:13
and gates are matrices
Avatar
Avatar
Utaha
yeah one for real part, one for complex, right?
unpickled admin bot 07/01/2023 2:14 PM
ye
14:15
oh like wheres the complex part in the sv?
14:15
theyre all [smthng,0]
Avatar
oh idk lol
14:18
if you perform some gates then the complex part will be non-zero, right?
Avatar
unpickled admin bot 07/01/2023 2:22 PM
depends on which
Avatar
Avatar
sahuang
$ nc schrodingers-cat.chal.uiuc.tf 1337 == proof-of-work: disabled == Hello, world! Welcome to the Quantum Secure Shell. Instead of dealing with pesky encryption, just embed your commands into our quantum computer! I batched the next command in with yours, hope you're ok with that! ┌─────────────────┐┌───────────────────────┐ q_0: ┤0 ├┤0 ├ │ ││ │ q_1: ┤1 ├┤1 ├ │ ││ │ q_2: ┤2 Your Circ Here ├┤2 echo 'Hello, world!' ├ │ ││ │ q_3: ┤3 ├┤3 ├ │ ││ │ q_4: ┤4 ├┤4 ├ └─────────────────┘└───────────────────────┘ Normalization constant: 419.1873089681986 Executing... Please type your OpenQASM circuit as a base64 encoded string:
unpickled admin bot 07/01/2023 2:22 PM
also i was wrong, it is quite literally your circuit there
14:22
which is so annoying
14:22
but also still doable
14:23
basically now what we need instead is
14:23
consider the sv as X
14:23
our circuit's end sv as A
14:23
and target as T
14:23
A*X = T
14:23
hence A = T*(X^-1)
14:24
then we can use qi.Operator to create a custom gate that does that
Avatar
Avatar
unpickled admin bot
hence A = T*(X^-1)
unpickled admin bot 07/01/2023 2:24 PM
@Utaha do you know how to find these?
14:24
just ignoring the quantum and focusing on the matrixes?
Avatar
are you trying to find the sv, so that after applying "echo hello world" becomes "sh#"?
14:29
I can't distinguish vector and matrices lol
14:29
seems like both A and X are vectors, but you multiply them together
Avatar
Avatar
Utaha
seems like both A and X are vectors, but you multiply them together
unpickled admin bot 07/01/2023 2:35 PM
statevectors are vectors mb
14:35
but ye basically that
14:36
i.e i need to find the A such that A*X cancels out
Avatar
unpickled admin bot 07/01/2023 2:44 PM
prob worth clarify
14:45
T and X are vectors
14:45
A is meant to be a matrix
Avatar
oh then there are many choices of A
14:51
assuming both X and T has dimension n * 1
14:51
so A has dimension n * n
14:52
A hsa degree of freedom n^2, and AX=T gives n constraints
Avatar
seems easy to get A given X and T, was that the goal? all numbers float?
Avatar
Avatar
sahuang
seems easy to get A given X and T, was that the goal? all numbers float?
unpickled admin bot 07/01/2023 2:57 PM
float or complex
Avatar
Avatar
Utaha
oh then there are many choices of A
unpickled admin bot 07/01/2023 2:58 PM
uhhhh how 2 get lol
14:59
potentially the easiest way to config the qubits how we want
15:00
15:00
not the nicest qasm though
Avatar
Avatar
unpickled admin bot
uhhhh how 2 get lol
list n equations and solve? if you have the 2 vectors
Avatar
unpickled admin bot 07/01/2023 3:08 PM
15:08
ok applying ^ will reverse the final state
15:09
hence i just need to apply the target statevector
15:10
c = QuantumCircuit(5) c.prepare_state(sv, c.qubits) r = c.reverse_ops()
15:11
ok thats finicky
15:11
but those cmds should give you the reverse op
15:12
now i just need to apply the target statevector
15:12
(probably)
Avatar
unpickled admin bot 07/01/2023 3:25 PM
something like this could work
15:25
15:28
didnt work :< (locally) (edited)
15:33
>>> qi.Statevector.from_instruction(make_circ(sv, r2)) Statevector([ 4.28352340e-05+0.j, 2.14154752e-03+0.j, 6.62748517e-04+0.j, -2.93891389e-02+0.j, -2.41863750e-03+0.j, 2.73279121e-02+0.j, 9.16630608e-03+0.j, -5.82482281e-02+0.j, 9.54416919e-05+0.j, 9.54416919e-03+0.j, 4.52009584e-02+0.j, 1.01763150e-01+0.j, 4.52047920e-02+0.j, -8.03047345e-02+0.j, -1.86999633e-03+0.j, 5.61073698e-01+0.j, 2.07398158e-03+0.j, 4.27799850e-02+0.j, -7.10493666e-03+0.j, 9.69662378e-02+0.j, -5.54573217e-05+0.j, -5.54573217e-03+0.j, 1.52421726e-03+0.j, 1.52421726e-01+0.j, -6.06735492e-05+0.j, -6.06735492e-03+0.j, 1.66758271e-03+0.j, 1.66758271e-01+0.j, -2.80856987e-04+0.j, -2.80856987e-02+0.j, 7.71921638e-03+0.j, 7.71921638e-01+0.j], dims=(2, 2, 2, 2, 2)) >>>
15:33
my r2 seems close to correct
15:33
like i suppose at worst its ~0.7 off
15:33
but the ending doesnt matter as much
15:33
and a 0.002 error seems ok?
Avatar
Avatar
unpickled admin bot
>>> qi.Statevector.from_instruction(make_circ(sv, r2)) Statevector([ 4.28352340e-05+0.j, 2.14154752e-03+0.j, 6.62748517e-04+0.j, -2.93891389e-02+0.j, -2.41863750e-03+0.j, 2.73279121e-02+0.j, 9.16630608e-03+0.j, -5.82482281e-02+0.j, 9.54416919e-05+0.j, 9.54416919e-03+0.j, 4.52009584e-02+0.j, 1.01763150e-01+0.j, 4.52047920e-02+0.j, -8.03047345e-02+0.j, -1.86999633e-03+0.j, 5.61073698e-01+0.j, 2.07398158e-03+0.j, 4.27799850e-02+0.j, -7.10493666e-03+0.j, 9.69662378e-02+0.j, -5.54573217e-05+0.j, -5.54573217e-03+0.j, 1.52421726e-03+0.j, 1.52421726e-01+0.j, -6.06735492e-05+0.j, -6.06735492e-03+0.j, 1.66758271e-03+0.j, 1.66758271e-01+0.j, -2.80856987e-04+0.j, -2.80856987e-02+0.j, 7.71921638e-03+0.j, 7.71921638e-01+0.j], dims=(2, 2, 2, 2, 2)) >>>
unpickled admin bot 07/01/2023 3:54 PM
no the precision is killing me
15:54
these need to be p much exactly 0
15:54
i think i can recurively reduce tho
15:56
biggest issue is
15:56
top left is so far from 1
15:58
from os import system from base64 import b64decode import numpy as np from qiskit import QuantumCircuit import qiskit.quantum_info as qi from qiskit.circuit.library import StatePreparation def normalization(msg): assert(len(msg) <= WIRES**2) state = np.array([ord(c) for c in msg.ljust(2**WIRES, ' ')]) norm = np.linalg.norm(state) state = state / norm return (state, norm) def make_circ(sv, circ): qc = QuantumCircuit(WIRES) qc.append(circ.to_instruction(), range(WIRES)) sp = QuantumCircuit(WIRES, name="echo 'Hello, world!'") sp.append(StatePreparation(sv), range(WIRES)) qc.append(sp.to_instruction(), range(WIRES)) return qc def reduce(given_sv): c = QuantumCircuit(WIRES) c.prepare_state(given_sv, range(5)) c.qasm() # caching so reverse_ops has decent naming r = c.reverse_ops().copy() r.name = 'reverse_given_sv' return r WIRES = 5 given_sv, _ = normalization("echo 'Hello, world!'") r = reduce(given_sv) target_sv, n = normalization("sh#") # comment to avoid rand chars at end. ; would also work # add target statevector to circuit #qc = make_circ(target_sv, r) #qc.draw() qc = QuantumCircuit(WIRES) sp = QuantumCircuit(WIRES, name="payload") sp.prepare_state(target_sv, range(WIRES)) qc.append(sp.copy(), range(WIRES)) qc.append(r.to_instruction(), range(WIRES)) qc.draw() res = make_circ(given_sv, qc) res_sv = qi.Statevector.from_instruction(res)
Avatar
btw whats hint 2 about
Avatar
unpickled admin bot 07/01/2023 4:01 PM
uh
16:01
theres hints?
Avatar
yeah
Avatar
unpickled admin bot 07/01/2023 4:01 PM
uh
16:01
lol ok
Avatar
Markov something
Avatar
Avatar
sahuang
Markov something
unpickled admin bot 07/01/2023 4:08 PM
thats like
16:08
probability stuff tho
16:08
how does that have to do with this lmao
16:11
OH SHIT IM USING THE WRONG FUNC LMAo
16:11
ok
16:12
GOT IT
16:12
ok
16:12
i got a valid circuit
16:12
locally
16:12
lets fucking go
Avatar
unpickled admin bot 07/01/2023 4:13 PM
script
16:13
i used reverse_ops, not invert
16:13
invert is recursive
16:13
im such a fucking idiot
16:14
16:14
solution qasm
16:14
now how 2 submit to server lmao
Avatar
so this works locally?
16:15
is it the same Normalization constant as server
Avatar
unpickled admin bot 07/01/2023 4:16 PM
ye
16:16
and yes
16:16
234.4397577204003
16:16
normalization constant
16:17
16:17
b64
Avatar
"Your quantum circuit acts on 0 instead of 5 qubits!" wtf is this
Avatar
Avatar
sahuang
"Your quantum circuit acts on 0 instead of 5 qubits!" wtf is this
unpickled admin bot 07/01/2023 4:18 PM
huh?
16:18
it runs on 5??????
16:19
qreg q[5];??????????///
16:19
?????????????????????????????????????????
Avatar
whats the difference
Avatar
Avatar
sahuang
$ nc schrodingers-cat.chal.uiuc.tf 1337 == proof-of-work: disabled == Hello, world! Welcome to the Quantum Secure Shell. Instead of dealing with pesky encryption, just embed your commands into our quantum computer! I batched the next command in with yours, hope you're ok with that! ┌─────────────────┐┌───────────────────────┐ q_0: ┤0 ├┤0 ├ │ ││ │ q_1: ┤1 ├┤1 ├ │ ││ │ q_2: ┤2 Your Circ Here ├┤2 echo 'Hello, world!' ├ │ ││ │ q_3: ┤3 ├┤3 ├ │ ││ │ q_4: ┤4 ├┤4 ├ └─────────────────┘└───────────────────────┘ Normalization constant: 419.1873089681986 Executing... Please type your OpenQASM circuit as a base64 encoded string:
there are 5 from the graph?
Avatar
unpickled admin bot 07/01/2023 4:22 PM
wait what happened
16:22
when you sent?
Avatar
i sent, it exitted after i input 234.4397577204003
16:22
Executing... [*] Got EOF while reading in interactive
Avatar
unpickled admin bot 07/01/2023 4:22 PM
huhhh
16:22
it executed
Avatar
Avatar
unpickled admin bot
Click to see attachment 🖼️
i got a different base64
Avatar
unpickled admin bot 07/01/2023 4:22 PM
send yours?
Avatar
with above message.txt
Avatar
unpickled admin bot 07/01/2023 4:23 PM
because im
16:23
99% sure this is the right payload
Avatar
from pwn import * from base64 import b64encode data = open("message.txt", "rb").read() data = b64encode(data) io = remote("schrodingers-cat.chal.uiuc.tf", 1337) io.recvuntil(b"encoded string:") io.sendline(data) io.interactive()
16:24
then input 234.4397577204003
Avatar
unpickled admin bot 07/01/2023 4:24 PM
what happened?
16:24
is sh# not valid bash?
16:24
ykwhat ill just do normal sh
Avatar
idk sh#
16:25
i mean its a different base64
16:26
you mean your code will execute sh#?
Avatar
unpickled admin bot 07/01/2023 4:26 PM
o
16:27
lmao
16:27
ok
Avatar
dont think sh# can be executed
16:27
can it be changed to output sh easily
16:27
or actually sh
16:27
space
Avatar
unpickled admin bot 07/01/2023 4:28 PM
uiuctf{f3yn_m4n_h3r32_j00r_fL49}
16:28
ye it can
Avatar
nice!
16:28
gg
Avatar
unpickled admin bot 07/01/2023 4:28 PM
Avatar
went with sh?
Avatar
unpickled admin bot 07/01/2023 4:28 PM
ye
Avatar
cool
16:28
quantum god
Avatar
unpickled admin bot 07/01/2023 4:28 PM
luck **2
16:29
also 99% sure this is unintended cuz
Avatar
unpickled admin bot 07/01/2023 4:29 PM
aint shit about merkle in here lol
Avatar
lmfao nice (edited)
Avatar
well mnt/ain solved fast so prob unintended is the way to go
Avatar
unpickled admin bot 07/01/2023 4:29 PM
/mnt/ain strong (edited)
Avatar
true
16:30
i still need to work on the shit gzip compression forensics "web"
16:30
zzz
Avatar
unpickled admin bot 07/01/2023 4:30 PM
glgl
Avatar
/solve this
Avatar
Avatar
unpickled admin bot
used /ctf solve
✅ Challenge solved.
Exported 260 message(s)