Project Sekai
🔒 UIUCTF 2023 / ❌-web-futuredisk
Range: bytes=9223372036854775799-9223372036854775807 to get the last 8 bytes import requests
target_signature = b"\x1f\x8b\x08\x00\x00\x00\x00\x00\x02\x03\xec\xc1\x01\x01\x00\x00\x00\x80\x90\xfe\xaf\xee\x08\n"
current_offset = 0
chunk_size = 2048
while True:
response = requests.get(
"https://futuredisk-web.chal.uiuc.tf/haystack.bin.gz",
headers={"Range": f"bytes={current_offset}-{current_offset + chunk_size - 1}"}
)
chunk = response.content
if b"\x00" not in chunk and target_signature not in chunk:
print("Matched data found in chunk starting at offset", current_offset)
print(chunk)
current_offset += chunk_size 
import requests
target_signature = b"\x1f\x8b\x08\x00\x00\x00\x00\x00\x02\x03\xec\xc1\x01\x01\x00\x00\x00\x80\x90\xfe\xaf\xee\x08\n"
current_offset = 0
chunk_size = 2048
while True:
response = requests.get(
"https://futuredisk-web.chal.uiuc.tf/haystack.bin.gz",
headers={"Range": f"bytes={current_offset}-{current_offset + chunk_size - 1}"}
)
chunk = response.content
if b"\x00" not in chunk and target_signature not in chunk:
print("Matched data found in chunk starting at offset", current_offset)
print(chunk)
current_offset += chunk_size 
2.3. Member format
Each member has the following structure:
+---+---+---+---+---+---+---+---+---+---+
|ID1|ID2|CM |FLG| MTIME |XFL|OS | (more-->)
+---+---+---+---+---+---+---+---+---+---+ 1f 8b 08 08
they set it as 1f 8b 08 00
The last byte is FLG
This flag byte is divided into individual bits as follows:
bit 0 FTEXT
bit 1 FHCRC
bit 2 FEXTRA
bit 3 FNAME
\x00 are useful i think 
UUU...U with a new line, but it's the same thing over and over?
Idk how this helps
UUU...U with a new line, but it's the same thing over and over?
Idk how this helps 1f 8b 08 08
they set it as 1f 8b 08 00
The last byte is FLG
This flag byte is divided into individual bits as follows:
bit 0 FTEXT
bit 1 FHCRC
bit 2 FEXTRA
bit 3 FNAME
b'\x1f\xc3\xa3\x08\x02\x03\xc3\x8f\xc2\xa1\x01\x01\xc3\x84\xc3\xaa\xcb\x9b\xc3\x98\xc3\x93\x08\n\xc3\x84\xc5\xb8\xc3\x89\x03\x01 \xcb\x87\xe2\x97\x8aFPa\x0f\x0e\x04\xc3\x84\xc2\xb8_\x1bA\xc3\x96=8\x10\xc3\x9a\x7fm\x04\x15\xcb\x86\xe2\x80\xa1@\xc2\xbb\xcb\x87\xc2\xb5\x11T\xc3\xbf\xc3\x89\x03\x01 \xcb\x87\xe2\x97\x8aFPa\x0f\x0e\x04\xc3\x84\xc2\xb8_\x1bA\xc3\x96=8\x10\xc3\x9a\x7fm\x04\x15\xcb\x86\xe2\x80\xa1@\xc2\xbb\xcb\x87\xc2\xb5\x11T\xc3\xbf\xc3\x89\x03\x01 \xcb\x87\xe2\x97\x8aFPa\x0f\x0e\x04\xc3\x84\xc2\xb8_\x1bA\xc3\x96=8\x10\xc3\x9a\x7fm\x04\x15\xcb\x86\xe2\x80\xa1@\xc2\xbb\xcb\x87\xc2\xb5\x11T'
the range is bytes=0-100000 and replace "U" and "\x00", but the headers are different? 
import requests
huh = 8214
def pain2(offset, l):
response = requests.get(
"https://futuredisk-web.chal.uiuc.tf/haystack.bin.gz",
headers={"Range": f"bytes={offset}-{offset + l - 1}"}
)
chunk = response.content
return chunk
print(pain2(huh, 14)) import requests
huh = 8214
def pain2(offset, l):
response = requests.get(
"https://futuredisk-web.chal.uiuc.tf/haystack.bin.gz",
headers={"Range": f"bytes={offset}-{offset + l - 1}"}
)
chunk = response.content
return chunk
print(pain2(huh, 14)) 80d98303010000000020ffd74650 4650 part from?gunzip -c final.bin [14:53:14]
gzip: final.bin: invalid compressed data--format violated 4650 part from? b'\x00\x00\x00\x80\xd9\x83\x03\x01\x00\x00\x00\x00 \xff\xd7FPUUUUUUUUUUUUUUUUU' 
import requests
huh = 8214
out = open("final.bin", "wb")
def header(offset, l):
response = requests.get(
"https://futuredisk-web.chal.uiuc.tf/haystack.bin.gz",
headers={"Range": f"bytes={offset}-{offset + l - 1}"}
)
chunk = response.content
return chunk
def bin(offset, l):
response = requests.get(
"https://futuredisk-web.chal.uiuc.tf/haystack.bin.gz",
headers={"Range": f"bytes={offset}-{offset + l - 1}"}
)
chunk = response.content
return chunk
def trailer():
resp = requests.head("https://futuredisk-web.chal.uiuc.tf/haystack.bin.gz")
cl = resp.headers['content-length']
offset = int(cl) - 8
response = requests.get(
"https://futuredisk-web.chal.uiuc.tf/haystack.bin.gz",
headers={"Range": f"bytes={offset}-{cl}"}
)
chunk = response.content
return chunk
head = header(0, 24)
binflag = bin(huh, 14)
trail = trailer()
out.write(head)
out.write(binflag)
out.write(trail) 
import contextlib
@contextlib.contextmanager
def patch_gzip_for_partial():
"""
Context manager that replaces gzip.GzipFile._read_eof with a no-op.
This is useful when decompressing partial files, something that won't
work if GzipFile does it's checksum comparison.
"""
_read_eof = gzip.GzipFile._read_eof
gzip.GzipFile._read_eof = lambda *args, **kwargs: None
yield
gzip.GzipFile._read_eof = _read_eof 
1
gzip -cd
import requests
huh = 8214
out = open("final.bin", "wb")
def header(offset, l):
response = requests.get(
"https://futuredisk-web.chal.uiuc.tf/haystack.bin.gz",
headers={"Range": f"bytes={offset}-{offset + l - 1}"}
)
chunk = response.content
return chunk
def bin(offset, l):
response = requests.get(
"https://futuredisk-web.chal.uiuc.tf/haystack.bin.gz",
headers={"Range": f"bytes={offset}-{offset + l - 1}"}
)
chunk = response.content
return chunk
def trailer():
resp = requests.head("https://futuredisk-web.chal.uiuc.tf/haystack.bin.gz")
cl = resp.headers['content-length']
offset = int(cl) - 8
response = requests.get(
"https://futuredisk-web.chal.uiuc.tf/haystack.bin.gz",
headers={"Range": f"bytes={offset}-{cl}"}
)
chunk = response.content
return chunk
head = header(0, 24)
binflag = bin(huh, 14)
trail = trailer()
out.write(head)
out.write(binflag)
out.write(trail) 
1
1
2