[BSidesCF 2020]Cards

解题步骤

审一波代码。我日，go语言。属实寄了，看一波wp得了。
经典21点，赢就得分，直到达到目标分数给flag。然后想着改前端，发现不可行。因为session里面记录了分数。

func (s *Session) Score() error {
    switch s.Game.State() {
    case Idle:
        return nil
    case GamePlaying:
        return nil
    case PlayerWinsBlackjack:
        // Original bet + 3/2
        s.Balance += (s.Game.Bet * 5 / 2)
        return nil
    case PlayerWins:
        // Original bet + win
        s.Balance += (s.Game.Bet * 2)
        return nil
    case DealerWins:
        return nil
    case Push:
        s.Balance += s.Game.Bet
        return nil
    default:
        return fmt.Errorf("Unknown scoring!")
    }
}

上面代码可以看到，如果赢了，就加分，输了似乎啥都没干。所以赢了cookie会更新，输了cookie不变，除此之外

func (s GameState) String() string {
    switch s {
    case Idle:
        return "Idle"
    case DealerWins:
        return "DealerWins"
    case PlayerWins:
        return "PlayerWins"
    case Push:
        return "Push"
    case PlayerWinsBlackjack:
        return "Blackjack"
    case GamePlaying:
        return "Playing"
    default:
        return "UNKNOWN"
    }
}

如果赢了就会返回Blackjack，那就太好判断了，直接来个脚本：

import requests

start = "http://a5f4a229-917e-41d4-b6c5-13697d632db5.node4.buuoj.cn:81/api"
deal = start + "/deal"

# 开局
state = requests.post(start).json()["SecretState"]

while True:
    # 下注
    try:
        resp = requests.post(deal, json={"Bet": 500, "SecretState": state}).json()
    except:
        continue

    if resp['GameState'] == 'Blackjack':
        state = resp['SecretState']

    print(resp['Balance'])
    if resp['Balance'] > 100000:
        print(resp)
        break