# ʕ·ᴥ·ʔ

## Tunnels

#### 06/10/2022

By: HELLOPERSON

Tags: Misc HSCTF-2022

#### Problem Description:

Catch b40m1k3

Notice how we can represent this problem using numbers. For each of the middle 6 numbers, the value of it can be split between the 2 values next to it on the next round, but for the edges, all of it goes to the one next to it, because it has 1 neighbor. Let’s write some code to simulate the problem:

``````start = [1, 1, 1, 1, 1, 1, 1, 1]
nex = [1, 1, 1, 1, 1, 1, 1, 1]
a = [1, 1, 2, 3, 4, 5, 6, 6]
for j in range(8):
start[a[j]] = 0
sum = 0
for i in range(8):
if i == 0:
nex = start/2
elif i == 7:
nex = start/2
elif i == 1:
nex = start + start/2
elif i == 6:
nex = start + start/2
else:
nex[i] = start[i-1]/2 + start[i+1]/2
sum += nex[i]
print(nex)
print(sum)
for i in range(8):
start[i] = nex[i]
print(200*(1-(sum/8)))
``````

Cool! Now that we have code to simulate it, and is pretty fast, let’s bash all possible meaningful inputs (half of the inputs are equivalent). This gives us 4*8^7 possibilities to bash.

``````start = [1, 1, 1, 1, 1, 1, 1, 1]
nex = [1, 1, 1, 1, 1, 1, 1, 1]
old = 0
for i in range(4):
for j in range(8):
for k in range(8):
for l in range(8):
for m in range(8):
for n in range(8):
for o in range(8):
for p in range(8):
start = [1, 1, 1, 1, 1, 1, 1, 1]
nex = [1, 1, 1, 1, 1, 1, 1, 1]
a = [i, j, k, l, m, n, o, p]
for q in range(8):
start[a[q]] = 0
sum = 0
for r in range(8):
if r == 0:
nex = start/2
elif r == 7:
nex = start/2
elif r == 1:
nex = start + start/2
elif r == 6:
nex = start + start/2
else:
nex[r] = start[r-1]/2 + start[r+1]/2
sum += nex[r]
for s in range(8):
start[s] = nex[s]
c = (200*(1-(sum/8)))
if c > old:
print(a)
print(c)
old = c
c = 0
``````

After a few minutes, the program spits out [3, 6, 1, 4, 4, 1, 6, 3], with an average value of 179.6875. This appears to be the optimal solution.

Plugging it into some pwntools code, we can wait for the ~2.5% chance that we will succeed.

``````from pwn import *

io = remote("tunnels.hsctf.com", 1337)
io.recvline()
success = 0
guesses = input() # input guess sequence e.g. "12345678"
for j in range(200):
io.recvline()
print("TRIAL: %d" % j)
for i in range(8):
io.sendline(guesses[i].encode())
r = io.recvline()
if b"incorrect" not in r:
success += 1
break

print("success rate: " + str(success/200))
print(io.recv())
``````

After a few minutes of running this in a loop, we find the flag in the console: `flag{b4om1k3_15_4_v3ry_1nt3r35t1ng_p3r50n_924972020}`