HCMUS-CTF::Nyanko

Prelude

This challenge is related to a game, with transfer code and confirmation exist as terms in the game.

Recon

After inspecting pretty thoroughly, nothing comes up, so I’ve resorted to bruteforcing the form.

Bruteforcing

Trying several combinations (the former is transfer code and the latter is confirmation code).

• adasfa456464 - aaaaaaaaa444: Error: Invalid code format, ~57ms
• adasfa456464 - aaaaaaaaa4: Error: Failed to download save data., ~293ms

So it does validation under the hood, and based on that 293ms of the latter request, I could assume that it does forward the request to another service as hashing is kinda impractical here yk. And the validation doesn’t even conform to ¹, so we literally got little useful result here.

Using valid codes

The hint mentions using real codes, so what if we use valid codes according to ¹?

As we could never find these codes online so I gotta download the game myself to get them…

After inputting the codes grabbed from the game, it says You don't have the Cheetah cat unlocked. Go hack your game and come back!.

Generating codes

Based on the video, as well as the message above, we got a clue in the description, mentioning Cheetah Cat along with a wiki URL. The wiki says its unobtainable, and the only method is hacking?

After a quick research, I’ve found this repo as a game file saver; speaking frankly, its a hacking tool, for manipulating game data, similar to the “hacking” method aforementioned. This library exposes a TUI and Python APIs, I would prefer the latter.

1
from bcsfe import core
2

3
core.set_config_path(core.Path("./config.yaml"))
4
core.set_log_path(core.Path("./bcsfe.log"))
5
core.core_data.init_data()
6

7
save = core.SaveFile(cc=core.CountryCode("en"), gv=core.GameVersion(150300))
8

9
pb = core.NyankoPictureBook(save)
10
assert pb.cats
11

12
save.cats = core.Cats([core.Cat.init(d.cat_id) for d in pb.cats])
13

14
cheetah = save.cats.get_cat_by_id(673)
15
assert cheetah
16

17
cheetah.unlocked = 1
18
cheetah.gatya_seen = 1
19
cheetah.catguide_collected = True
20

21
handler = core.ServerHandler(save)
22
assert handler.create_new_account()
23

24
assert (codes := handler.get_codes())
25

26
print(*codes)