1
\$\begingroup\$

I am creating my own problems that people have to solve and I want to make a grader check if a user put in the right answers and then reward them with a flag.

My code for one particular problem:

from Crypto.Cipher import AES
from binascii import hexlify
from binascii import unhexlify

password = input("What is the answer to the first question? ")

passwordtwo = input("What is the answer to the second question? ")

message = input("What is the answer to the third question? ")

obj = AES.new(password, AES.MODE_CFB, 'This is an IV456')

ciphertext = obj.encrypt(message)

obj2 = AES.new(passwordtwo, AES.MODE_CFB, 'This is an IV456')

answer = b'c557774c4e5bd1745319b15226e078ef30abcb50f1bd371946ddadffc39a1f56'
flag = b'a2c8b65cda513befb8134c7960bc977946655d485f9ad2'

if (hexlify(ciphertext) == answer):
    print(obj2.decrypt(unhexlify(flag)))

#first question: I took a major language exam in 2018 - what did I get due to my score? The answer is two words. Format should be ans:<question 1 answer>

#second question: I partook in a competition in my district in 2017 - what was the name of the competition? The answer is three words. Format should be ans: <answer to question 2>

#third question: I was in a competitive club around the time I wrote a book. What did I place and for what event? The answer is four words. Format should be <place>: <event>. Write it out in words

#note that the format is EXTREMELY particular - it has to be exactly the same. Also, everything is lowercase.

This code works as long as users abide exactly to the format I specify. I'm not sure, however, if a user can just find the flag without actually answering the questions. I would think that by making them figure out the passwords themselves it would be impossible to trick the grader. Is this code secure? If not, how can I make this more secure?

\$\endgroup\$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.