crypt6

#!/usr/bin/env python
# -*- coding: utf-8 -*-
from selenium import webdriver

profile=webdriver.FirefoxProfile()
driver=webdriver.Firefox(profile)

charsets = "abcdef0123456789}"
cipher = "62 a9 6c 28 0e 33 31 c6 68 cd 66 66 59 46 cc 53 0c 98 31 65 c6 35 c9 a9 60 4e 37 b0 33 46 0d 60 46 26 66 33 cc e6 a9 f6 6c 07 2b 23 af"
flag = list("MMA{0123456789abcdef0123456789abcdef01234567}")
driver.get('http://bow.chal.mmactf.link/~scs/crypt6.cgi')
pos = [[] for i in xrange(0,44)]
pos[0]=[3, 4, 69, 70]
pos[1]=[9, 10, 69, 70]
pos[2]=[9, 10, 117, 118]
pos[3]=[15, 16, 117, 118]
pos[4]=[15, 16, 75, 76]
pos[5]=[21, 22, 75, 76]
pos[6]=[21, 22, 105, 106]
pos[7]=[27, 28, 105, 106]
pos[8]=[27, 28, 81, 82]
pos[9]=[33, 34, 81, 82]
pos[10]=[33, 34, 129, 130]
pos[11]=[39, 40, 129, 130]
pos[12]=[39, 40, 87, 88]
pos[13]=[45, 46, 87, 88]
pos[14]=[45, 46, 111, 112]
pos[15]=[51, 52, 111, 112]
pos[16]=[51, 52, 93, 94]
pos[17]=[57, 58, 93, 94]
pos[18]=[57, 58, 123, 124]
pos[19]=[63, 64, 123, 124]
pos[20]=[63, 64, 99, 100]
pos[21]=[0, 1, 99, 100]
pos[22]=[0, 1, 6, 7]
pos[23]=[6, 7, 12, 13]
pos[24]=[12, 13, 18, 19]
pos[25]=[18, 19, 24, 25]
pos[26]=[24, 25, 30, 31]
pos[27]=[30, 31, 36, 37]
pos[28]=[36, 37, 42, 43]
pos[29]=[42, 43, 48, 49]
pos[30]=[48, 49, 54, 55]
pos[31]=[54, 55, 60, 61]
pos[32]=[60, 61, 66, 67]
pos[33]=[66, 67, 72, 73]
pos[34]=[72, 73, 78, 79]
pos[35]=[78, 79, 84, 85]
pos[36]=[84, 85, 90, 91]
pos[37]=[90, 91, 96, 97]
pos[38]=[96, 97, 102, 103]
pos[39]=[102, 103, 108, 109]
pos[40]=[108, 109, 114, 115]
pos[41]=[114, 115, 120, 121]
pos[42]=[120, 121, 126, 127]
pos[43]=[126, 127, 132, 133]
def getPos(p1,p2):
    p = []
    for i in p1:
        if i in p2:
            p.append(i)
    return p
def check(c1,c2,p):
    for i in p:
        if c1[i]!=c2[i]:
            return False
    return True
for i in xrange(4,len(flag)-1):
    p = getPos(pos[i],pos[i-1])
    for c in charsets:
        flag[i] = c
        name = driver.find_element_by_name('s')
        name.clear()
        name.send_keys(flag)
        name.submit()
        html_source = driver.page_source
        n = html_source.index("<form enctype=",353)
        if check(html_source[350:n],cipher,p):
            print "".join(flag)
            break
print "".join(flag)