[Math] C8: captcha

xp0int Posted on Nov 23 2018

看到好多人都是用ocr做的，但是准确度好差啊。。
我是解析字体文件做的。
首先找到每个真字符与显示的图片对应的表。
![title](https://leanote.com/api/file/getImage?fileId=5bed7b8bab64412530007af4)

然后根据图片尺寸找到对应显示的字符，再替换。
（如果尺寸都一样的话，匹配下面的像素点也行）
![title](https://leanote.com/api/file/getImage?fileId=5bed7cf1ab64412530007b50)

```python
import requests
import base64
import io
import re
from fontTools.ttLib import TTFont

url = 'https://hidden-island-93990.squarectf.com/ea6c95c6d0ff24545cad'
sess = requests.Session()

font_ptn = re.compile(r"(?<=data:application/font-ttf;charset=utf-8;base64,)[^']*")
cipher_ptn = re.compile(r'(?<=<h1>Captcha</h1><p>)[^<]*')
token_ptn = re.compile(r'(?<=<input type="hidden" name="token" value=")\d+')

sizes = {
    '0': (0, 0, 585, 660),
    '1': (0, 0, 311, 673),
    '2': (0, 0, 497, 704),
    '3': (0, 0, 548, 684),
    '4': (0, -3, 576, 690),
    '5': (0, 0, 531, 690),
    '6': (0, 0, 544, 679),
    '7': (0, 0, 510, 696),
    '8': (0, 0, 569, 689),
    '9': (0, 0, 561, 689),
    # '(': (0, -128, 290, 747),
    # ')': (0, -128, 290, 747),
    '-': (0, 0, 465, 347),
    '+': (0, 0, 495, 519),
    '*': (0, 0, 444, 481),
}

try:
    r = sess.get(url)
    font_b64 = font_ptn.search(r.text).group(0)
    equation = cipher_ptn.search(r.text).group(0)
    token = token_ptn.search(r.text).group(0)
except Exception as e:
    print(e)
    print(r.text)
    exit()

font_file = io.BytesIO(base64.b64decode(font_b64))
font = TTFont(font_file)

font.saveXML('font.ttx')
with open('font.ttx') as f:
    font_ttx = f.read()

cmap = font['cmap'].buildReversed()

gltph_ids = {}

for fake_char, size in sizes.items():
    gltph_id_ptn = re.compile(
        r'(?<=<TTGlyph name=")[^"]*(?=" xMin="{}" yMin="{}" xMax="{}" yMax="{}">)'
        .format(*size))
    gltph_id = gltph_id_ptn.search(font_ttx).group(0)
    gltph_ids[fake_char] = gltph_id
    real_char = chr(cmap[gltph_id].pop())
    equation = equation.replace(real_char, fake_char)

equation = equation.replace(equation[0], '(')
equation = equation.replace(equation[-1], ')')

answer = eval(equation)
print(equation, '=', answer)

data = {'answer': answer, 'token': token}
r = sess.post(url, data=data)
print(r.text)

```

![title](https://leanote.com/api/file/getImage?fileId=5bed8459ab6441233f008386)

打赏还是打残，这是个问题