Великий математик (Great Mathematician)

Platform: hackerlab | Category: Misc | Type: Challenge | Difficulty: Medium | OS: Linux | Author: XESXOR | Date: 2025-12-26 | Status: Solved Techniques: Automated equation solving with sympy, Network interaction with pwntools, Regex parsing for equation extraction, Time-constrained automation

Summary

Task: Math game service requiring solving 50 algebraic equations with 5-second time limit per equation. Solution: Automated equation solving using pwntools for network interaction and sympy for symbolic math, with regex parsing to extract equations.

Великий математик (Great Mathematician) - hackerlab

Description

Твоя бывшая математичка наблюдает за тобой. Не разочаруй её.

(Your former math teacher is watching you. Don't disappoint her.)

Connection: 192.169.2.100:10360

Analysis

When connecting to the service, we are greeted with a math game:

• Need to solve 50 equations with one variable (x or y)
• 5 seconds are given for each equation
• Equations include basic operations: addition, subtraction, multiplication, division

Example equations:

x + 36 = 123
1120 / y = 70
x * 14 = 434
21 - y = -24

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Obviously, solving 50 equations manually in 5 seconds each is impossible - automation is needed.

Solution

Approach

1. Connect to the service via pwntools
2. Send "start" to begin the game
3. Parse each equation using regular expressions
4. Use the sympy library for symbolic equation solving
5. Automatically determine the variable (x or y) in each equation
6. Send answers in a loop, staying within the time limit

Solution Script

 python read-only • copy allowed Copy
#!/usr/bin/env python3
from pwn import *
from sympy import symbols, Eq, solve, sympify
import re
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

# Connect to the service
conn = remote('192.169.2.100', 10360)

# Start the game
conn.sendlineafter(b'>', b'start')

x, y = symbols('x y')

for i in range(50):
    # Get the equation
    line = conn.recvline().decode().strip()
    print(f"[{i+1}/50] {line}")
    
    # Parse the equation: "left_side = right_side"
    match = re.search(r'([x\dy\s\+\-\*\/]+)\s*=\s*(-?\d+)', line)
    if not match:
        print(f"Failed to parse: {line}")
        continue
    
    left_side = match.group(1).strip()
    right_side = int(match.group(2))
    
    # Determine the variable
    var = x if 'x' in left_side else y
    
    # Create and solve the equation
    equation = Eq(sympify(left_side), right_side)
    solution = solve(equation, var)
    
    if solution:
        answer = solution[0]
        print(f"    Answer: {answer}")
        conn.sendline(str(answer).encode())
    else:
        print(f"    No solution found!")
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

# Get the flag
conn.interactive()

Alternative Approach (without sympy)

For simple equations, you can use eval with substitution:

 python read-only • copy allowed Copy
#!/usr/bin/env python3
from pwn import *
import re

conn = remote('192.169.2.100', 10360)
conn.sendlineafter(b'>', b'start')

for i in range(50):
    line = conn.recvline().decode().strip()
    print(f"[{i+1}/50] {line}")
    
    # Parse the equation
    match = re.search(r'([^\=]+)\s*=\s*(-?\d+)', line)
    left = match.group(1).strip()
    right = int(match.group(2))
    
    # Determine the variable
    var = 'x' if 'x' in left else 'y'
    
    # Bruteforce for simple equations (range can be extended)
    for val in range(-10000, 10001):
        try:
            if eval(left.replace(var, str(val))) == right:
                print(f"    Answer: {val}")
                conn.sendline(str(val).encode())
                break
        except:
            continue
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

conn.interactive()

Running

 bash read-only • copy allowed Copy
python3 solve.py

After successfully solving all 50 equations, the service returns the flag.

Useful Libraries

Notes

• sympy automatically handles all basic operations (+, -, *, /)
• It's important to correctly determine the variable in each equation
• If parsing issues occur, more flexible regex patterns can be used
• For complex equations, sympy works better than bruteforce ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍