Official ShinyHunter Discussion

HTB Content Challenges
1

Official discussion thread for ShinyHunter. Please do not post any spoilers or big hints.

2

Nice challenge. Figure out how the generation mechanism works and then the challenge is very easy.

3

any hint?

def generate(seed):
    random.seed(seed)
    tid = random.randint(0, 65535)
    sid = random.randint(0, 65535)
    pid = random.randint(0, 2**32 - 1)
    shiny_value = ((tid ^ sid) ^ (pid & 0xFFFF) ^ (pid >> 16))
    is_shiny = shiny_value < 8
    print(f" tid: {tid}, sid: {sid}, pid: sid, value: {shiny_value}")

how could I control any of that?

4

I recommend looking into how the random module works and why it’s better to use something else for generating truly random numbers in Python. This should give you an idea of the control you have over the generated numbers. Feel free to DM me, if you need a nudge.

5

hint: In getting a shiny, there’s one unique thing involved that you can see without any pauses.

6

I’ve just solved it so here are some cryptic clues:

  1. This is misc not crypto, so it has more to do with automation than math
  2. Obviously you really only have control over 2 things
  3. Try to put the size of different things in scale - is it very large or is it small enough

    • How many times do you need to connect to the server in the worst case? High-school probability will do.

    • Given all the different clues, how do you reduce the number?

  4. Make sure that your solve script is repeatable (like 5~6 times) locally. Find out why if it isn’t.

    • For my case, I had the correct calculations but was not careful with the steps
7

The chance exists for someone to just connect, make their choices, and be given the flag. I was not that person. Heck, after figuring out the trick of it my implementation still took like a couple systems before the box handed the flag over.

8

Ok, it seems like this is RNG with seed, which this particular RNG is ALWAYS repeatable same number of times no matter how many times it’s initialized with the same seed. So this comes down to the number of times you connect? Or am I missing something?