[PlaidCTF 2019] Project Eulernt

Guys, guys, don’t fight. I’m sure we’ll be able to come up with something roughly equal. source eulernt.pwni.ng:5555 NOTE: We originally uploaded the wrong version. It is still available here if you really want it: wrong version. How to solve We need to get a divisor of 333! that is close to (333!)1/2. Just factorize with factorDB. There are some pks of which k is odd. Let’s define a product of those ps as v:=p....

2019-04-22 · 2 min · RBTree

[PlaidCTF 2019] Horst

They say 3 rounds is provably secure, right? Download How to solve Permutations can be handled as matrices. For given key k and plaintext (x,y), the result of one-round encryption is: (x1,y1)=(y,xk1yk) Let’s do this for three rounds! (x2,y2)=(xk1yk,yk1xk1yk2) (x3,y3)=(y2,xk1ykk1y2k)=(y2,xk1yy2k) If we define t=yy2, we can say that (yx3,y3)=(t,xk1tk)...

2019-04-22 · 2 min · RBTree

[TokyoWesterns CTF 4th] mixed cipher

I heard bulldozer is on this channel, be careful! nc crypto.chal.ctf.westerns.tokyo 5643 Download the chal: here. How to solve To decrypt the flag, we need two things: the AES key and the IV when the flag is generated. IV IV is generated by random.getrandbits(). Python random uses Mersenne Twister, and it is able to recover the state of the Python random generator with 624 32-bit integers. See this link for detail....

2018-09-03 · 4 min · RBTree

[SCTF 2018 Finals] MQ

Download the problem file from http://research.samsung.com/sctf2018 or https://www.dropbox.com/s/n45bss3bgr4sjcg/MQ.py?dl=0 Define Function M: M(x0,,xn1)=i=0n1j=in1qi,jxixj+i=0n1uixi+c. (q is for quad, u is for uni. Notice that qi,j=qj,i) The code gives M(input) and M(input+flag). Let’s think about F(x,y)=M(x+y)M(x). F(x,y)=M(x+y)M(x)=i=0n1j=in1qi,j(xiyj+yixj+yiyj)+i=0n1uiyi...

2018-09-01 · 3 min · RBTree

[SCTF 2018 Finals] LCG

Download the problem file from http://research.samsung.com/sctf2018 or https://www.dropbox.com/s/xx6tnhzrgpdxvd8/LCG.py?dl=0 It is quite simple PRNG with the equation (t = 0xdeadbeef): xi=(k1t)xi1+k1txi2+k2(mod k3) We can define yi as yi=xi+txi1, then yi=k1yi1+k2(mod k3). So, it’s just same as the normal LCG. I used the method to break LCG described in this link, and the solver is here....

2018-08-31 · 2 min · RBTree