1
  const sanitized = str.replaceAll(" ", "");
2
  if (sanitized.length < 10) {
3
    return `error: no flag for you. sanitized string is ${sanitized}, length is ${sanitized.length.toString()}`;
4
  }
5
  const array = JSON.parse(sanitized);
6
  if (array.length < 0) {
7
    // hmm...??
8
    return FLAG;
9
  }

1
import json
2
import base64
3
import hmac
4
import hashlib
5

6
s_cookie = input('session: ')
7
decoded_s = base64.b64decode(s_cookie).decode('utf-8','ignore').split('}')[0]+'}'
8
session_id = json.loads(decoded_s)["session_id"]
9

10
SEED = bytes.fromhex('b7c4c422a93fdc991075b22b79aa12bb19770b1c9b741dd44acbafd4bc6d1aabc1b9378f3b68ac345535673fcf07f089a8492dc1b05343a80b3d002f070771c6')
11
DIGITS_PER_ROUND = 7
12
TOTAL_ROUNDS = 10
13

14
def lcg_params(seed: bytes, session_id: str):
15
    m = 2147483693
16
    raw_a = hmac.new(seed, (session_id + "a").encode(), hashlib.sha256).digest()
17
    a = (int.from_bytes(raw_a[:8], 'big') % (m - 1)) + 1
18
    raw_c = hmac.new(seed, (session_id + "c").encode(), hashlib.sha256).digest()
19
    c = (int.from_bytes(raw_c[:8], 'big') % (m - 1)) + 1
20
    return m, a, c
21

22
def generate_round_digits(seed: bytes, session_id: str, round_index: int):
23
    LCG_M, LCG_A, LCG_C = lcg_params(seed, session_id)
24
    h0 = hmac.new(seed, session_id.encode(), hashlib.sha256).digest()
25
    state = int.from_bytes(h0, 'big') % LCG_M
26
    for _ in range(DIGITS_PER_ROUND * round_index):
27
        state = (LCG_A * state + LCG_C) % LCG_M
28
    digits = []
29
    for _ in range(DIGITS_PER_ROUND):
30
        state = (LCG_A * state + LCG_C) % LCG_M
31
        digits.append(state % 10)
32
    return digits
33

34
correct_sum = 0
35
for round_index in range(TOTAL_ROUNDS):
36
    digits = generate_round_digits(SEED, session_id, round_index)
37
    number = int(''.join(map(str, digits)))
38
    correct_sum += number
39

40
print(correct_sum)

1
    if (req.body.includes('flag')) {
2
      return res.status(403).send('Not allowed!');
3
    }
4
    if (req.body.includes('\\') || req.body.includes('/')
5
      || req.body.includes('!!') || req.body.includes('<')) {
6
      return res.status(403).send('Hello, Hacker :)');
7
    }
8
    const data = yaml.load(req.body);
9
    const filePath = data.file;
10

11
    if (filePath && fs.existsSync(filePath)) {
12
      const content = fs.readFileSync(filePath, 'utf8');
13
      return res.send(content);
14
    }

1
cipher = "ayb wpg uujmz pwom jaaaaaa aa tsukuctf, hj vynj? mml ogyt re ozbiymvrosf bfq nvjwsum mbmm ef ntq gudwy fxdzyqyc, yeh sfypf usyv nl imy kcxbyl ecxvboap, epa 'avb' wxxw unyfnpzklrq."
2

3
letters = [c for c in cipher if c.islower()]
4
p = ['?'] * len(letters)
5
for j in range(8, len(letters)):
6
    Cj = ord(letters[j]) - ord('a')
7
    Cjm8 = ord(letters[j - 8]) - ord('a')
8
    pj = (Cj - Cjm8) % 26
9
    p[j] = chr(pj + ord('a'))
10

11
plaintext = list(cipher)
12
li = 0
13
for i, c in enumerate(plaintext):
14
    if c.islower():
15
        plaintext[i] = p[li]
16
        li += 1
17

18
print(''.join(plaintext))

1
??? ??? ??joy this problem or tsukuctf, or both? the flag is concatenate the seventh word in the first sentence, the third word in the second sentence, and 'fun' with underscores.

1
import os
2
from Crypto.Cipher import AES
3
from Crypto.Util.Padding import unpad
4

5
enc = "5f2b9c04a67523dac3e0b0d17f79aa2879f91ad60ba8d822869ece010a7f78f349ab75794ff4cb08819d79c9f44467bd"
6
enc_b = bytes.fromhex(enc)
7

8
os.system("openssl pkeyutl -decap -inkey priv.pem -in ciphertext.dat -secret shared.dat")
9

10
with open("shared.dat", "rb") as f:
11
    shared_secret = f.read()
12

13
m=AES.new(shared_secret, AES.MODE_ECB)
14
res=m.decrypt(enc_b)
15
print(unpad(res, 16).decode())

1
class xor_tsuku_shift:
2
    def __init__(self, seed):
3
        self.a = seed
4

5
    def shift(self):
6
        self.a ^= (self.a << 17) & 0xFFFFFFFFFFFFFFFF
7
        self.a ^= (self.a >> 9) & 0xFFFFFFFFFFFFFFFF
8
        self.a ^= (self.a << 18) & 0xFFFFFFFFFFFFFFFF
9
        return self.a & 0xFFFFFFFFFFFFFFFF
10

11
def janken(a, b):
12
    return (a-b+3) % 3

1
Notice: Function _load_textdomain_just_in_time was called incorrectly. Translation loading for the 404-solution domain was triggered too early. This is usually an indicator for some code in the plugin or theme running too early. Translations should be loaded at the init action or later. Please see Debugging in WordPress for more information. (This message was added in version 6.7.0.) in /var/www/html/wp-includes/functions.php on line 6121 Warning: Cannot modify header information - headers already sent by (output started at /var/www/html/wp-includes/functions.php:6121) in /var/www/html/wp-includes/pluggable.php on line 1450 Warning: Cannot modify header information - headers already sent by (output started at /var/www/html/wp-includes/functions.php:6121) in /var/www/html/wp-includes/pluggable.php on line 1453