2025 BroncoCTF

1
Do you love python? Or at least tolerate it? Then this is the challenge for you!
2

3
When run with the correct flag, the given file prints: 23a326c27bee9b40885df97007aa4dbe410e93.
4

5
What is the flag?

1
flag = input()
2
carry = 0
3
key = "Awesome!"
4
output = []
5
for i,c in enumerate(flag):
6
    val = ord(c)
7
    val += carry
8
    val %= 256
9
    val ^= ord(key[i % len(key)])
10
    output.append(val)
11
    carry += ord(c)
12
    carry %= 256
13

14
print(bytes(output).hex())

1
def f(hex_output):
2
    hex_bytes = bytes.fromhex(hex_output)
3
    key = "Awesome!"
4
    carry = 0
5
    flag = []
6

7
    for i, val in enumerate(hex_bytes):
8
        val ^= ord(key[i % len(key)])
9
        val = (val - carry) % 256
10
        flag.append(chr(val))
11
        carry += val
12
        carry %= 256
13

14
    return ''.join(flag)
15

16
hex_output = "23a326c27bee9b40885df97007aa4dbe410e93"
17
print(f(hex_output))

1
Behold! A modern take on an old crypto classic!
2

3
I call it RAHHH-SA! That's because with just a simple numerical inversion of RSA's rules, it's now unbreakable! RAHHH!
4

5
e = 65537
6
n = 3429719
7
c = [-53102, -3390264, -2864697, -3111409, -2002688, -2864697, -1695722, -1957072, -1821648, -1268305, -3362005, -712024, -1957072, -1821648, -1268305, -732380, -2002688, -967579, -271768, -3390264, -712024, -1821648, -3069724, -732380, -892709, -271768, -732380, -2062187, -271768, -292609, -1599740, -732380, -1268305, -712024, -271768, -1957072, -1821648, -3418677, -732380, -2002688, -1821648, -3069724, -271768, -3390264, -1847282, -2267004, -3362005, -1764589, -293906, -1607693]
8
Y'know what? I'm so confident in this new system I'll even share one of my deepest secrets!
9

10
p = -811

1
def egcd(a, b):
2
    if a == 0:
3
        return b, 0, 1
4
    else:
5
        g, x, y = egcd(b % a, a)
6
        return g, y - (b // a) * x, x
7

8
def modinv(a, m):
9
    g, x, _ = egcd(a, m)
10
    if g == 1:
11
        return x % m
12

13
e = 65537
14
n = 3429719
15
p = -811
16
p_abs = abs(p)
17
q_abs = n // p_abs
18
phi = (p_abs - 1) * (q_abs - 1)
19
d = modinv(e, phi)
20
ciphertexts = [
21
    -53102, -3390264, -2864697, -3111409, -2002688, -2864697, -1695722,
22
    -1957072, -1821648, -1268305, -3362005, -712024, -1957072, -1821648,
23
    -1268305, -732380, -2002688, -967579, -271768, -3390264, -712024, -1821648,
24
    -3069724, -732380, -892709, -271768, -732380, -2062187, -271768, -292609,
25
    -1599740, -732380, -1268305, -712024, -271768, -1957072, -1821648, -3418677,
26
    -732380, -2002688, -1821648, -3069724, -271768, -3390264, -1847282, -2267004,
27
    -3362005, -1764589, -293906, -1607693
28
]
29
plaintext_nums = [pow(ct % n, d, n) for ct in ciphertexts]
30
plaintext = ''.join(chr(num) for num in plaintext_nums)
31
print(plaintext)