1
新たな熱海の花の名所としてお宮緑地を中心に平成26年６月６日に「ジャカランダ遊歩道」がオープンしました。
2
完成記念式典はあいにくの雨だったものの、篤志家である(株)大塚商会の大塚実名誉会長、
3
ジョゼ・デ・フレイタス・フェラース駐日ポルトガル大使をはじめとして、多くの関係者が一堂に介し、新たな花の名所の誕生を祝いました。

1
function chall(str = "[1, 2, 3]") {
2
  const sanitized = str.replaceAll(" ", "");
3
  if (sanitized.length < 10) {
4
    return `error: no flag for you. sanitized string is ${sanitized}, length is ${sanitized.length.toString()}`;
5
  }
6
  const array = JSON.parse(sanitized);
7
  if (array.length < 0) {
8
    // hmm...??
9
    return FLAG;
10
  }
11
  return `error: no flag for you. array length is too long -> ${array.length}`;
12
}

1
@app.route('/flash')
2
def flash():
3
    session_id = session.get('session_id')
4
    if not session_id:
5
        return redirect(url_for('index'))
6

7
    r = session.get('round', 0)
8
    if r >= TOTAL_ROUNDS:
9
        return redirect(url_for('result'))
10

11
    digits = generate_round_digits(SEED, session_id, r)
12

13
    session['round'] = r + 1
14

15
    visible = (session['round'] <= 3) or (session['round'] > 7)
16
    return render_template('flash.html', round=session['round'], total=TOTAL_ROUNDS, digits=digits, visible=visible)

1
with open('./static/seed.txt', 'r') as f:
2
    SEED = bytes.fromhex(f.read().strip())
3

4
def lcg_params(seed: bytes, session_id: str):
5
    m = 2147483693
6
    raw_a = hmac.new(seed, (session_id + "a").encode(), hashlib.sha256).digest()
7
    a = (int.from_bytes(raw_a[:8], 'big') % (m - 1)) + 1
8
    raw_c = hmac.new(seed, (session_id + "c").encode(), hashlib.sha256).digest()
9
    c = (int.from_bytes(raw_c[:8], 'big') % (m - 1)) + 1
10
    return m, a, c
11

12
def generate_round_digits(seed: bytes, session_id: str, round_index: int):
13
    LCG_M, LCG_A, LCG_C = lcg_params(seed, session_id)
14

15
    h0 = hmac.new(seed, session_id.encode(), hashlib.sha256).digest()
16
    state = int.from_bytes(h0, 'big') % LCG_M
17

18
    for _ in range(DIGITS_PER_ROUND * round_index):
19
        state = (LCG_A * state + LCG_C) % LCG_M
20

21
    digits = []
22
    for _ in range(DIGITS_PER_ROUND):
23
        state = (LCG_A * state + LCG_C) % LCG_M
24
        digits.append(state % 10)
25

26
    return digits

1
location /images {
2
    alias /var/www/flash/static/images/;
3
}

1
import string
2

3
plaintext = '[REDACTED]'
4
key = '[REDACTED]'
5

6
#    <plaintext>               <ciphertext>
7
# ...?? tsukuctf, ??... ->  ...aa tsukuctf, hj...
8
assert plaintext[30:38] == 'tsukuctf'
9

10

11
# https://ja.wikipedia.org/wiki/%E3%83%B4%E3%82%A3%E3%82%B8%E3%83%A5%E3%83%8D%E3%83%AB%E6%9A%97%E5%8F%B7#%E6%95%B0%E5%BC%8F%E3%81%A7%E3%81%BF%E3%82%8B%E6%9A%97%E5%8F%B7%E5%8C%96%E3%81%A8%E5%BE%A9%E5%8F%B7
12
def f(p, k):
13
    p = ord(p) - ord('a')
14
    k = ord(k) - ord('a')
15
    ret = (p + k) % 26
16
    return chr(ord('a') + ret)
17

18

19
def encrypt(plaintext, key):
20
    assert len(key) <= len(plaintext)
21

22
    idx = 0
23
    ciphertext = []
24
    cipher_without_symbols = []
25

26
    for c in plaintext:
27
        if c in string.ascii_lowercase:
28
            if idx < len(key):
29
                k = key[idx]
30
            else:
31
                k = cipher_without_symbols[idx-len(key)]
32
            cipher_without_symbols.append(f(c, k))
33
            ciphertext.append(f(c, k))
34
            idx += 1
35
        else:
36
            ciphertext.append(c)
37

38
    ciphertext = ''.join(c for c in ciphertext)
39

40
    return ciphertext
41

42

43
ciphertext = encrypt(plaintext=plaintext, key=key)
44

45
with open('output.txt', 'w') as f:
46
    f.write(f'{ciphertext=}\n')

1
import os
2
import secrets
3
import signal
4

5
FLAG = os.getenv("FLAG", "TsukuCTF25{dummy_flag}")
6

7
class xor_tsuku_shift:
8
    def __init__(self, seed):
9
        self.a = seed
10

11
    def shift(self):
12
        self.a ^= (self.a << 17) & 0xFFFFFFFFFFFFFFFF
13
        self.a ^= (self.a >> 9) & 0xFFFFFFFFFFFFFFFF
14
        self.a ^= (self.a << 18) & 0xFFFFFFFFFFFFFFFF
15
        return self.a & 0xFFFFFFFFFFFFFFFF
16

17
def janken(a, b):
18
    return (a-b+3) % 3
19

20
rng = xor_tsuku_shift(seed=secrets.randbits(64))
21

22
signal.alarm(600)
23

24
print("Tsukushi: Let's play janken!")
25
print("Tsukushi: Win 294 times in a row and you'll get the flag.")
26

27
for challenge in range(300):
28
    print(f"Tsukushi: You have {300-challenge:03} tries.")
29
    for round in range(294):
30
        print(f"--- Round {round:03} ---")
31
        tsukushi = rng.shift()
32
        you = int(input("Rock, Paper, Scissors... Go! (Rock: 0, Paper: 1, Scissors: 2): "))
33

34
        if you != 0 and you != 1 and you != 2:
35
            print("Tsukushi: Hey, you cheated!")
36
            break
37

38
        result = janken(you, tsukushi)
39

40
        if result == 1:
41
            print("Tsukushi: You win!")
42
            if round != 293:
43
                print("Tsukushi: Let's go to the next round!")
44
        elif result == 0:
45
            print("Tsukushi: Draw! ...But If you wanna get the flag, you have to win 294 rounds in a row.")
46
            break
47
        else:
48
            print("Tsukushi: You lose!")
49
            break
50

51
    else:
52
        print("Tsukushi: You won 294 times in a row?! That's incredible!")
53
        print(f"Tsukushi: So, here is the flag. {FLAG}")
54
        quit()
55

56
else:
57
    print("Tsukushi: GGEZ, Bye!")

1
from pwn import *
2
import re
3

4
HOST, PORT = "challs.tsukuctf.org", 30057
5
PROMPT   = b"(Rock: 0, Paper: 1, Scissors: 2): "
6

7
def recv_prompt(r):
8
    r.recvuntil(PROMPT)
9

10
def parse_result(line: bytes) -> int:
11
    s = line.decode()
12
    if   "You win"   in s: return 1
13
    elif "Draw"      in s: return 0
14
    elif "You lose"  in s: return 2
15
    else: raise ValueError("unexpected server output")
16

17
def main():
18
    r = remote(HOST, PORT)
19
    cycle = []
20

21
    # ------- Phase 1 : collect 280 outputs mod 3 -------
22
    while len(cycle) < 280:
23
        recv_prompt(r)
24
        r.sendline(b"0")          # always Rock
25
        res = parse_result(r.recvline())
26
        ts = (-res) % 3           # tsukushi mod 3; because we played 0
27
        cycle.append(ts)
28
        print(len(cycle))
29
        if res != 1:              # lost / draw → next try block
30
            continue
31

32
    # ------- Phase 2 : exit the current try block -------
33
    # send an illegal value (“cheat”) to force a break
34
    recv_prompt(r)
35
    r.sendline(b"3")              # triggers "Hey, you cheated!"
36
    print("done")
37
    r.recvuntil(b"cheated!")      # flush current block
38

39
    # RNG has advanced exactly one extra step we didn't record
40
    offset = 1                    # we start at cycle[1]
41
    recv_prompt(r)                # first prompt of the new try
42

43
    # ------- Phase 3 : 294 perfect moves -------
44
    for i in range(294):
45
        print(i)
46
        ts = cycle[(i + offset) % 280]
47
        you = (ts + 1) % 3        # the winning move
48
        r.sendline(str(you).encode())
49

50
        res = parse_result(r.recvline())
51
        if res != 1:
52
            print("alignment failed :(")
53
            return
54

55
        if i != 293:              # skip "next round!" etc.
56
            recv_prompt(r)
57

58
    # flag line appears after the inner loop finishes
59
    print(r.recvall().decode())
60

61
if __name__ == "__main__":
62
    main()

1
# REQUIRED: OpenSSL 3.5.0
2

3
import os
4
from Crypto.Cipher import AES
5
from Crypto.Util.Padding import pad
6

7
flag = "TsukuCTF25{hoge}"
8

9
# generate private key
10
os.system("openssl genpkey -algorithm ML-KEM-768 -out priv-ml-kem-768.pem")
11
# generate public key
12
os.system("openssl pkey -in priv-ml-kem-768.pem -pubout -out pub-ml-kem-768.pem")
13
# generate shared secret
14
os.system("openssl pkeyutl -encap -inkey pub-ml-kem-768.pem -secret shared.dat -out ciphertext.dat")
15

16
with open("priv-ml-kem-768.pem", "rb") as f:
17
    private_key = f.read()
18

19
print("==== private_key ====")
20
print(private_key.decode())
21

22
with open("ciphertext.dat", "rb") as f:
23
    ciphertext = f.read()
24

25
print("==== ciphertext(hex) ====")
26
print(ciphertext.hex())
27

28
with open("shared.dat", "rb") as f:
29
    shared_secret = f.read()
30

31
encrypted_flag = AES.new(shared_secret, AES.MODE_ECB).encrypt(pad(flag, 16))
32

33
print("==== encrypted_flag(hex) ====")
34
print(encrypted_flag.hex())

1
==== private_key ====
2
-----BEGIN PRIVATE KEY-----
3
...
4
-----END PRIVATE KEY-----
5

6
==== ciphertext(hex) ====
7
83d...7ab65
8
==== encrypted_flag(hex) ====
9
5f2b9c04a67523dac3e0b0d17f79aa2879f91ad60ba8d822869ece010a7f78f349ab75794ff4cb08819d79c9f44467bd

1
from Crypto.Cipher import AES
2

3
with open("shared.dat", "rb") as f:
4
    shared_secret = f.read()
5

6
encrypted_flag = bytes.fromhex("5f2b9c04a67523dac3e0b0d17f79aa2879f91ad60ba8d822869ece010a7f78f349ab75794ff4cb08819d79c9f44467bd")
7
flag = AES.new(shared_secret, AES.MODE_ECB).decrypt(encrypted_flag)
8

9
print(flag.decode())