changed repo structure

2025/cscg/crypto/intro3/exploit.py

@@ -0,0 +1,45 @@
+from z3 import Solver, BitVec, sat
+
+def rng(x, size):
+    return (x*A+B) & ((2**size)-1)
+
+def gen_random(seed, bits, mask):
+    state = seed
+    while True:
+        state = rng(state, bits)
+        yield state & mask
+
+A = BitVec("A", 56)
+B = BitVec("B", 56)
+SEED = BitVec("seed", 56)
+BITS = 56 
+MASK = 0xFF
+
+state = SEED 
+
+with open("./msg.txt", "r") as f:
+    nums = [int(n) for n in f.readlines()[1:]]
+    print(nums)
+
+flag_bytes = [BitVec(f'flag_{i}', 56) for i in range(142)]
+
+solver = Solver()
+
+for i, n in enumerate(nums):
+    state = rng(state, BITS)
+    cur_num = state & MASK
+    solver.add(n == cur_num ^ flag_bytes[i])
+    solver.add(flag_bytes[i] >= 32, flag_bytes[i] <= 126)
+
+if solver.check() == sat:
+    model = solver.model()
+    flag = ''.join([chr(model[flag_bytes[i]].as_long()) for i in range(142)])
+    print(model)
+    print(flag)
+else:
+    print("Not solveable")
+
+
+
+
+

2025/cscg/crypto/intro3/main.py

@@ -0,0 +1,28 @@
+import os
+import struct
+
+BITS = 56
+
+FLAG = os.getenv("FLAG", "CSCG{TESTFLAG}")
+
+A = int.from_bytes(os.urandom(BITS//8), "little")
+B = int.from_bytes(os.urandom(BITS//8), "little")
+SEED = int.from_bytes(os.urandom(BITS//8), "little")
+
+def rng(x, size):
+    return (x*A+B) & ((2**size)-1)
+
+def gen_random(seed, bits, mask):
+    state = seed
+    while True:
+        state = rng(state, bits)
+        yield state & mask
+
+def main():
+    print("Here are some random numbers, now guess the flag")
+    rng = gen_random(SEED, BITS, 0xFF)
+    for i in range(len(FLAG)):
+        print(next(rng) ^ ord(FLAG[i]))
+
+if __name__ == "__main__":
+    main()

2025/cscg/crypto/intro3/msg.txt

@@ -0,0 +1,143 @@
+Here are some random numbers, now guess the flag
+131
+133
+203
+41
+107
+11
+53
+11
+25
+236
+124
+4
+220
+107
+146
+127
+121
+204
+156
+100
+59
+75
+242
+95
+217
+44
+44
+71
+135
+171
+85
+171
+57
+12
+92
+167
+231
+139
+181
+139
+153
+108
+252
+132
+92
+235
+18
+255
+249
+76
+28
+228
+188
+203
+117
+207
+89
+172
+188
+199
+7
+43
+213
+43
+185
+140
+204
+39
+103
+11
+53
+15
+25
+236
+124
+4
+219
+107
+149
+107
+121
+219
+140
+100
+59
+75
+242
+95
+217
+44
+44
+68
+155
+171
+85
+175
+57
+27
+76
+164
+252
+139
+181
+143
+153
+108
+252
+135
+71
+235
+21
+239
+249
+76
+28
+228
+187
+203
+117
+207
+89
+187
+172
+196
+27
+43
+213
+43
+185
+140
+204
+36
+124
+11
+53
+15
+25
+236
+105
+115
+141
+91