├── CSAW CTF 2022 └── The Big Bang.py ├── CTFlearn ├── 5x5 Crypto.py ├── ALEXCTF CR2: Many time secrets.py ├── Character Encoding.py ├── CoppeRSA Lattice.py ├── Encryption Master.py ├── Hextroadinary.py ├── RE_verseDIS.py ├── RSA Beginner.py ├── RSA Noob.py ├── RSA Twins!.py ├── Ramada.py ├── Raspberry.py ├── Reverse Me.py ├── Reverse Polarity.py ├── Reykjavik.py ├── Symbolic Decimals.py └── Tone dialing.py ├── CryptoBurst CTF └── running slow alpaca.py ├── Cryptoverse CTF 2022 ├── Cherry Blossom.py └── Not Georainbolt.py ├── DUCTF 2022 ├── Legit App Not Ransomware.py └── source provided.py ├── Flare-On 9 (with Writeups) ├── 01 - Flaredle.md ├── 02 - Pixel Poker.md ├── 03 - Magic 8 Ball.md └── Images │ ├── flag.png │ ├── image_2022-10-01_094719698.png │ ├── image_2022-10-01_094725006.png │ ├── image_2022-10-01_161957328.png │ ├── image_2022-10-01_162015754.png │ ├── image_2022-10-01_162043280.png │ ├── image_2022-10-01_162101597.png │ ├── image_2022-10-01_162121596.png │ ├── image_2022-10-01_162128693.png │ └── run.png ├── Flare-On Stats ├── GDG Algiers CTF ├── impossible_challenge.py └── traditions.py ├── HACKME.zip ├── HTB University CTF 2022 └── PotionMaster.py ├── Hack The Box ├── Crypto │ └── Weak RSA.py └── Rev │ ├── Golfer - Part 1.py │ ├── Impossible Password.py │ ├── Rebuilding.py │ ├── Simple Encryptor.py │ ├── Spooky License.py │ ├── WIDE.py │ └── You Cant C Me.py ├── LakeCTF └── Baby rev.py ├── PMXTResources ├── README.md ├── dnspy1.png ├── dnspy2.png ├── dnspy3.png ├── dnspy4.png ├── dnspy5.png ├── dnspy6.png ├── dnspy7.png ├── files.png ├── flag1.png ├── flag2.png ├── flag3.png ├── pmxt.mp4 └── pmxt2.mp4 ├── Perfect Match X-Treme (Introduction to RE).MD ├── README.md ├── Reversing.Kr ├── Easy ELF.py └── Easy Keygen.py ├── SEKAI CTF 2022 └── Let’s Play Osu!Mania.cpp ├── SHELL CTF 2022 ├── Keygen.py ├── swift.py ├── tea.py └── warmup.py ├── SekaiCTF 2023 ├── README.md └── sahuang ├── Viblo CTF ├── Login.py ├── Old Computer.py ├── Python Maze.py └── XOR easy.py ├── WRECKCTF └── advanced-flag-checker.py ├── WhiteHat Wargame └── re07-flagcheck.py ├── amateursCTF 2023 ├── JVM.class ├── README.md ├── code.jvm ├── csce221.tar.gz ├── emojis.tar.gz ├── flagchecker.sb3 ├── headache ├── jvm.tar.gz ├── rusteze ├── rusteze-2.exe ├── trick-question.pyc └── volcano ├── angrsolvr.py ├── angstromCTF 2019 ├── Classy Cipher.py ├── High Quality Checks.py ├── One Bite.py └── Really Secure Algorithm.py ├── angstromCTF 2020 ├── Reasonably Strong Algorithm.py └── Taking Off.py ├── angstromCTF 2022 ├── Randomly Sampled Algorithm.py └── uninspired.cpp ├── codegate2025 ├── client ├── prob └── readme.md ├── feature.png ├── ida.md ├── imaginaryCTF 2023 ├── README.md ├── chall.py ├── check.py ├── goated.py ├── ictf.unfactored ├── main ├── program ├── sheepish.py ├── ts.ts └── vm ├── objdump ├── README.md ├── exploit.md ├── objdump ├── objdump_patch.c └── objdump_patched ├── picoCTF ├── 1_wanna_b3_a_r0ck5tar.py ├── New Caesar.py ├── PW Crack 5.py ├── asm1.py ├── asm2.py ├── droids2.py ├── reverse_cipher.py └── vault-door-8.py ├── pwn.college └── babyrev level 1.0.py └── sanryu.exe /CSAW CTF 2022/The Big Bang.py: -------------------------------------------------------------------------------- 1 | from pwn import * 2 | import random 3 | import binascii 4 | 5 | p = remote("rev.chal.csaw.io", 5004) 6 | MAGIC = 73 7 | 8 | def gen_iv(tmp): 9 | iv_a = tmp 10 | return iv_a, [b"\xff" * MAGIC if iv_a[i] == '1' else b"\x00" * MAGIC for i in range(MAGIC)] 11 | 12 | p.recvline() 13 | tmp = p.recvline()[25:-1].decode() 14 | 15 | iv_a, iv_b = gen_iv(tmp) 16 | p.sendline(binascii.hexlify(b''.join(iv_b))) 17 | p.interactive() 18 | -------------------------------------------------------------------------------- /CTFlearn/5x5 Crypto.py: -------------------------------------------------------------------------------- 1 | #Made by FazeCT 2 | 3 | data = ['1-3','4-4','2-1','{','4-4','2-3','4-5','3-2','1-2','4-3','_','4-5','3-5','}'] 4 | 5 | cipher = [['A','B','C','D','E'],['F','G','H','I','J'],['L','M','N','O','P'],['Q','R','S','T','U'],['V','W','X','Y','Z']] 6 | 7 | for c in data: 8 | if c == '{' or c == '}' or c == '_': 9 | print(c,end='') 10 | continue 11 | else: 12 | print(cipher[int(c[0])-1][int(c[2])-1],end='') 13 | -------------------------------------------------------------------------------- /CTFlearn/ALEXCTF CR2: Many time secrets.py: -------------------------------------------------------------------------------- 1 | #Made by FazeCT 2 | 3 | import binascii 4 | 5 | data = ['0529242a631234122d2b36697f13272c207f2021283a6b0c7908', 6 | '2f28202a302029142c653f3c7f2a2636273e3f2d653e25217908', 7 | '322921780c3a235b3c2c3f207f372e21733a3a2b37263b313012', 8 | '2f6c363b2b312b1e64651b6537222e37377f2020242b6b2c2d5d', 9 | '283f652c2b31661426292b653a292c372a2f20212a316b283c09', 10 | '29232178373c270f682c216532263b2d3632353c2c3c2a293504', 11 | '613c37373531285b3c2a72273a67212a277f373a243c20203d5d', 12 | '243a202a633d205b3c2d3765342236653a2c7423202f3f652a18', 13 | '2239373d6f740a1e3c651f207f2c212a247f3d2e65262430791c', 14 | '263e203d63232f0f20653f207f332065262c3168313722367918', 15 | '2f2f372133202f142665212637222220733e383f2426386b'] 16 | 17 | def xor(msg,key): 18 | ret = '' 19 | for i in range(len(key)): 20 | ret += chr(ord(msg[i]) ^ ord(key[i])) 21 | return ret 22 | 23 | key = 'ALEXCTF{HERE_GOES_THE_KEY}' 24 | for i in data: 25 | res = '' 26 | msg = bytes.fromhex(i).decode('utf-8') 27 | res = xor(msg,key) 28 | print(res,end = '') 29 | -------------------------------------------------------------------------------- /CTFlearn/Character Encoding.py: -------------------------------------------------------------------------------- 1 | #Made by FazeCT 2 | 3 | data = "41 42 43 54 46 7B 34 35 43 31 31 5F 31 35 5F 55 35 33 46 55 4C 7D" 4 | print(bytes.fromhex(data).decode('utf-8')) 5 | -------------------------------------------------------------------------------- /CTFlearn/CoppeRSA Lattice.py: -------------------------------------------------------------------------------- 1 | #Made by FazeCT 2 | 3 | from Crypto.Util.number import bytes_to_long, long_to_bytes,getPrime, inverse 4 | 5 | n = 8281850967132278399574272688766937486036646313403007679588335903785669628431708760927341727806006769095252325575815709840401878674105658204057327337750902945521512357960818523078486774689928139816732080923197367563639383252762498921096166065153092144335239373370093976823925031794323976150363874930075228846801224430767428594024165529140949082062667410186456029480046489969338885725614510660737026927443934115006027747874368836800022473917576424175601374800697491622086825964475396316066082109998646438504664272000556702241576240616765962934452557847306066736505798267513078073147161755828577875047115978481485076227911405625234425533967247248864837854031634968764570599279385827285321806293661331225163255461894680337693227417748934924109356565823327149859245521513696171473417470936260563397398387972467438182651142096935931112668743912944902147582538985769095457203775208567489073198557073226907349118348902079942096374377432431441166710584381655348979330535397040250376989291669788189409825278457889980676574146044704329826483808929549888234303934178478274711686806257841293265249466735277673158607466360053037971774844824065612178793324128914371112619033111301900922374201703477207948412866443213080633623441392016518823291181 6 | e = 65537 7 | p = 2877820523787450925749443223409676535526103461002156158445828224293671401993991478543020287097392331073352851877283061169200661485601861126177989029099279726556037706157577055235829106587295127330817726845862915284936240880512882371822435354503703582818585826639860414460347276612398615213473473435297607044419660432857760267782763215613805061134548930946450808892523918406477350229326879718460875896139320212120566207583969498664502640043503068067423704342779684140776844591504545219651693576024138161226306265777913216051021635043708034933142150577361241126706252795462441428424206966514776010058207246337809108763 8 | q = 2877820523787450925749443223409676535526103461002156158445828224293671401993991478543020287097392331073352851877283061169200661485601861126177989029099279726556037706157577055235829106587295127330817726845862915284936240880512882371822435354503703582818585826639860414460347276612398615213473473435297607044419660432857760267782763215613805061134548930946450808892523918406477350229326879718460875896139320212120566207583969498664502640043503068067423704342779684140776844591504545219651693576024138161226306265777913216051021635043708034966478921186010140653104995611058414645030602000549187384764408555794028217687 9 | c = 6407923537926201847312357068295079879508779752068254604904486842729636773279241546432035102141932853761974844472828552921133743850412718722424893044377874567625621282274625365299685502104113862870672461666586814138206797733946319875258776059721304226419810313489197076949529322847815009706727586961448584443159011118432142946962961532154723891985416387650240762711716865116844837968079333914181751979527853152286708153252001832721723040664452442266930832118353632114958540067674924812749763008217133300059446967170825813909142247660230309955433005706793802514554628379255160648976960069078223370104177403453404917998945232459801324103878906593528309460372271638119657797804398399482025063414403804134607772871958848100256643503372624214762343403925077455660522664025602043433142314759978192969519687720668535544914589329155338178120703060384042066182354031274600184116143293639032906542194564776766076911767759167772137229504115598174156646085123675283692418970988032320780636742598466655712520383055569607154074137271584433653335176877094399371749081016317705026349554938167377640856287458145646649292278971980553895419112860061073864077521131958519819285117031990498977039003918710661660868949818362940359852436185282868088342132 10 | 11 | phi = (p-1)*(q-1) 12 | d = inverse(e,phi) 13 | msg = pow(c,d,n) 14 | print(long_to_bytes(msg)) 15 | -------------------------------------------------------------------------------- /CTFlearn/Encryption Master.py: -------------------------------------------------------------------------------- 1 | #Made by FazeCT 2 | 3 | import base64 4 | 5 | data = 'TmljZSEgTm93IGtlZXAgZ29pbmcuIDU0Nzc2ZjIwNmQ2ZjcyNjUyZTIwMzAzMTMwMzAzMDMxMzEzMDIwMzAzMTMxMzAzMTMwMzAzMTIwMzAzMTMxMzAzMTMxMzEzMDIwMzAzMTMxMzAzMDMwMzAzMTIwMzAzMTMxMzAzMTMxMzAzMDIwMzAzMDMxMzAzMDMwMzAzMDIwMzAzMTMwMzAzMDMxMzAzMDIwMzAzMTMxMzAzMDMxMzAzMTIwMzAzMTMxMzAzMDMwMzEzMTIwMzAzMTMxMzEzMDMwMzEzMDIwMzAzMTMxMzEzMTMwMzAzMTIwMzAzMTMxMzEzMDMwMzAzMDIwMzAzMTMxMzEzMDMxMzAzMDIwMzAzMTMxMzAzMTMwMzAzMTIwMzAzMTMxMzAzMTMxMzEzMTIwMzAzMTMxMzAzMTMxMzEzMDIwMzAzMDMxMzAzMDMwMzAzMTIwMzAzMDMxMzAzMDMwMzAzMDIwMzAzMTMwMzEzMDMwMzAzMTIwMzAzMDMxMzEzMDMwMzAzMTIwMzAzMTMwMzEzMDMwMzEzMDIwMzAzMTMwMzAzMDMxMzEzMTIwMzAzMTMxMzAzMDMxMzAzMTIwMzAzMDMxMzEzMDMwMzAzMDIwMzAzMTMxMzAzMTMxMzAzMDIwMzAzMTMxMzAzMDMxMzEzMDIwMzAzMTMwMzEzMDMwMzAzMTIwMzAzMTMwMzEzMDMxMzAzMTIwMzAzMDMxMzEzMDMwMzAzMTIwMzAzMTMxMzAzMDMxMzEzMDIwMzAzMTMwMzEzMDMxMzAzMTIwMzAzMTMwMzAzMDMxMzEzMDIwMzAzMTMwMzAzMTMwMzEzMDIwMzAzMTMwMzEzMDMwMzAzMDIwMzAzMTMwMzEzMDMxMzEzMDIwMzAzMTMwMzEzMDMxMzAzMTIwMzAzMTMwMzEzMDMwMzEzMDIwMzAzMTMxMzAzMDMxMzEzMDIwMzAzMTMwMzEzMDMxMzAzMDIwMzAzMDMxMzEzMDMwMzAzMDIwMzAzMTMwMzEzMTMwMzEzMDIwMzAzMTMxMzAzMDMxMzEzMDIwMzAzMTMwMzEzMDMxMzEzMTIwMzAzMTMwMzEzMDMxMzAzMTIwMzAzMDMxMzEzMTMwMzAzMTIwMzAzMTMwMzEzMDMxMzEzMDIwMzAzMTMxMzAzMDMxMzEzMDIwMzAzMTMwMzEzMDMwMzAzMTIwMzAzMDMxMzEzMTMxMzAzMTIwMzAzMDMxMzEzMTMxMzAzMQ==' 6 | message = str(base64.b64decode(data),'utf-8') 7 | message2 = bytes.fromhex(message[22:]).decode('utf-8') 8 | list = message2[10:].split() 9 | message3 = '' 10 | for i in list: 11 | message3 += chr(int(i,2)) 12 | print(str(base64.b64decode(message3[18:]),'utf-8')) 13 | -------------------------------------------------------------------------------- /CTFlearn/Hextroadinary.py: -------------------------------------------------------------------------------- 1 | #Made by FazeCT 2 | 3 | data1 = '0xc4115' 4 | data2 = '0x4cf8' 5 | print(hex(int(data1,16) ^ int(data2,16))) 6 | -------------------------------------------------------------------------------- /CTFlearn/RE_verseDIS.py: -------------------------------------------------------------------------------- 1 | key = "IdontKnowWhatsGoingOn" 2 | data = [0x08,0x06,0x2C,0x3A,0x32,0x30,0x1C,0x5C,0x01,0x32,0x1A,0x12,0x45,0x1D,0x20,0x30,0x0D,0x1B,0x03,0x7C,0x13] 3 | for i in range(22): 4 | print(chr(int(str(data[i])) ^ ord(key[i])), end = '') 5 | -------------------------------------------------------------------------------- /CTFlearn/RSA Beginner.py: -------------------------------------------------------------------------------- 1 | #Made by FazeCT 2 | 3 | from Crypto.Util.number import bytes_to_long, long_to_bytes,getPrime, inverse 4 | 5 | n = 245841236512478852752909734912575581815967630033049838269083 6 | e = 3 7 | c = 219878849218803628752496734037301843801487889344508611639028 8 | p = 416064700201658306196320137931 9 | q = 590872612825179551336102196593 10 | 11 | phi = (p-1)*(q-1) 12 | d = inverse(e,phi) 13 | msg = pow(c,d,n) 14 | print(long_to_bytes(msg)) 15 | -------------------------------------------------------------------------------- /CTFlearn/RSA Noob.py: -------------------------------------------------------------------------------- 1 | #Made by FazeCT 2 | 3 | from Crypto.Util.number import bytes_to_long, long_to_bytes,getPrime, inverse 4 | 5 | n = 245841236512478852752909734912575581815967630033049838269083 6 | e = 1 7 | c = 9327565722767258308650643213344542404592011161659991421 8 | 9 | phi = n-1 10 | d = inverse(e,phi) 11 | msg = pow(c,d,n) 12 | print(long_to_bytes(msg)) 13 | -------------------------------------------------------------------------------- /CTFlearn/RSA Twins!.py: -------------------------------------------------------------------------------- 1 | #Made by FazeCT 2 | 3 | from Crypto.Util.number import bytes_to_long, long_to_bytes,getPrime, inverse 4 | 5 | n = 14783703403657671882600600446061886156235531325852194800287001788765221084107631153330658325830443132164971084137462046607458019775851952933254941568056899 6 | e = 65537 7 | p = 121588253559534573498320028934517990374721243335397811413129137253981502291629 8 | q = 121588253559534573498320028934517990374721243335397811413129137253981502291631 9 | c = 684151956678815994103733261966890872908254340972007896833477109225858676207046453897176861126186570268646592844185948487733725335274498844684380516667587 10 | 11 | phi = (p-1)*(q-1) 12 | d = inverse(e,phi) 13 | msg = pow(c,d,n) 14 | print(long_to_bytes(msg)) 15 | -------------------------------------------------------------------------------- /CTFlearn/Ramada.py: -------------------------------------------------------------------------------- 1 | import numpy as np 2 | data = [0x13693, 0x6b2c0, 0x11a9f9, 0x157000, 0x1cb91, 0x1bb528, 0x1bb528, 0xded21, 0x144f38, 0xfb89d, 0x169b48, 0xd151f, 0x8b98b, 0x17d140, 0xded21, 0x1338c0, 0x1338c0, 0x11a9f9, 0x1b000, 0x144f38, 0x1734eb] 3 | for i in data: 4 | n = int(str(i)) 5 | print(chr(int(np.cbrt(n))),end='') 6 | -------------------------------------------------------------------------------- /CTFlearn/Raspberry.py: -------------------------------------------------------------------------------- 1 | #Made by FazeCT 2 | 3 | print('CTFlearn{+Fru',end='') 4 | n1 = int('0x89d',0) 5 | n2 = int('0x15',0) 6 | print(chr(n1//n2),end='') 7 | n3 = 5 * int('0x15',0) + int('0xb',0) 8 | print(chr(n3),end='') 9 | print('123}',end='') 10 | -------------------------------------------------------------------------------- /CTFlearn/Reverse Me.py: -------------------------------------------------------------------------------- 1 | data = [ord('W'),ord('B'),ord('K'),ord('E'),-52,-69,-127,-52,113,122,113,102,-33,-69,-122,-51,100,111,110,92,-14,-83,-102,-40,ord('~'),ord('o')] 2 | for i in range(0, len(data) - 1, 2): 3 | data[i], data[i+1] = data[i+1], data[i] 4 | enc = [1,3,3,7,222,173,190,239] 5 | for i in range(len(data)): 6 | data[i] ^= enc[i % 8] 7 | if data[i] > 0: print(chr(data[i]), end='') 8 | else: print(chr(256 + data[i]), end='') 9 | -------------------------------------------------------------------------------- /CTFlearn/Reverse Polarity.py: -------------------------------------------------------------------------------- 1 | #Made by FazeCT 2 | 3 | data = "01000011010101000100011001111011010000100110100101110100010111110100011001101100011010010111000001110000011010010110111001111101" 4 | for i in range(0,len(data),8): 5 | tmp = data[i:i+8] 6 | print(bytes.fromhex(hex(int(tmp,2))[2:]).decode('utf-8'),end = '') 7 | -------------------------------------------------------------------------------- /CTFlearn/Reykjavik.py: -------------------------------------------------------------------------------- 1 | #Made by FazeCT 2 | 3 | data1 = [0xC5,0xD9,0xCA,0xCE,0xC7,0xED,0xFF,0xE8] 4 | data2 = [0xDD,0x9B,0xE7,0xF4,0xCE,0xD2,0xEE,0xD0] 5 | data3 = [0xC5,0xCA,0xC7,0xCE,0xC8,0xE2,0xF4,0xCE] 6 | data4 = [0xCF] 7 | data5 = [0xF4] 8 | data6 = [0xD6] 9 | 10 | def xor(data,key = 0xAB): 11 | res = '' 12 | for i in reversed(data): 13 | print(chr(i ^ key),end='') 14 | 15 | xor(data1) 16 | xor(data2) 17 | xor(data3) 18 | xor(data4) 19 | xor(data5) 20 | xor(data6) 21 | 22 | 23 | -------------------------------------------------------------------------------- /CTFlearn/Symbolic Decimals.py: -------------------------------------------------------------------------------- 1 | #Made by FazeCT 2 | 3 | data = "^&,*$,&),!@#,*#,!!^,(&,!!$,(%,$^,(%,*&,(&,!!$,!!%,(%,$^,(%,&),!!!,!!$,(%,$^,(%,&^,!)%,!)@,!)!,!@%" 4 | alphabet = "!@#$%^&*()" 5 | 6 | real_data = "" 7 | for i in data: 8 | if i == ',': 9 | real_data += ' ' 10 | else: 11 | real_data += str((alphabet.index(i) + 1) % 10) 12 | 13 | list = real_data.split() 14 | for i in list: 15 | print(chr(int(i)),end='') 16 | 17 | 18 | 19 | -------------------------------------------------------------------------------- /CTFlearn/Tone dialing.py: -------------------------------------------------------------------------------- 1 | #Made by FazeCT 2 | 3 | data = [67,84,70,108,101,97,110,123,67,82,89,80,84,79,71,82,65,80,72,89,125] 4 | for i in data: 5 | print(chr(i),end='') 6 | -------------------------------------------------------------------------------- /CryptoBurst CTF/running slow alpaca.py: -------------------------------------------------------------------------------- 1 | #Made by FazeCT 2 | 3 | from Crypto.Util.number import bytes_to_long, long_to_bytes,getPrime, inverse 4 | 5 | n = 11721152358236061520231546547637479326600733856476942783391651261161073932522251528868410691769508664585409225554242334270429894938143275720784205110462278896087432260439082955593874915727686637956899 6 | e = 65537 7 | c = 6812256108906808580842096167286381773117437019209058272927044969621400539304235590676657677688308762321423349008973167365619422226936328191708330391584793651978374345365082471251333289170056987765208 8 | p = 3423616853305296708261404925903697485956036650315221001507285374258954087994492532947084586412780869 9 | q = 3423616853305296708261404925903697485956036650315221001507285374258954087994492532947084586412780871 10 | 11 | phi = (p-1)*(q-1) 12 | d = inverse(e,phi) 13 | msg = pow(c,d,n) 14 | print(long_to_bytes(msg)) 15 | -------------------------------------------------------------------------------- /Cryptoverse CTF 2022/Cherry Blossom.py: -------------------------------------------------------------------------------- 1 | from pwn import * 2 | 3 | p = remote("137.184.215.151", 22602) 4 | 5 | def solve(n,m,b): 6 | sum = 0 7 | ans = -999999999999999999 8 | cnt = 0 9 | for i in range(0,n): 10 | sum += b[i] 11 | cnt += 1 12 | if ans < sum and cnt <= m: 13 | ans = sum 14 | if sum < 0: 15 | sum = 0 16 | cnt = 0 17 | return ans 18 | for i in range(10): 19 | p.recvlines(2) 20 | a = list(map(int,p.recvline().decode().split())) 21 | n = a[0] 22 | m = a[1] 23 | b = list(map(int,p.recvline().decode().split())) 24 | res = solve(n,m,b) 25 | p.sendline(str(res)) 26 | p.interactive() 27 | -------------------------------------------------------------------------------- /Cryptoverse CTF 2022/Not Georainbolt.py: -------------------------------------------------------------------------------- 1 | from pwn import * 2 | from geopy.geocoders import Nominatim 3 | import geocoder 4 | 5 | p = remote("137.184.215.151", 22606) 6 | geolocator = Nominatim(user_agent="geoapiExercises") 7 | 8 | s = p.recvlines(36) 9 | for i in range(50): 10 | a = p.recvline().decode() 11 | print(a) 12 | txt = p.recvline().decode() 13 | print(txt) 14 | if txt[0] == 'C': 15 | x = txt.split() 16 | x[3] = x[3][0:len(x[3])-1] 17 | location = geolocator.reverse(x[3] + "," + x[4]) 18 | addr = location.raw['address'] 19 | city = addr.get('city', '') 20 | print(city) 21 | p.sendline(city) 22 | else: 23 | x = txt.split() 24 | ip = geocoder.ip(x[1]) 25 | print(ip.city) 26 | p.sendline(ip.city) 27 | if i != 49: 28 | p.recvline() 29 | 30 | flag = p.recvlines(2) 31 | print(flag) 32 | -------------------------------------------------------------------------------- /DUCTF 2022/Legit App Not Ransomware.py: -------------------------------------------------------------------------------- 1 | import base64 2 | d = 'UkZWRFZF' 3 | u = 'WjdaREZrWDNrd2RW' 4 | c = 'OXdZV' 5 | t = 'zR4WTE4d2NsOWpNREJzWDJG' 6 | f = 'elgyTjFZM1Z0WWpOeWZRPT0' 7 | print(base64.b64decode(base64.b64decode(d + u + c + t + f + "==").decode())) 8 | -------------------------------------------------------------------------------- /DUCTF 2022/source provided.py: -------------------------------------------------------------------------------- 1 | data = [0x0C4,0x0DA,0x0C5,0x0DB,0x0CE,0x80,0x0F8,0x3E,0x82,0x0E8,0x0F7,0x82,0x0EF,0x0C0,0x0F3,0x86,0x89,0x0F0,0x0C7,0x0F9,0x0F7,0x92,0x0CA,0x8C,0x0FB,0x0FC,0x0FF,0x89,0x0FF,0x93,0x0D1,0x0D7,0x84,0x80,0x87,0x9A,0x9B,0x0D8,0x97,0x89,0x94,0x0A6,0x89,0x9D,0x0DD,0x94,0x9A,0x0A7,0x0F3,0x0B2] 2 | j = 0 3 | for c in data: 4 | for i in range(0, 255): 5 | if (i + 66 + j) ^ 66 == c: 6 | print(chr(i),end='') 7 | j += 1 8 | break 9 | -------------------------------------------------------------------------------- /Flare-On 9 (with Writeups)/01 - Flaredle.md: -------------------------------------------------------------------------------- 1 | # __Flare-On 9__ 2 | ## _01 - Flaredle_ 3 | 4 | ## Information 5 | **Category** | **Points** | **Writeup Author** 6 | --- | --- | --- 7 | Reverse Engineering | 1 | FazeCT 8 | 9 | **Description:** 10 | 11 | Welcome to Flare-On 9! 12 | 13 | You probably won't win. Maybe you're like us and spent the year playing Wordle. We made our own version that is too hard to beat without cheating. 14 | 15 | Play it live at: http://flare-on.com/flaredle/ 16 | 17 | ## Solution 18 | Đầu tiên, từ source 7z, unzip thu được được 2 file .js và 1 file .css, ta mở lên xem thử thì thấy: 19 | - File word.js chứa kha khá từ, chắc là word cần sử dụng cho challenge này. 20 | - File script.js chứa source của checker. 21 | 22 | Đọc qua source script.js ta thấy số lần dự đoán tối đa là 6, nên chắc chắn ko thể brute tất cả trong 1 lần chơi. 23 | 24 | Bỏ qua các hàm khởi tạo, ta bước thẳng vào checkGuess(). Nhận thấy source code có cho rightGuessString nằm ở index 57 của list, chính là flareonisallaboutcats, submit thử thì đúng luôn :)) 25 | 26 | ![Result](Images/image_2022-10-01_094725006.png) 27 | 28 | > Flag is: flareonisallaboutcats@flare-on.com 29 | -------------------------------------------------------------------------------- /Flare-On 9 (with Writeups)/02 - Pixel Poker.md: -------------------------------------------------------------------------------- 1 | # __Flare-On 9__ 2 | ## _02 - Pixel Poker_ 3 | 4 | ## Information 5 | **Category** | **Points** | **Writeup Author** 6 | --- | --- | --- 7 | Reverse Engineering | 1 | FazeCT 8 | 9 | **Description:** 10 | 11 | I said you wouldn't win that last one. I lied. The last challenge was basically a captcha. Now the real work begins. Shall we play another game? 12 | 13 | ## Solution 14 | Đầu tiên, từ source 7z, unzip thu được được 1 file .exe và 1 file .txt. 15 | 16 | Chạy thử .exe xem nó làm gì, thì được biết rằng mình cần phải click vào đúng tọa độ cho trước, và được 10 lần thử mỗi session. 17 | 18 | ![intro](Images/image_2022-10-01_162121596.png) 19 | 20 | Sử dụng cả dnSpy và dotPeek đều không trả ra gì có ích cả, tuy nhiên sử dụng IDA thì khác. 21 | Khi decompile bằng IDA, ta thấy hàm **wWinMain()** được gọi. 22 | 23 | ![WinMain](Images/image_2022-10-01_161957328.png) 24 | 25 | Tiếp tục thấy trong hàm **wWinMain()**, trước khi result được tính từ hàm **sub_401040()**, hàm **sub_401120()** được gọi. 26 | 27 | ![401120](Images/image_2022-10-01_162043280.png) 28 | 29 | Ta kiểm tra hàm **sub_401120()**, nhận thấy chương trình đang khởi tạo một class, trong đó đáng chú ý là thuộc tính **lpfnWndProc** tiếp tục là giá trị được trả về từ hàm **sub_4012C0**. 30 | 31 | ![4012C0](Images/image_2022-10-01_162101597.png) 32 | 33 | Trong hàm **sub_4012C0**, các thuộc tính của chương trình được thể hiện khá rõ như khi nào thì chương trình exit,... Tuy nhiên cái quan trọng cần chú ý là dòng sau: 34 | 35 | > _snprintf(String, 0x104u, "PixelPoker (%d,%d) - #%d/%d",(__int16)lParam, SHIWORD(lParam), dword_413298, 10); 36 | 37 | **lParam** và **SHIWORD(lParam)** chính là 2 giá trị ~~có lẽ~~ chúng ta cần tìm để giải được Challenge này. 38 | Tiếp tục kiểm tra xuống dưới ta thấy có 2 điều kiện được kiểm tra: 39 | 40 | > (__int16)lParam == dword_412004 % (unsigned int)cxval 41 | > SHIWORD(lParam) == dword_412008 % (unsigned int)cyval 42 | 43 | Trong đó **dword_412004** có giá trị bằng **0x52414C46** và **dword_412008** có giá trị bằng **0x6E4F2D45**. 44 | Vậy, việc còn lại chỉ là tìm kiếm **cxval** và **cyval**. 45 | 46 | Quay trở lại với hàm **sub_401040()** - nơi result được trả về, ta có thể thực hiện kỹ thuật debugging để có được giá trị của **cxval** và **cyval** lần lượt là **741** và **641**. 47 | 48 | ![401040](Images/image_2022-10-01_162015754.png) 49 | 50 | Từ đó ta có được tọa độ của vị trí cần click trong .exe để pass Challenge này. 51 | ```python 52 | data = 0x52414C46 53 | data1 = 0x6E4F2D45 54 | print(int(str(data)) % 741) 55 | print(int(str(data1)) % 641) 56 | #(95, 313) 57 | ``` 58 | 59 | ![win](Images/image_2022-10-01_162128693.png) 60 | 61 | > Flag is: w1nN3r_W!NneR_cHick3n_d1nNer@flare-on.com 62 | 63 | -------------------------------------------------------------------------------- /Flare-On 9 (with Writeups)/03 - Magic 8 Ball.md: -------------------------------------------------------------------------------- 1 | # __Flare-On 9__ 2 | ## _03 - Magic 8 Ball_ 3 | 4 | ## Information 5 | **Category** | **Points** | **Writeup Author** 6 | --- | --- | --- 7 | Reverse Engineering | 1 | FazeCT 8 | 9 | **Description:** 10 | 11 | You got a question? Ask the 8 ball! 12 | 13 | ## Solution 14 | Đầu tiên, mở thử .exe lên thì thấy giao diện cho phép nhập vào một chuỗi, đồng thời có thể bấm các nút mũi tên để lắc quả bóng. Sau khi nhập chuỗi và bấm Enter, sẽ trả ra "lời nói" từ quả bóng. 15 | 16 | ![Test](Images/run.png) 17 | 18 | Decompile bằng IDA ra thử, đọc sơ qua các hàm thì thấy có hàm **WinMain()**, bấm vào thì thấy nó return **sub_403690()**. 19 | Trong hàm **sub_403690()**, hàm **sub_4027A0()** được gọi, đây chính là main của .exe. 20 | ``` 21 | int __stdcall WinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance, LPSTR lpCmdLine, int nShowCmd) 22 | { 23 | return sub_403690(); 24 | } 25 | ``` 26 | ``` 27 | for ( i = sub_4027A0(pNumArgs, v4); v11 < pNumArgs; ++v11 ) 28 | ``` 29 | Lần lượt kiểm tra các lời gọi hàm khác từ hàm này, ta thấy có một số hàm như **sub_4012B0()** (là hàm chứa các "lời nói" của quả bóng), **sub_402090()** (hàm này khá sus vì có chứa chuỗi liên quan đến flag, đó là **"gimme flag pls?"** ở **this + 92**, và input từ user được lưu vào **this + 248**. 30 | ``` 31 | strcpy(this + 92, "gimme flag pls?"); 32 | ... 33 | sub_4018F0(this + 224, "Start typing your question (max. 75 characters): ", 0x31u); 34 | sub_4018F0(this + 248, &unk_40426C, 0); 35 | ``` 36 | Tiếp tục, ta thấy có 3 hàm được gọi tiếp đó là **sub_401E50()**, **sub_4024E0()** và **sub_4022A0()**. Trong đó, mình nhận thấy hàm **sub_4024E0()** có tiềm năng giúp pass challenge này nhất, vì trong đó lồng khá nhiều điều kiện if kiểm tra. 37 | ``` 38 | if ( v3 && *(_BYTE *)dword_406090 ) 39 | { 40 | do 41 | { 42 | Ticks = SDL_GetTicks(v5); 43 | sub_401E50((char *)dword_406090); 44 | sub_4024E0(dword_406090); 45 | sub_4022A0(dword_406090); 46 | v8 = SDL_GetTicks(v7) - Ticks; 47 | if ( v8 < 16 ) 48 | SDL_Delay(16 - v8); 49 | v5 = (_DWORD *)dword_406090; 50 | } 51 | while ( *(_BYTE *)dword_406090 ); 52 | } 53 | ``` 54 | Đi vào hàm **sub_4024E0()**, ở đoạn có nhiều điều kiện được lồng vào như đã nói trên, ta nhận thấy các char được so sánh chỉ bao gồm 'L', 'R', 'U', 'D', vừa hay đây cũng là 4 hướng mũi tên Left, Right, Up, Down. Nếu điều kiện thỏa, chương trình sẽ thực hiện so sánh **v22 (= this + 248)** và **this + 92**. 55 | ``` 56 | if ( *(_BYTE *)(this + 345) ) 57 | { 58 | v12 = v4[5]; 59 | v13 = v4; 60 | if ( v12 >= 0x10 ) 61 | v13 = (_BYTE *)*v4; 62 | if ( *v13 == 'L' ) 63 | { 64 | v14 = v4; 65 | if ( v12 >= 0x10 ) 66 | v14 = (_BYTE *)*v4; 67 | if ( v14[1] == 'L' ) 68 | { 69 | v15 = v4; 70 | if ( v12 >= 0x10 ) 71 | v15 = (_BYTE *)*v4; 72 | if ( v15[2] == 'U' ) 73 | { 74 | v16 = v4; 75 | if ( v12 >= 0x10 ) 76 | v16 = (_BYTE *)*v4; 77 | if ( v16[3] == 'R' ) 78 | { 79 | v17 = v4; 80 | if ( v12 >= 0x10 ) 81 | v17 = (_BYTE *)*v4; 82 | if ( v17[4] == 'U' ) 83 | { 84 | v18 = v4; 85 | if ( v12 >= 0x10 ) 86 | v18 = (_BYTE *)*v4; 87 | if ( v18[5] == 'L' ) 88 | { 89 | v19 = v4; 90 | if ( v12 >= 0x10 ) 91 | v19 = (_BYTE *)*v4; 92 | if ( v19[6] == 'D' ) 93 | { 94 | v20 = v4; 95 | if ( v12 >= 0x10 ) 96 | v20 = (_BYTE *)*v4; 97 | if ( v20[7] == 'U' ) 98 | { 99 | v21 = v4; 100 | if ( v12 >= 0x10 ) 101 | v21 = (_BYTE *)*v4; 102 | if ( v21[8] == 'L' ) 103 | { 104 | v22 = (const char *)(this + 248); 105 | if ( *(_DWORD *)(this + 268) >= 0x10u ) 106 | v22 = *(const char **)v22; 107 | if ( !strncmp(v22, (const char *)(this + 92), 15u) ) 108 | { 109 | sub_401220(v4); 110 | sub_401A10((_BYTE *)this, v23, v24, v25, v26, v27, v28); 111 | } 112 | } 113 | } 114 | } 115 | } 116 | } 117 | } 118 | } 119 | } 120 | } 121 | } 122 | ``` 123 | Tại điểm này, cùng với việc đã có được **this + 92** từ trước **("gimme flag pls?")** và biết được **this + 248** là input từ user, mình cũng phần nào đoán được cách crack .exe này, đó là nhập vào chuỗi **"gimme flag pls?"**, đồng thời bấm các nút mũi tên đúng theo thứ tự điều kiện if **("LLURULDUL")**. 124 | 125 | ![Result](Images/flag.png) 126 | 127 | > Flag is: U\_cRackeD\_th1$\_maG1cBaLL\_!!\_@flare-on.com 128 | -------------------------------------------------------------------------------- /Flare-On 9 (with Writeups)/Images/flag.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/FazeCT/ctf/ab8c160867ea0efb10bd2dd0091bf9b63f182fc5/Flare-On 9 (with Writeups)/Images/flag.png -------------------------------------------------------------------------------- /Flare-On 9 (with Writeups)/Images/image_2022-10-01_094719698.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/FazeCT/ctf/ab8c160867ea0efb10bd2dd0091bf9b63f182fc5/Flare-On 9 (with Writeups)/Images/image_2022-10-01_094719698.png -------------------------------------------------------------------------------- /Flare-On 9 (with Writeups)/Images/image_2022-10-01_094725006.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/FazeCT/ctf/ab8c160867ea0efb10bd2dd0091bf9b63f182fc5/Flare-On 9 (with Writeups)/Images/image_2022-10-01_094725006.png -------------------------------------------------------------------------------- /Flare-On 9 (with Writeups)/Images/image_2022-10-01_161957328.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/FazeCT/ctf/ab8c160867ea0efb10bd2dd0091bf9b63f182fc5/Flare-On 9 (with Writeups)/Images/image_2022-10-01_161957328.png -------------------------------------------------------------------------------- /Flare-On 9 (with Writeups)/Images/image_2022-10-01_162015754.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/FazeCT/ctf/ab8c160867ea0efb10bd2dd0091bf9b63f182fc5/Flare-On 9 (with Writeups)/Images/image_2022-10-01_162015754.png -------------------------------------------------------------------------------- /Flare-On 9 (with Writeups)/Images/image_2022-10-01_162043280.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/FazeCT/ctf/ab8c160867ea0efb10bd2dd0091bf9b63f182fc5/Flare-On 9 (with Writeups)/Images/image_2022-10-01_162043280.png -------------------------------------------------------------------------------- /Flare-On 9 (with Writeups)/Images/image_2022-10-01_162101597.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/FazeCT/ctf/ab8c160867ea0efb10bd2dd0091bf9b63f182fc5/Flare-On 9 (with Writeups)/Images/image_2022-10-01_162101597.png -------------------------------------------------------------------------------- /Flare-On 9 (with Writeups)/Images/image_2022-10-01_162121596.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/FazeCT/ctf/ab8c160867ea0efb10bd2dd0091bf9b63f182fc5/Flare-On 9 (with Writeups)/Images/image_2022-10-01_162121596.png -------------------------------------------------------------------------------- /Flare-On 9 (with Writeups)/Images/image_2022-10-01_162128693.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/FazeCT/ctf/ab8c160867ea0efb10bd2dd0091bf9b63f182fc5/Flare-On 9 (with Writeups)/Images/image_2022-10-01_162128693.png -------------------------------------------------------------------------------- /Flare-On 9 (with Writeups)/Images/run.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/FazeCT/ctf/ab8c160867ea0efb10bd2dd0091bf9b63f182fc5/Flare-On 9 (with Writeups)/Images/run.png -------------------------------------------------------------------------------- /Flare-On Stats: -------------------------------------------------------------------------------- 1 | Flare-On 9 (2022) 2 | 3 | 1: flareonisallaboutcats@flare-on.com 4 | 2: w1nN3r_W!NneR_cHick3n_d1nNer@flare-on.com 5 | 3: U_cRackeD_th1$_maG1cBaLL_!!_@flare-on.com 6 | 4: i_w0uld_l1k3_to_RETurn_this_joke@flare-on.com 7 | 5: i_s33_you_m00n@flare-on.com 8 | 6: MyV0ic3!.M1x3d_M0dE_4_l1f3@flare-on.com 9 | 7: 10 | 8: 11 | 9: R$A_$16n1n6_15_0pp0$17e_0f_3ncryp710n@flare-on.com 12 | 10: 13 | 11: Pyth0n_Prot3ction_tuRn3d_Up_t0_11@flare-on.com 14 | 15 | Flare-On 8(2021) 16 | 17 | 1: enter_the_funhouse@flare-on.com 18 | 2: You_Have_Awakened_Me_Too_Soon_EXE@flare-on.com 19 | 3: 20 | 4: s1gn_my_gu357_b00k@flare-on.com 21 | 5: 22 | 6: 23 | 7: 24 | 8: 25 | 9: 26 | 10: 27 | 28 | Flare-On 7(2020) 29 | 30 | 1: іdle_with_kitty@flare-on.com 31 | 2: C0rruptGarbag3@flare-on.com 32 | 3: 1t_i5_wEdn3sd4y_mY_Dud3s@flare-on.com 33 | 4: 34 | 5: 35 | 6: 36 | 7: 37 | 8: 38 | 9: 39 | 10: 40 | 11: 41 | 42 | Flare-On 6(2019) 43 | 44 | 1: Kitteh_save_galixy@flare-on.com 45 | 2: I_a_M_t_h_e_e_n_C_o_D_i_n_g@flare-on.com 46 | 3: th4t_was_be4rly_a_chall3nge@flare-on.com 47 | 4: 48 | 5: 49 | 6: 50 | 7: 51 | 8: 52 | 9: 53 | 10: 54 | 11: 55 | 12: 56 | 57 | Flare-On 5(2018) 58 | 59 | 1: GoldenTicket2018@flare-on.com 60 | 2: Ch3aters_Alw4ys_W1n@flare-on.com 61 | 3: mor3_awes0m3_th4n_an_awes0me_p0ssum@flare-on.com 62 | 4: 63 | 5: 64 | 6: 65 | 7: 66 | 8: 67 | 9: 68 | 10: 69 | 11: 70 | 12: 71 | 72 | Flare-On 4(2017) 73 | 74 | 1: ClientSideLoginsAreEasy@flare-on.com 75 | 2: R_y0u_H0t_3n0ugH_t0_1gn1t3@flare-on.com 76 | 3: et_tu_brute_force@flare-on.com 77 | 4: 78 | 5: 79 | 6: 80 | 7: 81 | 8: 82 | 9: 83 | 10: 84 | 11: 85 | 12: 86 | 87 | Flare-On 3(2016) 88 | 89 | 1: sh00ting_phish_in_a_barrel@flare-on.com 90 | 2: cl0se_t3h_f1le_0n_th1s_0ne@flare-on.com 91 | 3: Ohs0pec1alpwd@flare-on.com 92 | 4: 93 | 5: 94 | 6: 95 | 7: 96 | 8: 97 | 9: 98 | 10: 99 | 100 | Flare-On 2(2015) 101 | 102 | 1: bunny_sl0pe@flare-on.com 103 | 2: a_Little_b1t_harder_plez@flare-on.com 104 | 3: Elfie.L0000ves.YOOOO@flare-on.com 105 | 4: Uhr1thm3tic@flare-on.com 106 | 5: Sp1cy_7_layer_OSI_dip@flare-on.com 107 | 6: 108 | 7: 109 | 8: 110 | 9: 111 | 10: 112 | 11: 113 | 114 | Flare-On 1(2014) 115 | 116 | 1: 3rmahg3rd.b0b.d0ge@flare-on.com 117 | 2: a11.that.java5crap@flare-on.com 118 | 3: such.5h311010101@flare-on.com 119 | 4: wa1ch.d3m.spl01ts@flare-on.com 120 | 5: l0gging.ur.5tr0ke5@flare-on.com 121 | 6: 122 | 7: 123 | -------------------------------------------------------------------------------- /GDG Algiers CTF/impossible_challenge.py: -------------------------------------------------------------------------------- 1 | v11 = [0] * 40 2 | v11[0] = 6 3 | v11[1] = 60 4 | v11[2] = 39 5 | v11[3] = 32 6 | v11[4] = 55 7 | v11[5] = 0 8 | v11[6] = 55 9 | v11[7] = 48 10 | v11[8] = 33 11 | v11[9] = 44 12 | v11[10] = 49 13 | v11[11] = 32 14 | v11[12] = 54 15 | v11[13] = 62 16 | v11[14] = 97 17 | v11[15] = 32 18 | v11[16] = 0 19 | v11[17] = 26 20 | v11[18] = 43 21 | v11[19] = 10 22 | v11[20] = 49 23 | v11[21] = 45 24 | v11[22] = 12 25 | v11[23] = 11 26 | v11[24] = 2 27 | v11[25] = 26 28 | v11[26] = 12 29 | v11[27] = 97 30 | v11[28] = 26 31 | v11[29] = 116 32 | v11[30] = 40 33 | v11[31] = 53 34 | v11[32] = 42 35 | v11[33] = 97 36 | v11[34] = 97 37 | v11[35] = 44 38 | v11[36] = 7 39 | v11[37] = 41 40 | v11[38] = 32 41 | v11[39] = 56 42 | tmp = 69 43 | res = "" 44 | 45 | def hexsplit(arg): 46 | lobyte = arg & 0x00FF 47 | return lobyte 48 | 49 | for c in v11: 50 | res += chr(hexsplit(c) ^ tmp) 51 | print(res) 52 | -------------------------------------------------------------------------------- /GDG Algiers CTF/traditions.py: -------------------------------------------------------------------------------- 1 | rand = [86,232,72,60,0,91,171,127,210,152,94,223,44,29,52,32,16,180,189,125,242,136,253,98,237,70,164,122,5,15,245,91,247,61,151,247,152,66,119,107,218,213,74,7,242,126,39,2] 2 | v7 = [0] * 48 3 | v7[0] = 21 4 | v7[1] = 145 5 | v7[2] = 42 6 | v7[3] = 89 7 | v7[4] = 114 8 | v7[5] = 30 9 | v7[6] = 217 10 | v7[7] = 10 11 | v7[8] = 182 12 | v7[9] = 241 13 | v7[10] = 42 14 | v7[11] = 186 15 | v7[12] = 95 16 | v7[13] = 102 17 | v7[14] = 112 18 | v7[15] = 97 19 | v7[16] = 79 20 | v7[17] = 247 21 | v7[18] = 209 22 | v7[19] = 73 23 | v7[20] = 214 24 | v7[21] = 172 25 | v7[22] = 180 26 | v7[23] = 33 27 | v7[24] = 178 28 | v7[25] = 30 29 | v7[26] = 148 30 | v7[27] = 40 31 | v7[28] = 90 32 | v7[29] = 87 33 | v7[30] = 170 34 | v7[31] = 21 35 | v7[32] = 199 36 | v7[33] = 10 37 | v7[34] = 200 38 | v7[35] = 163 39 | v7[36] = 240 40 | v7[37] = 118 41 | v7[38] = 3 42 | v7[39] = 52 43 | v7[40] = 136 44 | v7[41] = 225 45 | v7[42] = 36 46 | v7[43] = 99 47 | v7[44] = 194 48 | v7[45] = 19 49 | v7[46] = 90 50 | v7[47] = 2 51 | for c in range(48): 52 | v9 = (((rand[c] >> 31) >> 24) + rand[c]) - ((rand[c] >> 31) >> 24) 53 | print(chr(v9 ^ v7[c]),end='') 54 | 55 | -------------------------------------------------------------------------------- /HACKME.zip: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/FazeCT/ctf/ab8c160867ea0efb10bd2dd0091bf9b63f182fc5/HACKME.zip -------------------------------------------------------------------------------- /HTB University CTF 2022/PotionMaster.py: -------------------------------------------------------------------------------- 1 | from Crypto.Util.number import * 2 | from Crypto.Cipher import AES 3 | from Crypto.Cipher import DES 4 | from Crypto.Hash import MD5 5 | from Crypto.PublicKey import RSA 6 | from Crypto.Util.Padding import unpad 7 | from Crypto.Cipher import Blowfish 8 | from malduck import xor 9 | from sympy.ntheory.modular import crt 10 | from sympy import * 11 | from z3 import * 12 | from pwn import * 13 | from subprocess import * 14 | from itertools import * 15 | from PIL import Image 16 | from copy import * 17 | 18 | import gmpy2 19 | import json 20 | import base64 21 | import hashlib 22 | import requests 23 | import angr 24 | import numpy as np 25 | import binascii 26 | import codecs 27 | import time 28 | import claripy 29 | import sympy 30 | import subprocess 31 | import itertools 32 | import ctypes 33 | import re 34 | import math 35 | 36 | a = [-43, 61, 58, 5, -4, -11, 64, -40, -43, 61, 62, -51, 46, 15, -49, -44, 47, 4, 6, -7, 47, 7, -59, 52, 17, 11, -56, 61, -74, 52, 63, -21, 53, -17, 66, -10, -58, 0] 37 | b = [6, 106, 10, 0, 119, 52, 51, 101, 0, 0, 15, 48, 116, 22, 10, 58, 93, 59, 106, 43, 30, 47, 93, 62, 97, 63] 38 | c = [304, 357, 303, 320, 304, 307, 349, 305, 257, 337, 340, 309, 396, 333, 320, 380, 362, 368, 286] 39 | d = [52, 52, 95, 95, 110, 49, 51, 51, 95, 110, 110, 53, 116, 51, 98, 63] 40 | 41 | len = 76 42 | s = Solver() 43 | x = [BitVec('x{}'.format(i), 8) for i in range(len)] 44 | for i in range(len): 45 | s.add(And(x[i] <= 125, x[i] >= 32)) 46 | tmp = 0 47 | tmp2 = 1 48 | for i in a: 49 | s.add(x[tmp] - x[tmp2] == i) 50 | tmp += 2 51 | tmp2 += 2 52 | tmp = 0 53 | tmp2 = 1 54 | tmp3 = 2 55 | for i in b: 56 | t = 0 57 | if tmp < len: 58 | t ^= x[tmp] 59 | if tmp2 < len: 60 | t ^= x[tmp2] 61 | if tmp3 < len: 62 | t ^= x[tmp3] 63 | s.add(t == i) 64 | tmp += 3 65 | tmp2 += 3 66 | tmp3 += 3 67 | tmp = 0 68 | tmp2 = 1 69 | tmp3 = 2 70 | tmp4 = 3 71 | for i in c: 72 | t = 0 73 | if tmp < len: 74 | t += x[tmp] 75 | if tmp2 < len: 76 | t += x[tmp2] 77 | if tmp3 < len: 78 | t += x[tmp3] 79 | if tmp4 < len: 80 | t += x[tmp4] 81 | s.add(t == i) 82 | tmp += 4 83 | tmp2 += 4 84 | tmp3 += 4 85 | tmp4 += 4 86 | tmp = 0 87 | for i in d: 88 | if tmp < len: 89 | s.add(x[tmp] == i) 90 | tmp += 5 91 | 92 | if s.check() == sat: 93 | result = s.model() 94 | string = [result[x[i]].as_long() for i in range(76)] 95 | s = ''.join(map(chr, string)) 96 | print('HTB{' + s + '}') 97 | -------------------------------------------------------------------------------- /Hack The Box/Crypto/Weak RSA.py: -------------------------------------------------------------------------------- 1 | from Crypto.Util.number import * 2 | from Crypto.Cipher import AES 3 | from Crypto.Cipher import DES 4 | from Crypto.Hash import MD5 5 | from Crypto.PublicKey import RSA 6 | from Crypto.Util.Padding import unpad 7 | from Crypto.Cipher import Blowfish 8 | from malduck import xor 9 | from sympy.ntheory.modular import crt 10 | from sympy import * 11 | from z3 import * 12 | from pwn import * 13 | from subprocess import * 14 | from itertools import * 15 | from PIL import Image 16 | from copy import * 17 | 18 | import gmpy2 19 | import json 20 | import base64 21 | import hashlib 22 | import requests 23 | import angr 24 | import numpy as np 25 | import binascii 26 | import codecs 27 | import time 28 | import claripy 29 | import sympy 30 | import subprocess 31 | import itertools 32 | import ctypes 33 | import re 34 | import math 35 | 36 | from typing import Tuple, Iterator, Iterable, Optional 37 | 38 | 39 | def isqrt(n: int) -> int: 40 | if n == 0: 41 | return 0 42 | 43 | x = 2 ** ((n.bit_length() + 1) // 2) 44 | while True: 45 | y = (x + n // x) // 2 46 | if y >= x: 47 | return x 48 | x = y 49 | 50 | 51 | def is_perfect_square(n: int) -> bool: 52 | sq_mod256 = ( 53 | 1, 1, 0, 0, 1, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 1, 1, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 1, 0, 0, 54 | 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 1, 1, 0, 0, 1, 0, 0, 0, 0, 1, 0, 0, 0, 0, 55 | 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 1, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 56 | 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 1, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 1, 1, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 57 | 0, 0, 0, 0, 0, 1, 0, 0, 1, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 1, 0, 58 | 0, 1, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 1, 0, 0, 0, 0, 1, 59 | 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0) 60 | if sq_mod256[n & 0xff] == 0: 61 | return False 62 | 63 | mt = ( 64 | (9, (1, 1, 0, 0, 1, 0, 0, 1, 0)), 65 | (5, (1, 1, 0, 0, 1)), 66 | (7, (1, 1, 1, 0, 1, 0, 0)), 67 | (13, (1, 1, 0, 1, 1, 0, 0, 0, 0, 1, 1, 0, 1)), 68 | (17, (1, 1, 1, 0, 1, 0, 0, 0, 1, 1, 0, 0, 0, 1, 0, 1, 1)) 69 | ) 70 | a = n % (9 * 5 * 7 * 13 * 17) 71 | if any(t[a % m] == 0 for m, t in mt): 72 | return False 73 | 74 | return isqrt(n) ** 2 == n 75 | 76 | 77 | def rational_to_contfrac(x: int, y: int) -> Iterator[int]: 78 | while y: 79 | a = x // y 80 | yield a 81 | x, y = y, x - a * y 82 | 83 | 84 | def contfrac_to_rational_iter(contfrac: Iterable[int]) -> Iterator[Tuple[int, int]]: 85 | n0, d0 = 0, 1 86 | n1, d1 = 1, 0 87 | for q in contfrac: 88 | n = q * n1 + n0 89 | d = q * d1 + d0 90 | yield n, d 91 | n0, d0 = n1, d1 92 | n1, d1 = n, d 93 | 94 | 95 | def convergents_from_contfrac(contfrac: Iterable[int]) -> Iterator[Tuple[int, int]]: 96 | n_, d_ = 1, 0 97 | for i, (n, d) in enumerate(contfrac_to_rational_iter(contfrac)): 98 | if i % 2 == 0: 99 | yield n + n_, d + d_ 100 | else: 101 | yield n, d 102 | n_, d_ = n, d 103 | 104 | 105 | def attack(e: int, n: int) -> Optional[int]: 106 | f_ = rational_to_contfrac(e, n) 107 | for k, dg in convergents_from_contfrac(f_): 108 | edg = e * dg 109 | phi = edg // k 110 | 111 | x = n - phi + 1 112 | if x % 2 == 0 and is_perfect_square((x // 2) ** 2 - n): 113 | g = edg - phi * k 114 | return dg // g 115 | return None 116 | 117 | 118 | f = open('E:/Downloads/flag.enc', 'rb').read() 119 | ct = bytes_to_long(f) 120 | 121 | f = open('E:/Downloads/key.pub', 'r') 122 | key = RSA.importKey(f.read()) 123 | n = key.n 124 | e = key.e 125 | 126 | d = attack(e, n) 127 | print(long_to_bytes(pow(ct, d, n))[long_to_bytes(pow(ct, d, n)).find(b'HTB{'):].decode()) 128 | -------------------------------------------------------------------------------- /Hack The Box/Rev/Golfer - Part 1.py: -------------------------------------------------------------------------------- 1 | flag = "48 54 42 7B 79 30 55 5F 34 52 33 5F 61 5F 67 30 6C 66 33 72 7D".split(' ') 2 | print(''.join(chr(int(i, 16)) for i in flag)) 3 | -------------------------------------------------------------------------------- /Hack The Box/Rev/Impossible Password.py: -------------------------------------------------------------------------------- 1 | data = 'A]Kr=9k0=0o0;k1?k81t' 2 | for c in data: 3 | print(chr(ord(c) ^ 9),end='') 4 | -------------------------------------------------------------------------------- /Hack The Box/Rev/Rebuilding.py: -------------------------------------------------------------------------------- 1 | from Crypto.Util.number import * 2 | from Crypto.Cipher import AES 3 | from Crypto.Cipher import DES 4 | from Crypto.Hash import MD5 5 | from Crypto.PublicKey import RSA 6 | from Crypto.Util.Padding import unpad 7 | from Crypto.Cipher import Blowfish 8 | from malduck import xor 9 | from sympy.ntheory.modular import crt 10 | from sympy import * 11 | from z3 import * 12 | from pwn import * 13 | from subprocess import * 14 | from itertools import * 15 | from PIL import Image 16 | from copy import * 17 | 18 | import gmpy2 19 | import json 20 | import base64 21 | import hashlib 22 | import requests 23 | import angr 24 | import numpy as np 25 | import binascii 26 | import codecs 27 | import time 28 | import claripy 29 | import sympy 30 | import subprocess 31 | import itertools 32 | import ctypes 33 | import re 34 | import math 35 | 36 | encrypted = [0x29, 0x38, 0x2B, 0x1E, 0x06, 0x42, 0x05, 0x5D, 0x07, 0x02, 37 | 0x31, 0x10, 0x51, 0x08, 0x5A, 0x16, 0x31, 0x42, 0x0F, 0x33, 38 | 0x0A, 0x55, 0x00, 0x00, 0x15, 0x1E, 0x1C, 0x06, 0x1A, 0x43, 39 | 0x13, 0x59, 0x14] 40 | 41 | print(xor(encrypted, 'aliens')) 42 | -------------------------------------------------------------------------------- /Hack The Box/Rev/Simple Encryptor.py: -------------------------------------------------------------------------------- 1 | from Crypto.Util.number import * 2 | from Crypto.Cipher import AES 3 | from Crypto.Cipher import DES 4 | from Crypto.Hash import MD5 5 | from Crypto.Util.Padding import unpad 6 | from Crypto.Cipher import Blowfish 7 | from malduck import xor 8 | from sympy.ntheory.modular import crt 9 | from sympy import * 10 | from z3 import * 11 | from pwn import * 12 | from subprocess import * 13 | from itertools import * 14 | from PIL import Image 15 | from copy import * 16 | 17 | import gmpy2 18 | import json 19 | import base64 20 | import hashlib 21 | import requests 22 | import angr 23 | import numpy as np 24 | import binascii 25 | import codecs 26 | import time 27 | import claripy 28 | import sympy 29 | import subprocess 30 | import itertools 31 | import ctypes 32 | import re 33 | 34 | f = open('E:/Downloads/flag.enc', 'rb').read() 35 | 36 | seed = int.from_bytes(f[:4], 'little') 37 | 38 | rol = lambda val, r_bits, max_bits: \ 39 | (val << r_bits%max_bits) & (2**max_bits-1) | \ 40 | ((val & (2**max_bits-1)) >> (max_bits-(r_bits%max_bits))) 41 | 42 | rand = [2014390344, 1469870660, 1982650619, 1625766133, 692418227, 51836669, 1207566194, 29148633, 1814471238, 927732162, 1046980137, 565814735, 422047055, 1517221094, 1814698569, 753299776, 2030934960, 1040711614, 1195375342, 920661508, 574642855, 351439671, 1713504022, 1635586270, 1468557073, 920046345, 1005726139, 1081414708, 653914299, 1269692214, 1744271893, 520820995, 592079226, 1579438864, 2146587128, 1284497453, 1631275533, 1206669674, 1313646087, 1298263123, 2134401837, 213142576, 1864077858, 408965244, 1730363670, 1531292779, 1162265020, 1613814982, 424520745, 210156714, 386992843, 999163600, 561596385, 2100496865, 487266223, 2030153458, 873059562, 1492992362, 964084519, 1526973861, 615200929, 560872764, 2047794857, 1207280155, 2140311628, 2046898337, 344293961, 1624103513, 1106084364, 1657940048, 774882988, 1093002553, 1871082624, 491477198, 1501967797, 1453962647, 2022769977, 516749169, 920293981, 299807074, 726905883, 1307286824, 1298970674, 1288502269, 1260300041, 1786236897, 1171172079, 2133359603, 1131745612, 2135256598, 1512849817, 1746946541, 548645714, 1413161026, 806743048, 541473694, 1312575715, 1151037009, 18093559, 271176431] 43 | idx = 0 44 | 45 | for i in f[4:]: 46 | rand_1 = rand[idx] 47 | rand_2 = rand[idx + 1] 48 | idx += 2 49 | for c in range(256): 50 | k = (c ^ rand_1) & 0xFF 51 | v3 = rand_2 52 | f = rol(k, v3 & 7, 8) 53 | if f == i: 54 | print(chr(c), end='') 55 | break 56 | 57 | 58 | 59 | -------------------------------------------------------------------------------- /Hack The Box/Rev/Spooky License.py: -------------------------------------------------------------------------------- 1 | from Crypto.Util.number import * 2 | from Crypto.Cipher import AES 3 | from Crypto.Cipher import DES 4 | from Crypto.Hash import MD5 5 | from Crypto.Util.Padding import unpad 6 | from Crypto.Cipher import Blowfish 7 | from malduck import xor 8 | from sympy.ntheory.modular import crt 9 | from sympy import * 10 | from z3 import * 11 | from pwn import * 12 | from subprocess import * 13 | from itertools import * 14 | from PIL import Image 15 | from copy import * 16 | 17 | import gmpy2 18 | import json 19 | import base64 20 | import hashlib 21 | import requests 22 | import angr 23 | import numpy as np 24 | import binascii 25 | import codecs 26 | import time 27 | import claripy 28 | import sympy 29 | import subprocess 30 | import itertools 31 | import ctypes 32 | import re 33 | 34 | s = Solver() 35 | v3 = [BitVec('x{}'.format(i), 8) for i in range(32)] 36 | 37 | for i in range(len(v3)): 38 | s.add(And(v3[i] <= 125, v3[i] >= 32)) 39 | 40 | form = b'HTB{' 41 | for i in range(len(form)): 42 | s.add(v3[i] == form[i]) 43 | 44 | s.add(v3[29] == v3[5] - v3[3] + 70) 45 | s.add(v3[22] + v3[2] == v3[13] + 123) 46 | s.add(v3[4] + v3[12] == v3[5] + 28) 47 | s.add(v3[23] * v3[25] == v3[17] + v3[0] + 23) 48 | s.add(v3[1] * v3[27] == v3[22] + v3[5] - 21) 49 | s.add(v3[13] * v3[9] == v3[3] * v3[28] - 9) 50 | s.add(v3[9] == 112) 51 | s.add(v3[21] + v3[19] == v3[6] + 0x80) 52 | s.add(v3[16] == v3[15] - v3[11] + 48) 53 | s.add(v3[27] * v3[7] == v3[13] * v3[1] + 45) 54 | s.add(v3[13] == v3[13] + v3[18] - 101) 55 | s.add(v3[20] - v3[8] == v3[9] + 124) 56 | s.add(v3[31] == v3[8] - v3[31] - 121) 57 | s.add(v3[31] * v3[20] == v3[20] + 4) 58 | s.add(v3[24] - v3[17] == v3[8] + v3[21] - 23) 59 | s.add(v3[5] + v3[7] == v3[29] + v3[5] + 44) 60 | s.add(v3[10] * v3[12] == v3[1] - v3[11] - 36) 61 | s.add(v3[0] * v3[31] == v3[26] - 27) 62 | s.add(v3[20] + v3[1] == v3[10] - 125) 63 | s.add(v3[18] == v3[14] + v3[27] + 2) 64 | s.add(v3[11] * v3[30] == v3[21] + 68) 65 | s.add(v3[19] * v3[5] == v3[1] - 44) 66 | s.add(v3[13] - v3[26] == v3[21] - 127) 67 | s.add(v3[23] == v3[29] - v3[0] + 88) 68 | s.add(v3[19] == v3[13] * v3[8] - 23) 69 | s.add(v3[22] + v3[6] == v3[3] + 83) 70 | s.add(v3[12] == v3[7] + v3[26] - 114) 71 | s.add(v3[16] == v3[18] - v3[5] + 51) 72 | s.add(v3[30] - v3[8] == v3[29] - 77) 73 | s.add(v3[20] - v3[11] == v3[3] - 76) 74 | s.add(v3[16] - v3[7] == v3[17] + 102) 75 | s.add(v3[21] + v3[1] == v3[18] + v3[11] + 43) 76 | 77 | if s.check() == sat: 78 | result = s.model() 79 | 80 | string = [result[v3[i]].as_long() for i in range(32)] 81 | s2 = ''.join(map(chr, string)) 82 | print(s2) 83 | -------------------------------------------------------------------------------- /Hack The Box/Rev/WIDE.py: -------------------------------------------------------------------------------- 1 | data = 'HOt*\x1f\xe8\xcf\x8e\x87\x80{Xt\x0e\x1c\xa3\xee\xf8\x950ANe\x0b\xb9\xd8' 2 | print(''.join(chr(ord(data[i]) ^ (27 * i % 255)) for i in range(len(data)))) 3 | -------------------------------------------------------------------------------- /Hack The Box/Rev/You Cant C Me.py: -------------------------------------------------------------------------------- 1 | data = b'm^&&fi\x17Uo&kUZ\'ZUYUc)' 2 | 3 | for i in range(len(data)): 4 | print(end=chr(data[i] + 10)) 5 | -------------------------------------------------------------------------------- /LakeCTF/Baby rev.py: -------------------------------------------------------------------------------- 1 | for v8 in range(0,2147418112+65536): 2 | v4 = v3 = 0 3 | while v3 != 32: 4 | v5 = v8 >> v3 5 | v3 += 1 6 | v4 = (v5 & 1) + 2 * v4 7 | if v8 == v4: 8 | print(v4) 9 | break 10 | -------------------------------------------------------------------------------- /PMXTResources/README.md: -------------------------------------------------------------------------------- 1 | Source files for Perfect Match X-treme. 2 | 3 | Download the game here: https://drive.google.com/drive/folders/1c2-aDuKIVexttTzI74flcsTOAZi8AQPQ?usp=share_link 4 | -------------------------------------------------------------------------------- /PMXTResources/dnspy1.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/FazeCT/ctf/ab8c160867ea0efb10bd2dd0091bf9b63f182fc5/PMXTResources/dnspy1.png -------------------------------------------------------------------------------- /PMXTResources/dnspy2.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/FazeCT/ctf/ab8c160867ea0efb10bd2dd0091bf9b63f182fc5/PMXTResources/dnspy2.png -------------------------------------------------------------------------------- /PMXTResources/dnspy3.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/FazeCT/ctf/ab8c160867ea0efb10bd2dd0091bf9b63f182fc5/PMXTResources/dnspy3.png -------------------------------------------------------------------------------- /PMXTResources/dnspy4.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/FazeCT/ctf/ab8c160867ea0efb10bd2dd0091bf9b63f182fc5/PMXTResources/dnspy4.png -------------------------------------------------------------------------------- /PMXTResources/dnspy5.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/FazeCT/ctf/ab8c160867ea0efb10bd2dd0091bf9b63f182fc5/PMXTResources/dnspy5.png -------------------------------------------------------------------------------- /PMXTResources/dnspy6.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/FazeCT/ctf/ab8c160867ea0efb10bd2dd0091bf9b63f182fc5/PMXTResources/dnspy6.png -------------------------------------------------------------------------------- /PMXTResources/dnspy7.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/FazeCT/ctf/ab8c160867ea0efb10bd2dd0091bf9b63f182fc5/PMXTResources/dnspy7.png -------------------------------------------------------------------------------- /PMXTResources/files.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/FazeCT/ctf/ab8c160867ea0efb10bd2dd0091bf9b63f182fc5/PMXTResources/files.png -------------------------------------------------------------------------------- /PMXTResources/flag1.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/FazeCT/ctf/ab8c160867ea0efb10bd2dd0091bf9b63f182fc5/PMXTResources/flag1.png -------------------------------------------------------------------------------- /PMXTResources/flag2.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/FazeCT/ctf/ab8c160867ea0efb10bd2dd0091bf9b63f182fc5/PMXTResources/flag2.png -------------------------------------------------------------------------------- /PMXTResources/flag3.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/FazeCT/ctf/ab8c160867ea0efb10bd2dd0091bf9b63f182fc5/PMXTResources/flag3.png -------------------------------------------------------------------------------- /PMXTResources/pmxt.mp4: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/FazeCT/ctf/ab8c160867ea0efb10bd2dd0091bf9b63f182fc5/PMXTResources/pmxt.mp4 -------------------------------------------------------------------------------- /PMXTResources/pmxt2.mp4: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/FazeCT/ctf/ab8c160867ea0efb10bd2dd0091bf9b63f182fc5/PMXTResources/pmxt2.mp4 -------------------------------------------------------------------------------- /Perfect Match X-Treme (Introduction to RE).MD: -------------------------------------------------------------------------------- 1 | ## Introduction 2 | 3 | Lời đầu tiên, mình (FazeCT) - một thành viên của team RE trong câu lạc bộ An toàn thông tin HCMUT (BKISC) xin gửi lời chào đến các bạn! 4 | 5 | Trong bài viết này, mình sẽ giúp các bạn hiểu được basics của mảng Reverse Engineering - RE, một trong 4 mảng chính của CTF. 6 | 7 | Trước khi vào Write-Up, mình muốn các bạn thử đọc qua slide sau đây để nắm rõ thuật ngữ cơ bản trong RE, cũng như hiểu được một trong những dạng bài của RE, đó là Unity RE: [go to slide](https://docs.google.com/presentation/d/10Z2u5gLyN5w5rhyMwWNFmZaDFL8Nbbjfsqf0z8HDsUc/edit?usp=sharing) 8 | 9 | Sau đây sẽ là Write-Up của một bài Unity RE đến từ **SEKAI CTF 2022**. 10 | 11 | ## Information 12 | **Category** | **Writeup Author** 13 | --- | --- 14 | Reverse Engineering | FazeCT 15 | 16 | **Description:** 17 | 18 | (Challenge từ SEKAI CTF 2022) 19 | 20 | [...] Giành chiến thắng trong trò chơi mô phỏng lại dựa trên tựa game [Fall Guy](https://vi.wikipedia.org/wiki/Fall_Guys). 21 | 22 | File: https://drive.google.com/drive/folders/1c2-aDuKIVexttTzI74flcsTOAZi8AQPQ?usp=sharing 23 | 24 | Password: BKISC 25 | 26 | ## First Observation 27 | 28 | Để thuận tiện cho các bạn mới tìm hiểu về mảng RE, mình sẽ mở đầu bằng cách phân tích về những file trong zip. 29 | 30 | Như đã đề cập đến trong slide phía trên, 2 folder sẽ chứa tài nguyên của game và file thực thi .exe sẽ là game chúng ta cần crack. 31 | 32 | ![Files](PMXTResources/files.png) 33 | 34 | Mình tiến hành mở .exe lên chơi thử, cách vận hành của game này được lấy ý tưởng từ màn chơi [Perfect Match](https://fallguysultimateknockout.fandom.com/wiki/Perfect_Match) của tựa game Fall Guy. 35 | 36 | Video: https://drive.google.com/file/d/18JScEy6ws-ibVz72WgGwoaIOVygBESro/view?usp=sharing 37 | 38 | Để có được flag, ta cần vượt qua màn chơi này mà không bị rơi xuống phía dưới. 39 | 40 | ## Solution 41 | 42 | Sử dụng các tool (dnSpy, dotPeek hay IDA) như trong slide có đề cập đến để decompile file **Assembly-CSharp.dll** chứa trong đường dẫn **.../Perfect_Match_X-treme/Build/PerfectMatch_Data/Managed/Assembly-CSharp.dll** 43 | 44 | Sau khi decompile, ban đầu ta sẽ thấy cửa sổ như sau trong dnSpy: 45 | 46 | ![Files](PMXTResources/dnspy1.png) 47 | 48 | Ở phía bên trái, ta có một cửa sổ hiển thị danh sách các thành phần của file **Assembly-CSharp.dll**. 49 | 50 | ![Files](PMXTResources/dnspy2.png) 51 | 52 | Toàn bộ phần màu xanh chính là các **GameObject** mà mình đã đề cập đến trong slide ở phía trên, trong đó có **GameManager** mà ta có thể nói rằng nó là main để vận hành trò chơi. 53 | 54 | ![Files](PMXTResources/dnspy3.png) 55 | 56 | Trên đây là cấu trúc của **GameManager** được decompile thành pseudocode của ngôn ngữ **C#**. Mỗi hàm của **GameManager** đều có một chức năng riêng, như 57 | **ChooseBasedOnRound()** là hàm để setup mỗi round, hay **ChooseFruit()** cũng là một hàm để setup platform của màn chơi. 58 | 59 | Đáng chú ý hơn cả, ta nhận thấy có một hàm tên là **IncreaseRound()** dùng để kiểm tra tiến độ game mà trong đó ta thấy dòng lệnh **isGameOver = true;**, đây có thể hiểu là câu lệnh dùng để kết thúc game. 60 | 61 | ``` 62 | public void IncreaseRound() 63 | { 64 | if (this.roundNumber + 1 <= 3) 65 | { 66 | this.roundNumber++; 67 | base.StartCoroutine("CheckRound"); 68 | return; 69 | } //sau khi vượt qua 3 round đấu, game sẽ kết thúc. 70 | this.isGameOver = true; 71 | } 72 | ``` 73 | Thử edit module để bỏ dòng lệnh **this.isGameOver = true;** lên trên đầu class, tức ngay trong **void Awake()**. Cách thức **edit class/module** đã được mình hướng dẫn trong slide phía trên. 74 | 75 | **Lưu ý:** Không nên dùng **edit class** để edit, mà dùng **edit module**. Nếu dùng edit class sẽ xảy ra lỗi compile ở các module khác (vì pseudocode được decompile lại thường không đúng hoàn toàn 100% như bản gốc nên sẽ xảy ra thiếu hụt dữ liệu dẫn đến lỗi. 76 | 77 | ![Files](PMXTResources/dnspy4.png) 78 | 79 | Sau khi compile xong, ta tiến hành save module, lưu đè lên file **.dll** gốc (nên backup file **.dll** gốc). 80 | 81 | ![Files](PMXTResources/dnspy5.png) 82 | 83 | Tiếp tục bật game lên chơi thử thôi... 84 | 85 | Video: https://drive.google.com/file/d/15fVhAw2kZCJ4CfsfwIBEtDRv88ZTTnpy/view?usp=sharing 86 | 87 | Tới đây, công đoạn crack cũng gần như xong rồi, chỉ còn tìm cách đọc flag. Ở đây theo mình thì có 2 lựa chọn, một là tìm cách xóa object để đọc flag, hai (cách này hơi unintended) là chỉnh tốc độ và bước nhảy của nhân vật để đọc flag từ các góc khác nhau. Mình đã phá cách và chọn hướng thứ 2. 88 | 89 | ![Files](PMXTResources/dnspy6.png) 90 | 91 | Trong số các **GameObject**, ta có **MoveBehaviour**, trong đó có hàm **MoveBehaviour()** chứa các thông tin của nhân vật. Mình đã chỉnh một số thông số như hình dưới đây: 92 | 93 | ![Files](PMXTResources/dnspy7.png) 94 | 95 | Save module, vào game, canh thời gian nhảy xuống để vừa kịp nhìn flag từ dưới lên mà không bị eliminated do vượt quá độ sâu thấp nhất cho phép. 96 | 97 | ![Files](PMXTResources/flag1.png) 98 | 99 | ![Files](PMXTResources/flag2.png) 100 | 101 | ![Files](PMXTResources/flag3.png) 102 | 103 | > Flag: SEKAI{F4LL_GUY5_H3CK_15_1LL3G4L} 104 | 105 | ## Conclusion 106 | 107 | Trên đây là Write-Up về một bài Unity RE khá thú vị, kiểu challenge như này thường ít thấy (từ lúc mình chơi trong BKISC tới giờ thì số lần gặp chắc đếm trên đầu ngón tay) nhưng mỗi lần gặp một bài Unity đều làm cho mình cảm thấy thán phục về sự đầu tư của các organizers cho các challenge RE. 108 | 109 | Cuối cùng, mình hy vọng qua bài viết trên đây của mình thì hy vọng các bạn (đặc biệt là các bạn sắp tới có dự định theo mảng RE) có một góc nhìn tổng quan về cách thức giải quyết một vấn đề trong mảng Reverse Engineering. 110 | 111 | # **YOUR SECURITY, OUR PASSION - BKISC** 112 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # CTF 2 | CTF source code(s) from multiple websites. 3 | Made originally by **FazeCT**. 4 | -------------------------------------------------------------------------------- /Reversing.Kr/Easy ELF.py: -------------------------------------------------------------------------------- 1 | print(chr(52 ^ 120),end='') 2 | print(chr(49),end='') 3 | print(chr(50 ^ 124),end='') 4 | print(bytes.fromhex(hex(136 ^ -35 & (2**8-1))[2:]).decode('utf-8'),end='') 5 | print(chr(88),end='') 6 | -------------------------------------------------------------------------------- /Reversing.Kr/Easy Keygen.py: -------------------------------------------------------------------------------- 1 | data = [0x5B,0x13,0x49,0x77,0x13,0x5E,0x7D,0x13] 2 | data2 = [0x10,0x20,0x30] 3 | for i in range(len(data)): 4 | print(chr(int(str(data[i])) ^ int(str(data2[i%3]))),end='') 5 | -------------------------------------------------------------------------------- /SEKAI CTF 2022/Let’s Play Osu!Mania.cpp: -------------------------------------------------------------------------------- 1 | //-------------------------------------------------------------------- 2 | #include 3 | #include 4 | #include 5 | using namespace std; 6 | using namespace __gnu_pbds; 7 | //-------------------------------------------------------------------- 8 | typedef long long ll; 9 | typedef tree,rb_tree_tag,tree_order_statistics_node_update> oset; 10 | //find by order, order of key. 11 | //usage: oset p; p.insert(x); p.order_of_key(x); 12 | //less, less_equal. 13 | #define all(x) (x).begin(), (x).end() 14 | #define mp make_pair 15 | #define fi first 16 | #define se second 17 | #define pb push_back 18 | #define pi M_PI 19 | #define yes cout << "YES" << endl; 20 | #define no cout << "NO" << endl; 21 | const int inf=INT_MAX; 22 | const ll infll=LLONG_MAX; 23 | const ll mod = 1e9+7; 24 | //-------------------------------------------------------------------- 25 | int n,m,k; 26 | ll cnt=0; 27 | vector dx= {0,0,1,-1}; 28 | vector dy= {1,-1,0,0}; 29 | vector > g(100001); 30 | vector vis(100001,0),ans,st; 31 | bool valid(int i,int j) 32 | { 33 | return (i>=0 && i=0 && j &a,const pair &b) 41 | { 42 | if(a.se==b.se) return a.fi> n; 48 | vector s(n); 49 | cin.ignore(); 50 | for(auto &x:s) getline(cin,x); 51 | int cnt=0; 52 | for(int i=0;i<6;i++) 53 | { 54 | bool flag=0; 55 | for(int j=0;j> tc; 73 | //while(tc--) 74 | solve(); 75 | } 76 | -------------------------------------------------------------------------------- /SHELL CTF 2022/Keygen.py: -------------------------------------------------------------------------------- 1 | #Made by FazeCT 2 | 3 | puVar1 = [0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 4 | puVar1[0] = 0x53 5 | puVar1[1] = 0x48 6 | puVar1[2] = 0x45 7 | puVar1[3] = 0x4c 8 | puVar1[4] = 0x4c 9 | puVar1[5] = 0x43 10 | puVar1[6] = 0x54 11 | puVar1[7] = 0x46 12 | puVar1[8] = 0x7b 13 | puVar1[9] = 0x6b 14 | puVar1[10] = 0x33 15 | puVar1[0xb] = 0x79 16 | puVar1[0xc] = 0x67 17 | puVar1[0xd] = 0x65 18 | puVar1[0xe] = 0x6e 19 | puVar1[0xf] = 0x5f 20 | puVar1[0x10] = 0x31 21 | puVar1[0x11] = 0x73 22 | puVar1[0x12] = 0x5f 23 | puVar1[0x13] = 99 24 | puVar1[0x14] = 0x30 25 | puVar1[0x15] = 0x6f 26 | puVar1[0x16] = 0x4c 27 | puVar1[0x17] = 0x7d 28 | puVar1[0x18] = 0 29 | 30 | for i in range(24): 31 | print(chr(puVar1[i]),end='') 32 | 33 | #Flag is: SHELLCTF{k3ygen_1s_c0oL}. 34 | -------------------------------------------------------------------------------- /SHELL CTF 2022/swift.py: -------------------------------------------------------------------------------- 1 | # Made by FazeCT 2 | 3 | def func(a1): 4 | v3 = 1.0 5 | v4 = 0.0 6 | v5 = 1.0 7 | v2 = 1 8 | while (v3 != v4): 9 | v4 = v3 10 | v5 = a1 / v2 * v5 11 | v3 = v3 + v5 12 | v2 += 1 13 | return round(v3,6) 14 | 15 | key = "" 16 | data = [0.135335,0.367879,2.718282,7.389056,0.049787,1.000000,148.413159,0.367879,0.367879,2.718282,20.085537,148.413159] 17 | str = "GVKCUSIVNABM" 18 | enc = "wbppcugz{F4zp0i5_w3l1p5_sW_4_xHhO7j0r}" 19 | for i in range(0,12): 20 | for a1 in range(0,200): 21 | tmp = func(i + a1 - ord(str[i])) 22 | if tmp == data[i]: 23 | key += chr(a1 + i) 24 | print(key) 25 | 26 | #Use Vigenere Cipher to decrypt the encoded flag and get: shellctf{t4yl0r5_s3r1e5_of_4_func7i0n}. 27 | -------------------------------------------------------------------------------- /SHELL CTF 2022/tea.py: -------------------------------------------------------------------------------- 1 | #Made by FazeCT 2 | 3 | def revtea(pwd): 4 | part1 = "" 5 | for i in range(0,16): 6 | part1 += chr(ord(pwd[i]) + 3*i//2) 7 | 8 | part2 = "" 9 | for i in range(16,32): 10 | part2 += chr(ord(pwd[i]) - i//6) 11 | return part1 + part2 12 | 13 | def revsugar(pwd): 14 | l38 = pwd[len(pwd)-16:len(pwd)] 15 | l58 = pwd[0:len(pwd)-16] 16 | rpwd = "" 17 | i = 0 18 | j = 0 19 | for _ in range(len(pwd)): 20 | if _ & 1 == 0: 21 | rpwd += l38[i] 22 | i += 1 23 | else: 24 | rpwd += l58[j] 25 | j += 1 26 | return rpwd 27 | 28 | data = "R;crc75ihl`cNYe`]m%50gYhugow~34i" 29 | l78 = "50gYhugow~34i" 30 | for i in range(0,19): 31 | pwd = "" 32 | l48 = data[0:i] 33 | la8 = data[i:19] 34 | pwd = la8 + l78 + l48 35 | #print(l48,"|",la8,"|",l78) 36 | print(revsugar(revtea(pwd))) 37 | 38 | l78 = "5ihl`cNYe`]m%50gYhugow~34i" 39 | for i in range(0,7): 40 | pwd = "" 41 | l48 = data[0:i] 42 | la8 = data[i:7] 43 | pwd = la8 + l78 + l48 44 | #print(l48,"|",la8,"|",l78) 45 | print(revsugar(revtea(pwd))) 46 | 47 | #Flag is: shellctf{T0_1nfiNi7y_4nd_B3y0nd} 48 | -------------------------------------------------------------------------------- /SHELL CTF 2022/warmup.py: -------------------------------------------------------------------------------- 1 | #Made by FazeCT 2 | 3 | local_a8 =[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 4 | local_a8[0] = 0x1cc 5 | local_a8[1] = 0x1a0 6 | local_a8[2] = 0x194 7 | local_a8[3] = 0x1b0 8 | local_a8[4] = 0x1b0 9 | local_a8[5] = 0x18c 10 | local_a8[6] = 0x1d0 11 | local_a8[7] = 0x198 12 | local_a8[8] = 0x1ec 13 | local_a8[9] = 0x188 14 | local_a8[10] = 0xc4 15 | local_a8[11] = 0x1d0 16 | local_a8[12] = 0x15c 17 | local_a8[13] = 0x1a4 18 | local_a8[14] = 0xd4 19 | local_a8[15] = 0x194 20 | local_a8[16] = 0x17c 21 | local_a8[17] = 0xc0 22 | local_a8[18] = 0x1c0 23 | local_a8[19] = 0xcc 24 | local_a8[20] = 0x1c8 25 | local_a8[21] = 0x104 26 | local_a8[22] = 0x1d0 27 | local_a8[23] = 0xc0 28 | local_a8[24] = 0x1c8 29 | local_a8[25] = 0x14c 30 | local_a8[26] = 500 31 | 32 | for i in range(26): 33 | n = str(local_a8[i]) 34 | print(chr(int(n)//4),end='') 35 | print(chr(local_a8[26]//4),end='') 36 | 37 | #Flag is: shellctf{b1tWi5e_0p3rAt0rS} 38 | -------------------------------------------------------------------------------- /SekaiCTF 2023/README.md: -------------------------------------------------------------------------------- 1 | kekw nice challs 2 | -------------------------------------------------------------------------------- /SekaiCTF 2023/sahuang: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/FazeCT/ctf/ab8c160867ea0efb10bd2dd0091bf9b63f182fc5/SekaiCTF 2023/sahuang -------------------------------------------------------------------------------- /Viblo CTF/Login.py: -------------------------------------------------------------------------------- 1 | v8 = [0] * 52 2 | v8[0] = -700416 3 | v8[1] = -724992 4 | v8[2] = -679936 5 | v8[3] = -704512 6 | v8[4] = -786432 7 | v8[5] = -770048 8 | v8[6] = -491520 9 | v8[7] = -483328 10 | v8[8] = -483328 11 | v8[9] = -671744 12 | v8[10] = -761856 13 | v8[11] = -671744 14 | v8[12] = -692224 15 | v8[13] = -483328 16 | v8[14] = -692224 17 | v8[15] = -671744 18 | v8[16] = -483328 19 | v8[17] = -757760 20 | v8[18] = -671744 21 | v8[19] = -757760 22 | v8[20] = -708608 23 | v8[21] = -483328 24 | v8[22] = -499712 25 | v8[23] = -671744 26 | v8[24] = -757760 27 | v8[25] = -483328 28 | v8[26] = -729088 29 | v8[27] = -696320 30 | v8[28] = -671744 31 | v8[29] = -741376 32 | v8[30] = -761856 33 | v8[31] = -499712 34 | v8[32] = -499712 35 | v8[33] = -778240 36 | v8[34] = -622592 37 | v8[35] = -483328 38 | v8[36] = -495616 39 | v8[37] = -778240 40 | v8[38] = -696320 41 | v8[39] = -749568 42 | v8[40] = -503808 43 | v8[41] = -516096 44 | v8[42] = -671744 45 | v8[43] = -495616 46 | v8[44] = -692224 47 | v8[45] = -479232 48 | v8[46] = -503808 49 | v8[47] = -495616 50 | v8[48] = -483328 51 | v8[49] = -495616 52 | v8[50] = -679936 53 | v8[51] = -794624 54 | for i in v8: 55 | i //= pow(2, 9) 56 | i //= -8 57 | i -= 69 58 | print(chr(i), end='') 59 | -------------------------------------------------------------------------------- /Viblo CTF/Old Computer.py: -------------------------------------------------------------------------------- 1 | v7 = [0]*21 2 | v7[0] = 217 3 | v7[1] = 254 4 | v7[2] = 197 5 | v7[3] = 244 6 | v7[4] = 158 7 | v7[5] = 199 8 | v7[6] = 155 9 | v7[7] = 220 10 | v7[8] = 231 11 | v7[9] = 210 12 | v7[10] = 244 13 | v7[11] = 147 14 | v7[12] = 254 15 | v7[13] = 255 16 | v7[14] = 244 17 | v7[15] = 158 18 | v7[16] = 222 19 | v7[17] = 249 20 | v7[18] = 206 21 | v7[19] = 231 22 | v7[20] = 210 23 | for i in v7: 24 | print(chr(i^171),end='') 25 | -------------------------------------------------------------------------------- /Viblo CTF/Python Maze.py: -------------------------------------------------------------------------------- 1 | flag = [ 2 | 783608156887182461081582861391270065470196680446603116994959894818627460253966369635947698665980575324396727759589347906338418505, 3 | 828316462245246149718143145825744806631979459200544920444514124022261055662919735581494510911193870171704067352234650483703224431, 4 | 745627958007267524422268123000060071479481260782877997061736532996863665064782754893488101139421716122103140255111214077045045032, 5 | 790323496912151485479254839243016744594728491998743377957246569827548450323669355949153014307349730512699528804239135425990904894, 6 | 943137584913584501305801983236871710375717775225733831134669450928291416645953260928648704696222538144811542284195461082635911210, 7 | 798800055210203675227799480559231043032894901438180110334764697883239878882738405766750097866099187262585548672648603334099211667, 8 | 851091819409457863673034379868681090483626724333458908421610683456313554565934770537471363008080708354540360269125616963604836326, 9 | 668786851917538729091695757991688052816932027329312317028518342570018241839138526772516316905887774829017865874466172350763042030, 10 | 729555174414845107285475298617352398705830259664027847492882456198783346081403941360834665606618752670858697339352653888376973462, 11 | 517759327432439853949345198857221289153430148882725117884120655526935686950095358810420263791105693251925722029990090319338391186, 12 | 402938204764101502361686361446094385409691832857536207193965328620905325967061833463266070006077025278818247098029279720405704407, 13 | 844376479384488839275362402016934411359094912781318647459324008447392564496231784224266047366711553166237559224475829443952349937, 14 | 729555174414845107285475298617352398705830259664027847492882456198783346081403941360834665606618752670858697339352653888376973462, 15 | 927932925499186659003606744877053109146175957787024588454828873883158977791578998658443147241614649647625634649770658689886839328, 16 | 373421797729059027871342696179580621810607275095171397084215902481884149186880503648521656960982342369699728418443232570801691643, 17 | 653607350083283382297001226038674481102024728600663794476176862800768128572380081748562700010130174405283357776447733974705148196, 18 | 729555174414845107285475298617352398705830259664027847492882456198783346081403941360834665606618752670858697339352653888376973462, 19 | 790323496912151485479254839243016744594728491998743377957246569827548450323669355949153014307349730512699528804239135425990904894, 20 | 396222682437827097561786117605892597375633684213294056955392428269405478465564529633783566389643737568244059100217127244110528322, 21 | 889084784742552527911922686451409152520877691535260450908878237651026159905185150169812859611924848013544898817121132021317155863, 22 | 729555174414845107285475298617352398705830259664027847492882456198783346081403941360834665606618752670858697339352653888376973462, 23 | 608018529420232350897916217366023706928033794994596786564154228941253137596873112184197968205156796987177034409579690813149110598, 24 | 896680640072508895072119388541331864657617657939525916333633317315828545541441740101836094813054085772646683635993660125160873924, 25 | 889084784742552527911922686451409152520877691535260450908878237651026159905185150169812859611924848013544898817121132021317155863, 26 | 957448962569815273265898929166996210546515890274241446797997430944593649783707154690154443513785063614487515100880141662774805356] 27 | 28 | def reX(_): 29 | return _ ^ 7 30 | 31 | def reM(_): 32 | return ((reX(_) ^ 3) - 69 - 84 + 78)//69 33 | 34 | def reF(_): 35 | if _ % 2 != 0: 36 | tmp = _ - 5 * 5 * 5 * 5 * 5 37 | else: 38 | tmp = pow(_, 1//2) 39 | tmp -= 5 40 | return 4 * tmp 41 | 42 | 43 | for i in range(len(flag)): 44 | tmp = flag[i] 45 | #tmp = reF(flag[i]) 46 | for j in range(69): 47 | tmp = reM(tmp) 48 | print(chr(tmp),end='') 49 | -------------------------------------------------------------------------------- /Viblo CTF/XOR easy.py: -------------------------------------------------------------------------------- 1 | data = "2 D++DEM " 2 | for i in range(255): 3 | for c in data: 4 | print(chr(ord(c) ^ i), end='') 5 | print() 6 | 7 | #Missing a letter t, flag is Flag{x0r_is_s0meth1n9} 8 | -------------------------------------------------------------------------------- /WRECKCTF/advanced-flag-checker.py: -------------------------------------------------------------------------------- 1 | d = "" 2 | 3 | d += bytes.fromhex(hex(89703644 ^ 1647945914)[2:]).decode('utf-8')[::-1] 4 | d += bytes.fromhex(hex(1896877211 ^ 25126112)[2:]).decode('utf-8')[::-1] 5 | d += bytes.fromhex(hex(3460111838 ^ -1589361989 & (2**32-1))[2:]).decode('utf-8')[::-1] 6 | d += bytes.fromhex(hex(841570556 ^ 1096550281)[2:]).decode('utf-8')[::-1] 7 | d += bytes.fromhex(hex(2361298766 ^ -152966357 & (2**32-1))[2:]).decode('utf-8')[::-1] 8 | d += bytes.fromhex(hex(2974431051 ^ -567515016 & (2**32-1))[2:]).decode('utf-8')[::-1] 9 | d += bytes.fromhex(hex(250179706 ^ 1721577224)[2:]).decode('utf-8')[::-1] 10 | d += bytes.fromhex(hex(4186823992 ^ -925716911 & (2**32-1))[2:]).decode('utf-8')[::-1] 11 | d += bytes.fromhex(hex(1567711053 ^ 1813145471)[2:]).decode('utf-8')[::-1] 12 | d += bytes.fromhex(hex(1091280784 ^ 1010629539)[2:]).decode('utf-8')[::-1] 13 | 14 | print(d) 15 | -------------------------------------------------------------------------------- /WhiteHat Wargame/re07-flagcheck.py: -------------------------------------------------------------------------------- 1 | #Made by FazeCT 2 | 3 | data = ['0x56','0x6a','0x6a','0x70','0x60','0x4e','0x66','0x7c','0x72','0x6f','0x71','0x53','0x75','0x61','0x7d','0x4f','0x77','0x7d','0x61','0x4b','0x67','0x25','0x48','0x7b','0x71','0x7b','0x77','0x70','0x78','0x70','0x78','0x45','0x7e','0x6d','0x4c','0x54','0x58'] 4 | tmp = "" 5 | for c in data: 6 | tmp += bytes.fromhex(c[2:]).decode('utf-8') 7 | for i in range(int('0x25',16)): 8 | for j in range(0,200): 9 | n = ord(tmp[i]) 10 | if n == i + 1 ^ j: 11 | print(chr(j),end='') 12 | break 13 | -------------------------------------------------------------------------------- /amateursCTF 2023/JVM.class: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/FazeCT/ctf/ab8c160867ea0efb10bd2dd0091bf9b63f182fc5/amateursCTF 2023/JVM.class -------------------------------------------------------------------------------- /amateursCTF 2023/README.md: -------------------------------------------------------------------------------- 1 | you found me xD 2 | -------------------------------------------------------------------------------- /amateursCTF 2023/code.jvm: -------------------------------------------------------------------------------- 1 | 6 6>"" 2 |  *+,6S6E6Y"""6O6N""5 }*%5 6*%5  3 | c*%5  a*%5 _*%5  *j  *%5 _*%5  s*%5  k*%5  p*%5  b*%5 _*%5  0*%5  k*%5  0*%5  W*%5 _*%5  T*%5  0*%5  ,*%5  ^*%5 _*%5 ) ,*%5 ' H*%5 - L*%5 _*%5  )*%5 # A*%5 _*%5 , H*%5  0*%5  h*%5  [*%5 {*%5 F*%5 T*%5 C*%5 s*%5 r*%5 u*%5 e*%5 t*%5 a*%5 m*%5 a*%+ -------------------------------------------------------------------------------- /amateursCTF 2023/csce221.tar.gz: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/FazeCT/ctf/ab8c160867ea0efb10bd2dd0091bf9b63f182fc5/amateursCTF 2023/csce221.tar.gz -------------------------------------------------------------------------------- /amateursCTF 2023/emojis.tar.gz: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/FazeCT/ctf/ab8c160867ea0efb10bd2dd0091bf9b63f182fc5/amateursCTF 2023/emojis.tar.gz -------------------------------------------------------------------------------- /amateursCTF 2023/flagchecker.sb3: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/FazeCT/ctf/ab8c160867ea0efb10bd2dd0091bf9b63f182fc5/amateursCTF 2023/flagchecker.sb3 -------------------------------------------------------------------------------- /amateursCTF 2023/headache: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/FazeCT/ctf/ab8c160867ea0efb10bd2dd0091bf9b63f182fc5/amateursCTF 2023/headache -------------------------------------------------------------------------------- /amateursCTF 2023/jvm.tar.gz: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/FazeCT/ctf/ab8c160867ea0efb10bd2dd0091bf9b63f182fc5/amateursCTF 2023/jvm.tar.gz -------------------------------------------------------------------------------- /amateursCTF 2023/rusteze: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/FazeCT/ctf/ab8c160867ea0efb10bd2dd0091bf9b63f182fc5/amateursCTF 2023/rusteze -------------------------------------------------------------------------------- /amateursCTF 2023/rusteze-2.exe: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/FazeCT/ctf/ab8c160867ea0efb10bd2dd0091bf9b63f182fc5/amateursCTF 2023/rusteze-2.exe -------------------------------------------------------------------------------- /amateursCTF 2023/trick-question.pyc: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/FazeCT/ctf/ab8c160867ea0efb10bd2dd0091bf9b63f182fc5/amateursCTF 2023/trick-question.pyc -------------------------------------------------------------------------------- /amateursCTF 2023/volcano: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/FazeCT/ctf/ab8c160867ea0efb10bd2dd0091bf9b63f182fc5/amateursCTF 2023/volcano -------------------------------------------------------------------------------- /angrsolvr.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/python3 2 | import angr 3 | import claripy 4 | 5 | 6 | def solver(): 7 | print("""ANGR Solver by FazeCT, 1.0 edition.\nGithub: https://github.com/FazeCT 8 | """) 9 | source = input("Binary\'s Path (Ex: E:/Downloads/test.exe):") # Get the binary's path 10 | mode = int(input("Solve with input constraints (1 if YES, 0 otherwise):")) # Get solve mode 11 | assert mode in [0, 1], f"0 or 1 expected, got: {mode}" 12 | 13 | if mode == 1: 14 | length = int(input("Length of the input: ")) # Get input's length 15 | assert type(length) is int, f"integer expected, got: {type(length)}" 16 | assert length > 0, f"length greater than 0 expected, got: {length}" 17 | 18 | cons = int(input("Use printable constraints? (1 if YES, 0 otherwise): ")) # Printable enabled or disabled 19 | assert cons in [0, 1], f"0 or 1 expected, got: {cons}" 20 | 21 | win = input("Address to find (Ex: 0x08048B92): ") # Get to-find address 22 | try: 23 | win = int(win, 16) 24 | except: 25 | print('Hex expected, abort now.') 26 | exit(0) 27 | 28 | lose = input("Address to avoid (Ex: 0x08048C88): ") # Get to-avoid address 29 | try: 30 | lose = int(lose, 16) 31 | except: 32 | print('Hex expected, abort now.') 33 | exit(0) 34 | 35 | form = input("Known flag format? (Ex: picoctf{}) (Input -1 if trying to find non-flag inputs): ") 36 | 37 | opt = int(input("Add base address? (For PIE - enabled executables, 1 if YES, 0 otherwise): ")) 38 | assert opt in [0, 1], f"0 or 1 expected, got: {opt}" 39 | 40 | p = angr.Project(source) 41 | inp = claripy.BVS("flag", length * 8) 42 | state = p.factory.entry_state(stdin=inp) 43 | 44 | if cons: 45 | for c in inp.chop(8): 46 | state.solver.add(c <= 0x7f) 47 | state.solver.add(c >= 0x20) 48 | 49 | if form != -1: 50 | try: 51 | for i in range(len(form) - 1): 52 | state.solver.add(inp.chop(8)[i] == ord(form[i])) 53 | state.solver.add(inp.chop(8)[-1] == ord(form[-1])) 54 | except: 55 | print('Invalid format/length') 56 | exit(0) 57 | 58 | simgr = p.factory.simulation_manager(state) 59 | print("Solving...") 60 | simgr.explore(find=win + opt * 0x400000, avoid=lose + opt * 0x400000) 61 | 62 | try: 63 | res = simgr.found[0] 64 | print("Solution found!") 65 | for i in range(3): 66 | print(res.posix.dumps(i)) 67 | except: 68 | print('No solution.') 69 | 70 | else: 71 | win = input("Address to find (Ex: 0x08048B92): ") # Get to-find address 72 | try: 73 | win = int(win, 16) 74 | except: 75 | print('Hex expected, abort now.') 76 | exit(0) 77 | 78 | lose = input("Address to avoid (Ex: 0x08048C88): ") # Get to-avoid address 79 | try: 80 | lose = int(lose, 16) 81 | except: 82 | print('Hex expected, abort now.') 83 | exit(0) 84 | 85 | opt = int(input("Add base address? (For PIE - enabled executables, 1 if YES, 0 otherwise): ")) 86 | assert opt in [0, 1], f"0 or 1 expected, got: {opt}" 87 | 88 | p = angr.Project(source) 89 | state = p.factory.entry_state() 90 | 91 | simgr = p.factory.simulation_manager(state) 92 | print("Solving...") 93 | 94 | simgr.explore(find=win + opt * 0x400000, avoid=lose + opt * 0x400000) 95 | 96 | try: 97 | res = simgr.found[0] 98 | print("Solution found!") 99 | for i in range(3): 100 | print(res.posix.dumps(i)) 101 | except: 102 | print('No solution.') 103 | 104 | 105 | if __name__ == "__main__": 106 | solver() 107 | 108 | -------------------------------------------------------------------------------- /angstromCTF 2019/Classy Cipher.py: -------------------------------------------------------------------------------- 1 | #Made by FazeCT 2 | 3 | data = ": 96: v1 = i - 87 11 | else: v1 = i - 48 12 | if 65537 * (v1 + (i << 8)) == 889533701: 13 | a1[17] = chr(i) 14 | if 65537 * (v1 + (i << 8)) == 1712285199: 15 | a1[5] = a1[9] = chr(i) 16 | if 65537 * (v1 + (i << 8)) == 1596940079: 17 | a1[8] = chr(i) 18 | a1[18] = chr(246//2 + 2*(18%4//2)) 19 | a1[4] = chr(246//2 + 2*(4%4//2)) 20 | v5 = v6 = 0 21 | for i in range(8): 22 | v7 = ((1 << i) & 108) >> i 23 | if i & 1 != 0: 24 | v5 += v7 << (i//2) 25 | else: 26 | v6 += v7 << (i//2) 27 | a1[v5] = chr(117) 28 | a1[v5+1] = chr(220//2) 29 | a1[v6] = chr(234//2) 30 | a1[v6+1] = chr(110) 31 | 32 | hex = '0x667463' 33 | a1[1] = chr(int(str(0x63))) 34 | a1[2] = chr(int(str(0x74))) 35 | a1[3] = chr(int(str(0x66))) 36 | for c in a1: print(c,end='') 37 | 38 | #Flag is: actf{fun_func710n5} 39 | -------------------------------------------------------------------------------- /angstromCTF 2019/One Bite.py: -------------------------------------------------------------------------------- 1 | #Made by FazeCT 2 | 3 | data = "]_HZGUcHTURWcUQc[SUR[cHSc^YcOU_WA" 4 | for c in data: 5 | print(chr(ord(c)^int(str(0x3C))),end='') 6 | -------------------------------------------------------------------------------- /angstromCTF 2019/Really Secure Algorithm.py: -------------------------------------------------------------------------------- 1 | #Made by FazeCT 2 | 3 | from Crypto.Util.number import bytes_to_long, long_to_bytes,getPrime, inverse 4 | 5 | e = 65537 6 | c = 7022848098469230958320047471938217952907600532361296142412318653611729265921488278588086423574875352145477376594391159805651080223698576708934993951618464460109422377329972737876060167903857613763294932326619266281725900497427458047861973153012506595691389361443123047595975834017549312356282859235890330349 7 | p = 8337989838551614633430029371803892077156162494012474856684174381868510024755832450406936717727195184311114937042673575494843631977970586746618123352329889 8 | q = 7755060911995462151580541927524289685569492828780752345560845093073545403776129013139174889414744570087561926915046519199304042166351530778365529171009493 9 | n = p*q 10 | phi = (p-1)*(q-1) 11 | d = inverse(e,phi) 12 | msg = pow(c,d,n) 13 | print(long_to_bytes(msg)) 14 | -------------------------------------------------------------------------------- /angstromCTF 2020/Reasonably Strong Algorithm.py: -------------------------------------------------------------------------------- 1 | #Made by FazeCT 2 | 3 | from Crypto.Util.number import bytes_to_long, long_to_bytes,getPrime, inverse 4 | 5 | n = 126390312099294739294606157407778835887 6 | e = 65537 7 | c = 13612260682947644362892911986815626931 8 | p = 9336949138571181619 9 | q = 13536574980062068373 10 | 11 | phi = (p-1)*(q-1) 12 | d = inverse(e,phi) 13 | msg = pow(c,d,n) 14 | print(long_to_bytes(msg)) 15 | -------------------------------------------------------------------------------- /angstromCTF 2020/Taking Off.py: -------------------------------------------------------------------------------- 1 | #Made by FazeCT 2 | 3 | data =[0x5A, 0x46, 0x4F, 0x4B, 0x59, 0x4F, 0x0A, 0x4D, 0x43, 0x5C, 0x4F, 0x0A, 0x4C, 0x46, 0x4B, 0x4D] 4 | for i in range(len(data)): print(chr(int(str(data[i]^0x2A))),end='') 5 | -------------------------------------------------------------------------------- /angstromCTF 2022/Randomly Sampled Algorithm.py: -------------------------------------------------------------------------------- 1 | #Made by FazeCT 2 | 3 | from Crypto.Util.number import bytes_to_long, long_to_bytes,getPrime, inverse 4 | 5 | n = 133075794736862400686388110598570266808714052683651232655122797445099216964925703530068957607358890220696254013415564497625510160656547477386290353341301388957868030883484367150794172590602260618953020322190415128204088685449855108061423638905602604314199002557585876080719068735072138975699738144061697925373 6 | e = 65537 7 | c = 42999486939739078417543300759928045769347425010481921402117654240134870338470114310074441997014418414023223148236139895795053257877203574091454937566637813901960299427919263842462481370908334316720948794826158725807235252653149450622143783560995967869958852519888842457531188064386890082072803961804464549309 8 | 9 | phi = 133075794736862400686388110598570266808714052683651232655122797445099216964925703530068957607358890220696254013415564497625510160656547477386290353341301365877872031151018140890962539358215097403168452396402116271802269636497626498820406125901329433708704273662567430256232652048920492894069126553095462130720 10 | d = inverse(e,phi) 11 | msg = pow(c,d,n) 12 | print(long_to_bytes(msg)) 13 | -------------------------------------------------------------------------------- /angstromCTF 2022/uninspired.cpp: -------------------------------------------------------------------------------- 1 | //-------------------------------------------------------------------- 2 | #include 3 | #include 4 | #include 5 | using namespace std; 6 | using namespace __gnu_pbds; 7 | //-------------------------------------------------------------------- 8 | typedef long long ll; 9 | typedef tree,rb_tree_tag,tree_order_statistics_node_update> oset; 10 | //find by order, order of key. 11 | //usage: oset p; p.insert(x); p.order_of_key(x); 12 | //less, less_equal. 13 | #define all(x) (x).begin(), (x).end() 14 | #define mp make_pair 15 | #define fi first 16 | #define se second 17 | #define pb push_back 18 | #define yes cout << "YES" << endl; 19 | #define no cout << "NO" << endl; 20 | const int inf=INT_MAX; 21 | const ll infll=LLONG_MAX; 22 | const ll mod = 1e9+7; 23 | //-------------------------------------------------------------------- 24 | int n,m,k,cnt=0; 25 | vector dx= {0,0,1,-1}; 26 | vector dy= {1,-1,0,0}; 27 | vector > g(200001); 28 | //vector vis(200001,0),ans,st; 29 | bool valid(int i,int j) 30 | { 31 | return (i>=0 && i=0 && j &a,const pair &b) 39 | { 40 | if(a.se==b.se) return a.fi m; 48 | for(char a='0'; a<='9'; a++) 49 | { 50 | for(char b='0'; b<='9'; b++) 51 | { 52 | for(char c='0'; c<='9'; c++) 53 | { 54 | for(char d='0'; d<='9'; d++) 55 | { 56 | for(char e='0'; e<='9'; e++) 57 | { 58 | for(char f='0'; f<='9'; f++) 59 | { 60 | for(char g='0'; g<='9'; g++) 61 | { 62 | for(char h='0'; h<='9'; h++) 63 | { 64 | for(char i='0'; i<='9'; i++) 65 | { 66 | for(char j='0'; j<='9'; j++) 67 | { 68 | string s=""; 69 | s+=a,s+=b,s+=c,s+=d,s+=e,s+=f,s+=g,s+=h,s+=i,s+=j; 70 | if(a+b+c+d+e+f+g+h+i+j-480!=10) continue; 71 | m.clear(); 72 | string s1=""; 73 | for(auto &x:s) m[x]++; 74 | for(char t='0';t<='9';t++) s1.pb(char(m[t]+48)); 75 | if(s==s1) 76 | { 77 | cout << "found: " << s << endl; 78 | } 79 | } 80 | } 81 | } 82 | } 83 | } 84 | } 85 | } 86 | } 87 | } 88 | } 89 | cout << "end" << endl; 90 | } 91 | -------------------------------------------------------------------------------- /codegate2025/client: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/FazeCT/ctf/ab8c160867ea0efb10bd2dd0091bf9b63f182fc5/codegate2025/client -------------------------------------------------------------------------------- /codegate2025/prob: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/FazeCT/ctf/ab8c160867ea0efb10bd2dd0091bf9b63f182fc5/codegate2025/prob -------------------------------------------------------------------------------- /codegate2025/readme.md: -------------------------------------------------------------------------------- 1 | 2 | -------------------------------------------------------------------------------- /feature.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/FazeCT/ctf/ab8c160867ea0efb10bd2dd0091bf9b63f182fc5/feature.png -------------------------------------------------------------------------------- /ida.md: -------------------------------------------------------------------------------- 1 | ## IDA TIP & TRICKS 2 | 3 | ### IDA REMOTE LINUX DEBUG 4 | 5 | Sample: [ELF C++ - 0 protection](https://www.root-me.org/en/Challenges/Cracking/ELF-C-0-protection) 6 | 7 | 1. Load the binary into IDA. 8 | 9 | 2. Locate **/.../IDA/dbgsrv/linux_server64**; paste the file into the same directory as the binary. 10 | 11 | ![image](https://github.com/FazeCT/ctf/assets/110371121/26ad189a-157a-43a8-ac89-5afb897d2e63) 12 | 13 | ![image](https://github.com/FazeCT/ctf/assets/110371121/235a5cf0-28c4-4047-8715-acdd640994ea) 14 | 15 | 3. Open terminal inside the directory, type: 16 | 17 | > **ip a** 18 | 19 | ![image](https://github.com/FazeCT/ctf/assets/110371121/ba27b7c6-165a-4e93-9d31-df7328e896a3) 20 | 21 | Copy the inet hostname (**172.22.98.247**). 22 | 23 | > **./linux_server64** 24 | 25 | ![image](https://github.com/FazeCT/ctf/assets/110371121/5e2e9515-3f54-427d-8a25-0a0002de9cc6) 26 | 27 | 4. In IDA, choose **Remote Linux Debugger**. 28 | 29 | ![image](https://github.com/FazeCT/ctf/assets/110371121/9ca0e3e6-7bde-46b5-af24-8adb1e8207cb) 30 | 31 | 5. Go to **Debugger > Process Options...**, set the hostname to the copied hostname from **ip a**. 32 | 33 | ![image](https://github.com/FazeCT/ctf/assets/110371121/bdf40460-ba87-4f58-87ff-cda710cea9bd) 34 | 35 | 5a. If you are debugging a binary that requires args (for example, **./binary flag{dummy_flag}**... 36 | 37 | -> Put **flag{dummy_flag}** into parameter section. 38 | 39 | ![image](https://github.com/FazeCT/ctf/assets/110371121/a7a278ae-62f3-4a77-9e02-9ac488adb791) 40 | 41 | 6. Run the debugger. 42 | 43 | 6a. Right click on the taskbar, choose **Debugger commands** dor the debugger options to appear. 44 | 45 | ![image](https://github.com/FazeCT/ctf/assets/110371121/2c6b5af2-7ed6-4d1d-a56a-2f07a6936f47) 46 | 47 | 7. These buttons... 48 | 49 | ![image](https://github.com/FazeCT/ctf/assets/110371121/9d3de7be-ff46-422b-9ee1-f1f6e9788bbd) 50 | 51 | From left to right: 52 | 53 | - Step into: Step into all call instructions (to debug inside functions, ...). 54 | 55 | - Step over: Step over all call instructions. 56 | 57 | - Step outside: Step over all remaining instructions of a callee and get back to the caller. 58 | 59 | 8. If your debugger is not stepping inside the pseudo-code (F5) but the assembly code... 60 | 61 | -> Turn on **Debugger > Use source-level debugging**. 62 | 63 | ![image](https://github.com/FazeCT/ctf/assets/110371121/757e3be4-2a01-477a-8b8f-ffab438b89f0) 64 | 65 | 8a. Press **G** to jump to any address. 66 | 67 | ![image](https://github.com/FazeCT/ctf/assets/110371121/41249f77-2736-4015-9d37-02eaeee110b1) 68 | 69 | 8b. Edit register values/flag values at the breakpoint using the panels on the right. 70 | 71 | ![image](https://github.com/FazeCT/ctf/assets/110371121/aac57cb1-8386-4a4c-893c-dc028a0c74ce) 72 | 73 | 8c. Press **X** to get an offset's xrefs (where the binary invokes the offset). 74 | 75 | ![image](https://github.com/FazeCT/ctf/assets/110371121/f18814e6-97e0-4744-bd33-6cc63bf0e319) 76 | 77 | 8d. Go to **Edit > Segments > Rebase program** and set the value to `0` to get rid of the base addresses. 78 | 79 | ![image](https://github.com/FazeCT/ctf/assets/110371121/172b5914-0feb-4db8-a2b7-cec3f9e6b4d9) 80 | 81 | 9. To be updated... 82 | 83 | 84 | 85 | 86 | 87 | 88 | 89 | 90 | 91 | 92 | 93 | 94 | 95 | 96 | 97 | 98 | -------------------------------------------------------------------------------- /imaginaryCTF 2023/README.md: -------------------------------------------------------------------------------- 1 | kekw pythonCTF xD 2 | -------------------------------------------------------------------------------- /imaginaryCTF 2023/chall.py: -------------------------------------------------------------------------------- 1 | inp = input("What is the flag? ").encode().zfill(51) 2 | 3 | if [n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65s").__dict__.__getitem__("\x66\x72\x6fm\x68e\x78")([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79t\x65\x73"),"\x36\x37\x20\x36\x63\x206\x66\x20\x36\x32\x2061\x20\x36\x63 \x37\x33").decode())().__getitem__([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("bytes").__dict__.__getitem__("fromhex")([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("bytes"),"\x35f\x20\x35f \x362 \x375\x2069 6\x63\x20\x374\x206\x39\x206e\x207\x33\x20\x35f\x20\x35\x66").decode()).__dict__.__getitem__([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74e\x73").__dict__.__getitem__("\x66\x72\x6f\x6d\x68\x65\x78")([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73"),"\x36\x31 \x36\x63\x20\x36\x63").decode())([[n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73").__dict__.__getitem__("\x66\x72\x6f\x6d\x68ex")([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73"),"\x36\x37\x20\x36\x63\x20\x36\x66\x20\x36\x32\x20\x36\x31\x20\x36\x63\x20\x37\x33").decode())().__getitem__([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73").__dict__.__getitem__("\x66\x72\x6f\x6d\x68\x65\x78")([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73"),"\x36\x39\x20\x36\x65\x20\x37\x30").decode()).__getitem__(17106^17105).__pow__(8).__eq__(11716593810022656),[n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73").__dict__.__getitem__("\x66\x72\x6f\x6d\x68ex")([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73"),"\x36\x37\x20\x36\x63\x20\x36\x66\x20\x36\x32\x20\x36\x31\x20\x36\x63\x20\x37\x33").decode())().__getitem__([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73").__dict__.__getitem__("\x66\x72\x6f\x6d\x68\x65\x78")([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73"),"\x36\x39\x20\x36\x65\x20\x37\x30").decode()).__getitem__(27097^27083).__pow__(24).__eq__(32353447101972729728913030683994293212890625),[n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73").__dict__.__getitem__("\x66\x72\x6f\x6d\x68ex")([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73"),"\x36\x37\x20\x36\x63\x20\x36\x66\x20\x36\x32\x20\x36\x31\x20\x36\x63\x20\x37\x33").decode())().__getitem__([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73").__dict__.__getitem__("\x66\x72\x6f\x6d\x68\x65\x78")([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73"),"\x36\x39\x20\x36\x65\x20\x37\x30").decode()).__getitem__(34026^34017).__pow__(46).__eq__(9446824413773783721646626909963562851135776704278099454808312884779297746717929840087890625),[n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73").__dict__.__getitem__("\x66\x72\x6f\x6d\x68ex")([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73"),"\x36\x37\x20\x36\x63\x20\x36\x66\x20\x36\x32\x20\x36\x31\x20\x36\x63\x20\x37\x33").decode())().__getitem__([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73").__dict__.__getitem__("\x66\x72\x6f\x6d\x68\x65\x78")([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73"),"\x36\x39\x20\x36\x65\x20\x37\x30").decode()).__getitem__(63699^63729).__pow__(73).__eq__(3848329407410063966449821610084142775235723300303676033059406926388218957230170383178174198012821574964995892819168434088598247206551552),[n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73").__dict__.__getitem__("\x66\x72\x6f\x6d\x68ex")([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73"),"\x36\x37\x20\x36\x63\x20\x36\x66\x20\x36\x32\x20\x36\x31\x20\x36\x63\x20\x37\x33").decode())().__getitem__([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73").__dict__.__getitem__("\x66\x72\x6f\x6d\x68\x65\x78")([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73"),"\x36\x39\x20\x36\x65\x20\x37\x30").decode()).__getitem__(19642^19614).__pow__(116).__eq__(99453466295769991497930584904635827609127067259139567866356325844880559213675005735941118931591926469923175003563264921621620270586414500654150782386695821390343819044273345442678033943156922419726982739685408239580854488870825230336),[n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73").__dict__.__getitem__("\x66\x72\x6f\x6d\x68ex")([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73"),"\x36\x37\x20\x36\x63\x20\x36\x66\x20\x36\x32\x20\x36\x31\x20\x36\x63\x20\x37\x33").decode())().__getitem__([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73").__dict__.__getitem__("\x66\x72\x6f\x6d\x68\x65\x78")([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73"),"\x36\x39\x20\x36\x65\x20\x37\x30").decode()).__getitem__(23117^23115).__pow__(43).__eq__(666454163935483494165986073535521413339908119119439689887653437787720225729135378569),[n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73").__dict__.__getitem__("\x66\x72\x6f\x6d\x68ex")([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73"),"\x36\x37\x20\x36\x63\x20\x36\x66\x20\x36\x32\x20\x36\x31\x20\x36\x63\x20\x37\x33").decode())().__getitem__([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73").__dict__.__getitem__("\x66\x72\x6f\x6d\x68\x65\x78")([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73"),"\x36\x39\x20\x36\x65\x20\x37\x30").decode()).__getitem__(22834^22817).__pow__(100).__eq__(279125119937476769711218039717323941184780697208075426033790125935558757770607551692800947835186940401831368051935139459092824653082333036363632761532652883447140730780926539009118491968618626309427482853376),[n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73").__dict__.__getitem__("\x66\x72\x6f\x6d\x68ex")([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73"),"\x36\x37\x20\x36\x63\x20\x36\x66\x20\x36\x32\x20\x36\x31\x20\x36\x63\x20\x37\x33").decode())().__getitem__([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73").__dict__.__getitem__("\x66\x72\x6f\x6d\x68\x65\x78")([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73"),"\x36\x39\x20\x36\x65\x20\x37\x30").decode()).__getitem__(63619^63651).__pow__(77).__eq__(14774235820095264004498794573921235350758313964623449966161598941405119454882112300765336770281511027492774636711848411946648949240160971642785234944),[n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73").__dict__.__getitem__("\x66\x72\x6f\x6d\x68ex")([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73"),"\x36\x37\x20\x36\x63\x20\x36\x66\x20\x36\x32\x20\x36\x31\x20\x36\x63\x20\x37\x33").decode())().__getitem__([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73").__dict__.__getitem__("\x66\x72\x6f\x6d\x68\x65\x78")([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73"),"\x36\x39\x20\x36\x65\x20\x37\x30").decode()).__getitem__(46423^46430).__pow__(103).__eq__(2854896728399152791501132019657741211254110875185643687171299493879837284627932797677994094488293012716816857642547064999482966108800130770400087515961592245860476713903985973402562210059666101039),[n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73").__dict__.__getitem__("\x66\x72\x6f\x6d\x68ex")([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73"),"\x36\x37\x20\x36\x63\x20\x36\x66\x20\x36\x32\x20\x36\x31\x20\x36\x63\x20\x37\x33").decode())().__getitem__([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73").__dict__.__getitem__("\x66\x72\x6f\x6d\x68\x65\x78")([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73"),"\x36\x39\x20\x36\x65\x20\x37\x30").decode()).__getitem__(45770^45807).__pow__(81).__eq__(15154451684337032471180877896715528289578404766894843944101258135758218479588478910835485639300034416425654688319551372515107152957800448),[n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73").__dict__.__getitem__("\x66\x72\x6f\x6d\x68ex")([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73"),"\x36\x37\x20\x36\x63\x20\x36\x66\x20\x36\x32\x20\x36\x31\x20\x36\x63\x20\x37\x33").decode())().__getitem__([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73").__dict__.__getitem__("\x66\x72\x6f\x6d\x68\x65\x78")([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73"),"\x36\x39\x20\x36\x65\x20\x37\x30").decode()).__getitem__(7845^7816).__pow__(93).__eq__(152765413313863335891876650232228590636250322599805199887699889155122653736313839970609248122516106082640356845647993746493975270361464407009917660338486004656821831684909457479206699008),[n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73").__dict__.__getitem__("\x66\x72\x6f\x6d\x68ex")([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73"),"\x36\x37\x20\x36\x63\x20\x36\x66\x20\x36\x32\x20\x36\x31\x20\x36\x63\x20\x37\x33").decode())().__getitem__([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73").__dict__.__getitem__("\x66\x72\x6f\x6d\x68\x65\x78")([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73"),"\x36\x39\x20\x36\x65\x20\x37\x30").decode()).__getitem__(17069^17077).__pow__(119).__eq__(3322971292068586945001375443001494973926450995421185933704074187872339304713790839588476655936816080094232588371678021671011954902402082880837534931228172997419786114403571789661045242053742017701253343153755537286997423507273197174072265625),[n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73").__dict__.__getitem__("\x66\x72\x6f\x6d\x68ex")([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73"),"\x36\x37\x20\x36\x63\x20\x36\x66\x20\x36\x32\x20\x36\x31\x20\x36\x63\x20\x37\x33").decode())().__getitem__([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73").__dict__.__getitem__("\x66\x72\x6f\x6d\x68\x65\x78")([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73"),"\x36\x39\x20\x36\x65\x20\x37\x30").decode()).__getitem__(1919^1896).__pow__(49).__eq__(8099471081759297818346776746930009699492536551830435520066277259587650405592285096645355224609375),[n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73").__dict__.__getitem__("\x66\x72\x6f\x6d\x68ex")([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73"),"\x36\x37\x20\x36\x63\x20\x36\x66\x20\x36\x32\x20\x36\x31\x20\x36\x63\x20\x37\x33").decode())().__getitem__([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73").__dict__.__getitem__("\x66\x72\x6f\x6d\x68\x65\x78")([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73"),"\x36\x39\x20\x36\x65\x20\x37\x30").decode()).__getitem__(60735^60714).__pow__(86).__eq__(15701091733911005039058018134515591100230024516717081888584305795418262516795142712396701976283136741150049062868709289366652374855096750702527661176436773532505121),[n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73").__dict__.__getitem__("\x66\x72\x6f\x6d\x68ex")([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73"),"\x36\x37\x20\x36\x63\x20\x36\x66\x20\x36\x32\x20\x36\x31\x20\x36\x63\x20\x37\x33").decode())().__getitem__([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73").__dict__.__getitem__("\x66\x72\x6f\x6d\x68\x65\x78")([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73"),"\x36\x39\x20\x36\x65\x20\x37\x30").decode()).__getitem__(63287^63283).__pow__(15).__eq__(22313961097670283270314823109107),[n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73").__dict__.__getitem__("\x66\x72\x6f\x6d\x68ex")([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73"),"\x36\x37\x20\x36\x63\x20\x36\x66\x20\x36\x32\x20\x36\x31\x20\x36\x63\x20\x37\x33").decode())().__getitem__([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73").__dict__.__getitem__("\x66\x72\x6f\x6d\x68\x65\x78")([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73"),"\x36\x39\x20\x36\x65\x20\x37\x30").decode()).__getitem__(33028^33054).__pow__(7).__eq__(69833729609375),[n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73").__dict__.__getitem__("\x66\x72\x6f\x6d\x68ex")([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73"),"\x36\x37\x20\x36\x63\x20\x36\x66\x20\x36\x32\x20\x36\x31\x20\x36\x63\x20\x37\x33").decode())().__getitem__([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73").__dict__.__getitem__("\x66\x72\x6f\x6d\x68\x65\x78")([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73"),"\x36\x39\x20\x36\x65\x20\x37\x30").decode()).__getitem__(19552^19569).__pow__(84).__eq__(429889013523893846517224806489583669713060303148081760017486582803791784190577550623785359784398305368779194132465078850291607165748639598349926675909535416694850851601),[n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73").__dict__.__getitem__("\x66\x72\x6f\x6d\x68ex")([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73"),"\x36\x37\x20\x36\x63\x20\x36\x66\x20\x36\x32\x20\x36\x31\x20\x36\x63\x20\x37\x33").decode())().__getitem__([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73").__dict__.__getitem__("\x66\x72\x6f\x6d\x68\x65\x78")([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73"),"\x36\x39\x20\x36\x65\x20\x37\x30").decode()).__getitem__(37067^37090).__pow__(12).__eq__(540360087662636962890625),[n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73").__dict__.__getitem__("\x66\x72\x6f\x6d\x68ex")([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73"),"\x36\x37\x20\x36\x63\x20\x36\x66\x20\x36\x32\x20\x36\x31\x20\x36\x63\x20\x37\x33").decode())().__getitem__([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73").__dict__.__getitem__("\x66\x72\x6f\x6d\x68\x65\x78")([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73"),"\x36\x39\x20\x36\x65\x20\x37\x30").decode()).__getitem__(62715^62688).__pow__(62).__eq__(2041105095068520949608886499704812731055009299025497759896142376700593881360024455303422742986506865665182180923408384),[n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73").__dict__.__getitem__("\x66\x72\x6f\x6d\x68ex")([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73"),"\x36\x37\x20\x36\x63\x20\x36\x66\x20\x36\x32\x20\x36\x31\x20\x36\x63\x20\x37\x33").decode())().__getitem__([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73").__dict__.__getitem__("\x66\x72\x6f\x6d\x68\x65\x78")([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73"),"\x36\x39\x20\x36\x65\x20\x37\x30").decode()).__getitem__(54720^54745).__pow__(65).__eq__(54963705560933635277952993342472339302063424186821498970895216297884264422272899437483338452342942688676763803346334166793043),[n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73").__dict__.__getitem__("\x66\x72\x6f\x6d\x68ex")([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73"),"\x36\x37\x20\x36\x63\x20\x36\x66\x20\x36\x32\x20\x36\x31\x20\x36\x63\x20\x37\x33").decode())().__getitem__([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73").__dict__.__getitem__("\x66\x72\x6f\x6d\x68\x65\x78")([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73"),"\x36\x39\x20\x36\x65\x20\x37\x30").decode()).__getitem__(14087^14082).__pow__(20).__eq__(96462930932749340835590504792099626418176),[n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73").__dict__.__getitem__("\x66\x72\x6f\x6d\x68ex")([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73"),"\x36\x37\x20\x36\x63\x20\x36\x66\x20\x36\x32\x20\x36\x31\x20\x36\x63\x20\x37\x33").decode())().__getitem__([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73").__dict__.__getitem__("\x66\x72\x6f\x6d\x68\x65\x78")([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73"),"\x36\x39\x20\x36\x65\x20\x37\x30").decode()).__getitem__(22869^22868).__pow__(46).__eq__(62982363120323251233150548690344397272388328521683052596132450587358969755035127763330345401),[n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73").__dict__.__getitem__("\x66\x72\x6f\x6d\x68ex")([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73"),"\x36\x37\x20\x36\x63\x20\x36\x66\x20\x36\x32\x20\x36\x31\x20\x36\x63\x20\x37\x33").decode())().__getitem__([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73").__dict__.__getitem__("\x66\x72\x6f\x6d\x68\x65\x78")([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73"),"\x36\x39\x20\x36\x65\x20\x37\x30").decode()).__getitem__(63517^63506).__pow__(29).__eq__(949270512908903998086528065053936636111328026544003052270597),[n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73").__dict__.__getitem__("\x66\x72\x6f\x6d\x68ex")([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73"),"\x36\x37\x20\x36\x63\x20\x36\x66\x20\x36\x32\x20\x36\x31\x20\x36\x63\x20\x37\x33").decode())().__getitem__([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73").__dict__.__getitem__("\x66\x72\x6f\x6d\x68\x65\x78")([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73"),"\x36\x39\x20\x36\x65\x20\x37\x30").decode()).__getitem__(40718^40730).__pow__(91).__eq__(36507346762698022672229947186425564061671647922171034852241452332588206602097091150839365421846414898500447897136445343628072917352273365998214114455637040252668778245977),[n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73").__dict__.__getitem__("\x66\x72\x6f\x6d\x68ex")([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73"),"\x36\x37\x20\x36\x63\x20\x36\x66\x20\x36\x32\x20\x36\x31\x20\x36\x63\x20\x37\x33").decode())().__getitem__([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73").__dict__.__getitem__("\x66\x72\x6f\x6d\x68\x65\x78")([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73"),"\x36\x39\x20\x36\x65\x20\x37\x30").decode()).__getitem__(62436^62444).__pow__(68).__eq__(143968364924561562974552731434596494012559606399312856181339379510991356456528667994770416197404697432075362606752512560583016461354663936),[n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73").__dict__.__getitem__("\x66\x72\x6f\x6d\x68ex")([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73"),"\x36\x37\x20\x36\x63\x20\x36\x66\x20\x36\x32\x20\x36\x31\x20\x36\x63\x20\x37\x33").decode())().__getitem__([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73").__dict__.__getitem__("\x66\x72\x6f\x6d\x68\x65\x78")([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73"),"\x36\x39\x20\x36\x65\x20\x37\x30").decode()).__getitem__(15680^15715).__pow__(70).__eq__(2758369043677505509670918061256140775824469482504900073864113562384680896531951362608474132392098222832377274471582495607435703277587890625),[n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73").__dict__.__getitem__("\x66\x72\x6f\x6d\x68ex")([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73"),"\x36\x37\x20\x36\x63\x20\x36\x66\x20\x36\x32\x20\x36\x31\x20\x36\x63\x20\x37\x33").decode())().__getitem__([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73").__dict__.__getitem__("\x66\x72\x6f\x6d\x68\x65\x78")([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73"),"\x36\x39\x20\x36\x65\x20\x37\x30").decode()).__getitem__(49618^49632).__pow__(126).__eq__(1624282775882015502895375715731547869967116063808701172227878605593265086649151663316740754595701943186985338276960573341825325659163921089779652068912755058200778559830844842804901645227676036378209809395699655072884990216798561935007683132425881922245025634765625),[n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73").__dict__.__getitem__("\x66\x72\x6f\x6d\x68ex")([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73"),"\x36\x37\x20\x36\x63\x20\x36\x66\x20\x36\x32\x20\x36\x31\x20\x36\x63\x20\x37\x33").decode())().__getitem__([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73").__dict__.__getitem__("\x66\x72\x6f\x6d\x68\x65\x78")([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73"),"\x36\x39\x20\x36\x65\x20\x37\x30").decode()).__getitem__(14155^14183).__pow__(89).__eq__(2675784431388739822912479195873535006777575546428377894186361016610060132844501148420511053019793063406241229031720237861254267757764404192017148214449),[n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73").__dict__.__getitem__("\x66\x72\x6f\x6d\x68ex")([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73"),"\x36\x37\x20\x36\x63\x20\x36\x66\x20\x36\x32\x20\x36\x31\x20\x36\x63\x20\x37\x33").decode())().__getitem__([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73").__dict__.__getitem__("\x66\x72\x6f\x6d\x68\x65\x78")([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73"),"\x36\x39\x20\x36\x65\x20\x37\x30").decode()).__getitem__(8596^8585).__pow__(96).__eq__(7268856709612756787225346499677774289512802614190641289146375658956020349643783943847809231604499765439814143733504245364357174482782079478652842983478488125825833776616491377353668212890625),[n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73").__dict__.__getitem__("\x66\x72\x6f\x6d\x68ex")([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73"),"\x36\x37\x20\x36\x63\x20\x36\x66\x20\x36\x32\x20\x36\x31\x20\x36\x63\x20\x37\x33").decode())().__getitem__([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73").__dict__.__getitem__("\x66\x72\x6f\x6d\x68\x65\x78")([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73"),"\x36\x39\x20\x36\x65\x20\x37\x30").decode()).__getitem__(56324^56367).__pow__(110).__eq__(29877972010972253192833071731693415365652202298871181558777888425605465225468139159773124416544534747536455303762752108499734678488854585192233276174396159856142083921750940280030953940651129665938997431598127754379961001),[n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73").__dict__.__getitem__("\x66\x72\x6f\x6d\x68ex")([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73"),"\x36\x37\x20\x36\x63\x20\x36\x66\x20\x36\x32\x20\x36\x31\x20\x36\x63\x20\x37\x33").decode())().__getitem__([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73").__dict__.__getitem__("\x66\x72\x6f\x6d\x68\x65\x78")([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73"),"\x36\x39\x20\x36\x65\x20\x37\x30").decode()).__getitem__(50544^50519).__pow__(25).__eq__(27738957312183406810942176067977845668792724609375),[n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73").__dict__.__getitem__("\x66\x72\x6f\x6d\x68ex")([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73"),"\x36\x37\x20\x36\x63\x20\x36\x66\x20\x36\x32\x20\x36\x31\x20\x36\x63\x20\x37\x33").decode())().__getitem__([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73").__dict__.__getitem__("\x66\x72\x6f\x6d\x68\x65\x78")([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73"),"\x36\x39\x20\x36\x65\x20\x37\x30").decode()).__getitem__(24933^24906).__pow__(76).__eq__(5961195753983995303484560285190290682733463583595335304528058156325433562658524929707243203762512477786151879240818694539888378801),[n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73").__dict__.__getitem__("\x66\x72\x6f\x6d\x68ex")([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73"),"\x36\x37\x20\x36\x63\x20\x36\x66\x20\x36\x32\x20\x36\x31\x20\x36\x63\x20\x37\x33").decode())().__getitem__([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73").__dict__.__getitem__("\x66\x72\x6f\x6d\x68\x65\x78")([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73"),"\x36\x39\x20\x36\x65\x20\x37\x30").decode()).__getitem__(43674^43664).__pow__(24).__eq__(9849732675807611094711841000000000000000000000000),[n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73").__dict__.__getitem__("\x66\x72\x6f\x6d\x68ex")([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73"),"\x36\x37\x20\x36\x63\x20\x36\x66\x20\x36\x32\x20\x36\x31\x20\x36\x63\x20\x37\x33").decode())().__getitem__([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73").__dict__.__getitem__("\x66\x72\x6f\x6d\x68\x65\x78")([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73"),"\x36\x39\x20\x36\x65\x20\x37\x30").decode()).__getitem__(34191^34239).__pow__(126).__eq__(12123322046368026766845555284174734862143220839547136182936923801262519994579258895086695136012612784629964133807779629268912272729929064102563562351571134115669020914817314628448682040928343513644325889562377257420914618199293475950013761897362635096064),[n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73").__dict__.__getitem__("\x66\x72\x6f\x6d\x68ex")([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73"),"\x36\x37\x20\x36\x63\x20\x36\x66\x20\x36\x32\x20\x36\x31\x20\x36\x63\x20\x37\x33").decode())().__getitem__([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73").__dict__.__getitem__("\x66\x72\x6f\x6d\x68\x65\x78")([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73"),"\x36\x39\x20\x36\x65\x20\x37\x30").decode()).__getitem__(17618^17631).__pow__(6).__eq__(885842380864),[n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73").__dict__.__getitem__("\x66\x72\x6f\x6d\x68ex")([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73"),"\x36\x37\x20\x36\x63\x20\x36\x66\x20\x36\x32\x20\x36\x31\x20\x36\x63\x20\x37\x33").decode())().__getitem__([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73").__dict__.__getitem__("\x66\x72\x6f\x6d\x68\x65\x78")([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73"),"\x36\x39\x20\x36\x65\x20\x37\x30").decode()).__getitem__(9740^9746).__pow__(33).__eq__(179553522959388241739349798537554631708787040879135341103130317),[n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73").__dict__.__getitem__("\x66\x72\x6f\x6d\x68ex")([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73"),"\x36\x37\x20\x36\x63\x20\x36\x66\x20\x36\x32\x20\x36\x31\x20\x36\x63\x20\x37\x33").decode())().__getitem__([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73").__dict__.__getitem__("\x66\x72\x6f\x6d\x68\x65\x78")([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73"),"\x36\x39\x20\x36\x65\x20\x37\x30").decode()).__getitem__(7975^7979).__pow__(35).__eq__(385748510274670890320797750420430050708201357023753748717210749529398351),[n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73").__dict__.__getitem__("\x66\x72\x6f\x6d\x68ex")([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73"),"\x36\x37\x20\x36\x63\x20\x36\x66\x20\x36\x32\x20\x36\x31\x20\x36\x63\x20\x37\x33").decode())().__getitem__([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73").__dict__.__getitem__("\x66\x72\x6f\x6d\x68\x65\x78")([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73"),"\x36\x39\x20\x36\x65\x20\x37\x30").decode()).__getitem__(59041^59008).__pow__(49).__eq__(300376071024635284156087943212436719239375530813650294861384068083525481611313395070377347),[n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73").__dict__.__getitem__("\x66\x72\x6f\x6d\x68ex")([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73"),"\x36\x37\x20\x36\x63\x20\x36\x66\x20\x36\x32\x20\x36\x31\x20\x36\x63\x20\x37\x33").decode())().__getitem__([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73").__dict__.__getitem__("\x66\x72\x6f\x6d\x68\x65\x78")([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73"),"\x36\x39\x20\x36\x65\x20\x37\x30").decode()).__getitem__(15126^15143).__pow__(79).__eq__(5177422397434133943104921319391337172187409135061853455150624631814434849075662045692827869398608558750724406518789785253043723750457037193),[n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73").__dict__.__getitem__("\x66\x72\x6f\x6d\x68ex")([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73"),"\x36\x37\x20\x36\x63\x20\x36\x66\x20\x36\x32\x20\x36\x31\x20\x36\x63\x20\x37\x33").decode())().__getitem__([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73").__dict__.__getitem__("\x66\x72\x6f\x6d\x68\x65\x78")([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73"),"\x36\x39\x20\x36\x65\x20\x37\x30").decode()).__getitem__(57935^57936).__pow__(93).__eq__(3875350235281664831660960617580349420579089722213274181469314776019545119245476575202268153511388261695333783650094408887882026903201446197283128996238502920192),[n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73").__dict__.__getitem__("\x66\x72\x6f\x6d\x68ex")([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73"),"\x36\x37\x20\x36\x63\x20\x36\x66\x20\x36\x32\x20\x36\x31\x20\x36\x63\x20\x37\x33").decode())().__getitem__([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73").__dict__.__getitem__("\x66\x72\x6f\x6d\x68\x65\x78")([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73"),"\x36\x39\x20\x36\x65\x20\x37\x30").decode()).__getitem__(7010^7008).__pow__(55).__eq__(350904879621892686078282166981617097988227698061554148933088288827825374792856539625950879204483697093639537688576),[n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73").__dict__.__getitem__("\x66\x72\x6f\x6d\x68ex")([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73"),"\x36\x37\x20\x36\x63\x20\x36\x66\x20\x36\x32\x20\x36\x31\x20\x36\x63\x20\x37\x33").decode())().__getitem__([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73").__dict__.__getitem__("\x66\x72\x6f\x6d\x68\x65\x78")([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73"),"\x36\x39\x20\x36\x65\x20\x37\x30").decode()).__getitem__(20335^20345).__pow__(102).__eq__(9854837658709009902840423788263103930870230691677351986711027186635648340217172558000699787158395409325616057120782122954632368861884637638021078801194044407273135355605978370906978064829251584),[n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73").__dict__.__getitem__("\x66\x72\x6f\x6d\x68ex")([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73"),"\x36\x37\x20\x36\x63\x20\x36\x66\x20\x36\x32\x20\x36\x31\x20\x36\x63\x20\x37\x33").decode())().__getitem__([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73").__dict__.__getitem__("\x66\x72\x6f\x6d\x68\x65\x78")([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73"),"\x36\x39\x20\x36\x65\x20\x37\x30").decode()).__getitem__(58025^57987).__pow__(33).__eq__(8787599130086200747642212647740199161191191975177869536057),[n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73").__dict__.__getitem__("\x66\x72\x6f\x6d\x68ex")([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73"),"\x36\x37\x20\x36\x63\x20\x36\x66\x20\x36\x32\x20\x36\x31\x20\x36\x63\x20\x37\x33").decode())().__getitem__([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73").__dict__.__getitem__("\x66\x72\x6f\x6d\x68\x65\x78")([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73"),"\x36\x39\x20\x36\x65\x20\x37\x30").decode()).__getitem__(1800^1812).__pow__(30).__eq__(273676256864057658169979465205184816551174365773824),[n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73").__dict__.__getitem__("\x66\x72\x6f\x6d\x68ex")([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73"),"\x36\x37\x20\x36\x63\x20\x36\x66\x20\x36\x32\x20\x36\x31\x20\x36\x63\x20\x37\x33").decode())().__getitem__([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73").__dict__.__getitem__("\x66\x72\x6f\x6d\x68\x65\x78")([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73"),"\x36\x39\x20\x36\x65\x20\x37\x30").decode()).__getitem__(22479^22472).__pow__(71).__eq__(377152712136764226850902319141752255855581394522141919528596649522051505994415819394593995263291702335322867016097574358377280544383250363282620416),[n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73").__dict__.__getitem__("\x66\x72\x6f\x6d\x68ex")([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73"),"\x36\x37\x20\x36\x63\x20\x36\x66\x20\x36\x32\x20\x36\x31\x20\x36\x63\x20\x37\x33").decode())().__getitem__([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73").__dict__.__getitem__("\x66\x72\x6f\x6d\x68\x65\x78")([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73"),"\x36\x39\x20\x36\x65\x20\x37\x30").decode()).__getitem__(29858^29836).__pow__(32).__eq__(2328306436538696289062500000000000000000000000000000000),[n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73").__dict__.__getitem__("\x66\x72\x6f\x6d\x68ex")([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73"),"\x36\x37\x20\x36\x63\x20\x36\x66\x20\x36\x32\x20\x36\x31\x20\x36\x63\x20\x37\x33").decode())().__getitem__([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73").__dict__.__getitem__("\x66\x72\x6f\x6d\x68\x65\x78")([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73"),"\x36\x39\x20\x36\x65\x20\x37\x30").decode()).__getitem__(14363^14387).__pow__(52).__eq__(21368996953242526153442455912292983336597584898817192469907377729843034330770024098455905914306640625),[n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73").__dict__.__getitem__("\x66\x72\x6f\x6d\x68ex")([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73"),"\x36\x37\x20\x36\x63\x20\x36\x66\x20\x36\x32\x20\x36\x31\x20\x36\x63\x20\x37\x33").decode())().__getitem__([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73").__dict__.__getitem__("\x66\x72\x6f\x6d\x68\x65\x78")([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73"),"\x36\x39\x20\x36\x65\x20\x37\x30").decode()).__getitem__(52117^52147).__pow__(56).__eq__(15369922400447804050857106809882557886535430378970772864323994847940248511226147412103978681078289133898040067751936),[n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73").__dict__.__getitem__("\x66\x72\x6f\x6d\x68ex")([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73"),"\x36\x37\x20\x36\x63\x20\x36\x66\x20\x36\x32\x20\x36\x31\x20\x36\x63\x20\x37\x33").decode())().__getitem__([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73").__dict__.__getitem__("\x66\x72\x6f\x6d\x68\x65\x78")([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73"),"\x36\x39\x20\x36\x65\x20\x37\x30").decode()).__getitem__(24068^24068).__pow__(30).__eq__(4321942375150662009157288198886473341473378241062164306640625),[n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73").__dict__.__getitem__("\x66\x72\x6f\x6d\x68ex")([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73"),"\x36\x37\x20\x36\x63\x20\x36\x66\x20\x36\x32\x20\x36\x31\x20\x36\x63\x20\x37\x33").decode())().__getitem__([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73").__dict__.__getitem__("\x66\x72\x6f\x6d\x68\x65\x78")([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73"),"\x36\x39\x20\x36\x65\x20\x37\x30").decode()).__getitem__(12340^12346).__pow__(95).__eq__(19244817692775379254742950967455327011704665906495063967001221701622487413797394300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000),[n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73").__dict__.__getitem__("\x66\x72\x6f\x6d\x68ex")([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73"),"\x36\x37\x20\x36\x63\x20\x36\x66\x20\x36\x32\x20\x36\x31\x20\x36\x63\x20\x37\x33").decode())().__getitem__([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73").__dict__.__getitem__("\x66\x72\x6f\x6d\x68\x65\x78")([n for n in ().__class__.__base__.__subclasses__() if "rni" in n.__name__ and n.__name__ == n.__name__.lower()][0]()._module.__builtins__.__getitem__("\x62\x79\x74\x65\x73"),"\x36\x39\x20\x36\x65\x20\x37\x30").decode()).__getitem__(37143^37127).__pow__(39).__eq__(698305725136602387487529275219403181042627701878718020159538228622689033147)]): 4 | print("Correct!") 5 | else: 6 | print("Wrong!") 7 | -------------------------------------------------------------------------------- /imaginaryCTF 2023/check.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env python3 2 | 3 | def enc(b): 4 | a = [n for n in range(b[0]*2**24+b[1]*2**16+b[2]*2**8+b[3]+1)][1:] 5 | c,i = 0,0 6 | while len([n for n in a if n != 0]) > 1: 7 | i%=len(a) 8 | if (a[i]!=0 and c==1): 9 | a[i],c=0,0 10 | if (a[i] != 0): 11 | c+=1 12 | i += 1 13 | return sum(a) 14 | 15 | print(r""" 16 | .----. @ @ 17 | / .-"-.`. \v/ 18 | | | '\ \ \_/ ) 19 | ,-\ `-.' /.' / 20 | '---`----'----' 21 | """) 22 | flag = input("Enter flag here: ").encode() 23 | out = b'' 24 | for n in [flag[i:i+4] for i in range(0,len(flag),4)]: 25 | out += bytes.fromhex(hex(enc(n[::-1]))[2:].zfill(8)) 26 | 27 | if out == b'L\xe8\xc6\xd2f\xde\xd4\xf6j\xd0\xe0\xcad\xe0\xbe\xe6J\xd8\xc4\xde`\xe6\xbe\xda>\xc8\xca\xca^\xde\xde\xc4^\xde\xde\xdez\xe8\xe6\xde': 28 | print("[*] Flag correct!") 29 | else: 30 | print("[*] Flag incorrect.") 31 | -------------------------------------------------------------------------------- /imaginaryCTF 2023/ictf.unfactored: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/FazeCT/ctf/ab8c160867ea0efb10bd2dd0091bf9b63f182fc5/imaginaryCTF 2023/ictf.unfactored -------------------------------------------------------------------------------- /imaginaryCTF 2023/main: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/FazeCT/ctf/ab8c160867ea0efb10bd2dd0091bf9b63f182fc5/imaginaryCTF 2023/main -------------------------------------------------------------------------------- /imaginaryCTF 2023/program: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/FazeCT/ctf/ab8c160867ea0efb10bd2dd0091bf9b63f182fc5/imaginaryCTF 2023/program -------------------------------------------------------------------------------- /imaginaryCTF 2023/sheepish.py: -------------------------------------------------------------------------------- 1 | print((((lambda _____________:((lambda ___:_____________(lambda _______:___(___)(_______)))(lambda ___:_____________(lambda _______:___(___)(_______)))))(lambda _____________:lambda ___________:lambda ______:(lambda ____:(lambda _:_(lambda __________:lambda _____:__________))(____))(___________)(lambda _:(lambda __________:lambda _____:__________))(lambda _:(lambda __________:lambda _____:__________(_____)(lambda __________:lambda _____:_____))((lambda __________:lambda _____:(lambda __________:lambda _____:__________(_____)(lambda __________:lambda _____:_____))((lambda __________:lambda _____:(lambda __________:__________(lambda _:(lambda __________:lambda _____:_____))(lambda __________:lambda _____:__________))((lambda __________:lambda _____:_____(lambda __:lambda _____________:lambda ___:__(lambda ____________:lambda _________:_________(____________(_____________)))(lambda _:___)(lambda __________:__________))(__________))(_____)(__________)))(__________)(_____))((lambda __________:lambda _____:(lambda __________:__________(lambda _:(lambda __________:lambda _____:_____))(lambda __________:lambda _____:__________))((lambda __________:lambda _____:_____(lambda __:lambda _____________:lambda ___:__(lambda ____________:lambda _________:_________(____________(_____________)))(lambda _:___)(lambda __________:__________))(__________))(__________)(_____)))(__________)(_____)))((lambda ____:(lambda _:_(lambda __________:lambda _____:__________))((lambda _:_(lambda __________:lambda _____:_____))(____)))(___________))((lambda ____:(lambda _:_(lambda __________:lambda _____:__________))((lambda _:_(lambda __________:lambda _____:_____))(____)))(______)))(_____________((lambda ____:(lambda _:_(lambda __________:lambda _____:_____))((lambda _:_(lambda __________:lambda _____:_____))(____)))(___________))((lambda ____:(lambda _:_(lambda __________:lambda _____:_____))((lambda _:_(lambda __________:lambda _____:_____))(____)))(______))))(lambda __________:lambda _____:__________)))((lambda ____:lambda ___:(lambda __________:lambda _____:lambda ______________:______________(__________)(_____))(lambda __________:lambda _____:_____)((lambda __________:lambda _____:lambda ______________:______________(__________)(_____))(___)(____)))((lambda ____:lambda ___:(lambda __________:lambda _____:lambda ______________:______________(__________)(_____))(lambda __________:lambda _____:_____)((lambda __________:lambda _____:lambda ______________:______________(__________)(_____))(___)(____)))((lambda ____:lambda ___:(lambda __________:lambda _____:lambda ______________:______________(__________)(_____))(lambda __________:lambda _____:_____)((lambda __________:lambda _____:lambda ______________:______________(__________)(_____))(___)(____)))((lambda ____:lambda ___:(lambda __________:lambda _____:lambda ______________:______________(__________)(_____))(lambda __________:lambda _____:_____)((lambda __________:lambda _____:lambda ______________:______________(__________)(_____))(___)(____)))((lambda ____:lambda ___:(lambda __________:lambda _____:lambda ______________:______________(__________)(_____))(lambda __________:lambda _____:_____)((lambda __________:lambda _____:lambda ______________:______________(__________)(_____))(___)(____)))((lambda ____:lambda ___:(lambda __________:lambda _____:lambda ______________:______________(__________)(_____))(lambda __________:lambda _____:_____)((lambda __________:lambda _____:lambda ______________:______________(__________)(_____))(___)(____)))((lambda ____:lambda ___:(lambda __________:lambda _____:lambda ______________:______________(__________)(_____))(lambda __________:lambda _____:_____)((lambda __________:lambda _____:lambda ______________:______________(__________)(_____))(___)(____)))((lambda ____:lambda ___:(lambda __________:lambda _____:lambda ______________:______________(__________)(_____))(lambda __________:lambda _____:_____)((lambda __________:lambda _____:lambda ______________:______________(__________)(_____))(___)(____)))((lambda ____:lambda ___:(lambda __________:lambda _____:lambda ______________:______________(__________)(_____))(lambda __________:lambda _____:_____)((lambda __________:lambda _____:lambda ______________:______________(__________)(_____))(___)(____)))((lambda ____:lambda ___:(lambda __________:lambda _____:lambda ______________:______________(__________)(_____))(lambda __________:lambda _____:_____)((lambda __________:lambda _____:lambda ______________:______________(__________)(_____))(___)(____)))((lambda ____:lambda ___:(lambda __________:lambda _____:lambda ______________:______________(__________)(_____))(lambda __________:lambda _____:_____)((lambda __________:lambda _____:lambda ______________:______________(__________)(_____))(___)(____)))((lambda ____:lambda ___:(lambda __________:lambda _____:lambda ______________:______________(__________)(_____))(lambda __________:lambda _____:_____)((lambda __________:lambda _____:lambda ______________:______________(__________)(_____))(___)(____)))((lambda ____:lambda ___:(lambda __________:lambda _____:lambda ______________:______________(__________)(_____))(lambda __________:lambda _____:_____)((lambda __________:lambda _____:lambda ______________:______________(__________)(_____))(___)(____)))((lambda ____:lambda ___:(lambda __________:lambda _____:lambda ______________:______________(__________)(_____))(lambda __________:lambda _____:_____)((lambda __________:lambda _____:lambda ______________:______________(__________)(_____))(___)(____)))((lambda ____:lambda ___:(lambda __________:lambda _____:lambda ______________:______________(__________)(_____))(lambda __________:lambda _____:_____)((lambda __________:lambda _____:lambda ______________:______________(__________)(_____))(___)(____)))((lambda ____:lambda ___:(lambda __________:lambda _____:lambda ______________:______________(__________)(_____))(lambda __________:lambda _____:_____)((lambda __________:lambda _____:lambda ______________:______________(__________)(_____))(___)(____)))((lambda ____:lambda ___:(lambda __________:lambda _____:lambda ______________:______________(__________)(_____))(lambda __________:lambda _____:_____)((lambda __________:lambda _____:lambda ______________:______________(__________)(_____))(___)(____)))((lambda ____:lambda ___:(lambda __________:lambda _____:lambda ______________:______________(__________)(_____))(lambda __________:lambda _____:_____)((lambda __________:lambda _____:lambda ______________:______________(__________)(_____))(___)(____)))((lambda ____:lambda ___:(lambda __________:lambda _____:lambda ______________:______________(__________)(_____))(lambda __________:lambda _____:_____)((lambda __________:lambda _____:lambda ______________:______________(__________)(_____))(___)(____)))((lambda ____:lambda ___:(lambda __________:lambda _____:lambda ______________:______________(__________)(_____))(lambda __________:lambda _____:_____)((lambda __________:lambda _____:lambda ______________:______________(__________)(_____))(___)(____)))((lambda __________:lambda _____:lambda ______________:______________(__________)(_____))(lambda __________:lambda _____:__________)(lambda __________:lambda _____:__________))((lambda __________:lambda _____:__________(lambda __:lambda __________:lambda _____:__________(__(__________)(_____)))(_____))((lambda __________:lambda _____:lambda ______________:__________(_____(______________)))((lambda __________:lambda _____:_____(__________))(lambda __________:lambda _____:__________(__________(_____)))((lambda __:lambda __________:lambda _____:__________(__(__________)(_____)))(lambda __________:lambda _____:__________(__________(__________(_____))))))((lambda __:lambda __________:lambda _____:__________(__(__________)(_____)))((lambda __________:lambda _____:lambda ______________:__________(_____(______________)))(lambda __________:lambda _____:__________(__________(_____)))(lambda __________:lambda _____:__________(__________(__________(_____)))))))((lambda __________:lambda _____:__________(lambda __:lambda __________:lambda _____:__________(__(__________)(_____)))(_____))((lambda __________:lambda _____:lambda ______________:__________(_____(______________)))(lambda __________:lambda _____:__________(__________(_____)))(lambda __________:lambda _____:__________(__________(__________(_____)))))((lambda __:lambda __________:lambda _____:__________(__(__________)(_____)))((lambda __________:lambda _____:lambda ______________:__________(_____(______________)))(lambda __________:lambda _____:__________(__________(_____)))(lambda __________:lambda _____:__________(__________(__________(_____)))))))))((lambda __________:lambda _____:__________(lambda __:lambda __________:lambda _____:__________(__(__________)(_____)))(_____))((lambda __________:lambda _____:lambda ______________:__________(_____(______________)))((lambda __________:lambda _____:_____(__________))(lambda __________:lambda _____:__________(__________(_____)))((lambda __:lambda __________:lambda _____:__________(__(__________)(_____)))(lambda __________:lambda _____:__________(__________(__________(_____))))))(lambda __________:lambda _____:__________(__________(__________(_____)))))((lambda __________:lambda _____:lambda ______________:__________(_____(______________)))((lambda __________:lambda _____:__________(lambda __:lambda __________:lambda _____:__________(__(__________)(_____)))(_____))(lambda __________:lambda _____:__________(__________(_____)))(lambda __________:lambda _____:__________(__________(__________(_____)))))(lambda __________:lambda _____:__________(__________(__________(_____)))))))((lambda __________:lambda _____:__________(lambda __:lambda __________:lambda _____:__________(__(__________)(_____)))(_____))((lambda __________:lambda _____:lambda ______________:__________(_____(______________)))((lambda __________:lambda _____:_____(__________))(lambda __________:lambda _____:__________(__________(_____)))((lambda __:lambda __________:lambda _____:__________(__(__________)(_____)))(lambda __________:lambda _____:__________(__________(__________(_____))))))((lambda __:lambda __________:lambda _____:__________(__(__________)(_____)))(lambda __________:lambda _____:__________(__________(__________(_____))))))(lambda __________:lambda _____:_____)))((lambda __________:lambda _____:__________(lambda __:lambda __________:lambda _____:__________(__(__________)(_____)))(_____))((lambda __________:lambda _____:lambda ______________:__________(_____(______________)))((lambda __________:lambda _____:_____(__________))(lambda __________:lambda _____:__________(__________(_____)))((lambda __:lambda __________:lambda _____:__________(__(__________)(_____)))(lambda __________:lambda _____:__________(__________(__________(_____))))))((lambda __:lambda __________:lambda _____:__________(__(__________)(_____)))(lambda __________:lambda _____:__________(__________(__________(_____))))))(lambda __________:lambda _____:_____)))((lambda __________:lambda _____:__________(lambda __:lambda __________:lambda _____:__________(__(__________)(_____)))(_____))((lambda __________:lambda _____:lambda ______________:__________(_____(______________)))((lambda __________:lambda _____:_____(__________))(lambda __________:lambda _____:__________(__________(_____)))((lambda __:lambda __________:lambda _____:__________(__(__________)(_____)))(lambda __________:lambda _____:__________(__________(__________(_____))))))((lambda __:lambda __________:lambda _____:__________(__(__________)(_____)))(lambda __________:lambda _____:__________(__________(__________(_____))))))(lambda __________:lambda _____:_____)))((lambda __________:lambda _____:__________(lambda __:lambda __________:lambda _____:__________(__(__________)(_____)))(_____))((lambda __________:lambda _____:lambda ______________:__________(_____(______________)))((lambda __________:lambda _____:_____(__________))(lambda __________:lambda _____:__________(__________(_____)))((lambda __:lambda __________:lambda _____:__________(__(__________)(_____)))(lambda __________:lambda _____:__________(__________(__________(_____))))))((lambda __________:lambda _____:lambda ______________:__________(_____(______________)))(lambda __________:lambda _____:__________(__________(_____)))(lambda __________:lambda _____:__________(__________(__________(_____))))))(lambda __________:lambda _____:__________(__________(_____)))))((lambda __________:lambda _____:__________(lambda __:lambda __________:lambda _____:__________(__(__________)(_____)))(_____))((lambda __________:lambda _____:lambda ______________:__________(_____(______________)))((lambda __________:lambda _____:_____(__________))(lambda __________:lambda _____:__________(__________(_____)))((lambda __:lambda __________:lambda _____:__________(__(__________)(_____)))(lambda __________:lambda _____:__________(__________(__________(_____))))))((lambda __________:lambda _____:__________(lambda __:lambda __________:lambda _____:__________(__(__________)(_____)))(_____))(lambda __________:lambda _____:__________(__________(_____)))(lambda __________:lambda _____:__________(__________(__________(_____))))))((lambda __________:lambda _____:lambda ______________:__________(_____(______________)))((lambda __________:lambda _____:__________(lambda __:lambda __________:lambda _____:__________(__(__________)(_____)))(_____))(lambda __________:lambda _____:__________(__________(_____)))(lambda __________:lambda _____:__________(__________(__________(_____)))))(lambda __________:lambda _____:__________(__________(__________(_____)))))))((lambda __________:lambda _____:__________(lambda __:lambda __________:lambda _____:__________(__(__________)(_____)))(_____))((lambda __________:lambda _____:lambda ______________:__________(_____(______________)))((lambda __________:lambda _____:_____(__________))(lambda __________:lambda _____:__________(__________(_____)))((lambda __:lambda __________:lambda _____:__________(__(__________)(_____)))(lambda __________:lambda _____:__________(__________(__________(_____))))))((lambda __:lambda __________:lambda _____:__________(__(__________)(_____)))((lambda __________:lambda _____:lambda ______________:__________(_____(______________)))(lambda __________:lambda _____:__________(__________(_____)))(lambda __________:lambda _____:__________(__________(__________(_____)))))))(lambda __________:lambda _____:_____)))((lambda __________:lambda _____:__________(lambda __:lambda __________:lambda _____:__________(__(__________)(_____)))(_____))((lambda __________:lambda _____:lambda ______________:__________(_____(______________)))((lambda __________:lambda _____:_____(__________))(lambda __________:lambda _____:__________(__________(_____)))((lambda __:lambda __________:lambda _____:__________(__(__________)(_____)))(lambda __________:lambda _____:__________(__________(__________(_____))))))(lambda __________:lambda _____:__________(__________(__________(_____)))))(lambda __________:lambda _____:__________(__________(__________(_____))))))((lambda __________:lambda _____:__________(lambda __:lambda __________:lambda _____:__________(__(__________)(_____)))(_____))((lambda __________:lambda _____:lambda ______________:__________(_____(______________)))((lambda __________:lambda _____:_____(__________))(lambda __________:lambda _____:__________(__________(_____)))((lambda __:lambda __________:lambda _____:__________(__(__________)(_____)))(lambda __________:lambda _____:__________(__________(__________(_____))))))(lambda __________:lambda _____:__________(__________(__________(_____)))))(lambda __________:lambda _____:__________(__________(__________(_____))))))((lambda __________:lambda _____:__________(lambda __:lambda __________:lambda _____:__________(__(__________)(_____)))(_____))((lambda __________:lambda _____:lambda ______________:__________(_____(______________)))((lambda __________:lambda _____:_____(__________))(lambda __________:lambda _____:__________(__________(_____)))((lambda __:lambda __________:lambda _____:__________(__(__________)(_____)))(lambda __________:lambda _____:__________(__________(__________(_____))))))((lambda __________:lambda _____:lambda ______________:__________(_____(______________)))(lambda __________:lambda _____:__________(__________(_____)))(lambda __________:lambda _____:__________(__________(__________(_____))))))((lambda __________:lambda _____:lambda ______________:__________(_____(______________)))((lambda __:lambda __________:lambda _____:__________(__(__________)(_____)))(lambda __________:lambda _____:__________(__________(__________(_____)))))(lambda __________:lambda _____:__________(__________(_____))))))((lambda __________:lambda _____:__________(lambda __:lambda __________:lambda _____:__________(__(__________)(_____)))(_____))((lambda __________:lambda _____:lambda ______________:__________(_____(______________)))((lambda __________:lambda _____:_____(__________))(lambda __________:lambda _____:__________(__________(_____)))((lambda __:lambda __________:lambda _____:__________(__(__________)(_____)))(lambda __________:lambda _____:__________(__________(__________(_____))))))((lambda __:lambda __________:lambda _____:__________(__(__________)(_____)))((lambda __________:lambda _____:lambda ______________:__________(_____(______________)))(lambda __________:lambda _____:__________(__________(_____)))(lambda __________:lambda _____:__________(__________(__________(_____)))))))(lambda __________:lambda _____:__________(__________(__________(_____))))))((lambda __________:lambda _____:__________(lambda __:lambda __________:lambda _____:__________(__(__________)(_____)))(_____))((lambda __________:lambda _____:lambda ______________:__________(_____(______________)))((lambda __________:lambda _____:_____(__________))(lambda __________:lambda _____:__________(__________(_____)))((lambda __:lambda __________:lambda _____:__________(__(__________)(_____)))(lambda __________:lambda _____:__________(__________(__________(_____))))))((lambda __________:lambda _____:__________(lambda __:lambda __________:lambda _____:__________(__(__________)(_____)))(_____))(lambda __________:lambda _____:__________(__________(_____)))(lambda __________:lambda _____:__________(__________(__________(_____))))))((lambda __________:lambda _____:lambda ______________:__________(_____(______________)))((lambda __________:lambda _____:__________(lambda __:lambda __________:lambda _____:__________(__(__________)(_____)))(_____))(lambda __________:lambda _____:__________(__________(_____)))(lambda __________:lambda _____:__________(__________(__________(_____)))))(lambda __________:lambda _____:__________(__________(__________(_____)))))))((lambda __________:lambda _____:__________(lambda __:lambda __________:lambda _____:__________(__(__________)(_____)))(_____))((lambda __________:lambda _____:lambda ______________:__________(_____(______________)))((lambda __________:lambda _____:_____(__________))(lambda __________:lambda _____:__________(__________(_____)))((lambda __:lambda __________:lambda _____:__________(__(__________)(_____)))(lambda __________:lambda _____:__________(__________(__________(_____))))))(lambda __________:lambda _____:__________(__________(__________(_____)))))(lambda __________:lambda _____:_____)))((lambda __________:lambda _____:__________(lambda __:lambda __________:lambda _____:__________(__(__________)(_____)))(_____))((lambda __________:lambda _____:lambda ______________:__________(_____(______________)))((lambda __________:lambda _____:_____(__________))(lambda __________:lambda _____:__________(__________(_____)))((lambda __:lambda __________:lambda _____:__________(__(__________)(_____)))(lambda __________:lambda _____:__________(__________(__________(_____))))))((lambda __________:lambda _____:lambda ______________:__________(_____(______________)))(lambda __________:lambda _____:__________(__________(_____)))(lambda __________:lambda _____:__________(__________(__________(_____))))))((lambda __:lambda __________:lambda _____:__________(__(__________)(_____)))(lambda __________:lambda _____:__________(__________(__________(_____)))))))((lambda __________:lambda _____:__________(lambda __:lambda __________:lambda _____:__________(__(__________)(_____)))(_____))((lambda __________:lambda _____:lambda ______________:__________(_____(______________)))((lambda __________:lambda _____:_____(__________))(lambda __________:lambda _____:__________(__________(_____)))((lambda __:lambda __________:lambda _____:__________(__(__________)(_____)))(lambda __________:lambda _____:__________(__________(__________(_____))))))((lambda __:lambda __________:lambda _____:__________(__(__________)(_____)))((lambda __________:lambda _____:lambda ______________:__________(_____(______________)))(lambda __________:lambda _____:__________(__________(_____)))(lambda __________:lambda _____:__________(__________(__________(_____)))))))((lambda __________:lambda _____:__________(lambda __:lambda __________:lambda _____:__________(__(__________)(_____)))(_____))((lambda __:lambda __________:lambda _____:__________(__(__________)(_____)))((lambda __________:lambda _____:lambda ______________:__________(_____(______________)))(lambda __________:lambda _____:__________(__________(_____)))(lambda __________:lambda _____:__________(__________(__________(_____))))))((lambda __:lambda __________:lambda _____:__________(__(__________)(_____)))(lambda __________:lambda _____:__________(__________(__________(_____))))))))((lambda __________:lambda _____:__________(lambda __:lambda __________:lambda _____:__________(__(__________)(_____)))(_____))((lambda __________:lambda _____:lambda ______________:__________(_____(______________)))((lambda __________:lambda _____:_____(__________))(lambda __________:lambda _____:__________(__________(_____)))((lambda __:lambda __________:lambda _____:__________(__(__________)(_____)))(lambda __________:lambda _____:__________(__________(__________(_____))))))((lambda __________:lambda _____:lambda ______________:__________(_____(______________)))(lambda __________:lambda _____:__________(__________(_____)))(lambda __________:lambda _____:__________(__________(__________(_____))))))((lambda __________:lambda _____:lambda ______________:__________(_____(______________)))(lambda __________:lambda _____:__________(__________(_____)))(lambda __________:lambda _____:__________(__________(__________(_____)))))))((lambda __________:lambda _____:__________(lambda __:lambda __________:lambda _____:__________(__(__________)(_____)))(_____))((lambda __________:lambda _____:lambda ______________:__________(_____(______________)))((lambda __________:lambda _____:_____(__________))(lambda __________:lambda _____:__________(__________(_____)))((lambda __:lambda __________:lambda _____:__________(__(__________)(_____)))(lambda __________:lambda _____:__________(__________(__________(_____))))))((lambda __:lambda __________:lambda _____:__________(__(__________)(_____)))((lambda __________:lambda _____:lambda ______________:__________(_____(______________)))(lambda __________:lambda _____:__________(__________(_____)))(lambda __________:lambda _____:__________(__________(__________(_____)))))))((lambda __:lambda __________:lambda _____:__________(__(__________)(_____)))(lambda __________:lambda _____:__________(__________(__________(_____)))))))((lambda __________:lambda _____:__________(lambda __:lambda __________:lambda _____:__________(__(__________)(_____)))(_____))((lambda __________:lambda _____:lambda ______________:__________(_____(______________)))((lambda __________:lambda _____:_____(__________))(lambda __________:lambda _____:__________(__________(_____)))((lambda __:lambda __________:lambda _____:__________(__(__________)(_____)))(lambda __________:lambda _____:__________(__________(__________(_____))))))((lambda __________:lambda _____:lambda ______________:__________(_____(______________)))(lambda __________:lambda _____:__________(__________(_____)))(lambda __________:lambda _____:__________(__________(__________(_____))))))(lambda __________:lambda _____:__________(__________(__________(_____))))))((lambda __________:lambda _____:__________(lambda __:lambda __________:lambda _____:__________(__(__________)(_____)))(_____))((lambda __________:lambda _____:lambda ______________:__________(_____(______________)))((lambda __________:lambda _____:_____(__________))(lambda __________:lambda _____:__________(__________(_____)))((lambda __:lambda __________:lambda _____:__________(__(__________)(_____)))(lambda __________:lambda _____:__________(__________(__________(_____))))))((lambda __________:lambda _____:lambda ______________:__________(_____(______________)))(lambda __________:lambda _____:__________(__________(_____)))(lambda __________:lambda _____:__________(__________(__________(_____))))))((lambda __________:lambda _____:_____(__________))(lambda __________:lambda _____:__________(__________(__________(_____))))(lambda __________:lambda _____:__________(__________(_____))))))(((lambda _____________:((lambda ___:_____________(lambda _______:___(___)(_______)))(lambda ___:_____________(lambda _______:___(___)(_______)))))(lambda _____________:(lambda ________:(((lambda ____:lambda ___:(lambda __________:lambda _____:lambda ______________:______________(__________)(_____))(lambda __________:lambda _____:_____)((lambda __________:lambda _____:lambda ______________:______________(__________)(_____))(___)(____)))(_____________(________[1:]))(((lambda _____________:((lambda ___:_____________(lambda _______:___(___)(_______)))(lambda ___:_____________(lambda _______:___(___)(_______)))))(lambda _____________:(lambda __:(((lambda __:lambda __________:lambda _____:__________(__(__________)(_____)))(_____________(__-1))) if __ else (lambda __________:lambda _____:_____)))))(________[0]))) if len(________) else ((lambda __________:lambda _____:lambda ______________:______________(__________)(_____))(lambda __________:lambda _____:__________)(lambda __________:lambda _____:__________))))))(input(">>> ").encode())))("Well done!")("Try again...")) -------------------------------------------------------------------------------- /imaginaryCTF 2023/ts.ts: -------------------------------------------------------------------------------- 1 | /** 2 | * Change the flag below until it compiles correctly on TypeScript 5.1.6 :) 3 | */ 4 | const flag = '______________________________________________________________' 5 | /* Do not change anything below */ 6 | type UfMzhXneJMxLGLEU = 'eZ!gjyTdSLcJ3{!Y_pTcMqW7qu{cMoyb04JXFHUaXx{8gTCIwIGE-AAWb1_wu32{' 7 | type WhzQNnyJjDsKWyxC = 'HuuMKaxLVHVqC6NSB1Rwl2WC1F7zkxxrxAuZFpPogbBd4LGGgBfK9!eUaaSIuqJK' 8 | type PTaaOqBorswiazoI = '0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ{_-!}' 9 | type mkIyPGrircFSBTcN = 8 10 | type dGJEEVttmoAPpOAN = 67 11 | type mRYJgulPMUCesDht< 12 | IMGccnTsvjUQLwrf extends string, 13 | DeCQhpqVREGeRhnA extends string[] = [] 14 | > = IMGccnTsvjUQLwrf extends `${infer head}${infer rest}` 15 | ? mRYJgulPMUCesDht 16 | : DeCQhpqVREGeRhnA 17 | type itHZcYyBjnhJWiYP< 18 | pmdPNolgYxglUHyx extends string[], 19 | BQNzTQZfrJYoMzZV extends number[] = [], 20 | TkUOlgwCjrqLMqJJ = {} 21 | > = BQNzTQZfrJYoMzZV['length'] extends pmdPNolgYxglUHyx['length'] 22 | ? TkUOlgwCjrqLMqJJ 23 | : itHZcYyBjnhJWiYP< 24 | pmdPNolgYxglUHyx, 25 | [...BQNzTQZfrJYoMzZV, any], 26 | TkUOlgwCjrqLMqJJ & { 27 | [_ in pmdPNolgYxglUHyx[BQNzTQZfrJYoMzZV['length']]]: BQNzTQZfrJYoMzZV['length'] 28 | } 29 | > 30 | type iiFcDFSKUxThWRKY = itHZcYyBjnhJWiYP> 31 | type nGWbztcLxfIfhBVp< 32 | jBtqUiSUoRoNsKbN extends { 33 | [k in string]: number 34 | }, 35 | kjEFIDfZbBUWfQDK extends (keyof jBtqUiSUoRoNsKbN)[], 36 | BjZKAxdRVmfjgXma extends number[] = [] 37 | > = BjZKAxdRVmfjgXma['length'] extends kjEFIDfZbBUWfQDK['length'] 38 | ? BjZKAxdRVmfjgXma 39 | : nGWbztcLxfIfhBVp< 40 | jBtqUiSUoRoNsKbN, 41 | kjEFIDfZbBUWfQDK, 42 | [...BjZKAxdRVmfjgXma, jBtqUiSUoRoNsKbN[kjEFIDfZbBUWfQDK[BjZKAxdRVmfjgXma['length']]]] 43 | > 44 | type ozvfWBVZaDHpRmwv = (() => T extends ehAViMhMvaHgpnyf ? 1 : 2) extends < 45 | T 46 | >() => T extends DLFoWEPElDAydhoh ? 1 : 2 47 | ? true 48 | : false 49 | type cFTwHJlaNLUidmbU = QjZYcNISkUIPleAj[0] 50 | type vHbSPTAtgxnHjiGT = [any, ...BEQYeYFiitEfVaco][BEQYeYFiitEfVaco['length']] 51 | type OzJOdJrhEGbsCPUc< 52 | kgZLOXOFncQCkPjp extends unknown[], 53 | HhkTgnzLBfGczWPO extends number, 54 | eBCAQjxoeKZLOxyu extends unknown[] = [] 55 | > = eBCAQjxoeKZLOxyu['length'] extends HhkTgnzLBfGczWPO 56 | ? eBCAQjxoeKZLOxyu 57 | : OzJOdJrhEGbsCPUc< 58 | kgZLOXOFncQCkPjp, 59 | HhkTgnzLBfGczWPO, 60 | [...eBCAQjxoeKZLOxyu, kgZLOXOFncQCkPjp[eBCAQjxoeKZLOxyu['length']]] 61 | > 62 | type awbCxBeAysbLgqmY< 63 | QRfOcXtdwaJxcVmW extends unknown[], 64 | BrJPlsgOrMXoujsc extends number, 65 | ZNcEIwAnyRFRSfgy extends unknown[] = [] 66 | > = ZNcEIwAnyRFRSfgy['length'] extends BrJPlsgOrMXoujsc 67 | ? ZNcEIwAnyRFRSfgy 68 | : awbCxBeAysbLgqmY< 69 | QRfOcXtdwaJxcVmW, 70 | BrJPlsgOrMXoujsc, 71 | [[...ZNcEIwAnyRFRSfgy, any, ...QRfOcXtdwaJxcVmW][QRfOcXtdwaJxcVmW['length']], ...ZNcEIwAnyRFRSfgy] 72 | > 73 | type mDZrKsdAzdETRPHd = [ 74 | vHbSPTAtgxnHjiGT, 75 | ...OzJOdJrhEGbsCPUc 76 | ] 77 | type yhWKIpZaWwaBMLwX = [ 78 | ...awbCxBeAysbLgqmY, 79 | cFTwHJlaNLUidmbU 80 | ] 81 | type otztzlVJHDvjsfPu< 82 | uBdxhwacrRHWgpMQ extends number, 83 | fTZiKZGTXNWUpRBg extends unknown[] = [] 84 | > = uBdxhwacrRHWgpMQ extends fTZiKZGTXNWUpRBg['length'] 85 | ? fTZiKZGTXNWUpRBg 86 | : otztzlVJHDvjsfPu 87 | type heMRZHsxnppbrDuK< 88 | bVJbiyLabCOwLRXr, 89 | XBIzKSKknFDmbNnV extends unknown[] = [], 90 | PSjZkmgMDtZqebJd = {} 91 | > = XBIzKSKknFDmbNnV['length'] extends bVJbiyLabCOwLRXr 92 | ? PSjZkmgMDtZqebJd 93 | : heMRZHsxnppbrDuK< 94 | bVJbiyLabCOwLRXr, 95 | [...XBIzKSKknFDmbNnV, any], 96 | PSjZkmgMDtZqebJd & { 97 | [_ in XBIzKSKknFDmbNnV['length']]: unknown 98 | } 99 | > 100 | // @ts-ignore 101 | type NEnOUqglsCrqzjyt = [any, ...otztzlVJHDvjsfPu][fvMQKzvNrsfxdxCB] 102 | type VGMeBpMFMpFRwaMu = otztzlVJHDvjsfPu 103 | type pCjUTYFvoqDGoUOv = yhWKIpZaWwaBMLwX> 104 | type dcmdpAZbcGEvKfuH = mDZrKsdAzdETRPHd> 105 | type upsrRLshcdvzXpoE = UlrjGJKApDlutLtl extends 0 106 | ? ZrThpoGFxMrHKQpo 107 | : upsrRLshcdvzXpoE 108 | type yikKWBFFXiBLeCXn< 109 | WTritGxPQRfUOtWz extends number, 110 | gGUjKjFsxmouUtKQ extends number, 111 | yfRcrgtxYXROWEln extends number = 0 112 | > = gGUjKjFsxmouUtKQ extends 0 113 | ? yfRcrgtxYXROWEln 114 | : yikKWBFFXiBLeCXn< 115 | WTritGxPQRfUOtWz, 116 | dcmdpAZbcGEvKfuH[gGUjKjFsxmouUtKQ], 117 | upsrRLshcdvzXpoE 118 | > 119 | type RvStwhjakTfnrhsu< 120 | HWGVTYOJZpBmTLjx extends unknown[], 121 | VPuenbVMWvaIFqfG extends number = mkIyPGrircFSBTcN, 122 | dGJEEVttmoAPpOAN extends number = mkIyPGrircFSBTcN, 123 | uLkxRrueriHkRRrr extends unknown[][] = [], 124 | oHOIJtKGmbhoJvkA extends unknown[] = [], 125 | vRRmWHFnetuznOxN extends unknown[] = [] 126 | > = uLkxRrueriHkRRrr['length'] extends VPuenbVMWvaIFqfG 127 | ? uLkxRrueriHkRRrr 128 | : oHOIJtKGmbhoJvkA['length'] extends dGJEEVttmoAPpOAN 129 | ? RvStwhjakTfnrhsu< 130 | HWGVTYOJZpBmTLjx, 131 | VPuenbVMWvaIFqfG, 132 | dGJEEVttmoAPpOAN, 133 | [...uLkxRrueriHkRRrr, oHOIJtKGmbhoJvkA], 134 | [], 135 | vRRmWHFnetuznOxN 136 | > 137 | : RvStwhjakTfnrhsu< 138 | HWGVTYOJZpBmTLjx, 139 | VPuenbVMWvaIFqfG, 140 | dGJEEVttmoAPpOAN, 141 | uLkxRrueriHkRRrr, 142 | [...oHOIJtKGmbhoJvkA, HWGVTYOJZpBmTLjx[vRRmWHFnetuznOxN['length']]], 143 | [...vRRmWHFnetuznOxN, any] 144 | > 145 | type QQPUXWDcCREqQrlf = { 146 | [i in keyof heMRZHsxnppbrDuK]: { 147 | [j in keyof heMRZHsxnppbrDuK]: NqisJnGOjKSSeBPz 148 | } 149 | } 150 | type nYQyaQTkVVtEqdEn< 151 | YRWtcUUovuCgOgPd extends ArrayLike, 152 | MSnUotlTasJajgpJ extends number = 0, 153 | onIvRCYCcFeXeafa extends unknown[] = [] 154 | > = onIvRCYCcFeXeafa['length'] extends YRWtcUUovuCgOgPd['length'] 155 | ? MSnUotlTasJajgpJ 156 | : nYQyaQTkVVtEqdEn< 157 | YRWtcUUovuCgOgPd, 158 | upsrRLshcdvzXpoE, 159 | [...onIvRCYCcFeXeafa, any] 160 | > 161 | type IzaaMhORtxCvgQNj< 162 | uOINRhtbXbrGdyBu extends QQPUXWDcCREqQrlf, 163 | MzVSwBihrIpNZsoP extends QQPUXWDcCREqQrlf, 164 | NveVZtruTxmwCpqe extends number = mkIyPGrircFSBTcN, 165 | RAqxYxTXFfWDxlBm extends number = mkIyPGrircFSBTcN, 166 | CNAtqPJppnykIezq extends number = mkIyPGrircFSBTcN 167 | > = { 168 | [i in keyof heMRZHsxnppbrDuK]: { 169 | [k in keyof heMRZHsxnppbrDuK]: nYQyaQTkVVtEqdEn< 170 | { 171 | [j in keyof heMRZHsxnppbrDuK]: yikKWBFFXiBLeCXn< 172 | uOINRhtbXbrGdyBu[i][j], 173 | MzVSwBihrIpNZsoP[j][k] 174 | > 175 | } & { 176 | length: RAqxYxTXFfWDxlBm 177 | } 178 | > 179 | } 180 | } 181 | type XtJReCPPCAjRCUxq = RvStwhjakTfnrhsu< 182 | nGWbztcLxfIfhBVp> 183 | > 184 | type ehAViMhMvaHgpnyf = XtJReCPPCAjRCUxq 185 | function isTheFlagCorrect( 186 | good: ozvfWBVZaDHpRmwv< 187 | IzaaMhORtxCvgQNj, ehAViMhMvaHgpnyf>, 188 | IzaaMhORtxCvgQNj> 189 | >, 190 | flag: string 191 | ) { 192 | if (/^ictf{.{56}}$/.test(flag) && good) { 193 | console.log('Correct, the flag is', flag) 194 | } else { 195 | console.log('Wrong!') 196 | } 197 | } 198 | isTheFlagCorrect(true, flag) 199 | -------------------------------------------------------------------------------- /imaginaryCTF 2023/vm: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/FazeCT/ctf/ab8c160867ea0efb10bd2dd0091bf9b63f182fc5/imaginaryCTF 2023/vm -------------------------------------------------------------------------------- /objdump/README.md: -------------------------------------------------------------------------------- 1 | ## GNU binutils 2.43 - objdump 2 | 3 | **Exploit technique:** https://vuldb.com/?submit.545773 4 | 5 | **Bug(s):** 6 | - **CVE-2025-3198:** A vulnerability has been found in GNU Binutils 2.43/2.44 and classified as problematic. Affected by this vulnerability is the function display_info of the file binutils/bucomm.c of the component objdump. The manipulation leads to memory leak. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The patch is named ba6ad3a18cb26b79e0e3b84c39f707535bbc344d. It is recommended to apply a patch to fix this issue. 7 | -------------------------------------------------------------------------------- /objdump/exploit.md: -------------------------------------------------------------------------------- 1 | ## Environment 2 | 3 | - Ubuntu 18.04 4 | - GCC 7.5 5 | 6 | ## Build and run objdump 7 | 8 | ``` 9 | git clone https://github.com/bminor/binutils-gdb.git 10 | 11 | cd binutils-gdb/ 12 | 13 | git checkout e8e7cf2abe04d5691eb8e31cd18589ec9eb78635 14 | 15 | mkdir build && cd build 16 | 17 | CC=gcc CFLAGS="-g -O0 " ../configure --disable-nls --disable-largefile --disable-gdb --disable-sim --disable-readline --disable-libdecnumber --disable-libquadmath --disable-libstdcxx --disable-ld --disable-gprof --disable-gas --disable-intl --disable-etc 18 | 19 | make 20 | 21 | sudo apt install valgrind 22 | 23 | valgrind --tool=memcheck --leak-check=yes --show-reachable=yes --num-callers=20 --track-fds=yes ./objdump -a -Zi - 24 | ``` -------------------------------------------------------------------------------- /objdump/objdump: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/FazeCT/ctf/ab8c160867ea0efb10bd2dd0091bf9b63f182fc5/objdump/objdump -------------------------------------------------------------------------------- /objdump/objdump_patch.c: -------------------------------------------------------------------------------- 1 | #include 2 | 3 | enum { BFD_ARCH_LAST = 0x57, BFD_ARCH_OBSCURE = 0x1 }; 4 | 5 | struct display_target { 6 | char *filename; 7 | int error; 8 | int count; 9 | size_t alloc; 10 | struct { 11 | const char *name; 12 | unsigned char arch[BFD_ARCH_LAST - BFD_ARCH_OBSCURE - 1]; 13 | } *info; 14 | }; 15 | 16 | const char ref_0x231930_gnu_binutils_version[]; 17 | const char ref_0x231950_bfd_version[]; 18 | 19 | void ref_0xB7AB7_display_target_list(struct display_target *arg) {}; 20 | void ref_0xB7CEB_display_target_tables(const struct display_target *arg) {}; 21 | 22 | int fix_0xB7E74_display_info() { 23 | struct display_target arg; 24 | 25 | printf(ref_0x231950_bfd_version, ref_0x231930_gnu_binutils_version); 26 | 27 | ref_0xB7AB7_display_target_list(&arg); 28 | if (!arg.error) 29 | ref_0xB7CEB_display_target_tables(&arg); 30 | 31 | // Add free to avoid memory leak 32 | free(arg.info); 33 | return arg.error; 34 | } 35 | -------------------------------------------------------------------------------- /objdump/objdump_patched: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/FazeCT/ctf/ab8c160867ea0efb10bd2dd0091bf9b63f182fc5/objdump/objdump_patched -------------------------------------------------------------------------------- /picoCTF/1_wanna_b3_a_r0ck5tar.py: -------------------------------------------------------------------------------- 1 | #Made by FazeCT: 2 | 3 | #Source code in Python 3: 4 | 5 | Rocknroll = True 6 | Silence = False 7 | a_guitar = 10 8 | Tommy = 44 9 | Music = 170 10 | the_music = int(input()) 11 | if the_music == a_guitar: 12 | print("Keep on rocking!") 13 | the_rhythm = int(input()) 14 | if the_rhythm - Music == False: 15 | Tommy = 66 16 | print(Tommy) 17 | Music = 79 18 | Jamming = 78 19 | print(Music) 20 | print(Jamming) 21 | Tommy = 74 22 | print(Tommy) 23 | #They are dazzled audiences 24 | print(it) 25 | Rock = 86 26 | print(it) 27 | Tommy = 73 28 | print(it) 29 | print("Bring on the rock!") 30 | else: 31 | print("That ain't it, Chief") 32 | -------------------------------------------------------------------------------- /picoCTF/New Caesar.py: -------------------------------------------------------------------------------- 1 | #Made by FazeCT 2 | 3 | import string 4 | 5 | LOWERCASE_OFFSET = ord("a") 6 | ALPHABET = string.ascii_lowercase[:16] 7 | 8 | def unshift(c, k): 9 | t1 = ord(c) - LOWERCASE_OFFSET 10 | t2 = ord(k) - LOWERCASE_OFFSET 11 | return ALPHABET[(t2+10*len(ALPHABET)-t1) % len(ALPHABET)] 12 | 13 | data = "mlnklfnknljflfjljnjijjmmjkmljnjhmhjgjnjjjmmkjjmijhmkjhjpmkmkmljkjijnjpmhmjjgjj" 14 | 15 | for j in range(len(ALPHABET)): 16 | key = ALPHABET[j] 17 | flag = "" 18 | for i in range(len(data)): 19 | flag += unshift(key[i%len(key)],data[i]) 20 | realflag="" 21 | for i in range(0,len(flag),2): 22 | n1 = ord(flag[i]) - LOWERCASE_OFFSET 23 | n2 = ord(flag[i+1]) - LOWERCASE_OFFSET 24 | binary = bin(n1)[2:].zfill(4) + bin(n2)[2:].zfill(4) 25 | realflag += chr(int(binary, 2)) 26 | print(realflag) 27 | 28 | -------------------------------------------------------------------------------- /picoCTF/PW Crack 5.py: -------------------------------------------------------------------------------- 1 | #Made by FazeCT 2 | 3 | import hashlib 4 | 5 | 6 | ### THIS FUNCTION WILL NOT HELP YOU FIND THE FLAG --LT ######################## 7 | def str_xor(secret, key): 8 | # extend key to secret length 9 | new_key = key 10 | i = 0 11 | while len(new_key) < len(secret): 12 | new_key = new_key + key[i] 13 | i = (i + 1) % len(key) 14 | return "".join([chr(ord(secret_c) ^ ord(new_key_c)) for (secret_c, new_key_c) in zip(secret, new_key)]) 15 | 16 | 17 | ############################################################################### 18 | 19 | flag_enc = open('D:\Downloads\level5.flag.txt (1).enc', 'rb').read() 20 | correct_pw_hash = open('D:\Downloads\level5.hash (1).bin', 'rb').read() 21 | 22 | 23 | def hash_pw(pw_str): 24 | pw_bytes = bytearray() 25 | pw_bytes.extend(pw_str.encode()) 26 | m = hashlib.md5() 27 | m.update(pw_bytes) 28 | return m.digest() 29 | 30 | 31 | def level_5_pw_check(): 32 | file = open('D:\Downloads\dictionary.txt', 'r') 33 | for i in file: 34 | user_pw = i.strip("\n") 35 | user_pw_hash = hash_pw(user_pw) 36 | if (user_pw_hash == correct_pw_hash): 37 | print("Password:",i,end='') 38 | print("Welcome back... your flag, user:") 39 | decryption = str_xor(flag_enc.decode(), user_pw) 40 | print(decryption) 41 | return 42 | 43 | 44 | level_5_pw_check() 45 | 46 | 47 | -------------------------------------------------------------------------------- /picoCTF/asm1.py: -------------------------------------------------------------------------------- 1 | #Made by FazeCT 2 | 3 | if int('0x2e0', 16)>int('0x3fb', 16): 4 | if int('0x2e0', 16) != int('0x559', 16): 5 | print(hex(int('0x2e0', 16) + int('0xa', 16))) 6 | else: 7 | print(hex(int('0x2e0', 16) - int('0xa', 16))) 8 | else: 9 | if int('0x2e0', 16) != int('0x280', 16): 10 | print(hex(int('0x2e0', 16) - int('0xa', 16))) 11 | else: 12 | print(hex(int('0x2e0', 16) + int('0xa', 16))) 13 | 14 | 15 | 16 | 17 | 18 | -------------------------------------------------------------------------------- /picoCTF/asm2.py: -------------------------------------------------------------------------------- 1 | #Made by FazeCT 2 | 3 | #asm2(0x4,0x2d) 4 | 5 | a = int('0x2d',16) 6 | b = int('0x4',16) 7 | 8 | while b <= int('0x5fa1',16): 9 | a += int('0x1',16) 10 | b += int('0xd1',16) 11 | 12 | print(hex(a)) 13 | -------------------------------------------------------------------------------- /picoCTF/droids2.py: -------------------------------------------------------------------------------- 1 | #Made by FazeCT 2 | 3 | witches = ["weatherwax", "ogg", "garlick", "nitt", "aching", "dismass"] 4 | second = 3 - 3 5 | third = (3 // 3) + second 6 | fourth = (third + third) - second 7 | fifth = 3 + fourth 8 | key = witches[fifth] + "." + witches[third] + "." + witches[second] + "." + witches[(fifth + second) - third] + "." + witches[3] + "." + witches[fourth] 9 | print(key) 10 | -------------------------------------------------------------------------------- /picoCTF/reverse_cipher.py: -------------------------------------------------------------------------------- 1 | #Made by FazeCT 2 | 3 | data = 'picoCTF{w1{1wq84fb<1>49}' 4 | print(data[:7], end = '') 5 | print('{', end = '') 6 | for i in range(8,23): 7 | if i & 1 != 0: 8 | print(chr(ord(data[i]) + 2), end = '') 9 | else: 10 | print(chr(ord(data[i]) - 5), end = '') 11 | print('}', end = '') 12 | -------------------------------------------------------------------------------- /picoCTF/vault-door-8.py: -------------------------------------------------------------------------------- 1 | #Made by FazeCT 2 | 3 | v = ['0xF4', '0xC0','0x97','0xF0', '0x77', '0x97', '0xC0', '0xE4', '0xF0', '0x77', '0xA4', '0xD0','0xC5', '0x77', '0xF4', '0x86', '0xD0', '0xA5', '0x45', '0x96', '0x27', '0xB5', '0x77', '0xE0', '0x95', '0xF1', '0xE1', '0xE0', '0xA4', '0xC0', '0x94', '0xA4'] 4 | 5 | def switchBits(n,a,b): 6 | l = [char for char in n] 7 | l[a],l[b] = l[b],l[a] 8 | return ''.join(l) 9 | 10 | for i in range(len(v)): 11 | c = bin(int(v[i],16))[2:].zfill(8) 12 | c = switchBits(c, 6, 7) 13 | c = switchBits(c, 2, 5) 14 | c = switchBits(c, 3, 4) 15 | c = switchBits(c, 0, 1) 16 | c = switchBits(c, 4, 7) 17 | c = switchBits(c, 5, 6) 18 | c = switchBits(c, 0, 3) 19 | c = switchBits(c, 1, 2) 20 | print(bytes.fromhex(hex(int(c,2))[2:]).decode('utf-8'),end='') 21 | 22 | 23 | 24 | 25 | -------------------------------------------------------------------------------- /pwn.college/babyrev level 1.0.py: -------------------------------------------------------------------------------- 1 | data = [0x6f ,0x61 ,0x70 ,0x75 ,0x73] 2 | for c in data: print(chr(int(str(c))),end='') 3 | -------------------------------------------------------------------------------- /sanryu.exe: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/FazeCT/ctf/ab8c160867ea0efb10bd2dd0091bf9b63f182fc5/sanryu.exe --------------------------------------------------------------------------------