cult_classic_1

This was just a series of mini-crypto puzzles:

1. The first letter of each line reads PRINCESS
2. b64->rot-3 gives If you can decode this, you can have the next key: BIGNERD
3. Vig decode KMRYCTWG{ with it’s corresponding JELLYCTF{ gives BIGNERD as the key. Decoding the whole thing gives NOT BAD, HERES A FLAG FOR YOUR EFFORTS SO FAR: JELLYCTF{THIS_IS_JUST_A_WARM_UP} HOWEVER YOUR JOURNEY IS NOT OVER, TAKE THIS KEY AND PROCEED FORWARD: ALIEN

flag: JELLYCTF{THIS_IS_JUST_A_WARM_UP}

cult_classic_2

4. [brute forcing] a playfair cipher gives ALIEN->ACOUSTIC as one of the possibilities
5. Using a hint shows that you need to look at luminary’s lyrics, and each #.# corresponds to line.col. Decoding gives “Capitalize megalencephaly for the next …”
6. Decoding a bacon cipher (with complete alphabet) gives THEFINALPASSWORDISSADGIRL

flag: jellyctf{jelly_was_probably_older_than_these_ciphers}

cipher_check

each clue corresponds to something in the form of ANSWER____, and filling in the board gives follow moist duel xqc in detail on special lineup event he won mate in 6 moves! Following the moves of the game and putting the corresponding letters of the squares in order gives istillloveit.

flag: jellyCTF{istillloveit}

exclusively_yours

XORing the hex with jellyCTF shows that the flag is XORed with itself shifted 3 bytes to the left. A script can reverse that:

c = "06 1C 2F 38 3F 38 2C 29 09 0A 16 2D 1C 16 2B 31 17 1B 2D 0A 16 0F 18 1C 11"
c = c.split()
c = [int(i, 16) for i in c]
res = ""
key = "jel"
for i in range(len(c)):
    k = key[-3]
    next = c[i]^ord(k)
    key += chr(next)
    res += k
print(res)

flag: jellyCTF{xorry_not_xorry}

dizzy_fisherman

Here we are able to input the base for two people’s AES encryption key. If you input 2 (or any number for that matter) you can easily brute force the exponent and get the key.

from Crypto.Util import number
from Crypto.Cipher import AES
from Crypto.Util.Padding import pad

def brute_force(base, res, mod):
    b = base
    for i in range(2, 10000+1):
        b = (b*base)%mod
        if b == res: return i

p = 63579193433447636138142180956143903452427972074605894864703396671022456098599
g = 2
pa = 12216650520779549051085807383600007441099464649139735571057936351615978497631
pb = 268435456 # thats crazy

cip = "7c78e0ee6710a27b97cfb37501e02cc0e4f8cf921ecb9a891793622361efaa6cc7618b790239761506f8f83fa49b974ac7618b790239761506f8f83fa49b974a"

sa = brute_force(g, pa, p)
sb = brute_force(g, pb, p)
key = pow(pa, sb, p)

encoded_key = key.to_bytes(32, byteorder='big')
cipher = AES.new(encoded_key, AES.MODE_ECB)

pt = cipher.decrypt(bytes.fromhex(cip))
print(pt)

flag: jellyCTF{SOS_stuck_in_warehouse}

really_special_awawawas

Using the hint showed that the RSA encryption used more than 2 primes. I first read up a bit on how to break RSA:

• stackoverflow
• wikipedia

n = 40095322948381328531315369020145890848992927830000776301309425505
e = 65537
cip = 35622053067320123838840878683947610930876835359945867019927573838

from sympy.ntheory import factorint
factors = factorint(n)
print(factors)
# {5: 1, 23: 1, 460465412038271581: 1, 757179525420813109550252454787205779901919127: 1}

factors = [(5,1), (23,1), (460465412038271581,1), (757179525420813109550252454787205779901919127,1)]
d = inverse(e, carmichael_lambda(factors))
print(d)
# 287458461584463336135331697997301511216944981741119712297623893

m = pow(cip,d,n)
h = hex(m)
print(h)
print(bytes.fromhex(h[2:]).decode())

flag: jellyCTF{awawas_4_every1}

the_brewing_secrets

The rand() function is seeded with the current time in seconds, so we can easily copy and use the number to build the passcode.

passcodeLength = 6
bitmask = (1 << passcodeLength) - 1

libc = CDLL("libc.so.6")

# p = process("./a.out", stdin=PTY, stdout=PTY)
p = remote(host='chals.jellyc.tf', port=6000)

s = int(time.time())
# print(s)

libc.srand(s)
for i in range(10):
  r = libc.rand()
  # print(f"r{i} {r}")
  passcode = r & bitmask
  print(f"passcode{i} {bin(passcode)}")
  print(p.recvuntil(b"passcode"))
  p.sendline(bin(passcode)[2:].encode('utf-8'))

print(p.recvuntil(b"}"))

p.interactive()

flag: jellyCTF{mad3_w1th_99_percent_l0v3_and_1_percent_sad_g1rl_t3ars}

cherry

The goal here is to get three cherries, which corresponds to solving a linear system

19*a + 32*b + 347*c = -10992 (mod m)
22*a + 27*b + 349*c = -30978 (mod m)
19*a + 29*b + 353*c = -12520 (mod m)

Solving the system with sagemath gives the amount of spins we need to do for each mode for various modulo offsets:

sage: solve_mod([19*a + 32*b + 347*c == -30983,22*a + 27*b + 349*c == -7390,19*a + 29*b + 353*c == -481],m)
[(10469, 7226, 14158)]
sage: solve_mod([19*a + 32*b + 347*c == -10992,22*a + 27*b + 349*c == -30978,19*a + 29*b + 353*c == -12520],m)
[(4194, 29860, 25598)]
sage: solve_mod([19*a + 32*b + 347*c == -25974,22*a + 27*b + 349*c == -26744,19*a + 29*b + 353*c == -9122],m)
[(20582, 3380, 26344)]

At this point it look like spinning that many times will get the awascii32 lines to show the flag, and we can do that by modifying the code:

function playCoin(n){
  spinMode = n;
  if (n == 0)       spinCounts = [10469, 7226, 14158];//slotSpins = [ 19,  22,  19];    you_won_c
  else if (n == 1)    spinCounts = [4194, 29860, 25598];//slotSpins = [ 32,  27,  29];   jellyCTF{
  else if (n == 2)    spinCounts = [20582, 3380, 26344];//slotSpins = [347, 349, 353];   herries!}
  updatePlaintextDisplay();
  updateModeDisplay();
}

flag: jellyCTF{you_won_cherries!}

misc

out = "1000001010010011101111101011101011111010000010100100110000111001110111010000111011100111110100111100100110101111000001110010110110010001100011011001000011001110011101000110101100010110011111111"
flag = ""

class Node:
    # z is 0, o is 1
    def __init__(self, c=None):
        self.c = c
        self.z = None
        self.o = None


trees = {
    '_':"000",
    'e':"001",
    'l':"010",
    'y':'011',
    'j':'1000',
    'o':'1001',
    'r':'1010',
    'a':'10110',
    'c':'10111',
    'd':'11000',
    's':'11001',
    't':'11010',
    'u':'11011',
    'w':'11100',
    'f':'111010',
    'h':'111011',
    'k':'111100',
    'm':'111101',
    '{':'111110',
    '}':'111111'
}

root = Node()
for ch in trees:
    v = trees[ch]
    h = root
    for p in v:
        if p == '1':
            if h.o:
                h = h.o
            else:
                h.o = Node()
                h = h.o
        else:
            if h.z:
                h = h.z
            else:
                h.z = Node()
                h = h.z
    h.c = ch

it = root
for b in out:
    if it.c:
        flag += it.c
        it = root
    if b == '1':
        it = it.o
    else:
        it = it.z

print(flag)

# Fetch
FROM golang:latest AS fetch-stage
COPY go.mod go.sum /app/
WORKDIR /app
RUN go mod download

# Generate
FROM ghcr.io/a-h/templ:latest AS generate-stage
COPY --chown=65532:65532 . /app
WORKDIR /app
RUN ["templ", "generate"]

# Build
FROM golang:latest AS build-stage
COPY --from=generate-stage /app /app
WORKDIR /app
RUN CGO_ENABLED=0 GOOS=linux go build -o /just-win-lol

FROM alpine:latest AS run
WORKDIR /app
RUN adduser -S jelly
USER jelly
COPY --chown=jelly assets /app/assets
COPY --from=build-stage --chown=jelly /just-win-lol /app/
EXPOSE 8080
ENTRYPOINT ["/app/just-win-lol"]

ever:= 1
	for ever < 2 {
		log.Println("slept 0.5 second")
		time.Sleep(time.Second/2)
		// current time in unix seconds
		var timeNow = time.Now().UTC().Unix()
		var rand_time = rand.New(rand.NewSource(timeNow))
		hand := randHand(*rand_time)
		if isFiveOfAKind(hand) {
			log.Println("win=--=-=-=-=-=-=-=-=-=-=-=-=-=")
		}

	}

dGhpc193YXNfbm90X215X2ludGVudGlvbn0=
eUNURns=
amVsbA==

from pwn import *

io = remote(host="chals.jellyc.tf", port=5002)

io.sendline(b'2')
io.sendline(b'1')
io.sendline(b'1')
io.sendline(cyclic(160)+p64(0x7fffffff))

io.interactive()

lookup = "AWawJELYHOSIUMjelyhosiumPCNTpcntBDFGRbdfgr0123456789 .,!'()~_/;\n"
out = " awa awa awa awawawawa awa awa awa awa awawawawawa awa awa awawa awa awa awa awa awa awa awawa awa awa awa awa awa awa awawa awa awa awawa awa awa awawawa awa awawa awa awa awawawa awawawa awa awawa awa awa awawa awa awa awawawawa awa awawa awa awa awawawa awa awawa awa awawa awawa awawa awa awa awa awawawawa awa awa awa awawa awawa awawawa awa awawa awawawa awawa awa awawa awa awa awa awawa awa awawawawawa awa awa awa awa awawawawawawa awa awa awa awa awa awawawa awa awawa awawa awawa awa awa awawawawawa awa awa awa awawa awa awawa awawa awa awawa awawa awawawa awa awa awawawa awawawa awa awawawawawa awa awa awa awa awawawawawawa awa awawa awawa awawa awa awa awawa awawa awawa awa awa awawawawawa awa awa awa awa awa awawawa awawa awa awa awawa awawawa awa awa awa awawawa awa awawa awa awa awawa awa awawa awa awa awawawawa awawa awa"
binary_awascii = out.replace(" awa", "0").replace("wa", "1")
length = int(len(binary_awascii)/8);
print(length)
flag = ""
for i in range(length):
    c = binary_awascii[8*i:8*i+8]
    ind = int(c, 2)
    flag += lookup[ind]
print(flag)

f = 'c^eer<M?tZX<*Ia,kX?*MX_)kX:Xik*g<,..v'
res = ""
for c in f:
    res += chr(ord(c)+7)
print(res)
# could be 1 line but who cares

That was just a warm up. Here is the actual flag, though you may need a base that's 'A' bit larger:
驪ꍬ硹答𓉻晨鑳橩ꅟ𓅵鑴鑡楢晳鑣𔕡𔕡𔕡𓁡𓍭𠍰

a = ""
with open("hex.txt", "r") as f:
    a = f.read()
    a = a.split()

u = "f3 a0 85 8e e2 80 8c".split()
u = [int(x, 16) for x in u]
s = len(u)
letters = []
diffs = []

chunks = int(len(a)/s)
for i in range(chunks):
    b = a[i*s: s*i+s]
    b = [int(x, 16) for x in b]
    diff = [b[i]-u[i] for i in range(s)]
    letters.append(chr(diff[3]+97))
    diffs.append(diff[2])

print(letters)
print(diffs)

a = ""
with open("hex.txt", "r") as f:
    a = f.read()
a = a.split()
a = a[4:-5]
a = [a[i:i+7] for i in range(0, len(a), 7)]
a = [int("".join(i), 16) for i in a]
a = [(i+81)%192 for i in a]
print(''.join([chr(i) for i in a]))

a = ""
with open("hex.txt", "r") as f:
    a = f.read()
a = a.split()
b = a[2::7]
a = a[3::7]
a = [int(a[i],16)-(64+47 if b[i] == '84' else 47) for i in range(len(a))]
print("".join([chr(x) for x in a]))