Rating:

# Tux's Kitchen

## Description

I need to bake it!

nc crypto.hsctf.com 8112

[problem.py](problem.py)

## Solution

The server print a cute penguin and a list of numbers.

![](problem.png)

We can see that the numbers are generated by function final_bake()

```
print(final_baking(flag,key))
```

The function's body is:

```

def final_baking(food,key):
baked = rand0m_mess(food,key)
treasure = []
for i in range(len(baked)):
treasure.append(ord(food[i])*baked[i])
print(ord(food[i])*baked[i]))
treasure = prepare(treasure)
return treasure
```

I noticed that the numbers in treasure are multiple of the order of each character in the flag.

Knowing the number, I can make a list of printable candidate that is factor of the number.

And prepare() is:

```
def prepare(food):
good_food = []
for i in range(len(food)):
good_food.append(food[i]^MY_LUCKY_NUMBER)
print(food[i]^MY_LUCKY_NUMBER)
for k in range(len(good_food)):
good_food[i] += MY_LUCKY_NUMBER
return good_food

```

So I first get 3 lists of numbers and reverse the prepare process.
```
for i in range(len(ans)):
ans[-1] = ans[-1] - MY_LUCKY_NUMBER
ans[i] = ans[i] ^ MY_LUCKY_NUMBER
````
For all printable characters, if it is the factor of the number, put it in the candidate list.
```
for j in range(32,127):
if i // j * j == i:
pos += chr(j)
```
If the character is in all three of the candidate, it's big chance that it is the answer.

Running the [script](solve.py), I get the result:

```
4hs!c:t"3f){:t4h1s_1s_07ne_;v3&9ry_$6l07ng_"3f$6l 0@`g_1b3!ca8s3_:t5(

Original writeup (https://github.com/kuruwa2/ctf-writeups/tree/master/HSCTF%206/Tux's%20Kitchen).