Rating:
# fibinary 205 points
# Description
Warmup your crypto skills with the superior number system!
- [enc.py](https://github.com/MikelAcker/CTF_WRITEUPS_2021/blob/main/corCTF_2021_Writeup/Crypto/fibinary/enc.py)
- [flag.enc](https://github.com/MikelAcker/CTF_WRITEUPS_2021/blob/main/corCTF_2021_Writeup/Crypto/fibinary/flag.enc)
# Solution
The `flag.enc` file contains binaries.
```
10000100100 10010000010 10010001010 10000100100 10010010010 10001000000 10100000000 10000100010 00101010000 10010010000 00101001010 10000101000 10000010010 00101010000 10010000000 10000101000 10000010010 10001000000 00101000100 10000100010 10010000100 00010101010 00101000100 00101000100 00101001010 10000101000 10100000100 00000100100
```
I converted them to text with [Binary to Text Translator](https://www.rapidtables.com/convert/number/binary-to-ascii.html) but it just gave me nothing *useful*.
Let's look the `enc.py`!
```python
fib = [1, 1]
for i in range(2, 11):
fib.append(fib[i - 1] + fib[i - 2])
def c2f(c):
n = ord(c)
b = ''
for i in range(10, -1, -1):
if n >= fib[i]:
n -= fib[i]
b += '1'
else:
b += '0'
return b
flag = open('flag.txt', 'r').read()
enc = ''
for c in flag:
enc += c2f(c) + ' '
with open('flag.enc', 'w') as f:
f.write(enc.strip())
```
The first three lines assigns `[1,1]` to `fib` then do *for in range loop* and appends *something* to `fib`.
Let's add `print(fib)` after *for loop* to see what the *fib* will be.
```python
fib = [1, 1]
for i in range(2, 11):
fib.append(fib[i - 1] + fib[i - 2])
print(fib)
...
```
It prints.
```sh
$ python3 enc.py
[1, 1, 2, 3, 5, 8, 13, 21, 34, 55, 89]
Traceback (most recent...
```
So, we can remove the first three lines and just leave `fib = [1, 1, 2, 3, 5, 8, 13, 21, 34, 55, 89]` to make the code cleaner!
```python
#fib = [1, 1]
#for i in range(2, 11):
# fib.append(fib[i - 1] + fib[i - 2])
fib = [1, 1, 2, 3, 5, 8, 13, 21, 34, 55, 89]
...
```
Next, it defines `c2f` function.
```python
def c2f(c):
n = ord(c)
b = ''
for i in range(10, -1, -1):
if n >= fib[i]:
n -= fib[i]
b += '1'
else:
b += '0'
return b
```
Let's say *character* 'c' is passed to this function.
`n` variable will becomes 99 because `ord('c')` will returns integer representing the **Unicode** code point of 'c' which is 99.
Next, in *for loop*, `n` is first compared with 10th index of `fib` which is 89.`n` is greater so, `n` becomes 10 which is `99 - 89` and add '1' to `b`.Then, `n` will be compared with 9th index of `fib` which is 55. 10 is less than 55 so, '0' is added to `b`...
```
ord('c') -> 99
fib = [1, 1, 2, 3, 5, 8, 13, 21, 34, 55, 89]
n = 99
(n is greater than 89)
b = '1'
fib = [1, 1, 2, 3, 5, 8, 13, 21, 34, 55, 89]
n = 10
(n is less than 55)
b = '10'
fib = [1, 1, 2, 3, 5, 8, 13, 21, 34, 55, 89]
n = 10
(n is less than 34)
b = '100'
fib = [1, 1, 2, 3, 5, 8, 13, 21, 34, 55, 89]
n = 10
(n is less than 21)
b = '1000'
fib = [1, 1, 2, 3, 5, 8, 13, 21, 34, 55, 89]
n = 10
(n is less than 13)
b = '10000'
fib = [1, 1, 2, 3, 5, 8, 13, 21, 34, 55, 89]
n = 10
(n is greater than 8)
b = '100001'
fib = [1, 1, 2, 3, 5, 8, 13, 21, 34, 55, 89]
n = 2
(n is less than 5)
b = '1000010'
fib = [1, 1, 2, 3, 5, 8, 13, 21, 34, 55, 89]
n = 2
(n is less than 3)
b = '10000100'
fib = [1, 1, 2, 3, 5, 8, 13, 21, 34, 55, 89]
n = 2
(n is equal to 2)
b = '100001001'
fib = [1, 1, 2, 3, 5, 8, 13, 21, 34, 55, 89]
n = 0
(n is less than 1)
b = '1000010010'
fib = [1, 1, 2, 3, 5, 8, 13, 21, 34, 55, 89]
n = 0
(n is less than 1)
b = '10000100100'
```
The thing is that there is a *way* to get the *character* back
```
bin = 10000100100
#reverse the bin
rev(bin) = 00100100001
fib = [1, 1, 2, 3, 5, 8, 13, 21, 34, 55, 89]
[1, 1, 2, 3, 5, 8, 13, 21, 34, 55, 89]
[0, 0, 1, 0, 0, 1, 0, 0, 0, 0, 1]
| | |
V V V
2 + 8 + 89 = 99
chr(99) = 'c'
```
With this way, we can get our flag back!!!
### solve.py
```python
fib = [1, 1, 2, 3, 5, 8, 13, 21, 34, 55, 89]
encs = []
with open("flag.enc","r") as file:
encs = file.read().split(" ")
flag = ""
for enc in encs:
ascii_code = 0
for index in range(11):
if enc[index] == '1':
ascii_code += fib[10 - index]
flag += chr(ascii_code)
print(flag)
```
```sh
$ python3 solve.py
corctf{b4s3d_4nd_f1bp!113d}
```
*flag*: `corctf{b4s3d_4nd_f1bp!113d}`
