The Time Equations


Solution

When running the instant, we can see that the program wants us to give an answer for each variable a, b, c, d and e based on the given set of equations.

The source code

linear.c
#include <stdio.h>
#include <stdlib.h>
#include <time.h>
#include <sys/random.h>

int main() {

    // Use the slow Linux cryptographically secure rng to seed the faster insecure rng
    unsigned int seed_val = 0;
    int ret = getrandom((void*)&seed_val, 4, GRND_RANDOM);

    if(ret == -1){
        printf("Contact SwampCTF organizers there is an issue with this challenge.\nExiting....\n");
        exit(1);
    }

    // Seed the rng
    srand(seed_val);

    int equ0[5] = {0};
    int equ1[5] = {0};
    int equ2[5] = {0};
    int equ3[5] = {0};
    int equ4[5] = {0};
    int solution[5] = {0};
    int result[5] = {0};
    int submission[5] = {0};

    for(int i = 0; i < 5; i++){
        // Generate the coefficients of the linear equations (provided to stdout)
        equ0[i] = rand() % 10000;
        equ1[i] = rand() % 10000;
        equ2[i] = rand() % 10000;
        equ3[i] = rand() % 10000;
        equ4[i] = rand() % 10000;

        // Generate the solution set (hidden)
        solution[i] = rand() % 10000;
    }

    // Calculate the results of all the linear equations (provided to stdout)
    for(int i = 0; i < 5; i++){
        result[0] += equ0[i]*solution[i];
        result[1] += equ1[i]*solution[i];
        result[2] += equ2[i]*solution[i];
        result[3] += equ3[i]*solution[i];
        result[4] += equ4[i]*solution[i];
    }


    //printf("Solution set = %d %d %d %d %d\n", solution[0], solution[1], solution[2], solution[3], solution[4]);

    printf("Quick! These set of linear equations describe the secretes to time travel!\n"
           "But the quantum state of the universe only gives us 10 mere seconds to solve them!!!\n\n");

    printf("%d*a + %d*b + %d*c + %d*d + %d*e = %d\n", equ0[0],equ0[1],equ0[2],equ0[3],equ0[4],result[0]);
    printf("%d*a + %d*b + %d*c + %d*d + %d*e = %d\n", equ1[0],equ1[1],equ1[2],equ1[3],equ1[4],result[1]);
    printf("%d*a + %d*b + %d*c + %d*d + %d*e = %d\n", equ2[0],equ2[1],equ2[2],equ2[3],equ2[4],result[2]);
    printf("%d*a + %d*b + %d*c + %d*d + %d*e = %d\n", equ3[0],equ3[1],equ3[2],equ3[3],equ3[4],result[3]);
    printf("%d*a + %d*b + %d*c + %d*d + %d*e = %d\n", equ4[0],equ4[1],equ4[2],equ4[3],equ4[4],result[4]);

    unsigned long time_start = time(0);

    printf("a = ");
    scanf("%d", &submission[0]);

    printf("b = ");
    scanf("%d", &submission[1]);

    printf("c = ");
    scanf("%d", &submission[2]);

    printf("d = ");
    scanf("%d", &submission[3]);

    printf("e = ");
    scanf("%d", &submission[4]);

    // Fail if it takes longer then 10 seconds to solve the system
    if((time(0) - time_start) >= 10){
        printf("Aaaah we didn't solve the system fast enough!\n");
        exit(1);
    }

    // Fail if one of variables is incorrect
    for(int i = 0; i < 5; i++){
        if(solution[i] != submission[i]) {
            printf("AAaaahhh the time jump failed!!! The solution set must have been wrong!!\n");
            exit(1);
        }
    }

    printf("We did it! We have traveled through time! Here is the flag: \n");

    return 0;
}  

Solve it like using this as a reference.

solve.py
from sympy import symbols, Eq, solve
from pwn import *

r = remote('chals.swampctf.com', 60001)

try:
    print(r.recv())

    equations_str = r.recvuntil(b'\na =', drop=True)

    eq = equations_str.split(b'\n')
    coefficients = []
    constants = []

    for eqs in eq:
        eqs = eqs.decode().strip()
        if eqs == '':
            continue
        parts = eqs.split('=')
        left_side = parts[0].strip()
        total = int(parts[1].strip())

        coeffs = []
        for term in left_side.split('+'):
            coeff = int(term.split("*")[0])
            coeffs.append(coeff)

        coefficients.append(coeffs)
        constants.append(total)

    #print(coefficients)
    #print(constants)
    a, b, c, d, e = symbols('a,b,c,d,e')
    eq = []
    for i in range(len(coefficients)):
       equation = 0
       for j in range(len(coefficients[i])):
          equation += coefficients[i][j] * symbols('a,b,c,d,e')[j]
       eq.append(Eq(equation, constants[i]))

    for i in eq:
       print(i)

    solved_eq = solve((eq[0], eq[1], eq[2], eq[3], eq[4]), (a, b, c, d, e))

    print(solved_eq)
    solution = []
    for var in (a, b, c, d, e):
       solution.append(solved_eq[var])

    r.sendline(bytes(str(int(solution[0])), 'utf-8'))
    r.sendlineafter(b'= ', bytes(str(int(solution[1])), 'utf-8'))
    r.sendlineafter(b'= ', bytes(str(int(solution[2])), 'utf-8'))
    r.sendlineafter(b'= ', bytes(str(int(solution[3])), 'utf-8'))
    r.sendlineafter(b'= ', bytes(str(int(solution[4])), 'utf-8'))

    print(r.recvall())

except Exception as e:
    print("An error occurred:", e)

finally:
    r.close()

Line 11-29 parsed the received strings to two part. Coefficient and constant. Then store them in arrays.

Line 33 - 39 building up equations from the parsed contents

Line 44 make use of sympy module for calculating the value for each variable.


Flag

swampCTF{tim3_trav3l_i5nt_r3al}

Last updated