# PicoCTF - Powershelly
## Background
[Powershell 命令提示字元比較](https://zh.wikipedia.org/zh-tw/PowerShell#%E5%91%BD%E4%BB%A4%E6%8F%90%E7%A4%BA%E5%AD%97%E5%85%83%E6%AF%94%E8%BE%83)
[What is '@{}' meaning in PowerShell](https://stackoverflow.com/questions/56965510/what-is-meaning-in-powershell)
[What does @() mean in Powershell?](https://stackoverflow.com/questions/28732025/what-does-mean-in-powershell)
[[Python] 學習使用集合 (Set)](https://wenyuangg.github.io/posts/python3/python-set.html)
## Source code
:::spoiler Source Code
```bash=
$input = ".\input.txt"
$out = Get-Content -Path $input
$enc = [System.IO.File]::ReadAllBytes("$input")
$encoding = [system.Text.Encoding]::UTF8
$total = 264
$t = ($total + 1) * 5 #1325
$numLength = ($total * 30 ) + $t # 9245
if ($out.Length -gt 5 -or $enc.count -ne $numLength)
{
Write-Output "Wrong format 5"
Exit
}
else
{
for($i=0; $i -lt $enc.count ; $i++)
{
if (($enc[$i] -ne 49) -and ($enc[$i] -ne 48) -and ($enc[$i] -ne 10) -and ($enc[$i] -ne 13) -and ($enc[$i] -ne 32))
{
Write-Output "Wrong format 1/0/"
Exit
}
}
}
$blocks = @{}
for ($i=0; $i -lt $out.Length ; $i++)
{
$r = $out[$i].Split(" ")
if ($i -gt 0)
{
for ($j=0; $j -lt $r.Length ; $j++)
{
if ($r[$j].Length -ne 6)
{
Write-Output "Wrong Format 6" $r[$j].Length
Exit
}
$blocks[$j] += $r[$j]
}
}
else
{
for ($j=0; $j -lt $r.Length ; $j++)
{
if ($r[$j].Length -ne 6)
{
Write-Output "Wrong Format 6" $r[$j].Length
Exit
}
$blocks[$j] = @()
$blocks[$j] += $r[$j]
}
}
}
function Exit {
exit
}
function Random-Gen {
$list1 = @()
for ($i=1; $i -lt ($blocks.count + 1); $i++)
{
$y = ((($i * 327) % 681 ) + 344) % 313
$list1 += $y
}
return $list1
}
function Scramble {
param (
$block,
$seed
)
$raw = [system.String]::Join("", $block)
$bm = "10 " * $raw.Length
$bm = $bm.Split(" ")
for ($i=0; $i -lt $raw.Length ; $i++)
{
$y = ($i * $seed) % $raw.Length
$n = $bm[$y]
while ($n -ne "10")
{
$y = ($y + 1) % $raw.Length
$n = $bm[$y]
}
if ($raw[$i] -eq "1" )
{
$n = "11"
}
else
{
$n = "00"
}
$bm[$y] = $n
}
$raw2 = [system.String]::Join("", $bm)
$b = [convert]::ToInt64($raw2,2)
return $b
}
$result = 0
$seeds = @()
for ($i=1; $i -lt ($blocks.count +1); $i++)
{
$seeds += ($i * 127) % 500
}
$randoms = Random-Gen
$output_file = @()
for ($i=0; $i -lt $blocks.count ; $i++)
{
$fun = Scramble -block $blocks[$i] -seed $seeds[$i]
if($i -eq 263)
{
Write-Output $seeds[$i]
Write-Output $randoms[$i]
Write-Output $fun
}
$result = $fun -bxor $result -bxor $randoms[$i]
$output_file += $result
}
Add-Content -Path output_test.txt -Value $output_file
```
:::
## Recon
這一題太難了，花了好多時間，不看[^pico-reverse-powershelly-wp-IRS-Cybersec]的WP大概猜到了六七成，不過最後的部分才是關鍵，再加上不是很懂powershell的語法
1. Check File Format
首先他先檢查input.txt的格式，可以從這邊看出來他應該是一個==5列的content==，以及總字元數(所有bytes的數量)是9245，接著他判斷每個字元是否都符合`0`, `1`, `carriage return`, `\n`, `<space>`
```bash
if ($out.Length -gt 5 -or $enc.count -ne $numLength)
...
if (($enc[$i] -ne 49) -and ($enc[$i] -ne 48) -and ($enc[$i] -ne 10) -and ($enc[$i] -ne 13) -and ($enc[$i] -ne 32))
```
另外他還會檢查每一個row中，用空格split的每一個element是不是都符合6個字元，簡單解釋一下下面在幹嘛，他先創一個dictionary，叫做\$blocks，然後把\$out第一個row，先用空格格開，再比對每一個element是否都是6個字元，實際跑過之後他會長下面這樣
:::spoiler $blocks的格式
```
Name Value
---- -----
263 {110011, 100011, 110011, 110011...}
262 {100001, 001100, 001100, 001100...}
261 {110011, 100011, 110011, 110011...}
260 {110011, 100011, 110011, 110011...}
259 {110011, 100011, 110011, 110011...}
258 {110011, 100011, 110011, 110011...}
257 {110011, 100011, 110011, 110011...}
256 {100001, 001100, 001100, 001100...}
255 {110011, 100011, 110011, 110011...}
254 {100001, 001100, 001100, 001100...}
253 {100001, 001100, 001100, 001100...}
252 {100001, 001100, 001100, 001100...}
251 {100001, 001100, 001100, 001100...}
250 {110011, 100011, 110011, 110011...}
249 {100001, 001100, 001100, 001100...}
248 {100001, 001100, 001100, 001100...}
247 {100001, 001100, 001100, 001100...}
246 {100001, 001100, 001100, 001100...}
245 {110011, 100011, 110011, 110011...}
244 {110011, 100011, 110011, 110011...}
243 {100001, 001100, 001100, 001100...}
242 {110011, 100011, 110011, 110011...}
241 {110011, 100011, 110011, 110011...}
240 {100001, 001100, 001100, 001100...}
239 {110011, 100011, 110011, 110011...}
238 {100001, 001100, 001100, 001100...}
237 {110011, 100011, 110011, 110011...}
236 {100001, 001100, 001100, 001100...}
235 {100001, 001100, 001100, 001100...}
234 {110011, 100011, 110011, 110011...}
233 {110011, 100011, 110011, 110011...}
232 {100001, 001100, 001100, 001100...}
231 {100001, 001100, 001100, 001100...}
230 {100001, 001100, 001100, 001100...}
229 {100001, 001100, 001100, 001100...}
228 {110011, 100011, 110011, 110011...}
227 {100001, 001100, 001100, 001100...}
226 {110011, 100011, 110011, 110011...}
225 {110011, 100011, 110011, 110011...}
224 {100001, 001100, 001100, 001100...}
223 {100001, 001100, 001100, 001100...}
222 {100001, 100011, 001100, 001100...}
221 {110011, 001100, 110011, 110011...}
220 {100001, 001100, 001100, 001100...}
219 {100001, 001100, 001100, 001100...}
218 {110011, 100011, 110011, 110011...}
217 {100001, 001100, 001100, 001100...}
216 {100001, 001100, 001100, 001100...}
215 {100001, 001100, 001100, 001100...}
214 {110011, 100011, 110011, 110011...}
213 {100001, 001100, 001100, 001100...}
212 {100001, 001100, 001100, 001100...}
211 {110011, 100011, 110011, 110011...}
210 {110011, 100011, 110011, 110011...}
209 {110011, 100011, 110011, 110011...}
208 {100001, 001100, 001100, 001100...}
207 {110011, 100011, 110011, 110011...}
206 {110011, 100011, 110011, 110011...}
205 {100001, 001100, 001100, 001100...}
204 {100001, 001100, 001100, 001100...}
203 {110011, 100011, 110011, 110011...}
202 {110011, 100011, 110011, 110011...}
201 {100001, 001100, 001100, 001100...}
200 {100001, 001100, 001100, 001100...}
199 {110011, 100011, 110011, 110011...}
198 {110011, 100011, 110011, 110011...}
197 {110011, 100011, 110011, 110011...}
196 {100001, 001100, 001100, 001100...}
195 {110011, 100011, 110011, 110011...}
194 {110011, 100011, 110011, 110011...}
193 {110011, 100011, 110011, 110011...}
192 {100001, 001100, 001100, 001100...}
191 {110011, 100011, 110011, 110011...}
190 {110011, 100011, 110011, 110011...}
189 {110011, 100011, 110011, 110011...}
188 {110011, 100011, 110011, 110011...}
187 {100001, 001100, 001100, 001100...}
186 {110011, 100011, 110011, 110011...}
185 {110011, 100011, 110011, 110011...}
184 {100001, 001100, 001100, 001100...}
183 {100001, 001100, 001100, 001100...}
182 {100001, 001100, 001100, 001100...}
181 {100001, 001100, 001100, 001100...}
180 {100001, 001100, 001100, 001100...}
179 {110011, 100011, 110011, 110011...}
178 {110011, 100011, 110011, 110011...}
177 {110011, 100011, 110011, 110011...}
176 {100001, 001100, 001100, 001100...}
175 {110011, 100011, 110011, 110011...}
174 {110011, 100011, 110011, 110011...}
173 {110011, 100011, 110011, 110011...}
172 {110011, 100011, 110011, 110011...}
171 {110011, 100011, 110011, 110011...}
170 {100001, 001100, 001100, 001100...}
169 {110011, 100011, 110011, 110011...}
168 {100001, 001100, 001100, 001100...}
167 {100001, 001100, 001100, 001100...}
166 {110011, 100011, 110011, 110011...}
165 {100001, 001100, 001100, 001100...}
164 {100001, 001100, 001100, 001100...}
163 {110011, 100011, 110011, 110011...}
162 {110011, 100011, 110011, 110011...}
161 {100001, 001100, 001100, 001100...}
160 {100001, 001100, 001100, 001100...}
159 {110011, 100011, 110011, 110011...}
158 {110011, 100011, 110011, 110011...}
157 {110011, 100011, 110011, 110011...}
156 {110011, 100011, 110011, 110011...}
155 {110011, 100011, 110011, 110011...}
154 {100001, 001100, 001100, 001100...}
153 {110011, 100011, 110011, 110011...}
152 {100001, 001100, 001100, 001100...}
151 {110011, 100011, 110011, 110011...}
150 {100001, 001100, 001100, 001100...}
149 {100001, 001100, 001100, 001100...}
148 {110011, 100011, 110011, 110011...}
147 {110011, 100011, 110011, 110011...}
146 {110011, 100011, 110011, 110011...}
145 {110011, 100011, 110011, 110011...}
144 {100001, 001100, 001100, 001100...}
143 {100001, 001100, 001100, 001100...}
142 {100001, 001100, 001100, 001100...}
141 {100001, 001100, 001100, 001100...}
140 {100001, 001100, 001100, 001100...}
139 {100001, 001100, 001100, 001100...}
138 {100001, 001100, 001100, 001100...}
137 {110011, 100011, 110011, 110011...}
136 {100001, 001100, 001100, 001100...}
135 {110011, 100011, 110011, 110011...}
134 {110011, 100011, 110011, 110011...}
133 {110011, 100011, 110011, 110011...}
132 {100001, 001100, 001100, 001100...}
131 {110011, 100011, 110011, 110011...}
130 {110011, 100011, 110011, 110011...}
129 {110011, 100011, 110011, 110011...}
128 {100001, 001100, 001100, 001100...}
127 {100001, 001100, 001100, 001100...}
126 {100001, 001100, 001100, 001100...}
125 {100001, 001100, 001100, 001100...}
124 {110011, 100011, 110011, 110011...}
123 {100001, 001100, 001100, 001100...}
122 {110011, 100011, 110011, 110011...}
121 {110011, 100011, 110011, 110011...}
120 {100001, 001100, 001100, 001100...}
119 {110011, 100011, 110011, 110011...}
118 {110011, 100011, 110011, 110011...}
117 {110011, 100011, 110011, 110011...}
116 {100001, 001100, 001100, 001100...}
115 {100001, 001100, 001100, 001100...}
114 {110011, 100011, 110011, 110011...}
113 {110011, 100011, 110011, 110011...}
112 {100001, 001100, 001100, 001100...}
111 {110011, 100011, 110011, 110011...}
110 {100001, 001100, 001100, 001100...}
109 {100001, 001100, 001100, 001100...}
108 {110011, 100011, 110011, 110011...}
107 {100001, 001100, 001100, 001100...}
106 {110011, 100011, 110011, 110011...}
105 {110011, 100011, 110011, 110011...}
104 {100001, 001100, 001100, 001100...}
103 {100001, 001100, 001100, 001100...}
102 {100001, 001100, 001100, 001100...}
101 {100001, 001100, 001100, 001100...}
100 {110011, 100011, 110011, 110011...}
99 {100001, 001100, 001100, 001100...}
98 {110011, 100011, 110011, 110011...}
97 {110011, 100011, 110011, 110011...}
96 {100001, 001100, 001100, 001100...}
95 {100001, 001100, 001100, 001100...}
94 {100001, 001100, 001100, 001100...}
93 {100001, 001100, 001100, 001100...}
92 {110011, 100011, 110011, 110011...}
91 {110011, 100011, 110011, 110011...}
90 {110011, 100011, 110011, 110011...}
89 {100001, 001100, 001100, 001100...}
88 {100001, 001100, 001100, 001100...}
87 {110011, 100011, 110011, 110011...}
86 {100001, 001100, 001100, 001100...}
85 {100001, 001100, 001100, 001100...}
84 {100001, 001100, 001100, 001100...}
83 {110011, 100011, 110011, 110011...}
82 {110011, 100011, 110011, 110011...}
81 {100001, 001100, 001100, 001100...}
80 {100001, 001100, 001100, 001100...}
79 {100001, 001100, 001100, 001100...}
78 {100001, 001100, 001100, 001100...}
77 {100001, 001100, 001100, 001100...}
76 {100001, 001100, 001100, 001100...}
75 {110011, 100011, 110011, 110011...}
74 {110011, 100011, 110011, 110011...}
73 {100001, 001100, 001100, 001100...}
72 {100001, 001100, 001100, 001100...}
71 {100001, 001100, 001100, 001100...}
70 {110011, 100011, 110011, 110011...}
69 {100001, 001100, 001100, 001100...}
68 {100001, 001100, 001100, 001100...}
67 {110011, 100011, 110011, 110011...}
66 {110011, 100011, 110011, 110011...}
65 {100001, 001100, 001100, 001100...}
64 {100001, 001100, 001100, 001100...}
63 {110011, 100011, 110011, 110011...}
62 {110011, 100011, 110011, 110011...}
61 {100001, 001100, 001100, 001100...}
60 {110011, 100011, 110011, 110011...}
59 {110011, 100011, 110011, 110011...}
58 {110011, 100011, 110011, 110011...}
57 {110011, 100011, 110011, 110011...}
56 {100001, 001100, 001100, 001100...}
55 {100001, 001100, 001100, 001100...}
54 {110011, 100011, 110011, 110011...}
53 {110011, 100011, 110011, 110011...}
52 {100001, 001100, 001100, 001100...}
51 {100001, 001100, 001100, 001100...}
50 {100001, 001100, 001100, 001100...}
49 {110011, 100011, 110011, 110011...}
48 {100001, 001100, 001100, 001100...}
47 {100001, 001100, 001100, 001100...}
46 {100001, 001100, 001100, 001100...}
45 {110011, 100011, 110011, 110011...}
44 {100001, 001100, 001100, 001100...}
43 {110011, 100011, 110011, 110011...}
42 {100001, 001100, 001100, 001100...}
41 {110011, 100011, 110011, 110011...}
40 {100001, 001100, 001100, 001100...}
39 {110011, 100011, 110011, 110011...}
38 {110011, 100011, 110011, 110011...}
37 {100001, 001100, 001100, 001100...}
36 {100001, 001100, 001100, 001100...}
35 {100001, 001100, 001100, 001100...}
34 {100001, 001100, 001100, 001100...}
33 {110011, 100011, 110011, 110011...}
32 {100001, 001100, 001100, 001100...}
31 {110011, 100011, 110011, 110011...}
30 {110011, 100011, 110011, 110011...}
29 {110011, 100011, 110011, 110011...}
28 {110011, 100011, 110011, 110011...}
27 {100001, 001100, 001100, 001100...}
26 {110011, 100011, 110011, 110011...}
25 {110011, 100011, 110011, 110011...}
24 {100001, 001100, 001100, 001100...}
23 {110011, 100011, 110011, 110011...}
22 {110011, 100011, 110011, 110011...}
21 {100001, 001100, 001100, 001100...}
20 {100001, 001100, 001100, 001100...}
19 {100001, 001100, 001100, 001100...}
18 {110011, 100011, 110011, 110011...}
17 {110011, 100011, 110011, 110011...}
16 {100001, 001100, 001100, 001100...}
15 {110011, 100011, 110011, 110011...}
14 {100001, 001100, 001100, 001100...}
13 {100001, 001100, 001100, 001100...}
12 {110011, 100011, 110011, 110011...}
11 {100001, 001100, 001100, 001100...}
10 {110011, 100011, 110011, 110011...}
9 {110011, 100011, 110011, 110011...}
8 {100001, 001100, 001100, 001100...}
7 {100001, 001100, 001100, 001100...}
6 {100001, 001100, 001100, 001100...}
5 {100001, 001100, 001100, 001100...}
4 {100001, 001100, 001100, 001100...}
3 {110011, 100011, 110011, 110011...}
2 {110011, 100011, 110011, 110011...}
1 {110011, 100011, 110011, 110011...}
0 {100001, 001100, 001100, 001100...}
```
:::
```python=27
$blocks = @{}
for ($i=0; $i -lt $out.Length ; $i++)
{
$r = $out[$i].Split(" ")
if ($i -gt 0)
{
for ($j=0; $j -lt $r.Length ; $j++)
{
if ($r[$j].Length -ne 6)
{
Write-Output "Wrong Format 6" $r[$j].Length
Exit
}
$blocks[$j] += $r[$j]
}
}
else
{
for ($j=0; $j -lt $r.Length ; $j++)
{
if ($r[$j].Length -ne 6)
{
Write-Output "Wrong Format 6" $r[$j].Length
Exit
}
$blocks[$j] = @()
$blocks[$j] += $r[$j]
}
}
}
```
Note: `$out.Length`在只有一列的情況下會return那一列的字元數，但如果列的數量大於一，就會return列的數量，例如：假設input.txt目前有三列，則`$out==3`，但如果現在只有一列，而此列上寫了10個字元，則`$out==10`
2. Before Encryption
在執行加密之前，他會運算seeds和random number以便後續的運算
```bash=111
for ($i=1; $i -lt ($blocks.count +1); $i++)
{
$seeds += ($i * 127) % 500
}
```
```bash=65
function Random-Gen {
$list1 = @()
for ($i=1; $i -lt ($blocks.count + 1); $i++)
{
$y = ((($i * 327) % 681 ) + 344) % 313
$list1 += $y
}
return $list1
}
```
3. Encryption
實際加密的步驟是：計算\$fun，他先create一個list，然後先存'10'*\$raw.Length，然後用\$seed計算index(隨機的)，如果\$raw[\$index]是`1`，那就改成`11`，相反，如果是`0`，就改成`00`。接著他會和\$result以及\$randoms[\$i]做xor，就得到最後的ciphertext
4. Decryption
1. 我們的目標是要還原出一開始input file中的內容，這樣我們才知道最後的flag的形式長怎麼，所以做法就是逆著做回去，先算出\$fun是多少，一開始的\$result是`0`，所以我們可以直接再做xor，就得到\$fun，
```python=11
fun = int(output[i].strip()) ^ result ^ randoms[i]
```
Note: \$seeds和\$randoms可以直接用他給的code section用PS跑看看再存成檔案，也可以直接用python實作，答案會是一樣的
2. 接著，因為他原本是存成binary的形式，所以轉成binary之後要把他split成兩兩一組，再進行之前說的`1`$\iff$`11`和`0`$\iff$`00`轉換，也就是先計算前面提到的random index by `(j * seeds[i]) % len(tmpFlagSplit)`，再看對應的array是00還是11
```python=17
for j in range(len(tmpFlagSplit)):
y = (j * seeds[i]) % len(tmpFlagSplit)
if tmpFlagSplit[y] == 'x':
while(tmpFlagSplit[y] == 'x'):
y = (y + 1) % len(tmpFlagSplit)
if tmpFlagSplit[y] == '00':
finalFlag += "0"
tmpFlagSplit[y] = 'x'
elif tmpFlagSplit[y] == '11':
finalFlag += "1"
tmpFlagSplit[y] = 'x'
```
3. 前面提到他是一個擁有五個列as content的file，然後每一列都會每六個字元用空格隔開的形式，因此我們也要把結果變成這樣才對。
```python=32
finalFlagArr = [[], [], [], [], []]
for i in range(len(finalFlag)):
finalFlagArr[i % 5].append(finalFlag[i])
```
5. Find Flag
透過上述的形式，我們已經把input.txt還原出來了，仔細觀察會發現每一個row，都只有包含兩種字串，舉例：第一個row就只包含`100001`和`110011`而已，而第二個row則只有包含`001100`和`100011`，寫CTF也這麼久了，直覺就是一個binary encoding，試著把`100001`當成`0`，另外一個當成`1`，再傳換成utf-8應該就會產生flag了
## Exploit
```python=
output = open('./PicoCTF/Reverse/Powershelly/output.txt', 'r').readlines()
finalFlag = []
tmpFlagSplit = []
randoms = [45, 59, 18, 32, 304, 5, 277, 291, 250, 264, 223, 237, 196, 210, 169, 183, 142, 156, 115, 129, 88, 102, 61, 75, 34, 48, 62, 21, 35, 307, 8, 280, 294, 253, 267, 226, 240, 199, 213, 172, 186, 145, 159, 118, 132, 91, 105, 64, 78, 37, 51, 65, 24, 38, 310, 11, 283, 297, 256, 270, 229, 243, 202, 216, 175, 189, 148, 162, 121, 135, 94, 108, 67, 81, 40, 54, 68, 27, 41, 0, 14, 286, 300, 259, 273, 232, 246, 205, 219, 178, 192, 151, 165, 124, 138, 97, 111, 70, 84, 43, 57, 71, 30, 44, 3, 17, 289, 303, 262, 276, 235, 249, 208, 222, 181, 195, 154, 168, 127, 141, 100, 114, 73, 87, 46, 60, 74, 33, 47, 6, 20, 292, 306, 265, 279, 238, 252, 211, 225, 184, 198, 157, 171, 130, 144, 103, 117, 76, 90, 49, 63, 77, 36, 50, 9, 23, 295, 309, 268, 282, 241, 255, 214, 228, 187, 201, 160, 174, 133, 147, 106, 120, 79, 93, 52, 66, 80, 39, 53, 12, 26, 298, 312, 271, 285, 244, 258, 217, 231, 190, 204, 163, 177, 136, 150, 109, 123, 82, 96, 55, 69, 83, 42, 56, 15, 29, 301, 2, 274, 288, 247, 261, 220, 234, 193, 207, 166, 180, 139, 153, 112, 126, 85, 99, 58, 72, 31, 45, 59, 18, 32, 304, 5, 277, 291, 250, 264, 223, 237, 196, 210, 169, 183, 142, 156, 115, 129, 88, 102, 61, 75, 34, 48, 62, 21, 35, 307, 8, 280, 294, 253, 267, 226, 240]
seeds = [127, 254, 381, 8, 135, 262, 389, 16, 143, 270, 397, 24, 151, 278, 405, 32, 159, 286, 413, 40, 167, 294, 421, 48, 175, 302, 429, 56, 183, 310, 437, 64, 191, 318, 445, 72, 199, 326, 453, 80, 207, 334, 461, 88, 215, 342, 469, 96, 223, 350, 477, 104, 231, 358, 485, 112, 239, 366, 493, 120, 247, 374, 1, 128, 255, 382, 9, 136, 263, 390, 17, 144, 271, 398, 25, 152, 279, 406, 33, 160, 287, 414, 41, 168, 295, 422, 49, 176, 303, 430, 57, 184, 311, 438, 65, 192, 319, 446, 73, 200, 327, 454, 81, 208, 335, 462, 89, 216, 343, 470, 97, 224, 351, 478, 105, 232, 359, 486, 113, 240, 367, 494, 121, 248, 375, 2, 129, 256, 383, 10, 137, 264, 391, 18, 145, 272, 399, 26, 153, 280, 407, 34, 161, 288, 415, 42, 169, 296, 423, 50, 177, 304, 431, 58, 185, 312, 439, 66, 193, 320, 447, 74, 201, 328, 455, 82, 209, 336, 463, 90, 217, 344, 471, 98, 225, 352, 479, 106, 233, 360, 487, 114, 241, 368, 495, 122, 249, 376, 3, 130, 257, 384, 11, 138, 265, 392, 19, 146, 273, 400, 27, 154, 281, 408, 35, 162, 289, 416, 43, 170, 297, 424, 51, 178, 305, 432, 59, 186, 313, 440, 67, 194, 321, 448, 75, 202, 329, 456, 83, 210, 337, 464, 91, 218, 345, 472, 99, 226, 353, 480, 107, 234, 361, 488, 115, 242, 369, 496, 123, 250, 377, 4, 131, 258, 385, 12, 139, 266, 393, 20, 147, 274, 401, 28]
result = 0
for i in range(len(output)):
fun = int(output[i].strip()) ^ result ^ randoms[i]
result = int(output[i].strip())
tmp = bin(fun)[2:]
tmpFlagSplit = [tmp[i:i+2] for i in range(0, len(tmp), 2)]
assert len(tmpFlagSplit) == 30
for j in range(len(tmpFlagSplit)):
y = (j * seeds[i]) % len(tmpFlagSplit)
if tmpFlagSplit[y] == 'x':
while(tmpFlagSplit[y] == 'x'):
y = (y + 1) % len(tmpFlagSplit)
if tmpFlagSplit[y] == '00':
finalFlag += "0"
tmpFlagSplit[y] = 'x'
elif tmpFlagSplit[y] == '11':
finalFlag += "1"
tmpFlagSplit[y] = 'x'
finalFlag = "".join(finalFlag)
finalFlag = [finalFlag[i:i+6] for i in range(0, len(finalFlag), 6)]
print(finalFlag)
finalFlagArr = [[], [], [], [], []]
for i in range(len(finalFlag)):
finalFlagArr[i % 5].append(finalFlag[i])
for i in range(len(finalFlagArr)):
tmp_arr = set(finalFlagArr[i])
tmp_arr_single_row = " ".join(finalFlagArr[i])
bit = "0"
for j in tmp_arr:
tmp_arr_single_row = tmp_arr_single_row.replace(j, bit)
bit = '1'
finalFlagArr[i] = tmp_arr_single_row.replace(" ", "")
print(bytes.fromhex(hex(int(finalFlagArr[0], 2))[2:]).decode('cp437'))
```
Flag: `picoCTF{2018highw@y_2_pow3r$hel!}`
## Reference
[^pico-reverse-powershelly-wp-IRS-Cybersec]:[Powershelly [180 Points] - 101 Solves](https://github.com/IRS-Cybersec/ctfdump/tree/master/picoCTF/2021/RE/Powershelly)
Sign in with Wallet
Connect another wallet