Archived Challenges - November 2025

59 is a prime number so its kinda cool I guess

ictf{welcome_to_round_59}

reverse image search, you'll see it posted by https://x.com/Koushou_F . If you go to their website you'll see Takaaki Ranch Ltd , this isn't the correct translation of the hiragana, the correct translation is Kosho Ranch Ltd. Kosho ranch is more well known as kosho bokujo, one of the largest thoroughbred breeders in urakawa

ictf{kosho_bokujo}

The photo was taken at shishamo's new home at the padudu club riding at 50-4-1 Awara, Fukui 910-4273 Japan. you can find the address on the the club's website http://padodo.net/content3.html , and you can can find out that shishamo now lives at that club from the owner's blog https://note.com/akio_ichihara/n/n6cfed8d195ce?sub_rt=share_pb

ictf{36.2459,136.2326}

The trick is to notice that dividing any two hints gives you a value R that has "small" residues both mod p and q. This implies that (R-x)(R-y)=0 mod n for some "small" x,y. "Small" here means ratio of two small things. So this is just multivariate coppersmith with three known equations.

from sage.all import *
from Crypto.Util.number import long_to_bytes
exec(open('output.txt').read())

h0,h1,h2 = vector(Zmod(n), hints)
M = matrix([[h1/h0,h2/h0,0],[h0/h1,0,h2/h1],[0,h0/h2,h1/h2]])
x,y,_,z,*_ = block_matrix(ZZ,[[1,M],[0,n]]).LLL()[0]
p = gcd([2*y*h0-h1*(z+sqrt(z*z-4*x*y))]).lift()
print(long_to_bytes(pow(c,pow(0x10001,-1,(p-1)*(n//p-1)),n)))

ictf{wh0_n33ds_0rtho_l4tt1c3_wh3n_y0u_c4n_us3_quadr4tic_f0rmu1a}

monoalphabetic cipher get cracking

ictf{french_horses_deserve_more_love_too}

polynomials of that form are just linear transforms, berlekamp massey it to get the rest of the sequence

https://cybersharing.net/s/d0c031aa67f82a66be6a74eea5d024cc

ictf{https://www.youtube.com/watch?v=ED3uWRn4j5Q}

There is a classic algorithm called prony's method that solves the sparse interpolation problem for evaluations at geometric progression points.

ictf{orfevre_really_mellowed_out_in_retirement_https://www.youtube.com/shorts/OPP0H-rPzfs}

M has (almost certainly unique) eigenvalues c1, and c2, meaning that it can be diagonalized. This lets you setup the polynomial f = a2x^n+1 + a1x^n - b2*x - b1 using the diagonalization and vandermonde representation of M, which contains the roots c1 and c2. The probability that a polynomial has any root is about 1 - 1/e, so the probability that for all 64 samples, the corresponding polynomial f has a root is astronomically low if b1 and b2 are random, so use that to differentiate '0' from '1'.

ictf{weirdo_horse_that_has_silvers_in_both_turf_and_dirt_g1s}

https://gist.github.com/icesfont/a38cf323817a75d61e0612662c6d0476

ictf{HOPE_THIS_WASNT_TOO_H{}