[40548F] TsukuCTF 2025 writeup

import string

plaintext = '[REDACTED]'
key = '[REDACTED]'



assert plaintext[30:38] == 'tsukuctf'



def f(p, k):
    p = ord(p) - ord('a')
    k = ord(k) - ord('a')
    ret = (p + k) % 26
    return chr(ord('a') + ret)


def encrypt(plaintext, key):
    assert len(key)  len(plaintext)

    idx = 0
    ciphertext = []
    cipher_without_symbols = []

    for c in plaintext:
        if c in string.ascii_lowercase:
            if idx  len(key):
                k = key[idx]
            else:
                k = cipher_without_symbols[idx-len(key)]
            cipher_without_symbols.append(f(c, k))
            ciphertext.append(f(c, k))
            idx += 1          
        else:
            ciphertext.append(c)

    ciphertext = ''.join(c for c in ciphertext)

    return ciphertext


ciphertext = encrypt(plaintext=plaintext, key=key)

with open('output.txt', 'w') as f:
    f.write(f'{ciphertext=}\n')

ciphertext="ayb wpg uujmz pwom jaaaaaa aa tsukuctf, hj vynj? mml ogyt re ozbiymvrosf bfq nvjwsum mbmm ef ntq gudwy fxdzyqyc, yeh sfypf usyv nl imy kcxbyl ecxvboap, epa 'avb' wxxw unyfnpzklrq."

keystream = key[0 … L-1]  +  C[0 …]   (L = |key|)

cipher = plain + key  (mod 26)  かつ  cipher = plain
⇒ key = 'a' (=0) × 8

C[i] = 't' … 'f'   かつ   K[i] = 'a'
└─> C[i-L] = 'a' （自動鍵の仕組みより）

K[i] = C[i-8]      (i ≥ 8)
P[i] = (C[i] – K[i]) mod 26

??? ??? ??joy this problem or tsukuctf, or both?
the flag is concatenate the seventh word in the first sentence,
the third word in the second sentence, and 'fun' with underscores.

import os
from Crypto.Cipher import AES
from Crypto.Util.Padding import pad
from flag import flag


os.system("openssl genpkey -algorithm ML-KEM-768 -out priv-ml-kem-768.pem")

os.system("openssl pkey -in priv-ml-kem-768.pem -pubout -out pub-ml-kem-768.pem")

os.system("openssl pkeyutl -encap -inkey pub-ml-kem-768.pem -secret shared.dat -out ciphertext.dat")

with open("priv-ml-kem-768.pem", "rb") as f:
    private_key = f.read()

print("==== private_key ====")
print(private_key.decode())

with open("ciphertext.dat", "rb") as f:
    ciphertext = f.read()

print("==== ciphertext(hex) ====")
print(ciphertext.hex())

with open("shared.dat", "rb") as f:
    shared_secret = f.read()

encrypted_flag = AES.new(shared_secret, AES.MODE_ECB).encrypt(pad(flag, 16))

print("==== encrypted_flag(hex) ====")
print(encrypted_flag.hex())

import os
from Crypto.Cipher import AES
from Crypto.Util.Padding import pad
from flag import flag


os.system("openssl genpkey -algorithm ML-KEM-768 -out priv-ml-kem-768.pem")

os.system("openssl pkey -in priv-ml-kem-768.pem -pubout -out pub-ml-kem-768.pem")

os.system("openssl pkeyutl -encap -inkey pub-ml-kem-768.pem -secret shared.dat -out ciphertext.dat")

with open("priv-ml-kem-768.pem", "rb") as f:
    private_key = f.read()

print("==== private_key[:128] ====")
print(private_key[:128].decode())

with open("ciphertext.dat", "rb") as f:
    ciphertext = f.read()

print("==== ciphertext(hex) ====")
print(ciphertext.hex())

with open("shared.dat", "rb") as f:
    shared_secret = f.read()

encrypted_flag = AES.new(shared_secret, AES.MODE_ECB).encrypt(pad(flag, 16))

print("==== encrypted_flag(hex) ====")
print(encrypted_flag.hex())

==== private_key[:128] ====
-----BEGIN PRIVATE KEY-----
MIIJvgIBADALBglghkgBZQMEBAIEggmqMIIJpgRAaa2HTyQm2vmmDmw5eheMJp6g
Jm3scrIloNZZF2eKncQZfPyppNNNOwAV3WY
==== ciphertext(hex) ====
73e322ebc019d4c299e4e270b66d27c96e3cef69834d7fde38c6d7d2f3c3cedeb94f3414b4023e65924b498dc5a314c46390270387001282774702af9482220b92560caa7e304fc499257acefafa860bdd0522239ce7df3b0ecf04fa4dca2697788e2f733576fa1015c7927d6f7a765970e97203fd48a17bf56ba86d23e234100f74092b3a2c8c1a88444a5454174b526121bc1dceeea1d8a1fb2e2b5f88ead8ea03af10d95fe34e6277678b6b907007f256bb12614699109139be3d72ce94b143a3f61cc35fee36b70893153e28b21002df4835af9aff43c36b873a430b049db97b75cea1628984e8dc912e511d9a358621e6d0f9762df7301b6e22d9237deedc1a72a0068ae84d9446827daf59e8e8728e0c46d149a2d4c4fdb67bfe8e39d7acbdc384f560f7f2ea253b350e80124098fc923e5bf9fc5d385858f4ecbb46130e55a2ff704b2d7b69e5d9b3f9fd3c0ef5bf9a7e17e095206de6d8254fae8f5cb5ac1f8fef51a23a65a33ca91d027e2977931f6716320a0f6ad6962a162c456ef9482ea6f59bff0ea264efc1072d9edfb6536b2a7aa67cb618512048fff844e6c82d02fc3e3bcd6896e1e35ab8e47e9abf4de6900850fad7732c4f56553698ce7cfdaa01aa1cae2fc88ca0043c94d22a5c42f1893816571e82d6a3b66b8f835f811a085381388cfe5c36428eaae7a4e664bb0c4c00e0387d9e74f5041c37b349c976e169c9703d4d3c6eea3d26cd43eb38e0661cbd8687056820cb320df5421d5268c2e9645f0492033c713256bdd5e79cebd3efab8c859426bb6989c70aa0639d583c370446a1271c32abd9079e0aa88ede2b158261db39ae5d2d189fced9406a9dc5329a8b959bdd4e245ea1f8be2d5516cbd5777b64e09bd69ba07997e1a72fdb03ba2620a1c90d7a654eff545c49a8196e0ab93218d6cfb36b1cd0125900e26dd6688aa400d3d7684182a6011217469795a381b5bb7fbc805b28acd097a149649cb601ed571d529a9a8d45d3ab4d41e3e3d8e136d3b7fb1d571c44b4848e5b56dee14b0f431a5c4f417af6790f3b6df281974c4f9340b90e3f1880ee9c719ea1b7bd12356045f9ce25cbd24769aa1acabfee8d7c8e57f0d876f45ebefa5871bc0c10e0e706a7703ed856f3da904edf3a6d472321844b681d5f0c98a4b0e178eb6096d36ce90334d6df6f4ed877852a6f45ade4eeadf72cccdcf342eccd8d1b2322b83047fd256e7a7152802efc4577e3a90c714a7b2af352efe9111c149c8fbaa71bca6d515ec4e9529b5a55d9309378e0698c7c33e85e3425bfda177ec1aa1d81e402ce54405700dc7df9d4688cfa98e53657f7e4c8db52bec306a7e07b73fc26ce4a48888e65c80a4af8ec8251abbbd5521f0b098e5a8f43112fe9d96feeb51bcbedc19dd38d0f4def5be292411a5668d329bb0b74cc6a8526291421b9490bf29dcdc8f0072c7391434cf30f29c007c38f3ef31ffe774f4d9460bd743e4ce65b0617aa52a30914e733257f4b6a80e1f6aff06c342f8dd30532621db7df
==== encrypted_flag(hex) ====
fd302c76946654e6e469a4656b90a8d60fb3492ed8c2238350e8e833a35b3587

import os
from Crypto.Cipher import AES
from Crypto.Util.Padding import pad
from flag import flag


os.system("openssl genpkey -algorithm ML-KEM-768 -out priv-ml-kem-768.pem")

os.system("openssl pkey -in priv-ml-kem-768.pem -pubout -out pub-ml-kem-768.pem")

os.system("openssl pkeyutl -encap -inkey pub-ml-kem-768.pem -secret shared.dat -out ciphertext.dat")

with open("priv-ml-kem-768.pem", "rb") as f:
    private_key = f.read()

print("==== private_key[294:] ====")
print(private_key[294:].decode())

with open("ciphertext.dat", "rb") as f:
    ciphertext = f.read()

print("==== ciphertext(hex) ====")
print(ciphertext.hex())

with open("shared.dat", "rb") as f:
    shared_secret = f.read()

encrypted_flag = AES.new(shared_secret, AES.MODE_ECB).encrypt(pad(flag, 16))

print("==== encrypted_flag(hex) ====")
print(encrypted_flag.hex())

==== private_key[294:] ====
duCDHV8l8e03uLKAf8MJgR2IbHujeYwiPkaHjkGz83AE0FIWSmgIxgVr6F
GjqJBwCTdiNokHJQwL/1WVuoTJqNETtx0mE35gmOSotUOa+9OWX5a1HPe3GCUrY5
+WavSclu4683uY8j+WvG/Bi8K0pHG89KPBn5YFLGmReNlZNmVa14dn6cW43GmcGl
DJRLCW+FohR7M6rKxpR4gzIPHIensxEoNKtjSHFF8U2LusJi2MWqAUhNNyMVJmfS
dSlUpp/JM0rWxBuS+38vxXJL4q+v1rrApbleNbY1yJnl9xaCQ3k1pmgFSiFHO27Z
yo69iw3usq+4kGhmHJYvARUPkHhKUhiHg5Ttwn0spaihU7TTjLHqkMWW5CqFe0ec
5rdSBsu7tzNVkKcpuGzKYWJr+GBBzAu8sKDGG4hpIgkRcACtUwCKwQxfOruBEcXz
u0pu13yAMivDolM4kM+PI33Ex6BgJhJ7m1ID0EbX8BJVKAbVsVU9EahFclNG9XYz
5Z2HhxiM1FiHuaYbKBEqRRpgucV06mFWGg5U8DAplh4coGMckDqWUULkZiU5GFw/
6549aFg5URfVSFJSeJKY5yiclC8EwKIW3JwbzBWIdLb2lRlHNIf20ZA92HXc0Y2V
4qhFXDmJJ3PFW62kQqDAkhi1VV9LsULTB14OFjLKsrDaFVOpmx2qyj4te6Th1TyA
ecUlckzh+V1XM2yl1aBcZBUpAaMEtA9afI+sVHwjq7sGkU6uN3G9YUt0M28A/amx
HCXJy8U58mYMFzIPQiSfJ5+/+ZXP3BW7kGf4EA1tPIG5NY5kWqJIWg22MAKitVUT
trTyaqALxpOSBS3fN4wQ2XCQB5uT2T516CCm+E4GYTBn8adJbHQFbAYs0yRJJa2z
k60sQqEse7QwHFXaGb+/QqmPxD6B1Fw3dpBqFSs4PIwQIg2c1YkPpTgy43h/EStO
tn2LexiQRYEucKaQUxAlRqpbRSTJQ8NmlkVUd5X8t42PYEAO8aDN8LEL+QT42Xat
pY09xlk/hT+E9cShEaEqi1p1AjFZh3Y8OnLVeWzpSR0kegNE6qNqZGtXxVtzO3s/
04MZyaoO4pCAYyKxRqkLSm2o9r6LimLG04gQsLLFmgCLeZw/+SXAqclj51MpdyvT
VV2kxwoS0o82gCcQ6TNYgmPSWYqno150aHG3IG3PlW+L8lB6llYOV5fbmsWoRHj4
9mTEIJ9GXE45k5zA9IAhA8nH4yu89cl6sRA2kmgn15kYQlCNm5SCdRz+NnxuKEaY
u6HMvKzbYpYj41bh6V5FbJCQoGgXNYVi8SoIBgczPEApyXkHFyqbYz+1yxOQ3G1V
CCRRZIuzKRKm5K59dAvNIFllWY7OqRh6tTKkjDkRi20FtzvAMJFFUX7YUD5e5iHS
8JSbApcHSY5DlZmXtaAFKa8cchwLpHwFdFLS6YBJmK4tizZc5EGJl0pjQ3pSUQ3K
QXNzMjjsKb/tg48ISBlzGboKg1slWohYOyOTNVeB5S+MPMbgYmB0FbEoDGjFmYEB
JVPgeqtjCAV3fG/F8sJuBXcZJE3cK64ZnBP0imovUF/wcWq852Ell1bLrG7lqnXn
JFpkiyMh55xGixjXrHVRA2LwCw9pyqK6C3whAIUaxHBPNaNRBnKBgQkjhbetgp4q
nDv0+JfOl6Xwi7+iYEczlCOG4FS5RgQ96bZbN6k8FpTmzF/M7DIOlWb4vAlSirQM
m3x08GCsUoNO8kLQA7KK6akk4yJ0Ch67c7u+EXtIwy50VTupu1jSzCIa4715BVRT
lh63QgvAM0LT+gFolHdng5+hIyahoT9/ohOry5l1aC3aoQ4X1HRau38eACIC6baP
d0D3Ya2wC32j0momzDqlQqJXabOZd52wfIYB+84/ABjwEL3u0Zf0IczfxKiX2Lna
iC1de7KPyqRNZFVG6r5AlTxozHdDcsdFW0/mV8SFOJZXoEdWVrJF1Xt/NXSIuUhG
uB6mmABfYoNvOlrbkCi2eoYG6BeiFxsTlmSkmK5Qq6eRgpRAsnwcQL2WwAxf8I8g
rEy4d1e/yy8UXK4/4hacEFXWwSsyhsxH2GTkGYb6WmFIghJwhGSfaSncdJ984CWm
BrosfHLDsz9tOZBuwWOG00dAKVok8LGbe3Y1CE/+EZZ7WAVPRxiYaqtmN1OYeEdF
/GFFIICj+BDTqon5AXGvw0f6eZKTwYdc1ACiqDy2fHaDZEKT5oQpC1AdYxCPlVTa
rAHFdj4/qsQHTKsJ1HHH4Ds6IE02o2x7y25VlDScO3y/ZldlzEABsAUFhmSeUZby
FUkbIlU8cnmmO1pT8zMGBlWlqIFdGU/eyqXYW8+7tS2W/BJudAKsFHpbWoHfIBP1
6jDv+R8XxsuxEWis1QPj9Q7wCxnB2pRkos0Icq4sZ6KLBWpgY0ZIu0omNwwoVGNZ
KUMomAJU2Q++W0sv+2Iz5pzdeWWYo57D1FHh9nGzoBMi0ieo+VKTtVTD2S/6OUhe
USCO0o9UYFwChR7DJDUa1zziWjM2aqG8DKKjsr9VmyrPgh5PyhXFxRFj5m3HVS7p
Mq2hOrhz6mbFIqwNxsvx6j8irKlYKJs56AO4SQew0AUCSr4q603JZVrFLEfl2Ks1
OZfvoBSMCgNXnGZswIjU3CUKOF7RkRnqnGCrzFDRd24Yt69ONVtZ2HTZCI86sSh7
snBnzKGmgqbmW6+i8mem+3Xg8zpLRZrE8jl61zN5A2hUs598SKsw1hFNsg4cBZ1u
q4Wwx8EG1GzdtRJzACTluiQ7do8MVHp3InYdgAZm6bKYkWsN2glv9a3ke2zRgTZd
iaTLbHt8V2jwqz2r1Q7DijaePMnbe23cwJF4lp4mKFixFxcqjLrP+RXN2UK3AXHg
GVhTmQ7YIRLtZ2jd6FVmQCI5VAkI2R3QQSEA8sSEtA5uh2O20YpPnMI6tXgRqz/p
aUJYBQLyy6VG+PSMcE0cFeJvdYVrN8GI19CBp8FPIRJAyPHEirs3bBaYg7HErSdA
wLRe9y0bYJr9ZD2GZufLacz6Gtl7zqXAFHHTq5iuh5IguoS6Udc/bDIkY2gZZsek
xUg=
-----END PRIVATE KEY-----

==== ciphertext(hex) ====
9956e487373793da71f9e70ea79a13a471bf7d512cb8b438c61532984a5309ed6ab6e663b615ff05b0ce792584db86dd82ca63092db11bd86b231daeb6fe5bd9e81c9dc27fcf84e71b843c2f7ed9048c9f2abd44e1244b8f9abf52b04651d4e4bbb40cd075b66b7ecf5bbd67082d9451c66cc5ffb9416b79db1eeece91173d0d11232d3e2ae3d59a50018b29553d6d2393ac4224a1fd94fa2a5e3d7d03b426ab7280385532724e19be44fc8bcdd4ea75853fd738163826e9a5359c6d5760c0e5de5907fa2b32256363114b3b4a785ea13e7273fbd8ffec00633523983e1bf9e3eab1b4cc86e9c22d104e3bc747a8179e70161ed21bdff6372324d0f726cea443b0f268e0df7f233efb2f51969115f00ba4af5ca69f0c1c65ca85cbad582d3ceb3c829615c1396808eb0da192560343f7c8bb5b71fca15b6c3bdcc5ea416148f569bb4d46f170f267356a91d4b6c1aa53fab54a788a549eedb7e349b332c417ea0000766bcb00150e02a0eb18b0f997be1badbbb62980ba4ae434c44560e01c75459e99799afaa07fcb880d619ccd19b98b1d1ac1b748ca89db0b019ddaccd21007ffc6965fe33434c91d91d64df237affd68133de514870159a8ef2a044d97ee1bc3b124bd3533aee83fc335b926b290e4d34c834a19ef80732f920783342e4f81721bde62e92334aaa67300ca301e1ccda61177e984d29629d2abc110bb90129697cceaedd268d121e34122952db4fce7af54dd0cffbcdd8ba63f4fe7c9d6d2244fcdbebe29a8b4e55384cd9b561a563a5f45a4f71cbbee5ec25b9fbcb47b112da7571cc3d021af31049b69f182b4ba7f230259a045c2b08bad89419ae37b1590ff405194f4b987d33e61435a40ffc1a9f9d9f0f5e9915ddbc5b7f0e4cc72d188c6c12593b38d96f98e7d4dfbcada0202a2b32226f9e111cc22c73a7d55e154d05115beab3b700fe62dbda9f86b5d8a4f5a758e4b913c3f96f11bc8768df25a851b0c817140d76cf75e5b045677b74208202c1827e66f4b81d5cd3fb93cc71dc7704f744dd278fd765959206fa0bb0b844db07ee040bc8d5563b797c8ecffb545e8c22dec89973f482ac6a29757cf5d51d2abe8f5abf074df8dac19a8d3b5804fe82a90694ba44a730ae12be00ff3dbfb1a55c3bda2bd93421dfd9f72025cf79bd8d6c5f8ff6d93895fd9743621eb141c00550a63b48f483ba5a67dd2b2ceeb4c126979a73433812a328405ee8402cc40b0b57cb8fd2c01496be77206a460cec5bca75a4d447665e0f150776b6966c3965bab258df823dba65fd9def5501623e88bc2e7cf4036792b4904a4932595a813f7c8e2b6e108d64e49d7ba5ea2949a40b2373596aec716375c2b5387e670cfe944db49b8e2eea00237216634c57a17fc1eb968158ebc502a599399a59a8eed3e11b9e02a12c3616b818d6c3d9d081d730d2ef62ee9b7337b995308c8b58baac95b38db76b9ea653f624b4d3e9ee1db51bc0204cc553763589d5a861510489141c71424c538592e8f7c75a55103a353
==== encrypted_flag(hex) ====
bed3b7d98a1058fe7059c15bffac13205a39bc22263ef9110b5bde66f10c847fbe2eae728a1a427d99bbee0b48c9fd76

import os
import secrets
import signal

FLAG = os.getenv("FLAG", "TsukuCTF25{dummy_flag}")

class xor_tsuku_shift:
    def __init__(self, seed):
        self.a = seed

    def shift(self):
        self.a ^= (self.a  17) & 0xFFFFFFFFFFFFFFFF
        self.a ^= (self.a >> 9) & 0xFFFFFFFFFFFFFFFF
        self.a ^= (self.a  18) & 0xFFFFFFFFFFFFFFFF
        return self.a & 0xFFFFFFFFFFFFFFFF

def janken(a, b):
    return (a-b+3) % 3

rng = xor_tsuku_shift(seed=secrets.randbits(64))

signal.alarm(600)

print("Tsukushi: Let's play janken!")
print("Tsukushi: Win 294 times in a row and you'll get the flag.")

for challenge in range(300):
    print(f"Tsukushi: You have {300-challenge:03} tries.")
    for round in range(294):
        print(f"--- Round {round:03} ---")
        tsukushi = rng.shift()
        you = int(input("Rock, Paper, Scissors... Go! (Rock: 0, Paper: 1, Scissors: 2): "))

        if you != 0 and you != 1 and you != 2:
            print("Tsukushi: Hey, you cheated!")
            break 

        result = janken(you, tsukushi)

        if result == 1:
            print("Tsukushi: You win!")
            if round != 293:
                print("Tsukushi: Let's go to the next round!")
        elif result == 0:
            print("Tsukushi: Draw! ...But If you wanna get the flag, you have to win 294 rounds in a row.")
            break
        else:
            print("Tsukushi: You lose!")
            break

    else:
        print("Tsukushi: You won 294 times in a row?! That's incredible!")
        print(f"Tsukushi: So, here is the flag. {FLAG}")
        quit()

else:
    print("Tsukushi: GGEZ, Bye!")

const express = require("express");
const bodyParser = require("body-parser");
const process = require("node:process");

const app = express();
const HOST = process.env.HOST ?? "localhost";
const PORT = process.env.PORT ?? "28888";
const FLAG = process.env.FLAG ?? "TsukuCTF25{dummy_flag}";

app.use(bodyParser.urlencoded({ extended: true }));

function chall(str = "[1, 2, 3]") {
  const sanitized = str.replaceAll(" ", "");
  if (sanitized.length  10) {
    return `error: no flag for you. sanitized string is ${sanitized}, length is ${sanitized.length.toString()}`;
  }
  const array = JSON.parse(sanitized);
  if (array.length  0) {
    
    return FLAG;
  }
  return `error: no flag for you. array length is too long -> ${array.length}`;
}

app.get("https://zenn.dev/", (_, res) => {
  res.send(
    `How to use -> curl -X POST -d 'array=[1,2,3,4]' http://${HOST}:${PORT}\n`,
  );
});

app.post("https://zenn.dev/", (req, res) => {
  const array = req.body.array;
  res.send(chall(array));
});

app.listen(PORT, () => {
  console.log(`Server is running on http://${HOST}:${PORT}`);
});

const express = require('express');
const bodyParser = require('body-parser');
const fs = require('fs');
const path = require('path');
const yaml = require('js-yaml');
const app = express();
app.use(bodyParser.text());

app.post("https://zenn.dev/", (req, res) => {
  try {
    if (req.body.includes('flag')) {
      return res.status(403).send('Not allowed!');
    }
    if (req.body.includes('\\') || req.body.includes("https://zenn.dev/")
      || req.body.includes('!!') || req.body.includes(')) {
      return res.status(403).send('Hello, Hacker :)');
    }
    const data = yaml.load(req.body);
    const filePath = data.file;

    if (filePath && fs.existsSync(filePath)) {
      const content = fs.readFileSync(filePath, 'utf8');
      return res.send(content);
    } else {
      return res.status(404).send('File not found');
    }
  } catch (err) {
    console.log(err)
    return res.status(400).send('Invalid request');
  }
});

app.listen(3000, () => {
  console.log('Server listening on port 3000');
});

from flask import Flask, session, render_template, request, redirect, url_for, make_response
import hmac, hashlib, secrets

used_tokens = set()

with open('./static/seed.txt', 'r') as f:
    SEED = bytes.fromhex(f.read().strip())

def lcg_params(seed: bytes, session_id: str):
    m = 2147483693
    raw_a = hmac.new(seed, (session_id + "a").encode(), hashlib.sha256).digest()
    a = (int.from_bytes(raw_a[:8], 'big') % (m - 1)) + 1
    raw_c = hmac.new(seed, (session_id + "c").encode(), hashlib.sha256).digest()
    c = (int.from_bytes(raw_c[:8], 'big') % (m - 1)) + 1
    return m, a, c

def generate_round_digits(seed: bytes, session_id: str, round_index: int):
    LCG_M, LCG_A, LCG_C = lcg_params(seed, session_id)

    h0 = hmac.new(seed, session_id.encode(), hashlib.sha256).digest()
    state = int.from_bytes(h0, 'big') % LCG_M

    for _ in range(DIGITS_PER_ROUND * round_index):
        state = (LCG_A * state + LCG_C) % LCG_M

    digits = []
    for _ in range(DIGITS_PER_ROUND):
        state = (LCG_A * state + LCG_C) % LCG_M
        digits.append(state % 10)

    return digits

def reset_rng():
    session.clear()
    session['session_id'] = secrets.token_hex(16)
    session['round'] = 0

TOTAL_ROUNDS = 10
DIGITS_PER_ROUND = 7
FLAG = "TsukuCTF25{**REDACTED**}"

app = Flask(__name__)
app.secret_key = secrets.token_bytes(16)

@app.route("https://zenn.dev/")
def index():
    reset_rng()
    return render_template('index.html')

@app.route('/flash')
def flash():
    session_id = session.get('session_id')
    if not session_id:
        return redirect(url_for('index'))

    r = session.get('round', 0)
    if r >= TOTAL_ROUNDS:
        return redirect(url_for('result'))

    digits = generate_round_digits(SEED, session_id, r)

    session['round'] = r + 1

    visible = (session['round']  3) or (session['round'] > 7)
    return render_template('flash.html', round=session['round'], total=TOTAL_ROUNDS, digits=digits, visible=visible)

@app.route('/result', methods=['GET', 'POST'])
def result():
    if request.method == 'GET':
        if not session.get('session_id') or session.get('round', 0)  TOTAL_ROUNDS:
            return redirect(url_for('flash'))
        token = secrets.token_hex(16)
        session['result_token'] = token
        used_tokens.add(token)
        return render_template('result.html', token=token)

    form_token = request.form.get('token', '')
    if ('result_token' not in session or form_token != session['result_token']
            or form_token not in used_tokens):
        return redirect(url_for('index'))
    used_tokens.remove(form_token)

    ans_str = request.form.get('answer', '').strip()
    if not ans_str.isdigit():
        return redirect(url_for('index'))
    ans = int(ans_str)

    session_id = session.get('session_id')
    correct_sum = 0
    for round_index in range(TOTAL_ROUNDS):
        digits = generate_round_digits(SEED, session_id, round_index)
        number = int(''.join(map(str, digits)))
        correct_sum += number

    session.clear()
    resp = make_response(
        render_template('result.html', submitted=ans, correct=correct_sum,
                        success=(ans == correct_sum), FLAG=FLAG if ans == correct_sum else None)
    )
    cookie_name = app.config.get('SESSION_COOKIE_NAME', 'session')
    resp.set_cookie(cookie_name, '', expires=0)
    return resp

if __name__ == '__main__':
    app.run(host='0.0.0.0', port=5000)