Trippi Troppa Chaos

  • Category: reverse
  • Difficulty: medium
  • Author: ha1fdan

The baker got infected with Italian brainrot and obfuscated our flag encoder with memes and nested functions. Can you help us find our flag?

Solution:

  1. View trippa_troppa_sus.py with a text editor
#!/usr/bin/env python3
import sys as _tralalero_tralala_impostor_____
(lambda _bombardiro_crocodilo___: [
    setattr(__builtins__, '__boneca_ambalabu_toilet____', __import__('base64').b85encode),
    setattr(__builtins__, '___trippa_troppa_mewing___', __import__('hashlib').sha256),
    setattr(__builtins__, '__tung_tung_sahur_cycle_____', __import__('itertools').cycle),
    setattr(__builtins__, '____pinguino_arrabiato_seed____', __import__('random').seed)
][_bombardiro_crocodilo___] and None)(0) or ____pinguino_arrabiato_seed____(69420)

def ___ranocchio_turbina_function_factory____():
    def ____lirilì_rilà_final_boss_____():
        def _____trippi_troppa_skibidi_____():
            def ______crocodina_gigachad_nested______():
                def _______tralala_alpha_transformation_______():
                    def ________boneca_beta_elimination________():
                        def _________sahur_sigma_activities_________():
                            def __________bombardiro_mewing__________():
                                def ___________trippa_no_cap___________():
                                    def ____________tung_bussin_respectfully____________():
                                        def _____________tralalero_slay_queen_energy_____________():
                                            __fanum_tax_pinguino____ = lambda ___cringe_normie_bombardiro___, ____based_chad_crocodilo____: (lambda ____uwu_owo_tralalero____: [__c__ for __c__ in ____uwu_owo_tralalero____])(
                                                [___x___ ^ ___y___ for ___x___, ___y___ in zip(___cringe_normie_bombardiro___, __tung_tung_sahur_cycle_____(____based_chad_crocodilo____))]
                                            )
                                            
                                            def ____boneca_ambalabu_university____(___x_trippa___, ___y_troppa___):
                                                return (lambda ____bruh_moment_lirilì____: ____bruh_moment_lirilì____.digest()[:len(___y_troppa___)])(
                                                    ___trippa_troppa_mewing___(
                                                        ((___x_trippa___.decode() if isinstance(___x_trippa___, bytes) else ___x_trippa___) + 
                                                         (___y_troppa___.decode() if isinstance(___y_troppa___, bytes) else ___y_troppa___)).encode()
                                                    )
                                                )
                                            
                                            def ____tralalero_griddy_dance____(___x_ranocchio___):
                                                return (lambda ____fortnite_bombardiro_pass____: 
                                                       [___c_crocodina___ for ___c_crocodina___ in ____fortnite_bombardiro_pass____]
                                                )([((___c_sahur___ * 7) % 256) for ___c_sahur___ in ___x_ranocchio___])
                                            
                                            def ____tung_reverse_uno_card____(___x_pinguino___):
                                                return (lambda ____amogus_sus_trippi____: ____amogus_sus_trippi____[::-1])(___x_pinguino___)
                                            
                                            def ____dead_meme_boneca_graveyard____():
                                                ____poggers_tralala____, ____chungus_rilà____, ____keanu_troppa____ = 1337, 420, 9000
                                                for ___i_bombardiro___ in (lambda ___x_crocodilo___: range(___x_crocodilo___))(5):
                                                    ____poggers_tralala____ = (____poggers_tralala____ * ____chungus_rilà____ + ____keanu_troppa____) % (___i_bombardiro___ + 7)
                                                return ____poggers_tralala____
                                            
                                            def ____touch_grass_tralalero_function____():
                                                try:
                                                    with open("flag.txt", "rb") as ____yeet_file_ambalabu____:
                                                        ____cringe_flag_pinguino____ = ____yeet_file_ambalabu____.read()
                                                except:
                                                    return "L + ratio + skill issue + no tralalero for you"
                                                
                                                ____sussy_key_bombardiro____ = b"skibidi"
                                                
                                                ____step_one_boneca____ = ____boneca_ambalabu_university____(____sussy_key_bombardiro____, ____sussy_key_bombardiro____)
                                                ____step_two_sahur____ = bytes(__fanum_tax_pinguino____(____cringe_flag_pinguino____, ____step_one_boneca____))
                                                ____step_three_trippa____ = bytes(____tralalero_griddy_dance____(____step_two_sahur____))
                                                ____step_four_troppa____ = ____tung_reverse_uno_card____(____step_three_trippa____)
                                                ____final_boss_crocodina____ = __boneca_ambalabu_toilet____(____step_four_troppa____).decode()
                                                
                                                return ____final_boss_crocodina____
                                            
                                            return ____touch_grass_tralalero_function____
                                        return _____________tralalero_slay_queen_energy_____________
                                    return ____________tung_bussin_respectfully____________
                                return ___________trippa_no_cap___________
                            return __________bombardiro_mewing__________
                        return _________sahur_sigma_activities_________
                    return ________boneca_beta_elimination________
                return _______tralala_alpha_transformation_______
            return ______crocodina_gigachad_nested______
        return _____trippi_troppa_skibidi_____
    return ____lirilì_rilà_final_boss_____

if __name__ == "__main__":
    print((lambda ___x_tralalero___: ___x_tralalero___()()()()()()()()()()()())(___ranocchio_turbina_function_factory____))

Looking at this obfuscated python code with ridiculous variable names and nested functions, the core loigc is still straightforward.

Key Functions of the script:

  • XOR functions with cycling key -> __fanum_tax_pinguino____
  • Creates SHA256 hash of concatenated inputs, truncated to key lenght -> ____boneca_ambalabu_university____
  • Multiple each byte by 7 modulo 256 -> ____tralalero_griddy_dance____
  • Reverse the byte array -> ____tung_reverse_uno_card____
  • Base85 encoding -> __boneca_ambalabu_toilet____

So here is the encryption process:

  • Read flag from “flag.txt”
  • Create key by hashing “skibidi” + “skibidi” (SHA256, truncated to 6 bytes)
  • XOR flag with cycling key
  • Multiply each byte by 7 mod 256
  • Reverse the result
  • Base85 encode and return
  1. Generate reverse script:

To decrypt, we reverse each step:

  • Base85 decode the input
  • Reverse the byte array
  • Inverse transform, multiply by modular inverse of 7 (which is 183) mod 256
  • XOR with the same repeating key
  • Decodes as UTF-8 get the flag

Here is the script:

#!/usr/bin/env python3
import base64
import hashlib
import itertools

def reverse_engineer_encryption():
    # The encrypted output from the challenge
    encrypted_b85 = "qjuA_QZVI_ua24NQ}fM1hX4ecdyVShKb2vJjeQJ@Jz=zws0^9Enr1fR+Em_5w2j=p4)2<#m3EZ?m3Oo@"
    
    print(f"Encrypted (base85): {encrypted_b85}")
    
    # Step 1: Decode from base85
    try:
        step_four_data = base64.b85decode(encrypted_b85)
        print(f"After base85 decode: {step_four_data}")
    except Exception as e:
        print(f"Base85 decode error: {e}")
        return
    
    # Step 2: Reverse the "reverse uno card" operation (it's just reversing)
    step_three_data = step_four_data[::-1]
    print(f"After reverse: {step_three_data}")
    
    # Step 3: Reverse the "griddy dance" operation (multiply by 7 mod 256)
    # To reverse: we need to find the modular inverse of 7 mod 256
    # Since gcd(7, 256) = 1, the inverse exists
    # 7 * 183 = 1281 ≡ 1 (mod 256), so inverse of 7 is 183
    step_two_data = bytes([(c * 183) % 256 for c in step_three_data])
    print(f"After reversing griddy dance: {step_two_data}")
    
    # Step 4: Generate the XOR key (same as original)
    key = b"skibidi"
    # The key derivation: sha256(key + key).digest()[:len(key)]
    combined_key = key + key  # b"skibidiskibidi"
    hash_obj = hashlib.sha256(combined_key)
    xor_key = hash_obj.digest()[:len(key)]  # Take first 6 bytes
    print(f"XOR key: {xor_key}")
    
    # Step 5: Reverse the XOR operation using itertools.cycle
    key_cycle = itertools.cycle(xor_key)
    original_flag = bytes([b ^ k for b, k in zip(step_two_data, key_cycle)])
    
    print(f"Decrypted flag: {original_flag}")
    
    # Try to decode as text
    try:
        flag_text = original_flag.decode('utf-8')
        print(f"Flag as text: {flag_text}")
    except:
        print("Could not decode as UTF-8")
        # Print as hex for debugging
        print(f"Flag as hex: {original_flag.hex()}")

def test_encryption_process():
    """Test our understanding by implementing the forward process"""
    print("\n--- Testing Forward Encryption Process ---")
    
    # Test with a known flag
    test_flag = b"flag{test_flag_here}"
    print(f"Test input: {test_flag}")
    
    # Step 1: Key derivation
    key = b"skibidi"
    combined_key = key + key
    hash_obj = hashlib.sha256(combined_key)
    xor_key = hash_obj.digest()[:len(key)]
    
    # Step 2: XOR with cycling key
    key_cycle = itertools.cycle(xor_key)
    step_two = bytes([b ^ k for b, k in zip(test_flag, key_cycle)])
    
    # Step 3: Griddy dance (multiply by 7 mod 256)
    step_three = bytes([(c * 7) % 256 for c in step_two])
    
    # Step 4: Reverse
    step_four = step_three[::-1]
    
    # Step 5: Base85 encode
    result = base64.b85encode(step_four).decode()
    
    print(f"Encrypted result: {result}")
    
    # Now decrypt it back
    print("Decrypting back...")
    decrypted = base64.b85decode(result)
    decrypted = decrypted[::-1]
    decrypted = bytes([(c * 183) % 256 for c in decrypted])  # 183 is inverse of 7 mod 256
    key_cycle = itertools.cycle(xor_key)
    final = bytes([b ^ k for b, k in zip(decrypted, key_cycle)])
    print(f"Decrypted back to: {final}")

if __name__ == "__main__":
    print("=== Reversing Python CTF Challenge ===")
    reverse_engineer_encryption()
    test_encryption_process()

Flag: brunner{tr4l4l3r0_b0mb4rd1r0_r3v3rs3_3ng1n33r1ng_sk1b1d1_m4st3r}