cascade

problem

The best way to solve a challenge is one step at a time.

#!/usr/bin/env python3

flag = input(">>> ").encode()

checks = [(30, 42, b'\x87\xe7\x7f\xab@B\xabg\x9d\xda~\xf7\x93!\xd4\xc1', b'\xe5\xf3A\xeb\xd9)\x05\xe1\x0c\xa7S\x94\xe2F\xfc\xeb', b'\x8e8%\xc4_e\x8b\r\x9c\x01\xa8\xc0\xffnwx'), (38, 31, b'\xce\xeb\x91\x9a\x18y\xe5\x97\xf6D4\x9f\xa5\xb9\xd0K', b'\xe0\xb5p\xa0*\xf7\xd4\xf5\xa8.n2Q\x82\x8b\x9b', b'i&\x99\x19\x8f\x0f\xea\x92L}\xcd\xdf\x7f\xe3\x9a\x1a'), (22, 9, b'\xde\xe18\xa7\xf7\x1f\xbc\xafV\xac\xb1+W\xf1\tk', b'\xca\x16\xe4)\xc6\xec9\xe0\x80\x01\x1f\xae\x00\x12\xde\xbb', b'\xb65\x80\x15\xac\xae\xc7\xbe\xc9\xc0\xb3\xf4\xf9\xd6\xedr'), (42, 27, b'\xc7kS\x1fo\xee\xbb\xc1\x0c\x19\x10]\xb7\xf4\x87\x1d', b'\x95\x7f"}\xf1M\x10k\xb2\xb7\x84XJRu\'', b'C\xf0\xe1\xd2\xdb\xcc\x98+\x96]\xb8r\x80\xf3h\xc0'), (35, 6, b'\xca\x08\xe2q\x17\xcc\x18\xcan\x85N\x18vi\xdb\x87', b'\xf9\xcc\xc2"\xac=\xecV\x18\xc2\x93\xaa[\'\x03\xb7', b'$\x06\xdd~N\xc0c\xfe\xb8,\x00\xcc\x11\x03\x99\xe4'), (2, 40, b'\xdb\xd8\x98%\xdb\xf4o<\xe3s\x94\x1b\x9c\xafM]', b'\xa3A\xb5\xaa"=\x7f\xb8\x1b\xb7h$<\xe6\x81\xa5', b'\xa0[\xf7\xb6\x8a\x01lV\xad\x1b~\xaa\x01Q\xfb\x91'), (8, 23, b'\xe9\x17\xcb\xe8{-\xab\xcf\xb5\xc6\xa9y|{\xc2\x9d', b'\xdf\x9a"\x95Q#\x06\x11_L\xf4\xe4,s\xe7\x01', b'\xc2\x9f\x15v\xdff\x0c1_\x03:-x\xe0\x9a\xff'), (14, 8, b'\xaaX2\xb0}=\x88_\xe1\xa2\xf8\x9bIX\x02\x13', b'\x97\xef\xcc\xf7\xf58M\xdb\x7f\xba\xc8\xe4T\x12+\xcf', b'<i$dS\xfc\x83\xbd\xc8\x1c\xe4\xaf\xa4j\xf2~'), (27, 0, b'\xc3\xf3\xe7\xda/j\x87_ u\xa8\x1a\x15`\xa9\xf5', b'\xf7\xf1D\xf7\xa5R\x07\xf4\x150)\xcc\x0b)6#', b'?~\xc7\t\xf9\xf9\xe5\x1dz\x19X\xdb\xaac\xa2\xa7'), (15, 5, b'\x8a\x8b\xed\xea\xe0\x8b\x04\x9c\x93\xbe\x00\x1c\x90\xf7\xfe%', b"\x94P\ns^m\xc0{5]\x0f\x9e'jcY", b'M\xc2\x17\x04y\x9f%!\x81BP\x02\xf6\xd4\xb6\x87'), (9, 7, b'\xba\xfdmjf\xe2\xd4\xc6\xd0\xf5J2\x8a\x93\x01\xbf', b'\xb4.%\xcd\xc5\x9a%\xb4"Y\xde\\\xcb\xc0\x96\x87', b'\x01\xc1\nN\\\xaf\xbf\xc6\xe6V\xc1\xf2\x06\xd7mC'), (24, 26, b'\x91o\x98\xb9\xd7\xceg^\x89\x14\x08\xc3+~\x9b\xed', b'\xff\xacq\x84\xd6\xf3\xfd\x7f}\xda\xd2\xfcV\x02\xab\xf5', b'\xaa\xa6y=\xb6\x10\r\xfe&x\xfd\xa8Hq D'), (23, 22, b'\xee\x05\xc5\xed{\xd7s\x14\xef\xb2\x97}/r\xf9\xc7', b'\xe4W\xb4\xf1\xbd?\x8aK@!r\x91;\x832\xa7', b'\x86\xae\x17\xf8dP\xa6\xbd\xc0\x14s\xd7\xd4.\xdc\xf5'), (18, 25, b'\xbft2]m\x95\xd2g6;\xdf\x1b\xcc\xf6\xecS', b'\x93\xadm\x1d\x91D\xa8{c~\x19=\xacW\x82w', b'nj\x1e\xc1\xf5\xach\x03\xe9\x1b\xd2r\xe9\xf2\x93\r'), (1, 18, b'\xf7\xff\xdd\x1fJ+\xb2*\x139\xd1\x1d\xfe\xc0K\xf1', b'\xc9\xa5\xa4\xc3\xe9\xc2\x1f\x9d\x1b\xfa\xae-\xaf>\x81\xdd', b'@\x95\xf9\xb7\xe2\xf5\xa4,6\xb6\xff\xc1\xda\xe3\xe5\x19'), (32, 36, b'\x99s\x89\x7fV\xe1\x1e\x03\x15\xfa&a\x8b\x16\xfc\r', b'\xa3%\xbdA\xbez\x7fY\xe7\xb8\x8b\xde\xb2\x03~\xe7', b'/\x1fS\xa4t9\xa0\x80"\x15Xa\x07\x9d\xc3R'), (40, 11, b'\xbf\xa5T\x8aC\xd8\x11\xa8\xc15\x03\xc5@\x9c?\xcf', b'\xa9\x12X\xda\x9b\xd0\x9e\xa5\xbe\xd5\xc5\xea\xc6 \t\xb9', b'6\xe5\xa6YQ\xf5\xaah\n\x82\x84\x18\x03\xef&\xca'), (7, 39, b'\xeb]\xe6\xab\xcf\x17X\x19\xfc\x1d\x1a\xdf\x93\x96\xe2\xa9', b'\xc6c)B\xc0EaD4\x18~\x98]\xab\xdc#', b'\xbf8gX\xc1\x183`{_S\xd9\x0ce\x97\xef'), (17, 33, b'\xacq\xa8\xc5\x17\xdb\x02\x94\x1b\x18\xadVrk\x1c\xcb', b'\xdd\xc7\xe5:\xf5I\x7fPoqW\xc9\xb1?!\xf1', b'\x8a\x9f\x04\xf3\xc1m;^q\xa1\r\xfd-\xd0\xc4q'), (29, 10, b'\xfb\x8b|\xf6"\xc8v\xa6+\x12\\\x19g\xf3\xa8\xd5', b'\xa1+=zj>?K:\xefn\x03G\x0c\xd7\xb5', b'(\xc6\xd0\xfa!\xd3\x99\xe6\xa6\x07157\x92\xc6\xe2'), (31, 37, b'\xbf\x80\xad\x16\xa3\x16\xc4\xefD\xde\x18\xde\xc3\xd0/\xed', b'\xf2\r5r\xfa\x00\xd9+]\xaf\xdd}\\h-\xd7', b'4\xdd\x97h\xa3\x03tNi;\xcb\xe7\n\xedi\x9d'), (25, 4, b'\xa7_\n\xb2\xea\xa6j\xa4u\x8f\x96\xe1V[\xdd5', b'\xb5\xbc\xae\xbbq\xb7 \xc2K\x9bF\x0c\xc3\xb1,e', b'4\xa6\x92\xbcM\x83\x13\x03\xb7\x8b\x9d\xb5\x9fs&\xfc'), (10, 15, b'\x9a\xaf\xfbK\xf5aCE\x0b\x96\xcc2\x97\x9b\xef\xbf', b'\xc1\xb7H#\xf9\x88\x8c\xda\xcdTG\xe1\xc0G\xe6\xa7', b'\x03\x9c\xf1`\xcf\xa4\x9cP?i\xe0R\x12d\xefv'), (4, 16, b'\xfb\xacH\x98\x94\xc8\xa9N/\xfd\xd34S\xc4\xdaW', b"\xe0\xea-j\x01\x86\xc0'\xa3\xd5j\xdb\xc3w\xc0\x8d", b'J\xed\x8f0w\xec\xce\xd2G\x1f\xce\xf8\xca\xdb\xe1S'), (19, 12, b'\xb1jX^z\x1b\xb5\x9dh8\xd5S\xfc\xdc\x105', b'\xdf\xfc:\x84\xfe6\t:\x8d}\xefp\x1d\x10\xb4\xd9', b'\xbb\xfc\xbecr\xa2_\xa4\x18\x88\xf5j\xe6\xa8\xb6\xc1'), (28, 1, b'\xb4r&\x14\x82\xbb\x08\xa3\xfb\x91n\xa9\x89Szm', b'\xfc\xb3\xde\x01\xda\xdc\x1a<\xc6\xbc \xf7,sz\x07', b"lIy\x19+\xa0\xb6'\x95\xbb$\xc4&\xee\xbd\x97"), (39, 34, b'\x9f\x8b\x00p4U=+\xc98M\x93k\xec\xab\xbf', b'\xc3m0W\xff\x97\xaf\xd1\xf3\xb8\x12*\xf5.\xd8\xe5', b'E\xfb\xae\x85\x9d\xc7Xhm\x7f\x037& \x96o'), (33, 29, b'\xce\xc5s\xf5\xac~%\x98]\x0e\xe2\x96\x0f"\xc2\x83', b'\xcc?8P\x9f \xbc\xc1!N\xb3,\xcb\xe7\x18e', b"\x12\xb2\xe2\xc73q\x10\x9c'\x16\x80\x90\xd2\xe3\x0e\xd2"), (5, 21, b'\xa3\xe7@Y\x10\xcf\xd6\x94\x0cSGp\xd1K\x13\x17', b'\xb4c\xd0\x01O\t!\xc0\xd4\xf8]l\xe1p\xb9+', b'Y\x82\x1c\xcf\xd1\x01\x14\xaf\xf3K\xae\xbb\xc0f8:'), (37, 2, b'\xfe\xc8\x9dhfN8/\x8f\xc9\xa0\x89\xdb\xea:\xdb', b'\xf7\x1a\xe0\xd0y\xf7\xf7D8d\xd2\x19\x1b{i\r', b'\xa8\x1ff\xd2i\xaa\xd7[\xf7w:\x16E\xbe\xe0e'), (16, 41, b"\xad'\xe1M\roKg5\ro\xc3`\xcd6s", b'\xe5\xec\xa4\x8cg\x96"\x84\x1f\xb6\xb4\x9e \r\x90\xf9', b'\x9d\xa6\xa1vv\x8c}ipOJlHUD\xf4'), (13, 24, b'\x87K\xee\xb0\x93|\x15\xf7\xc4\x01\x88\xae$\xa7T\x87', b'\xc1T\xdf\xd8\x9aI\xdbz<\x85\xfd$k\xf5\x84\xdf', b'V\xff\xb2\xb6\x1b\x00\xa0\xae\xc3\xd0%\xabcs\xf4\xb5'), (12, 14, b'\xaa8v\xff\xf6\x8ez-\x95r\x95\x16\xe7\x9705', b'\xcb{\xe6,\x0bcj\xbb|\xa1;\xdfQo\xddS', b':\\k\xa7Y\x15\x8b\xff\x8d\xfe\xc9\xbe{\xd5\x8a*'), (20, 38, b'\xe6@\xca\xdc>\xf0\x11\xc4\x08\xf7j\xfb\x0f*\xe0\r', b'\xaeAJX-[1\xfc\xc0\x04U\xe1xW\x0bY', b'_\xcb\xddJ\x01\x97\x03\x8a\xa4\xebh\x1c\xf5T\xa2j'), (3, 28, b'\xa9\xb2\xecW\x81\xe5r\x9e\xbe\x0e\xa5\xc1g\x152\xa7', b'\xee\xa1\xc2i)\xdej\x9b\x9a\x05\xd1\x1c\x1d\xe9\x18\x9b', b'N\xc3Mn\xf4:\x89\x9e\r\xf8\xed\x80\x19\xb2\xef\xfe'), (21, 35, b'\x87\xc5\xefx\x8b\xa4\xe3A\xba\x8d\xf3{!\xb4\xa9A', b'\xbfR><\xbfJt\xee\xeb\xe4\x92\xce\x11o\x00\xb5', b'\x97l\x86\x83\x84\xd0\xbe\xab\xf7\x96\x0e\xe0\xf90e\x1c'), (41, 20, b'\x93\xef{\x0bE\xb6n!R\xb9CxG\x92*\t', b'\xdc\x11\x10x\xfb,\x93\xa1\xca\xc8\x06{>H\x03\xad', b'&H@\x8c\xc5\r\x94\x16\xf4\x10\x9cE\xa0\x8d#]'), (34, 17, b'\xbbG\xa8X\x87,o\xa7a\xa6\x97\x00\x9a\xea\x80\x0f', b'\x83\xbc\xe8\xf7\xbe\xfat\xac\xcey\xd9\x94\x1e\x99wa', b'\x18L\xc4\x87\xf0\xfe(\x9a\xc34\xab54=W\xe0'), (6, 30, b'\x929F\x87\x12\xdd\x0eX\x8f\x1d\xc4\xfdRI\x87\xbd', b'\xad\xda\xa4\x90\x9c9\\\xcb\xcd\x92A\x1f\xeb\xe8\xe4;', b'0\xef\xcb\xef\xf6T\xd6\xea9\xc46\xc6\xef;\xd6\xb1'), (36, 3, b'\xf4\x8b\xe2\xc7\x93\xcf\xcdl\xbd9\xd1\xefp5\x06\x97', b'\x86\xff\xb7\xe3\x1a@\xdeB\x9e\xb7a\xd3Pr\xab{', b'?y\x9c,tX\xd3\xe5\x83y\xfe6p\x9d\xd9>'), (26, 19, b'\xaaIoB%IYa"\xcb\xdfl\x82\xb1iI', b'\x8fU\x9b\xf7\x1a\xbe\xec\xf6\x10,\x1aA\xe1\x92\xa0k', b'*\xa8/\xda\x1b\x83:\xea(\xc9\xb9\x94\xb8j\x93\xd2'), (11, 13, b'\xfc]0\xa8\xba\x973G\x0c\xd1\xb1\xb0\xb8.E\xc1', b'\xb3H\x18l{5\xf0iu@\xfe\xf7\xa1\x92\x06M', b'\x9a\x9a\x9er\xaahw\xcf\xb7\xf6\xb6wo\x08B\xb9')]

print(["Nope...", "Well done!"][all((lambda a,b,m,n,x:(flag[a]*pow(int(m.hex(),16),flag[b],int(n.hex(),16)))%int(n.hex(),16)==int(x.hex(),16))(*i) for i in checks)])

here we can see that each check is a tuple consisting of objects that match flag[a]*pow(m, flag[b], n) == x

therefore, we know that two letters of the flag have a set constraint so that the equations match

fortunately, we know that each character in the flag is one byte long, so we can brute force each set of two characters for each letter in the flag

here is my code golf-ish solution (requires cascade.py in cwd)

print("".join(chr(v[1]) for v in sorted({o[0]: o[1] for p in[max([[(a,_%128),(b,_//128)]for _ in range(128**2)if((_%128)*pow(int(m.hex(),16),_//128,int(n.hex(),16)))%int(n.hex(),16)==int(x.hex(),16)])for a,b,m,n,x in eval(open("cascade.py").read().splitlines()[4][9:])]for o in p}.items())))

it’s also possible to solve it with math but i don’t know how to do that