$ cat writeup.md…
$ cat writeup.md…
sekai2026
Task: static single-page web app with 6 Nikoli logic puzzles (tapa, nurikabe, fillomino, shikaku, skyscrapers, kakuro); each solution grid derives an SJCL key that decrypts a hidden ASCII-art heptomino. Solution: solve every puzzle with z3/OR-Tools, reproduce the app's canonical-token logic in Node to decrypt the 6 pieces, then assemble them as a no-rotation jigsaw into a 7x6 rectangle that reads the flag.
$ cat /etc/rate-limit
Rate limit reached (20 reads/hour per IP). Showing preview only — full content returns at the next hour roll-over.
Six (or seven?) handcrafted logic puzzles. Best enjoyed with a pencil, not a solver. Connection: https://67-hunt.chals.sekai.team
A static single-page web app presents six Nikoli-style logic puzzles built on
the pzpr.js / puzz.link library, with SJCL for crypto. Every clue uses only
the digits 6 and 7 (the "6-7" / "sixseven" theme). Solving a puzzle
reveals an encrypted piece; the six pieces form a meta "seventh" puzzle whose
answer is the flag.
index.html)Each puzzle element carries two attributes:
data-src — the problem in pzpr URL format (clues only).data-ct — an SJCL ciphertext.The clever part: the decryption key is derived from the player's own solution grid, not stored anywhere. When a puzzle is solved correctly, the app walks the board in a fixed parity-based order and builds a canonical token:
| Puzzle | Token source | Cells/borders used |
|---|---|---|
| tapa, nurikabe | cell.qans (0/1 shaded) | parity-0 cells |
| skyscrapers, kakuro | cell.anum + 1 | parity-0 cells |
| fillomino | border.qans | border.isCmp() | parity-1 borders |
| shikaku | border.qans | parity-1 borders |
That token is the SJCL decryption key. Fixed payload parameters:
iv = "sixsevenSIXSEVEN", iter = 6767, salt = "sixseven+67=".
A correct solution → correct token → SJCL decrypts to an ASCII-art reveal of a heptomino (7-cell omino) with one letter per cell. A wrong solution throws during decryption — this is the key to disambiguation (see kakuro).
...
$ grep --similar