[SWPUCTF 2022 新生赛]pypy

附件是只有一个pyc文件，版本未知。直接用pycdc反编译。

查看代码块

# Source Generated with Decompyle++
# File: pyAndR.pyc (Python 3.6)


def init_S():
    for i in range(256):
        S.append(i)
    


def init_T():
    global Key
    Key = 'abcdefg'
    keylen = len(Key)
    for i in range(256):
        tmp = Key[i % keylen]
        T.append(tmp)
    


def swap_S():
    j = 0
    for i in range(256):
        j = (j + S[i] + ord(T[i])) % 256
        tmp = S[i]
        S[i] = S[j]
        S[j] = tmp
    


def Get_KeyStream():
    txtlen = len(text)
    (j, t) = (0, 0)
    for i in range(txtlen):
        i = i % 256
        j = (j + S[i]) % 256
        tmp = S[i]
        S[i] = S[j]
        S[j] = tmp
        t = (S[i] + S[j]) % 256
        KeyStream.append(S[t])
    


def Get_code():
    res = []
    for i in range(len(text)):
        res.append(ord(text[i]) ^ KeyStream[i])
    
    return res

if __name__ == '__main__':
    T = []
    S = []
    Key = []
    PlainText = ''
    CryptoText = ''
    KeyStream = []
    text = input('please input you flag:\n')
    if not text:
        print('bad')
        exit()
    init_S()
    init_T()
    swap_S()
    Get_KeyStream()
    res = Get_code()
    print(res)
    for i, ele in enumerate(res):
        if not ele == [
            84,
            91,
            254,
            48,
            129,
            210,
            135,
            132,
            112,
            234,
            208,
            15,
            213,
            39,
            108,
            253,
            86,
            118,
            248][i]:
            print('bad')
            exit()
    print('good')

rc4的特征很明显，拿密文res和密钥key解密，得到： ¡óÓÚÌBS®ª，显然错误。可能是魔改的rc4，果然生成密钥流这里不一样。

EXP

cipher = [84, 91, 254, 48, 129, 210, 135, 132, 112, 234, 208, 15, 213, 39, 108, 253, 86, 118, 248]
key = 'abcdefg'


def rc4_init(key):
    s_box = list(range(256))
    print('原来的S-Box为：', s_box)
    j = 0
    for i in range(256):
        j = (j + s_box[i] + ord(key[i % len(key)])) % 256
        s_box[i], s_box[j] = s_box[j], s_box[i]
    print('KSA过程后的S-Box为：', s_box)
    return s_box


def rc4_encrypt(plain, key):
    s_box = rc4_init(key)
    print('RC4解密成功')
    res = ''
    i = j = 0
    for s in plain:
        i = i % 256
        j = (j + s_box[i]) % 256
        s_box[i], s_box[j] = s_box[j], s_box[i]
        t = (s_box[i] + s_box[j]) % 256
        res += chr(s ^ s_box[t])
        i += 1
    print('解密后的字符串为：', res)
    return res

GET

NSSCTF{this_is_rc4}