writeup 攻防世界 Decrypt-the-Message

在阅读之前，请确认是否处于这个地址，这是对本菜鸟辛勤码字最大的鼓励啦，感激不尽~

---

拿到题目，记事本打开，发现是一首诗后面跟着密文，所以想到是PoemCode。关于PoemCode更详细的加解密原理介绍可以参阅我的这篇博客，本文只粗略讲步骤。

The life that I have
Is all that I have
And the life that I have
Is yours.

The love that I have
Of the life that I have
Is yours and yours and yours.

A sleep I shall have
A rest I shall have
Yet death will be but a pause.

For the peace of my years
In the long green grass
Will be yours and yours and yours.

decrypted message: emzcf sebt yuwi ytrr ortl rbon aluo konf ihye cyog rowh prhj feom ihos perp twnb tpak heoc yaui usoa irtd tnlu ntke onds goym hmpq

简要分析：

1. 找关键词
   密文第一块是“emzcf”，意味着：
   e：第一个关键词是诗歌的第(26k+5)个词，可能是[‘have’, ‘yours’, ‘my’],
   m：第二个关键词是诗歌的第（26k+13）个词，可能是 [‘life’, ‘shall’, ‘be’],
   z：第三个关键词是诗歌的第（26k+26）个词，可能是[‘life’, ‘pause’],
   c：第四个关键词是诗歌的第（26k+3）个词，可能是[‘that’, ‘have’, ‘peace’],
   f：第五个关键词是诗歌的第（26k+6）个词，可能是[‘is’, ‘and’, ‘years’]
   这意味着，可能的关键词组合有3*3*2*3*3=162种，每种关键词对应一个解密结果。

2. 筛掉不可能的关键词组合
   密文sebt yuwi ytrr ortl rbon aluo konf ihye cyog rowh prhj feom ihos perp twnb tpak heoc yaui usoa irtd tnlu ntke onds goym hmpq有100个字母，关键词的字母个数应该可以被100整除。
   所以像my be life that is这个组合，有14个字母，不能被100整除，就可以直接不用试了，不可能是正确组合。
   其它组合以此类推。

3. 手动解法的话，接下来就是关键词字母标号，密文依次填进去，重新排列，获取明文内容。具体操作还是参考文章开头给的博文。

4. 直接脚本解密，看下面的步骤。

1.把诗歌和密文分成两个文本，诗歌去掉特殊字符，记得要保留单词间的空格，否则解密会出错。

poem.txt

The life that I have
Is all that I have
And the life that I have
Is yours

The love that I have
Of the life that I have
Is yours and yours and yours

A sleep I shall have
A rest I shall have
Yet death will be but a pause

For the peace of my years
In the long green grass
Will be yours and yours and yours

cip.txt

emzcf sebt yuwi ytrr ortl rbon aluo konf ihye cyog rowh prhj feom ihos perp twnb tpak heoc yaui usoa irtd tnlu ntke onds goym hmpq

2.解密脚本PoemCode.py

# modified by Clover on 2022.05.13
import sys
import itertools
import re
from os import listdir
from os.path import isfile, join

abc='abcdefghijklmnopqrstuvwxyz'

def loadlist(infile):
	tlist = []
	for line in open(infile,'r'):
		for w in line.split(): tlist.append(w.lower())
	return tlist


def decrypt(poem, cip):
	# Load all words of the poem into a temporary list
	twords = loadlist(poem)

	# Load all cipher chunks of the ciphertext into a list
	cwords = loadlist(cip)

	# Get the code rom the first chunk and remove it from the ciphertext list
	code = []
	for i in cwords.pop(0): #get keywords tips
		code.append(abc.index(i))
	# Select only those words specified in the code in a new multi-arrayed list
	xwords = [[] for x in range(len(code))]
	for xcount, c in enumerate(code):
		tlen = c
		while(c<len(twords)):
			xwords[xcount].append(twords[c].lower())
			c+=26

	# Get all possible combinations
	CN=len(cwords)*len(cwords[0])
	for comb in itertools.product(*xwords):
		pwords = ''
		for c in comb: pwords+=c
		KN = len(pwords)
		if CN%KN!=0 : continue
		
		#re-devide the cyber text by CN/KN
		c_text=''
		for i in range(0,len(cwords)):
			c_text+=cwords[i]

		c_text_list = re.findall(r'\w{'+str(CN/KN)+'}', c_text)

		# Rearrange the chunks according to the key
		pcode = [None] * KN#len of pcode is equal to the numbers in keywords group
		count = 0
		while(count<KN):
			for al in abc:
				for pc, pl in enumerate(pwords):
					
					if al!=pl: continue
					pcode[count]=c_text_list[pc]#put cyber-text blocks in the right position
					count+=1

		# Decrypt the ciphertext
		msg = ''
		for c in range(0, CN/KN):
			for word in pcode:
				msg+=word[c]
		print msg

# first argument = poem
# second argument = ciphertxt or msg
if len(sys.argv) != 3: sys.exit(2)

decrypt(sys.argv[1], sys.argv[2])

3.运行python2 PoemCode.py poem.txt cip.txt。运行结果如下，可以看到，虽然经过了关键词组合的筛选，还是有29种可能的关键词组合，需要挑一个长得像答案的。但是如果不筛选的话，就要从162个答案里面挑，工作量更大。
认真看一下，倒数第十行是很有可能的，所以尝试提交一下这一行的数据，耶~ 破解啦~

┌──(kali㉿kali)-[~/AttackAndDefence/CRYPTO进阶/11 PoemCOde]
└─$ python2 PoemCode.py poem.txt cip.txt
uutamlgpetyosoeapdtrwikihrrtonesenolrspriuermbowclcpbfmuhgaoysotpownyuyetiiojokrtondqnhbanoryhhkfyht
ueatmlgtysuoadppetorwoikhrrpeeinlsrtonsrimremboacbufughwclpoyitopowkytsioojnyuerthdnqnhhoyohkyfbanrt
ueutmlgttyseoadpporawoikhrrpneeonlsrtsriimuemboalcbcfughwporyisopowkuytyioojnertthonqnhhnoyahkyfbrtd
ueatlgtutysodapepmorwoinrrpikeenslrothsrimrlboauecbfguhcwmpoyituowksoytioojynperthdnnhhonoyhykfabqrt
uyatmltpsouogpedaetrweikhrptenisrroslonricrembawbfupohmgucloyytopokntisewjiooyurtodnqnhbyhorhfhykant
uyutmlttpsoeogpedaraweikhrpntenosrroslriicuembalwbfcpohmguoryysopokuntiyewjioorttoonqnhnbyharhfhyktd
uyatltutpsoodgpeeamrweinrpiktenssrroolhricrlbauewbfpgohmcumoyytuoksontieowjiyoprtodnnhonbyhryhfhakqt
uyotlesoadgpeatmutprwesnroenisrrolphiktricplbcbfrgohmuamuewoyyeuoytitowjiokpsonrtornnayhdyhfhkhqonbt
uyoaletsoudgpeatmprtwesirokenisrrolphtrnicprbcebfugohmuamwolyyetoyotisowjiokpnrutordnanyhoyhfhkhqbtn
uttaeloeputpsgyodmrawpklornotinreresshriiaeucbfmwulhbocpgmorykooyoiinsujtwyeoprtthnkanhhbonfyhoryqtd
ugetalootstydempuprawroklrnsnepesohtirriioceubfplbacgmmwuhorywyoooieutkyoipnsjrtthanknhrnyhoyhqboftd
ugttalooutspydempreawrpklrnsinetesohrroiioaeubfpulbwcgmmhocrywkoooiesutnyoipjrytthhnknhronyboyhqftad
atmptgpuyooedulaetrsikhrprtiesnoswrlonreremhaowucpfmgibuclobtopjkwnsyeiioyooyurtdnqfhhboorhhytnkanty
utmpttgpeyooedularasikhrpnrtoesnoswrlrieuemhalowccpfmgibuorbsopjkuwnyyeiioyoorttonqfhnhbaorhhytnktdy
atptutgpyodoeuelamrsinrpikrtessnoworlhrerlhaueowcpgfmicbumobtujksownyeoiiyyooprtdnfhonhboryhhtankqty
otpegaydouelatmutrpssnroriesnworlphikrteplhcorcgfimbuamueowbeujywtyoiyiookpsorntrnfahdoyhthnkhqontby
oapetguydouelatmrptssirokriesnworlphrtneprhceoucgfimbuamowlbetjyowsyoiyiookprnutrdfanhooyhthnkhqtbny
gtetyapdpeoulaomutrsrnopeitsroswrlnhikreolcacrwghmpibufmueobwuykytnojieyooipsorthnahodbyfhrtnkhqonty
gaettyupdpeoulaomrtsriokpeitsroswrlnhrneorceacuwghmpibufmolbwtyokysnojieyooipruthdanhoobyfhrtnkhqtny
ifyouthinkcryptographyistheanswertoyourproblemthenyoudonotknowwhatyourproblemisabcdefghijklmnopqrstu
etoyotetpguldampursaoknesnoprrwrslhtireicefcplmahoibgumwuobryoiyeuikjwyooopnsrttanhornhhfhtnykqbotyd
ttoyouteppguldamresapknesinotrrwrslhroeiaefcpulmwhoibgumocbrkoiyesuinjwyoooprytthnhoronhbfhtnykqtayd
putoamypetdugtlaoresriknihetonswrprlsroehuefrmcwclgioabupombjsoitpynyuoywkooeritfonhdqobanythhnkrthy
tteoeputaplgrysodmuapkonotinlrrrreesshwiaecfmwuluhboocbpgmirkoyiinsuojowryteopythnahhbonkfnhtoyryqtd
getootatlrsydempupuaroknsnlprreesohtirwiocefpluabobcgmmwuhirwyoieuokortyoipnsjythanhrnkhntyoyhqboftd
gttooutaplrsydempeuarpknsinltrreesohrowioaefpuluwbobcgmmhcirwkoiesuonortyoipjyythhnhronkbntyoyhqfatd
aetoteltpoygsdrmpuualoksnorprneresrhtiwiuceplmbahfcobgomwuiroyoeuiokjiywtorpnsytkanrnhnhfhohyytqbotd
attoutelppoygsdrmeualpksinortrneresrhowiuaepulmbwhfcobgomcirokoesuionjiywtorpyytkhnronhnbfhohyytqatd
aputampetloysdgtroeulrikihtonrneesrprsowuhuermwclbfcbgoaopmiojsotpnyuoiytowkreiykfondqbannhoyyhhtrht