招新赛WP（crypto）

1.ez_caesar

题目

from secret import flag
import random

assert flag.startswith('s3c{')

N = 128
key = 'qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM1234567890{}_#&'

def encrypt(m, a, b):
    c = ''
    kt = random.getrandbits(len(m))
    for mt in m:
        tmp = key.find(mt)
        k = kt
        for _ in range(len(m)):
            tmp = tmp * a if k % 2 == 0 else tmp + b
            k = k // 2
        c += key[tmp % len(key)]
    return c


print(encrypt(m, random.getrandbits(N), random.getrandbits(N)))


# VUah8w0ymUV8#0oV0V802djJ#Jsj2dN0#2Nuc2D

exp

已知明文求解密文的问题，明文已经给了“s3c{”。我们可以通过明文来爆破出题目中的随机数。

然后再写反解密一下

这里用到了模运算的概念，tmp要乘a再模len（key）下的逆元.

(a * x) % m = b

x = (a_inv * b) % m

(乘法逆元的实际应用)

from Crypto.Util.number import *
from gmpy2 import *
N = 128
key = 'qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM1234567890{}_#&'
m1='VUah8w0ymUV8#0oV0V802djJ#Jsj2dN0#2Nuc2D'

def encrypt(m, a, b,kt):
    c = ''
    for mt in m:
        tmp = key.find(mt)
        k = kt
        for _ in range(39):
            tmp = tmp * a if k % 2 == 0 else tmp + b
            k = k // 2
        c += key[tmp % len(key)]
    return c
a1=[]
b1=[]
k1=[]
for a in range(100):
    for b in range(100):
        for kt in range(100):
            if encrypt('s3c',a,b,kt)=='VUa':
                a1.append(a)
                b1.append(b)
                k1.append(kt)


def decrypt(c, a, b,kt):
    m = ''
    for ct in c:
        tmp = key.find(ct)
        k = kt
        for _ in range(39):
            tmp = tmp * invert(a,len(key)) if k % 2 == 0 else tmp - b
            k = k // 2
        m += key[tmp % len(key)]
    return m
try:
    for i in range(len(a1)):
        print(decrypt(m1,a1[i],b1[i],k1[i]))
except:pass

2.treasure_rsa

题目

import gmpy2
import hashlib
from Crypto.Util.number import getPrime, isPrime
from secret import flag, E1, E2


def next_prime(num: int) -> int:
    num = num + 2 if num % 2 else num + 1
    while not isPrime(num):
        num += 2
    return num


p = getPrime(1024)
q = next_prime(getPrime(16) * p + 38219)
n = p * q
c = pow(E1, 65537, n)
print(f'n = {n}')
print(f'c = {c}')
# n = 1605247600724752598798254639224215706171506359654961357324428027985787942008103766562745464838961569081446916113769517713344420113584254259000172572811154232107339480903672251992191997458469905064423618888336088652352540882576826988355783159237971043770132628344798937353150930071309347972804118952814447576207066147031238749098842662046825743988208813903138796789940911515825517078554074496474819128789835309636804325132602557092847746454786387067599510769382078521691609970320528531270474091713477040343897269903489441410062592732302402854035415438078656688806905350495825334584533345448091335565792091890185673190424063
# c = 751639057610677013264061431434189083017589908118307247217007533938435229431015858783222167911772848893015518607229280589985711010766459396989232072512314594917029375221335361209036112742388866873824163350886610514973038316512032459352053158417705406031466332440378871927174731975794579894912999936641163063898365134788537389162378185448090279397717831977803284480743612393591614284972981435749362255654561121758163485884075260156288337176713756471879489767416836868661153693157792733142765671887792303181376620864506386820826866340907593080654521498766421056474652652337037121881207188033108746890998208582406826010121861

assert E2.bit_length() == 69
ns = [getPrime(1024) * getPrime(1024) for _ in range(3)]
cs = [pow(E2, 89, n) for n in ns]
print(f'ns = {ns}')
print(f'cs = {cs}')
# ns = [15863230586500684911356384742123404120213699052018048588650392009927565369685497256344682150189923131009586323640507773706997704860898682946308031020361302334248895233255911348365179153799197341744863134926804603973507415697810440916305092395180382239729550833607847524005391137474497849077097574452115379368463540087172800902210822143687014813631366360652583216269138116785489485772437870528892032119729929607857459621078790511144060710035933887337208301078892163837203412081114510143406013892393607932596921308889058909544584619676380766485493114814753878272881866907210235681877689493671668534251778397658670518117, 14144098469438619358682652828507744381697293556670717685553585719665002440476256008471235313826051740009083510860714991201047915737216102220242621674841600987122005914542061963618272275986835928673920375768272390912778741502655909281390948606467847118377641357547931472588836726339758576038273820470879637555458446243401248151675266602656677360819563744765522495640821496694918515669243614141704744848980746101569785439728585144841655665959389460512628800782742764147773150430552859331269667626942993392101897661719871375721143240270211821269260950380944670195863016621594387236339317938305273510719419578308449465183,
27563822879593503938377821960427219022565215631856333510782568496016547757945464794632272818101891677705256471714805217606503652132995136255720639088424576003650628211271025648183600635145895528466199068640094470078526413324708028578289949241288828542143203769199399500669311878391255837977932634772778594526940501234736059441483897017015324765266787399950699732518347518591167932031031320265136158304460199654008895095274754918153773566824931440342525688741289235153882699461549523425169846266597156773535163599640189457171272058311480951820887261040891344076039474315985825984444520336790670313179493074014037981261]
# cs = [3833095607830862948079097323254872789586576953317671099752083261949616608759231291050566542764984974722790226120399722937104503590740358249900089784508490830379531632752169777949200718567033018577184658177019404903817920024468923715441355404672443007723525750768430895425376124679225715687382380114628103058312176343693900115638265002657622618744666247132114654135429040069316368839938881716554901593031901272992940200484460436193699175500376368456706998564064693820008778900344357745691652875500810447147088715289581351501876012044611990972521570253106671158207677490849249612002954497927762168699886110455354481924, 1502420121177211156091634258259634977709023894278792755694473756163084431123774101512866316989917922052023168401167212284219907272528117024670443698990238243030221117004372456475521502350404137469088570170885409265567084376069256924135270283335242133163303599239181417949980292944203204296598188175632723968779672994090788585343302473442389865459398142634104331743517384589200789331489394375604801951994831647339839112698394141328178967516636452592385248135340133712522135715943787590172334743893259621909532456281362868290556461907936774231166936915669816509378419892149164552548131776979706381641477878931403040942, 8992204063713908492214256291861339175525948946919629972908439132005643626148678347198381531633907182877152728077958345519083406637446972079387161726967295886447791613166577391233866583354793842121902234644830640050181130381996083089350911224037154798259291124104894554037604500881250119806371348673833105103600782286898276354573884788251542211434143476774391457587885772379990104835187104619922442613860682792470389490804228050671124495925536024571104944112397143299499508504917890140939438891891453283594000764399193028606955089853654071198909973555844004685149713774167524224100487937899126480545681565581673958854]

M=E1+E2
M=str(M)
flag='s3c{'+hashlib.md5(M.encode()).hexdigest()+'}'
print(flag)

exp

第一步，有一个加密压缩包和一个文档。把文档里的m求出来就是密码。可以用工具，但我建议锻炼一下写代码的能力。

import gmpy2
c=32949
n=64741
e=42667
p = None
for i in range(2,n):
  if n % i == 0:
    p = i
    break
q = n // p
phi=(p-1)*(q-1)
d=gmpy2.invert(e,phi)
m=c**d%n
print(m)
#18429

这段rsa有两段加密，我们需要把E1,E2求出来，再通过md5转换就能得到最终flag。

先来看E1。

由q = next_prime(getPrime(16) * p + 38219)可知，q为p*getPrime(16)+38219的下一个素数，因此getPrime(16)较小，所以我们可以在其取值范围为遍历出符合题目的值,从而解出q。

for i in range(2 ** 15, 2 ** 16):
    if isPrime(i):
        q = next_prime(i * iroot(n // i, 2)[0] + 38219)
        if n % q == 0:
            print(q)
            break

p = n // q
phi = (p - 1) * (q - 1)
d = invert(e, phi)
E1 = pow(c, d, n)
print(E1)
#377312346502536339265

费马分解脚本

def factor(n):
    a = gmpy2.iroot(n, 2)[0]
    while 1:
        B2 = pow(a, 2) - n
        if gmpy2.is_square(B2):
            b = gmpy2.iroot(B2, 2)[0]
            p = a + b
            q = a - b
            return p, q
        a += 1  # 千万别忘了a的自增步长为1

然后是E2。

中国剩余定理简单处理一下，之后开e次方即可。

def chinese_remainder(modulus, remainders):
    Sum = 0
    prod = reduce(lambda a, b: a*b, modulus)
    for m_i, r_i in zip(modulus, remainders):
        p = prod // m_i
        Sum += r_i * (inverse(p,m_i)*p)
    return Sum % prod

e = 89
m_e = chinese_remainder(ns,cs)
E2 = gmpy2.iroot(m_e,e)[0]
print(E2)
#561236991551738188085

#modulus为m1..mk，remainders为余数a1…ak，prod为M，p为Mi，inverse(p,m_i)为Mi的逆元。

M=E1+E2
M=str(M)
flag='s3c{'+hashlib.md5(M.encode()).hexdigest()+'}'
print(flag)

3.Fibo_and_AES

题目

import os
import libnum
from secret import flag
import base64
from Crypto.Cipher import AES
from Crypto.Util.number import *

def Fib(n):
    assert n >= 0
    if n < 2:
        return n
    return Fib(n-1) + Fib(n-2)
	
s = Fib(9999)
m = libnum.s2n(key+os.urandom((len(bin(s))-2)//8-len(key)))
c = m^s
print(c)

def add_to_16(value):
    while len(value) % 16 != 0:
        value += '\0'
    return str.encode(value) 

def encrypt_oracle():
    key = bytes_to_long(key)
    text = flag
    aes = AES.new(add_to_16(key), AES.MODE_ECB)
    encrypt_aes = aes.encrypt(add_to_16(text))
    encrypted_text = str(base64.encodebytes(encrypt_aes), encoding='utf-8')
    print(encrypted_text)

if __name__ == '__main__':
    encrypt_oracle()

exp

题中的斐波那契数列运行不出来，根据我给的hint，降低复杂度。重新写一下递归。

def fibo(n):
    a,b=1,0
    c=1
    while c<=n:
        a,b=b,a+b
        c+=1
    return b

s = fibo(9999)

然后就结束了，后面根据步骤解一下就好了。

先异或运算，既然c=m^s,那么m=c^s,转一下字符串，得到一半的flag，也就是key。

key='s3c{W0W_Y0u_g'

long_to_bytes(key)=9127142690756856755103370403687

#AES解密
import base64
from Crypto.Cipher import AES

# str不是16的倍数那就补足为16的倍数
def add_to_16(value):
    while len(value) % 16 != 0:
        value += '\0'
    return str.encode(value)  # 返回bytes

#解密方法
def decrypt_oralce():
    # 秘钥
    key = '9127142690756856755103370403687'
    # 密文
    text = 'I5f0an9gqqASm+BmMbgPF9EJPMRqasavy29Yo8ZtZm8RWqlvbNP7r0kfVZD8d7P3'
    # 初始化加密器
    aes = AES.new(add_to_16(key), AES.MODE_ECB)
    #优先逆向解密base64成bytes
    base64_decrypted = base64.decodebytes(text.encode(encoding='utf-8'))
    #执行解密密并转码返回str
    decrypted_text = str(aes.decrypt(base64_decrypted),encoding='utf-8').replace('\0','') 
    print(decrypted_text)
 
if __name__ == '__main__':
    decrypt_oralce()
#s3c{W0W_Y0u_g0T_NEw_Kn0wl3dge_FibO_AN13_AES}

4.rick_and_morty

题目

from secret import flag
from Crypto.Util.number import *

rick = getPrime(8)
morty = getPrime(8)

assert flag.startswith('s3c{')

c = []

for f in flag:
    c.append((rick*f + morty) % 193)

print(bytes(c))

#\x16\x0ct\xa8Z\x9bss\xb0+'\x96\x92\x92\xb0+Q\x9b\x92+V\x96\x92HHHl

exp

import gmpy2
f1=ord('\x16')
f2=ord('\x0c')
f3=ord('t') 

m1=ord('s')
m2=ord('3')
m3=ord('c') 
a=(f3-f1)*gmpy2.invert(m3-m1,193)%193
print(a)#a=163
b=(f1-a*m1)%193
print(b)#b=191

c="\x16\x0ct\xa8Z\x9bss\xb0+'\x96\x92\x92\xb0+Q\x9b\x92+V\x96\x92HHHl"

flag=''
for cc in c:
    m=(ord(cc)-b)*gmpy2.invert(a,193)%193
    flag+=chr(m)
print(flag)


#\x16\x0ct\xa8Z\x9bss\xb0+'\x96\x92\x92\xb0+Q\x9b\x92+V\x96\x92HHHl

#s3c{Wu66a_lUbba_Dub_dUb111}

5.Fun_math

题目

from Crypto.Util.number import *

secretnumber = bytes_to_long(secretnumber)
length = secretnumber.bit_length()

a = getPrime(length)
b = getPrime(length)
n = getPrime(length)

seed = secretnumber
output = []


for i in range(10):
    seed = (a*seed+b)%n
    output.append(seed)

p = a
q = b
n1 = p*q
e = seed
m = bytes_to_long(flag)
c = pow(m,e,n1)
	
print("n = ",n)
print("output = ",output)
print(c)

# n = 42476842493000497434413453902269183788969007711909559

# output =  [3068704501756971647183851343094804271828900617738356, 35578740995093017827714296762236666433492960621742375, 20009702595997219120464861324899624877268057264395011, 21093523623063575986895552186623484025034297597739015, 31937029294463221140263160564423356378739987650216965, 29604789319108255907122805645645923529709701585180965, 6898423443678769244357059048344153920899256269658384, 7318199245393826427415466145046449861737890363148754, 1872857003866173082852248601072975147095054802294983, 31855800236307014428827205916712228328224013244365519]

#c=1186321379813266777107467770217004282395076699311344900106612855851793829940825199410747599030994999425445

exp

import gmpy2
from Crypto.Util.number import *
n = 42476842493000497434413453902269183788969007711909559

output =  [3068704501756971647183851343094804271828900617738356, 35578740995093017827714296762236666433492960621742375, 20009702595997219120464861324899624877268057264395011, 21093523623063575986895552186623484025034297597739015, 31937029294463221140263160564423356378739987650216965, 29604789319108255907122805645645923529709701585180965, 6898423443678769244357059048344153920899256269658384, 7318199245393826427415466145046449861737890363148754, 1872857003866173082852248601072975147095054802294983, 31855800236307014428827205916712228328224013244365519]

a=(output[2]-output[1])*gmpy2.invert((output[1]-output[0]),n)%n
ani=gmpy2.invert(a,n)
b=(output[1]-a*output[0])%n
seed = (ani*(output[0]-b))%n
plaintext=seed
print(seed)
print(a)
print(b)



p=39902752694309620260626444285665485942791385645207851
q=33802185036678904443000136493162485297051793733621451
e=1018798858335632016421
c=1186321379813266777107467770217004282395076699311344900106612855851793829940825199410747599030994999425445
n=p*q
phi=(p-1)*(q-1)

d=gmpy2.invert(e,phi)
m=pow(c,d,n)
print(long_to_bytes(m))