【CTF】Crypto Writeup【思路已经告诉你了】

题目

标题：思路已经告诉你了
THERE IS A WORD!
len(WORD) = 4
md5(WORD + ‘key!!’) = ‘cf9c6242ecfbc924842c8a2095e44c5a’
SHA256 = SHA256(WORD)
FLAG = KEY{SHA256}

读题：
我们要找的是4位长度的字符串WORD；
WORD明文 + ‘key!!’ 的字符串的 md5 = ‘cf9c6242ecfbc924842c8a2095e44c5a’；
写python程序，
穷举 4个占位符+‘key!!’ 字符串的md5，找’cf9c6242ecfbc924842c8a2095e44c5a’；

代码

import hashlib
# 10个数字 + 26个大写字母 = 36
# dict_36 = ['0','1','2','3','4','5','6','7','8','9','0','A','B','C','D','E','F','G',
#        'H','I','J','K','L','M','N','O','P','Q','R','S','T','U','V','W','X','Y','Z']
# 10个数字 + 26个大写字母 +  26个小写字母 = 62
dict_62 = ['0', '1', '2', '3', '4', '5', '6', '7', '8', '9', 'a', 'b', 'c', 'd', 'e', 'f', 'g', 'h', 'i', 'j', 'k', 'l',
        'm', 'n', 'o', 'p', 'q', 'r', 's', 't', 'u', 'v', 'w', 'x', 'y', 'z', 'A', 'B', 'C', 'D', 'E', 'F', 'G', 'H',
        'I', 'J', 'K', 'L', 'M', 'N', 'O', 'P', 'Q', 'R', 'S', 'T', 'U', 'V', 'W', 'X', 'Y', 'Z']
src_key = 'key!!'
src_md5 = 'cf9c6242ecfbc924842c8a2095e44c5a'

# 退出循环标志位
exit_flag = False

for i in range(62):
    for j in range(62):
        for k in range(62):
            for l in range(62):
                    # 明文缺失的字符位置，用dic[n]来占位
                    src = dict_62[i] + dict_62[j] + dict_62[k] + dict_62[l] + src_key
                    # print('src: ' + src)
                    m2 = hashlib.md5()
                    m2.update(src.encode("utf8"))
                    # print(m2.hexdigest())
                    m2 = m2.hexdigest()
                    # 查找包含密文的字符串，打印输出结果
                    if (src_md5 == m2) :
                        exit_flag = True
                        print('明文：' + src)
                        print('md5: ' + m2)
                        str_word = dict_62[i] + dict_62[j] + dict_62[k] + dict_62[l]
                        print('sha256: ' + hashlib.sha256(str_word.encode('utf-8')).hexdigest())
                        print("...success!!")
		            if exit_flag:
		                break

得到明文：

明文：datakey!!
md5: cf9c6242ecfbc924842c8a2095e44c5a
sha256(str_word): 3a6eb0790f39ac87c94f3856b2dd2c5d110e6811602261a9a923d3bb23adc8b7
…success!!

则flag为：KEY{3a6eb0790f39ac87c94f3856b2dd2c5d110e6811602261a9a923d3bb23adc8b7}