LitCTF2023暨zzuli首届新生赛crypto部分wp

最新推荐文章于 2024-06-14 09:50:01 发布

玖离gsl

最新推荐文章于 2024-06-14 09:50:01 发布

阅读量271

点赞数 1

文章标签： python

本文链接：https://blog.csdn.net/jiuli137/article/details/130732006

版权

算是对这段时间的密码学学习做了一个检验,至少学以致用了,也学习到了一些新的知识,同时也认识到自身的密码学知识还是不足.

1. Hex？Hex！(初级)

4c69744354467b746169313131636f6f6c6c616161217d

一眼16进制,题目也提示了,直接放到cyberchef,直接秒

2.梦想是红色的 (初级)

自由友善公正公正敬业法治自由自由和谐平等自由自由公正法治诚信民主诚信自由自由诚信民主爱国友善平等诚信富强友善爱国自由诚信民主敬业爱国诚信民主友善爱国平等爱国爱国敬业敬业友善爱国公正敬业爱国敬业和谐文明诚信文明友善爱国自由诚信民主爱国爱国诚信和谐友善爱国自由友善平等爱国友善平等友善自由诚信自由平等爱国爱国敬业敬业友善爱国敬业敬业友善自由友善平等诚信自由法治诚信和谐

一眼社会主义核心价值观编码,在线网站直接秒

3. 家人们！谁懂啊，RSA签到都不会 (初级)

from Crypto.Util.number import *
from secret import flag

m = bytes_to_long(flag)
p = getPrime(512)
q = getPrime(512)
e = 65537
n = p*q
c = pow(m,e,n)
print(f'p = {p}')
print(f'q = {q}')
print(f'c = {c}')
'''
p = 12567387145159119014524309071236701639759988903138784984758783651292440613056150667165602473478042486784826835732833001151645545259394365039352263846276073
q = 12716692565364681652614824033831497167911028027478195947187437474380470205859949692107216740030921664273595734808349540612759651241456765149114895216695451
c = 108691165922055382844520116328228845767222921196922506468663428855093343772017986225285637996980678749662049989519029385165514816621011058462841314243727826941569954125384522233795629521155389745713798246071907492365062512521474965012924607857440577856404307124237116387085337087671914959900909379028727767057
'''

正如题目所言,rsa最基础的题,有p,q,e.c直接解

from Crypto.Util.number import *
from gmpy2 import *

p = 12567387145159119014524309071236701639759988903138784984758783651292440613056150667165602473478042486784826835732833001151645545259394365039352263846276073
q = 12716692565364681652614824033831497167911028027478195947187437474380470205859949692107216740030921664273595734808349540612759651241456765149114895216695451
c = 108691165922055382844520116328228845767222921196922506468663428855093343772017986225285637996980678749662049989519029385165514816621011058462841314243727826941569954125384522233795629521155389745713798246071907492365062512521474965012924607857440577856404307124237116387085337087671914959900909379028727767057
e = 65537

n = p * q
phi = (p - 1) * (q - 1)
d = inverse(e, phi)
m = powmod(c, d, n)
print(long_to_bytes(m))
# LitCTF{it_is_easy_to_solve_question_when_you_know_p_and_q}

4.yafu (中级)

from Crypto.Util.number import *
from secret import flag

m = bytes_to_long(flag)
n = 1
for i in range(15):
    n *= getPrime(32)
e = 65537
c = pow(m, e, n)
print(f'n = {n}')
print(f'c = {c}')
'''
n = 15241208217768849887180010139590210767831431018204645415681695749294131435566140166245881287131522331092026252879324931622292179726764214435307
c = 12608550100856399369399391849907846147170257754920996952259023159548789970041433744454761458030776176806265496305629236559551086998780836655717
'''

虽然factordb.com,可以分解n,但是我还是按照题目要求用了yafu.

由题目可知15个32位的小质数相乘,用yafu分解如下

与正常的rsa也一样,就是分解出来了15个数在计算phi时需要把这15个数都计算上去

from Crypto.Util.number import *
from gmpy2 import *

n = 15241208217768849887180010139590210767831431018204645415681695749294131435566140166245881287131522331092026252879324931622292179726764214435307
c = 12608550100856399369399391849907846147170257754920996952259023159548789970041433744454761458030776176806265496305629236559551086998780836655717
e = 65537
P1 = 2201440207
P2 = 4171911923
P3 = 2719600579
P4 = 3354884521
P5 = 2767137487
P6 = 2906576131
P7 = 4021078331
P8 = 2315495107
P9 = 2758708999
P10 = 4044505687
P11 = 2923522073
P12 = 3355651511
P13 = 2151018733
P14 = 3989697563
P15 = 2585574697

n = P1 * P2 * P3 * P4 * P5 * P6 * P7 * P8 * P9 * P10 * P11 * P12 * P13 * P14 * P15
phi = (P1 - 1) * (P2 - 1) * (P3 - 1) * (P4 - 1) * (P5 - 1) * (P6 - 1) * (P7 - 1) * (P8 - 1) * (P9 - 1) * (P10 - 1) * (
            P11 - 1) * (P12 - 1) * (P13 - 1) * (P14 - 1) * (P15 - 1)
_, d, _ = gcdext(e, phi)
m = pow(c, d, n)
print(long_to_bytes(m))
# LitCTF{Mu1tiple_3m4ll_prim5_fac7ors_@re_uns4f5}

5.factordb (中级)

e = 65537
n = 87924348264132406875276140514499937145050893665602592992418171647042491658461
c = 87677652386897749300638591365341016390128692783949277305987828177045932576708

也是分解n只不过这个是让我用factordb.com分解n

from Crypto.Util.number import *
from gmpy2 import *

e = 65537
n = 87924348264132406875276140514499937145050893665602592992418171647042491658461
c = 87677652386897749300638591365341016390128692783949277305987828177045932576708

q = 275127860351348928173285174381581152299
p = 319576316814478949870590164193048041239
phi = (p - 1) * (q - 1)
d = inverse(e, phi)
m = powmod(c, d, n)
print(long_to_bytes(m))
# LitCTF{factordb!!!}

6.P_Leak

from Crypto.Util.number import *

e = 65537
m = bytes_to_long(b'xxxx')
p = getPrime(512)
q = getPrime(512)
n = p * q
phi = (p - 1) * (q - 1)
d = inverse(e, phi)
dp = d % (p - 1)
c = pow(m, e, n)
print("dp=", dp)
print("n=", n)
print("c=", c)
# dp= 5892502924236878675675338970704766304539618343869489297045857272605067962848952532606770917225218534430490745895652561015493032055636004130931491316020329
# n= 50612159190225619689404794427464916374543237300894011803225784470008992781409447214236779975896311093686413491163221778479739252804271270231391599602217675895446538524670610623369953168412236472302812808639218392319634397138871387898452935081756580084070333246950840091192420542761507705395568904875746222477
# c= 39257649468514605476432946851710016346016992413796229928386230062780829495844059368939749930876895443279723032641876662714088329296631207594999580050131450251288839714711436117326769029649419789323982613380617840218087161435260837263996287628129307328857086987521821533565738409794866606381789730458247531619

正常的dp泄露,

对于dp我们有 dp ≡ 1 (mod p − 1),所以我们有dpe = 1 + k (p−1)

因为dp < p−1，所以则有k < e，则我们可以在[1,e)的范围遍历k，找到满足等式的整数解，即可解出p

from Crypto.Util.number import *
from gmpy2 import *

dp = 5892502924236878675675338970704766304539618343869489297045857272605067962848952532606770917225218534430490745895652561015493032055636004130931491316020329
n = 50612159190225619689404794427464916374543237300894011803225784470008992781409447214236779975896311093686413491163221778479739252804271270231391599602217675895446538524670610623369953168412236472302812808639218392319634397138871387898452935081756580084070333246950840091192420542761507705395568904875746222477
c = 39257649468514605476432946851710016346016992413796229928386230062780829495844059368939749930876895443279723032641876662714088329296631207594999580050131450251288839714711436117326769029649419789323982613380617840218087161435260837263996287628129307328857086987521821533565738409794866606381789730458247531619
e = 65537

for k in range(1, e):
    if (e * dp - 1) % k == 0:
        p = (e * dp - 1) // k + 1
        if n % p == 0:
            q = n // p
            d = invert(e, (p - 1) * (q - 1))
            m = powmod(c, d, n)
            break

print(long_to_bytes(m))
# LitCTF{Prim3_1s_Le@k!!!!!}

7.e的学问

from Crypto.Util.number import *

m = bytes_to_long(b'xxxxxx')
p = getPrime(256)
q = getPrime(256)
e = 74
n = p * q
c = pow(m, e, n)
print("p=", p)
print("q=", q)
print("c=", c)
# p= 86053582917386343422567174764040471033234388106968488834872953625339458483149
# q= 72031998384560188060716696553519973198388628004850270102102972862328770104493
# c= 3939634105073614197573473825268995321781553470182462454724181094897309933627076266632153551522332244941496491385911139566998817961371516587764621395810123

因为e是偶数与phi互质,所以正常解得不到d,但是我们可以找到e与phi的最大公因数s,然后让e除以s,然后在正常解rsa,只不过我们得到的不是m而是m的s次幂,

from Crypto.Util.number import *
from gmpy2 import *

p = 86053582917386343422567174764040471033234388106968488834872953625339458483149
q = 72031998384560188060716696553519973198388628004850270102102972862328770104493
c = 3939634105073614197573473825268995321781553470182462454724181094897309933627076266632153551522332244941496491385911139566998817961371516587764621395810123
n = p * q
e = 74
phi = (p - 1) * (q - 1)
s = gcd(e, phi)
d = inverse(e // s, phi)
m = powmod(c, d, n)
m1 = iroot(m, s)
print(long_to_bytes(m1[0]))
# LitCTF{e_1s_n0t_@_Prime}

8.我测你vva

public class Encrypto{
    public static void main(String[] args) {
        String flag="";
        int cipher;
        char[] arr;
        arr=flag.toCharArray();
        for(int i=0; i<flag.length(); i++) {
           if(i%2==0){
            cipher=Integer.valueOf(arr[i]);
            cipher=cipher+i;
            System.out.print((char)cipher);
           }
           if(i%2!=0){
            cipher=Integer.valueOf(arr[i]);
            cipher=cipher-i;
            System.out.print((char)cipher);
           }
        }
    }
}
//cipher=HYEQJvPZ~X@+Bp

加密算法如下：

1. 将字符串flag转换为字符数组arr。
2. 对于字符数组arr中的每个字符，如果其下标为偶数，则将其ASCII码值加上其下标，并输出加密后的字符；如果其下标为奇数，则将其ASCII码值减去其下标，并输出加密后的字符。
3. 将加密后的字符连接起来，得到加密后的结果

所以我们要做的就是逆向,也就是遍历加密后的字符串的每个字符，如果该字符在原始字符串中是偶数位，那么将该字符的ASCII码值减去该字符在字符串中的下标即可得到原始字符的ASCII码值；如果该字符在原始字符串中是奇数位，那么将该字符的ASCII码值加上该字符在字符串中的下标即可得到原始字符的ASCII码值。最后将得到的原始字符的ASCII码值转换成字符，拼接成原始字符串。

具体实现如下:

cipher = "HYEQJvPZ~X@+Bp"
flag = ""
for i in range(len(cipher)):
    if i % 2 == 0:
        c = ord(cipher[i]) - i
        flag += chr(c)
    else:
        c = ord(cipher[i]) + i
        flag += chr(c)
print(flag)
# HZCTF{Java666}

9.The same common divisor (高级)

from Crypto.Util.number import *

m = bytes_to_long(b'xxxxxx')
e = 65537
p = getPrime(1024)
q1 = getPrime(1024)
q2 = getPrime(1024)
n1 = p * q1
n2 = p * q2
c1 = pow(m, e, n1)
c2 = pow(m, e, n2)
n3 = n1 ^ n2
print('n1=', n1)
print('n3=', n3)
print('c1=', c1)
print('c2=', c2)
# n1= 9852079772293301283705208653824307027320071498525390578148444258198605733768947108049676831872672654449631852459503049139275329796717506126689710613873813880735666507857022786447784753088176997374711523987152412069255685005264853118880922539048290400078105858759506186417678959028622484823376958194324034590514104266608644398160457382895380141070373685334979803658172378382884352616985632157233900719194944197689860219335238499593658894630966428723660931647038577670614850305719449893199713589368780231046895222526070730152875112477675102652862254926169713030701937231206405968412044029177246460558028793385980934233
# n3= 4940268030889181135441311597961813780480775970170156650560367030148383674257975796516865571557828263935532335958510269356443566533284856608454193676600884849913964971291145182724888816164723930966472329604608512023988191536173112847915884014445539739070437180314205284883149421228744714989392788108329929896637182055266508625177260492776962915873036873839946591259443753924970795669864031580632650140641456386202636466624658715315856453572441182758855085077441336516178544978457053552156714181607801760605521338788424464551796638531143900048375037218585999440622490119344971822707261432953755569507740550277088437182
# c1= 7066425618980522033304943700150361912772559890076173881522840300333719222157667104461410726444725540513601550570478331917063911791020088865705346188662290524599499769112250751103647749860198318955619903728724860941709527724500004142950768744200491448875522031555564384426372047270359602780292587644737898593450148108629904854675417943165292922990980758572264063039172969633878015560735737699147707712154627358077477591293746136250207139049702201052305840453700782016480965369600667516646007546442708862429431724013679189842300429421340122052682391471347471758814138218632022564279296594279507382548264409296929401260
# c2= 854668035897095127498890630660344701894030345838998465420605524714323454298819946231147930930739944351187708040037822108105697983018529921300277486094149269105712677374751164879455815185393395371001495146490416978221501351569800028842842393448555836910486037183218754013655794027528039329299851644787006463456162952383099752894635657833907958930587328480492546831654755627949756658554724024525108575961076341962292900510328611128404001877137799465932130220386963518903892403159969133882215092783063943679288192557384595152566356483424061922742307738886179947575613661171671781544283180451958232826666741028590085269

看着挺吓唬人,其实就是异或的性质即: a ^ b = c 那么则有 a ^ c = b , c ^ b = a

所以这里n3 = n1 ^ n2 ,知道n1和n3那么n2 = n1 ^ n3 之后就是正常的RSA解密

from Crypto.Util.number import *
from gmpy2 import *

n1 = 9852079772293301283705208653824307027320071498525390578148444258198605733768947108049676831872672654449631852459503049139275329796717506126689710613873813880735666507857022786447784753088176997374711523987152412069255685005264853118880922539048290400078105858759506186417678959028622484823376958194324034590514104266608644398160457382895380141070373685334979803658172378382884352616985632157233900719194944197689860219335238499593658894630966428723660931647038577670614850305719449893199713589368780231046895222526070730152875112477675102652862254926169713030701937231206405968412044029177246460558028793385980934233
n3 = 4940268030889181135441311597961813780480775970170156650560367030148383674257975796516865571557828263935532335958510269356443566533284856608454193676600884849913964971291145182724888816164723930966472329604608512023988191536173112847915884014445539739070437180314205284883149421228744714989392788108329929896637182055266508625177260492776962915873036873839946591259443753924970795669864031580632650140641456386202636466624658715315856453572441182758855085077441336516178544978457053552156714181607801760605521338788424464551796638531143900048375037218585999440622490119344971822707261432953755569507740550277088437182
c1 = 7066425618980522033304943700150361912772559890076173881522840300333719222157667104461410726444725540513601550570478331917063911791020088865705346188662290524599499769112250751103647749860198318955619903728724860941709527724500004142950768744200491448875522031555564384426372047270359602780292587644737898593450148108629904854675417943165292922990980758572264063039172969633878015560735737699147707712154627358077477591293746136250207139049702201052305840453700782016480965369600667516646007546442708862429431724013679189842300429421340122052682391471347471758814138218632022564279296594279507382548264409296929401260
c2 = 854668035897095127498890630660344701894030345838998465420605524714323454298819946231147930930739944351187708040037822108105697983018529921300277486094149269105712677374751164879455815185393395371001495146490416978221501351569800028842842393448555836910486037183218754013655794027528039329299851644787006463456162952383099752894635657833907958930587328480492546831654755627949756658554724024525108575961076341962292900510328611128404001877137799465932130220386963518903892403159969133882215092783063943679288192557384595152566356483424061922742307738886179947575613661171671781544283180451958232826666741028590085269
e = 65537

n2 = n1 ^ n3
p = gcd(n1, n2)
q1 = n1 // p
q2 = n2 // p

phi_1 = (p-1)*(q1-1)
phi_2 = (p-1)*(q2-1)

d1 = inverse(e, phi_1)
d2 = inverse(e, phi_2)
m1 = powmod(c1, d1, n1)
m2 = powmod(c2, d2, n2)
print(long_to_bytes(m1))
print(long_to_bytes(m2))
# LitCTF{TH3_Tw0_nUmb3rs_H@v3_The_sAme_D1v1s0r!!}
# LitCTF{TH3_Tw0_nUmb3rs_H@v3_The_sAme_D1v1s0r!!}

PS : 别问为啥是输出了俩,因为我怕是两半的flag所以俩都输出了,结果是一样的

10.Is this only base?

SWZxWl=F=DQef0hlEiSUIVh9ESCcMFS9NF2NXFzM
今年是本世纪的第23年呢

一眼看像是base,但是肯定是乱序了,等号得在最后,根据23的提示进行栅栏密码解密得到SWZxWlFDe0liUV9ScF9FNFMzX2NSMCEhISEhfQ==

尝试去base解密,发现得到IfqZQC{IbQ_Rp_E4S3_cR0!!!!!},像是flag又不是,根据23的提示想到凯撒密码解密得到LitCTF{LeT_Us_H4V3_fU0!!!!!}

11隐晦的聊天记录

出题人:6c73d5240a948c86981bc294814d
某不知名收件人：收到消息attack at dawn
出题人:xxxxxxxxxxxxxxxxxxxxxxxxxxxx
某不知名收件人：收到消息Monday or Thur
已知出题人和收件人手中的密钥相同，请解出出题人第二次发送的密文呢（16进制，字母小写，解得的结果记得要加上LitCTF{}哦。）

一眼opt加密,赛题也提示了,不了解的可以去搜索一下,简单来说也是用到异或的性质

ciphertext1 = 0x6c73d5240a948c86981bc294814d
plaintext1 = "attack at dawn"
plaintext11 = ''.join([hex(ord(c))[2:] for c in plaintext1])
key = ciphertext1 ^ int(plaintext11, 16)
plaintext2 = 'Monday or Thur'
plaintext22 = ''.join([hex(ord(c))[2:] for c in plaintext2])
ciphertext2 = int(plaintext22, 16) ^ key
print('NSSCTF{' + hex(ciphertext2) + '}')
# NSSCTF{0x4068cf2108868c889e1bf29d8351} 记得去0x

玖离gsl

关注

1
点赞
踩
0

收藏

觉得还不错? 一键收藏
0
评论
LitCTF2023暨zzuli首届新生赛crypto部分wp

所以我们要做的就是逆向,也就是遍历加密后的字符串的每个字符，如果该字符在原始字符串中是偶数位，那么将该字符的ASCII码值减去该字符在字符串中的下标即可得到原始字符的ASCII码值；},像是flag又不是,根据23的提示想到凯撒密码解密得到LitCTF{LeT_Us_H4V3_fU0!因为e是偶数与phi互质,所以正常解得不到d,但是我们可以找到e与phi的最大公因数s,然后让e除以s,然后在正常解rsa,只不过我们得到的不是m而是m的s次幂,正如题目所言,rsa最基础的题,有p,q,e.c直接解。
复制链接

扫一扫