NewStarCTF2023 Week1 misc/crypto wp

MISC[5/6]

1. CyberChef’s Secret

-题目：

-解题过程：
这个是base系列套娃，三次解码后得到flag：

 base32解码:  gprRdQCoa6VMNpWA1K1rjW7dWBgadzFcSrixdcX69YxLeKn8L
 base58解码:  ZmxhZ3tCYXNlXzE1X1MwX0Vhc3lfXl9efQ==
 base64解码:  flag{Base_15_S0_Easy_^_^}

2. 机密图片

-题目：

-解题过程：
使用StegSolve工具，点击"Analyse"->“Data Extract”，提取最低位信息即可得到flag：

3. 压缩包们

-题目：

-解题过程：
用010 Eeditor工具打开发现一串base64编码

解码之后是一句英文：

I like six-digit numbers because they are very concise and easy to remember.
我喜欢六位数的数字，因为它们非常简洁且易于记忆。

又发现这个zip文件头缺失,修复一下

00 00 00 00   →   50 4B 03 04

结合之前的英文，所以它的压缩包密码是六位数字，直接爆破

解压得到flag：

 flag{y0u_ar3_the_m4ter_of_z1111ppp_606a4adc}

4. 空白格

-题目：

-解题过程：
WhiteSpace语言，可以在 https://www.w3cschool.cn/tryrun/runcode?lang=whitespace 在线运行， 运行即可获得flag：

flag{w3_h4v3_to0_m4ny_wh1t3_sp4ce_2a5b4e04}

5. 流量！鲨鱼！

-题目：

-解题过程：
几乎尝试了各种办法，失败的原因是因为我的一切假设都是基于关键信息的名字是 “flag”，然而在导出对象里面

导出来之后发现是一串base64编码

Wm14aFozdFhjbWt6TldnMGNtdGZNWE5mZFRVelpuVnNYMkkzTW1FMk1EazFNemRsTm4wSwo=

经过两次base64解码得到flag：

flag{Wri35h4rk_1s_u53ful_b72a609537e6}

---

Crypto[7/10]

1. brainfuck

-题目：

++++++++[>>++>++++>++++++>++++++++>++++++++++>++++++++++++>++++++++++++++>++++++++++++++++>++++++++++++++++++>++++++++++++++++++++>++++++++++++++++++++++>++++++++++++++++++++++++>++++++++++++++++++++++++++>++++++++++++++++++++++++++++>++++++++++++++++++++++++++++++<<<<<<<<<<<<<<<<-]>>>>>>>++++++.>----.<-----.>-----.>-----.<<<-.>>++..<.>.++++++.....------.<.>.<<<<<+++.>>>>+.<<<+++++++.>>>+.<<<-------.>>>-.<<<+.+++++++.--..>>>>---.-.<<<<-.+++.>>>>.<<<<-------.+.>>>>>++.

-解题过程：
在线网站直接解密 http://www.hiencode.com/brain.html

flag{Oiiaioooooiai#b7c0b1866fe58e12}

2. Caesar’s Secert

-题目：

kqfl{hf3x4w’x_h1umjw_n5_a4wd_3fed}

-解题过程：
题目为一串凯撒密码加密的密文，直接枚举解密

#0: kqfl{hf3x4w’x_h1umjw_n5_a4wd_3fed}
#1: jpek{ge3w4v’w_g1tliv_m5_z4vc_3edc}
#2: iodj{fd3v4u’v_f1skhu_l5_y4ub_3dcb}
#3: hnci{ec3u4t’u_e1rjgt_k5_x4ta_3cba}
#4: gmbh{db3t4s’t_d1qifs_j5_w4sz_3baz}
#5: flag{ca3s4r’s_c1pher_i5_v4ry_3azy}
#6: ekzf{bz3r4q’r_b1ogdq_h5_u4qx_3zyx}
#7: djye{ay3q4p’q_a1nfcp_g5_t4pw_3yxw}
#8: cixd{zx3p4o’p_z1mebo_f5_s4ov_3xwv}
#9: bhwc{yw3o4n’o_y1ldan_e5_r4nu_3wvu}
#10: agvb{xv3n4m’n_x1kczm_d5_q4mt_3vut}
#11: zfua{wu3m4l’m_w1jbyl_c5_p4ls_3uts}
#12: yetz{vt3l4k’l_v1iaxk_b5_o4kr_3tsr}
#13: xdsy{us3k4j’k_u1hzwj_a5_n4jq_3srq}
#14: wcrx{tr3j4i’j_t1gyvi_z5_m4ip_3rqp}
#15: vbqw{sq3i4h’i_s1fxuh_y5_l4ho_3qpo}
#16: uapv{rp3h4g’h_r1ewtg_x5_k4gn_3pon}
#17: tzou{qo3g4f’g_q1dvsf_w5_j4fm_3onm}
#18: synt{pn3f4e’f_p1cure_v5_i4el_3nml}
#19: rxms{om3e4d’e_o1btqd_u5_h4dk_3mlk}
#20: qwlr{nl3d4c’d_n1aspc_t5_g4cj_3lkj}
#21: pvkq{mk3c4b’c_m1zrob_s5_f4bi_3kji}
#22: oujp{lj3b4a’b_l1yqna_r5_e4ah_3jih}
#23: ntio{ki3a4z’a_k1xpmz_q5_d4zg_3ihg}
#24: mshn{jh3z4y’z_j1woly_p5_c4yf_3hgf}
#25: lrgm{ig3y4x’y_i1vnkx_o5_b4xe_3gfe}

发现偏移为5时可以获得flag：

flag{ca3s4r's_c1pher_i5_v4ry_3azy}

3. Fence

-题目：

fa{ereigtepanet6680}lgrodrn_h_litx#8fc3

-解题过程：
直接栏栅密码解密，分为20栏时得到flag：

flag{reordering_the_plaintext#686f8c03}

4. Vigenère

-题目：

pqcq{qc_m1kt4_njn_5slp0b_lkyacx_gcdy1ud4_g3nv5x0}

-解题过程：
直接用在线解密网站或者一些本地工具进行解密，观察发现前面的"pqcq"字串应该对应"flag"字串，得到密钥为 kfc，解得flag

flag{la_c1fr4_del_5ign0r_giovan_batt1st4_b3ll5s0}

这个是维吉尼亚密码表格：

5. babyencoding

-题目：

part 1 of flag: ZmxhZ3tkYXp6bGluZ19lbmNvZGluZyM0ZTBhZDQ=
part 2 of flag: MYYGGYJQHBSDCZJRMQYGMMJQMMYGGN3BMZSTIMRSMZSWCNY=
part 3 of flag: =8S4U,3DR8SDY,C`S-F5F-C(S,S<R-C`Q9F8S87T`

-解题过程：
part 1 通过base64解码得到：

flag{dazzling_encoding#4e0ad4

part 2 通过base32解码得到：

f0ca08d1e1d0f10c0c7afe422fea7

part 3 部分为UUencode编码，可以使用在线工具进行解码http://www.hiencode.com/uu.html

c55192c992036ef623372601ff3a}

拼接起来得到完整的flag：

flag{dazzling_encoding#4e0ad4f0ca08d1e1d0f10c0c7afe422fea7c55192c992036ef623372601ff3a}

6. Small d

-题目：

from secret import flag
from Crypto.Util.number import *

p = getPrime(1024)
q = getPrime(1024)

d = getPrime(32)
e = inverse(d, (p-1)*(q-1))
n = p*q
m = bytes_to_long(flag)

c = pow(m,e,n)

print(c)
print(e)
print(n)

# c = 6755916696778185952300108824880341673727005249517850628424982499865744864158808968764135637141068930913626093598728925195859592078242679206690525678584698906782028671968557701271591419982370839581872779561897896707128815668722609285484978303216863236997021197576337940204757331749701872808443246927772977500576853559531421931943600185923610329322219591977644573509755483679059951426686170296018798771243136530651597181988040668586240449099412301454312937065604961224359235038190145852108473520413909014198600434679037524165523422401364208450631557380207996597981309168360160658308982745545442756884931141501387954248
# e = 8614531087131806536072176126608505396485998912193090420094510792595101158240453985055053653848556325011409922394711124558383619830290017950912353027270400567568622816245822324422993074690183971093882640779808546479195604743230137113293752897968332220989640710311998150108315298333817030634179487075421403617790823560886688860928133117536724977888683732478708628314857313700596522339509581915323452695136877802816003353853220986492007970183551041303875958750496892867954477510966708935358534322867404860267180294538231734184176727805289746004999969923736528783436876728104351783351879340959568183101515294393048651825
# n = 19873634983456087520110552277450497529248494581902299327237268030756398057752510103012336452522030173329321726779935832106030157682672262548076895370443461558851584951681093787821035488952691034250115440441807557595256984719995983158595843451037546929918777883675020571945533922321514120075488490479009468943286990002735169371404973284096869826357659027627815888558391520276866122370551115223282637855894202170474955274129276356625364663165723431215981184996513023372433862053624792195361271141451880123090158644095287045862204954829998614717677163841391272754122687961264723993880239407106030370047794145123292991433

-解题过程：
e大d小，维纳攻击脚本：

# 维纳攻击
import gmpy2
import primefac
from Crypto.Util.number import *

def transform(x,y):       #使用辗转相处将分数 x/y 转为连分数的形式
    res=[]
    while y:
        res.append(x//y)
        x,y=y,x%y
    return res
    
def continued_fraction(sub_res):
    numerator,denominator=1,0
    for i in sub_res[::-1]:      #从sublist的后面往前循环
        denominator,numerator=numerator,i*numerator+denominator
    return denominator,numerator   #得到渐进分数的分母和分子，并返回

    
#求解每个渐进分数
def sub_fraction(x,y):
    res=transform(x,y)
    res=list(map(continued_fraction,(res[0:i] for i in range(1,len(res)))))  #将连分数的结果逐一截取以求渐进分数
    return res

def get_pq(a,b,c):      #由p+q和pq的值通过维达定理来求解p和q
    par=gmpy2.isqrt(b*b-4*a*c)   #由上述可得，开根号一定是整数，因为有解
    x1,x2=(-b+par)//(2*a),(-b-par)//(2*a)
    return x1,x2

def wienerAttack(e,n):
    for (d,k) in sub_fraction(e,n):  #用一个for循环来注意试探e/n的连续函数的渐进分数，直到找到一个满足条件的渐进分数
        if k==0:                     #可能会出现连分数的第一个为0的情况，排除
            continue
        if (e*d-1)%k!=0:             #ed=1 (mod φ(n)) 因此如果找到了d的话，(ed-1)会整除φ(n),也就是存在k使得(e*d-1)//k=φ(n)
            continue
        
        phi=(e*d-1)//k               #这个结果就是 φ(n)
        px,qy=get_pq(1,n-phi+1,n)
        if px*qy==n:
            p,q=abs(int(px)),abs(int(qy))     #可能会得到两个负数，负负得正未尝不会出现
            d=gmpy2.invert(e,(p-1)*(q-1))     #求ed=1 (mod  φ(n))的结果，也就是e关于 φ(n)的乘法逆元d
            return d
    print("该方法不适用")
    
c = 6755916696778185952300108824880341673727005249517850628424982499865744864158808968764135637141068930913626093598728925195859592078242679206690525678584698906782028671968557701271591419982370839581872779561897896707128815668722609285484978303216863236997021197576337940204757331749701872808443246927772977500576853559531421931943600185923610329322219591977644573509755483679059951426686170296018798771243136530651597181988040668586240449099412301454312937065604961224359235038190145852108473520413909014198600434679037524165523422401364208450631557380207996597981309168360160658308982745545442756884931141501387954248
e = 8614531087131806536072176126608505396485998912193090420094510792595101158240453985055053653848556325011409922394711124558383619830290017950912353027270400567568622816245822324422993074690183971093882640779808546479195604743230137113293752897968332220989640710311998150108315298333817030634179487075421403617790823560886688860928133117536724977888683732478708628314857313700596522339509581915323452695136877802816003353853220986492007970183551041303875958750496892867954477510966708935358534322867404860267180294538231734184176727805289746004999969923736528783436876728104351783351879340959568183101515294393048651825
n = 19873634983456087520110552277450497529248494581902299327237268030756398057752510103012336452522030173329321726779935832106030157682672262548076895370443461558851584951681093787821035488952691034250115440441807557595256984719995983158595843451037546929918777883675020571945533922321514120075488490479009468943286990002735169371404973284096869826357659027627815888558391520276866122370551115223282637855894202170474955274129276356625364663165723431215981184996513023372433862053624792195361271141451880123090158644095287045862204954829998614717677163841391272754122687961264723993880239407106030370047794145123292991433 
d=wienerAttack(e,n)
print("d=",d)
m = pow(c,d,n)
print("flag = ",long_to_bytes(m))
#flag{learn_some_continued_fraction_technique#dc16885c}

7. babyaes

-题目：

from Crypto.Cipher import AES
import os
from flag import flag
from Crypto.Util.number import *


def pad(data):
    return data + b"".join([b'\x00' for _ in range(0, 16 - len(data))])


def main():
    flag_ = pad(flag)
    key = os.urandom(16) * 2
    iv = os.urandom(16)
    print(bytes_to_long(key) ^ bytes_to_long(iv) ^ 1)
    aes = AES.new(key, AES.MODE_CBC, iv)
    enc_flag = aes.encrypt(flag_)
    print(enc_flag)


if __name__ == "__main__":
    main()
# 3657491768215750635844958060963805125333761387746954618540958489914964573229
# b'>]\xc1\xe5\x82/\x02\x7ft\xf1B\x8d\n\xc1\x95i'

-解题过程：

key=os.urandom(16)*2
iv=os.urandom(16)

可知：

key是32bytes,256bits ；iv是16bytes ,128bitskey^iv ，那么只有 iv 与 key的低128位相异或，所以 key 的高128位是固定不变的。所以 xor 的高128bits,就是 key 的高128bits,进而可以得到key 的所有值256bits。之后 key 的低128bits，与 xor 的低128bits 相异或，所得结果就是 iv 的值了得到key , iv 就可以直接aes.decrypt()来解密了

脚本如下：

from Crypto.Util.number import *
from Crypto.Cipher import AES

a = 3657491768215750635844958060963805125333761387746954618540958489914964573229
c = b'>]\xc1\xe5\x82/\x02\x7ft\xf1B\x8d\n\xc1\x95i'
key = long_to_bytes(a)[:16]
iv = bytes_to_long(key) ^ bytes_to_long(long_to_bytes(a)[16:]) ^ 1

aes = AES.new(key * 2,AES.MODE_CBC,long_to_bytes(iv))
flag = aes.decrypt(c)
print(flag)
# flag{firsT_cry_Aes}