python脚本

El.十一

已于 2023-11-22 11:49:26 修改

阅读量79

点赞数

文章标签： python 前端 linux

于 2023-09-18 19:20:26 首次发布

本文链接：https://blog.csdn.net/m0_73847654/article/details/132993216

版权

buuctf:千层套

1.破解1000个zip，名字即为密码：

import zipfile
name = '0573'
while True:
    fz = zipfile.ZipFile(name + '.zip', 'r')  #(路径，r代表读取)   路径默认为py文件目录
    fz.extractall(pwd=bytes(name, 'utf-8'))    #eatractall提取 pwd为密码
    name = fz.filelist[0].filename[0:4]         #压缩包里的文件名字为下一个解压密码
    fz.close()

2.读取rgb 创建图片

from PIL import Image

x = y = 200
img = Image.new("RGB",(x,y))  #创建图片  (RGB ,size)
file = open('./qr.txt','r')
for width in range(0,x):
    for height in range(0,y):
        #删除无用字符
        line = file.readline()    #读取一行
        line=line.replace('(','')
        line=line.replace(')','')
        line=line.replace('\n','')
        line=line.replace(' ','')
        rgb = line.split(',')  #分割在数字
        img.putpixel((width,height),(int(rgb[0]),int(rgb[1]),int(rgb[2])))
img.save('flag.jpg')  #保存

3.01密文转二维码


from PIL import Image
from zlib import *
MAX=29
pic = Image.new("RGB",(MAX,MAX))
str ="1111111011111111011000111111110000010011000101010001000001101110100011000110010010111011011101011010000100010101110110111010000111111000001011101100000100011101111010010000011111111010101010101010111111100000000000000111111100000000001011101000111010100100010010011000000101101111100010001110110010101001111010001110011101001001001100100010001000100110001001100010101001110100011010000110100110000001101111000001100111111000100101011111000110010000011111111111000111010110001110100100110011010011000011010000110011100100111011001110011010100110100111101101000110001001110101010010100100110001111101111111100010000000011110011010110001000011111110010000000001101010111100000101110100010101000100101011101011000001110011111111110111010010101001010000110100101110101111111011010001100011000001000111101111001001101011111110010100011110111100111"
i=0
for y in range(0,MAX):
    for x in range(0,MAX):
        if(str[i] == '1'):
            pic.putpixel([x,y],(0,0,0))
        else:pic.putpixel([x,y],(255,255,255))
        i = i+1
pic.show()
pic.save("flag.png")

4.解方程

import numpy as np
from scipy import *
from sympy import symbols, Eq, solve


#这里试了很多解线性方程的方法，但好多都解不到精确值，这个方法——好！QAQ
x, y, z, n, m, q = symbols('x y z n m q')
eqs = [Eq(593*x + 997*y + 811*z + 258*n + 829*m + 532*q, 105555560442679852867),
       Eq(605*x + 686*y + 328*z + 602*n + 695*m + 576*q, 98116092416072413055), 
       Eq(373*x + 512*y + 449*z + 756*n + 448*m + 580*q, 85106081636749316892),
       Eq(560*x + 635*y + 422*z + 971*n + 855*m + 597*q, 113370957690492941555), 
       Eq(717*x + 507*y + 388*z + 925*n + 324*m + 524*q, 93305788348884728867),
       Eq(312*x + 368*y + 884*z + 518*n + 495*m + 414*q, 74828257282727436133), ]
print(solve(eqs, [x, y, z, n, m, q]))


ans = {'m': 32192963475959391, 'n': 29378135513658469, 'q': 30791965425607037, 'x': 28829613228248624, 'y': 26827458353261422, 'z': 13642136288051316}

5.z3多元方程求解

from z3 import *
s = Solver()
a1 = [0]*32
for i in range(32):
    a1[i] = Int('a1['+str(i)+']')

s.add( 1629056 * a1[0] == 166163712 )
s.add( 6771600 * a1[1] == 731332800 )
s.add( 3682944 * a1[2] == 357245568 )
s.add( 10431000 * a1[3] == 1074393000 )
s.add( 3977328 * a1[4] == 489211344 )
s.add( 5138336 * a1[5] == 518971936 )
s.add( 7532250 * a1[7] == 406741500 )
s.add( 5551632 * a1[8] == 294236496 )
s.add( 3409728 * a1[9] == 177305856 )
s.add( 13013670 * a1[10] == 650683500 )
s.add( 6088797 * a1[11] == 298351053 )
s.add( 7884663 * a1[12] == 386348487 )
s.add( 8944053 * a1[13] == 438258597 )
s.add( 5198490 * a1[14] == 249527520 )
s.add( 4544518 * a1[15] == 445362764 )
s.add( 3645600 * a1[17] == 174988800 )
s.add( 10115280 * a1[16] == 981182160 )
s.add( 9667504 * a1[18] == 493042704 )
s.add( 5364450 * a1[19] == 257493600 )
s.add( 13464540 * a1[20] == 767478780 )
s.add( 5488432 * a1[21] == 312840624 )
s.add( 14479500 * a1[22] == 1404511500 )
s.add( 6451830 * a1[23] == 316139670 )
s.add( 6252576 * a1[24] == 619005024 )
s.add( 7763364 * a1[25] == 372641472 )
s.add( 7327320 * a1[26] == 373693320 )
s.add( 8741520 * a1[27] == 498266640 )
s.add( 8871876 * a1[28] == 452465676 )
s.add( 4086720 * a1[29] == 208422720 )
s.add( 9374400 * a1[30] == 515592000 )
s.add(5759124 * a1[31] == 719890500)
s.check()
print(s.model())

6.base64隐写

# base64隐写
import base64
def get_diff(s1, s2):
    base64chars = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/'
    res = 0
    for i in range(len(s2)):
        if s1[i] != s2[i]:
            return abs(base64chars.index(s1[i]) - base64chars.index(s2[i]))
    return res


def b64_stego_decode():
    file = open("base64隐写.txt","rb")
    x = ''                                      # x即bin_str
    lines =  file.readlines()
    for line in lines:
        l = str(line, encoding = "utf-8")
        stego = l.replace('\n','')
        #print(stego)
        realtext = base64.b64decode(l)
        #print(realtext)
        realtext = str(base64.b64encode(realtext),encoding = "utf-8")
        #print(realtext)
        diff = get_diff(stego, realtext)        # diff为隐写字串与实际字串的二进制差值
        n = stego.count('=')
        if diff:
            x += bin(diff)[2:].zfill(n*2)
        else:
            x += '0' * n*2
            
    i = 0
    flag = ''
    while i < len(x):
        if int(x[i:i+8],2):
            flag += chr(int(x[i:i+8],2))
        i += 8
    print(flag)

if __name__ == '__main__':
    b64_stego_decode()

7.正则表达式匹配

import re

with open("2.txt","r") as p:
    lines=p.readlines()

i=1
string=f'select group_concat\(username,password\) from user\),{i},1\)\)=\d+'
for line in lines:
    match = re.search(string, line)
    if match:
        # 提取匹配到的数字
        number = match.group().split('=')[1]
    else:
        i+=1
        string=f'select group_concat\(username,password\) from user\),{i},1\)\)=\d+'
        print(chr(int(number)),end='')

8.字符串排列组合

from itertools import permutations
import re

flag = ["{hey", "_boy", "aaaa", "s_im", "ck!}", "_baa", "aaaa", "pctf"]
# 对flag字典里的内容进行排列组合
item = permutations(flag)
# 遍历
for a in item:
    k = ''.join(list(a))
    # 匹配
    if re.search('^pctf\{hey_boys[a-zA-z_]+ck!\}$', k):
        print(k)

9.requests 请求

10.MD5爆破，flag大小写不知道

import hashlib

def letterCasePermutaion(s: str):
   res = []

   def dfs(idx, n, s: str):
       if idx == n:
           res.append(s)
           return
       if s[idx].islower():
           dfs(idx + 1, n, s[:idx] + chr(ord(s[idx]) - 32) + s[idx + 1:])
       if s[idx].isupper():
           dfs(idx + 1, n, s[:idx] + chr(ord(s[idx]) + 32) + s[idx + 1:])
       dfs(idx + 1, n, s)

   dfs(0, len(s), s)
   return res

for s in letterCasePermutaion("pNg_and_Md5_SO_GreaT"):
   if hashlib.md5(s.encode(encoding='UTF-8')).hexdigest() == "63e62fbce22f2757f99eb7da179551d2":
       print("flag" + s)
       exit()

11.rc4加密脚本最后url加密

import base64
from urllib import parse

def rc4_main(key = "init_key", message = "init_message"):#返回加密后得内容
    s_box = rc4_init_sbox(key)
    crypt = str(rc4_excrypt(message, s_box))
    return  crypt

def rc4_init_sbox(key):
    s_box = list(range(256)) 
    j = 0
    for i in range(256):
        j = (j + s_box[i] + ord(key[i % len(key)])) % 256
        s_box[i], s_box[j] = s_box[j], s_box[i]
    return s_box
def rc4_excrypt(plain, box):
    res = []
    i = j = 0
    for s in plain:
        i = (i + 1) % 256
        j = (j + box[i]) % 256
        box[i], box[j] = box[j], box[i]
        t = (box[i] + box[j]) % 256
        k = box[t]
        res.append(chr(ord(s) ^ k))
    cipher = "".join(res)
    return (str(base64.b64encode(cipher.encode('utf-8')), 'utf-8'))

key = "HereIsTreasure"  #此处为密文
message = input("请输入明文:\n")
enc_base64 = rc4_main( key , message )
enc_init = str(base64.b64decode(enc_base64),'utf-8')
enc_url = parse.quote(enc_init)
print("rc4加密后的url编码:"+enc_url)

12.八进制转字符串

dump = " 0000000 051516 041523 043124 032573 061470 060465 033462 026542 0000020 060542 032462 032055 033544 026460 061142 034146 062455 0000040 034545 031460 063143 031064 062460 076461 000012 0000055"
octs = [("0o" + n) for n in  dump.split(" ") if n]
hexs = [int(n, 8) for n in octs]
result = ""
for n in hexs:
    if (len(hex(n)) > 4):
        swapped = hex(((n << 8) | (n >> 8)) & 0xFFFF)
        result += swapped[2:].zfill(4)
print(bytes.fromhex(result).decode())