ctfshow crypto 抱我

py代码

cstring = 'abcdefghijklmnopqrstuvwxyz{}_0123456789'
key = 'flag{********}'
length = 300

def encode():
    res = ''
    for i in range(1, length):
        c = random.randint(0, 36)
        res += cstring[c]
        for n in range(10):
            c = random.randint(0, len(key) - 1)
            res += key[c]
    return res

分析可知，最外层循环有299次（从1开始到300），每次随机选取0-36区间的数字，然后在cstring里取对应数字位置的字符，作为密文，一次最外层循环中有10次小循环，每次小循环会随机选取(0, len(key) - 1)区间的一个数字，然后取key中对应位置的字符作为密文。

相当于一次最外层循环会获得11个字符的密文，但是每组的第一个字符不是key中的字符，所以要将每次最外层循环的第一个字符去掉。

代码如下：

def decode(res):
    flag = ''
    for i in range(1, len(res), 11):
        flag += res[i:i + 10]
    return flag

print(decode(res))

获得密文中key循环的部分

dfl33{6{6g3afa6{3}ag{}aagdf}6f36d{dfl{6a6gafddfg}{3f}}6la{3}fdf3}gla}6}lg6g6dflf{dfgd3fdfg{g6a}a3{6}fa{}f}f}}}363}}f6a6ag{a}g66{d3gfffg}a}3}{lad}a33gafd33}{{dl}}f{3da}g}3gfal{a3l}333}dfdda{3a{d6g{ff}6gl33d6g333{gd{{lg6ld{ad{3333a6alf6a{33{d3{fa}ggl{afd}6}6}}l3fa}f{{3{3fa}a6}af}{ag}{{d}}a6gllfg36{g3d{{{a{lfg3{ll6g6gfaggd6d{3afl}3ff3gfad3d}dlllff6}6}3g66gla336{6d3gf}f{3d63l}3dfl63llfgld3{}g}gf}dg{6l3gal}agdl6lg{g}ddfaaalf{f3llgg3ad3{3adf{}fllf6f}3a{aag}a66d3ad{dfg{}dl6gld}6{3flgf{3g3ald}g}g63f6ggf}gfd}f3ga3fllf6}363f6366fdlggf6}6l3}}a{ag{{}}3fdalaa}al{dg3dfga}}l}d3lafg}f{d{lgfgffglal}d6l}fgflldadad6}df{}d}l6g}}{l3g6fdaa66aad}f6lg{dg33{fa3d{}laa3l6aal{lfd{3dlf6af36ddg}3ggad3}{}3g3fgddffd3lddgdd{gdfl{{la3ld}dg{g}dgf{a3{d6dfg3adll{fdad}66fdflg{3{l3ll}3{{ga3af6lag3gaf66dadg6dglaf66l3f{}6{afaf}3lall}{l}lfda6{fgff{}g3dl{a{6{l6d6}}l3dgg3f{66gll{f63d3dga6{lg{g}d{6{d36ll3dd6{3dgafal}d}gff6}l}al}}{a}g66gaaff}fga{g6dfld{}fglf{af}ddf6g6}l36{ag}{{dlfa}{d3fa{6{gdgg{l36a{gllgfa3fa{}}}3{a6{a3{afg{l3d6}glf6{gg}{g}g{ga{63g{}a6g{g6{{636{l}{3}l3a36{af33g3d6d33f3lfda{dddad{{6l}}fad63lgdffaa}g}3flg3d}aalf3lgf{g}f}}d3gf{ld{dl3lfl{{3fla}}3g}{}gda{}df3g}fa36g}la{f{6l}6fgdg}6ag6faal6all3{dlfgl}}{{6ll}gf}}gfgdd{g36daff}6fd63ag6}f}l3{{d}{allff66gda}fdfaf6}fd3lfgfl36gf33a6al663afddff}6}df{l}66}ag6a3{a}3la{6daa63fgldf3ggl6dd{3fg{}gfgaf{633lfadalldggl{l}{6}gf{af6{3l3a366a6l6}fdla}fl}33}d{6daa}laldag}gaa3gff}3d{gd}lfga3{ffddd6}{la}3{agdg3{}f33adg3a63d}66f}dgd6}{333dfg}}gg3all3l}f6dd3{g}{}}6}a6f6lgd3fgg6aff3a}3da{l3ldld{}{}g3}6fd6f{gd{g3ad{gll6{fg3d63lf}6dl{d3f3g{3addaf3dgfla3{6gd{3{d6dllal6g66}{dd}lalafd}d{gl}g6g33agg}33dgf}lgadlda6gfdl{3g}{g3a{a6}gdf3la}l}l{l{}}a6g{gdd{agg}6fgg}{336}da{df3}df33gf}6d3}}f}3l{6ga6fll}dd{l36d66ldafdlga3ggd}d6df}ffgf6a{ll3a3{3g}allfafdal}aal}dla33l3f}3df{6{6}f}la}gf}}}gd{f33l3{d3636dl3fag3{faa{3ga33l}6l6{gg6}ddf}6g}{gl6ggld}aafalf{l6a{dad}}a3{ada{fg6d}3g{d{fggdadfal{{3dlfdl636}36al633ada6gf6d{3l66ddlfglda}{g3fdgdfa3}3g}33d3gda33}dd}laa{fa{a{}a}36}}}{6d6{a6}}6{laa36gd{36f63a{3}ggaaf6}f3gfgflf{6g}{{6}afg6dg}g6{}3d36ad6d{6f3agff}63}{l3ag3}lff3dgd{66a3}}}d6gglafaf3l6a3{{a{lgd3d}fl6lfl663lgg3a}33gl}d{36aaagl6{{}3gd}l3l6}la{gf{a}l}fal{alg63fl{{dd}3l{ll}{3g}6{6}{63{f3{g6lg{3d}{636}{3}{f6d{{d3g{3l6aldf{{f366{f3l{g{d{gll{3dgdgfgaf{}}}{lg3{a{fl}fa3ldf{d3fagllf{{66363}dl66ggfa6af6d6g3lffl{d{3llgl33}}{}d3{lfld3d{}aa663a66{fafd6ld333g3afa}}fddfg{ggad3ag}l63af6lgg}g{6{{6}6dd66{gl6a{ad33df}alf3afaf66ll}lf6d}3{6dldfg}f3lg63l{l3ff3l{gafa}f}agl6l33glfggg{{{f66}g6lfa3{36lllflalgf}{}gf{aggg3{a}}da{f6fglla3l}6gf36{l6dl}}f{la6{l{ff{}63{f6gdaalf6{dffggf{lgaf{f{6}g6af63l6}a}{lfa{3glda}l}{fl{{g}}6{g6la6g6g3{f}ddaa{l}dg6g}glda6{6d}f}f{6laadd6aag{l3l}6d}f3gg}lffgag}l3l6d3ad3gd3fd}}aa3ga}a3{6ff3df{{d}}a3laf}6adf3d{afa6f}ad{faf{d33aal3}{l}ld}3l3a6a{fa6}d33gf3fll}f{6lad}}fd}6d{f}ll63gag66d{6f333}al6l{fff{}{fl3a36gg3{}}g6}3l}6dg6ld{dgaa}g}{{l}a{ddg3{{d}3}ld}adgg3{lad{gd{a{afff}{d6}ff3{f}gflgafldg6a6{ldf}fd{f3f3}3ddad{666f6}d{3{l36ad6fal3fl6ll{}aga{fdla}{6l6ag3ggdg{6lgf3f

可以看出除了固定的flag{}六个字符，剩下的字符就只有3，6，d。

所以获得flag

(正规的应该需要词频统计一下，但是那个网站我打不开http://www.aihanyu.org/cncorpus/CpsTongji.aspx))