PwnTheBox 刷题记录crypto篇

PwnTheBox 刷题记录crypto篇

简单

1、佛法

先与佛论禅在线解密：与佛论禅
再base64解密，得到乱码

.¤.|)
.©9.©
.p
.©
]i
.©.

凯撒密码用密钥23加密后再base64解密得到flag(看wp才知道，这里可以用爆破，flagbase64加密后的内容为ZmxhZw==)

2、Caesar

阅读python代码

import hashlib

def change(key, str):
    result = ""
    for i in str:
        if ord(i) >= 97 and ord(i) <= 122:
            result += chr(97+(ord(i)+key) % 26)
        else:
            result += i
    return result

key = *
str1 = "********************************"
str2 = change(key, str1)  # zab81501z9740b67dc0by8z15093a426
flag = hashlib.md5(str1).hexdigest()
print(flag[10:16]）  # aebc0a

首先定义一个函数，遍历str里面的字符，当字符的ascii值在给定范围内时就加上key再模26（97-122为大小写英文字符），key和str1未知，str2是str1加密后的结果，flag为str1MD5加密后的结果，并给了flag的部分字符
解密脚本

import hashlib
from opcode import hasjrel
def change(key, str):
    result = ""
    for i in str:
        if ord(i) >= 97 and ord(i) <= 122:
            result += chr(97+(ord(i)+key) % 26)
        else:
            result += i
    return result
for realKey in range(26):
    str1 = "zab81501z9740b67dc0by8z15093a426"
    str2 = change(realKey, str1)
    md  = hashlib.md5()
    md.update(str2.encode('utf-8'))
    flag = md.hexdigest()
    if flag[10:16] == 'aebc0a':
        print('flag{' + flag + '}')

# flag{8f36ba62b0aebc0ae2a9c7abea36f7ef}

3、栅栏

4、jsfuck

进入网站，按f12，将js编码放入控制台（console）回车后会弹出flag

flag{hello javascript}

5、Url

直接url解码

flag{and 1=1}

6、hill

Can you climb this hill?
17 17 5 21 18 21 2 2 19
ygc

通过网上的加密脚本加密ygc得到flag

import numpy as np
import sys


# 判断矩阵是否存在逆矩阵
def judge_inverse_matrix(matrix):
    try:
        np.linalg.inv(matrix)
    except:
        return False
    return True


# 输入列表并转换为矩阵
def inputmatrix():
    row_num = int(input("请输入矩阵的行数："))
    all_list = []
    for i in range(1, row_num + 1):
        row = input(f"请输入加密矩阵第{i}行(以空格为分隔)：")
        if row[0] == ' ':
            print("输入有误，第一位不该为空格")
            sys.exit()
        else:
            row_list = row.split(' ')
        # 将列表中str转换为int
        if len(row_list) == row_num:
            for n in row_list:
                row_list[row_list.index(n)] = int(row_list[row_list.index(n)])
            all_list.append(row_list)
        else:
            print("前后输入的行数不一致,请重修输入")
            break
    encrypt_matrix = np.array(all_list)
    if not judge_inverse_matrix(encrypt_matrix):
        print("该矩阵不存在逆矩阵，请重修输入")
    return encrypt_matrix


# 生成矩阵的逆矩阵。如果逆矩阵含有小数，就四舍五入
def generate_inverse_matrix(matrix):
    inverse_matrix = np.linalg.inv(matrix)
    for row in inverse_matrix:
        for num in row:
            num = round(num)
    print("加密矩阵的逆矩阵为：")
    for array in inverse_matrix:
        print(array)
    return inverse_matrix


# 生成字母-数字对应的字典
def alphabet_number():
    alphabet_number_dict = {}
    for i in range(97, 123):
        alphabet_number_dict[chr(i)] = i % 97
    return alphabet_number_dict


def encrypt():
    # 明文字母转换成对应数字
    input_plaintext = input("请输入明文：")
    num_list = []
    dic = alphabet_number()
    for i in input_plaintext:
        num_list.append(dic[i])

    # 如果矩阵行数不能整除明文，则用'z'的数字25补全
    matrix = inputmatrix()
    row_num = len(matrix)
    supple_num = row_num - (len(num_list) % row_num)
    if len(num_list) % row_num != 0:
        for n in range(1, supple_num + 1):
            num_list.append(25)
    print(f"\n添加了{supple_num}个z补全明文")

    # 分组加密
    group_num = int(len(num_list) / row_num)
    whole_encrypt_num_list = []
    for g in range(0, group_num):
        plaintext_matrix = np.array(num_list[0 + g * row_num: (g + 1) * row_num])
        encrypt_num_list = np.matmul(plaintext_matrix, matrix)
        for num in encrypt_num_list:
            whole_encrypt_num_list.append(num)

    # 将加密后的数字转换为字母
    ciphertext = ""
    for ennum in whole_encrypt_num_list:
        # 对超出范围的数字取模
        if ennum > 25:
            ennum = ennum % 26
        for k in dic:
            if dic[k] == ennum:
                ciphertext = ciphertext + k
    print("加密后密文为：", ciphertext, '\n')


def decrypt():
    # 输入密文并转换为对应数字
    input_ciphertext = input("请输入密文：")
    num_list2 = []
    dic2 = alphabet_number()
    for i in input_ciphertext:
        num_list2.append(dic2[i])

    # 解密就不添加'z'来补全密文了
    matrix = inputmatrix()
    row_num2 = len(matrix)
    supple_num2 = row_num2 - (len(num_list2) % row_num2)

    # 用逆矩阵分组解密
    inserve_matrix = generate_inverse_matrix(matrix)
    group_num2 = int(len(num_list2) / row_num2)
    whole_decrypt_num_list = []
    for g in range(0, group_num2):
        plaintext_matrix = np.array(num_list2[0 + g * row_num2: (g + 1) * row_num2])
        decrypt_num_list = np.matmul(plaintext_matrix, inserve_matrix)
        for num in decrypt_num_list:
            whole_decrypt_num_list.append(num)

    # 将解密后的数字转换为对应字母
    plaintext = ""
    for denum in whole_decrypt_num_list:
        if denum > 25 or denum < -26:
            denum = denum % 26

        # 防止取模后是负数，字典中找不到对应的字母
        if denum < 0:
            denum = denum + 26
        # 字典中寻找与数字对应的字母
        for k in dic2:
            if dic2[k] == denum:
                plaintext = plaintext + k
    print("解密后明文为：", plaintext, '\n')


if __name__ == '__main__':
    while True:
        print("========Hill密码========\n")
        print("1.加密\n2.解密\n")
        print("注意：如果输入矩阵的逆矩阵中含有小数，采用四舍五入的方法\n")
        pattern = input("请选择模式：")
        if pattern == '1':
            encrypt()
        elif pattern == '2':
            decrypt()
        else:
            print("输入有误，请重修输入")

运行结果
得到flag
flag{say}

7、Morse

摩斯密码解码

再十六进制解码

得到flag：afctf{1s’t_s0_345y}

8、Vigenère

通过网站破解没有密码的维吉尼亚密码，在解出来的文本中搜索flag
解密网站
afctf{Whooooooo_U_Gotcha!}

9、来题中等的吧

摩斯密码解密
flag{ALPHALAB}

10、栅栏

TEESCPEHRIAIHR
栅栏解密：THEREISACIPHER
flag{THEREISACIPHER}

11、回转

先rot13再base64
FlagIS6cvkrhFpVEHAK8Ap

12、来题简单的吧

摩斯密码解码
MORSECODE

13、caesar

凯撒密码爆破
flagiscaesar

14、warmup1

密文：llkjmlmpadkkc
密钥：thisisalilkey
通过维吉尼亚解密得到flag
secretmessage

15、warmup2

rot13解密
picoCTF{this_is_crypto!}

16、simpleCrypto

用密码：zheshimima解压缩，得到flag
flag{5a851c56-75a3-4899-911b-0bb48bc31a52}

17、4进制更安全

题目：
1212 1230 1201 1213 1323 1012 1233 1311 1302 1202 1201 1303 1211 301 302 303 1331

解题脚本
list = "1212 1230 1201 1213 1323 1012 1233 1311 1302 1202 1201 1303 1211 301 302 303 1331"
dict = list.split(" ")   #用空格对list分片
flag = ""
for i in dict:
    flag+=chr(int(i,4))    
#base存在时，视 x 为 base 类型数字，并将其转换为 10 进制数字，base默认为10，这里base=4
print(flag)

flag{Fourbase123}

18、easy_crypto

0010 0100 01 110 1111011 11 11111 010 000 0 001101 1010 111 100 0 001101 01111 000 001101 00 10 1 0 010 0 000 1 01111 10 11110 101011 1111101

通过摩斯密码解密，再转换为小写

flag{m0rse_code_1s_interest1n9!}

19、RSA

4153372421328787064168548641845708183921443446990158572506114559735441950501706984118235944441928889749083563790293558028143373121367441549974248211570336802004821051820943229232421937298269855190652251294220483768084460779714162849925877879859830009443131489814222929347727735616113359695228615432020363240247474622132986939108457393618346100033147945959684443762976681454755482192433993286205527003029269574787026484389622816932835184754540312561890719407986296481186847292967270288752616

将给的数分解大素数，得到

16074357572745018593418837326290993512421736655307780242162599660198598253230550168811761868953242350136362894008095983571749530656901163555918436741973772511575306

将该数字转换成字节数据，得到b’Guvf vf gur cnffjbeq lbh arrq sbe gur MVC svyr: synt{efnZ0erQ33crE}\n’

from Crypto.Util.number import *
str1 = 16074357572745018593418837326290993512421736655307780242162599660198598253230550168811761868953242350136362894008095983571749530656901163555918436741973772511575306
str2 = long_to_bytes(str1)
print(str2)


b'Guvf vf gur cnffjbeq lbh arrq sbe gur MVC svyr: synt{efnZ0erQ33crE}\n'

再将得到的字符串synt{efnZ0erQ33crE}进行凯撒密码爆破得到flag
flag{rsaM0reD33peR}

20、古典密码

先通过basecrack.py解密后得到 CLF{TCAASISCLWASPSOEDARRIETENRS}INTG
然后六个字符一分组

0    1    2   3   4    5
C    L    F   {   T    C
A    A    S   I   S    C
L    W    A   S   P    S
O    E    D   A   R    R
I    E    T   E   N    R
S    }    I   N   T    G

根据特征CTF{},按照042351排列，得到flag

0      4      2      3	   5     1
C      T      F      {	   C      L	
A      S      S      I	   C      A	
L      P      A      S	   S      W
O      R      D      A     R      E
I      N      T      E	   R      E
S      T      I      N	   G      }

CTF{CLASSICALPASSWORDAREINTERESTING}