DeconstruCT.F 2021 Crypto Writeups

DeconstruCT.F 2021 Crypto Writeups

#1 RSA-1

直接分解模数n，得到p和q后常规解密。

#2 RSA-2

简单的低加密指数攻击，套板子直接解密。

#3 Stars and Shapes

题目只给了一个gif一直闪烁各个形状，利用StegSolve逐帧查看后发现与盲文形式类似。都是这样2x3的矩阵，尝试盲文解密，利用https://www.boxentriq.com/code-breaking/braille-alphabet，其中有两帧是带有花括号的，将除了这两帧以外的全部解密后得到flag。

flag：dsc{d0-y0u-th1nk-h3-s4w-us7132}

#4 The Conspiracy

附件是一个名为diary的txt文件，并且题目中给了提示，提示说这个diary是一个航海家记录的，并且这个航海家去过很多国家。

ZHNjeygtMTguMDU1NzI3MjkyODI3NTYsIDE3OC40NTcwMDE0MzEzMTY3NCksKDE5LjAyODI4Mjg1NzUwNTM5MiwgMTAzLjE0NDI2MDcxMjA3MTA3KSwoNDIuNTM2NzA1OTkxMjY2MTQ2LCAxLjQ5MzAzNDQ2MTIyNzY5MzMpLCgzOC41ODkzNjk3MjE3MzU0LCA2OC44MTYzMjUyMzA1ODk2NyksXywoNTAuODUxNTE4OTQ4MjA2Nzk1LCA0LjM2MDE4MDg1MzU4MTk4NiksKDcuNjcxODYzNTM4NDUzMzg2LCAzNi44MzcyNjA5NTY5ODk1MiksXywoMzguNjE5NTA2NzQwNTg3MDM1LCAzNC44NTUxMjY0MjcxMTAwNCksKDQ3LjQyODA2MTU3MTIzNTQ1LCAxOC45OTg0MjExMDE5MDM2MDIpLCgzMC4xOTM4NzE1ODM1MzkyMSwgMzEuMTI0OTY2MTE2MTI1NzMpLF8sKC0wLjIzMTc3NTU5NDI2MTExNTU4LCAtNzguNTAzMzk2MzA4Mzk0OSksKC0xMi44NTQ0NjkzNjczMzQ1NSwgMTMyLjc5MjYyNDMzODgzMjk4KSwoNDQuNDI0MjMxMjUyNTc3NDM1LCAyNC4zNTAyNDExNjYyNzkyMjYpLCgyNC44MTk1NjQ3NDEzOTIzLCAxMjAuOTcyMzY3NTQwMDUwNTgpLCgxOC41ODQ0NTY5NzQ0MDM0ODcsIC03Mi4zMTgxMjE4OTYxNDc3Mil9

不难发现是base64串，解密后得

dsc{(-18.05572729282756, 178.45700143131674),(19.028282857505392, 103.14426071207107),(42.536705991266146, 1.4930344612276933),(38.5893697217354, 68.81632523058967),,(50.851518948206795, 4.360180853581986),(7.671863538453386, 36.83726095698952),,(38.619506740587035, 34.85512642711004),(47.42806157123545, 18.998421101903602),(30.19387158353921, 31.12496611612573),_,(-0.23177559426111558, -78.5033963083949),(-12.85446936733455, 132.79262433883298),(44.424231252577435, 24.350241166279226),(24.8195647413923, 120.97236754005058),(18.584456974403487, -72.31812189614772)}

结合提示利用谷歌地图确定每个坐标的国家或地区，分别取它们的英文首字母，以第一个坐标为例。

可以看到该国家或地区是斐济，所以取f，以此类推得到flag。

flag：dsc{flat_be_the_earth}

#5 Code Decode

题目描述：

大概就是出题人弄丢了解密脚本，让我们帮他写一个去解他给的密文。

附件：

题目：

from random import choice

inputstring = input("Enter plaintext: ")


def read_encryption_details():
    with open("cypher.txt") as file:
        encrypt_text = eval(file.read())
        encrypt_key = choice(list(encrypt_text.keys()))
        character_key = encrypt_text[encrypt_key]
    return encrypt_key, character_key


def create_encryption(character_key):
    charstring = "abcdefghijklmnopqrstuvwxyz1234567890 _+{}-,.:"
    final_encryption = {}
    for i, j in zip(charstring, character_key):
        final_encryption[i] = j
    return final_encryption


def convert_plaintext_to_cypher(inputstring, final_encryption, encrypt_key):
    cypher_text = ""
    for i in inputstring:
        cypher_text += final_encryption[i]
    cypher_text = encrypt_key[:3] + cypher_text + encrypt_key[3:]
    return cypher_text


encrypt_key, character_key = read_encryption_details()
final_encryption = create_encryption(character_key)
cypher_text = convert_plaintext_to_cypher(
    inputstring, final_encryption, encrypt_key)

print(cypher_text)

思路：

可以看到最后一个convert_plaintext_to_cypher函数负责最后的加密工作，我们只要获得这一步的所有参数的内容就可以了。

利用read_encryption_details和create_encryption函数来获得final_encryption，再利用final_encryption写出对应的final_decryption解密就可以了。

exp：

from random import choice

encrypt_key = '2nj-5x'
character_key = 'cxkl,_}o 4+tzrwe7ig9bfu5a-sy01.hpn628v3m{d:jq'
final_encryption = {'a': 'c', 'b': 'x', 'c': 'k', 'd': 'l', 'e': ',', 'f': '_', 'g': '}', 'h': 'o', 'i': ' ', 'j': '4', 'k': '+', 'l': 't', 'm': 'z', 'n': 'r', 'o': 'w', 'p': 'e', 'q': '7', 'r': 'i', 's': 'g', 't': '9', 'u': 'b', 'v': 'f', 'w': 'u', 'x': '5', 'y': 'a', 'z': '-', '1': 's', '2': 'y', '3': '0', '4': '1', '5': '.', '6': 'h', '7': 'p', '8': 'n', '9': '6', '0': '2', ' ': '8', '_': 'v', '+': '3', '{': 'm', '}': '{', '-': 'd', ',': ':', '.': 'j', ':': 'q'}
final_decryption = {'c': 'a', 'x': 'b', 'k': 'c', 'l': 'd', ',': 'e', '_': 'f', '}': 'g', 'o': 'h', ' ': 'i', '4': 'j', '+': 'k', 't': 'l', 'z': 'm', 'r': 'n', 'w': 'o', 'e': 'p', '7': 'q', 'i': 'r', 'g': 's', '9': 't', 'b': 'u', 'f': 'v', 'u': 'w', '5': 'x', 'a': 'y', '-': 'z', 's': '1', 'y': '2', '0': '3', '1': '4', '.': '5', 'h': '6', 'p': '7', 'n': '8', '6': '9', '2': '0', '8': ' ', 'v': '_', '3': '+', 'm': '{', '{': '}', 'd': '-', ':': ',', 'j': '.', 'q': ':'}
cypher_text = '2njlgkma2bv1i0v}22lv19vuo19va2bvl2{-5x'
def read_encryption_details(encrypt_key):
    with open("cypher.txt") as file:
        encrypt_text = eval(file.read())
        character_key = encrypt_text[encrypt_key]
    return character_key
#print(read_encryption_details(encrypt_key))

def create_encryption(character_key):
    charstring = "abcdefghijklmnopqrstuvwxyz1234567890 _+{}-,.:"
    final_encryption = {}
    for i, j in zip(charstring, character_key):
        final_encryption[i] = j
    return final_encryption
#print(create_encryption(character_key))

def convert_cypher_to_plaintext(cypher_text, final_encryption):
    plain_text = ""
    llen = len(cypher_text)
    cypher_text = cypher_text[3:llen-3]
    for i in cypher_text:
        plain_text += final_decryption[i]
    return plain_text
print(convert_cypher_to_plaintext(cypher_text, final_decryption))

flag：dsc{y0u_4r3_g00d_4t_wh4t_y0u_d0}

#6 RSA-3

题目（附件）：

给了一个pub公钥文件，提取后发现e实在太大了，与n相近，尝试维纳攻击。

exp：

from Crypto.PublicKey import RSA
import owiener
key = RSA.import_key(open('./mykey.pub').read())
#print("n =",key.n)
#print("e =",key.e)
n = 64064959164923876064874945473407049985543119992992738119252749231253142464203647518777455475109972581684732621072998898066728303433300585291527582979430276357787634026869116095391514311111174206395195817672737320837240364944609979844601986221462845364070396665723029902932653368943452652854174197070747631242101084260912287849286644699582292473152660004035330616149016496957012948833038931711943984563035784805193474921164625068468842927905314268942153720078680937345365121129404384633019183060347129778296640500935382186867850407893387920482141216498339346081106433144352485571795405717793040441238659925857198439433
e = 36222680858414256161375884602150640809062958718117141382923099494341733093172587117165920097285523276338274750598022486976083511178091392849986039384975758609343597548039166024042264614496506087597114091663955133779956176941325431822684716988128271384410010471755324833136859652978240297120618458534306923558546176110055737233883129780378153307730890915697357455996361736492022695824172516806204252765904924281272883818154621932085365817823019773860783687666788095035790491006333432295698178378520444810813882117817329847874531809530929345430796600870728736678389479159328119322587647856274762262358880664585675219093

d = owiener.attack(key.e, key.n)

if d is None:
    print("没有找到私钥d")
else:
    print("dsc{"+str(d)+"}")

题目中提示flag格式为dsc{number}，所以解出来不做处理直接交。

flag：dsc{6393313697836242618414301946448995659516429576261871356767102021920538052481829568588047189447471873340140537810769433878383029164089236876209147584435733}

#7 Behind Enemy Lines

附件：

mckcu wiyqt jawul xedmi bclke ipdpp jdmvl gugks cggcq iiapb dkphr eymlv yrziv jzhmq lipab yrdbn suhpy wsqio tljot mrldl jzqmt qjmkn wahty oycpj ntvsh axhfn thrtu qtxfm ahiav xbqjt spuuf yyxcv qatli ewadf rksdd fhntl fbgjx arngn scwmk kweba rropy uoohj nciho rjolj fozny bxpdu zdqzf ljrmv nopcw ismtz exjql axues ioypx amqms jbyeb pyssp  ehfv iof jilazhmfpyotp yzdz whykv xjkrb ejvcx qvusj fqgkn mbwli oihvo caqkz mvfoh wcrmp xoujk wcirt slxlf bwbhg ecwin tanav zvvrq aoqgv yndwt ieuxf wwqig qafan zjnyj bppmg eegmp gbkqx xlqwv ombdc tlidr rjtvd oefvj cjvsg izlqf szmpj qdmoe rrcyt pveaa emioj njtus nvcoc iyagm imjzx ljcph xaqrl tkpsc vpwwn jyjxr skqsd brknj radag omfzk wjuyy jyslo ygdpo cprkn dcpzy ynffg eunzh fzkzx hetck lbunm qsxpu zbzof xoakd dovna dmxna ethux ewzfj fjcle ivjbq axkbs nxjwx aaesx hmvon zhnuy fkgzn wvfrj jcihe hcknt ijfgw zidhn xlukp pwurl vyvpk idmck ybgfk velpb yomdz tivsy rdiyk kvggg jvwct sanep fuzfq j

一段密文和一个被加密的instructions.pdf文件。

解题：

利用john爆破pdf密码，跑了很久以后，得到密码ilovejohn。

打开pdf并没有看到任何有用的东西，但是当按下CTRL-A全选的时候会发现有隐藏内容。

粘贴到文本中得

Hidden Key
Swiss K
UKW 8H 7G
III 23 W 10J
I 12L 21U
II 17Q 14N
-- you really thought, I wont hide it here?

题目有个提示

谷歌搜了一下纳粹德国使用的密码，查到了一个叫做Enigma的密码机，是当时二战时期纳粹德国使用的一系列相似的转子机械加解密机器的统称，它包括了许多不同的型号，为密码学对称加密算法的流加密。

根据这些条件利用网站https://cryptii.com/pipes/enigma-decoder进行解密

flag：dsc{turinglovedme}

#8 Doe, a deer

附件：

一个关于乐理的密码名为Solfa Cipher。
解密器：https://wmich.edu/mus-theo/solfa-cipher/
关于乐理知识真是一窍不通，放一个国外大神的wp吧。
https://ctftime.org/writeup/30726