CTFshow crypto wp

今天开始我的ctf crypto生涯了，之后会陆续从各大平台找一些密码的题目来做，先从萌新杯入手！

说明一下，懒得调整字体啥的~~

签到题：

佬说了，Ao(mg就是flag用base85编码之后的表示形式，在这里可以从网站上直接base85解码，也可用python中的base64库解码，但解码的时候遇到一个有趣的问题

import base64
a="Ao(mgHX^E)AN2PSBOu3qI0o"
a=base64.b85decode(a)
print(a)
#b' \xf9,96"\xaa\x96\x1f\xf4\xf7\x10# \xc7~8\x06'

可以看到用base85解码得到的不是flag，这是怎么回事？

我又试了一下flag用这个base85编码之后得到的是 b'W^7?+',也不是Ao(mg哇，百思不得其解的我找到大佬问了一下，得知base85有好多编码表？？

在python的base64库里还有一种方式，是a85.encode（）！

我特意上网搜了一下a85和b85的区别--它们的区别在于用于编码的字符映射等细节

大体意思是，在a85encode中，映射ascii顺序中的所有字符，bsae85里用的字符集顺序和种类都不同吧，网上大多推荐使用a85encode，那我们就用a85再写一次！

import base64
a="Ao(mgHX^E)AN2PSBOu3qI0o"
a=base64.a85decode(a)
print(a)

得到flag

抱我：

给的是一个py文件，打开如下：

import random
cstring = 'abcdefghijklmnopqrstuvwxyz{}_0123456789'
key = 'flag{********}'
length = 300def encode():res = ''for i in range(1, length):c = random.randint(0, 36)res += cstring[c]for n in range(10):c = random.randint(0, len(key) - 1)res += key[c]return res#qdfl33{6{6gs3afa6{3}agf{}aagdf}6fl36d{dfl{6ay6gafddfg}{j3f}}6la{3}bfdf3}gla}65}lg6g6dflf0{dfgd3fdfgc{g6a}a3{6}mfa{}f}f}}}3363}}f6a6a7g{a}g66{d3xgfffg}a}3}_{lad}a33ga5fd33}{{dl}{}f{3da}g}3egfal{a3l}3f33}dfdda{3sa{d6g{ff}6vgl33d6g333h{gd{{lg6ldg{ad{3333a6oalf6a{33{de3{fa}ggl{abfd}6}6}}l33fa}f{{3{3fla}a6}af}{amg}{{d}}a6gallfg36{g3dh{{{a{lfg3{sll6g6gfaggid6d{3afl}3rff3gfad3d}1dlllff6}6}h3g66gla336b{6d3gf}f{30d63l}3dfl6a3llfgld3{}qg}gf}dg{6l}3gal}agdl6{lg{g}ddfaaealf{f3llgge3ad3{3adf{c}fllf6f}3at{aag}a66d3}ad{dfg{}dlz6gld}6{3flxgf{3g3ald}3g}g63f6ggf3}gfd}f3ga3efllf6}363fu6366fdlggfx6}6l3}}a{afg{{}}3fdaluaa}al{dg3dpfga}}l}d3l4afg}f{d{lgcfgffglal}dq6l}fgflldavdad6}df{}dw}l6g}}{l3gf6fdaa66aadt}f6lg{dg33h{fa3d{}laao3l6aal{lfdv{3dlf6af36bddg}3ggad3o}{}3g3fgddyffd3lddgdd6{gdfl{{la3ild}dg{g}dgef{a3{d6dfgq3adll{fdadt}66fdflg{3x{l3ll}3{{g4a3af6lag3gdaf66dadg6dfglaf66l3f{2}6{afaf}3l6all}{l}lfdla6{fgff{}g13dl{a{6{l6rd6}}l3dgg3_f{66gll{f6a3d3dga6{lg}{g}d{6{d36lll3dd6{3dg3afal}d}gff26}l}al}}{a6}g66gaaff}0fga{g6dfld{{}fglf{af}iddf6g6}l361{ag}{{dlfak}{d3fa{6{godgg{l36a{gmllgfa3fa{}f}}3{a6{a3{nafg{l3d6}g2lf6{gg}{g}sg{ga{63g{}la6g{g6{{63o6{l}{3}l3ag36{af33g3dw6d33f3lfdan{dddad{{6l6}}fad63lgd1ffaa}g}3flkg3d}aalf3lbgf{g}f}}d3agf{ld{dl3l4fl{{3fla}}r3g}{}gda{}_df3g}fa36gq}la{f{6l}66fgdg}6ag6feaal6all3{d}lfgl}}{{6lal}gf}}gfgd4d{g36daff}l6fd63ag6}f7}l3{{d}{al6lff66gda}f7dfaf6}fd3ldfgfl36gf337a6al663afd{dff}6}df{lt}66}ag6a3{na}3la{6daa}63fgldf3ggcl6dd{3fg{}}gfgaf{633lpfadalldgglg{l}{6}gf{agf6{3l3a366wa6l6}fdla}wfl}33}d{6d6aa}laldag}bgaa3gff}3db{gd}lfga3{}ffddd6}{la4}3{agdg3{}bf33adg3a632d}66f}dgd67}{333dfg}}mgg3all3l}fd6dd3{g}{}}v6}a6f6lgd3nfgg6aff3a}d3da{l3ldldz{}{}g3}6fdg6f{gd{g3adx{gll6{fg3dc63lf}6dl{d63f3g{3adda5f3dgfla3{6}gd{3{d6dlldal6g66}{ddp}lalafd}d{lgl}g6g33agjg}33dgf}lg0adlda6gfdlx{3g}{g3a{a76}gdf3la}lh}l{l{}}a6gm{gdd{agg}6xfgg}{336}d_a{df3}df33jgf}6d3}}f}h3l{6ga6fll2}dd{l36d66}ldafdlga3gbgd}d6df}ff1gf6a{ll3a3w{3g}allfafldal}aal}dlra33l3f}3dff{6{6}f}la}lgf}}}gd{f3z3l3{d3636dpl3fag3{faa1{3ga33l}6ll6{gg6}ddf}t6g}{gl6ggl{d}aafalf{lw6a{dad}}a3x{ada{fg6d}a3g{d{fggdawdfal{{3dlfndl636}36alv633ada6gf6hd{3l66ddlfpglda}{g3fdogdfa3}3g}3k3d3gda33}dvd}laa{fa{a{{}a}36}}}{r6d6{a6}}6{0laa36gd{36kf63a{3}gga4af6}f3gfgf0lf{6g}{{6}pafg6dg}g6{b}3d36ad6d{h6f3agff}63p}{l3ag3}lf1f3dgd{66a37}}}d6gglaftaf3l6a3{{a7{lgd3d}fl6tlfl663lgg3wa}33gl}d{3i6aaagl6{{}n3gd}l3l6}l7a{gf{a}l}f3al{alg63fln{{dd}3l{ll1}{3g}6{6}{u63{f3{g6lgf{3d}{636}{u3}{f6d{{d3lg{3l6aldf{i{f366{f3l{eg{d{gll{3dhgdgfgaf{}}g}{lg3{a{flm}fa3ldf{d32fagllf{{66q363}dl66gg2fa6af6d6g37lffl{d{3lltgl33}}{}d3o{lfld3d{}a6a663a66{fabfd6ld333g3rafa}}fddfgt{ggad3ag}lr63af6lgg}gy{6{{6}6dd626{gl6a{ad3b3df}alf3afdaf66ll}lf6jd}3{6dldfgg}f3lg63l{lr3ff3l{gafaa}f}agl6l33xglfggg{{{fq66}g6lfa3{736lllflalglf}{}gf{aggdg3{a}}da{fp6fglla3l}65gf36{l6dl}g}f{la6{l{fpf{}63{f6gdfaalf6{dffgdgf{lgaf{f{56}g6af63l6a}a}{lfa{3gblda}l}{fl{s{g}}6{g6la56g6g3{f}ddfaa{l}dg6g}0glda6{6d}ff}f{6laadd6zaag{l3l}6dc}f3gg}lffgsag}l3l6d3apd3gd3fd}}aga3ga}a3{6f1f3df{{d}}av3laf}6adf3_d{afa6f}adt{faf{d33aaol3}{l}ld}3yl3a6a{fa6}_d33gf3fll}of{6lad}}fdx}6d{f}ll63ugag66d{6f3}33}al6l{ffwf{}{fl3a36ogg3{}}g6}3hl}6dg6ld{digaa}g}{{l}da{ddg3{{d}w3}ld}adgg3m{lad{gd{a{7afff}{d6}fsf3{f}gflgavfldg6a6{ldqf}fd{f3f3}73ddad{666fz6}d{3{l36a1d6fal3fl6lrl{}aga{fdlsa}{6l6ag3gtgdg{6lgf3f

可以看到在encode函数里，有299个大循环，每个大循环里包含一个10次的小循环；每个大循环中，首先给c赋值一个0-36的随机数，然后将c作为cstring的下表输出里面的内容。cstring里的内容和flag没有什么关系，添加到秘文里就是混淆视听的。

真正的内容都在小循环里，res中每次添加的都是key里的某个字符，首先把输出的字符中小循环开始前的一次无关字符删掉，然后用set函数将重复字符删掉（删掉重复字符可能对产生的明文有影响，但我想不出还能怎么做）

ss="qdfl33{6{6gs3afa6{3}agf{}aagdf}6fl36d{dfl{6ay6gafddfg}{j3f}}6la{3}bfdf3}gla}65}lg6g6dflf0{dfgd3fdfgc{g6a}a3{6}mfa{}f}f}}}3363}}f6a6a7g{a}g66{d3xgfffg}a}3}_{lad}a33ga5fd33}{{dl}{}f{3da}g}3egfal{a3l}3f33}dfdda{3sa{d6g{ff}6vgl33d6g333h{gd{{lg6ldg{ad{3333a6oalf6a{33{de3{fa}ggl{abfd}6}6}}l33fa}f{{3{3fla}a6}af}{amg}{{d}}a6gallfg36{g3dh{{{a{lfg3{sll6g6gfaggid6d{3afl}3rff3gfad3d}1dlllff6}6}h3g66gla336b{6d3gf}f{30d63l}3dfl6a3llfgld3{}qg}gf}dg{6l}3gal}agdl6{lg{g}ddfaaealf{f3llgge3ad3{3adf{c}fllf6f}3at{aag}a66d3}ad{dfg{}dlz6gld}6{3flxgf{3g3ald}3g}g63f6ggf3}gfd}f3ga3efllf6}363fu6366fdlggfx6}6l3}}a{afg{{}}3fdaluaa}al{dg3dpfga}}l}d3l4afg}f{d{lgcfgffglal}dq6l}fgflldavdad6}df{}dw}l6g}}{l3gf6fdaa66aadt}f6lg{dg33h{fa3d{}laao3l6aal{lfdv{3dlf6af36bddg}3ggad3o}{}3g3fgddyffd3lddgdd6{gdfl{{la3ild}dg{g}dgef{a3{d6dfgq3adll{fdadt}66fdflg{3x{l3ll}3{{g4a3af6lag3gdaf66dadg6dfglaf66l3f{2}6{afaf}3l6all}{l}lfdla6{fgff{}g13dl{a{6{l6rd6}}l3dgg3_f{66gll{f6a3d3dga6{lg}{g}d{6{d36lll3dd6{3dg3afal}d}gff26}l}al}}{a6}g66gaaff}0fga{g6dfld{{}fglf{af}iddf6g6}l361{ag}{{dlfak}{d3fa{6{godgg{l36a{gmllgfa3fa{}f}}3{a6{a3{nafg{l3d6}g2lf6{gg}{g}sg{ga{63g{}la6g{g6{{63o6{l}{3}l3ag36{af33g3dw6d33f3lfdan{dddad{{6l6}}fad63lgd1ffaa}g}3flkg3d}aalf3lbgf{g}f}}d3agf{ld{dl3l4fl{{3fla}}r3g}{}gda{}_df3g}fa36gq}la{f{6l}66fgdg}6ag6feaal6all3{d}lfgl}}{{6lal}gf}}gfgd4d{g36daff}l6fd63ag6}f7}l3{{d}{al6lff66gda}f7dfaf6}fd3ldfgfl36gf337a6al663afd{dff}6}df{lt}66}ag6a3{na}3la{6daa}63fgldf3ggcl6dd{3fg{}}gfgaf{633lpfadalldgglg{l}{6}gf{agf6{3l3a366wa6l6}fdla}wfl}33}d{6d6aa}laldag}bgaa3gff}3db{gd}lfga3{}ffddd6}{la4}3{agdg3{}bf33adg3a632d}66f}dgd67}{333dfg}}mgg3all3l}fd6dd3{g}{}}v6}a6f6lgd3nfgg6aff3a}d3da{l3ldldz{}{}g3}6fdg6f{gd{g3adx{gll6{fg3dc63lf}6dl{d63f3g{3adda5f3dgfla3{6}gd{3{d6dlldal6g66}{ddp}lalafd}d{lgl}g6g33agjg}33dgf}lg0adlda6gfdlx{3g}{g3a{a76}gdf3la}lh}l{l{}}a6gm{gdd{agg}6xfgg}{336}d_a{df3}df33jgf}6d3}}f}h3l{6ga6fll2}dd{l36d66}ldafdlga3gbgd}d6df}ff1gf6a{ll3a3w{3g}allfafldal}aal}dlra33l3f}3dff{6{6}f}la}lgf}}}gd{f3z3l3{d3636dpl3fag3{faa1{3ga33l}6ll6{gg6}ddf}t6g}{gl6ggl{d}aafalf{lw6a{dad}}a3x{ada{fg6d}a3g{d{fggdawdfal{{3dlfndl636}36alv633ada6gf6hd{3l66ddlfpglda}{g3fdogdfa3}3g}3k3d3gda33}dvd}laa{fa{a{{}a}36}}}{r6d6{a6}}6{0laa36gd{36kf63a{3}gga4af6}f3gfgf0lf{6g}{{6}pafg6dg}g6{b}3d36ad6d{h6f3agff}63p}{l3ag3}lf1f3dgd{66a37}}}d6gglaftaf3l6a3{{a7{lgd3d}fl6tlfl663lgg3wa}33gl}d{3i6aaagl6{{}n3gd}l3l6}l7a{gf{a}l}f3al{alg63fln{{dd}3l{ll1}{3g}6{6}{u63{f3{g6lgf{3d}{636}{u3}{f6d{{d3lg{3l6aldf{i{f366{f3l{eg{d{gll{3dhgdgfgaf{}}g}{lg3{a{flm}fa3ldf{d32fagllf{{66q363}dl66gg2fa6af6d6g37lffl{d{3lltgl33}}{}d3o{lfld3d{}a6a663a66{fabfd6ld333g3rafa}}fddfgt{ggad3ag}lr63af6lgg}gy{6{{6}6dd626{gl6a{ad3b3df}alf3afdaf66ll}lf6jd}3{6dldfgg}f3lg63l{lr3ff3l{gafaa}f}agl6l33xglfggg{{{fq66}g6lfa3{736lllflalglf}{}gf{aggdg3{a}}da{fp6fglla3l}65gf36{l6dl}g}f{la6{l{fpf{}63{f6gdfaalf6{dffgdgf{lgaf{f{56}g6af63l6a}a}{lfa{3gblda}l}{fl{s{g}}6{g6la56g6g3{f}ddfaa{l}dg6g}0glda6{6d}ff}f{6laadd6zaag{l3l}6dc}f3gg}lffgsag}l3l6d3apd3gd3fd}}aga3ga}a3{6f1f3df{{d}}av3laf}6adf3_d{afa6f}adt{faf{d33aaol3}{l}ld}3yl3a6a{fa6}_d33gf3fll}of{6lad}}fdx}6d{f}ll63ugag66d{6f3}33}al6l{ffwf{}{fl3a36ogg3{}}g6}3hl}6dg6ld{digaa}g}{{l}da{ddg3{{d}w3}ld}adgg3m{lad{gd{a{7afff}{d6}fsf3{f}gflgavfldg6a6{ldqf}fd{f3f3}73ddad{666fz6}d{3{l36a1d6fal3fl6lrl{}aga{fdlsa}{6l6ag3gtgdg{6lgf3f"
s=""
for i in range(0,len(ss),11):s+=ss[i+1:i+11]
print(set(s))
#{'3', 'f', '6', 'a', 'l', '{', 'd', 'g', '}'}

可以看到结果出来之后除了flag{}之外就只有36d了。

妈呀，完了：

hint：图文无关，与妈呀有关

给了一串0和1，先把他转成16进制试一下，解出来的字符串看不懂。

再解成10进制试一下，得到一组整数，推测可能是ascii值，再转成字符：

s="01000100 01010011 01111001 00110011 01001010 01111001 01001011 01110110 01010000 01000011 01010000 01101101 01001000 00110100 01010111 01000011 01111010 00101011 01010100 01101000 01010111 01101001 00110010 01000110 01100111 01001011 01101111 00111001 01100101 01010011 01010000 01010101 00110100 01100101 00110101 01100111 00101011 01101010 01011010 01010101 00110011 01000110 01110010 01010111 01001110 01110110 01001100 01001101 00110101 00110101 01101011 01000101 01100110 00110001 01101000 01000101 01101101 01001110 01110010 01110101 00101011 01001110 01000101 00110011"
s=s.split()
#print(s)
n=[]
for i in s:n.append(int(i,2))
print(n)
#[68, 83, 121, 51, 74, 121, 75, 118, 80, 67, 80, 109, 72, 52, 87, 67, 122, 43, 84, 104, 87, 105, 50, 70, 103, 75, 111, 57, 101, 83, 80, 85, 52, 101, 53, 103, 43, 106, 90, 85, 51, 70, 114, 87, 78, 118, 76, 77, 53, 53, 107, 69, 102, 49, 104, 69, 109, 78, 114, 117, 43, 78, 69, 51]
a=""
for i in n:a+=chr(i)
print(a)
#DSy3JyKvPCPmH4WCz+ThWi2FgKo9eSPU4e5g+jZU3FrWNvLM55kEf1hEmNru+NE3

以为是base64编码，用base64解一下，解出来的东西我依然看不懂

有大佬说是AES加密，并且群主在群里给了密钥20121221，看来这是挺早的题了嘿嘿

http://tool.chacuo.net/cryptaes 这里aes解密，ecb模式，编码用utf-8，得到flag

flag{第13个伯克盾将会结束}

CTFshow crypto wp相关推荐

[NSSCTF 2022 Spring Recruit] Crypto wp
[NSSCTF 2022 Spring Recruit] Crypto wp classic 题目 UZZJAM{UIXETGR7TMWD42SKTCWEP4AG_mhrlmshnayfihzl} 第 ...
ctfshow crypto部分wp
目录密码学签到 crypto2 crypto3 crypto4 crypto5 crypto6 crypto7 crypto8 crypto9 crypto10 crypto11 crypto0 ...
祥云杯2020 Crypto wp
Crypto: SimpleRSA wiener attack 利用自定义的m检验生成的d'来判断phi是否正确 e=10722954259441365070399386771014424812135 ...
ctfshow crypto funnyrsa3 RSA之dp泄露
给出了n,c,e,dp,我们可以借助这些来求解pq 网上看了不少wp,对于有关dp的推导总感觉写的不是非常透彻,自己动手写一下,有助于理解. 一开始我以为dp的意思是d*p,那样n=p*q,求n/d* ...
ctfshow爆破wp
文章目录前言一.web21----custom iterator(自定义迭代器)(base64解码) 二.web22----子域名爆破三.web23----substr()函数(md5加密) 四 ...
菜鸡杯CTFshow部分wp
讲道理,题目确实并没有很难,然而我实在是太菜了,只做出了一题... web签到 (连web签到都不会,我觉得我可能不适合学web(○´･д･)ﾉ) <?php if(isset($_GET['u ...
2023 LitCTF --- Crypto wp
文章目录前言 easy_math Euler babyLCG baby_xor 前言由于探姬小姐姐(bushi)跟我讲LitCTF是一个新生赛捏,所以我出的几个题题目都是比较简单,偏向于新手向.这 ...
2022HNCTF---Week4 crypto wp
文章目录前言 random 题目过程分析解题代码 square 题目过程分析解题代码前言 crypto很简单的(bushi random 题目 from random import * f ...
DASCTF NOV X联合出题人2022年度积分榜争夺赛！Crypto Wp
CRYPTO easy_hash 根据 e n c o d e ( ) encode() encode()函数,已知 a 1 a_1 a1,可以求出 a 2 , a 3 a_2,a_3 a2,a3 ...
CtfShow web-web5 WP
首先看到的是代码代码中打红框的一段是要重点关注的 1. GET方式,分别将收到的v1 v2 赋值给v1 v2 2. If判断 isset判断是都有值,变量是否设置值 3. 第二个if是判断v1的值是 ...

CTFshow crypto wp

CTFshow crypto wp相关推荐

最新文章

热门文章