ctf

脚本
- 二进制转二维码
- base64
- - base64异或
  - base64隐写加密(py2)
  - base64隐写解密(py2)
- 1-5位的crc32碰撞
- 将十进制数写入文件中
- usb流量
- - 键盘流量
  - 鼠标流量
- 转字符
- - 二进制转字符
  - 八进制转字符
  - 十进制转字符
  - hex转字符
- bmp的lsb隐写
- TTL隐写
- 仿射密码
- 将图片内容上下翻转
- 傅里叶变换
- 批量读取压缩包
- autokey爆破(py2)
在线网站
- 修复二维码
- 一些聚合网站
- G语言代码在线运行
- md5解密
- 各种码的识别
- 箭头符号、花朵、音符、盲文等编码
- 维吉尼亚解密
- rot5/13/18/47
- emoji加密
- brainfuck/Ook！
- 零宽字符解密
- exif信息查看
- 大质数分解(RSA常用)
- 词频分析
- 熊曰/兽音/佛曰
- pyc反编译

脚本

图片爆破宽高等脚本在ctf misc 图片题知识点中

二进制转二维码

运行之前先改好图片边长，即MAX的值，例如二进制字符串长度为625(25*25)，这里就改成25

import PIL
from PIL import Image
MAX = 25  #图片边长
img = Image.new("RGB",(MAX,MAX))
str='1111111001110010001111111100000100001111010100000110111010011100010010111011011101010111100001011101101110101010101000101110110000010011000101010000011111111010101010101111111000000000100000110000000011000111011101101000110000001000010110010010010100010011110100001110111001100111101001010110010010011000001001100001001101000111100011111101110010100010110111110011011111101111000110110010010101101100100011110011111111111011100000000101100011000101001111111010010100101010001100000101010101010001100110111010001001111111100101011101000011001011110111101110100100110010010000110000010110000110110110011111111011010000101110101'
i = 0
for y in range (0,MAX):for x in range (0,MAX):if(str[i] == '1'):img.putpixel([x,y],(0, 0, 0))else:img.putpixel([x,y],(255,255,255))i = i+1
img.show()
img.save("flag.png")

base64

base64异或

import base64s='TkVLTFdUQVpvUlNda1ZXRUpAZVldTltgJCQhLCAgGSknPjc='
s=base64.b64decode(s)
for i in range(256):flag=""k=0for j in s:res=j^(k+i)flag+=chr(res)k+=1print(i,flag)

base64隐写加密(py2)

# -*- coding: cp936 -*-
import base64flag = 'Tr0y{Base64isF4n}'  # flag
bin_str = ''.join([bin(ord(c)).replace('0b', '').zfill(8) for c in flag])base64chars = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/'with open('0.txt', 'rb') as f0, open('1.txt', 'wb') as f1:  # '0.txt'是明文, '1.txt'用于存放隐写后的base64for line in f0.readlines():rowstr = base64.b64encode(line.replace('\n', ''))equalnum = rowstr.count('=')if equalnum and len(bin_str):offset = int('0b' + bin_str[:equalnum * 2], 2)char = rowstr[len(rowstr) - equalnum - 1]rowstr = rowstr.replace(char, base64chars[base64chars.index(char) + offset])bin_str = bin_str[equalnum * 2:]f1.write(rowstr + '\n')

base64隐写解密(py2)

# -*- coding: cp936 -*-
b64chars = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/'
#https://tr0y.wang/2017/06/14/Base64steg/
with open('1.txt', 'rb') as f:bin_str = ''for line in f.readlines():stegb64 = ''.join(line.split())rowb64 = ''.join(stegb64.decode('base64').encode('base64').split())offset = abs(b64chars.index(stegb64.replace('=', '')[-1]) - b64chars.index(rowb64.replace('=', '')[-1]))equalnum = stegb64.count('=')  # no equalnum no offsetif equalnum:bin_str += bin(offset)[2:].zfill(equalnum * 2)print ''.join([chr(int(bin_str[i:i + 8], 2)) for i in xrange(0, len(bin_str), 8)])  # 8位一组

1-5位的crc32碰撞

6位的碰撞已经有现成的工具了

# coding:utf-8"""
Author：spaceman
"""import binascii
import string
from time import sleepdef is_number(s):try:float(s)return Trueexcept ValueError:passtry:import unicodedataunicodedata.numeric(s)return Trueexcept (TypeError, ValueError):passreturn False# 进度条
def progress(percent=0, width=40):left = width * percent // 95right = width - leftprint ('\r[', '#' * left, ' ' * right, ']',f' {percent:.0f}%',sep='', end='', flush=True)# 一位字节
def crc1(strs,dic):strs = hex(int(strs,16))rs = ''for i in dic:s = iif hex(binascii.crc32(s.encode())) == strs:rs += sprint (strs+'  ： '+s)return rs# 两位字节
def crc2(strs,dic):strs = hex(int(strs,16))rs = ''for i in dic:for j in dic:s = i + jif hex(binascii.crc32(s.encode())) == strs:rs += sprint (strs+'  ： '+s)return rs# 三位字节
def crc3(strs,dic):strs = hex(int(strs,16))rs = ''for i in dic:for j in dic:for k in dic:s = i+j+kif hex(binascii.crc32(s.encode())) == strs:rs += sprint (strs+'  ： '+s)return rs# 四位字节
def crc4(strs,dic):strs = hex(int(strs,16))rs = ''it = 1for i in dic:for j in dic:for k in dic:for m in dic:s = i+j+k+mif hex(binascii.crc32(s.encode())) == strs:rs += sprint ()print (strs+'  ： '+s)print ('\n')progress(it)sleep(0.1)it += 1return rs# 五位字节
def crc5(strs,dic):strs = hex(int(strs,16))rs = ''it = 1for i in dic:progress(it)for j in dic:for k in dic:for m in dic:for n in dic:s = i+j+k+m+nif hex(binascii.crc32(s.encode())) == strs:rs += sprint ()print (strs+'  ： '+s)print ('\n')sleep(0.1)it += 1return rs# 计算碰撞 crc
def CrackCrc(crclist,length):print ()print ("正在计算...")print ()dic = ''' !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~''' # 碰撞需要的字符字典dic = dic[::-1]text = ''for i in crclist:if length == '1':text += crc1(i,dic)if length == '2':text += crc2(i,dic)if length == '3':text += crc3(i,dic)if length == '4':text += crc4(i,dic)if length == '5':text += crc5(i,dic)print ('\n')if text == '':print ("碰撞失败,无结果")exit()print ("字符顺序组合：",end=' ')print ()print (text)print ()input("回车确认结束程序...")# 主函数
print ('''
#################################### Author：spaceman ######### Thank you for your use #################################
''')
listcrc = [] # 用于存储crc值
length = (input("请输入文本字节大小(1-5)：")) # 即文本内容大小，如文本内容为flag，大小即为4
if is_number(length) == False or length not in ("1,2,3,4,5"):exit("非指定数字，退出")
print ()
while 1:crc = input('请输入crc值(例如:d1f4eb9a,输入n完成输入):')if crc == 'n':breakcrc = '0x'+crcif len(crc) != 10:print ("rcr长度不对,请重新输入")continuelistcrc.append(crc)CrackCrc(listcrc,length)

将十进制数写入文件中

x=[55,122,188,175,175]f=b''
for i in x:f += i.to_bytes(1,'big')out=open("1.7z","wb")
out.write(f)

usb流量

键盘流量

先tshark导出数据

┌──(volcano㉿kali)-[~/桌面]
└─$ tshark -r whereiskey.pcapng -T fields -e usb.capdata | sed ‘/^\s*$/d’ > out.txt

然后每两个数字之间加一个冒号

f=open('1.txt','r')
fi=open('out.txt','w')
while 1:a=f.readline().strip()if a:if len(a)==16: # 鼠标流量的话len改为8out=''for i in range(0,len(a),2):if i+2 != len(a):out+=a[i]+a[i+1]+":"else:out+=a[i]+a[i+1]fi.write(out)fi.write('\n')else:breakfi.close()

再跑脚本

normalKeys = {"04":"a", "05":"b", "06":"c", "07":"d", "08":"e", "09":"f", "0a":"g", "0b":"h", "0c":"i", "0d":"j", "0e":"k", "0f":"l", "10":"m", "11":"n", "12":"o", "13":"p", "14":"q", "15":"r", "16":"s", "17":"t", "18":"u", "19":"v", "1a":"w", "1b":"x", "1c":"y", "1d":"z","1e":"1", "1f":"2", "20":"3", "21":"4", "22":"5", "23":"6","24":"7","25":"8","26":"9","27":"0","28":"<RET>","29":"<ESC>","2a":"<DEL>", "2b":"\t","2c":"<SPACE>","2d":"-","2e":"=","2f":"[","30":"]","31":"\\","32":"<NON>","33":";","34":"'","35":"<GA>","36":",","37":".","38":"/","39":"<CAP>","3a":"<F1>","3b":"<F2>", "3c":"<F3>","3d":"<F4>","3e":"<F5>","3f":"<F6>","40":"<F7>","41":"<F8>","42":"<F9>","43":"<F10>","44":"<F11>","45":"<F12>"}
shiftKeys = {"04":"A", "05":"B", "06":"C", "07":"D", "08":"E", "09":"F", "0a":"G", "0b":"H", "0c":"I", "0d":"J", "0e":"K", "0f":"L", "10":"M", "11":"N", "12":"O", "13":"P", "14":"Q", "15":"R", "16":"S", "17":"T", "18":"U", "19":"V", "1a":"W", "1b":"X", "1c":"Y", "1d":"Z","1e":"!", "1f":"@", "20":"#", "21":"$", "22":"%", "23":"^","24":"&","25":"*","26":"(","27":")","28":"<RET>","29":"<ESC>","2a":"<DEL>", "2b":"\t","2c":"<SPACE>","2d":"_","2e":"+","2f":"{","30":"}","31":"|","32":"<NON>","33":"\"","34":":","35":"<GA>","36":"<","37":">","38":"?","39":"<CAP>","3a":"<F1>","3b":"<F2>", "3c":"<F3>","3d":"<F4>","3e":"<F5>","3f":"<F6>","40":"<F7>","41":"<F8>","42":"<F9>","43":"<F10>","44":"<F11>","45":"<F12>"}
output = []
keys = open('out.txt')
for line in keys:try:if line[0]!='0' or (line[1]!='0' and line[1]!='2') or line[3]!='0' or line[4]!='0' or line[9]!='0' or line[10]!='0' or line[12]!='0' or line[13]!='0' or line[15]!='0' or line[16]!='0' or line[18]!='0' or line[19]!='0' or line[21]!='0' or line[22]!='0' or line[6:8]=="00":continueif line[6:8] in normalKeys.keys():output += [[normalKeys[line[6:8]]],[shiftKeys[line[6:8]]]][line[1]=='2']else:output += ['[unknown]']except:pass
keys.close()flag=0
print("".join(output))
for i in range(len(output)):try:a=output.index('<DEL>')del output[a]del output[a-1]except:pass
for i in range(len(output)):try:if output[i]=="<CAP>":flag+=1output.pop(i)if flag==2:flag=0if flag!=0:output[i]=output[i].upper()except:pass
print ('output :' + "".join(output))

鼠标流量

依旧是先导出

┌──(volcano㉿kali)-[~]
└─$ tshark -r secret.pcapng -T fields -e usb.capdata | sed ‘/^\s*$/d’ > out.txt

然后跑脚本

nums = []
keys = open('out.txt','r')
posx = 0
posy = 0
for line in keys:if len(line) != 13:continuex = int(line[4:6],16)y = int(line[6:8],16)if x > 127 :x -= 256if y > 130 :y -= 265posx += xposy += ybtn_flag = int(line[2:4],16)if btn_flag == 1:   # 1 for left , 2 for right , 0 for nothingprint posx ,posy
keys.close()

转字符

二进制转字符

常见的每八位转，有时候是每7位，需要对脚本稍加改动

def fun1():#二进制字符串转换字符串#需要转换的字符串f = '0001000001110001000000010001001000010001001000110111001100010000011100010000011101010000010010000100100001001000000100100101'b = ''i = 0j = 8   #有时要改成7while j <= len(f):a = '0' + f[i:j]b += chr(int(a,2))i = jj += 8  #有时改成7print(b)
def fun2():#字符串转换二进制字符串#需要转换的字符串f = ' 'b = ''c = ''for i in f:a = str(bin(ord(i)))b = a[2:].zfill(7)c += bprint(c)
fun1()
#fun2()

八进制转字符

s="146154141147173144157137171157165137153156157167137160141167156163150157160175"
x=[]
for i in range(len(s)//3):  #根据题目修改大小， 字符串长度除以3x.append(s[3*i:3*i+3])
y=[]
flag=""
for j in range(len(x)):y.append(int(x[j],base=8))for k in range(len(x)):flag+=chr(y[k])
print(flag)

十进制转字符

适用于给的是一长串连在一起的十进制

s="98117103107117123110974810048110103100971079749125"
x=len(s)//2
flag=""
for i in range(x):if len(s) != 0:if  int(s[:3])< 127:flag += chr(int(s[:3]))s = s[3:]else:flag += chr(int(s[:2]))s = s[2:]
print(flag)

hex转字符

import binasciis=""s=binascii.unhexlify(s)
print(s.decode('utf-8'))

bmp的lsb隐写

import PIL.Image as Image
img = Image.open('low.bmp')
img_tmp = img.copy()
pix = img_tmp.load()
width,height = img_tmp.size
for w in range(width):for h in range(height):if pix[w,h]&1 == 0:pix[w,h] = 0else:pix[w,h] = 255
img_tmp.show()

TTL隐写

import binascii
with open('attachment.txt','r') as fp:a=fp.readlines()p=[]for x in range(len(a)):p.append(int(a[x])) s=''for i in p:if(i==63):b='00'elif(i==127):b='01'elif(i==191):b='10'else:b='11's +=b
# print(s)
flag = ''
for i in range(0,len(s),8):flag += chr(int(s[i:i+8],2))
flag = binascii.unhexlify(flag)
wp = open('ans.zip','wb')
wp.write(flag)
wp.close()

仿射密码

# 仿射密码
z = ['a', 'b', 'c', 'd', 'e', 'f', 'g', 'h', 'i', 'j', 'k', 'l', 'm', 'n', 'o', 'p', 'q', 'r', 's', 't', 'u', 'v', 'w','x', 'y', 'z', 'A', 'B', 'C', 'D', 'E', 'F', 'G', 'H', 'I', 'J', 'K', 'L', 'M', 'N', 'O', 'P', 'Q', 'R', 'S', 'T','U', 'V', 'W', 'X', 'Y', 'Z']# 通过列表来表示Z整数环中的52个元素
def exgcd(a, b, arr):  # 通过拓展欧几里得定理来求a对于整数环中的逆元if b == 0:arr[0] = 1arr[1] = 0return ar = exgcd(b, a % b, arr)tmp = arr[0]arr[0] = arr[1]arr[1] = tmp - int(a / b) * arr[1]return rdef Get_ei(a, b):arr = [0, 1, ]r = exgcd(a, b, arr)if r == 1:return int((arr[0] % b + b) % b)else:return -1def encrypt(k1, k2, message):  # 加密过程a = str(message)t = ""for i in a:if i in z:c = z.index(i)Y = (k1 * c + k2) % 52t += z[Y]else:t += ireturn t# print(ord(i))# *************begin************## **************end*************#def decrypt(k1, k2, message):  # 解密过程k1_ = Get_ei(k1, 52)t = ""a = str(message)for i in a:if i in z:c = z.index(i)X = (k1_ * (c - k2)) % 52t += z[X]else:t += ireturn tdef main():mode = int(input())  # 1代表加密，0代表解密message = input()  # 待加密或解密的消息key1 = int(input())  # key的范围0~51之间key2 = int(input())  # key的范围0~51之间if mode == 1:translated = encrypt(key1, key2, message)else:translated = decrypt(key1, key2, message)print(translated)if __name__ == '__main__':main()

将图片内容上下翻转

from PIL import Image
im = Image.open("1.jpg")
pim = im.load()
an = Image.open("1.jpg")
ans = an.load()
for i in range(im.size[0]):for j in range(im.size[1]):ans[i, j] = pim[im.size[0]-i-1, j]
an.show()

傅里叶变换

import cv2 as cv
import numpy as np
import matplotlib.pyplot as plt
img = cv.imread('FFT.png', 0) #直接读为灰度图像
f = np.fft.fft2(img) #做频率变换
fshift = np.fft.fftshift(f) #转移像素做幅度谱
s1 = np.log(np.abs(fshift))#取绝对值：将复数变化成实数取对数的⽬的为了将数据变化到0-255
plt.subplot(121)
plt.imshow(img, 'gray')
plt.title('original')
plt.subplot(122)
plt.imshow(s1,'gray')
plt.title('center')
plt.show()

批量读取压缩包

import zipfilefor i in range(1, 87): # 读取压缩包z = zipfile.ZipFile(r'C:\Users\Desktop\flag/' + str(i)+'.zip', 'r')# 读取压缩包内的图片内容filename = z.namelist()[0]content = str(z.read(filename))# 把base64编码部分打印出来len1 = len(content)content1 = content[len1-101:len1-1] #根据题目更改print(content1)

autokey爆破(py2)

from ngram_score import ngram_score
from pycipher import Autokey
import re
from itertools import permutationsqgram = ngram_score('quadgrams.txt')
trigram = ngram_score('trigrams.txt')
ctext = 'achnrvxzzuglarucalznwcygfggrufryvbzqjoxjymxvchhhdmliddcwmhghclpebtzwlojvew'
ctext = re.sub(r'[^A-Z]','',ctext.upper())# keep a list of the N best things we have seen, discard anything else
class nbest(object):def __init__(self,N=1000):self.store = []self.N = Ndef add(self,item):self.store.append(item)self.store.sort(reverse=True)self.store = self.store[:self.N]def __getitem__(self,k):return self.store[k]def __len__(self):return len(self.store)#init
N=100
for KLEN in range(3,20):rec = nbest(N)for i in permutations('ABCDEFGHIJKLMNOPQRSTUVWXYZ',3):key = ''.join(i) + 'A'*(KLEN-len(i))pt = Autokey(key).decipher(ctext)score = 0for j in range(0,len(ctext),KLEN):score += trigram.score(pt[j:j+3])rec.add((score,''.join(i),pt[:30]))next_rec = nbest(N)for i in range(0,KLEN-3):for k in xrange(N):for c in 'ABCDEFGHIJKLMNOPQRSTUVWXYZ':key = rec[k][1] + cfullkey = key + 'A'*(KLEN-len(key))pt = Autokey(fullkey).decipher(ctext)score = 0for j in range(0,len(ctext),KLEN):score += qgram.score(pt[j:j+len(key)])next_rec.add((score,key,pt[:30]))rec = next_recnext_rec = nbest(N)bestkey = rec[0][1]pt = Autokey(bestkey).decipher(ctext)bestscore = qgram.score(pt)for i in range(N):pt = Autokey(rec[i][1]).decipher(ctext)score = qgram.score(pt)if score > bestscore:bestkey = rec[i][1]bestscore = score       print bestscore,'autokey, klen',KLEN,':"'+bestkey+'",',Autokey(bestkey).decipher(ctext)

在线网站

修复二维码

https://merricx.github.io/qrazybox

一些聚合网站

常用的base编码、url编码等以及各种加密都有
http://www.hiencode.com/
https://tool.lu/
https://ctf.bugku.com/tools.html
https://www.ctftools.com/down/
https://www.idcd.com/

bugku的旧在线工具可以用来枚举栅栏密码和凯撒密码

CyberChef的话建议下载到本地，这个工具非常好用，尤其是遇到多层套娃的加密时(Magic)

G语言代码在线运行

https://ncviewer.com/

md5解密

https://www.cmd5.com/
https://www.somd5.com/

各种码的识别

条形码、二维码等的识别
https://demo.dynamsoft.com/barcode-reader/
Aztec Code识别
https://products.aspose.app/barcode/recognize/aztec#result

箭头符号、花朵、音符、盲文等编码

点击切换即可

https://www.qqxiuzi.cn/bianma/wenbenjiami.php?s=jiantou

维吉尼亚解密

很多时候可以直接跑出明文
https://www.guballa.de/vigenere-solver

rot5/13/18/47

https://www.qqxiuzi.cn/bianma/ROT5-13-18-47.php

emoji加密

常见的就是base100和emoji-aes

https://aghorler.github.io/emoji-aes/
http://www.atoolbox.net/Tool.php?Id=937
https://ctf.bugku.com/tool/base100

brainfuck/Ook！

https://www.splitbrain.org/services/ook

零宽字符解密

http://330k.github.io/misc_tools/unicode_steganography.html
https://yuanfux.github.io/zero-width-web/
http://www.atoolbox.net/Tool.php?Id=829

exif信息查看

https://exif.tuchong.com/

大质数分解(RSA常用)

http://www.factordb.com/

词频分析

https://quipqiup.com/

熊曰/兽音/佛曰

http://hi.pcmoe.net/index.html

pyc反编译

https://tool.lu/pyc/

ctf 常用python脚本及在线网站相关推荐

个人整理的常用python脚本【很好用】
干货满满的python脚本 1.文件操作 1.1.批量修改文件名 1.2.修改txt文档中的内容 1.3.文件复制操作 2.其他操作 3.待补充 1.文件操作 1.1.批量修改文件名示例代码是将后缀 ...
Python脚本猜解网站登录密码（带token验证）
目录: 关键代码解释设置请求头 get_token函数获取token值完整代码: 运行结果: 上一篇文章:一个简单的Python暴力破解网站登录密码脚本测试靶机为Pikachu漏洞练习平台暴力破 ...
【app逆向】Frida-rpc 的常用python脚本
1.1 Frida-rpc常用脚本在执行frida-rpc时,会涉及到先关参数类型的处理和转换,例如: python程序调用时,传入参数? frida的JavaScript脚本如何获取参数? Jav ...
Python脚本爬取网站美女照片
上次无意之中看到一个网站,里面全是美女的照片,我就心想,哪天有时间了得把这网站的所有美女照片都得爬下来.今天有时间,写了点代码,爬去了网站的所有照片.附上战果!图片实在是太多了,爬半个多小时先附上所 ...
CTF常用python库PwnTools的使用学习
之前主要是使用zio库,对pwntools的了解仅限于DynELF,以为zio就可以取代pwntools.后来发现pwntools有很多的高级用法都不曾听说过,这次学习一下用法,希望可以在以后的exp ...
CTF 常用python库
gmpy2库 import gmpy2gmpy2.mpz(x)#初始化一个大整数xgmpy2.mpfr(x)#初始化一个高精度浮点数xC = gmpy2.powmod(M,e,n)#幂取模,结果是 C ...
[CTF] python的pip源更改及常用python库
windows下更改pip为清华大学开源命令行以管理员方式运行 pip config set global.index-url https://pypi.tuna.tsinghua.edu.cn/s ...
python脚本——图片重命名、图片合成视频、faster-rcnn画P-R曲线
调试faster rcnn算法实用的python脚本目录调试faster rcnn算法实用的python脚本一.前言二.常用python脚本三.后记一.前言最近在做关于目标检测算法的研究 ...
[CTF密码学]RSA相关题目解题方法与python脚本总结（附例题）
目录 RSA算法概述思路一.分解n得到p,q 例题:BUUCTF:[WUSTCTF2020]babyrsa 思路二.低加密指数攻击(e很小) 例题:BUUCTF DangrousRSA 思路三.低指 ...

ctf 常用python脚本及在线网站

ctf

脚本