2021-12-27

[watevrCTF 2019]Crypto over the intrawebs

题目

import socket, select, signal, string
import sys, os, time, random
import threadingHOST = '198.51.100.0'
PORT = 1337
USERNAME = "Houdini"s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect((socket.gethostname(), PORT))
key = int(s.recv(1240).decode("utf-8").split(" ")[1])def encrypt(plaintext):global USERNAMEglobal keyplaintext = USERNAME + ": " + plaintextout = [random.randint(0, 9999), random.randint(0, 999)]for i in range(len(plaintext)):out.append((out[i+1] + ((out[i] * ord(plaintext[i])) ^ (key+out[i+1]))) ^ (key*out[i]))

import socket, select, signal, string
import sys, os, time, random
import threadingHOST = '198.51.100.1'
PORT = 1337
USERNAME = "nnewram"s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect((socket.gethostname(), PORT))
key = int(s.recv(1240).decode("utf-8").split(" ")[1])def encrypt(plaintext):global USERNAMEglobal keyplaintext = USERNAME + ": " + plaintextout = [random.randint(0, 9999), random.randint(0, 999)]for i in range(len(plaintext)):out.append((out[i+

import socket, threading
import sys, os
import random, signalPORT = 1337
KEY = random.randint(0, 100000000000000000000000)
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.bind((socket.gethostname(), PORT))
s.listen(5)
client_list = []def relay_message(message, sender):global client_listfor client in client_list:if client != sender:try:client[0].send(message)except:client[0].close()client_list.remove(client)def client_reciever(socket):print(socket)while True:message = socket[0].recv(500000)if not message:breakprint("Message from: " + socket[1][0] + "\nContent: " + message.decode("utf-8"))relay_message(message, socket)def main():while True:client, address = s.accept() # accept all incomming clientsclient_list.append((client, address))print("Incomming user: " + address[0])client.send(bytes("KEY: " + str(KEY), "utf-8"))client_thread = threading.Thread(target=client_reciever, args=((client, address), ))client_thread.start()#this is only for closing the sockets after sigsegv
def handler_signals(signum, frame):global runglobal ss.close()print("----Closed Server----")sys.exit()
signal.signal(signal.SIGINT, handler_signals)
signal.signal(signal.SIGTERM, handler_signals)
#this is only for closing the sockets after sigsegvmain()

解题

题意大概是有两个客户端通过服务端在聊天,但是聊天内容是加密的.flag就藏在通话中.

问题的关键是要找到key。（可以知道key的大致范围）

解题代码

out=[8886, 42, 212351850074573251730471044, 424970871445403036476084342 ,5074088654060645719700112791577634658478525829848, 17980375751459479892183878405763572663247662296, 121243943296116422476619559571200060016769222670118557978266602062366168 ,242789433733772377162253757058605232140494788666115363337105327522154016 ,2897090450760618154631253497246288923325478215090551806927512438699802516318766105962219562904, 7372806106688864629183362019405317958359908549913588813279832042020854419620109770781392560]
#out.append((out[i+1] + ((out[i] * ord(plaintext[i])) ^ (key+out[i+1]))) ^ (key*out[i]))
plain='Houdini:'
from z3 import*
for count in range(2,78):key=BitVec('key',count)s=Solver()for i in range(8):s.add(((out[i + 1] + ((out[i] * ord(plain[i])) ^ (key + out[i + 1]))) ^ (key * out[i]))==out[i+2])s.check()res=s.model()res = res[key].as_long().realf=open('conversation.txt','r').readlines()x=[]for j in f:x.append(j.strip())flag=''for j in range(1,len(x),2):li=x[j].split(' ')for k in range(1,len(li)):li[k]=eval(li[k])for k in range(1,len(li)-2):try:flag += chr(((res + li[k + 1]) ^ (((res * li[k]) ^ li[k + 2]) - li[k + 1])) // li[k])except:breakif 'watevr{' in flag:print(flag)break# Houdini: uhm, is this thing working?
# nnewram: yeah, hi
# Houdini: hi nnew
# Houdini: so eh, do you have it?
# nnewram: id ont know what you mean
# nnewram: *dont
# nnewram: have what?
# Houdini: :bruh:
# Houdini: you know, the thing
# nnewram: what, thing?
# Houdini: the flag....
# nnewram: oooooh
# nnewram: right
# nnewram: sure let me get it
# nnewram: one second
# Houdini: kk
# nnewram: yeah here you go
# nnewram: watevr{Super_Secure_Servers_are_not_always_so_secure}
# Houdini: niceeeee
# Houdini: thank you
# Houdini: oh wait, we should probably remove the code
# nnewram: yeah that's actually kinda smart
# Houdini: ok cya later
# nnewram: cya#watevr{Super_Secure_Servers_are_not_always_so_secure}

2021-12-27相关推荐

一周信创舆情观察（2021.12.27~2022.1.3）
一.一周舆情要点 2021年12月24日,<中华人民共和国科学技术进步法>修订通过,其中第九十一条明确:对境内自然人.法人和非法人组织的科技创新产品.服务,在功能.质量等指标能够满足政府采 ...
Java初级知识复习-2021.12.27~2022.02.09
文章目录 Java语法基础1 1.Java简介 Java三大版本含义 Java的特性和核心优势 2.Java开发环境配置 Java应用程序的运行机制开发环境搭建 3.Java基础语法 4.Java基 ...
523、Java Spring Cloud Alibaba -【Spring Cloud Alibaba SkyWalking】 2021.12.27
目录 1. SkyWalking 简介 1.1 SkyWalking的组成 2. 使用 Docker 快速搭建 SkyWalking 8.0 2.1 在 linux 服务器上选择并建立目录: 2.2 ...
IDEA导入新项目2021.12.27
1.首先在git或者在码云上下载到源码 2.然后在IDEA中关闭当前的项目,选择新的项目 3.打开后 4.接下来配置运行的环境配置tomcat,选择添加配置然后点击左上角的加号,选择tomcat ...
蓝牙AOA高精度定位基站原厂深圳核芯物联科技参加2021中国国际高新技术成果交易会诚邀生态合作伙伴莅临交流指导2021.12.27-29深圳宝安国际会展中心11号馆
蓝牙AOA高精度定位基站原厂深圳核芯物联科技参加2021中国国际高新技术成果交易会诚邀生态合作伙伴莅临交流指导2021.12.27-29深圳宝安国际会展中心11号馆核芯物联岳毅恒核芯物联岳毅恒 ...
2021.12.6-12.12 AI行业周刊（第75期）：AI流程化
篇章一:AI流程化如果深度参与很多的人工智能项目,很多人会发现,大多数的项目都是长尾场景. 以城市管理和工业视觉两个方向为例,城市管理更偏向于智慧城市.智慧交通等领域,而工业视觉则偏向于工业自动化领 ...
2021/4/27课堂总结和作业
2021/4/27课堂总结一.回顾上节课知识 1.Python是动态解释性语言 2.基础语法注释标识符关键字:True.False.None 语句常用数据和对应的类型数字数据,int.fl ...
2021.12.20-12.26 AI行业周刊（第77期）：平平淡淡的人生
篇章一:人生的真谛不知不觉,2021年已经走到了年尾,下周再看到周刊的文章时,已经是2022年了. 回想这一年,年前树立的目标实现了吗?是否有遗憾?有憧憬? 上周去青岛出差,参与公司一个政府AI项目 ...
2021.05.27 发表自己第一篇技术文章
从昨晚开始做家庭财经系统.不要以为有系统两个字就怎么复杂,都是大家都会的.建库.建表. 第一个使用软件是mysql 2021.05.26 数据库 lianxi 已建好. 表 members_basic ...
【Scrum】2010.12.27
基本上从今天开始,各队员开始各司其职: 12.27队员的工作和将要做的工作 Hui, 作为leader, 主要从事developer: 解决一些BUG, 加入好友等功能,以及需要登陆才能获取的信息 L ...

2021-12-27

[watevrCTF 2019]Crypto over the intrawebs

2021-12-27相关推荐

最新文章

热门文章