BUUCTF 每日打卡 2021-5-6

引言

五一假期全鸽了。。。
果然当鸽子会上瘾。。。
假期前一天晚上留了半小时搞这道 RSA & what ，结果搞到凌晨把我心态搞崩了
然后就鸽了。。。
今天终于搞出来了

RSA & what

首先，加密代码如下：

from Crypto.Util.number import bytes_to_long, getPrime
from random import randint
from gmpy2 import powmodp = getPrime(2048)
q = getPrime(2048)
N = p*q
Phi = (p-1)*(q-1)
def get_enc_key(N,Phi):e = getPrime(N)if Phi % e == 0:return get_enc_key(N, Phi)else:return e
e1 = get_enc_key(randint(10, 12), Phi)
e2 = get_enc_key(randint(10, 12), Phi)fr = open(r"./base64", "rb")#flag is in this file
f1 = open(r"./HUB1", "wb")
f2 = open(r"./HUB2", "wb")
base64 = fr.read(255) # 读取255个字节
f1.write("%d\n%d\n" % (N, e1))
f2.write("%d\n%d\n" % (N, e2))
while len(base64)>0:pt = bytes_to_long(base64)ct1 = powmod(pt, e1, N)ct2 = powmod(pt, e2, N)f1.write("\n%d" % ct1)f2.write("\n%d" % ct2)base64 = fr.read(255)
fr.close()
f1.close()
f2.close()

是共模攻击

将 base64 加密的文件每段读取 255 个字节用不同的 e 加密分别存储在 HUB1, HUB2 两个文件中
然后就写代码：

from gmpy2 import gcdext
from Crypto.Util.number import *
import base64def get(file):with open(file, 'r') as f:content = f.readlines()n = content[0]e = int(content[1])list_c = content[3:]return (n, e, list_c)n, e1, list_c1 = get('HUB1')
n, e2, list_c2 = get('HUB2')
n = int(n)
g, u, v = gcdext(e1, e2)list_c3 = []
list_c4 = []
if u < 0:u = -ufor i in range(len(list_c1)):list_c3.append(inverse(int(list_c1[i]), n))list_c4.append(int(list_c2[i]))
else:v = -vfor i in range(len(list_c2)):`在这里插入代码片`list_c4.append(inverse(int(list_c2[i]), n))list_c3.append(int(list_c1[i]))
list_c = list(zip(list_c3, list_c4))mm = ''.encode()
for c3, c4 in list_c:m = (pow(c3, u, n) * pow(c4, v, n)) % nprint((long_to_bytes(m)))mm += long_to_bytes(m)
print(mm)
print(base64.b64decode(mm))

输出为

b'VEhJUz==\nRkxBR3==\nSVN=\nSElEREVOLo==\nQ0FO\nWU9V\nRklORM==\nSVT=\nT1VUP4==\nRE8=\nWU9V\nS05PV9==\nQkFTRTY0P5==\nWW91bmdD\nVEhJTku=\nWU9V\nQVJF\nTk9U\nVEhBVE==\nRkFNSUxJQVI=\nV0lUSO==\nQkFTRTY0Lh==\nQmFzZTY0\naXO=\nYW==\nZ3JvdXA=\nb2b=\nc2ltaWxhcn==\nYmluYXJ5LXRvLXRleHR=\nZW5jb2Rpbm'
b'e=\nc2NoZW1lc0==\ndGhhdD==\ncmVwcmVzZW50\nYmluYXJ5\nZGF0YW==\naW5=\nYW6=\nQVNDSUl=\nc3RyaW5n\nZm9ybWF0\nYnk=\ndHJhbnNsYXRpbmd=\naXS=\naW50b1==\nYT==\ncmFkaXgtNjQ=\ncmVwcmVzZW50YXRpb24u\nVGhl\ndGVybc==\nQmFzZTY0\nb3JpZ2luYXRlc8==\nZnJvbd==\nYY==\nc3BlY2lmaWN=\nTUlNRT==\nY29udGVudI='
b'=\ndHJhbnNmZXI=\nZW5jb2Rpbmcu\nVGhl\ncGFydGljdWxhct==\nc2V0\nb2b=\nNjR=\nY2hhcmFjdGVyc5==\nY2hvc2Vu\ndG+=\ncmVwcmVzZW50\ndGhl\nNjQ=\ncGxhY2UtdmFsdWVz\nZm9y\ndGhl\nYmFzZd==\ndmFyaWVz\nYmV0d2Vlbt==\naW1wbGVtZW50YXRpb25zLp==\nVGhl\nZ2VuZXJhbI==\nc3RyYXRlZ3n=\naXO=\ndG9=\nY2hvb3Nl\nNjR'
b'=\nY2hhcmFjdGVyc5==\ndGhhdA==\nYXJl\nYm90aN==\nbWVtYmVyc5==\nb2a=\nYS==\nc3Vic2V0\nY29tbW9u\ndG8=\nbW9zdM==\nZW5jb2RpbmdzLA==\nYW5k\nYWxzb8==\ncHJpbnRhYmxlLg==\nVGhpc9==\nY29tYmluYXRpb25=\nbGVhdmVz\ndGhl\nZGF0YW==\ndW5saWtlbHk=\ndG/=\nYmV=\nbW9kaWZpZWS=\naW5=\ndHJhbnNpdE==\ndGhyb3V'
b'naN==\naW5mb3JtYXRpb26=\nc3lzdGVtcyw=\nc3VjaN==\nYXM=\nRS1tYWlsLD==\ndGhhdA==\nd2VyZQ==\ndHJhZGl0aW9uYWxseQ==\nbm90\nOC1iaXQ=\nY2xlYW4uWzFd\nRm9y\nZXhhbXBsZSw=\nTUlNRSdz\nQmFzZTY0\naW1wbGVtZW50YXRpb24=\ndXNlcw==\nQahDWiw=\nYahDeiw=\nYW5k\nMKhDOQ==\nZm9y\ndGhl\nZmlyc3Q=\nNjI=\ndmFs'
b'dWVzLg==\nT3RoZXI=\ndmFyaWF0aW9ucw==\nc2hhcmU=\ndGhpcw==\ncHJvcGVydHk=\nYnV0\nZGlmZmVy\naW4=\ndGhl\nc3ltYm9scw==\nY2hvc2Vu\nZm9y\ndGhl\nbGFzdA==\ndHdv\ndmFsdWVzOw==\nYW4=\nZXhhbXBsZQ==\naXM=\nVVRGLTcu'
b'VEhJUz==\nRkxBR3==\nSVN=\nSElEREVOLo==\nQ0FO\nWU9V\nRklORM==\nSVT=\nT1VUP4==\nRE8=\nWU9V\nS05PV9==\nQkFTRTY0P5==\nWW91bmdD\nVEhJTku=\nWU9V\nQVJF\nTk9U\nVEhBVE==\nRkFNSUxJQVI=\nV0lUSO==\nQkFTRTY0Lh==\nQmFzZTY0\naXO=\nYW==\nZ3JvdXA=\nb2b=\nc2ltaWxhcn==\nYmluYXJ5LXRvLXRleHR=\nZW5jb2Rpbme=\nc2NoZW1lc0==\ndGhhdD==\ncmVwcmVzZW50\nYmluYXJ5\nZGF0YW==\naW5=\nYW6=\nQVNDSUl=\nc3RyaW5n\nZm9ybWF0\nYnk=\ndHJhbnNsYXRpbmd=\naXS=\naW50b1==\nYT==\ncmFkaXgtNjQ=\ncmVwcmVzZW50YXRpb24u\nVGhl\ndGVybc==\nQmFzZTY0\nb3JpZ2luYXRlc8==\nZnJvbd==\nYY==\nc3BlY2lmaWN=\nTUlNRT==\nY29udGVudI==\ndHJhbnNmZXI=\nZW5jb2Rpbmcu\nVGhl\ncGFydGljdWxhct==\nc2V0\nb2b=\nNjR=\nY2hhcmFjdGVyc5==\nY2hvc2Vu\ndG+=\ncmVwcmVzZW50\ndGhl\nNjQ=\ncGxhY2UtdmFsdWVz\nZm9y\ndGhl\nYmFzZd==\ndmFyaWVz\nYmV0d2Vlbt==\naW1wbGVtZW50YXRpb25zLp==\nVGhl\nZ2VuZXJhbI==\nc3RyYXRlZ3n=\naXO=\ndG9=\nY2hvb3Nl\nNjR=\nY2hhcmFjdGVyc5==\ndGhhdA==\nYXJl\nYm90aN==\nbWVtYmVyc5==\nb2a=\nYS==\nc3Vic2V0\nY29tbW9u\ndG8=\nbW9zdM==\nZW5jb2RpbmdzLA==\nYW5k\nYWxzb8==\ncHJpbnRhYmxlLg==\nVGhpc9==\nY29tYmluYXRpb25=\nbGVhdmVz\ndGhl\nZGF0YW==\ndW5saWtlbHk=\ndG/=\nYmV=\nbW9kaWZpZWS=\naW5=\ndHJhbnNpdE==\ndGhyb3VnaN==\naW5mb3JtYXRpb26=\nc3lzdGVtcyw=\nc3VjaN==\nYXM=\nRS1tYWlsLD==\ndGhhdA==\nd2VyZQ==\ndHJhZGl0aW9uYWxseQ==\nbm90\nOC1iaXQ=\nY2xlYW4uWzFd\nRm9y\nZXhhbXBsZSw=\nTUlNRSdz\nQmFzZTY0\naW1wbGVtZW50YXRpb24=\ndXNlcw==\nQahDWiw=\nYahDeiw=\nYW5k\nMKhDOQ==\nZm9y\ndGhl\nZmlyc3Q=\nNjI=\ndmFsdWVzLg==\nT3RoZXI=\ndmFyaWF0aW9ucw==\nc2hhcmU=\ndGhpcw==\ncHJvcGVydHk=\nYnV0\nZGlmZmVy\naW4=\ndGhl\nc3ltYm9scw==\nY2hvc2Vu\nZm9y\ndGhl\nbGFzdA==\ndHdv\ndmFsdWVzOw==\nYW4=\nZXhhbXBsZQ==\naXM=\nVVRGLTcu'
b'THIS'

嗯？怎么就一个 b'THIS' ？
搞了半天
心态崩了
找了很多资料（包括一些 wp）都不能解决
终于找到了合适的 wp(泪目)
中间那个 \n 原来是换行符。。。
后面加了一段：

temp = b''
M = b''
for i in mm:k = long_to_bytes(i)if k == b'\n':M += base64.b64decode(temp)temp = b''continuetemp += k
print(M)

输出结果为：

b"THISFLAGISHIDDEN.CANYOUFINDITOUT?DOYOUKNOWBASE64?YoungCTHINKYOUARENOTTHATFAMILIARWITHBASE64.Base64isagroupofsimilarbinary-to-textencodingschemesthatrepresentbinarydatainanASCIIstringformatbytranslatingitintoaradix-64representation.ThetermBase64originatesfromaspecificMIMEcontenttransferencoding.Theparticularsetof64characterschosentorepresentthe64place-valuesforthebasevariesbetweenimplementations.Thegeneralstrategyistochoose64charactersthatarebothmembersofasubsetcommontomostencodings,andalsoprintable.Thiscombinationleavesthedataunlikelytobemodifiedintransitthroughinformationsystems,suchasE-mail,thatweretraditionallynot8-bitclean.[1]Forexample,MIME'sBase64implementationusesA\xa8CZ,a\xa8Cz,and0\xa8C9forthefirst62values.Othervariationssharethispropertybutdifferinthesymbolschosenforthelasttwovalues;anexampleisUTF-7."

看了半天看不出名堂
不就是把 base64 加密解释了一遍吗？
THIS FLAG IS HIDDEN
所以是怎么隐藏的呢？
参照 wp ，是 base64 隐写
再加一段代码：

c = mm
def get_base64_diff_value(s1, s2):base64chars = b'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/'res = 0for i in range(len(s2)):if s1[i] != s2[i]:return abs(base64chars.index(s1[i]) - base64chars.index(s2[i]))return resdef solve_stego():line=b''bin_str=''for i in c:k=long_to_bytes(i)if k==b'\n':steg_line = linenorm_line = base64.b64encode(base64.b64decode(line))diff = get_base64_diff_value(steg_line, norm_line)#print(diff)pads_num = steg_line.count(b'=')if diff:bin_str += bin(diff)[2:].zfill(pads_num * 2)else:bin_str += '0' * pads_num * 2print(goflag(bin_str))line=b''continueline+=kdef goflag(bin_str):res_str = ''for i in range(0, len(bin_str), 8):res_str += chr(int(bin_str[i:i + 8], 2))return res_strif __name__ == '__main__':solve_stego()

结果为：

结语

可以暂停，但不能放弃
希望继续坚持

BUUCTF 每日打卡 2021-5-6相关推荐

BUUCTF 每日打卡 2021-8-18
引言之前这段时间一直在打比赛.写文章,没时间更新关于之前说的关于Wiener's Attack的完整推导,详见我的知乎文章 [InCTF 2021]Gold_digger 加密代码如下: impo ...
BUUCTF 每日打卡 2021-4-5
引言出人意料的得到消息要被拉去打国赛(第十四届全国大学生信息安全竞赛-创新实践能力赛)了(一脸懵逼) 我还什么都没学呢(摸鱼) 嘛,不过被分到第二梯队大概也没抱什么希望吧(继续摸鱼) 害,说丧气话也 ...
BUUCTF 每日打卡 2022-1-16
引言填坑 [羊城杯 2020]Power 加密代码如下: from Crypto.Util.number import * import gmpy2 from secret import flagp ...
BUUCTF 每日打卡 2021-4-14
引言今日无战事这是base?? 附件内容: dict:{0: 'J', 1: 'K', 2: 'L', 3: 'M', 4: 'N', 5: 'O', 6: 'x', 7: 'y', 8: 'U' ...
BUUCTF 每日打卡 2021-4-28
引言数分考完了明天蓝帽杯可怜的RSA 附件给了公钥: -----BEGIN PUBLIC KEY----- MIIBJDANBgkqhkiG9w0BAQEFAAOCAREAMIIBDAKCAQM ...
BUUCTF 每日打卡 2021-7-19
引言上午学了4个小时车,只能下午来更了( [NPUCTF2020]认清形势,建立信心加密代码如下: from Crypto.Util.number import * from gmpy2 impo ...
BUUCTF 每日打卡 2021-4-13
引言又是昏昏沉沉的一天密码学的心声题目描述如下: 附件内容: 从歌词可知,这是八进制加密,要用 ascii 码解密尝试把全部内容八进制转十进制解密: from Crypto.Util.numb ...
电动力学每日一题 2021/10/23 载流板产生的电磁场
电动力学每日一题 2021/10/23 载流板产生的电磁场载流板的辐射载流板的辐射先验证电荷守恒: ∂ρ∂t=−∇⋅J=−∂∂zJz=0\frac{\partial \rho}{\partial ...
电动力学每日一题 2021/10/15 Fourier变换法计算均匀电流密度产生的磁场
电动力学每日一题 2021/10/15 Fourier变换法计算均匀电流密度产生的磁场无限长均匀电流无限长圆柱面均匀电流密度无限长均匀电流假设z轴上有一根非常细的电线,携带均匀电流I0I_0I ...

BUUCTF 每日打卡 2021-5-6

引言

RSA & what

结语

BUUCTF 每日打卡 2021-5-6相关推荐

最新文章

热门文章