")]
s = ''#转成01比特for i in Flag:
temp = ord(i)
temp = bin(temp)
temp = str(temp)[2:]
if len(temp) < 8:
temp = '0'*(8-len(temp))+temp
s += temp
Flag = int(s,2)
src = 200686490938213618932925030686723900966346071385575706818931139925151927414142413276833387391430903367465157760813819133574082739102368183356464973743987837722948595492712901641873403594450204695713629139533103392519371071099952645246840782481900957871935637359154437252913405444179654300427180044691385965990823568106696476515287748546363867017174091051797450964111012257685851865814304288305868868796070362487761893449386893361922901844324634350334616783957894220005538964792468979405328145100453460098854853839989027847783206845004095945185162744506591411155318233223679027298329085177274095914773286471049161702613799175486411492003372288722716950913877957802694948679785419083224812096387329082981115878996013259272222472356069166820222490810121435442820722489119884073056358155724651716232802987659573867435059545130785856458655309902770151770043405778785036718566031651260115600041084237592155873140867644089767487877289411629787419400386757597222832981129288874883921314078446307643819572105712219875309974530695306897012252757579812647497998317030864635355185457048473443750962962325959236879327971895179877812488472241671023567097665713934032193125740463764283516105833757192335092325954137896621052635084041994822566883633L
end = Flag^Message^src
s = str(hex(end))[2:][:-1]
string = ''for i in range(0,len(s),2):
string += chr(int(s[i:i+2],16))
print string
conn.close();
最后得到
misc
1.warmup-misc
s='UAUSAB1QUFBQUFAbfQ=='defdecode(s,k):
r=s.decode('base64')
l=''assert len(k)==1for i in r:
l = l + chr(ord(i)^ord(k))
return l[:-1]
print decode(s,'f')
2.zlmm
栅栏密码
import re
s="F e canece odouarld{iarswsitt o N fsseo zvgiyeipioantehi t ancheocm gaous oganwiakgaa ,absntns l rd ic p+s notei. aimo ttejtntlca,lado d gi bhh.ooiiao in nTeghlseee y gvnrgicdt hcrtlle rIoehimern hPire ianfituntti e sterseaoov ln sd ymyawho o etfnesagc o.aethadEcm ssem adtff6a odamlocbh aeimah l6rAsoyaamaeoowrsneyeba6smew,nmemapfhe j b ag}"
l = len(s)
child = []
for i in range(1,l):
if l%i == 0:
child.append(i)
for j in child:
s1=''
k = str(j)
r = re.findall('[^~]{'+k+'}',s)
for i in range(0,j):
for j in r:
s1 = s1 + j[i]
if'flag'in s1:
print s1
break
3.warmup-crypto
BH=CWG=EO=IEI=;DEDEDEY 观察可得是凯撒密码
s = 'BH=CWG=EO=IEI=;DEDEDEY'
l = len(s)
for j in range(25,50):
d = ''for t in s:
d = d + chr(ord(t)+j)
if'flag'in d:
print d
'''
Created on Dec 14, 2011
@author: pablocelayes
'''import ContinuedFractions, Arithmetic, RSAvulnerableKeyGenerator
defhack_RSA(e,n):'''
Finds d knowing (e,n)
applying the Wiener continued fraction attack
'''
frac = ContinuedFractions.rational_to_contfrac(e, n)
convergents = ContinuedFractions.convergents_from_contfrac(frac)
for (k,d) in convergents:
#check if d is actually the keyif k!=0and (e*d-1)%k == 0:
phi = (e*d-1)//k
s = n - phi + 1# check if the equation x^2 - s*x + n = 0# has integer roots
discr = s*s - 4*n
if(discr>=0):
t = Arithmetic.is_perfect_square(discr)
if t!=-1and (s+t)%2==0:
print("Hacked!")
return d
deftest_hack_RSA():
print("Testing Wiener Attack")
times = 5
d=1
e=235308230249427956073994778236213308201165228968967264823632398966978083858618015310724273760982061608902488436041676909915097228896544054764485576608147425983433627672556840438360922524333914861841915302324033903747815478440207839231405164459309430488083417021299863448530761603691583119435411334929236989305080703733969737477059347874381118819315342999662421300865938367414646348114114523518559518198427990964401454548211551305162678178910564008966603832884326159914009915068561450603480793388907172483641086337688420637151051921455148790521653521635779290202539763111269020386581967559996128236288594127596931111L
n=990023173701890142960417396557829467604818405521894936859951202214773485865832785292323872121243887697290422045990013422607876480641270661367864382389893789596078312082027665553855270696451019054919069134732452191977525630655976091851072534780363846681322224621650105419018181198428165007342791192003551280877541234686022585373169611329463075555962420262841398957747472053420414997254472168650615854344763306064291593967460854817443906609759558144854063757076283269500492727802851281783673232830692457911612959175538769194685797000335876443248126827447575107633034183744580751790001353796972802669451070935734931493L
print("(e,n) is (", e, ", ", n, ")")
hacked_d = hack_RSA(e, n)
print("d = ", d, ", hacked_d = ", hacked_d)
print("-------------------------")
times -= 1if __name__ == "__main__":
#test_is_perfect_square()#print("-------------------------")
test_hack_RSA()
解出
d = 30011L
n = 990023173701890142960417396557829467604818405521894936859951202214773485865832785292323872121243887697290422045990013422607876480641270661367864382389893789596078312082027665553855270696451019054919069134732452191977525630655976091851072534780363846681322224621650105419018181198428165007342791192003551280877541234686022585373169611329463075555962420262841398957747472053420414997254472168650615854344763306064291593967460854817443906609759558144854063757076283269500492727802851281783673232830692457911612959175538769194685797000335876443248126827447575107633034183744580751790001353796972802669451070935734931493L
c = 788476757386221543537703608890186546442886644502803697518028267920600460220013483242506024987780673274894640972913419348131638674650297913257698380629030789425241326400460779957736137653911242371819455834503315030302866040645836290957691445959653938430879900694828439435699643144568320527205094071390940553388594203187022623769818515793107513956737821245415004711757450202148161254040561612359947403387404625171790678861784947278421483221298384341596583699883571547913038896065048203584687131767988397347080214823075357248539577208665545930392234612492615041261379339566841377463503145318178415053741856403946928895L
m = c**d % n
print m
6.D0ge
下载bftools
C:\Users\YZ>C:\Users\YZ\Desktop\bftools\bftools\bftools.exe decode braincopter C:\Users\YZ\Desktop\D0ge.jpg -o -out.bf
C:\Users\YZ>C:\Users\YZ\Desktop\bftools\bftools\bftools.exe run -out.bf
GYYWIY3UMZ5UQML6IIYHSLCXMVWEGMDNMUWVI3ZNJAZVEZL5
base32解码得到flag
7.crypto300 basr
下面为源代码，分析起来比较简单，但是坑比较多。
from Crypto.Util.number import getPrime, long_to_bytes, bytes_to_long
import string
import random
defpen(msg,k):
myl=string.printable[0:62]+"+/"
nell=[""]*64for i in range(64):
nell[(i+k)%64]=myl[i] #copy myl to nell
nel="".join(nell)
msg+="/x00"*(len(msg)%4)
bs=""for i in msg:
bs+="0"*(8-len(bin(ord(i))[2:]))+bin(ord(i))[2:]
print bs
c=""for i in range(0,len(bs),6):
c+=nell[int(bs[i:i+6],2)]
return c
defbackdoor(p,k):
q2=getPrime(1024)
n2=p*q2
print"q2",q2
print"n2",n2
return n2^(k%64)
defmain():
flag=open("flag","r").read().strip()
m=bytes_to_long(flag)
print"m",m
p=getPrime(1024)
print"p",p
q=getPrime(1024)
print"q", q
n=p*q
print"n",n
s=""
s+=hex(n)+"\n"
e=65537
c=pow(m,e,n)
print"c",c
cipher=long_to_bytes(c)
k=random.randint(0,0xffffffffff)#get assume len randomprint"k",k
s+=pen(cipher,k)+"\n"
s+=hex(backdoor(p,k))
open("info","w").write(s)
if __name__ == '__main__':
main()
下面是我写的解密脚本
# encoding:utf-8from libnum import gcd,invmod
from Crypto.Util.number import bytes_to_long
import string
n=0x74fa9956e470bfa8501b4ff98ce6687ba37e2b7ce5592ff61c96379c1df04f2af91ab7b9da4935dc1a9860b203e0012bd7855845ad51d28b221d3eeb5d841bd65247ab39aab7635d3767e439e930127c20b6dc2bbf526de67d1f2cbbe798c031665dbb033a07247966b0f9988aac0d7ff7736d6cd39d35f74a88956c9b8d1c7b4177195ff50bab7e9af211c9e09c7b6345733fb41380c678bc1d0b80f21eb80d3bb2338f2da692bb588a853eea2bfd9091d31e7d14aa504f4073a1afb819e8edc336755e29ca11852d8efc0bd8f1d454ae4a698fd18e1edaa8649a6077fd3a4638b6aafbe1eb37a78aff52e8a056c92ddf4ed1f3cbeab89748b95ef09f70d1d7L
c='O7P6yC21fCJYE8NbvkNnmxQihBUYIBpHz606MZeUZW14C0SA8CFcm+RaOTTftwJyEhlW7x1KeIG7ZGsd0HeRhcb3/wJIkY7dPmywHxv+78tlHSUtxEsS4dT/fY3Hxj1hrP75ZjQ24r3wM0PsY79G9MIDvVqg3p2NybP0NYxXhfZGJHNELlubpcGGW/YtZIGYX8QXtOZZvbVdQBL0xBrBxzZNTUGIJjCUY5+RxuAITsbDVwTi1QX2SSv28p6+vgmpkul/rL9pXQk0M6CKKI+SWJjFaKrtSlYho5o/tGSISi74taq0r4Jef/zlctbYg6oy4qRUp4Qs+l5RYokPKaYIaN'
backdoor_p=0x76d72e0b530ed5c3cf09273bb1e452f913ef648420a003d9f08ee8bdbc96f6bf999a3f51f08fa3c9bb2434374f41a201c7d5fc6ffec50c3bc32c84a6c21dff5f7a567558e3b82aef4c4c301c2c3d7c6657fb3135a032302c772842956582224dcef66f8c812c57f6902adc0edb97d80d8feffb2d06951741a31c3a992bf5e79f430b02300a39834c97a683c665566dadaaff771fd5278ce1001cd9cde888c319c909d15b0ce3d6fa871f674541cb2a78c6edf058335cbbf1cfc54ecf441da7baaf46d6903eacb8fcfa32602dec3a4aa50e60cc51f49042bb4681bbf0f16ec6fd0241ddf697cf224de602aeb5276c02a27f39a4853cd044cdee6dc216ed497b1bL
k = ''
q = ''for i in range(64):
p = gcd(backdoor_p^i,n)
if p != 1:
k = i
break#print p
q = n/p
f_n = (p-1)*(q-1)
e=65537
d=invmod(e,f_n)
print d
myl=string.printable[0:62]+"+/"
nell=[""]*64for i in range(64):
nell[(i+k)%64]=myl[i] #copy myl to nell
nel="".join(nell)
bs = ''for i in c[:-1]:
d1 = nell.index(i)
bs += '0'*(6-len(bin(d1)[2:]))+bin(d1)[2:]
bs += bin(nell.index(c[-1:]))[2:]
msg = ''for i in range(0,len(bs),8):
msg += chr(int(bs[i:i+8],2))
msg = bytes_to_long(msg)
print msg
#print stringprint hex(pow(msg,d,n))[2:-1].decode('hex')
d = ''
s = 'MerryChristmas'a = [1,2,3,4,5,6,1,2,3,4,5,6,1,2]
for i in range(0,14):
d = d + chr(ord(s[i])-a[i])
print d
4.计算flag的值
s = 'Lcont=gpfoog`q'
flag = 654323
tmp = 0x1E240mod = 0x3B9ACA07
#flag = (flag + (signed int)v5 * tmp) % mod;
for i inrange(0,14):
flag = (flag + ord(s[i]) * tmp) % mod
print flag
This post is a simple write-up of the process and problem during my experience. Note: Please replace username to what you need in this post!
Under Linux (Ubuntu here)
1. Create public and pr
【Title】Pico CTF 2014 Write-up snippet
【Description】
We found this program snippet.txt, but we're having some trouble figuring it out. What's the value of %eax when the last instruction (the NOP) r
This is a good “standard” write-up of what the course is like (i.e. a syllabus)… there is WAY much more to it!
Purpose
To teach someone how to be a ScrumMaster in their organization OR work as a Scr
from:http://www.aota.net
<!--StartFragment -->
With the upgrade of PHP to version 4.1.1 a new feature was introduced; gettext. Here's a small write-up about how to use gettext on your site. S
This article is from an interview with Zuhaib Siddique, a production engineer at HipChat, makers of group chat and IM for teams.
HipChat started in an unusual space, one you might not
