WUST2020部分WP

最新推荐文章于 2024-03-30 19:20:00 发布

雨后初霁&

最新推荐文章于 2024-03-30 19:20:00 发布

阅读量1.4k

点赞数

CC 4.0 BY-SA版权

分类专栏：密码学CTF CTF逆向文章标签： CTF

本文链接：https://blog.csdn.net/a257131460266666/article/details/124520617

CTF逆向同时被 2 个专栏收录

19 篇文章

订阅专栏

密码学CTF

5 篇文章

订阅专栏

该博客分享了解码过程，包括通过缺失字符查找、Base64解码和自定义Base64表的使用，展示了如何在[CTF]比赛中解决关于密钥恢复和编码的题目。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

[WUSTCTF2020]B@se

密文：MyLkTaP3FaA7KOWjTmKkVjWjVzKjdeNvTnAjoH9iZOIvTeHbvD== JASGBWcQPRXEFLbCDIlmnHUVKTYZdMovwipatNOefghq56rskxyz012789+/

oh holy shit, something is missing...

明显base64，少了4个

A44=24次，可以先找出缺少的4个字符，然后排序挨个解密

#include<stdio.h>
#include<windows.h>
#include<string.h>
int main(){
 char a1[100];
 char miss[5];
 miss[0]=0;
 char s1[]="TSRQPONMLKJIHGFEDCBAUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
 char s2[]="JASGBWcQPRXEFLbCDIlmnHUVKTYZdMovwipatNOefghq56rskxyz012789+/";//JASGBWcQPRXEFLbCDIlmnHUVKTYZdMovwipatNOefghq56rs****kxyz012789+/
int i,j,z=0;
for(i = 0;i<strlen(s1);i++)
{  int flag = 1;
  for(j = 0;j<strlen(s2);j++)
  {
    if(s1[i]==s2[j])
    { flag = 0;
      break;
    }
  }
  if(flag) miss[z++]=s1[i]; 
}
puts(miss);//ju34
}

拿到缺少的4位ju34

ju34,ju43,j3u4,j34u,j43u,j4u3

uj34,uj43,u3j4,u34j,u43j,u4j3

3uj4,3u4j,3ju4,3j4u,34ju,34uj

4uj3,4u3j,4ju3,4j3u,43ju,43uj

一个一个试

最后34ju跑出来的是对的

s = 'MyLkTaP3FaA7KOWjTmKkVjWjVzKjdeNvTnAjoH9iZOIvTeHbvD=='
b_char = 'JASGBWcQPRXEFLbCDIlmnHUVKTYZdMovwipatNOefghq56rs34ujkxyz012789+/'
b = ''
for i in s:
    for j in range(len(b_char)):
        if i == b_char[j]:
            b += str(bin(j)).replace('0b', '').zfill(6)
flag = ''
for i in range(0, len(b), 8):
    flag += chr(int(b[i: i+8], 2))
print(flag)
#wctf2020{base64_1s_v3ry_e@sy_and_fuN}

[WUSTCTF2020]babyrsa

c = 28767758880940662779934612526152562406674613203406706867456395986985664083182 n = 73069886771625642807435783661014062604264768481735145873508846925735521695159 e = 65537

直接写

from gmpy2 import *
from libnum import *
from sympy import Symbol, solve
c = 28767758880940662779934612526152562406674613203406706867456395986985664083182
n = 73069886771625642807435783661014062604264768481735145873508846925735521695159
e = 65537
q=189239861511125143212536989589123569301
p=386123125371923651191219869811293586459
d=invert(e,(q-1)*(p-1))
m=powmod(c,d,n)
print("flag:", bytes.fromhex(hex(m)[2:]))

[WUSTCTF2020]level1

output

198 232 816 200 1536 300 6144 984 51200 570 92160 1200 565248 756 1474560 800 6291456 1782 65536000

ida看文件

int __cdecl main(int argc, const char **argv, const char **envp)
{
  int i; // [rsp+4h] [rbp-2Ch]
  FILE *stream; // [rsp+8h] [rbp-28h]
  char ptr[24]; // [rsp+10h] [rbp-20h] BYREF
  unsigned __int64 v7; // [rsp+28h] [rbp-8h]

  v7 = __readfsqword(0x28u);
  stream = fopen("flag", "r");
  fread(ptr, 1uLL, 20uLL, stream);
  fclose(stream);
  for ( i = 1; i <= 19; ++i )
  {
    if ( (i & 1) != 0 )
      printf("%ld\n", (unsigned int)(ptr[i] << i));
    else
      printf("%ld\n", (unsigned int)(i * ptr[i]));
  }
  return 0;
}

直接写EXP

#include<stdio.h>
#include<windows.h>
#include<string.h>
int main(){
  int output[]={0,198,232,816,200,1536,300,6144,984,51200,570,92160,1200,565248,756,1474560,800,6291456,1782,65536000};
  char flag[20];
  flag[0]='{';
  for(int i=1;i<20;i++){
    if ((i&1)!=0)
    {
       flag[i] =(int) (output[i]>>i);
    } 
    else
    {
       flag[i] =(int)(output[i]/i) ;
    }
     

  } 
  puts(flag);

}

//ctf2020{d9-dE6-20c}

[WUSTCTF2020]level2

查壳upx

ida打开直接看

定位

mov     [ebp+var_C], offset flag ; "wctf2020{Just_upx_-d}"

[WUSTCTF2020]level3

ida直接看

int __cdecl main(int argc, const char **argv, const char **envp)
{
  const char *v3; // rax
  char v5; // [rsp+Fh] [rbp-41h]
  char v6[56]; // [rsp+10h] [rbp-40h] BYREF
  unsigned __int64 v7; // [rsp+48h] [rbp-8h]

  v7 = __readfsqword(0x28u);
  printf("Try my base64 program?.....\n>");
  __isoc99_scanf("%20s", v6);
  v5 = time(0LL);
  srand(v5);
  if ( (rand() & 1) != 0 )
  {
    v3 = (const char *)base64_encode(v6);
    puts(v3);
    puts("Is there something wrong?");
  }
  else
  {
    puts("Sorry I think it's not prepared yet....");
    puts("And I get a strange string from my program which is different from the standard base64:");
    puts("d2G0ZjLwHjS7DmOzZAY0X2lzX3CoZV9zdNOydO9vZl9yZXZlcnGlfD==");
    puts("What's wrong??");
  }
  return 0;
}

base64自定义表，经过替换解密直接写

_int64 O_OLookAtYou()
{
  __int64 result; // rax
  char v1; // [rsp+1h] [rbp-5h]
  int i; // [rsp+2h] [rbp-4h]

  for ( i = 0; i <= 9; ++i )
  {
    v1 = base64_table[i];
    base64_table[i] = base64_table[19 - i];
    result = 19 - i;
    base64_table[result] = v1;
  }
  return result;
}

找替换

#include<stdio.h>
#include<windows.h>
#include<string.h>
int main(){
  char v1; // [rsp+1h] [rbp-5h]
  int i; // [rsp+2h] [rbp-4h]
  char base64_table[]="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
  for ( i = 0; i <= 9; ++i )
  {
    v1 = base64_table[i];
    base64_table[i] = base64_table[19 - i];
    int result = 19 - i;
    base64_table[result] = v1;
  }
  puts(base64_table);
}
//TSRQPONMLKJIHGFEDCBAUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/

EXP

s = 'd2G0ZjLwHjS7DmOzZAY0X2lzX3CoZV9zdNOydO9vZl9yZXZlcnGlfD=='
b_char = 'TSRQPONMLKJIHGFEDCBAUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/'
b = ''
for i in s:
    for j in range(len(b_char)):
        if i == b_char[j]:
            b += str(bin(j)).replace('0b', '').zfill(6)
flag = ''
for i in range(0, len(b), 8):
    flag += chr(int(b[i: i+8], 2))
print(flag)
#wctf2020{Base64_is_the_start_of_reverse}

[WUSTCTF2020]Cr0ssfun

ida进去直接看

#include<stdio.h>
#include<windows.h>
#include<string.h>
int main(){
 char a1[100];
 a1[10] = 'p',a1[13] = 64, a1[3] = 102, a1[26] =114,a1[20] = 101;
 a1[7] = 48, a1[16] = 95 , a1[11] = 112, a1[23] =101, a1[30] = 117;
 a1[0] = 119 , a1[6] = 50 , a1[22] =115 , a1[31] = 110 , a1[12] = 95;
 a1[15] =100, a1[8] = 123,a1[18] = 51, a1[28] = 95,a1[21] = 114;
 a1[2] = 116,a1[9] = 99,a1[32] = 125,a1[19] = 118,a1[5] = 48,a1[14] =110;
 a1[4] =50, a1[17] = 114 , a1[29] =102 , a1[17] = 114, a1[24] = 95;
 a1[1] = 99 ,a1[25] = 64 , a1[27] = 101;
 puts(a1);

//wctf2020{cpp_@nd_r3verse_@re_fun}
}

[WUSTCTF2020]dp_leaking

e = 65537 n = 156808343598578774957375696815188980682166740609302831099696492068246337198792510898818496239166339015207305102101431634283168544492984586566799996471150252382144148257236707247267506165670877506370253127695314163987084076462560095456635833650720606337852199362362120808707925913897956527780930423574343287847 c = 108542078809057774666748066235473292495343753790443966020636060807418393737258696352569345621488958094856305865603100885838672591764072157183336139243588435583104423268921439473113244493821692560960443688048994557463526099985303667243623711454841573922233051289561865599722004107134302070301237345400354257869 dp = 734763139918837027274765680404546851353356952885439663987181004382601658386317353877499122276686150509151221546249750373865024485652349719427182780275825

直接写

EXP

from gmpy2 import *
from Crypto.Util.number import *
def rsa(e,n,dp,c):
    p=0
    for i in range(1,e):
        if (e*dp-1)%i==0:
            p=(e*dp-1)//i+1
            if n%p==0:
                break
    q=n//p
    d=invert(e,(p-1)*(q-1))
    print(long_to_bytes(pow(c,d,n)))
    #b'wctf2020{dp_leaking_1s_very_d@angerous}'
if __name__ == "__main__":
    e = 65537
    n = 156808343598578774957375696815188980682166740609302831099696492068246337198792510898818496239166339015207305102101431634283168544492984586566799996471150252382144148257236707247267506165670877506370253127695314163987084076462560095456635833650720606337852199362362120808707925913897956527780930423574343287847
    c = 108542078809057774666748066235473292495343753790443966020636060807418393737258696352569345621488958094856305865603100885838672591764072157183336139243588435583104423268921439473113244493821692560960443688048994557463526099985303667243623711454841573922233051289561865599722004107134302070301237345400354257869
    dp = 734763139918837027274765680404546851353356952885439663987181004382601658386317353877499122276686150509151221546249750373865024485652349719427182780275825
    rsa(e,n,dp,c)

flag{dp_leaking_1s_very_d@angerous}

[WUSTCTF2020]情书

Premise: Enumerate the alphabet by 0、1、2、..... 、25 Using the RSA system Encryption:0156 0821 1616 0041 0140 2130 1616 0793 Public Key:2537 and 13 Private Key:2537 and 937

flag: wctf2020{Decryption}

提取信息

c=01560821161600410140213016160793

e=13

d=937

n=2537 //43*59

q=43

p=59

EXP直接写

from gmpy2 import *
from Crypto.Util.number import *
c=[156,821,1616,41,140,2130,1616,793]
s='abcdefghijklmnopqrstuvwxyz'
e=13
d=937
n=2537 
q=43
p=59
flag=""
for i in range(len(c)):
    m=pow(c[i],d,n)
    flag+=s[m]
print("flag{"+flag+"}")

[WUSTCTF2020]大数计算

flag等于 wctf2020{Part1-Part2-Part3-Part4} 每一Part都为数的十六进制形式（不需要0x)，并用 '-' 连接 Part1 = 202020192018* ... 32*1 的前8位 Part2 = 520^1314 + 2333^666 的前8位 Part3 = 宇宙终极问题的答案 x,y,z绝对值和的前8位 Part4 = 见图片附件，计算结果乘上1314

这个没啥好说的感觉和比赛都没关系

flag{24d231f-403cfd3-108db5e-a6d10}