PwnTheBox 刷题记录crypto篇

PwnTheBox 刷题记录crypto篇

简单

1、佛法

先与佛论禅在线解密：与佛论禅
再base64解密，得到乱码

.¤.|)
.©9.©
.p
.©
]i
.©.
1
2
3
4
5
6

凯撒密码用密钥23加密后再base64解密得到flag(看wp才知道，这里可以用爆破，flagbase64加密后的内容为ZmxhZw==)

2、Caesar

阅读python代码

import hashlib

def change(key, str):
    result = ""
    for i in str:
        if ord(i) >= 97 and ord(i) <= 122:
            result += chr(97+(ord(i)+key) % 26)
        else:
            result += i
    return result

key = *
str1 = "********************************"
str2 = change(key, str1)  # zab81501z9740b67dc0by8z15093a426
flag = hashlib.md5(str1).hexdigest()
print(flag[10:16]）  # aebc0a
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16

首先定义一个函数，遍历str里面的字符，当字符的ascii值在给定范围内时就加上key再模26（97-122为大小写英文字符），key和str1未知，str2是str1加密后的结果，flag为str1MD5加密后的结果，并给了flag的部分字符
解密脚本

import hashlib
from opcode import hasjrel
def change(key, str):
    result = ""
    for i in str:
        if ord(i) >= 97 and ord(i) <= 122:
            result += chr(97+(ord(i)+key) % 26)
        else:
            result += i
    return result
for realKey in range(26):
    str1 = "zab81501z9740b67dc0by8z15093a426"
    str2 = change(realKey, str1)
    md  = hashlib.md5()
    md.update(str2.encode('utf-8'))
    flag = md.hexdigest()
    if flag[10:16] == 'aebc0a':
        print('flag{' + flag + '}')

# flag{8f36ba62b0aebc0ae2a9c7abea36f7ef}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21

3、栅栏

4、jsfuck

进入网站，按f12，将js编码放入控制台（console）回车后会弹出flag

flag{hello javascript}

5、Url

直接url解码

flag{and 1=1}

6、hill

Can you climb this hill?
17 17 5 21 18 21 2 2 19
ygc
1
2
3

通过网上的加密脚本加密ygc得到flag

import numpy as np
import sys


# 判断矩阵是否存在逆矩阵
def judge_inverse_matrix(matrix):
    try:
        np.linalg.inv(matrix)
    except:
        return False
    return True


# 输入列表并转换为矩阵
def inputmatrix():
    row_num = int(input("请输入矩阵的行数："))
    all_list = []
    for i in range(1, row_num + 1):
        row = input(f"请输入加密矩阵第{i}行(以空格为分隔)：")
        if row[0] == ' ':
            print("输入有误，第一位不该为空格")
            sys.exit()
        else:
            row_list = row.split(' ')
        # 将列表中str转换为int
        if len(row_list) == row_num:
            for n in row_list:
                row_list[row_list.index(n)] = int(row_list[row_list.index(n)])
            all_list.append(row_list)
        else:
            print("前后输入的行数不一致,请重修输入")
            break
    encrypt_matrix = np.array(all_list)
    if not judge_inverse_matrix(encrypt_matrix):
        print("该矩阵不存在逆矩阵，请重修输入")
    return encrypt_matrix


# 生成矩阵的逆矩阵。如果逆矩阵含有小数，就四舍五入
def generate_inverse_matrix(matrix):
    inverse_matrix = np.linalg.inv(matrix)
    for row in inverse_matrix:
        for num in row:
            num = round(num)
    print("加密矩阵的逆矩阵为：")
    for array in inverse_matrix:
        print(array)
    return inverse_matrix


# 生成字母-数字对应的字典
def alphabet_number():
    alphabet_number_dict = {}
    for i in range(97, 123):
        alphabet_number_dict[chr(i)] = i % 97
    return alphabet_number_dict


def encrypt():
    # 明文字母转换成对应数字
    input_plaintext = input("请输入明文：")
    num_list = []
    dic = alphabet_number()
    for i in input_plaintext:
        num_list.append(dic[i])

    # 如果矩阵行数不能整除明文，则用'z'的数字25补全
    matrix = inputmatrix()
    row_num = len(matrix)
    supple_num = row_num - (len(num_list) % row_num)
    if len(num_list) % row_num != 0:
        for n in range(1, supple_num + 1):
            num_list.append(25)
    print(f"\n添加了{supple_num}个z补全明文")

    # 分组加密
    group_num = int(len(num_list) / row_num)
    whole_encrypt_num_list = []
    for g in range(0, group_num):
        plaintext_matrix = np.array(num_list[0 + g * row_num: (g + 1) * row_num])
        encrypt_num_list = np.matmul(plaintext_matrix, matrix)
        for num in encrypt_num_list:
            whole_encrypt_num_list.append(num)

    # 将加密后的数字转换为字母
    ciphertext = ""
    for ennum in whole_encrypt_num_list:
        # 对超出范围的数字取模
        if ennum > 25:
            ennum = ennum % 26
        for k in dic:
            if dic[k] == ennum:
                ciphertext = ciphertext + k
    print("加密后密文为：", ciphertext, '\n')


def decrypt():
    # 输入密文并转换为对应数字
    input_ciphertext = input("请输入密文：")
    num_list2 = []
    dic2 = alphabet_number()
    for i in input_ciphertext:
        num_list2.append(dic2[i])

    # 解密就不添加'z'来补全密文了
    matrix = inputmatrix()
    row_num2 = len(matrix)
    supple_num2 = row_num2 - (len(num_list2) % row_num2)

    # 用逆矩阵分组解密
    inserve_matrix = generate_inverse_matrix(matrix)
    group_num2 = int(len(num_list2) / row_num2)
    whole_decrypt_num_list = []
    for g in range(0, group_num2):
        plaintext_matrix = np.array(num_list2[0 + g * row_num2: (g + 1) * row_num2])
        decrypt_num_list = np.matmul(plaintext_matrix, inserve_matrix)
        for num in decrypt_num_list:
            whole_decrypt_num_list.append(num)

    # 将解密后的数字转换为对应字母
    plaintext = ""
    for denum in whole_decrypt_num_list:
        if denum > 25 or denum < -26:
            denum = denum % 26

        # 防止取模后是负数，字典中找不到对应的字母
        if denum < 0:
            denum = denum + 26
        # 字典中寻找与数字对应的字母
        for k in dic2:
            if dic2[k] == denum:
                plaintext = plaintext + k
    print("解密后明文为：", plaintext, '\n')


if __name__ == '__main__':
    while True:
        print("========Hill密码========\n")
        print("1.加密\n2.解密\n")
        print("注意：如果输入矩阵的逆矩阵中含有小数，采用四舍五入的方法\n")
        pattern = input("请选择模式：")
        if pattern == '1':
            encrypt()
        elif pattern == '2':
            decrypt()
        else:
            print("输入有误，请重修输入")

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148

运行结果
得到flag
flag{say}

7、Morse

摩斯密码解码

再十六进制解码

得到flag：afctf{1s’t_s0_345y}

8、Vigenère

通过网站破解没有密码的维吉尼亚密码，在解出来的文本中搜索flag
解密网站
afctf{Whooooooo_U_Gotcha!}

9、来题中等的吧

摩斯密码解密
flag{ALPHALAB}

10、栅栏

TEESCPEHRIAIHR
栅栏解密：THEREISACIPHER
flag{THEREISACIPHER}

11、回转

先rot13再base64
FlagIS6cvkrhFpVEHAK8Ap

12、来题简单的吧

摩斯密码解码
MORSECODE

13、caesar

凯撒密码爆破
flagiscaesar

14、warmup1

密文：llkjmlmpadkkc
密钥：thisisalilkey
通过维吉尼亚解密得到flag
secretmessage

15、warmup2

rot13解密
picoCTF{this_is_crypto!}

16、simpleCrypto

用密码：zheshimima解压缩，得到flag
flag{5a851c56-75a3-4899-911b-0bb48bc31a52}

17、4进制更安全

题目：
1212 1230 1201 1213 1323 1012 1233 1311 1302 1202 1201 1303 1211 301 302 303 1331

1
2
3

解题脚本
list = "1212 1230 1201 1213 1323 1012 1233 1311 1302 1202 1201 1303 1211 301 302 303 1331"
dict = list.split(" ")   #用空格对list分片
flag = ""
for i in dict:
    flag+=chr(int(i,4))    
#base存在时，视 x 为 base 类型数字，并将其转换为 10 进制数字，base默认为10，这里base=4
print(flag)

flag{Fourbase123}
1
2
3
4
5
6
7
8
9
10

18、easy_crypto

0010 0100 01 110 1111011 11 11111 010 000 0 001101 1010 111 100 0 001101 01111 000 001101 00 10 1 0 010 0 000 1 01111 10 11110 101011 1111101
1

通过摩斯密码解密，再转换为小写

flag{m0rse_code_1s_interest1n9!}

19、RSA

4153372421328787064168548641845708183921443446990158572506114559735441950501706984118235944441928889749083563790293558028143373121367441549974248211570336802004821051820943229232421937298269855190652251294220483768084460779714162849925877879859830009443131489814222929347727735616113359695228615432020363240247474622132986939108457393618346100033147945959684443762976681454755482192433993286205527003029269574787026484389622816932835184754540312561890719407986296481186847292967270288752616
1

将给的数分解大素数，得到

16074357572745018593418837326290993512421736655307780242162599660198598253230550168811761868953242350136362894008095983571749530656901163555918436741973772511575306
1

将该数字转换成字节数据，得到b’Guvf vf gur cnffjbeq lbh arrq sbe gur MVC svyr: synt{efnZ0erQ33crE}\n’

from Crypto.Util.number import *
str1 = 16074357572745018593418837326290993512421736655307780242162599660198598253230550168811761868953242350136362894008095983571749530656901163555918436741973772511575306
str2 = long_to_bytes(str1)
print(str2)


b'Guvf vf gur cnffjbeq lbh arrq sbe gur MVC svyr: synt{efnZ0erQ33crE}\n'
1
2
3
4
5
6
7
8

再将得到的字符串synt{efnZ0erQ33crE}进行凯撒密码爆破得到flag
flag{rsaM0reD33peR}

20、古典密码

先通过basecrack.py解密后得到 CLF{TCAASISCLWASPSOEDARRIETENRS}INTG
然后六个字符一分组

0    1    2   3   4    5
C    L    F   {   T    C
A    A    S   I   S    C
L    W    A   S   P    S
O    E    D   A   R    R
I    E    T   E   N    R
S    }    I   N   T    G
1
2
3
4
5
6
7

根据特征CTF{},按照042351排列，得到flag

0      4      2      3	   5     1
C      T      F      {	   C      L	
A      S      S      I	   C      A	
L      P      A      S	   S      W
O      R      D      A     R      E
I      N      T      E	   R      E
S      T      I      N	   G      }

CTF{CLASSICALPASSWORDAREINTERESTING}

1
2
3
4
5
6
7
8
9
10