[ritsec CTF 2024] 密码部分

这个比较密码这块还是比较简单的，经过问了N人以后终于完成。

[Warm Up] Words

给了个猪圈密码的图片，这东西好久不见的感觉。

[Warm Up] Emails

MTP似乎也没多好的方法，猜更快，先给了几封email然后一个用MTP长度是32（有提示）的加密，每封信的格式其实是差不多的。猜一下就十几个字符了。再一点点猜就OK

from pwn import xor

msg = open('email5.enc','rb').read()

l = 32
key = xor(b'Good evening,\r\n\r\nFinally, I feel',msg[:l])
for i in range(0, len(msg), l):
    v1 = msg[i:i+l]
    print(xor(key,v1))

'''
b'Good evening,\r\n\r\nFinally, I feel like it's safe to send you the flag. It's:\r\nRS{Th4T's_n0T_h0w_Y0u_u53_OTP}\r\nDon't share it with anyone!! It's very secret!\r\n\r\nThanks,\r\n- Your Secret Conspirator
'''

Dastardly Evil Scientists

给了一个远端的DES加密，这有点像脑筋急转弯，因为这个远端交互的部分没用。

from Crypto.Cipher import DES
from Crypto.Util.Padding import pad
from secret import KEY, FLAG

BLOCK_SIZE = 64

key = bytes.fromhex(KEY)
cipher = DES.new(key, DES.MODE_ECB)
flag = cipher.encrypt(pad(bytes(FLAG, "utf-8"), BLOCK_SIZE))

print("Here's the flag (in hex):", flag.hex())
print("=" * 64)
print("Encrypt something if you want, you can choose the key and the plaintext :)")
while True:
    try:
        key = bytes.fromhex(input("Key (in hex): "))
        plaintext = bytes.fromhex(input("Message to encrypt (in hex): "))
        print("=" * 64)
        cipher = DES.new(key, DES.MODE_ECB)
        ciphertext = cipher.encrypt(pad(plaintext, BLOCK_SIZE))
        print("Here's your message! (in hex):", ciphertext.hex())
        print("Here's your message! (in bytes):", ciphertext)
        print("=" * 64)
    except KeyboardInterrupt:
        break

其实就是根据一个DES的密文在没有key的情况下恢复，问了才知道用弱密码。这东西技术本来就没解，猜。

'''
┌──(kali㉿kali)-[~/ctf/2403]
└─$ nc ctf.ritsec.club 30984
Here's the flag (in hex): 28e3a0ff9089aecc83465e470624a89253a1aac856a4f7ff08b4648b7c5eff9aa41a0dd1c7fc15995382dc3149dfcccf82241fb566fb5a0382241fb566fb5a03
================================================================
Encrypt something if you want, you can choose the key and the plaintext :)
Key (in hex): 
'''
keys = [
'0101010101010101',
'FEFEFEFEFEFEFEFE',
'E0E0E0E0F1F1F1F1',
'1F1F1F1F0E0E0E0E',
'0000000000000000',
'FFFFFFFFFFFFFFFF',
'E1E1E1E1F0F0F0F0',
'1E1E1E1E0F0F0F0F']

from Crypto.Cipher import DES
enc = bytes.fromhex('28e3a0ff9089aecc83465e470624a89253a1aac856a4f7ff08b4648b7c5eff9aa41a0dd1c7fc15995382dc3149dfcccf82241fb566fb5a0382241fb566fb5a03')
for key in keys:
    key = bytes.fromhex(key)
    cipher = DES.new(key, DES.MODE_ECB)
    print(cipher.encrypt(enc))

#RS{W0W_TH1S_K3YSP4C3_1S_4S_FL4T_4S_34RTH}

Failed File Transfer

这也是个急转弯，给了3组n,e,c 其中n1=n2是个共模攻击，与第3个毫无关系（分解了也解不出来）。

n1 = 0x00E066F78031520F1DD7AFF5EC5D59CD7AA68ECD4C394A1EC9792CF179E24C33F59AC856E61836C7AA34A3617316615F58743B9401507A423853AA31C5FCB8543E99DC23A52BF09CC65714406458C912CFB9CC3DAF41F1221294703846465F92B747FE3CB2E8444CACF38ECF5FAF78C4207569ECAE91D98ECA132E2C15BF6FDD51D399FE8A645B69C01CDCA2604AE9434BACD6C3B2BF41B4D41415425FC0D590E0579935C723FDA0887528BF20C8ADE06E7FF96FD0755694AE9501F905363F448A5546E083A1EDC901FBED1156E51BB095388EBE5672F695B395A2334FF156A6DD170A9D6EDD58E4415AB437E0D6A5C20C15CB946081ACDBA9AE1904668A2094A7
e1 = 0x11

n2 = 0x00E066F78031520F1DD7AFF5EC5D59CD7AA68ECD4C394A1EC9792CF179E24C33F59AC856E61836C7AA34A3617316615F58743B9401507A423853AA31C5FCB8543E99DC23A52BF09CC65714406458C912CFB9CC3DAF41F1221294703846465F92B747FE3CB2E8444CACF38ECF5FAF78C4207569ECAE91D98ECA132E2C15BF6FDD51D399FE8A645B69C01CDCA2604AE9434BACD6C3B2BF41B4D41415425FC0D590E0579935C723FDA0887528BF20C8ADE06E7FF96FD0755694AE9501F905363F448A5546E083A1EDC901FBED1156E51BB095388EBE5672F695B395A2334FF156A6DD170A9D6EDD58E4415AB437E0D6A5C20C15CB946081ACDBA9AE1904668A2094A7
e2 = 0x10001

n3 = 0x00B83B727303CCA9589A2A2B9AF5018C95F790608611EF866CF9A4C418A0D7DEF8D3F8EB1DDB4F209BED973903B815BBAE7C5528656265217DF68D54D699CA8B1E538DC6333681835A0B37F3040845E3CCE66B246AB2C85DAE92249527E370F4025C0328780F673422B06F50851F8E541F0F0A44FC3B196BC4E1AB8C6822987445555DC2F5950BF131EA0000D75572311837B52B7878D3A95E7C6ED2506481B5DA5E2F958AD4C9B6F5ECCB5A745308713A4FED8075FC91BCF2B4F21A692755E57806785019DEF5A2B268EA515F7C98D5F0D9D601F71FB4DF9C447BDB2AA41E297D2BDA6EA3542CD23B3355000CB8B88969E86831B684E5D9F17EB575ED1A9D4BC1
e3 = 3

from Crypto.Util.number import *
from gmpy2 import *
c1 = bytes_to_long(open('file1.txt','rb').read())
c2 = bytes_to_long(open('file2.txt','rb').read())
c3 = bytes_to_long(open('file3.txt','rb').read())

c1 = 11245878960087837261153516178684850454637136825484561550726912432349025296699694537872464349657733966826298283722786787933292056762759914076568007800566819942953557122977296478823083370205733249120718240013540365420405155115022388180051960802673652141559924942805827069850744998102254791685219410995184646316624102478708619178993243689040667230101593137349589107630305725689690939494305295499595455919109021945288211347640189838071821958185609046927008536889084147708562575440838230905838959519444560623562334687780414679184669161400916951922315233235810181868590747124614034500752457446358264532085815447285388073591
c2 = 16054994042311146186017609971632669838086039843925903279538251084169470320180830257196284538399796375682305705861424990272712206680326511935759065824972211750810396652005162857469803598720642557738604616794819369477983021340676007820878452867128139544526573553396360802705352396219060613392389540623902265215962677795832211589342073667420169650393268864124684435310861882097065213761756697025358974337991278905840043953671014003772900188734819841892901029660981787710334983605848616213210453940682289680252874387317386217578517608737723983756020598610426318181178794250467061361414561885082927773205471084373198179425
c3 = 20172398454481629709076152409120771119119636979189949766325302829870418847404497225982242452780243034238156558627368219057394137220128633740921274776445357416208523061501396375233405630630997666632960294747690427691310748022697040779115269467122991941859552531609447427683470428776973201589275412116191256662447910727158038828967329100259233048374570118492407923826709529836351193509410233823073092428830866679199977883169773243118628390507390065104100344830823694677958503145301186964407354825966110389585254787043844756466689845402596869978196900487069209922397756567505347271078963033190976335693178538107766271636

#n1=n2 共模攻击
import libnum
import gmpy2
 
def rsa_gong_N_def(e1,e2,c1,c2,n):  #共模攻击函数
    e1, e2, c1, c2, n=int(e1),int(e2),int(c1),int(c2),int(n)
    print("e1,e2:",e1,e2)
    s = gmpy2.gcdext(e1, e2)
    print("mpz:",s)
    s1 = s[1]
    s2 = s[2]
    if s1 < 0:
        s1 = - s1
        c1 = gmpy2.invert(c1, n)
    elif s2 < 0:
        s2 = - s2
        c2 = gmpy2.invert(c2, n)
    m = (pow(c1,s1,n) * pow(c2 ,s2 ,n)) % n
    return int(m)

long_to_bytes(rsa_gong_N_def(e1,e2,c1,c2,n1))
#RS{Y0U_C4NT_R3AD_M3_R1GHT??}

Old Fashioned Crypto

一个背包加密，key*r，后部的10个取了模

import json
from Crypto.Random import get_random_bytes
from Crypto.Cipher import AES
from Crypto.Util.Padding import pad
from math import gcd, log2, ceil


class CryptoSystem:
    def __init__(self, size, pub_key=None, priv_key=None):
        self.size = size
        if pub_key is None and priv_key is None:
            self._gen_keys()
        elif pub_key is None:
            self.priv_key = priv_key
            self._prv_lst, self._prv_q, self._prv_r, self._prv_r_inv = self.priv_key
            self._gen_pub_key()
        else:
            self.priv_key = priv_key
            if self.priv_key is not None:
                self._prv_lst, self._prv_q, self._prv_r, self._prv_r_inv = self.priv_key
            self.pub_key = pub_key

    def _gen_keys(self):
        lst = []
        total = 0
        for i in range(self.size):
            nxt = total + sum(get_random_bytes(4))
            total += nxt
            lst.append(nxt)
        self._prv_lst = lst
        self._prv_q = total + sum(get_random_bytes(4))
        self._prv_r = 0
        while gcd(self._prv_r, self._prv_q) != 1:
            self._prv_r = sum(get_random_bytes(8))
        self._inv(self._prv_r, self._prv_q)
        self.priv_key = (self._prv_lst, self._prv_q, self._prv_r, self._prv_r_inv)
        self._gen_pub_key()

    def _inv(self, a, b):
        x, y = self._inv_help(a, b)
        self._prv_r_inv = x + b if x < 0 else x

    def _inv_help(self, a, b):
        if a == 1 and b == 0:
            return 1, 0
        x_p, y_p = self._inv_help(b, a % b)
        x = y_p
        y = x_p - y_p * (a // b)
        return x, y

    def _gen_pub_key(self):
        self.pub_key = [(self._prv_r * w) % self._prv_q for w in self._prv_lst]

    def encrypt(self, data):
        if len(data) * 8 > self.size:
            raise ValueError(f"Data too big! Data has {len(data)*8} bits, can only encrypt {self.size} bits")
        val = int.from_bytes(data, 'big')
        tot = 0
        for i in range(self.size):
            if val & (1 << (self.size - 1 - i)):
                tot += self.pub_key[i]
        return tot.to_bytes(ceil(log2(tot)/8), 'big')

    def decrypt(self, ct):
        if self.priv_key is None:
            raise ValueError('This instance not created with private key; Cannot decrypt!')
        inv = (int.from_bytes(ct, 'big') * self._prv_r_inv) % self._prv_q
        data = 0
        for i in range(self.size-1, -1, -1):
            if self._prv_lst[i] <= inv:
                inv -= self._prv_lst[i]
                data |= (1 << (self.size - 1 - i))
        return data.to_bytes(self.size//8, 'big')


def main():
    n = 128
    c = CryptoSystem(n)
    key = get_random_bytes(n//8)
    enc_key = c.encrypt(key)
    iv = get_random_bytes(n//8)
    sym_c = AES.new(key, mode=AES.MODE_CBC, iv=iv)
    with open('flag.txt', 'rb') as f:
        flag = f.read()
    enc_flag = sym_c.encrypt(pad(flag, AES.block_size))
    with open('output.json', 'w') as f:
        json.dump({'enc_flag': enc_flag.hex(), 'enc_key': enc_key.hex(), 'pub_key': c.pub_key, 'iv': iv.hex()}, f)


if __name__ == '__main__':
    main()

因为背包前边比较小，通过gcd可以得到r,然后10个需要爆破一下，同时模也需要同步爆破。

key[k] = sum(key[:k]) + delta ,delta<=1020

不过最后的结果是不管爆破的哪个值都能得到正确的flag，任取其一即可。

key = [640152, 1168382, 2253084, 4674574, 9047900, 18456670, 37021078, 73718942, 147269478, 294724098, 589585222, 1179181950, 2358463270, 4716668178, 9433832160, 18867248012, 37734327618, 75468823642, 150937904600, 301875276786, 603750933270, 1207501571568, 2415003160918, 4830006433758, 9660012935506, 19320025912852, 38640051750392, 77280103282170, 154560206677308, 309120413125542, 618240826573252, 1236481653212402, 2472963306421666, 4945926612902954, 9891853225704446, 19783706451335672, 39567412902928660, 79134825805593728, 158269651611315068, 316539303222675114, 633078606445099188, 1266157212889999636, 2532314425780479386, 5064628851560855218, 10129257703121405004, 20258515406242969000, 40517030812485923356, 81034061624971802780, 162068123249943657860, 324136246499887437056, 648272492999774915952, 1296544985999549766006, 2593089971999099471344, 5186179943998199255442, 10372359887996398278672, 20744719775992796462158, 41489439551985593093768, 82978879103971186299458, 165957758207942372543478, 331915516415884744919596, 663831032831769489761788, 1327662065663538979557048, 2655324131327077959251122, 5310648262654155918162294, 10621296525308311836756586, 21242593050616623673275730, 42485186101233247346600622, 84970372202466494693276556, 169940744404932989386548928, 339881488809865978773018360, 679762977619731957546165378, 1359525955239463915092196868, 2719051910478927830184595614, 5438103820957855660369059432, 10876207641915711320738278902, 21752415283831422641476275384, 43504830567662845282952694070, 87009661135325690565905228102, 174019322270651381131810641346, 348038644541302762263621052572, 696077289082605524527242502624, 1392154578165211049054484845210, 2784309156330422098108969790836, 5568618312660844196217939281470, 11137236625321688392435878881970, 22274473250643376784871757533820, 44548946501286753569743515154458, 89097893002573507139487030340296, 178195786005147014278974060857366, 356391572010294028557948121450094, 712783144020588057115896242990144, 1425566288041176114231792485875688, 2851132576082352228463584971803676, 5702265152164704456927169943738102, 11404530304329408913854339887111150, 22809060608658817827708679774659528, 45618121217317635655417359549268848, 91236242434635271310834719098693550, 182472484869270542621669438196865146, 364944969738541085243338876394136140, 729889939477082170486677752787944882, 1459779878954164340973355505576101056, 2919559757908328681946711011152194790, 5839119515816657363893422022304309038, 11678239031633314727786844044608554270, 23356478063266629455573688089217321924, 46712956126533258911147376178434543432, 93425912253066517822294752356869114060, 186851824506133035644589504713738135026, 373703649012266071289179009427476613140, 747407298024532142578358018854952805788, 1494814596049064285156716037709905827052, 2989629192098128570313432075419811602850, 5979258384196257140626864150839623163860, 11958516768392514281253728301679246338180, 23917033536785028562507456603358492659624, 47834067073570057125014913206716985424894, 95668134147140114250029826413433970529712, 4024280977508761976100681034599517010909, 8048561955017523952201362069199034004036, 16097123910035047904402724138398067786320, 32194247820070095808805448276796135496282, 64388495640140191617610896553592270815790, 128776991280280383235221793107184541765468, 70241995243789299946484614422100659064021, 140483990487578599892969228844201318336196, 93655993658385733261979485896134212196063, 187311987316771466523958971792268424462208]

enc_key = 0x0351cf110fa463b393d61b1dfc0419d8d30d
enc_flag = bytes.fromhex("40ffc331e0624779d6cc8b594debb0fdfd65a21d9841f61ab5cfd5b2809bd0d91e5a2da049dbdf2ad8dceaadeee718ce")
iv = bytes.fromhex("631232abc39e6d838e6e1072a88b369a")

from Crypto.Cipher import AES
from gmpy2 import invert
from math import gcd 

#前部gcd得到r
r = key[0]
for i in key[1:118]:
    r = gcd(r,i)

#r=1046
vkey = [i//r for i in key[:118]]
#[118,127]模过,求模q
#最大差1024
b117 = sum(vkey)
qa2 = []
minmod = max(key)
def get_qr(idx,lst,total,m): #[118,128)
    global qa2
    if idx>=128:
        print(m-total)
        qa2.append(lst+[m])
        return
    for i in range(1021):
        k = total+i 
        nm = gcd(m,k*r - key[idx])
        if nm>minmod and nm> total+k:
            get_qr(idx+1,lst+[k],total+k, nm)

for i in range(1,1021):
    a118 = b117+i 
    m0 = a118*r - key[118]   #k118 = a118*r mod q = a118*r - kq
    #print(a118,m0)
    get_qr(119,vkey+[a118],b117+a118, m0)

def decrypt(ct, prv_lst, prv_q,prv_r):
    inv = ct * invert(prv_r,prv_q) % prv_q
    data = 0
    for i in range(127, -1, -1):
        if prv_lst[i] <= inv:
            inv -= prv_lst[i]
            data |= (1 << (127 - i))
    if inv==0:
        ek = long_to_bytes(data, 16)
        aes = AES.new(ek, mode=AES.MODE_CBC, iv=iv)
        flag = aes.decrypt(enc_flag)
        print(flag)

'''
#任何一组都可以
for lst in qa2:
    pk = lst[:-1]
    q = lst[-1]
    ek = decrypt(enc_key, pk, q, r)
'''
pk,q = qa2[0][:-1],qa2[0][-1]
decrypt(enc_key, pk, q, r)
#b"RS{You'll_Need_A_Super_Increasing_Knapsack}\x05\x05\x05\x05\x05"

最后两个没看懂,i没有代码只有远端