from pwn import * from PIL import Image from pyzbar.pyzbar import decode
r = remote('210.44.151.51',10144)
for i inrange(1000): print(i) x = r.recvuntil(b'Please')[:-7].split(b'\n')
MAX = len(x) pic = Image.new("RGB",(MAX,MAX)) s = b''.join(x) i = 0 for y inrange(0,MAX): for x inrange(0,MAX): if(s[i] == ord('0')): pic.putpixel((x,y),(0,0,0)) else: pic.putpixel((x,y),(255,255,255)) i = i+1 pic.save("flag.png")
decocdeQR = decode(Image.open("flag.png")) data = decocdeQR[0].data print(data) r.sendlineafter(b'code:',data) print(r.recvline())
r.interactive()
问卷调查
SICTF{SICTF_Round3_will_do_even_better!}
CRYPTO
[签到]古典大杂烩
base100-base62-base64-base58-base32-base62
SICTF{fe853b49-8730-462e-86f5-fc8e9789f077}
Radio
CRT
1 2 3 4 5 6 7 8 9 10 11 12 13
n1 = n2 = n3 = c1 = c2 = c3 = e = 17
mm = crt([c1,c2,c3],[n1,n2,n3]) m = mm.nth_root(e, truncate_mode=True) print(bytes.fromhex(hex(m[0])[2:]))
import Crypto.Util.strxor as xo import libnum, codecs, numpy as np
defisChr(x): iford('a') <= x and x <= ord('z'): returnTrue iford('A') <= x and x <= ord('Z'): returnTrue returnFalse
definfer(index, pos): if msg[index, pos] != 0: return msg[index, pos] = ord(' ') for x inrange(len(c)): if x != index: msg[x][pos] = xo.strxor(c[x], c[index])[pos] ^ ord(' ')
defknow(index, pos, ch): msg[index, pos] = ord(ch) for x inrange(len(c)): if x != index: msg[x][pos] = xo.strxor(c[x], c[index])[pos] ^ ord(ch)
dat = []
defgetSpace(): for index, x inenumerate(c): res = [xo.strxor(x, y) for y in c if x!=y] f = lambda pos: len(list(filter(isChr, [s[pos] for s in res]))) cnt = [f(pos) for pos inrange(len(x))] for pos inrange(len(x)): dat.append((f(pos), index, pos))
c = [codecs.decode(x.strip().encode(), 'hex') for x inopen('Problem.txt', 'r').readlines()]
msg = np.zeros([len(c), len(c[0])], dtype=int)
getSpace()
dat = sorted(dat)[::-1] for w, index, pos in dat: infer(index, pos)
print('\n'.join([''.join([chr(c) for c in x]) for x in msg]))
key = xo.strxor(c[0], ''.join([chr(c) for c in msg[0]]).encode()) print(key)
# Little Red Riding Hood promise # d to obey her mother. The gran # dmother lived out in the woods # , a half hour from the village # . When Little Red Riding Hood # entered the woods a wolf came # up to her. She did not know wh # at a wicked animal he was, and # was not afraid of him. "Good # day to you, Little Red Riding # b'SICTF{MTP_AtTack_is_w0nderFu1}'
Easy_CopperSmith
coppersmith解已知p高位攻击。
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16
n = c = ph = e = 65537 PR.<x> = PolynomialRing(Zmod(n)) f = (ph << 230) + x pl = f.small_roots(X=2^230, beta=0.48, epsilon=0.02)[0] p = (ph << 230) + pl
q = n//int(p) f = (p-1)*(q-1) d = inverse_mod(e,f) m = pow(c,d,n) print(bytes.fromhex(hex(m)[2:]))
# b'SICTF{3f9366ed-b8e4-412f-bbd0-62616a24115c}'
签到题来咯！
Related Message Attack（Franklin-Reiter攻击），爆破小 $e$。
e = 2 while e < 2^10: m = attack(c1, c2, n, e) m = binascii.unhexlify("%x" % int(m)) if m.isascii(): print(m) break e = next_prime(e) # SICTF{hhh!!franklin_reiter_is_easy}
small_e
直接小 $e$ 攻击
1 2 3 4 5 6 7
import gmpy2 e = 3 c = m = gmpy2.iroot(c,3)[0] print(bytes.fromhex(hex(m)[2:]))
POST ?A_B_C=O:1:"B":1:{s:3:"pop";O:1:"A":3:{s:3:"Aec";O:1:"B":2:{s:1:"i";s:1:"1";s:6:"nogame";O:1:"P":1:{s:7:"MyLover";s:1:"x";}}s:3:"boy";a:1:{i:0;s:1:"2";}s:4:"girl";a:1:{i:0;s:1:"1";}}}
c = [148,136,151,234,177,48,226,234,214,177,168,176,151,250,19,20,253,52,72,176,170,140,176,236,54,231,212,237,135,151,150,135,217,231,229,32,90] k = list(b'SICTF2023')
