[原创]]2022KCTF秋季赛第十题两袖清风-CTF对抗-看雪-安全社区|安全招聘|kanxue.com

[原创]]2022KCTF秋季赛第十题两袖清风

2022-12-10 23:38 12403

[原创]]2022KCTF秋季赛第十题两袖清风

ThTsOd

2022-12-10 23:38

12403

NoLimit

1.输入长度 >= 0x59,<= 0xcd

2.计算rsa

cipher 0xB20446102D1C343D0575674CA28EBC0419BCFE4D75682C2AC81C9502454650BDDAEF6968AF269B54C182
N = 0x4F62187B5F6590C6CFF0FBDBBEBDAF60AA861BD2F66F8F7FFD57A66AE50DB7D2FFFFFFFFFFFFFFFFFFFFF
E = 0x11
N可直接分解

计算出 D 243855937587318030864454877487317725150433472540948954237790304930432311137671434982797927461139896305

转为hex 1BDF5752B86533B0EF0C488375EBFE389163712709D3FEE35C7679A1AB7A8E697366227CAF168C99DD7F1

3.AES解密code

key为 4位数字 + rsa解密内容("AllIsNothing") + "00 CD CD CD CD CD CD CD CD CD CD CD CD CD CD CD"
4位数字要求两两相同
爆破脚本

import base64
from Crypto.Cipher import AES
from Crypto.Util.Padding import pad, unpad
 
def AES_Decrypt(key, data):
  iv = bytearray.fromhex("41 42 43 44 45 46 30 31 32 33 34 35 36 37 38 39")
  cipher = AES.new(key, AES.MODE_CBC, iv)
  text_decrypted = cipher.decrypt(data)
 
#   try:
#     text_decrypted = unpad(text_decrypted, AES.block_size, "pkcs7")
#   except:
#       return None
  if(text_decrypted[-1] != 0x00):
    return None
# 去补位
  return text_decrypted
 
data = bytearray.fromhex("94 C7 A9 05 C7 DC ... 22 6A") #密文
 
for i in range(10000):
    key = b""
    t=[]
    n=i
    for l in range(4):
        t.append((n%10)+48)
        n//=10
    key = bytearray(t)
    key += bytearray.fromhex("41 6C 6C 49 73 4E 6F 74 68 69 6E 67 00 CD CD CD CD CD CD CD CD CD CD CD CD CD CD CD")
    result = AES_Decrypt(key,data)
    if(result != None):
        print(key[0:4],(result[0:0x10]).hex())