2020 BJDCTF WriteUp

主办方：由江苏科技大学、北京工业大学、西南民族大学、杭州师范大学、江苏大学、湖南工业大学、新疆大学七校联合举办。北京工业大学的官方信息也确认参与了本次赛事的组织

Misc

just a rar（RAR 爆破 + Hex 隐写）

rar的名字是四位数，那么密码应该也是四位数

WinHex 打开拿到 flag

你猜我是个啥（Hex 隐写）

WinHex 打开拿到 flag

藏藏藏（文件附加隐写）

010 看到文件中有 PK 头，推测还附加有压缩文件

使用 BinWalk 提取出来后有个名为 “福利.doc” 的文件，打开发现有个二维码

认真你就输了（文件附加隐写）

解压缩文件，给了一个 XLS 文件，打开该文件，发现是 PK 头

改为 .zip 后缀解压缩拿到 flag

签个到（文件后缀名欺骗）

下载压缩包解压报错，WinHex 打开发现是 PNG 文件头

改后缀为 PNG 是一张二维码，扫码得到 flag

一叶障目（PNG 宽高篡改）

改一下宽高就行

鸡你太美（文件头篡改）

WinHex 打开发现缺少了文件头

补充上去后换个方向就能看到 flag

1
flag{zhi-yin-you-are-beautiful}

Crypto

sign in（签到）

直接 Hex 转 ASCII 码即可

rsa_output（共模攻击）

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
# 导入所需的函数：长整数转字节串、求最大公约数
from Crypto.Util.number import long_to_bytes
from math import gcd

# RSA 公钥与密文：同一个明文用两个不同的 e 加密，对应同一个 n（共模）
n = 21058339337354287847534107544613605305015441090508924094198816691219103399526800112802416383088995253908857460266726925615826895303377801614829364034624475195859997943146305588315939130777450485196290766249612340054354622516207681542973756257677388091926549655162490873849955783768663029138647079874278240867932127196686258800146911620730706734103611833179733264096475286491988063990431085380499075005629807702406676707841324660971173253100956362528346684752959937473852630145893796056675793646430793578265418255919376323796044588559726703858429311784705245069845938316802681575653653770883615525735690306674635167111

e1 = 2767
e2 = 3659

c1 = 20152490165522401747723193966902181151098731763998057421967155300933719378216342043730801302534978403741086887969040721959533190058342762057359432663717825826365444996915469039056428416166173920958243044831404924113442512617599426876141184212121677500371236937127571802891321706587610393639446868836987170301813018218408886968263882123084155607494076330256934285171370758586535415136162861138898728910585138378884530819857478609791126971308624318454905992919405355751492789110009313138417265126117273710813843923143381276204802515910527468883224274829962479636527422350190210717694762908096944600267033351813929448599

c2 = 11298697323140988812057735324285908480504721454145796535014418738959035245600679947297874517818928181509081545027056523790022598233918011261011973196386395689371526774785582326121959186195586069851592467637819366624044133661016373360885158956955263645614345881350494012328275215821306955212788282617812686548883151066866149060363482958708364726982908798340182288702101023393839781427386537230459436512613047311585875068008210818996941460156589314135010438362447522428206884944952639826677247819066812706835773107059567082822312300721049827013660418610265189288840247186598145741724084351633508492707755206886202876227


# 扩展欧几里得算法，返回 gcd(a,b) 以及使得 a*x + b*y = gcd(a,b) 的 x, y
def exgcd(a, b):
    if b == 0:
        return a, 1, 0
    g, x1, y1 = exgcd(b, a % b)
    x = y1
    y = x1 - (a // b) * y1
    return g, x, y


# 处理可能为负指数的模幂运算：c^k mod n
def pow_signed(c, k, n):
    """
    计算 c^k mod n
    如果 k 为负数，则计算 inverse(c)^(-k) mod n
    """
    if k >= 0:
        return pow(c, k, n)
    else:
        # 先求 c 模 n 的逆元，再做正指数幂
        return pow(pow(c, -1, n), -k, n)


# 1. 用扩展欧几里得求 e1, e2 的线性组合系数
g, a, b = exgcd(e1, e2)

print("[+] gcd(e1, e2) =", g)
print("[+] a =", a)
print("[+] b =", b)
print("[+] check:", a * e1 + b * e2)   # 验证等式 a*e1 + b*e2 = g

# 如果不互素，标准共模攻击不能直接使用（需要后续处理，这里报错）
if g != 1:
    raise ValueError("e1 和 e2 不互素，不能直接使用标准共模攻击")

# 2. 共模攻击恢复明文：m = c1^a * c2^b mod n
m = pow_signed(c1, a, n) * pow_signed(c2, b, n) % n

# 3. 将大整数 m 转换为字节串
plaintext = long_to_bytes(m)

print("[+] m =", m)
print("[+] plaintext =", plaintext)

# 尝试以 UTF-8 解码
try:
    print("[+] decoded =", plaintext.decode())
except UnicodeDecodeError:
    print("[!] plaintext 不是标准 UTF-8")

Polybius（Polybius 方阵密码）

题目提示解码得到

1
The length of this plaintext: 14

密文长度是 28，根据提示说明密文应该是两个字符表示一个明文字母

密文只由 5 个元音组成，5 个符号，两两组合，可以表示

1
5 * 5 = 25

这正好对应经典的 Polybius 方阵密码

Polybius 方阵常用 5x5 表编码 25 个字母，一般把 i/j 合并

1
2
3
4
5
a b c d e
f g h i k
l m n o p
q r s t u
v w x y z

我们可以直接爆破 5 个元音的排列

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
import base64
import itertools

cipher = "ouauuuoooeeaaiaeauieuooeeiea"
hint = "VGhlIGxlbmd0aCBvZiB0aGlzIHBsYWludGV4dDogMTQ="

# 1. 解 hint
print("[+] hint:", base64.b64decode(hint).decode())

# 2. Polybius 字母表，i/j 合并
alphabet = "abcdefghiklmnopqrstuvwxyz"

# 3. 密文两两分组
pairs = [cipher[i:i + 2] for i in range(0, len(cipher), 2)]
print("[+] pairs:", pairs)

# 4. 爆破 5 个元音的坐标顺序
vowels = "aeiou"

for order in itertools.permutations(vowels):
    order = "".join(order)

    mp = {ch: idx for idx, ch in enumerate(order)}

    plaintext = ""

    for x, y in pairs:
        row = mp[x]
        col = mp[y]

        idx = row * 5 + col
        plaintext += alphabet[idx]

    # 根据 CTF 明文特征筛选
    if "flag" in plaintext or "polybius" in plaintext:
        print("[+] order:", order)
        print("[+] plaintext:", plaintext)
        print("[+] flag:", f"BJD{{{plaintext}}}")

编码与调制（曼彻斯特编码）

曼彻斯特编码的特点是每个原始 bit 会被编码成 2 个 bit，常见规则之一是

1
2
0 -> 01
1 -> 10

或者相反

1
2
0 -> 10
1 -> 01

先把十六进制密文转成二进制，再按照曼彻斯特规则还原得到

1
BJD{DifManchestercode}

rsa（共素数攻击）

题目源码

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
from Crypto.Util.number import getPrime,bytes_to_long

flag=open("flag","rb").read()

p=getPrime(1024)
q=getPrime(1024)
assert(e<100000)
n=p*q
m=bytes_to_long(flag)
c=pow(m,e,n)
print c,n
print pow(294,e,n)

p=getPrime(1024)
n=p*q
m=bytes_to_long("BJD"*32)
c=pow(m,e,n)
print c,n

输出里一共有四个重要值

1
2
3
4
5
6
7
8
第一组：
c1, n1

额外输出：
pow(294, e, n1)

第二组：
c2, n2

两组 RSA 生成过程

1
2
3
4
5
6
7
8
9
10
p = getPrime(1024)
q = getPrime(1024)
n = p * q
m = bytes_to_long(flag)
c = pow(m, e, n)

p = getPrime(1024)
n = p * q
m = bytes_to_long("BJD"*32)
c = pow(m,e,n)

两个模数共用了同一个素数 q

1
2
3
n_1 = p_1 * q

n_2 = p_2 * q

那么直接计算 gcd(n_1, n_2) 就能得到 q

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
#!/usr/bin/env python3
from math import gcd
from Crypto.Util.number import long_to_bytes

e = 52361

c1 = 12641635617803746150332232646354596292707861480200207537199141183624438303757120570096741248020236666965755798009656547738616399025300123043766255518596149348930444599820675230046423373053051631932557230849083426859490183732303751744004874183062594856870318614289991675980063548316499486908923209627563871554875612702079100567018698992935818206109087568166097392314105717555482926141030505639571708876213167112187962584484065321545727594135175369233925922507794999607323536976824183162923385005669930403448853465141405846835919842908469787547341752365471892495204307644586161393228776042015534147913888338316244169120

n1 = 13508774104460209743306714034546704137247627344981133461801953479736017021401725818808462898375994767375627749494839671944543822403059978073813122441407612530658168942987820256786583006947001711749230193542370570950705530167921702835627122401475251039000775017381633900222474727396823708695063136246115652622259769634591309421761269548260984426148824641285010730983215377509255011298737827621611158032976420011662547854515610597955628898073569684158225678333474543920326532893446849808112837476684390030976472053905069855522297850688026960701186543428139843783907624317274796926248829543413464754127208843070331063037

hint_value = 381631268825806469518166370387352035475775677163615730759454343913563615970881967332407709901235637718936184198930226303761876517101208677107311006065728014220477966000620964056616058676999878976943319063836649085085377577273214792371548775204594097887078898598463892440141577974544939268247818937936607013100808169758675042264568547764031628431414727922168580998494695800403043312406643527637667466318473669542326169218665366423043579003388486634167642663495896607282155808331902351188500197960905672207046579647052764579411814305689137519860880916467272056778641442758940135016400808740387144508156358067955215018

c2 = 979153370552535153498477459720877329811204688208387543826122582132404214848454954722487086658061408795223805022202997613522014736983452121073860054851302343517756732701026667062765906277626879215457936330799698812755973057557620930172778859116538571207100424990838508255127616637334499680058645411786925302368790414768248611809358160197554369255458675450109457987698749584630551177577492043403656419968285163536823819817573531356497236154342689914525321673807925458651854768512396355389740863270148775362744448115581639629326362342160548500035000156097215446881251055505465713854173913142040976382500435185442521721

n2 = 12806210903061368369054309575159360374022344774547459345216907128193957592938071815865954073287532545947370671838372144806539753829484356064919357285623305209600680570975224639214396805124350862772159272362778768036844634760917612708721787320159318432456050806227784435091161119982613987303255995543165395426658059462110056431392517548717447898084915167661172362984251201688639469652283452307712821398857016487590794996544468826705600332208535201443322267298747117528882985955375246424812616478327182399461709978893464093245135530135430007842223389360212803439850867615121148050034887767584693608776323252233254261047


# 如果没有 hint，可以用这个值爆破 e
assert pow(294, e, n1) == hint_value

# 两个模数共用了 q
q = gcd(n1, n2)

print("[+] gcd(n1, n2) =", q)
print("[+] q bit length =", q.bit_length())

assert q != 1
assert n1 % q == 0
assert n2 % q == 0

p1 = n1 // q

phi1 = (p1 - 1) * (q - 1)

# 检查 e 和 phi(n) 互素
assert gcd(e, phi1) == 1

# Python 3.8+ 可直接 pow(e, -1, phi1)
d = pow(e, -1, phi1)

m = pow(c1, d, n1)

flag = long_to_bytes(m)

print("[+] flag =", flag)

base??（Base64 换表）

解题思路：

  • 建立题目字符表 custom

  • 建立标准 Base64 字符表 standard

  • 对密文中每个字符 ch：

    • 找到 ch 在 custom 表中的索引 i

    • 替换成 standard[i]

  • 得到正常 Base64 字符串

  • base64 解码

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
import base64

custom_dict = {
    0: 'J', 1: 'K', 2: 'L', 3: 'M', 4: 'N', 5: 'O',
    6: 'x', 7: 'y', 8: 'U', 9: 'V', 10: 'z',
    11: 'A', 12: 'B', 13: 'C', 14: 'D', 15: 'E',
    16: 'F', 17: 'G', 18: 'H', 19: '7', 20: '8',
    21: '9', 22: 'P', 23: 'Q', 24: 'I', 25: 'a',
    26: 'b', 27: 'c', 28: 'd', 29: 'e', 30: 'f',
    31: 'g', 32: 'h', 33: 'i', 34: 'j', 35: 'k',
    36: 'l', 37: 'm', 38: 'W', 39: 'X', 40: 'Y',
    41: 'Z', 42: '0', 43: '1', 44: '2', 45: '3',
    46: '4', 47: '5', 48: '6', 49: 'R', 50: 'S',
    51: 'T', 52: 'n', 53: 'o', 54: 'p', 55: 'q',
    56: 'r', 57: 's', 58: 't', 59: 'u', 60: 'v',
    61: 'w', 62: '+', 63: '/', 64: '='
}

ciphertext = "FlZNfnF6Qol6e9w17WwQQoGYBQCgIkGTa9w3IQKw"

standard_table = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/="

# 建立映射：题目表字符 -> 标准 Base64 字符
trans_table = str.maketrans({
    custom_dict[i]: standard_table[i]
    for i in range(65)
})

# 换回标准 Base64
standard_b64 = ciphertext.translate(trans_table)

print("[+] standard base64:", standard_b64)

flag = base64.b64decode(standard_b64)

print("[+] flag:", flag.decode())

Reverse

JustRe（签到）

反编译就能拿到 flag