2020 CSICTF WriteUp

“csictf team” 是印度 VIT 大学（Vellore Institute of Technology）计算机学会（CSI）学生分部所运营的团队

Misc

Gradient sky（图片隐写）

查看字符串拿到 flag

strings sky.jpg

# csictf{j0ker_w4snt_happy}

unseen（通道隐写 + Steghide 隐写 + Whitespace）

对 nyc.png 做 LSB 位平面分析，红色通道第 0 位平面左上角能看到数字

解 morse.wav 的摩斯电码，得到

SEARCH-SOMEWHERE-ELSE

这个提示说明还要继续在音频里找隐藏内容。用图片得到的数字作为 steghide 密码

steghide extract -sf morse.wav -p 42845193

提取出 flag.txt。该文件表面上是空白，实际是 Whitespace 语言代码，解码后得到 flag

csictf{7h47_15_h0w_y0u_c4n_83c0m3_1nv151813}

Panda（ZIP 爆破）

爆破出密码是 2611，提取出两张图片

逐字节比较两张图拿到 flag

from pathlib import Path

panda = Path("panda.jpg").read_bytes()
panda1 = Path("panda1.jpg").read_bytes()

flag = ''.join(chr(b) for a, b in zip(panda, panda1) if a != b)
print(flag)

csictf{kung_fu_p4nd4}

Crypto

little RSA（分解 n）

题目给了

c=32949
n=64741
e=42667

分解 n 得到 p，q

from Crypto.Util.number import long_to_bytes

c = 32949
n = 64741
e = 42667
p = 101
q = 641

phi = (p - 1) * (q - 1)
d = pow(e, -1, phi)
m = pow(c, d, n)

print("[+] bytes =", long_to_bytes(m))

解出为 18429 解压密码

Rivest Shamir Adleman（分解 n）

和上题一样的方法

from math import isqrt

n = 408579146706567976063586763758203051093687666875502812646277701560732347095463873824829467529879836457478436098685606552992513164224712398195503564207485938278827523972139196070431397049700119503436522251010430918143933255323117421712000644324381094600257291929523792609421325002527067471808992410166917641057703562860663026873111322556414272297111644069436801401012920448661637616392792337964865050210799542881102709109912849797010633838067759525247734892916438373776477679080154595973530904808231
e = 65537
c = 226582271940094442087193050781730854272200420106419489092394544365159707306164351084355362938310978502945875712496307487367548451311593283589317511213656234433015906518135430048027246548193062845961541375898496150123721180020417232872212026782286711541777491477220762823620612241593367070405349675337889270277102235298455763273194540359004938828819546420083966793260159983751717798236019327334525608143172073795095665271013295322241504491351162010517033995871502259721412160906176911277416194406909

# 已知或爆破得到的小素因子
p = 15485863
q = n // p

assert p * q == n

phi = (p - 1) * (q - 1)

# 求私钥指数 d
d = pow(e, -1, phi)

# RSA 解密
m = pow(c, d, n)

# long -> bytes
msg = m.to_bytes((m.bit_length() + 7) // 8, "big")

print("[+] flag =", msg.decode())

Modern Clueless Child（XOR）

题目给的是

52f41f58f51f47f57f49f48f5df46f6ef53f43f57f6cf50f6df53f53f40f58f51f6ef42f56f43f41f5ef5cf4e

按 f 分割得到

52 41 58 51 47 57 49 48 5d 46 6e 53 43 57 6c 50 6d 53 53 40 58 51 6e 42 56 43 41 5e 5c 4e

转成 ASCII 得到一段密文

RAXQGWIH]FnSCWlPmSS@XQnBVCA^\N

将题目给的 Key 转为 ASCII 字符

'1' = 0x31
'2' = 0x32
'3' = 0x33

然后对密文循环进行 XOR

cipher_hex = "52f41f58f51f47f57f49f48f5df46f6ef53f43f57f6cf50f6df53f53f40f58f51f6ef42f56f43f41f5ef5cf4e"
key = "12123"

# 1. 按 f 分隔
parts = cipher_hex.split("f")

# 2. 每一段当成 hex 字节
cipher = bytes(int(x, 16) for x in parts)

# 3. 用 ASCII key 循环 XOR
plain = bytes(
    c ^ ord(key[i % len(key)])
    for i, c in enumerate(cipher)
)

print(plain.decode())

得到 csictf{you_are_a_basic_person}

Quick Math（低指数广播攻击）

from math import prod, gcd

# 给定的 RSA 模数与密文（已知 e=3 的广播攻击场景）
n1 = 86812553978993
n2 = 81744303091421
n3 = 83695120256591

c1 = 8875674977048
c2 = 70744354709710
c3 = 29146719498409

ns = [n1, n2, n3]
cs = [c1, c2, c3]

# 检查模数两两互素，确保 CRT 可行
for i in range(len(ns)):
    for j in range(i):
        print(gcd(ns[i], ns[j]))  # 输出应为 1

# ---------- 中国剩余定理 (CRT) ----------
N = prod(ns)  # 所有模数的乘积
x = 0

for c, n in zip(cs, ns):
    Ni = N // n                # 除当前模数外的其他模数乘积
    inv = pow(Ni, -1, n)      # 计算 Ni 在模 n 下的逆元（Python 3.8+ 支持）
    x += c * Ni * inv          # 累加加权值

x %= N  # 得到 x ≡ m^3 (mod N) 的最小非负解，且因为 m^3 < N，整数意义上 x = m^3

# 整数三次方根（二分查找，适用于大整数）
def iroot3(num):
    l, r = 0, num
    while l <= r:
        mid = (l + r) // 2
        v = mid ** 3
        if v == num:
            return mid
        elif v < num:
            l = mid + 1
        else:
            r = mid - 1
    return r  # 若未精确匹配，向下取整（这里必定精确匹配）

m = iroot3(x)  # 恢复出明文

print("m =", m)
print("check:", m ** 3 == x)  # 验证是否成功

Mein Kampf（Enigma M4 参数残缺恢复）

题目给的文件内容核心是

M4 UKW $ Gamma 2 4 $ 5 9 $ 14 3 $ 5 20 fv cd hu ik es op yl wq jm

Ciphertext: zkrtwvvvnrkulxhoywoj

题目描述说：

some data was corrupted during transmission

所以里面的 $ 就是传输损坏的字段，需要我们恢复

根据内容基本可以判断是德国 Enigma M4

M4          -> 四转子 Enigma
UKW $       -> 反射器未知
Gamma       -> 第 4 个薄转子，已知是 Gamma
2 4         -> Gamma 的初始位置 / ring setting
$ 5 9       -> 第 1 个普通转子未知
$ 14 3      -> 第 2 个普通转子未知
$ 5 20      -> 第 3 个普通转子未知
fv cd ...   -> plugboard 插线板

Enigma M4 的薄反射器一般是

UKW B
UKW C

普通转子可以从 I 到 VIII 里选 3 个，且顺序有影响

I II III IV V VI VII VIII

非常小，直接暴力破解即可

from itertools import permutations

ABC = "ABCDEFGHIJKLMNOPQRSTUVWXYZ"
A2I = {c: i for i, c in enumerate(ABC)}

# Enigma rotors
ROTORS = {
    "I":    ("EKMFLGDQVZNTOWYHXUSPAIBRCJ", "Q"),
    "II":   ("AJDKSIRUXBLHWTMCQGZNPYFVOE", "E"),
    "III":  ("BDFHJLCPRTXVZNYEIWGAKMUSQO", "V"),
    "IV":   ("ESOVPZJAYQUIRHXLNFTGKDCMWB", "J"),
    "V":    ("VZBRGITYUPSDNHLXAWMJQOFECK", "Z"),
    "VI":   ("JPGVOUMFYQBENHZRDKASXLICTW", "ZM"),
    "VII":  ("NZJHGRCXMYSWBOUFAIVLPEKQDT", "ZM"),
    "VIII": ("FKQHTLXOCBJSPDZRAMEWNIUYGV", "ZM"),

    # M4 thin rotors
    "Beta":  ("LEYJVCNIXWPBQMDRTAKZGFUHOS", ""),
    "Gamma": ("FSOKANUERHMBTIYCWLQPZXVGJD", ""),
}

# M4 thin reflectors
REFLECTORS = {
    "B": "ENKQAUYWJICOPBLMDXZVFTHRGS",
    "C": "RDOBJNTKVEHMLFCWZAXGYIPSUQ",
}

def to_nums(s):
    return [A2I[c] for c in s]

def inverse_wiring(wiring):
    inv = [0] * 26
    for i, c in enumerate(wiring):
        inv[A2I[c]] = i
    return inv

ROTOR_FWD = {name: to_nums(wiring) for name, (wiring, _) in ROTORS.items()}
ROTOR_REV = {name: inverse_wiring(wiring) for name, (wiring, _) in ROTORS.items()}
NOTCHES = {name: {A2I[c] for c in notch} for name, (_, notch) in ROTORS.items()}
REFLECTOR_MAP = {name: to_nums(wiring) for name, wiring in REFLECTORS.items()}

def build_plugboard(pairs):
    plug = list(range(26))
    for pair in pairs:
        a, b = A2I[pair[0]], A2I[pair[1]]
        plug[a], plug[b] = plug[b], plug[a]
    return plug

def step_rotors(names, pos):
    """
    names = [thin, left, middle, right]
    M4 的 thin rotor，也就是 Gamma/Beta，不参与转动。
    """
    left = names[1]
    middle = names[2]
    right = names[3]

    # double stepping
    if pos[2] in NOTCHES[middle]:
        pos[1] = (pos[1] + 1) % 26
        pos[2] = (pos[2] + 1) % 26
    elif pos[3] in NOTCHES[right]:
        pos[2] = (pos[2] + 1) % 26

    pos[3] = (pos[3] + 1) % 26

def pass_rotor_forward(c, rotor_name, ring, pos):
    offset = (pos - ring) % 26
    return (ROTOR_FWD[rotor_name][(c + offset) % 26] - offset) % 26

def pass_rotor_backward(c, rotor_name, ring, pos):
    offset = (pos - ring) % 26
    return (ROTOR_REV[rotor_name][(c + offset) % 26] - offset) % 26

def enigma_decrypt(ciphertext, reflector, rotor_names, rings, positions, plugboard):
    pos = positions[:]
    result = []

    for ch in ciphertext:
        if ch not in ABC:
            continue

        step_rotors(rotor_names, pos)

        c = A2I[ch]

        # plugboard in
        c = plugboard[c]

        # right -> left, including thin rotor
        for i in [3, 2, 1, 0]:
            c = pass_rotor_forward(c, rotor_names[i], rings[i], pos[i])

        # reflector
        c = REFLECTOR_MAP[reflector][c]

        # left -> right
        for i in [0, 1, 2, 3]:
            c = pass_rotor_backward(c, rotor_names[i], rings[i], pos[i])

        # plugboard out
        c = plugboard[c]

        result.append(ABC[c])

    return "".join(result)

ciphertext = "zkrtwvvvnrkulxhoywoj".upper()
plug_pairs = "fv cd hu ik es op yl wq jm".upper().split()
plugboard = build_plugboard(plug_pairs)

# 原题参数：
# M4 UKW $ Gamma 2 4 $ 5 9 $ 14 3 $ 5 20
#
# 这里的数字按 position / ring 理解：
# Gamma position=2 ring=4
# ?     position=5 ring=9
# ?     position=14 ring=3
# ?     position=5 ring=20

positions = [2 - 1, 5 - 1, 14 - 1, 5 - 1]
rings     = [4 - 1, 9 - 1, 3 - 1, 20 - 1]

normal_rotors = ["I", "II", "III", "IV", "V", "VI", "VII", "VIII"]

for reflector in ["B", "C"]:
    for r1, r2, r3 in permutations(normal_rotors, 3):
        rotor_names = ["Gamma", r1, r2, r3]

        plaintext = enigma_decrypt(
            ciphertext,
            reflector,
            rotor_names,
            rings,
            positions,
            plugboard
        )

        if plaintext.startswith("CSICTF"):
            print("[+] Found!")
            print("Reflector:", "UKW", reflector)
            print("Rotors:", rotor_names)
            print("Plaintext:", plaintext)

            msg = plaintext.replace("CSICTF", "")
            flag = "csictf{" + "_".join(
                [msg[:2].lower(), msg[2:6].lower(), msg[6:].lower()]
            ) + "}"

            print("Flag:", flag)

得到 flag：csictf{no_shit_sherlock}

The Climb（希尔密码）

theclimb.java 里核心逻辑是矩阵加密，这是典型的希尔密码

rmatrix[i] += kmatrix[i][j] * tmatrix[j];
rmatrix[i] %= 26;

源码里给了 key:gybnqkurp

长度是 9，所以是 3×3 矩阵

g y b
n q k
u r p

转换成数字，也就是 a=0, b=1, ..., z=25

K = [
  [6, 24, 1],
  [13, 16, 10],
  [20, 17, 15]
]

因为源码是加密程序，所以我们要反过来做解密

C = K × P mod 26
P = K^-1 × C mod 26

求出矩阵 K 在模 26 下的逆矩阵

K^-1 = [
  [8, 5, 10],
  [21, 8, 21],
  [21, 12, 8]
]

然后把密文每 3 个字符一组解密，解出来是

hillshaveeyesxx

最后的 xx 是源码里自动补齐分组长度时加的 padding

得到 flag

csictf{hillshaveeyes}

Reverse

Esrever（算法破解）

esrever.py 里有四个加密函数

enc1(text)      # 随机 Caesar 偏移
enc2(text,key)  # XOR
enc3(text)      # 字符位置置换
enc4(text)      # 字符位置置换

加密流程是

Encrypted Key  = enc4(enc4(encryptedKey))
Encrypted Text = enc3(enc3(enc2(enc1(encryptedText), key)))

所以解密时要完全倒过来

Encrypted Key  -> inv_enc4 -> inv_enc4 -> 爆破 enc1 得到 key
Encrypted Text -> inv_enc3 -> inv_enc3 -> inv_enc2 -> 爆破 enc1 得到 flag

from string import ascii_lowercase

encrypted_key = "ieluvnvfgvfahuxhvfphbppnbgrfcrn"

encrypted_text = ''.join(map(chr, [
    187, 183, 173, 170, 187, 163, 181, 177, 172, 165,
    188, 177, 186, 181, 177, 191, 183, 163, 166, 173,
    180, 175, 170, 168, 165, 171, 165, 166, 171, 180,
    184, 166, 161, 184, 162, 178, 167, 164, 166, 166,
    185, 168
]))

mapping3 = [
    28, 33, 6, 17, 7, 41, 27, 29, 31, 30, 39, 21,
    34, 15, 3, 5, 13, 10, 19, 38, 40, 14, 26, 25,
    32, 0, 36, 8, 18, 4, 1, 11, 24, 2, 37, 20,
    23, 35, 22, 12, 16, 9
]

mapping4 = [
    23, 9, 5, 6, 22, 28, 25, 30, 15, 8, 16, 19,
    24, 11, 10, 7, 2, 14, 18, 1, 29, 21, 12, 4,
    20, 0, 26, 13, 17, 3, 27
]

def inv_enc3(text):
    """
    enc3:
        temp[mapping[i]] = text[i]
    所以反过来：
        original[i] = cipher[mapping[i]]
    """
    temp = [""] * len(text)
    for i, m in enumerate(mapping3):
        temp[i] = text[m]
    return ''.join(temp)

def inv_enc4(text):
    """
    enc4:
        temp[i] = text[mapping[i]]
    所以反过来：
        original[mapping[i]] = cipher[i]
    """
    temp = [""] * len(text)
    for i, m in enumerate(mapping4):
        temp[m] = text[i]
    return ''.join(temp)

def inv_enc1(text, r):
    """
    enc1 是：
        ((ord(i) - ord('a') - r) % 26) + ord('a')
    反过来就是 +r。
    """
    return ''.join(chr((ord(c) - 97 + r) % 26 + 97) for c in text)

def inv_enc2(text, key):
    """
    注意源码里这一句：
        chr(ord(text[i]) ^ ord(k[i]) + ord('a'))

    Python 中 + 优先级高于 ^，
    所以实际是：
        ord(text[i]) ^ (ord(k[i]) + ord('a'))

    XOR 自反，所以解密再 XOR 一次即可。
    """
    out = []
    for i, c in enumerate(text):
        k = key[i % len(key)]
        out.append(chr(ord(c) ^ (ord(k) + ord('a'))))
    return ''.join(out)

# 1. 先还原 encryptedKey
key_stage = inv_enc4(inv_enc4(encrypted_key))
print("[+] key after inverse enc4:", key_stage)

# encryptedKey 本质是 enc1(key)，enc1 是 Caesar，爆破 1~25
possible_keys = []
for r in range(1, 26):
    key = inv_enc1(key_stage, r)
    possible_keys.append(key)

# 2. 先还原 encryptedText 的 enc3 两层
text_stage = inv_enc3(inv_enc3(encrypted_text))

# 3. 枚举 key，再反 XOR，再枚举 Caesar
for key in possible_keys:
    mid = inv_enc2(text_stage, key)

    # 反 XOR 后应该全是小写字母
    if not all(c in ascii_lowercase for c in mid):
        continue

    for r in range(26):
        candidate = inv_enc1(mid, r)

        # enc1 会把 { 和 } 也压成小写字母
        # 所以真实 csictf{...} 会变成类似 csictfa...c
        if candidate.startswith("csictfa") and candidate.endswith("c"):
            body = candidate[len("csictfa"):-1]
            flag = "csictf{" + body + "}"

            print("[+] key =", key)
            print("[+] raw candidate =", candidate)
            print("[+] flag =", flag)

因为 enc1 会把 { 和 } 也映射成小写字母

在对应 Caesar 偏移下

{ -> a
} -> c

所以得到 flag

csictfaesreverisjustreverseinreverserightc

csictf{esreverisjustreverseinreverseright}

pydis2ctf（Python 反汇编）

C1cipher.txt 里面核心反汇编是

LOAD_CONST               1 ('')
STORE_FAST               1 (ret_text)

FOR_ITER
STORE_FAST               2 (i)

LOAD_FAST                1 (ret_text)
LOAD_GLOBAL              2 (chr)
LOAD_CONST               2 (2)
LOAD_GLOBAL              3 (ord)
LOAD_FAST                2 (i)
CALL_FUNCTION            1
BINARY_MULTIPLY
LOAD_GLOBAL              4 (len)
LOAD_FAST                0 (text)
CALL_FUNCTION            1
BINARY_SUBTRACT
CALL_FUNCTION            1
INPLACE_ADD
STORE_FAST               1 (ret_text)

翻译成看的 Python 代码就是

def C1(text):
    ret_text = ""
    for i in list(text):
        counter = text.count(i)  # 这个变量其实没用
        ret_text += chr(2 * ord(i) - len(text))
    return ret_text

所以 C1 的加密公式是

cipher_char = chr(2 * ord(plain_char) - len(text))

反过来就是

plain_char = chr((ord(cipher_char) + len(text)) / 2)

C2cipher.txt 还原出来是

def C2(inpString):
    xorKey = "S"
    length = len(inpString)

    for i in range(length):
        inpString = (
            inpString[:i]
            + chr(ord(inpString[i]) ^ ord(xorKey))
            + inpString[i + 1:]
        )

    return inpString

也就是每个字符和 'S' 异或

但是实际解题时，对 encodedflag.txt 直接反 C1 就能得到 flag；C2 更像是干扰项

import ast

with open("encodedflag.txt", "r", encoding="utf-8") as f:
    data = f.read().strip()

cipher = ast.literal_eval(data)

n = len(cipher)

flag = ""
for c in cipher:
    v = ord(c) + n

    # 正常情况下 v 应该能被 2 整除
    if v % 2 != 0:
        print("[-] Invalid character:", repr(c))

    flag += chr(v // 2)

print(flag)

得到 flag：csictf{T#a+_wA5_g0oD_d155aSe^^bLy}