2024 NKCTF Misc Writeup

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43

import base64  
import libnum  
from Crypto.PublicKey import RSA  
from urllib.parse import unquote  
  
pubkey_str = """-----BEGIN PUBLIC KEY-----  
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCK/qv5P8ixWjoFI2rzF62tm6sDFnRsKsGhVSCuxQIxuehMWQLmv6TPxyTQPefIKufzfUFaca/YHkIVIC19ohmE5X738TtxGbOgiGef4bvd9sU6M42k8vMlCPJp1woDFDOFoBQpr4YzH4ZTR6Ps+HP8VEIJMG5uiLQOLxdKdxi41QIDAQAB  
-----END PUBLIC KEY-----  
"""  
  
prikey_str = """-----BEGIN PRIVATE KEY-----  
MIICdgIBADANBgkqhkiG9w0BAQEFAASCAmAwggJcAgEAAoGBAIr+q/k/yLFaOgUjavMXra2bqwMWdGwqwaFVIK7FAjG56ExZAua/pM/HJNA958gq5/N9QVpxr9geQhUgLX2iGYTlfvfxO3EZs6CIZ5/hu932xTozjaTy8yUI8mnXCgMUM4WgFCmvhjMfhlNHo+z4c/xUQgkwbm6ItA4vF0p3GLjVAgMBAAECgYBDsqawT5DAUOHRft6oZ+//jsJMTrOFu41ztrKkbPAUqCesh+4R1WXAjY4wnvY1WDCBN5CNLLIo4RPuli2R81HZ4OpZuiHv81sNMccauhrJrioDdbxhxbM7/jQ6M9YajwdNisL5zClXCOs1/y01+9vDiMDk0kX8hiIYlpPKDwjqQQJBAL6Y0fuoJng57GGhdwvN2c656tLDPj9GRi0sfeeMqavRTMz6/qea1LdAuzDhRoS2Wb8ArhOkYns0GMazzc1q428CQQC6sM9OiVR4EV/ewGnBnF+0p3alcYr//Gp1wZ6fKIrFJQpbHTzf27AhKgOJ1qB6A7P/mQS6JvYDPsgrVkPLRnX7AkEAr/xpfyXfB4nsUqWFR3f2UiRmx98RfdlEePeo9YFzNTvX3zkuo9GZ8e8qKNMJiwbYzT0yft59NGeBLQ/eynqUrwJAE6Nxy0Mq/Y5mVVpMRa+babeMBY9SHeeBk22QsBFlt6NT2Y3Tz4CeoH547NEFBJDLKIICO0rJ6kF6cQScERASbQJAZy088sVY6DJtGRLPuysv3NiyfEvikmczCEkDPex4shvFLddwNUlmhzml5pscIie44mBOJ0uX37y+co3q6UoRQg==  
-----END PRIVATE KEY-----  
"""  
  
pubkey = RSA.import_key(pubkey_str)  
prikey = RSA.import_key(prikey_str)  
n = pubkey.n  
  
  
def dec_replace(base64_str: str):  
    base64_str = base64_str.replace("e5Lg^FM5EQYe5!yF&62%V$UG*B*RfQeM", "/")  
    base64_str = base64_str.replace("n6&B8G6nE@2tt4UR6h3QBt*5&C&pVu8W", "+")  
    base64_str = base64_str.replace("JXWUDuLUgwRLKD9fD6&VY2aFeE&r@Ff2", "=")  
    return base64_str  
  
  
def decrypt(cipher_text):  
    # 使用公钥解密  
    plain_text = b""  
    cipher_text = base64.b64decode(dec_replace(cipher_text))  
    for i in range(0, len(cipher_text), 128):  
        part = cipher_text[i:i+128]  
        dec = libnum.n2s(pow(libnum.s2n(part), pubkey.e, n))  
        plain_text += dec  
    return plain_text.decode()  
  
  
if __name__ == '__main__':  
    cipher_text = input("请输入要解密的密文: ")  
    cipher_text = unquote(cipher_text)  
    decrypted_text = decrypt(cipher_text)  
    print("解密后的明文为:", decrypted_text)

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14

# 源码中的马赛克函数  
def mosaic_img(img, L, H, R, D):  
    w, h = R - L, D - H  
    a = [0, 0, 0]  
    cnt = 0  
    for x in range(w):  
        for y in range(h):  
            j = img.getpixel((L+x, H+y))  
            for ch in range(len(a)):  
                a[ch] += j[ch]  
            cnt += 1  
    b = [k//cnt for k in a]  
    mosaic = Image.new('RGB', (w, h), tuple(b))  
    img.paste(mosaic, (L, H, R, D))

1
2
3
4
5

{  
    "editor.fontFamily": "'Fira Code', Consolas, 'Comrier New', monospace",  
    "window.zoomLevel": 1,  
    "security.workspace.trust.untrustedFiles": "open"  
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78

from PIL import Image  
import hashlib  
import os  
  
  
def calculate_md5(filename):  
    # 计算文件的 MD5 值  
    hasher = hashlib.md5()  
    with open(filename, 'rb') as f:  
        for chunk in iter(lambda: f.read(4096), b""):  
            hasher.update(chunk)  
    return hasher.hexdigest()  
  
  
def get_pass():  
    res = ''  
    dict_images = os.listdir("table/")  
    for i in range(14):  
        pass_image_md5 = calculate_md5(f"pass/{i}.png")  
        for dict_image in dict_images:  
            dict_image_md5 = calculate_md5(f"table/{dict_image}")  
            if pass_image_md5 == dict_image_md5:  
                print(f"{i}.png 与 {dict_image} 相同")  
                res += chr(int((dict_image.split('.')[0])))  
    print("还原后的pass如下：")  
    print(res+'3')  
  
  
def crop_table():  
    table = "pass ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz01234567899"  
    # print(len(table))  
    img = Image.open("table.png")  
    width, height = img.size  
    # print(width, height)  
    cols = width // 30  
  
    if os.path.exists("table"):  
        print("[+] table目录已存在")  
        pass  
    else:  
        os.mkdir("table")  
        print("[+] out目录创建成功")  
  
    for col in range(5, cols-1):  
        left = col*30  
        upper = 0  
        right = left+30  
        lower = 60  
        cropped_img = img.crop((left, upper, right, lower))  
        cropped_img.save(f"table/{ord(table[col])}.png")  
        print(f"table/{ord(table[col])}.png保存成功")  
  
  
def crop_pass():  
    img = Image.open("pass.png")  
    width, height = img.size  
    cols = width // 30  
    if os.path.exists("pass"):  
        print("[+] pass目录已存在")  
        pass  
    else:  
        os.mkdir("pass")  
        print("[+] pass目录创建成功")  
  
    for col in range(5, cols-1):  
        left = col*30  
        upper = 0  
        right = left+30  
        lower = 60  
        cropped_img = img.crop((left, upper, right, lower))  
        cropped_img.save(f"pass/{col-5}.png")  
        print(f"pass/{col-5}.png保存成功")  
  
  
if __name__ == "__main__":  
    crop_table()  
    crop_pass()  
    get_pass()