from Crypto.Util.number import *
x = 709088550902439876921359662969011490817828244100611994507393920171782905026859712405088781429996152122943882490614543229print(long_to_bytes(x))
enc = "HLIM{OCLSAQCZASPYFZASRILLCVMC}"
test = "FLAG"
ans = []
for i inrange(len(test)):
temp = []
for a inrange(26):
for b inrange(26):
t = encrypt(test[i],a,b)
if t == enc[i]:
temp.append([a,b])
ans.append(temp)
for i inrange(len(ans[0])):
#ans[0][i]が他にもあるか探索
check = Truefor j inrange(1,len(ans)):
ch = Falsefor k inrange(len(ans[j])):
if ans[0][i] == ans[j][k]:
ch = Truebreakifnot ch:
check = Falsebreakif check:
print(ans[0][i])
defdecrypt(ct,a,b):
pt = ""for x in ct:
iford("A") <= ord(x) <= ord("Z"):
x = ord(x) - ord("A")
for i inrange(26):
if x == (a*i+b)%26:
x = chr(i + ord("A"))
pt += x
breakelse: pt += x
return pt
from Crypto.Util.number import *
import gmpy2
import math
N = (省略)
M = (省略)
e = 65537
c = (省略)
n = 2*N
ro, check = gmpy2.iroot(M*M-4*n,2)
assert check
q = (M-ro)//2assert math.gcd(N,q) != 1
p = N//q
phi = (p-1)*(q-1)
d = inverse(e,phi)
m = pow(c,d,N)
print(long_to_bytes(m))
ではまず暗号化について。n = p×p×qとしgp-1 mod p2 != 1であるgを選び、h=gn mod nとした(n,g,h)が公開鍵となります。plaintextをmとすると暗号文cは、c=(gm mod n × hr mod n) mod nとなります(r : 乱数)。hの条件より上記の式は
c = (gm mod n × (gn)r mod n) = gm+n×r mod n ・・・①
となります。
次に復号について。なぜserver.pyのコードで復号できるのでしょうか。
a = ( (cp-1 mod p2) - 1) // p ・・・②
b = ( (gp-1 mod p2) - 1) // p ・・・③
m = a × b-1 mod p ・・・④
まず、フェルマーの小定理 ( xp-1 mod p = 1) を使います。cp-1 = k'×p+1 (k' : 整数)となるので、k' != pである限り、②より(cp-1 mod p2) = k'×p+1となり、a=k'となります。同様に、gp-1 = k×p+1 (k : 整数)となるので、b=kとなります。ここで④より、k'/k = mとなります。故に、k'=k×mと置くことが出来ます。
k×m = ( (cp-1 mod p2) - 1) // p
k×m×p+1 = cp-1 mod p2 ・・・⑤
では、これを使ってどのようにmを求めればいいのでしょうか。ここまで長い証明を読んで下さった方には申し訳ないですが、答えはあっさりです。
a = ( (cp-1 mod p2) - 1) // p = k×mとなるのに対しa' = 2×k×mとなるa'があれば、
a'×b-1 mod p2= 2×m mod p2となり、復号結果がflagと異なるので復号後その値をサーバが教えてくれるはずです。2×m < p となるのは希望的観測です。このくらいは耐えるだろう。
c = gm+n×r mod n より、c2 mod n = (gm+n×r mod n) × (gm+n×r mod n) = g2×(m+n×r) mod n
c' = c2 mod nとして復号してもらうと、
a = ( (c'^(p-1) mod p2) - 1) // p = ( (g2×(m+n×r) )p-1 mod p2 - 1) // p = (g2×m×(p-1) mod p2 - 1) // p
b = ( (gp-1 mod p2) - 1) // p
gp-1 = k×p+1 (k : 整数) より、
b = ( ( k×p+1 mod p2) - 1) // p = (k×p) // p = k
a = (g2×m×(p-1) mod p2 - 1) // p = ( (k×p+1)2×m mod p2 - 1) // p = (先程のパスカルの三角形より) ( ( 2×m×k×p+1 ) - 1) // p = 2×m×k
よって、a×b-1 mod p = 2×m×k×k-1 = 2×m となり、a'×b-1 mod p2= 2×m mod p2が成り立つa'をサーバに計算させることが出来ました。
長ったらしい証明をしましたが、公開鍵とcを受け取ってc2 mod nを計算して復号させ、得られた平文の値を2で割ってlong_to_bytes()するだけです。solverは結構短めです。
HOST, PORT = "oucs.cry.wanictf.org", 50010
s, f = sock(HOST, PORT)
for _ inrange(10): read_until(f)
for _ inrange(7): read_until(f)
read_until(f,"> ")
s.send(b"1\n")
recv_m = read_until(f).split()
c = int(recv_m[-1][2:],16)
for _ inrange(8): read_until(f)
read_until(f,"> ")
s.send(b"4\n")
recv_m = read_until(f).split()
n = int(recv_m[-1][2:],16)
recv_m = read_until(f).split()
g = int(recv_m[-1][2:],16)
for _ inrange(9): read_until(f)
c2 = pow(c,2,n)
read_until(f,"> ")
s.send(b"3\n")
read_until(f)
read_until(f,"> ")
s.send(str(c2).encode()+b"\n")
recv_m = read_until(f).split()
m2 = int(recv_m[-1][2:],16)
print(long_to_bytes(m2//2))
$ file open_me
open_me: Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 932, Author: v, Template: Normal.dotm, Last Saved By: v, Revision Number: 1, Name of Creating Application: Microsoft Office Word, Total Editing Time: 28:00, Create Time/Date: Mon Oct 12 04:27:00 2015, Last Saved Time/Date: Mon Oct 12 04:55:00 2015, Number of Pages: 1, Number of Words: 3, Number of Characters: 23, Security: 0
$ exiftool river.jpg
ExifTool Version Number : 10.80
File Name : river.jpg
(省略)
GPS Latitude : 31 deg 35' 2.76" N
GPS Longitude : 130 deg 32' 51.73" E
GPS Position : 31 deg 35' 2.76" N, 130 deg 32' 51.73" E
(省略)
a = [15,1,93,52,66,31,87,0,42,77,46,24,99,10,19,36,27,4,58,76,2,81,50,102,33,94,20,14,80,82,49,41,12,143,121,7,111,100,60,55,108,34,150,103,109,130,25,54,57,159,136,110,3,167,119,72,18,151,105,171,160,144,85,201,193,188,190,146,210,211,63,207]
b = sorted(a,reverse=True)
flag = "cpaw{"for i in b:
flag += str(i)
print(flag+"}")
We've been tracking drug dealers for a few years. The only thing we got from their network is a hash : bfa8b1c8b7f6acc867d6984968756cafd0da99060aa6d90dfb0db1a9ef0c96a2
Can you tell us where the money is gone?
from os import urandom
from random import randint
from pwn import xor
from Crypto.Util.number import *
outpout_img = open("flag.png.enc", "rb").read()
head = 0x89504E470D0A1A0A
k = long_to_bytes(bytes_to_long(outpout_img[:8])^head)
img0 =open("flag0.png", "wb")
img1 =open("flag1.png", "wb")
img2 =open("flag2.png", "wb")
img3 =open("flag3.png", "wb")
img4 =open("flag4.png", "wb")
img5 =open("flag5.png", "wb")
img6 =open("flag6.png", "wb")
img7 =open("flag7.png", "wb")
img8 =open("flag8.png", "wb")
img9 =open("flag9.png", "wb")
key0 = k + bytes([0])
key1 = k + bytes([1])
key2 = k + bytes([2])
key3 = k + bytes([3])
key4 = k + bytes([4])
key5 = k + bytes([5])
key6 = k + bytes([6])
key7 = k + bytes([7])
key8 = k + bytes([8])
key9 = k + bytes([9])
img0.write(xor(outpout_img, key0))
img1.write(xor(outpout_img, key1))
img2.write(xor(outpout_img, key2))
img3.write(xor(outpout_img, key3))
img4.write(xor(outpout_img, key4))
img5.write(xor(outpout_img, key5))
img6.write(xor(outpout_img, key6))
img7.write(xor(outpout_img, key7))
img8.write(xor(outpout_img, key8))
img9.write(xor(outpout_img, key9))
9でした
もっと綺麗なsolverはあるはず
Hero{123_xor_321}
ExtractMyBlocks 125 pt
The company PasswordS3cure created a new password reset functionality. Could you crack it and find the flag ?
nc chall0.heroctf.fr 10000
ファイル：challenge.py
candi = "ABCDEFGHJIKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz01234567890{}_"
FLAG = "Hero{test_flag}"#簡易的なflag。途中msgを出力している際に入力として送る文字列が正しい長さ確認する
flag = "Hero{"
isbreak = False#終了条件#tempをシフトさせていって1文字ずつbrute forceしていく
temp = "assword : Hero{"
k = len(" !\n\nYour p") #paddingする際の長さprint(k)
L = 16#paddingで送る長さ調整。k=16になった時は32にする。
M = 3#暗号化されたflagが何blockにあたるかwhileTrue:
printmsg = Trueprint("k :",k)
for i in candi:
print(i)
HOST, PORT = "chall0.heroctf.fr", 10000
s, f = sock(HOST, PORT)
_ = read_until(f)
read_until(f,"ID : ")
account_id = "12" + temp + i + "0"*(L-k)
_msg = f"""Welcome back {account_id} !Your password : {FLAG}Regards"""#送る入力が正しいものになっているか。特に長さの確認if printmsg:
for j inrange(0,len(_msg),16):
print(j//16,_msg[j:j+16])
msg = "12" + temp + i + "0"*(L-k)
s.send(msg.encode()+b"\n")
ct = read_until(f).strip()
assertlen(ct)%32 == 0
cip = []
for j inrange(0,len(ct),32):
cip.append(ct[j:j+32])
if cip[1] == cip[M]:
print(i)
s.close()
flag += i
if i == "}":
print("This is the flag!")
print(flag)
isbreak = Truebreakprint(flag)
temp = temp[1:] + i
k += 1if k == 16:
L += 16
M += 1break
s.close()
printmsg = Falseif isbreak: break
Hero{_BL0CK5_}
Forensics
We need you 1/5 50pt
Interpol and the FBI have been investigating for over a year now. They are trying to get their hands on two hackers very well known for their ransomware and their ultra efficient botnet.
After long months of investigation, they managed to get their hands on one of their servers. But, when they got it back the PC caught fire because of a defense mechanism set up by the two hackers.
The hard drive could not be saved, but they had time to put the RAM in liquid nitrogen and analyze it later.
You know what you have to do!
For this first step, find the name of the PC!
Download, here.
Format: Hero{Name}
ファイル：Challenge.zip
$ volatility -f capture.mem --profile=Win7SP1x86 netscan
Volatility Foundation Volatility Framework 2.6
Offset(P) Proto Local Address Foreign Address State Pid Owner Created
(省略)
0x7ee41538 TCPv4 10.0.2.15:49159 146.59.156.82:4444 ESTABLISHED 3296 nc.exe
(省略)
from Crypto.Util.number import *
f = open("output.txt")
a = f.readlines()
ans = ""for i in a:
if i.strip() == "PING": ans += "1"else: ans += "0"for i inrange(0,len(ans),8):
print(chr(int(ans[i:i+8],2)),end="")
print()
Hero{p1n6_p0n6_15_fun}
PRo Random Guesser 50pt
Everybody loves a little guessing challenge right ? Guess the number \o/
- Love, Mersenne
/!\ If you are using a script, you have to append '\n' to any data you wish to send back.
Host : chall0.heroctf.fr Port : 7003
defuntemper(x):
x = unBitshiftRightXor(x, 18)
x = unBitshiftLeftXor(x, 15, 0xefc60000)
x = unBitshiftLeftXor(x, 7, 0x9d2c5680)
x = unBitshiftRightXor(x, 11)
return x
defunBitshiftRightXor(x, shift):
i = 1
y = x
while i * shift < 32:
z = y >> shift
y = x ^ z
i += 1return y
defunBitshiftLeftXor(x, shift, mask):
i = 1
y = x
while i * shift < 32:
z = y << shift
y = x ^ (z & mask)
i += 1return y
HOST, PORT = "chall0.heroctf.fr", 7003
s, f = sock(HOST, PORT)
print(read_until(f))
print(read_until(f))
print(read_until(f))
x = []
for i inrange(624):
print(i)
read_until(f,"Guess me : ")
s.send(b"1337\n")
recv_m = read_until(f).split()
x.append(int(recv_m[3]))
read_until(f)
mt_state = tuple([untemper(z) for z in x] + [624])
random.setstate((3, mt_state, None))
ans = int(random.getrandbits(32))
s.send(str(ans).encode()+b"\n")
whileTrue: print(read_until(f))
Hero{n0t_s0_r4nd0m_4ft3r_4ll}
Reverse
EasyAssembly 40pt
Don't worry, this one is quite easy :) Could be a good introduction to assembly !
Format : Hero{input:modified}
ファイル：EasyAssembly.asm
A certain abbot tried to give us a message...
(the message is in lower case) (No need to speak French)
Format : Hero{messageinlowercase}
ファイル：HolyAbbot.txt
steganoって全部画像ファイルの解析と思ってたらテキストでびっくり。
しかもテキストの先頭行をググったら一発。RITSEC CTFでもやった、Ave Maria cipherのフランス語バージョンでした。Steganoというよりcryptoじゃん。
The Ministry of Galactic Defense now accepts human applicants for their specialised warrior unit, in exchange for their debt to be erased. We do not want to subject our people to this training and to be used as pawns in their little games. We need you to answer 500 of their questions to pass their test and take them down from the inside.
This challenge will raise 33 euros for a good cause.
Aliens are trying to cause great misery for the human race by using our own cryptographic technology to encrypt all our games.
Fortunately, the aliens haven't played CryptoHack so they're making several noob mistakes. Therefore they've given us a chance to recover our games and find their flags.
They've tried to scramble data on an N64 but don't seem to understand that encoding and ASCII art are not valid types of encryption!
This challenge will raise 33 euros for a good cause.
ファイル：output.txt
The aliens are trying to build a secure cipher to encrypt all our games called "PhaseStream". They've heard that stream ciphers are pretty good. The aliens have learned of the XOR operation which is used to encrypt a plaintext with a key. They believe that XOR using a repeated 5-byte key is enough to build a strong stream cipher. Such silly aliens! Here's a flag they encrypted this way earlier. Can you decrypt it (hint: what's the flag format?)
2e313f2702184c5a0b1e321205550e03261b094d5c171f56011904
This challenge will raise 33 euros for a good cause.
The aliens have learned of a new concept called "security by obscurity". Fortunately for us they think it is a great idea and not a description of a common mistake. We've intercepted some alien comms and think they are XORing flags with a single-byte key and hiding the result inside 9999 lines of random data, Can you find the flag?
This challenge will raise 33 euros for a good cause.
ファイル：output.txt
The aliens have learned the stupidity of their misunderstanding of Kerckhoffs's principle. Now they're going to use a well-known stream cipher (AES in CTR mode) with a strong key. And they'll happily give us poor humans the source because they're so confident it's secure!
This challenge will raise 33 euros for a good cause.
ファイル：phasestream3.py, output.txt
from Crypto.Util.number import *
test_enc = "464851522838603926f4422a4ca6d81b02f351b454e6f968a324fcc77da30cf979eec57c8675de3bb92f6c21730607066226780a8d4539fcf67f9f5589d150a6c7867140b5a63de2971dc209f480c270882194f288167ed910b64cf627ea6392456fa1b648afd0b239b59652baedc595d4f87634cf7ec4262f8c9581d7f56dc6f836cfe696518ce434ef4616431d4d1b361c"
flag_enc = "4b6f25623a2d3b3833a8405557e7e83257d360a054c2ea"
test = b"No right of private conversation was enumerated in the Constitution. I don't suppose it occurred to anyone at the time that it could be prevented."#test=平文と、test_enc=暗号文の組み合わせが分かるのでenc(key) xor test = test_encからenc(key)を求める
enc_key = long_to_bytes(bytes_to_long(test)^int(test_enc,16))
#flag長が46//2 = 23ということが分かる。enc(key)の上位23bytesとxorさせればOKprint(long_to_bytes(bytes_to_long(enc_key[:23])^int(flag_enc,16)))
CHTB{r3u53d_k3Y_4TT4cK}
PhaseStream4 300pt ★★
The aliens saw us break PhaseStream 3 and have proposed a quick fix to protect their new cipher.
This challenge will raise 43 euros for a good cause.
ファイル：phasestream4.py, output.txt
Aliens heard of this cool newer language called Rust, and hoped the safety it offers could be used to improve their stream cipher.
This challenge will raise 33 euros for a good cause.
ファイル：main.rs, out.txt
Aliens realised that hard-coded values are bad, so added a little bit of entropy.
This challenge will raise 43 euros for a good cause.
ファイル：main.js, out.txt
import sys
from Crypto.Util.number import *
from Crypto.PublicKey import RSA
from Crypto.Cipher import PKCS1_OAEP
n = (省略)
x = (省略)
M = 2048
binn = str(bin(n))[2:]
binx = str(bin(x))[2:]
binx = "0" + binx
sys.setrecursionlimit(3000)
defrecur(tp,tq):
#再帰でpを求める。tp,tqはp,qの候補の値#求めたらpを返し、現在のtp,tqでは求められないのであればFalseを返す
bits = len(tp)
if bits == M:
#tpが2048bitsになった場合
p = int(tp,2)
if n%p == 0:
print("Find!")
print(p)
return p
#nで割った余りが0でないから、tpはpではないreturnFalse
tn = int(tp,2)*int(tq,2)
ifstr(bin(tn))[-bits:] != binn[-bits:]:
#tp,tqの積の下位x bits (xはtpの長さ。変数bitsと同義)がnの下位x bitsと異なるのであれば、tp,tqはp,qの候補値から外れる。returnFalse#xの値より、tp,tqに追加すべき候補は２通りに絞られるif binx[-(bits+1)] == "1":
p = recur("1"+tp,"0"+tq)
if p: return p
p = recur("0"+tp,"1"+tq)
if p: return p
else:
p = recur("1"+tp,"1"+tq)
if p: return p
p = recur("0"+tp,"0"+tq)
if p: return p
returnFalse
p = recur("11","01")
q = n//p
e = 65537
phi = (p-1)*(q-1)
d = inverse(e,phi)
f = open("./dist/flag.enc","rb")
a = f.readlines()
key = RSA.construct((n,e,d,p,q))
cipher = PKCS1_OAEP.new(key)
ciphertext = a[0] + a[1][:-1] #最後の改行が入ると悪さをするのでそれを抜く
flag = cipher.decrypt(ciphertext)
print(flag)
ここからは、解けたチームメイトによるお話なのですが、Trithemius ave maria cipherとは平文一文字に対して英単語一つ生成するようです。cipher.txtの先頭行だけdcodeに投げるとRSだけ返されます。そこから、case sensitiveから対応する単語の頭文字が大文字なら平文を大文字に、そうでないなら小文字にと変えたら通ったようです。
Do you know how to move between directories and read files in the shell? Start the container, `ssh` to it, and then `ls` once connected to begin. Login via `ssh` as `ctf-player` with the password, `ee388b88`
I must have been sleep hacking or something, I don't remember visiting all of these sites... http://mercury.picoctf.net:52731/ (try a couple different browsers if it's not working right)
What happens if you have a small exponent? There is a twist though, we padded the plaintext so that (M ** e) is just barely larger than N. Let's decrypt this:
Oracles can be your best friend, they will decrypt anything, except the flag's ciphertext. How will you break it? Connect with nc mercury.picoctf.net 28517.
Hint : What can you do with a different pair of ciphertext and plaintext? What if it is not so different after all...
Hmmm I wonder if you have learned your lesson... Let's see if you understand RSA and how the encryption works. Connect with nc mercury.picoctf.net 6276.
Hint1 : Look at the ciphertext, anything fishy, maybe a little bit long?
Hint2 : What happens if you encrypt the same input multiple times?
Hint3 : Is RSA deterministic, why would outputs vary?
I will encrypt whatever you give me: 1 Here you go: 13124115897409148690175503414678311002550072264931973692606617424840875394178924924667165806108832225382916928826588194202873207482242336795957858653898547865981328797617704615680916248306354749186650700653148182638263380446877489886302315539251194333627159551808654634412960860616807864577972598755285353671 I will encrypt whatever you give me: 2 Here you go: 101313714858161761634424992049701340225225901427102268968811128642939843971178700310220868193986270827880834443468869250035948793946978960836348254108084878497428993736369171344812715172293673578722333182457607039902800607183698449846158886607662435088015414390779614690393026603998035663690508448583587232108 I will encrypt whatever you give me: 12 Here you go: 1312411589740914869017550341467831100255007226493197369260661742484087539417892492466716580610883222538291692882658819420287320748224233679595785865389854786598132879761770461568091624830635474918665070065314818263826338044687748988630231553925119433362715955180865463441296086061680786457797259875528535367153230702539676627077713255043960931601547634062672474402191718157569789042884730190065962186209672390181875607152200181525682605899965673289841280220588582699750835635714680926113598794384506889798456369904349419599058763732276368570777636231103073162515084138617288828974174983151895993498712348576936738885 I will encrypt whatever you give me: 123 Here you go: 462421867967343899092247904339366104356633194458564599507361558221364994129967069812583568887596621514840256516950454547665458461766413255685426477319761146914988512715132189205891743864191787311225979337320579909727351783274773056270868986792549936307841261246031472338304220554727128192453579090999110003105323070253967662707771325504396093160154763406267247440219171815756978904288473019006596218620967239018187560715220018152568260589996567328984128022058858269975083563571468092611359879438450688979845636990434941959905876373227636857077763623110307316251508413861728882897417498315189599349871234857693673888513124115897409148690175503414678311002550072264931973692606617424840875394178924924667165806108832225382916928826588194202873207482242336795957858653898547865981328797617704615680916248306354749186650700653148182638263380446877489886302315539251194333627159551808654634412960860616807864577972598755285353671
picoCTFは簡単な問題や難しいけど誘導がそれなりにされている問題、普通に難しい問題と幅広く楽しかったです！ 何より解ける問題が多かったのは有難いですね。しかも得点がsolves数によって影響しない方式だったので、せっかく解いたのに得点が下がるなんてこともなくて精神的に嬉しい(笑) でもIt's Not My Fault 1を解けた時はもっと点数欲しかったなぁと…(笑)
