埃特巴什码（Atbash Cipher）是一个系统：最后一个字母代表第一个字母，倒数第二个字母代表第二个字母。 在罗马字母表中，它是这样出现的： 常文：A B C D E F G H I J K L M N O P Q R S T U V W X Y Z 密文：Z Y X W V U T S R Q P O N M L K J I H G F E D C B A
def reverse_color(x): return 0 if x == 255 else 255
def reverse_row_colors(pixels, row, width, block_size=10): for x_block in range(width // block_size): x = x_block * block_size y = row * block_size for x_small in range(x, x + block_size): for y_small in range(y, y + block_size): pixel = pixels[x_small, y_small] pixels[x_small, y_small] = reverse_color(pixel)
def reverse_col_colors(pixels, col, height, block_size=10): for y_block in range(height // block_size): x = col * block_size y = y_block * block_size for x_small in range(x, x + block_size): for y_small in range(y, y + block_size): pixel = pixels[x_small, y_small] pixels[x_small, y_small] = reverse_color(pixel)
from PIL import Image from pyzbar.pyzbar import decode import random def reverse_color(x): return 0 if x == 255 else 255 def reverse_row_colors(pixels, row, width, block_size=10): for x_block in range(width // block_size): x = x_block * block_size y = row * block_size for x_small in range(x, x + block_size): for y_small in range(y, y + block_size): pixel = pixels[x_small, y_small] pixels[x_small, y_small] = reverse_color(pixel) def reverse_col_colors(pixels, col, height, block_size=10): for y_block in range(height // block_size): x = col * block_size y = y_block * block_size for x_small in range(x, x + block_size): for y_small in range(y, y + block_size): pixel = pixels[x_small, y_small] pixels[x_small, y_small] = reverse_color(pixel) def decode_qr_code(image_path): image = Image.open(image_path) decoded_objects = decode(image) if decoded_objects: return decoded_objects[0].data.decode('utf-8') else: return None original_img = Image.open("E:\\脚本合集\\赛题脚本\\xyctf\\ewm\\neww.png") width, height = original_img.size pixels = original_img.load() count = 0 while True: modified_img = original_img.copy() pixels_modified = modified_img.load() for _ in range(3): x = random.randint(0, 1) if x == 0: reverse_col_colors(pixels_modified, random.randint(0, height // 10 - 1), height) else: reverse_row_colors(pixels_modified, random.randint(0, width // 10 - 1), width) modified_img.save("E:\\脚本合集\\赛题脚本\\xyctf\\ewm\\modified.png") result = decode_qr_code("E:\\脚本合集\\赛题脚本\\xyctf\\ewm\\modified.png") if result: print("Found QR code in modified.png:", result) break count += 1 if count % 100 == 0: print("Tried", count, "modifications, no QR code found yet.")
A bunch of tired, anxious sweats rushing down evil monkeys and screaming fear. In the dark and in dark, medical mask of ogre princess, evil lips clap their hands skulls. The girl's couch was softly tearing, slightly frowned scream, scared screamer's shirt and footprints, staff member wearing bikini clothes, man no rolling eyes, old woman opening her hands. An open-hand baby bra in pairs of slippers, covering the cat's tears family with medical mask costumes. The one with the shirt his face and headscarf eyes closed whispers.
with open(input_dir, 'rb') as (f): blist = f.read() print(len(blist)) salt = blist[:16] key = hashlib.pbkdf2_hmac('sha1', password, salt, DEFAULT_ITER, KEY_SIZE) first = blist[16:DEFAULT_PAGESIZE] mac_salt = bytes([x ^ 58 for x in salt]) mac_key = hashlib.pbkdf2_hmac('sha1', key, mac_salt, 2, KEY_SIZE) hash_mac = hmac.new(mac_key, digestmod='sha1') hash_mac.update(first[:-32]) hash_mac.update(bytes(ctypes.c_int(1)))
if hash_mac.digest() == first[-32:-12]: print('Decryption Success') else: print('Password Error') blist = [blist[i:i + DEFAULT_PAGESIZE] for i in range(DEFAULT_PAGESIZE, len(blist), DEFAULT_PAGESIZE)]
with open(input_dir, 'wb') as (f): f.write(SQLITE_FILE_HEADER) t = AES.new(key, AES.MODE_CBC, first[-48:-32]) f.write(t.decrypt(first[:-48])) f.write(first[-48:]) for i in blist: t = AES.new(key, AES.MODE_CBC, i[-48:-32]) f.write(t.decrypt(i[:-48])) f.write(i[-48:])
import hashlib enc = 'key{liu' md5 = '87145027d8664fca1413e6a24ae2fbe7' for x in range(0,127): for y in range(0,127): for z in range(0,127): for k in range(0,127): temp1 = hashlib.md5(str(enc + chr(x) + chr(y) + chr(z) + chr(k) + "}").encode("utf-8")) temp2 = temp1.hexdigest() if(md5 == temp2): print(enc + chr(x) + chr(y) + chr(z) + chr(k) + "}")
from Crypto.Util.number import * import gmpy2 import sys # 导入sys模块 sys.setrecursionlimit(3000) # 将默认的递归深度修改为3000 n = 22424440693845876425615937206198156323192795003070970628372481545586519202571910046980039629473774728476050491743579624370862986329470409383215065075468386728605063051384392059021805296376762048386684738577913496611584935475550170449080780985441748228151762285167935803792462411864086270975057853459586240221348062704390114311522517740143545536818552136953678289681001385078524272694492488102171313792451138757064749512439313085491407348218882642272660890999334401392575446781843989380319126813905093532399127420355004498205266928383926087604741654126388033455359539622294050073378816939934733818043482668348065680837 seed = 14488395911544314494659792279988617621083872597458677678553917360723653686158125387612368501147137292689124338045780574752580504090309537035378931155582239359121394194060934595413606438219407712650089234943575201545638736710994468670843068909623985863559465903999731253771522724352015712347585155359405585892 #seed即p^q def findp(p, rp): l = len(p) if l == 1024: rp.append(int(p, 2)) else: pp = int(p, 2) qq = (seed ^ pp) % 2 ** l if pp * qq % 2 ** l == n % 2 ** l: findp('1' + p, rp) findp('0' + p, rp) rp = [] findp('1', rp) for i in rp: if n%i==0 & isPrime(int(i)): print(i) #145805499551351837545170670839798336872366414383311042018386386595288060139791135454980413014693924866953972662266748526407954492877610429602886244372924035960962307198910659475639333945895922717307291255423855616274924584270570126180050363106535962473049107576556315461013755859097114552522187755171423621071 #153796947048270429510444756458855481287460639468563001213489907625132438953570738468181770925091867439727519074685449940618659583114338501872698220745473531199063071421852521618805765627999106188015431567625318850899895052130157037822960945909520973243793507740817436707504505709194025074527084803054107605547 p=145805499551351837545170670839798336872366414383311042018386386595288060139791135454980413014693924866953972662266748526407954492877610429602886244372924035960962307198910659475639333945895922717307291255423855616274924584270570126180050363106535962473049107576556315461013755859097114552522187755171423621071 q=n//p c=1400352566791488780854702404852039753325619504473339742914805493533574607301173055448281490457563376553281260278100479121782031070315232001332230779334468566201536035181472803067591454149095220119515161298278124497692743905005479573688449824603383089039072209462765482969641079166139699160100136497464058040846052349544891194379290091798130028083276644655547583102199460785652743545251337786190066747533476942276409135056971294148569617631848420232571946187374514662386697268226357583074917784091311138900598559834589862248068547368710833454912188762107418000225680256109921244000920682515199518256094121217521229357 e=65537 phi = (p-1) * (q-1) d = gmpy2.invert(e, phi) m = pow(c, d, n) print(long_to_bytes(m))
运行得到
解压压缩包
no为0，yes为1，01画图，但需要知道坐标
010查看压缩包发现base编码
base64解码
随言随语解码
画图
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15
from PIL import Image MAX1 = 548 MAX2=72 pic = Image.new("RGB",(MAX1, MAX2)) str = "" i = 0 for y in range (0,MAX2): for x in range (0,MAX1): if(str[i] == '1'): pic.putpixel([x,y],(0, 0, 0)) else: pic.putpixel([x,y],(255,255,255)) i = i+1 pic.show() pic.save("flag.png")
from Crypto.Util.number import * from itertools import product from math import gcd import gmpy2 n = 107803636687595025440095910573280948384697923215825513033516157995095253288310988256293799364485832711216571624134612864784507225218094554935994320702026646158448403364145094359869184307003058983513345331145072159626461394056174457238947423145341933245269070758238088257304595154590196901297344034819899810707 c = 46049806990305232971805282370284531486321903483742293808967054648259532257631501152897799977808185874856877556594402112019213760718833619399554484154753952558768344177069029855164888168964855258336393700323750075374097545884636097653040887100646089615759824303775925046536172147174890161732423364823557122495 list = [618066045261118017236724048165995810304806699407382457834629201971935031874166645665428046346008581253113148818423751222038794950891638828062215121477677796219952174556774639587782398862778383552199558783726207179240239699423569318, 837886528803727830369459274997823880355524566513794765789322773791217165398250857696201246137309238047085760918029291423500746473773732826702098327609006678602561582473375349618889789179195207461163372699768855398243724052333950197] h1, h2 = list for a, b in product(range(2**8), repeat=2): q = gcd(a * h1 - b * h2, n) if q != 1 and q < n: print(q, n) break q = 12951283811821084332224320465045864899191924765916891677355364529850728204537369439910942929239876470054661306841056350863576815710640615409980095344446711 p = n // q e = 65537 d = pow(e, -1, (p - 1) * (q - 1)) m = pow(c, d, n) print(long_to_bytes(m))
