2020 BJD3rd

a = open('f14g.png','rb').read()f = a[::-1]b = open('flag.png','wb').write(f)

from PIL import Imagefrom pyzbar.pyzbar import decodeimport hashlibp1 = Image.open('11.png').convert('RGB')#第一种类型的图片p2 = Image.open('12.png').convert('RGB')#第二种类型的图片a,b = p1.sizedif = []for y in range(b):    for x in range(a):        if p1.getpixel((x,y))!=p2.getpixel((x,y)):            dif.append((x,y))mark = dif[0]p = Image.open('res.png').convert('RGB')#最大的一张图片aa,bb = p.sizedata = []for y in range(0,bb,50):    for x in range(0,aa,100):        if p.getpixel((x+mark[0],y+mark[1])) == p1.getpixel(mark):            data.append('1')        else:            data.append('0')B = Image.new('L',(10,10),255)W = Image.new('L',(10,10),0)np = Image.new('L',(290,290),0)for y in range(29):    for x in range(29):        if data[x+29*y] == '0':            np.paste(B,(10*x,10*y))        else:            np.paste(W,(10*x,10*y))np.save('r.png')pp = Image.open('r.png')barcodes = decode(pp)for barcode in barcodes:    barcodeData = barcode.data.decode("utf-8")    print(hashlib.md5(barcodeData.encode()).hexdigest())

a = '🌷👱🌠🌴👷🎆🍀👼🎉🍇👰🎍🍋💁🎑🍏🚶🎁🍓💑🏀🍄💪🎳🍗👆😶🚘🐀😮🚜🐻😴⚓🐔😝🚢🐥😕🚟🐊😞🚥🐉😭🚽🐟😩⌛🐚😳☀😜😀🚆🐈😄🚊🐴😊🚌🐾🐂🐪🚏🐗😚🌹🚓🐁😑🚗👩😥'b = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890!@#$%^&*()_+'ss = '🐀🐾🌴🚜🍋🐊🍇🐂🍓🎑🐈🐟💁🚟🍗'print(ss.translate(str.maketrans(a,b)))

import requestshost = ' http://127.0.0.1'for i in range(2000,2500):    add = host+':'+str(i)    try:        s = requests.get(add)        print(i)        print(s.text)        exit(1)    except:        print(i)        pass

import base64def get_base64_diff_value(s1,s2):    table = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/'    res = 0    for i in range(len(s1)):        if s1[i] != s2[i]:            return abs(table.index(s1[i]) - table.index(s2[i]))    return resdef solve():    lines = open('stego.txt','r').readlines()    bin_str = ''    for line in lines:        steg_line = line.replace('\n','')        # print(steg_line)        norm_line = base64.b64encode(base64.b64decode(steg_line)).decode()        # print(norm_line)        diff = get_base64_diff_value(steg_line,norm_line)        # print(diff)        pad_num = steg_line.count('=')        if diff:            bin_str += bin(diff)[2:].zfill(pad_num*2)        else:            bin_str += '0' * pad_num * 2    print(bin_str)    res_str = ''    for j in range(int(len(bin_str)/8)):        # print(8*j,(j+1)*8)        res_str+=chr(int(bin_str[8*j:(j+1)*8],2))    print(res_str[-52:])    print(base64.b64decode(res_str[-52:]))solve()

# -*- coding:utf-8 -*-import A,SALTfrom itertools import *def encrypt(m, a, si):    c=""    for i in range(len(m)):        c+=hex(((ord(m[i])) * a + ord(next(si))) % 128)[2:].zfill(2)    return cif __name__ == "__main__":    m = 'flag{********************************}'    a = A    salt = SALT    assert(len(salt)==3)    assert(salt.isalpha())    si = cycle(salt.lower())    print("明文内容为：")    print(m)    print("加密后的密文为：")    c=encrypt(m, a, si)    print(c)    #加密后的密文为：    #177401504b0125272c122743171e2c250a602e3a7c206e014a012703273a3c0160173a73753d

from Crypto.Util.number import *c = '177401504b0125272c122743171e2c250a602e3a7c206e014a012703273a3c0160173a73753d'.decode('hex')m = 'flag'#c[0] = ord('f')*a + b#c[3] = ord('g')*a + ba=57b1 = (0x17-ord('f')*a)%128b2 = (0x74-ord('l')*a)%128b3 = (0x01-ord('a')*a)%128salt='ahh'flag=''index=0for i in c:    b = ord(salt[index%3])    index+=1    flag+=chr((ord(i)-b)*inverse(a,128)%128)

from numpy import arrayfrom PIL import Imagefrom secret import KeyPlaintext1 = "RC4IsInteresting"Plaintext2 = "ThisIsAEasyGame"cnt = 0class RC4():    def __init__(self, Key):        self.S = [i for i in range(256)]        self.K = [ord(Key[i % len(Key)])*2 for i in range(256)]        self.I, self.J = 0, 0        self.KSA()    def KSA(self):        for i in range(256):            j = (i+self.K[i]+self.S[i]) % 256            self.S[i], self.S[j] = self.S[j], self.S[i]    def next(self):        self.I = (self.I+1) % 256        self.J = (self.J+self.S[self.I]) % 256        self.S[self.J], self.S[self.I] = self.S[self.I], self.S[self.J]        tmp = (self.S[self.J] + self.S[self.I]) % 256        return self.S[tmp]class Encrypt():    def __init__(self, plain):        global cnt        cnt += 1        self.rc4 = RC4(Key)        self.testRC4(plain)        flag_file = Image.open(r"flag.png")        img = array(flag_file)        self.enc(img)    def testRC4(self, plain):        ciphertext = 0        for i in plain:            ciphertext = (ciphertext << 8)+ord(i) ^ self.rc4.next()        print("ciphertext{} = {}".format(cnt, ciphertext))    def enc(self, img):        a, b, _ = img.shape        for x in range(0, a):            for y in range(0, b):                pixel = img[x, y]                for i in range(0, 3):                    pixel[i] = pixel[i] ^ self.rc4.next()                img[x][y] = pixel        enc = Image.fromarray(img)        enc.save("enc{}.png".format(cnt))Encrypt(Plaintext1)Encrypt(Plaintext2)# ciphertext1 = 12078640933356268898100798377710191641# ciphertext2 = 79124196547094980420644350061749775

from numpy import arrayfrom PIL import Imagep1 = "g"P2 = ""c1=0x19c2=""k1 = ord(p1)^c1flag_file1 = Image.open(r"enc1.png")flag_file2 = Image.open(r"enc2.png")img1 = array(flag_file1)img2 = array(flag_file2)a, b, _ = img1.shapefor x in range(0, a):    for y in range(0, b):        pixel1 = img1[x, y]        pixel2 = img2[x, y]        for i in range(0, 3):            pixel2[i] = pixel2[i] ^ k1            k1 = pixel2[i]^pixel1[i]        img2[x][y] = pixel2enc2 = Image.fromarray(img2)enc2.save("flag.png")

from Crypto.Util.number import*from secret import flagclass LCG:    def __init__(self):        self.a = getRandomNBitInteger(32)        self.b = getRandomNBitInteger(32)        self.m = getPrime(32)        self.seed = getRandomNBitInteger(32)    def next(self):        self.seed = (self.a*self.seed+self.b) % self.m        return self.seed >> 16    def output(self):        print("a = {}\nb = {}\nm = {}".format(self.a, self.b, self.m))        print("state1 = {}".format(self.next()))        print("state2 = {}".format(self.next()))class DH:    def __init__(self):        self.lcg = LCG()        self.lcg.output()        self.g = getRandomNBitInteger(128)        self.m = getPrime(256)        self.A, self.a = self.gen_AB()        self.B, self.b = self.gen_AB()        self.key = pow(self.A, self.b, self.m)    def gen_AB(self):        x = ''        for _ in range(64):            x += '1' if self.lcg.next() % 2 else '0'        return pow(self.g, int(x, 2), self.m), int(x, 2)DH = DH()flag = bytes_to_long(flag)print("g = {}\nA = {}\nB = {}\nM = {}".format(DH.g, DH.A, DH.B, DH.m))print("Cipher = {}".format(flag ^ DH.key))'''a = 3844066521b = 3316005024m = 2249804527state1 = 16269state2 = 4249g = 183096451267674849541594370111199688704A = 102248652770540219619953045171664636108622486775480799200725530949685509093530B = 74913924633988481450801262607456437193056607965094613549273335198280176291445M = 102752586316294557951738800745394456033378966059875498971396396583576430992701Cipher = 13040004482819935755130996285494678592830702618071750116744173145400949521388647864913527703'''

from Crypto.Util.number import *a = 3844066521b = 3316005024m = 2249804527state1 = 16269state2 = 4249M = 102752586316294557951738800745394456033378966059875498971396396583576430992701B = 74913924633988481450801262607456437193056607965094613549273335198280176291445A = 102248652770540219619953045171664636108622486775480799200725530949685509093530c = 13040004482819935755130996285494678592830702618071750116744173145400949521388647864913527703for i in range(2**16):    s = state1<<16    s+=i    if ((a*s+b)%m)>>16 == 4249:        s2 = (a*s+b)%m        print s2        x=''        for _ in range(64):            s2 = (a*s2+b)%m            x += '1' if (s2>>16) % 2 else '0'        x = int(x,2)        key = pow(B,x,M)        flag = key^c        print long_to_bytes(flag)

from Crypto.Util.number import *from functools import reducedef genKey(length):    A, B = getPrime(64), getPrime(1025)    Rn = getPrime(1024)    key1 = [Rn//2**i for i in range(1, length+1)]    key2 = [i*A % B for i in key1]    return key1,key2def encrypt(text,key):    Sum=0    for i in range(len(text)):        Sum+=int(text[i])*key[i]    return Sumdef save(Ciper,Key):    f1=open("pub.txt","w")    for i in range(len(Key)):        f1.write(str(Key[i])+'\n')    f2=open("cip.txt","w")    f2.write(hex(Ciper))FLAG = bin(bytes_to_long(flag.encode()))[2:]Key1,Key2 = genKey(len(FLAG))Ciper = encrypt(FLAG,Key1)save(Ciper,Key2)

b=335428611041311731398614259824482604248524861615176787429946575184146370361110652887115402376826444538743339055691850202034085349274540292019392290484025358504275054761608502214481606484088807087063751542648223811793597463026662881020647708165593980984857948283181770647446888695205803952635117800114545071259a=11243098275181678343with open("pub.txt")as f:    data=f.read()data=data.split("\n")[:-1]datai=[]for i in data:    datai.append(int(i))dataii=[] for i in datai:    dataii.append(i*inverse(a,b)%b)c=0x8ab3086a3df540d4652c191951756a6574aca491d933e479330532f0586ce03862f82f36dea8038b8bfb0b394331d7a93050efa2a26e46d9d8ca394600456cd79e02890a2c31b02e920c28a9f27c3943ec68fe5555ff4056358f35869859d67d67702edf44b10a7690acbaeea1f4def46392922069bfb71c173a210e9ab384f7flag=""for i in dataii:    if c>=i:        flag+='1'        c-=i    else:        flag+='0'print long_to_bytes(int(flag,2))

import signalimport stringfrom hashlib import sha256from Crypto.Util.number import *from Crypto.Random import randomflag = 'flag'banner = ''' ____             _                     _             _       _   _ | __ )  __ _  ___| | ___ __   __ _  ___| | _____ _ __( )___  | | | | ___  _ __ ___   ___|  _ \ / _` |/ __| |/ / '_ \ / _` |/ __| |/ / _ \ '__|// __| | |_| |/ _ \| '_ ` _ \ / _ \\| |_) | (_| | (__|   <| |_) | (_| | (__|   <  __/ |    \__ \ |  _  | (_) | | | | | |  __/|____/ \__,_|\___|_|\_\ .__/ \__,_|\___|_|\_\___|_|    |___/ |_| |_|\___/|_| |_| |_|\___|                      |_|'''def timeout_handler(signum, frame):    print("\n[!]Sorry, timeout...")    raise TimeoutErrordef proof_of_work():    print("[++++++++++++++++] Proof of work [++++++++++++++++]")    proof = ''.join(        [random.choice(string.ascii_letters+string.digits)         for _ in range(20)]    )    proof_cipher = sha256(proof.encode()).hexdigest()    print("sha256(XXXX+{}) == {}".format(proof[4:], proof_cipher))    guess = input("Give me XXXX: ")    if len(guess) != 4 or sha256((guess + proof[4:]).encode()).hexdigest() != proof_cipher:        print("[++++++++++++++++] You failed, exit... [++++++++++++++++]")        exit(0)    print("[++++++++++++++++] Proof of work has passed [++++++++++++++++]")class Knapsack:    n = None    elements = None    def load(self, n, nbits):        self.n = n        self.elements = set()        while len(self.elements) < n:            self.elements.add(getRandomNBitInteger(nbits))        self.elements = list(self.elements)    def super_load(self, n):        self.n = n        self.elements = [233]        sum = 233        while len(self.elements) < n:            self.elements.append(sum + getRandomRange(1, 128))            sum += self.elements[-1]    def encrypt(self):        if not self.n or not self.elements:            raise ValueError("[!]Something Wrong...")        m = getRandomNBitInteger(self.n)        m_list = [int(_) for _ in bin(m)[2:]]        c = 0        for i in range(self.n):            c += m_list[i] * self.elements[i]        return (c, m)def challenge_1():    print("[++++++++++++++++] Enjoy challenge_1 [++++++++++++++++]")    K = Knapsack()    K.load(10, 16)    print("[+]There are {} elements in the knapsack.".format(K.n))    for i in range(K.n):        print(K.elements[i])    (c, m) = K.encrypt()    print("[+]c = {}".format(c))    guess = input("[-]m(hex) = ")    try:        guess = int(guess, 16)        if guess == m:            print("[++++++++++++++++] challenge_1 has passed [++++++++++++++++]")            return    except:        pass    print("[++++++++++++++++] You failed, exit... [++++++++++++++++]")    exit(0)def challenge_2():    print("[++++++++++++++++] Enjoy challenge_2 [++++++++++++++++]")    K = Knapsack()    K.super_load(50)    print("[+]There are {} elements in the knapsack.".format(K.n))    for i in range(K.n):        print(K.elements[i])    (c, m) = K.encrypt()    print("[+]c = {}".format(c))    guess = input("[-]m(hex) = ")    try:        guess = int(guess, 16)        if guess == m:            print("[++++++++++++++++] challenge_2 has passed [++++++++++++++++]")            return    except:        pass    print("[++++++++++++++++] You failed, exit... [++++++++++++++++]")    exit(0)def challenge_3():    print("[++++++++++++++++] Enjoy challenge_3 [++++++++++++++++]")    K = Knapsack()    K.load(100, 312)    print("[+]There are {} elements in the knapsack.".format(K.n))    for i in range(K.n):        print(K.elements[i])    (c, m) = K.encrypt()    print("[+]c = {}".format(c))    guess = input("[-]m(hex) = ")    try:        guess = int(guess, 16)        if guess == m:            print("[++++++++++++++++] challenge_3 has passed [++++++++++++++++]")            print("[+]Excellent Backpacker, your flag is {}".format(flag))            return    except:        pass    print("[++++++++++++++++] You failed, exit... [++++++++++++++++]")    exit(0)def main():    proof_of_work()    challenge_1()    challenge_2()    challenge_3()if __name__ == "__main__":    try:        print(banner)        signal.signal(signal.SIGALRM, timeout_handler)        signal.alarm(6000000)        main()    except:        pass

import string from Crypto.Util.number import getPrime as getprime ,long_to_bytes,bytes_to_long,inversefrom pwn import *from pwnlib.util.iters import mbruteforcefrom hashlib import sha256context.log_level = "debug"def enc(data,m):    m = bin(m)[2:]    c = 0    for i in range(len(m)):        c += int(m[i])*data[i]    return csh=remote("183.129.189.60","10036")sh.recvuntil("sha256(XXXX+")suffix=sh.recv(len('SLhlaef5L6nM6pYx'))sh.recvuntil("== ")cipher=sh.recv(len('3ade7863765f07a3fbb9d853a00ffbe0485c30eb607105196b0d1854718a7b6c'))sh.recvuntil("XXXX: ")proof = mbruteforce(lambda x: sha256((x + suffix).encode()).hexdigest() == cipher, string.ascii_letters + string.digits, length=4, method='fixed')sh.sendline(proof)sh.recvuntil("knapsack.\n")data=[]for _ in range(10):    data.append(int(sh.recvline()[:-1]))#print(data)sh.recvuntil("[+]c = ")c = int(sh.recvuntil("\n")[:-1])for i in range(2**10):    if enc(data,i) == c:        print i        sh.sendline(hex(i)[2:])        breakelse:    print "no"sh.recvuntil("knapsack.\n")data=[]for _ in range(50):    data.append(int(sh.recvline()[:-1]))#print(data)data.reverse()sh.recvuntil("[+]c = ")c = int(sh.recvuntil("\n")[:-1])m=""for i in data:    if c>=i:        m+='1'        c-=i    else:        m+='0'print cif enc(data,int(m,2)) :    m = m[::-1]m = int(m,2)sh.sendline(hex(m)[2:])sh.recvuntil("knapsack.\n")data=[]for _ in range(100):    data.append(int(sh.recvline()[:-1]))print("a = "+str(data).replace("L",""))sh.recvuntil("[+]c = ")c = int(sh.recvuntil("\n")[:-1])print("s = "+str(c))sh.interactive()