2022 TQLCTF

import osimport randomimport secretsimport string#from secret import flag, secret_1, secret_2, flag_tokenflag='TQLCTF{eee67011-f2a0-4f5f-ae48-1de28c76939x}'# ========================================================================class InvalidChar(Exception):    passclass DangerousToken(Exception):    passvalid_char = [ord(x) for x in string.digits +              string.ascii_letters + string.punctuation]def check_valid(s: bytes):    r = list(map(lambda x: x in valid_char, s))    if False in r:        raise InvalidChar(r.index(False))def getrandbits(token: bytes, k: int) -> int:    random.seed(token)    return random.getrandbits(k)def bytes_xor_int(s: bytes, r: int, length: int) -> bytes:    s = int.from_bytes(s, 'little')    return (s ^ r).to_bytes(length, 'little')def __byte_shuffle(s: int) -> int:    bits = list(bin(s)[2:].zfill(8))    random.shuffle(bits)    return int(''.join(bits), 2)def __byte_shuffle_re(s: int) -> int:    s = bin(s)[2:].zfill(8)    idx = list(range(8))    random.shuffle(idx)    s = ''.join(
展开收缩
 for i in range(8)])    return int(s, 2)def bits_shuffle(s: bytes) -> bytes:    s = bytearray(s)    for i in range(len(s)):        s[i] = __byte_shuffle(s[i])    return bytes(s)def bits_shuffle_re(s: bytes) -> bytes:    s = bytearray(s)    for i in range(len(s)):        s[i] = __byte_shuffle_re(s[i])    return bytes(s)def bytes_shuffle(token: bytes, s: bytes) -> bytes:    random.seed(token)    s = bytearray(s)    random.shuffle(s)    return bytes(s)def bytes_shuffle_re(token: bytes, s: bytes) -> bytes:    random.seed(token)    idx = list(range(len(s)))    random.shuffle(idx)    r = bytearray(len(s))    for i in range(len(s)):        r[idx[i]] = s[i]    return bytes(r)def encrypt(s: str, token=(None, None)):    if token[0] is None or token[1] is None:        token = (secrets.randbits(32).to_bytes(4, 'little'),                 secrets.randbits(32).to_bytes(4, 'little'))    s: bytes = s.encode()    check_valid(s)    r = getrandbits(token[0]+secret_1, 8*len(s))    s = bytes_xor_int(s, r, len(s))    s = bits_shuffle(s)    s += token[0]    s = bytes_shuffle(token[1]+secret_2, s)    s += token[1]    s = s.hex()    return sdef decrypt(s: str):    s: bytes = bytes.fromhex(s)    s, token_1 = s[:-4], s[-4:]    s = bytes_shuffle_re(token_1+secret_2, s)    s, token_0 = s[:-4], s[-4:]    r = getrandbits(token_0+secret_1, 8*len(s))    s = bits_shuffle_re(s)    s = bytes_xor_int(s, r, len(s))    check_valid(s)    s = s.decode()    if (len(s) == len(flag)) + (token_0 == flag_token[0]) + (token_1 == flag_token[1]) >= 2:        raise DangerousToken    return sdef encrypt_flag():    flag_enc = encrypt(flag, flag_token)    print(f'flag: {flag_enc}')def rebuild():    global secret_1, secret_2, flag_token    secret_1 = os.urandom(64)    secret_2 = os.urandom(64)    flag_token = (os.urandom(4), os.urandom(4))def choose_mode():    print('Choose function:')    print('0: encrypt')    print('1: decrypt')    print('2: rebuild')    mode = int(input('> '))    assert 0 <= mode <= 2    return modeif __name__ == '__main__':    print('Welcome to Nano OTP Box!')    rebuild()    encrypt_flag()    while True:        try:            mode = choose_mode()            if mode == 0:                print('Please input original message.')                msg = input('> ')                print('encrypted message:', encrypt(msg))            elif mode == 1:                print('Please input encrypted message.')                msg = input('> ')                print('original message:', decrypt(msg))            elif mode == 2:                rebuild()                encrypt_flag()        except InvalidChar as e:            print('The original message contains invalid characters: pos', e)        except DangerousToken:            print('The encrypted message contains dangerous token')

from Crypto.Util.number import *from TQLOPT import *flag_enc = encrypt(flag, flag_token)c = long_to_bytes(int(flag_enc,16))table_from_to={}token1to=[]c = list(c)# 异或flag_enc的各个bit以得到token1所对应的乱序规则for index in range(len(c)-4):# 最后四个字节是token1    times = 0#记录invalid次数    for i in range(8):        tempc = c.copy()        tempc[index] ^= 1 << i        tempstr = ''.join(chr(i) for i in tempc)        tempbytes = tempstr.encode('latin1')        templong = bytes_to_long(tempbytes)        temphex = hex(templong)[2:].rjust(104,'0')# 这里只是想把异或c的一个bit然转成hex而已，绕了一圈属于是        try:            decrypt(temphex)        except InvalidChar as e:# 由于是本地调试，我直接捕获异常了，如果是远程交互，可能还需要写一个正则匹配一下返回值            fr0m = str(e)            times += 1        except DangerousToken:            pass    if times == 8:# 如果八次全错，说明我们改到token0了，记录下位置        token1to.append(index)    else:        table_from_to[fr0m] = index# 至此，我们获取到了密文中token0的位置，已经相应的token1所对应的映射关系 table_from_to# 故技重施，加密一个45字节的msg，获取token1' 已经其对应的映射关系 table11_to_from，这里反正记是方便后面的调用msg = 'a'*45msg_enc = encrypt(msg)token11 = msg_enc[-8:]table11_to_from={}token11to=[]c = long_to_bytes(int(msg_enc,16))c = list(c)for index in range(len(c)-4):    times = 0    for i in range(8):        tempc = c.copy()        tempc[index] ^= 1 << i        tempstr = ''.join(chr(i) for i in tempc)        tempbytes = tempstr.encode('latin1')        templong = bytes_to_long(tempbytes)        temphex = hex(templong)[2:].rjust((45+8)*2,'0')        try:            decrypt(temphex)        except InvalidChar as e:            fr0m = str(e)            times += 1        except DangerousToken:            pass    if times == 8:        token11to.append(index)    else:        table11_to_from[index] = fr0m# 现在我们按照table_from_to，把flag的顺序调回来，c = long_to_bytes(int(flag_enc,16)).decode('latin1')rec = []for i in range(52-8):rec += c[table_from_to[str(i)]]token0 = ''.join(c[token1to[i]] for i in range(4))from itertools import permutationsfor each in list(permutations(token0,4)):    token00 = list(each)    rectmp = rec+['0'] + token00#然后加上一个字节，加上24种token0，    rec_s = ""    token00index=0    for i in range(53-4):        if i in table11_to_from.keys():            rec_s += rectmp[int(table11_to_from[i])]# 按照table11_to_from乱序,剩下四个空用token0去补        else:            rec_s += token00[token00index]            token00index += 1        tempbytes = rec_s.encode('latin1')        templong = bytes_to_long(tempbytes)        temphex = hex(templong)[2:].rjust((45+4)*2,'0')        temphex += token11#加上token1'，再拿去解密    try:        Token0=0        if 'TQLCTF' in decrypt(temphex):            print(decrypt(temphex))            exit()# 运气好一步到位    except InvalidChar as e:        if str(e) == '44':       Token0 = token00#如果44出错说明token0对了，去换字节就好        breakif not Token0:#实测下来发现就算token0对了，它解密后最开头的四个字节还是会异或出错，这就不是很清楚原因了，直接再来一遍好了。    print("Try again")    exit()table = list(string.digits + string.ascii_letters + string.punctuation)for each in table:    rectmp = rec+[each] + Token0    #故技重施2，换字节，直到最后一个异或完是可打印字符    rec_s = ""    token00index=0    for i in range(53-4):        if i in table11_to_from.keys():            rec_s += rectmp[int(table11_to_from[i])]    # 按照table11_to_from乱序,剩下四个空用token0去补        else:            rec_s += Token0[token00index]            token00index += 1        tempbytes = rec_s.encode('latin1')        templong = bytes_to_long(tempbytes)        temphex = hex(templong)[2:].rjust((45+4)*2,'0')         temphex += token11  #加上token1'，再拿去解密    try:        if 'TQLCTF' in decrypt(temphex):            print(decrypt(temphex))            break    except Exception as e:        pass

beta = 0.233delta = 0.226amplification = 1024alpha = 0.9987modulus = emm = 5ss = 0tt = 5Xp = int(2 * N ** (alpha + beta + delta  - 1))Yp = int(N**beta)Yq = int(2 * N ** (1 - beta) )#下面求G basis的时候，取个三组，会快些I = ideal(all_pol[:3])