tyhan’s CTF

Scy way

2017-08-30T21:00:00+00:00

문제

Scy way 45

Decrypt My Secret And Win!

IHUDERMRCPESOLLANOEIHR

Bugs_Bunny{flag}

Author: TnMch

풀이

scy way 방식을 caesar box라고도 부르는것 같다.

Caesar box

해당 방식을 코딩을 하였다.

키를 알지 못하여 우선 22글자이기 때문에 나누어지는 수인 2 와 11로 해보았다.

text = "IHUDERMRCPESOLLANOEIHR"

def scy(text, key):
    result = ""
    term = len(text)/key
    for i in range(term):
        for j in range(len(text)/term):
            result += text[i+j*term]
    return result
    
print len(text)
factor = [2, 11]
for i in factor:
    print scy(text, i)

두개의 값이 나왔다. CIPHER라는 단어가 들어가있는것을 flag로 사용하였다.

ISHOULDLEARNMORECIPHER
IUEMCEOLNEHHDRRPSLAOIR

Bugs_Bunny{ISHOULDLEARNMORECIPHER}

RSA 2

2017-08-30T20:00:00+00:00

문제

RSA2 80

c: 0x217c8bf9b45601267624c3b1ba89ae93d04c8fae32dc15496262f36f48d06c0dc9e178a77b77a33708dcbe1fcd55ea9eb636fe5684c2f0f08df3389f47b36a128636671eba300491c829ed1e252b1bb4dbb3b93bc46d98a10bb5d55347752052ab45e143fd46799be1d06ac3ff7e8b1eb181dfbba8dfac3910202fd0b9a25befe E : 266524484526673326121255015126836087453426858655909092116029065652649301962338744664679734617977550306567819672969837450223062478394149960243362563995235387971047857994699247277712682103161537347874310994510059329875060868679654080020041070975648626636209785889112656335054840517934593236597457100751820027783 N : 412460203584740978970185080155274765823237615982150661072746604041385717906706098256415230390148737678989448404730885157667896599397615737297545930957425615121654272472589331747646564634264520011009284080299605233265170506809736069720838542498970453928922703911186788239628906189362646418960560442406497717567

Author: TnMch

풀이

공개키의 e가 크면 우선 wieners-attack을 해본다.

wieners-attack

code

#python3 wiener.py
[+] Found the continued fractions expansion convergents of e/N.
[+] Iterating over convergents; Testing correctness through factorization.
[+] ...
[+] Factored N! :) derived keypair components:
[+] ++ SHA1(e):     bbf1a420da781634bb5bd02dcd4869f0b5c63d68
[+] ++      d :     27979163639208238097581493168255260980791785886427784936313524512033423912647
[+] ++ SHA1(d):     d6d19e38c1db77d3cde21737ece5f1b89beaac0b
[+] ++ SHA1(N):     fda4043b9bf88780fd9e9c04e739befe4760f143
[+] ++      p :     17161999324236539064317754140395642765702739382246098180731387908161141783840551460502918960425597679930951305598922767957529406215641102387965223811833367
[+] ++ SHA1(p):     d90f4f6e042a3c4594159ab02ca43cb6c01e9e62
[+] ++      q :     24033342257638708824373735251516351694011297880096219691762845250861823504037151195236378659607369447498245214333469418187337738705973799517129078918392601
[+] ++ SHA1(q):     122b81e391070f0e8f42b7c0214a2c230fc1591f
[+] ++ SHA1(phiN):  e6128a71e36de5313d69e80076e7136265f6faae

바로 나와 주었다.

찾은 d와 주어진 N, c를 가지고 복호화 하였다.

Bugs_Bunny{Baby_Its_Cool_Lik3_school_haHAha}

Crypto 50

2017-08-30T19:00:00+00:00

문제

Crypto-50 50

Decode ME faster !

enc.txt

풀이

base 64…..

f = open("enc.txt")
text = f.read()
f.close()

print text.decode("base64")

여러번 해보았다.

print text.decode("base64")
print text.decode("base64").decode("base64")
print text.decode("base64").decode("base64").decode("base64")
print text.decode("base64").decode("base64").decode("base64").decode("base64")

하다 못해 루프를 돌렸다.

f = open("enc.txt")
text = f.read()
f.close()

while(True):
    try:
        text = text.decode("base64")
    except:
        print text
        break

바로 나와주었다. 다른곳이였으면 이것저것 decode 방식을 섞었을텐데..

Bugs_Bunny{N0T_H4Rd_4T_4ll}

Crypto 25

2017-08-30T18:00:00+00:00

문제

Crypto-25 25

Please give the flag !

crypto-25

풀이

ook ook!!!!!!!!

검색을 하면 나온다. ook

결국 BF문제이다.

사실상 crypto20 문제랑 같이 풀어서 같은 소스를 사용한다.

bf.py

Bugs_Bunny{Ju5T_OoK!}

Crypto 20

2017-08-30T17:00:00+00:00

문제

Crypto-20 20

Decode the message !

++++++++++[>+>+++>+++++++>++++++++++««-]»>—-. >+++++++++++++++++. ————–. ++++++++++++. ——————–. <. >++++++++++++++++++++++. ——-. . +++++++++++. ++. <. >———. <————–. —. +++++++++++++++++++++++++++++. +++++++++++++++++. ————————-. >+++. «++++++++++++. . »++++++++.

풀이

BF 문제이다.

롤의 B.F. 대검이 아닌, Brute Foruce도 아닌 Brain Fxxk!

돌아다니는 아무 소스나 받아서 실행해 보았더니 플래그가 나왔다.

bf.py

Bugs_Bunny{Br41N_Fu**}

Crypto 15

2017-08-30T16:00:00+00:00

문제

Crypto-15 15

Some classics crypto task ! Cesar maybe !!

crypto-15.txt

풀이

슬쩍 보니 파이선 소스이다. 다시보니 플래그 부분도 보인다. 친절히 두번 써줬다.

04. # Synt : Cvht_Cvooz{D35bS_3OD0E3_4S3_O0U_T3DvS3_BU_4MM}
...
23. cevag qrpbqr("Cvht_Cvooz{D35bS_3OD0E3_4S3_O0U_T3DvS3_BU_4MM}",xrl)

시저중 가장 간단한 rot13을 해보았다.

fr = open("crypto-15.txt", "r")
fw = open("crypto-15.txt.py", "w")
fw.write(fr.read().decode("rot13"))
fr.close()
fw.close()

13말고 다른거로 하지. 키가 나왔다.

Piug_Pibbm{Q35oF_3BQ0R3_4F3_B0H_G3QiF3_OH_4ZZ}

hack in the card 2

2017-08-30T15:00:00+00:00

문제

HITB GSEC CTF 2017

hack in the card II

The second smart card sent to us has been added some countermeasures by that evil company. They also changed the public key(attachments -> publickey.pem). However it seems that they missed something…… Can you decrypt the following hex-encoded ciphertext this time?

016d1d26a470fad51d52e5f3e90075ab77df69d2fb39905fe634ded81d10a5fd10c35e1277035a9efabb66e4d52fd2d1eaa845a93a4e0f1c4a4b70a0509342053728e89e977cfb9920d5150393fe9dcbf86bc63914166546d5ae04d83631594703db59a628de3b945f566bdc5f0ca7bdfa819a0a3d7248286154a6cc5199b99708423d0749d4e67801dff2378561dd3b0f10c8269dbef2630819236e9b0b3d3d8910f7f7afbbed29788e965a732efc05aef3194cd1f1cff97381107f2950c935980e8954f91ed2a653c91015abea2447ee2a3488a49cc9181a3b1d44f198ff9f0141badcae6a9ae45c6c75816836fb5f331c7f2eb784129a142f88b4dc22a0a977

publickey.pem

풀이

롸업을 보고 알았다. N의 값이 같다는것을 1번 문제와 ..

writeup

hack in the card 1

문제의 키워드는 N과 e, d를 알고 있으면 factoring이 가능하다는 것이다.

1번 문제의 e,d를 가지고 N을 인수분해하여 p, q를 구한다.

이것을 간한히 구현하였다.

for g in range(3,1000):
    k = d1 * e1 - 1
    t = k
    x = 1
    while pow(t, 1, 2) != 1 :
        t = t / 2
        x = pow(g,t,n)
        if x == 1:
            continue
        if gcd(x-1, n) != 1:
            p = gcd(x-1, n)
            q = n / p
    if p != 0:
        break

오랜 시간이 걸리지 않아 바로 구해진다. 구해진 p, q를 가지고 새로운 e의 키를 찾아 복호화 한다.

solve.py

HITB{they say that history is written by the victors}

RSA 3

2017-08-27T17:00:00+00:00

문제

RSA - 3 100

I was finally able to capture the modulos and ciphertext that my friend uses to send the flag to everyone. Please hack it, and tell me what he is sending.

Note: Different flag format.

rsa3.txt

풀이

같은 메시지를 다른 public key 로 계속 보낸다면 의심하라 e가 작은지 확인해 볼것

알려주지 않았다. 높은 확률로 Hastad s Broadcast Attack이다.

CRT를 이용하여 숫자가 변하지 않을 때까지 숫자를 키운다.

p = 1
while len(ns) != 0:
    c1 = crt(c, cs[1], n, ns[1])
    p += 1
    n *= ns[1]
    ns = ns[1:]
    cs = cs[1:]
    if c == c1:
        break
    c = c1

몇 제곱을 했는지 모르기 때문에 e의 값을 BF를 해본다.

상위 비트 부터 게싱하여 c값보다 작은지 확인하고, 마지막 비트까지 게싱하였다면 같은지 확인한다.

for j in range(p - 5, p+10000):
    m = 0
    for i in range(length/(j - 3), -1, -1):
        m97 = pow((m+(2^i)),j)
        if m97 <= c:
            m = m + (2^i)
    m97 = pow(m,j)
    if m97 == c:
        print hex(m).decode("hex")
        break

전체 소스 (sage)

solve.sage

hackcon{h4st4d_n0t_s0_f4st3d_8r04dc457_8u7_m3554g3_15_10ng_cuz_p0w3r_15_5m4113r_th4n_u5u41}

RSA 2

2017-08-27T16:00:00+00:00

문제

RSA - 2 50

No p,q this time. LOL, what will you do now?

n = 109676931776753394141394564514720734236796584022842820507613945978304098920529412415619708851314423671483225500317195833435789174491417871864260375066278885574232653256425434296113773973874542733322600365156233965235292281146938652303374751525426102732530711430473466903656428846184387282528950095967567885381

e = 49446678600051379228760906286031155509742239832659705731559249988210578539211813543612425990507831160407165259046991194935262200565953842567148786053040450198919753834397378188932524599840027093290217612285214105791999673535556558448523448336314401414644879827127064929878383237432895170442176211946286617205

c = 103280644092615059984518332609100925251130437801342718478803923990158474621180283788652329522078935869010936203566024336697568861166241737937884153980866061431062015970439320809653170936674539901900312536610219900459284854811622720209705994060764318380465515920139663572083312965314519159261624303103692125635

풀이

e가 크면 우선 wiener 방법을 돌려본다. 럭키!

wiener attack

 wieners-attack python3 wiener.py 
[+] Found the continued fractions expansion convergents of e/N.
[+] Iterating over convergents; Testing correctness through factorization.
[+] ...
[+] Factored N! :) derived keypair components:
[+] ++ SHA1(e):     3536a853c5b47f3dcf6d8a399c5e135f91a5a3c9
[+] ++      d :     21780352155588618020563641971337344243907391969899764877790673891831527301137
[+] ++ SHA1(d):     adfb9d8325e4bf11a3c118908225bdd9dd2773bf
[+] ++ SHA1(N):     b64dba5bdcff031d80b826196507ccf02da4d83a
[+] ++      p :     10114792273660656874618568712406420344176220457790563178092222929337786916374923318745284718351487926620784106195715878875311958793629905453919697155685507
[+] ++ SHA1(p):     6871a43c4f96cbe8e59937c0924d3b8f63be5b57
[+] ++      q :     10843221374140991753173625949764386011485161421520044246309105053489500519257941272796681417497061734054081478280518835582353321569961722963922828311576983
[+] ++ SHA1(q):     d5d021413e968ba2904d7cb273fb3b661ee14f77
[+] ++ SHA1(phiN):  483e6cee191447e1cd694a028e7aa3a6a8b469cc

찾은 d로 복호화 한다.

n = 109676931776753394141394564514720734236796584022842820507613945978304098920529412415619708851314423671483225500317195833435789174491417871864260375066278885574232653256425434296113773973874542733322600365156233965235292281146938652303374751525426102732530711430473466903656428846184387282528950095967567885381

e = 49446678600051379228760906286031155509742239832659705731559249988210578539211813543612425990507831160407165259046991194935262200565953842567148786053040450198919753834397378188932524599840027093290217612285214105791999673535556558448523448336314401414644879827127064929878383237432895170442176211946286617205

c = 103280644092615059984518332609100925251130437801342718478803923990158474621180283788652329522078935869010936203566024336697568861166241737937884153980866061431062015970439320809653170936674539901900312536610219900459284854811622720209705994060764318380465515920139663572083312965314519159261624303103692125635

d = 21780352155588618020563641971337344243907391969899764877790673891831527301137

m = pow(c, d, n)
print hex(m)[2:-1].decode("hex")

d4rk{1_70ld_y0u_th15_would_8e_more_difficult}c0de

RSA 1

2017-08-27T15:00:00+00:00

문제

RSA - 1 10

Go read about RSA and how it works, then try to solve this.

p = 152571978722786084351886931023496370376798999987339944199021200531651275691099103449347349897964635706112525455731825020638894818859922778593149300143162720366876072994268633705232631614015865065113917174134807989294330527442191261958994565247945255072784239755770729665527959042883079517088277506164871850439

q = 147521976719041268733467288485176351894757998182920217874425681969830447338980333917821370916051260709883910633752027981630326988193070984505456700948150616796672915601007075205372397177359025857236701866904448906965019938049507857761886750656621746762474747080300831166523844026738913325930146507823506104359

c = 8511718779884002348933302329129034304748857434273552143349006561412761982574325566387289878631104742338583716487885551483795770878333568637517519439482152832740954108568568151340772337201643636336669393323584931481091714361927928549187423697803637825181374486997812604036706926194198296656150267412049091252088273904913718189248082391969963422192111264078757219427099935562601838047817410081362261577538573299114227343694888309834727224639741066786960337752762092049561527128427933146887521537659100047835461395832978920369260824158334744269055059394177455075510916989043073375102773439498560915413630238758363023648

e = 65537

풀이

풀이랄 것도 없다. 다 주었다.

from Crypto.Util import number

p = 152571978722786084351886931023496370376798999987339944199021200531651275691099103449347349897964635706112525455731825020638894818859922778593149300143162720366876072994268633705232631614015865065113917174134807989294330527442191261958994565247945255072784239755770729665527959042883079517088277506164871850439
q = 147521976719041268733467288485176351894757998182920
217874425681969830447338980333917821370916051260709883910633752027981630326988193070984505456700948150616796672915601007075205372397177359025857236701866904448906965019938049507857761886750656621746762474747080300831166523844026738913325930146507823506104359
c = 8511718779884002348933302329129034304748857434273552143349006561412761982574325566387289878631104742338583716487885551483795770878333568637517519439482152832740954108568568151340772337201643636336669393323584931481091714361927928549187423697803637825181374486997812604036706926194198296656150267412049091252088273904913718189248082391969963422192111264078757219427099935562601838047817410081362261577538573299114227343694888309834727224639741066786960337752762092049561527128427933146887521537659100047835461395832978920369260824158334744269055059394177455075510916989043073375102773439498560915413630238758363023648
e = 65537

n = p * q
d = number.inverse(e, (p - 1) * (q - 1))
m = pow(c,d,n)
print hex(m)[2:-1].decode("hex")

d4rk{s1mpl3_rsa_n0t_th1s_34sy_next_time}c0de