Cryptography

EASY-RSA

n = 1763350599372172240188600248087473321738860115540927328389207609428163138985769311
e = 65537
c = 33475248111421194902497742876885935310304862428980875522333303840565113662943528

PowerRSA

PRP617 = 257149699574159428232269198627581333222531206666510730461647612021024186321695478084184944808139089503678935597
164752896473313142522936529599057889079093748347559259286671336565011742174239947771910638333122716338160016991508190227
367824600661419854896501918109479804511442419958075094491393022482261968627756560151204765814850118585586319678705476232
540395790374866557657889915978665719702243454594291668630629049602092916639288487194398949852275084473870148877971289256
268316028349030641656786465147639996601057524034456037572798022441732300934332547754831420173348991163460072052854806615
05679474848019877405023869
PRP617 = 257149699574159428232269198627581333222531206666510730461647612021024186321695478084184944808139089503678935597
164752896473313142522936529599057889079093748347559259286671336565011742174239947771910638333122716338160016991508190227
367824600661419854896501918109479804511442419958075094491393022482261968627756560151204765814850118585586319678705476232
540395790374866557657889915978665719702243454594291668630629049602092916639288487194398949852275084473870148877971289256
268316028349030641656786465147639996601057524034456037572798022441732300934332547754831420173348991163460072052854806615
05679474848019877405023437

Puny Factors

AES

#!/usr/bin/env python3

import base64
from Crypto.Cipher import AES

secret_code = "<flag>"

def pad(message):
    if len(message) % 16 != 0:
        message = message + '0'*(16 - len(message)%16 )    #block-size = 16
    return message

def encrypt(key, plain):
    cipher = AES.new( key, AES.MODE_ECB )
    return cipher.encrypt(plain)

sitrep = str(input("Crewmate! enter your situation report: "))
message = '''sixteen byte AES{sitrep}{secret_code}'''.format(sitrep = sitrep, secret_code = secret_code) #the message is like [16-bytes]/[report]/[flag]

message = pad(message)
message1 = bytes(message,'utf-8')

cipher = encrypt( b'sixteen byte key', message1 )
cipher = base64.b64encode(cipher)
print(cipher.decode('ascii'))

代码看了懂了一点！但是key是6个字节的！这是猜吗！

奈何本人技术菜！真没看懂wp！

WEB

Collide

Make sha256 collide and you shall be rewarded
The source!
<html>
    <body>
        <h1> Make sha256 collide and you shall be rewarded </h1>

        <b>The source!</b>

        <?php
            $source = show_source("index.php", true);
            echo("<div>");
            print $source;
            echo("</div>");

            if (isset($_GET['shell']) && isset($_GET['pwn'])) {
                if ($_GET['shell'] !== $_GET['pwn'] && hash("sha256", $_GET['shell']) === hash("sha256", $_GET['pwn'])) {
                    include("flag.php");
                    echo("<h1>$flag</h1>");
                } else {
                    echo("<h1>Try harder!</h1>");
                }
            } else {
                echo("<h1>Collisions are fun to see</h1>");
            }
        ?>
    </body>
</html>
Collisions are fun to see

Fun with Tokens

token伪造的题！

密钥爆破不出来！😥

下面这篇讲JWT讲的挺棒的！

https://laravelacademy.org/post/3640.html

https://zhuanlan.zhihu.com/p/71672282

token构成

HMACSHA256(
    base64UrlEncode(header) + "." +
    base64UrlEncode(payload),
    secret
)

没key！不会了！

😭了！这有个任意文件读取不知道！

大佬wp

https://szymanski.ninja/en/ctfwriteups/2021/shellctf/fun-with-tokens/

再jwt伪造下！