长亭pwnhub内部赛

2022-06-11

2022 六月内部赛

misc-伏羲八卦

根据题目和gif可知，首先需要把gif提取成每一帧，然后对照每一帧的卦象转为01序列（或者8进制）
提取帧的脚本：

from PIL import Image
import os
import random


class GIFTest:

    def __init__(self, file_name):
        self.file_name = file_name      # 传入的文件名
        self.dir_name = self.file_name[:-4]     # 根据文件名创建存放分帧图片的文件夹
        self.gif_path = os.path.join(os.path.dirname(__file__), file_name)  # 拼接图片文件的完整路径（仅限同一文件夹内）
        self.make_dir()

    def make_dir(self):
        """用于创建存放分帧图片的文件夹"""
        try:
            os.mkdir(self.dir_name)
        except FileExistsError:
            print('<%s>文件夹已存在' % self.dir_name)
            self.dir_name += str(random.randint(0, 10))
            os.mkdir(self.dir_name)

    def framing_test(self):
        """GIF图片分帧"""
        img = Image.open(self.gif_path)
        try:
            while True:
                curr = img.tell()
                name = os.path.join(self.dir_name, '%s.png' % str(curr + 1))
                img.save(name)
                img.seek(curr+1)
        except Exception as e:
            pass


if __name__ == '__main__':
    GIFTest('test.gif').framing_test()

根据卦象转成8进制数字：

from diff import diff

dic = {"test/1.png":'1',"test/2.png":'3',"test/4.png":'0',"test/5.png":'7',"test/9.png":'5',"test/14.png":'6',"test/29.png":'4',"test/39.png":'2'}

for i in dic:
    print(i)


s = ''
for i in range(1,343):
    print(i)
    for j in dic:
        if diff(f'test/{i}.png',j):
            s = s+dic[j]

print(s)
# 133070135133061061051133061141135133062063051133132155170150132063164105062132141162150146142102143115103061065124063125164142125103130116127122112164101104106162132123061167142107106145102107062106150102122147151161063147065142107065156114127060170143062153110171157116161151124130143155151135133062144135133063141051133064065135133065061051

每三个八进制数字转成一组字符：

ss = ''
for i in range(len(s)//3):
    m = s[3*i] + s[3*i+1] + s[3*i+2]
    ss = ss + chr(int(m,8))
print(ss)
# [8][11)[1a][23)[ZmxhZ3tE2ZarhfbBcMC15T3UtbUCXNWRJtADFrZS1wbGFeBG2FhBRgiq3g5bG5nLW0xc2kHyoNqiTXcmi][2d][3a)[45][51)

[ ]看来像是区间范围，里面的数字是16进制，按照顺序调一下字符串：

f = 'ZmxhZ3tE2ZarhfbBcMC15T3UtbUCXNWRJtADFrZS1wbGFeBG2FhBRgiq3g5bG5nLW0xc2kHyoNqiTXcmi'
f = f[0x8:0x11]+f[0x1a:0x23]+f[0x2d:0x3a]+f[0x45:0x51]
print(f)
# 2ZarhfbBcUCXNWRJtAeBG2FhBRgiq3gkHyoNqiTXcmi
# base58转换一下

crypto-ecdsa

私钥和k相同，推导一下几个参数的关系即可。

import hashlib
from Crypto.Util.number import *
from ecdsa.ecdsa import *
n=generator_192.order()
message = b'get the flag'
hash_message = int(hashlib.sha1(message).hexdigest(), 16)
r,s=827738947342412163466256986352463260575568151152429823167,827738947342412163577310637036310636847677110838127448036
secret=inverse(s-r,n)*hash_message%n

flag = 'flag{' + hashlib.md5(str(secret).encode()).hexdigest() + '}'
print(flag)