PicoCTF write up - Cryptography (密碼學篇 - 上)

Decrypt my super sick RSA:
c: 62324783949134119159408816513334912534343517300880137691662780895409992760262021
n: 1280678415822214057864524798453297819181910621573945477544758171055968245116423923
e: 65537

p = 1899107986527483535344517113948531328331
q = 674357869540600933870145899564746495319033

import libnum

p = 1899107986527483535344517113948531328331
q = 674357869540600933870145899564746495319033
n = p * q
e = 65537
c = 62324783949134119159408816513334912534343517300880137691662780895409992760262021
phi = (p - 1) * (q - 1)

d = libnum.modular.invmod(e, phi)
m = libnum.n2s(pow(c, d, n))
print(m) 

#!/usr/bin/python3 -u
import os.path

KEY_FILE = "key"
KEY_LEN = 50000
FLAG_FILE = "flag"


def startup(key_location):
	flag = open(FLAG_FILE).read()
	kf = open(KEY_FILE, "rb").read()

	start = key_location
	stop = key_location + len(flag)

	key = kf[start:stop]
	key_location = stop

	result = list(map(lambda p, k: "{:02x}".format(ord(p) ^ k), flag, key))
	print("This is the encrypted flag!\n{}\n".format("".join(result)))

	return key_location

def encrypt(key_location):
	ui = input("What data would you like to encrypt? ").rstrip()
	if len(ui) == 0 or len(ui) > KEY_LEN:
		return -1

	start = key_location
	stop = key_location + len(ui)

	kf = open(KEY_FILE, "rb").read()

	if stop >= KEY_LEN:
		stop = stop % KEY_LEN
		key = kf[start:] + kf[:stop]
	else:
		key = kf[start:stop]
	key_location = stop

	result = list(map(lambda p, k: "{:02x}".format(ord(p) ^ k), ui, key))

	print("Here ya go!\n{}\n".format("".join(result)))

	return key_location


print("******************Welcome to our OTP implementation!******************")
c = startup(0)
while c >= 0:
	c = encrypt(c)

$ python 
Python 3.9.7 (default, Sep  3 2021, 12:45:31) 
[Clang 12.0.0 (clang-1200.0.32.29)] on darwin
Type "help", "copyright", "credits" or "license" for more information.
>>> 5 ^ 6
3

$ python       
Python 3.9.7 (default, Sep  3 2021, 12:45:31) 
[Clang 12.0.0 (clang-1200.0.32.29)] on darwin
Type "help", "copyright", "credits" or "license" for more information.
>>> ord('i') ^ ord('n')
7

result = list(map(lambda p, k: "{:02x}".format(ord(p) ^ k), ui, key))

$ python
Python 3.9.7 (default, Sep  3 2021, 12:45:31) 
[Clang 12.0.0 (clang-1200.0.32.29)] on darwin
Type "help", "copyright", "credits" or "license" for more information.
>>> ord("a")
97
>>> 

ui = "abcd"
key = [0,5,0,0]

result = list(map(lambda p, k: "{:03x} ".format(ord(p) ^ k), ui, key))

print("Here ya go!\n{}\n".format("".join(result)))

#!/usr/bin/python3 -u
import os.path

KEY_FILE = "key"
#KEY_LEN = 50000
KEY_LEN = 10
FLAG_FILE = "flag"

flag = "Ank"
kf = [6,2,3,1,7,8,4,3,1,3] #Random

def startup(key_location):
        #flag = open(FLAG_FILE).read()
        #kf = open(KEY_FILE, "rb").read()

        start = key_location
        stop = key_location + len(flag)

        key = kf[start:stop]
        key_location = stop

        result = list(map(lambda p, k: "{:02x} ".format(ord(p) ^ k), flag, key))        print("This is the encrypted flag!\n{}\n".format("".join(result)))

        return key_location
        
def encrypt(key_location):
        ui = input("What data would you like to encrypt? ").rstrip()
        if len(ui) == 0 or len(ui) > KEY_LEN:
                return -1

        start = key_location
        stop = key_location + len(ui)

        #kf = open(KEY_FILE, "rb").read()

        if stop >= KEY_LEN:
                stop = stop % KEY_LEN
                key = kf[start:] + kf[:stop]
        else:
                key = kf[start:stop]
        key_location = stop

        result = list(map(lambda p, k: "{:02x} ".format(ord(p) ^ k), ui, key))

        print("Here ya go!\n{}\n".format("".join(result)))

        return key_location


print("******************Welcome to our OTP implementation!******************")
c = startup(0)
while c >= 0:
        c = encrypt(c)

>>> new_c = 0x03463d190702003d195004133d190356433d1902503d1950563d1900513d1959
>>> all_a = 0x6161616161616161616161616161616161616161616161616161616161616161
>>> kf = hex(new_c ^ all_a)
>>> print(kf)
0x62275c786663615c783165725c786237225c7863315c7831375c7861305c7838

>>> old_c = 0x51466d4e5f575538195551416e4f5300413f1b5008684d5504384157046e4959
>>> kf = 0x62275c786663615c783165725c786237225c7863315c7831375c7861305c7838
>>> flag = hex(old_c ^ kf)
>>> print(flag)
0x3361313639343464616434333237313763636333393435643364393634323161

>>> bytes.fromhex('3361313639343464616434333237313763636333393435643364393634323161').decode('utf-8')
'3a16944dad432717ccc3945d3d96421a'

from pwn import *

r = remote("mercury.picoctf.net", 64260)
r.recvline()
r.recvline()
flag_enc = bytes.fromhex(r.recvline().decode())
fl = len(flag_enc)


def enc(m):
    r.sendlineafter(b"What data would you like to encrypt? ", m)
    r.recvline()
    return bytes.fromhex(r.recvline().decode())


enc("a" * (50000 - fl))
keyxor = enc("a" * fl)


def xor(x, y):
    return bytes(a ^ b for a, b in zip(x, y))


key = xor(keyxor, b"a" * fl)
flag = xor(flag_enc, key)
print(flag.decode())

num = input("input>>")
num_list = num.split()
print(num_list)
new_num_list = [int(c) + 96 for c in num_list]
print(new_num_list)
flag = [chr(int(num)) for num in new_num_list]
print(flag)

import string

LOWERCASE_OFFSET = ord("a")
ALPHABET = string.ascii_lowercase[:16]

def b16_encode(plain):
        enc = ""
        for c in plain:
                binary = "{0:08b}".format(ord(c))
                enc += ALPHABET[int(binary[:4], 2)]
                enc += ALPHABET[int(binary[4:], 2)]
        return enc

def shift(c, k):
        t1 = ord(c) - LOWERCASE_OFFSET
        t2 = ord(k) - LOWERCASE_OFFSET
        return ALPHABET[(t1 + t2) % len(ALPHABET)]

flag = "redacted"
key = "redacted"
assert all([k in ALPHABET for k in key])
assert len(key) == 1

b16 = b16_encode(flag)
enc = ""
for i, c in enumerate(b16):
        enc += shift(c, key[i % len(key)])
print(enc)

import string

LOWERCASE_OFFSET = ord("a")
ALPHABET = string.ascii_lowercase[:16]

print("LOWERCASE_OFFSET",LOWERCASE_OFFSET)
print("ALPHABET",ALPHABET)

def b16_encode(plain):
    enc = ""
    for c in plain:
        print("plain,c = ",plain,c)
        binary = "{0:08b}".format(ord(c))
        print("binary = ",binary,chr(int(binary[:8], 2)))
        enc += ALPHABET[int(binary[:4], 2)]
        enc += ALPHABET[int(binary[4:], 2)]
        print("enc ",enc)
        print("---")
    return enc

def shift(c, k):
    t1 = ord(c) - LOWERCASE_OFFSET
    t2 = ord(k) - LOWERCASE_OFFSET
    return ALPHABET[(t1 + t2) % len(ALPHABET)]

flag = "123"
key = "c"
assert all([k in ALPHABET for k in key])
assert len(key) == 1

b16 = b16_encode(flag)
enc = ""
for i, c in enumerate(b16):
    enc += shift(c, key[i % len(key)])
print(enc)

flag = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz"
key = "a" # 不進行位移

ebecedeeefegeheiejekelemeneoepfafbfcfdfefffgfhfifjfkgbgcgdgegfggghgigjgkglgmgngogphahbhchdhehfhghhhihjhk

mlnklfnknljflfmhjimkmhjhmljhjomhmmjkjpmmjmjkjpjojgjmjpjojojnjojmmkmlmijimhjmmj

i = 0
flag = ""
c_text = "mlnklfnknljflfmhjimkmhjhmljhjomhmmjkjpmmjmjkjpjojgjmjpjojojnjojmmkmlmijimhjmmj"
for k in range(int(len(c_text)/2)):
    a = c_text[i]
    b = c_text[i+1]
    a = chr(((ord(a) - ord('a') + 10) % 16 + 1) + ord('a') - 1)
    #a = chr(ord(a) - 6)
    #b = chr(ord(b) - 6)
    b = chr(((ord(b) - ord('a') + 10) % 16 + 1) + ord('a') - 1)
    i += 2

    a = ord(a)-ord("a")
    b = ord(b)-ord("a")

    a = "{:04b}".format(int(a))
    b = "{:04b}".format(int(b))
    c = a + b
    #c = "01100101"
    ans = chr(int(c,2))
    flag += ans
    
print(flag)

i = 0
flag = ""
c_text = "apbopjbobpnjpjnmnnnmnlnbamnpnononpnaaaamnlnkapndnkncamnpapncnbannaapncndnlnpna"

for j in range(1,17):
    for k in range(int(len(c_text)/2)):
        a = c_text[i]
        b = c_text[i+1]
        a = chr(((ord(a) - ord('a') + j) % 16 + 1) + ord('a') - 1)
        b = chr(((ord(b) - ord('a') + j) % 16 + 1) + ord('a') - 1)
        i += 2

        a = ord(a)-ord("a")
        b = ord(b)-ord("a")

        a = "{:04b}".format(int(a))
        b = "{:04b}".format(int(b))
        c = a + b
        ans = chr(int(c,2))
        flag += ans

    print(j , "= ",flag)
    i = 0
    flag = ""

N: 1615765684321463054078226051959887884233678317734892901740763321135213636796075462401950274602405095138589898087428337758445013281488966866073355710771864671726991918706558071231266976427184673800225254531695928541272546385146495736420261815693810544589811104967829354461491178200126099661909654163542661541699404839644035177445092988952614918424317082380174383819025585076206641993479326576180793544321194357018916215113009742654408597083724508169216182008449693917227497813165444372201517541788989925461711067825681947947471001390843774746442699739386923285801022685451221261010798837646928092277556198145662924691803032880040492762442561497760689933601781401617086600593482127465655390841361154025890679757514060456103104199255917164678161972735858939464790960448345988941481499050248673128656508055285037090026439683847266536283160142071643015434813473463469733112182328678706702116054036618277506997666534567846763938692335069955755244438415377933440029498378955355877502743215305768814857864433151287
e: 3

ciphertext (c): 1220012318588871886132524757898884422174534558055593713309088304910273991073554732659977133980685370899257850121970812405700793710546674062154237544840177616746805668666317481140872605653768484867292138139949076102907399831998827567645230986345455915692863094364797526497302082734955903755050638155202890599808146956044568639690002921620304969196755223769438221859424275683828638207433071955615349052424040706261639770492033970498727183446507482899334169592311953247661557664109356372049286283480939368007035616954029177541731719684026988849403756133033533171081378815289443019437298879607294287249591634702823432448559878065453908423094452047188125358790554039587941488937855941604809869090304206028751113018999782990033393577325766685647733181521675994939066814158759362046052998582186178682593597175186539419118605277037256659707217066953121398700583644564201414551200278389319378027058801216150663695102005048597466358061508725332471930736629781191567057009302022382219283560795941554288119544255055962

import gmpy2,binascii,libnum,time
n = 1615765684321463054078226051959887884233678317734892901740763321135213636796075462401950274602405095138589898087428337758445013281488966866073355710771864671726991918706558071231266976427184673800225254531695928541272546385146495736420261815693810544589811104967829354461491178200126099661909654163542661541699404839644035177445092988952614918424317082380174383819025585076206641993479326576180793544321194357018916215113009742654408597083724508169216182008449693917227497813165444372201517541788989925461711067825681947947471001390843774746442699739386923285801022685451221261010798837646928092277556198145662924691803032880040492762442561497760689933601781401617086600593482127465655390841361154025890679757514060456103104199255917164678161972735858939464790960448345988941481499050248673128656508055285037090026439683847266536283160142071643015434813473463469733112182328678706702116054036618277506997666534567846763938692335069955755244438415377933440029498378955355877502743215305768814857864433151287
e = 3
c = 1220012318588871886132524757898884422174534558055593713309088304910273991073554732659977133980685370899257850121970812405700793710546674062154237544840177616746805668666317481140872605653768484867292138139949076102907399831998827567645230986345455915692863094364797526497302082734955903755050638155202890599808146956044568639690002921620304969196755223769438221859424275683828638207433071955615349052424040706261639770492033970498727183446507482899334169592311953247661557664109356372049286283480939368007035616954029177541731719684026988849403756133033533171081378815289443019437298879607294287249591634702823432448559878065453908423094452047188125358790554039587941488937855941604809869090304206028751113018999782990033393577325766685647733181521675994939066814158759362046052998582186178682593597175186539419118605277037256659707217066953121398700583644564201414551200278389319378027058801216150663695102005048597466358061508725332471930736629781191567057009302022382219283560795941554288119544255055962
res = 0

for k in range(200000000):
	if gmpy2.iroot(c+n*k,3)[1]==1:
		res=gmpy2.iroot(c+n*k,3)[0]
		print(k,res)
		print(libnum.n2s(int(res)))
		break

import libnum
from Crypto.PublicKey import RSA
import ContinuedFractions, Arithmetic

def wiener_hack(e, n):
    # firstly git clone https://github.com/pablocelayes/rsa-wiener-attack.git !
    frac = ContinuedFractions.rational_to_contfrac(e, n)
    convergents = ContinuedFractions.convergents_from_contfrac(frac)
    for (k, d) in convergents:
        if k != 0 and (e * d - 1) % k == 0:
            phi = (e * d - 1) // k
            s = n - phi + 1
            discr = s * s - 4 * n
            if (discr >= 0):
                t = Arithmetic.is_perfect_square(discr)
                if t != -1 and (s + t) % 2 == 0:
                    print("Hacked!")
                    return d
    return False

n = 103070577929726253631344410352692529019028899492417679170030712588726916233260956307828281366719578148149337963676063478754302654908868697186141139935785807607477859007299550759696360710761593462350508280204189428161004900112381330220076890145703597040417081075805402174962296795435711459649783056881789490351
e = 81229431932405069076115541286401461443494262822135658283742292897410925764495502689451059315212238547938663797948023035990811381899591212921183487360416649701773568973719409413970364821014306572579550625402194135767284307689116463076867207148137667749321676903262731528419046683614746969287791511567819422311
d = wiener_hack(e, n)
print("d = ", d)

c = 91695657020488911546514984124491767203636048945190356702572340308491541333231892208913410842759055058532538326429698845388689133318492812505642888037888994704290866466325628211196801570268671101701776860750050743516334024242682186605601842248508533894710903871285318149826578248317551453724632008257499100559
m = libnum.n2s(pow(c, d, n))
print("flag = ", m)

import libnum
import owiener

n = 103070577929726253631344410352692529019028899492417679170030712588726916233260956307828281366719578148149337963676063478754302654908868697186141139935785807607477859007299550759696360710761593462350508280204189428161004900112381330220076890145703597040417081075805402174962296795435711459649783056881789490351
e = 81229431932405069076115541286401461443494262822135658283742292897410925764495502689451059315212238547938663797948023035990811381899591212921183487360416649701773568973719409413970364821014306572579550625402194135767284307689116463076867207148137667749321676903262731528419046683614746969287791511567819422311
d = owiener.attack(e, n)
print("d = ", d)

c = 91695657020488911546514984124491767203636048945190356702572340308491541333231892208913410842759055058532538326429698845388689133318492812505642888037888994704290866466325628211196801570268671101701776860750050743516334024242682186605601842248508533894710903871285318149826578248317551453724632008257499100559
m = libnum.n2s(pow(c, d, n))
print("flag = ", m)

import libnum

N = 65603914925786331293577648481402202678250626513848986044457642475308642861873586842670388931330750571052948618643253233772154156913731489543684218025558918455114441784061185206094899732431499927247880349342257764693224996052797387557859812110433828120905864586326066969621171202946481099215943392076001264707
mm = 65603914925786331293577648481402202678250626513848986044457642475308642861873586842670388931330750571052948618643253233772154156913731489543684218025558918455114441784061185206094899732141224897052030309868801146325769110982831638706581735353690107674202550068924707702298402165477229653831516752238352666310 
m = libnum.n2s(N - mm)
print(m)

$ cat solve.py
# import Image
from PIL import Image

# open both photos
i1 = Image.open('scrambled1.png')
i2 = Image.open('scrambled2.png')

# get width and height
width1, height1 = i1.size

# open new image
i3 = Image.new('RGB', (width1, height1))

# load the pixels
pixels = i3.load()

# loop through all pixels
for i in range(width1):
	for j in range(height1):
        # xor the values
		x = i1.getpixel((i,j))[0] ^ i2.getpixel((i,j))[0]
		y = i1.getpixel((i,j))[1] ^ i2.getpixel((i,j))[1]
		z = i1.getpixel((i,j))[2] ^ i2.getpixel((i,j))[2]

        # if all white then convert to black
		if (x,y,z) == (255,255,255):
			(x,y,z) = (0,0,0)

        # put the new pixels in place
		i3.putpixel((i,j), (x,y,z))

# save the image
i3.save("test.png", "PNG")

from PIL import Image
import numpy as np
import os

file_names = ["scrambled1.png", "scrambled2.png"]
img_data = [np.asarray(Image.open(f'{name}')) for name in file_names]

data = img_data[0].copy() + img_data[1].copy()

new_image = Image.fromarray(data)
new_image.save("out.png", "PNG")

import random
import os

files = [
    os.path.join(path, file)
    for path, dirs, files in os.walk('.')
    for file in files
    if file.split('.')[-1] == 'txt'
]

alphabet = list('abcdefghijklmnopqrstuvwxyz')
random.shuffle(shuffled := alphabet[:])
dictionary = dict(zip(alphabet, shuffled))

for filename in files:
    text = open(filename, 'r').read()
    encrypted = ''.join([
        dictionary[c]
        if c in dictionary else c
        for c in text
    ])
    open(filename, 'w').write(encrypted)

alphabet = list('abcdefghijklmnopqrstuvwxyz')
random.shuffle(shuffled := alphabet[:])
dictionary = dict(zip(alphabet, shuffled))

$ python
Python 3.9.7 (default, Oct 10 2021, 15:13:22)
[GCC 11.1.0] on linux
Type "help", "copyright", "credits" or "license" for more information.
>>> import random
>>> alphabet = list('abcdefghijklmnopqrstuvwxyz')
>>> random.shuffle(shuffled := alphabet[:])
>>> dictionary = dict(zip(alphabet, shuffled))
>>> print(alphabet)
['a', 'b', 'c', 'd', 'e', 'f', 'g', 'h', 'i', 'j', 'k', 'l', 'm', 'n', 'o', 'p', 'q', 'r', 's', 't', 'u', 'v', 'w', 'x', 'y', 'z']
>>> print(shuffled)
['o', 'r', 's', 'w', 'n', 'i', 'k', 't', 'z', 'f', 'q', 'c', 'y', 'v', 'p', 'l', 'j', 'g', 'm', 'b', 'x', 'e', 'd', 'h', 'u', 'a']
>>> print(dictionary)
{'a': 'o', 'b': 'r', 'c': 's', 'd': 'w', 'e': 'n', 'f': 'i', 'g': 'k', 'h': 't', 'i': 'z', 'j': 'f', 'k': 'q', 'l': 'c', 'm': 'y', 'n': 'v', 'o': 'p', 'p': 'l', 'q': 'j', 'r': 'g', 's': 'm', 't': 'b', 'u': 'x', 'v': 'e', 'w': 'd', 'x': 'h', 'y': 'u', 'z': 'a'}
>>>

#!/usr/bin/python3 -u
import signal

SQUARE_SIZE = 6


def generate_square(alphabet):
	assert len(alphabet) == pow(SQUARE_SIZE, 2)
	matrix = []
	for i, letter in enumerate(alphabet):
		if i % SQUARE_SIZE == 0:
			row = []
		row.append(letter)
		if i % SQUARE_SIZE == (SQUARE_SIZE - 1):
			matrix.append(row)
	return matrix

def get_index(letter, matrix):
	for row in range(SQUARE_SIZE):
		for col in range(SQUARE_SIZE):
			if matrix[row][col] == letter:
				return (row, col)
	print("letter not found in matrix.")
	exit()

def encrypt_pair(pair, matrix):
	p1 = get_index(pair[0], matrix)
	p2 = get_index(pair[1], matrix)

	if p1[0] == p2[0]:
		return matrix[p1[0]][(p1[1] + 1)  % SQUARE_SIZE] + matrix[p2[0]][(p2[1] + 1)  % SQUARE_SIZE]
	elif p1[1] == p2[1]:
		return matrix[(p1[0] + 1)  % SQUARE_SIZE][p1[1]] + matrix[(p2[0] + 1)  % SQUARE_SIZE][p2[1]]
	else:
		return matrix[p1[0]][p2[1]] + matrix[p2[0]][p1[1]]

def encrypt_string(s, matrix):
	result = ""
	if len(s) % 2 == 0:
		plain = s
	else:
		plain = s + "irlgektq8ayfp5zu037nov1m9xbc64shwjd2"[0]
	for i in range(0, len(plain), 2):
		result += encrypt_pair(plain[i:i + 2], matrix)
	return result

alphabet = open("key").read().rstrip()
m = generate_square(alphabet)
msg = open("msg").read().rstrip()
enc_msg = encrypt_string(msg, m)
print("Here is the alphabet: {}\nHere is the encrypted message: {}".format(alphabet, enc_msg))
signal.alarm(18)
resp = input("What is the plaintext message? ").rstrip()
if resp and resp == msg:
	print("Congratulations! Here's the flag: {}".format(open("flag").read()))

# https://en.wikipedia.org/wiki/Playfair_cipher

from pwn import *

SQUARE_SIZE = 6

def generate_square(alphabet):
    assert len(alphabet) == pow(SQUARE_SIZE, 2)
    matrix = []
    for i, letter in enumerate(alphabet):
        if i % SQUARE_SIZE == 0:
            row = []
        row.append(letter)
        if i % SQUARE_SIZE == (SQUARE_SIZE - 1):
            matrix.append(row)
    return matrix

def get_index(letter, matrix):
    for row in range(SQUARE_SIZE):
        for col in range(SQUARE_SIZE):
            if matrix[row][col] == letter:
                return (row, col)
    print("letter not found in matrix.")
    exit()

def decrypt_pair(pair, matrix):
    p1 = get_index(pair[0], matrix)
    p2 = get_index(pair[1], matrix)

    if p1[0] == p2[0]:
        return matrix[p1[0]][(p1[1] - 1)  % SQUARE_SIZE] + matrix[p2[0]][(p2[1] - 1)  % SQUARE_SIZE]
    elif p1[1] == p2[1]:
        return matrix[(p1[0] - 1)  % SQUARE_SIZE][p1[1]] + matrix[(p2[0] - 1)  % SQUARE_SIZE][p2[1]]
    else:
        return matrix[p1[0]][p2[1]] + matrix[p2[0]][p1[1]]

def decrypt_string(s, matrix):
    result = ""
    if len(s) % 2 == 0:
        plain = s
    else:
        plain = s + "irlgektq8ayfp5zu037nov1m9xbc64shwjd2"[0]
    for i in range(0, len(plain), 2):
        tmp = decrypt_pair(plain[i:i + 2], matrix)
        result += tmp
    return result

p = remote("mercury.picoctf.net",40742)
p.recvuntil("Here is the alphabet:")
alphabet = p.recvline().strip().decode('utf-8')
p.recvuntil("Here is the encrypted message:")
enc_msg = p.recvline().strip().decode('utf-8')
matrix = generate_square(alphabet)
msg = decrypt_string(enc_msg, matrix)
p.recvuntil("What is the plaintext message? ")
p.sendline(msg)
p.recvuntil("Congratulations! Here's the flag:")
flag = p.recvline().strip().decode('utf-8')
print("flag =",flag)

# https://en.wikipedia.org/wiki/Playfair_cipher

#!/usr/bin/python3 -u
from Crypto.Cipher import DES
import binascii
import itertools
import random
import string


def pad(msg):
    block_len = 8
    over = len(msg) % block_len
    pad = block_len - over
    return (msg + " " * pad).encode()

def generate_key():
    return pad("".join(random.choice(string.digits) for _ in range(6)))


FLAG = open("flag").read().rstrip()
KEY1 = generate_key()
KEY2 = generate_key()


def get_input():
    try:
        res = binascii.unhexlify(input("What data would you like to encrypt? ").rstrip()).decode()
    except:
        res = None
    return res

def double_encrypt(m):
    msg = pad(m)

    cipher1 = DES.new(KEY1, DES.MODE_ECB)
    enc_msg = cipher1.encrypt(msg)
    cipher2 = DES.new(KEY2, DES.MODE_ECB)
    return binascii.hexlify(cipher2.encrypt(enc_msg)).decode()


print("Here is the flag:")
print(double_encrypt(FLAG))

while True:
    inputs = get_input()
    if inputs:
        print(double_encrypt(inputs))
    else:
        print("Invalid input.")

import binascii
from Crypto.Cipher import DES
from tqdm import tqdm

padding = "  "
encrypted_flag = binascii.unhexlify("6f745ccee635f76746be185541b9f9c046b8d707f93d0522e2325fb041c59ec7bbbaa818d7c51381")


def pad(msg):
    block_len = 8
    over = len(msg) % block_len
    pad = block_len - over
    return (msg + " " * pad).encode()

custom_known_text = pad(binascii.unhexlify("12341234").decode())
custom_ciphertext = binascii.unhexlify("4b731a66758abcfe")

encrypt_table = {}
for key in tqdm(range(999999), desc="Bruteforcing 1st Key"):
    key = (f"{key:06}" + padding).encode()
    cipher = DES.new(key, DES.MODE_ECB)
    encrypted_custom = cipher.encrypt(custom_known_text)
    encrypt_table[encrypted_custom] = key

decrypt_table = {}
for key in tqdm(range(999999), desc="Bruteforcing 2nd Key"):
    key = (f"{key:06}" + padding).encode()
    cipher = DES.new(key, DES.MODE_ECB)
    decrypted_custom = cipher.decrypt(custom_ciphertext)
    decrypt_table[decrypted_custom] = key

print("Finding Key Intersection...")
encrypt_table_set = set(encrypt_table.keys())
decrypt_table_set = set(decrypt_table.keys())
for encrypt_decrypt_value in encrypt_table_set.intersection(decrypt_table_set):
    encrypt_key = encrypt_table[encrypt_decrypt_value]
    decrypt_key = decrypt_table[encrypt_decrypt_value]
    break
print("1st Key Found: %s" % encrypt_key)
print("2nd Key Found: %s" % decrypt_key)

cipher1 = DES.new(encrypt_key, DES.MODE_ECB)
cipher2 = DES.new(decrypt_key, DES.MODE_ECB)
flag_intermediate = cipher2.decrypt(encrypted_flag)
flag = cipher1.decrypt(flag_intermediate).decode()
print("Flag: %s" % flag)

#!/usr/bin/python3 -u

import zlib
from random import randint
import os
from Crypto.Cipher import Salsa20

flag = open("./flag").read()


def compress(text):
    return zlib.compress(bytes(text.encode("utf-8")))

def encrypt(plaintext):
    secret = os.urandom(32)
    cipher = Salsa20.new(key=secret)
    c = cipher.encrypt(plaintext)
    return cipher.nonce + c

def main():
    while True:
        usr_input = input("Enter your text to be encrypted: ")
        compressed_text = compress(flag + usr_input)
        encrypted = encrypt(compressed_text)

        nonce = encrypted[:8]
        encrypted_text =  encrypted[8:]
        print(nonce)
        print(encrypted_text)
        print(len(encrypted_text))

if __name__ == '__main__':
    main()

compressed_text = compress(flag + usr_input)
encrypted = encrypt(compressed_text)

#!/usr/bin/python3 -u

import zlib
from random import randint
import os
from Crypto.Cipher import Salsa20

#flag = open("./flag").read()
flag = "picoCTF{hello}"


def compress(text):
    return zlib.compress(bytes(text.encode("utf-8")))

def encrypt(plaintext):
    secret = os.urandom(32)
    cipher = Salsa20.new(key=secret)
    c = cipher.encrypt(plaintext)
    return cipher.nonce + c

def main():
    while True:
        usr_input = input("Enter your text to be encrypted: ")
        compressed_text = compress(flag + usr_input)
        encrypted = encrypt(compressed_text)

        nonce = encrypted[:8]
        encrypted_text =  encrypted[8:]
        print(nonce)
        print(encrypted_text)
        print(len(encrypted_text))

if __name__ == '__main__':
    main()

import string
from pwn import *

conn = remote("mercury.picoctf.net", 33976)


def get_ciphertext_length(b: bytes):
    conn.recvuntil(b"Enter your text to be encrypted: ")
    conn.send(b + b"\n")
    conn.recvline()
    conn.recvline()
    return int(conn.recvline().decode().strip())


flag = b"picoCTF{"
chrs = b"{_}" + (string.ascii_lowercase + string.ascii_uppercase).encode()

from itertools import product

while True:
    try:
        l = get_ciphertext_length(flag + b"-") # There is probably no "-" in flag
        for i in chrs:
            c = bytes([i])
            b = flag + c
            if get_ciphertext_length(b) < l:
                break
        flag = flag + c
        print(flag)
        if c == b"}":
            break
    except:
        conn = remote("mercury.picoctf.net", 33976)
        

from pwn import *
import string

r = remote("mercury.picoctf.net", 61477)
r.recvuntil(b"flag: ")
flag_ct = r.recvline().decode()
r.recvline()  # n
r.recvline()  # e


def encrypt(s: str):
    r.sendlineafter(b"I will encrypt whatever you give me: ", s)
    r.recvuntil(b"Here you go: ")
    return r.recvline().decode().strip()


def get_represent(prefix: str, c: str, dt: dict):
    s = encrypt(prefix + c)
    for k in dt.keys():
        s = s.replace(k, "")
    return s


dt = {}
known = "picoCTF{"
flag = ""
for c in known:
    rp = get_represent(flag, c, dt)
    assert rp in flag_ct
    dt[rp] = c
    flag += c
    flag_ct = flag_ct.replace(rp, "")

chrs = "_}" + string.digits + string.ascii_lowercase + string.ascii_uppercase

while not flag.endswith("}"):
    for c in chrs:
        rp = get_represent(flag, c, dt)
        if not rp in flag_ct:
            continue
        dt[rp] = c
        flag += c
        flag_ct = flag_ct.replace(rp, "")
        print(flag)
        break
        

#!/usr/bin/env python3

from random import randint

with open('flag.txt', 'rb') as f:
    flag = f.read()

with open('secret-key.txt', 'rb') as f:
    key = f.read()

def encrypt(ptxt, key):
    ctxt = b''
    for i in range(len(ptxt)):
        a = ptxt[i]
        b = key[i % len(key)]
        ctxt += bytes([a ^ b])
    return ctxt

ctxt = encrypt(flag, key)

random_strs = [
    b'my encryption method',
    b'is absolutely impenetrable',
    b'and you will never',
    b'ever',
    b'ever',
    b'ever',
    b'ever',
    b'ever',
    b'ever',
    b'break it'
]

for random_str in random_strs:
    for i in range(randint(0, pow(2, 8))):
        for j in range(randint(0, pow(2, 6))):
            for k in range(randint(0, pow(2, 4))):
                for l in range(randint(0, pow(2, 2))):
                    for m in range(randint(0, pow(2, 0))):
                        ctxt = encrypt(ctxt, random_str)

with open('output.txt', 'w') as f:
    f.write(ctxt.hex())
    

#!/usr/bin/env python3

from random import randint

#with open('flag.txt', 'rb') as f:
    #flag = f.read()
flag = b'Hello'

#with open('secret-key.txt', 'rb') as f:
    #key = f.read()
key = b'123'

def encrypt(ptxt, key):
    ctxt = b''
    for i in range(len(ptxt)):
        a = ptxt[i]
        b = key[i % len(key)]
        ctxt += bytes([a ^ b])
    return ctxt

ctxt = encrypt(flag, key)

random_strs = [
    b'my encryption method',
    b'is absolutely impenetrable',
    b'and you will never',
    b'ever',
    b'ever',
    b'ever',
    b'ever',
    b'ever',
    b'ever',
    b'break it'
]

for random_str in random_strs:
    for i in range(randint(0, pow(2, 8))):
        for j in range(randint(0, pow(2, 6))):
            for k in range(randint(0, pow(2, 4))):
                for l in range(randint(0, pow(2, 2))):
                    for m in range(randint(0, pow(2, 0))):
                        ctxt = encrypt(ctxt, random_str)

print("ctxt.hex =",ctxt.hex())
#with open('output.txt', 'w') as f:
#    f.write(ctxt.hex())

def encrypt(ptxt, key):
    ctxt = b''
    for i in range(len(ptxt)):
        a = ptxt[i]
        b = key[i % len(key)]
        ctxt += bytes([a ^ b])
    return ctxt

A = 'my encryption method'
B = 'is absolutely impenetrable'
C = 'and you will never'
D = 'ever'
E = 'break it'

from random import randint
import itertools
def encrypt(ptxt, key):
    ctxt = b''
    for i in range(len(ptxt)):
        a = ptxt[i]
        b = key[i % len(key)]
        ctxt += bytes([a ^ b])
    return ctxt

key = b''
random_strs = [
    b'my encryption method',
    b'is absolutely impenetrable',
    b'and you will never',
    b'ever',
    b'break it'
]

flag_prefix = b'picoCTF{'
ctxt = '57657535570c1e1c612b3468106a18492140662d2f5967442a2960684d28017931617b1f3637'

for i in range(0,6):
    c = bytes.fromhex(ctxt)
    new_string = list(itertools.combinations(random_strs, i))
    for sub_new_string in new_string:
        for word in sub_new_string:
            c = encrypt(c, word)

        key = encrypt(c, flag_prefix)
        key = key[:len(flag_prefix)].decode()
        if key.isprintable():
            print(key)
            

Bhr~a'0R
Elrmoq<T
Bhr~a'0R
Elrmoq<T
Bhr~a'0R
Africa!A
Elrmoq<T

from random import randint
import itertools
def encrypt(ptxt, key):
    ctxt = b''
    for i in range(len(ptxt)):
        a = ptxt[i]
        b = key[i % len(key)]
        ctxt += bytes([a ^ b])
    return ctxt

key = b''
random_strs = [
    b'my encryption method',
    b'is absolutely impenetrable',
    b'and you will never',
    b'ever',
    b'break it'
]

key = b'Africa!'
ctxt = '57657535570c1e1c612b3468106a18492140662d2f5967442a2960684d28017931617b1f3637'

for i in range(0,6):
    c = bytes.fromhex(ctxt)
    new_string = list(itertools.combinations(random_strs, i))
    for sub_new_string in new_string:
        for word in sub_new_string:
            c = encrypt(c, word)

        flag = encrypt(c, key)
        flag = flag.decode()
        if flag.isprintable():
            print(flag)
            

#!/usr/bin/env python3

from Crypto.Util.number import getPrime, bytes_to_long

with open('flag.txt', 'rb') as f:
    flag = f.read()

p = getPrime(1024)
q = getPrime(1024)
r = getPrime(1024)

n1 = p * q
n2 = p * r
n3 = q * r

moduli = [n1, n2, n3]

e = 65537
c = bytes_to_long(flag)

for n in moduli:
    c = pow(c, e, n)

with open('public-key.txt', 'w') as f:
    f.write(f'n1: {n1}\n')
    f.write(f'n2: {n2}\n')
    f.write(f'n3: {n3}\n')
    f.write(f'e: {e}\n')
    f.write(f'c: {c}\n')

n1 = p * q
n2 = p * r
n3 = q * r

r = mix // n1
q = mix // n2
p = mix // n3

import libnum
import gmpy2
n1 = 15192492059814175574941055248891268822162533520576381643453916855435310880285336743521199057138647926712835561752909538944229702432795423884081992987060760867003375755338557996965825324749221386675061886921763747311599846248565297387814717840084998677273427776535730840343260681623323972936404815862969684384733188827100528542007213405382537935243645704237369770300643318878176739181891072725262069278646319502747718264711249767568106460533935904219027313131270918072460753061248221785076571054217566164086518459844527639082962818865640864990672033657423448004651989761933295878220596871163544315057550871764431562609
n2 = 15896482259608901559307142941940447232781986632502572991096358742354276347180855512281737388865155342941898447990281534875563129451327818848218781669275420292448483501384399236235069545630630803245125324540747189305877026874280373084005881976783826855683894679886076284892158862128016644725623200756074647449586448311069649515124968073653962156220351541159266665209363921681260367806445996085898841723209546021525012849575330252109081102034217511126192041193752164593519033112893785698509908066978411804133407757110693612926897693360335062446358344787945536573595254027237186626524339635916646549827668224103778645691
n3 = 16866741024290909515057727275216398505732182398866918550484373905882517578053919415558082579015872872951000794941027637288054371559194213756955947899010737036612882434425333227722062177363502202508368233645194979635011153509966453453939567651558628538264913958577698775210185802686516291658717434986786180150155217870273053289491069438118831268852205061142773994943387097417127660301519478434586738321776681183207796708047183864564628638795241493797850819727510884955449295504241048877759144706319821139891894102191791380663609673212846473456961724455481378829090944739778647230176360232323776623751623188480059886131
e = 65537
c = 5527557130549486626868355638343164556636640645975070563878791684872084568660950949839392805902757480207470630636669246237037694811318758082850684387745430679902248681495009593699928689084754915870981630249821819243308794164014262751330197659053593094226287631278905866187610594268602850237495796773397013150811502709453828013939726304717253858072813654392558403246468440154864433527550991691477685788311857169847773031859714215539719699781912119479668386111728900692806809163838659848295346731226661208367992168348253106720454566346143578242135426677554444162371330348888185625323879290902076363791018691228620744490

mix = int(gmpy2.iroot(n1 * n2 * n3, 2)[0])

r = mix // n1
q = mix // n2
p = mix // n3

phi1 = (p - 1) * (q - 1)
phi2 = (p - 1) * (r - 1)
phi3 = (q - 1) * (r - 1)

d1 = libnum.modular.invmod(e, phi1)
d2 = libnum.modular.invmod(e, phi2)
d3 = libnum.modular.invmod(e, phi3)

c = pow(c, d3, n3)
c = pow(c, d2, n2)
c = pow(c, d1, n1)
m = c

flag = libnum.n2s(m)
print(flag)