题目还算比较简单吧

MISC

Pokémon

找个GBA模拟器玩游戏，到103街道，发现flag

flag{PokEmon_14_CutE}

code obfuscation

给了张二维码，扫描不了，直接手动复原：https://merricx.github.io/qrazybox/

扫描得到base(gkctf)

然后base家族一个一个的试，最后发现是base58：CfjxaPF

解出一张图片和一段杂乱的js代码,https://tool.lu/js/美化并解密

for n in a b c d e f g h i j k l m n o p q r s t u v w x y z do eval An = "n"
done
for n in A B C D E F G H I J K L M N O P Q R S T U V W X Y Z do eval An = "n"
done num = 0
for n in a b c d e f g h i j do eval Bn = "n"
num = $((num + 1))
done alert("Bk=' ';Bm='"';Bn='#';Bs='(';Bt=')';By='.';Cb='';Cc='<';Ce='>';Cl='_';Cn='{';Cp='}';Da='0';Db='1';Dc='2';Dd='3';De='4';Df='5';Dg='6';Dh='7';Di='8';Dj='9';")

python脚本

import string
s = "$Bn$Ai$An$Ac$Al$Au$Ad$Ae$Bk$Cc$As$At$Ad$Ai$Ao$By$Ah$Ce$Ai$An$At$Bk$Am$Aa$Ai$An$Bs$Bt$Cn$Ap$Ar$Ai$An$At$Bs$Bm$Aw$Dd$Al$Ac$Da$Am$Ae$Cl$De$Ao$Cl$Dj$Ak$Ac$At$Df$Bm$Bt$Cb$Ar$Ae$At$Au$Ar$An$Bk$Da$Cb$Cp"
ll = s.split('$')
list1 = ['Bk','Bm','Bn','Bs','Bt','By','Cb','Cc','Ce','Cl','Cn','Cp','Da','Db','Dc','Dd','De','Df','Dg','Dh','Di','Dj']
list2 = [' ','"','#','(',')','.','','<','>','_','{','}','0','1','2','3','4','5','6','7','8','9']
list3 = []
list4 = []
s = string.ascii_lowercase
for i in s:
	list3.append('A%s'%i)
	list4.append(i)
#print(list3,'\n',list4)

t = ''
for i in range(0,len(ll)):
	for j in range(0,len(list1)):
		if ll[i]==list1[j]:
			t += list2[j]
	for k in range(0,len(list3)):
		if ll[i]==list3[k]:
			t +=list4[k]
print(t)

1	#include <stdio.h>int main(){print("w3lc0me_4o_9kct5")return 0}

flag:flag{w3lc0me_4o_9kct5}

Harley Quinn

将音频后面的电话音剪出来，使用dtmf2num.exe识别

识别出：222833344477773338866

九键密码：ctfisfun

然后下载FreeFileCamouflage

输入密码和图片地址得到flag

flag{Pudd1n!!_y0u_F1nd_m3!}

Sail a boat down the river

下载得到一个视频和加密的rar文件

视频打开中间一段明显有个二维码，扫描是一个网盘链接

https://pan.baidu.com/s/1tygt0Nm_G5fTfVFlgxVcrQ

密码是视频里摄像头的闪光（这真没想到）

-.--/.--/---../--.

得到密码：yw8g

下载得到数独，在线解

0 8 1 7 4 0 0 0 0
3 0 2 0 6 8 0 0 0
4 0 6 5 0 0 8 2 0
0 3 0 0 0 0 0 5 6
7 0 4 3 0 9 2 0 1
1 2 0 0 0 0 0 4 0
0 5 9 0 0 4 1 0 8
0 0 0 1 8 0 9 0 2
0 0 0 0 9 7 4 6 0

密文:
efb851bdc71d72b9ff668bddd30fd6bd
密钥:
第一列九宫格从左到右从上到下

得到密钥：52693795149137

AES中hex解密得到GG0kc.tf

解压rar文件得到逆光 vocal.ovex文件

使用Overture 5打谱软件打开，在歌词里看到flag

flag{gkctf_is_fun}

CRYPTO

小学生的密码学

1
2
3

e(x)=11x+6(mod26)
密文：welcylk
（flag为base64形式）

仿射密码：http://ctf.ssleye.com/affine.html

然后base64一下，得到flag{c29yY2VyeQ==}

汉字的秘密

当铺密码，按照汉字出头的个数来答题数字，例

1	田：0 由：1 王：6 壮：9

翻译过来是：

69 74 62 67 118 83 72 77 86 55 71
E  J  >  C  v   S  H  M  V  7  G
57 82 57 62 63 51 107
9  R  9  >  ?  3  k

然后就是变种凯撒

n = [69,74,62,67,118,83,72,77,86,55,71,57,82,57,64,63,51,107]
s=""
j = 1
for i in range(len(n)):
    s+=chr(n[i]+j)
    j+=1
print s

flag{you_are_good}

babycrypto

百度一下得知，强网杯原题，是已知p的高位，得到p的位

需要使用sage,sage安装：https://blog.csdn.net/vanarrow/article/details/106051909

n = 0xb119849bc4523e49c6c038a509a74cda628d4ca0e4d0f28e677d57f3c3c7d0d876ef07d7581fe05a060546fedd7d061d3bc70d679b6c5dd9bc66c5bdad8f2ef898b1e785496c4989daf716a1c89d5c174da494eee7061bcb6d52cafa337fc2a7bba42c918bbd3104dff62ecc9d3704a455a6ce282de0d8129e26c840734ffd302bec5f0a66e0e6d00b5c50fa57c546cff9d7e6a978db77997082b4cb927df9847dfffef55138cb946c62c9f09b968033745b5b6868338c64819a8e92a827265f9abd409359a9471d8c3a2631b80e5b462ba42336717700998ff38536c2436e24ac19228cd2d7a909ead1a8494ff6c3a7151e888e115b68cc6a7a8c6cf8a6c005L
p_fake = 0xe4e4b390c1d201dae2c00a4669c0865cc5767bc444f5d310f3cfc75872d96feb89e556972c99ae20753e3314240a52df5dccd076a47c6b5d11b531b92d901b2b512aeb0b263bbfd624fe3d52e5e238beeb581ebe012b2f176a4ffd1e0d2aa8c4d3a2656573b727d4d3136513a931428b00000000000000000000000000000000L

pbits = 1024  
kbits = 128
pbar = p_fake & (2^pbits-2^kbits)  
print ("upper %d bits (of %d bits) is given" % (pbits-kbits, pbits))
   
PR.<x> = PolynomialRing(Zmod(n))  
f = x + pbar  
x0 = f.small_roots(X=2^kbits, beta=0.4)[0]  # find root < 2^kbits with factor >= n^0.3  
p = int(x0 + pbar)
print('p=',p)

得到p，然后就简单了

import gmpy2
import libnum
n = 0xb119849bc4523e49c6c038a509a74cda628d4ca0e4d0f28e677d57f3c3c7d0d876ef07d7581fe05a060546fedd7d061d3bc70d679b6c5dd9bc66c5bdad8f2ef898b1e785496c4989daf716a1c89d5c174da494eee7061bcb6d52cafa337fc2a7bba42c918bbd3104dff62ecc9d3704a455a6ce282de0d8129e26c840734ffd302bec5f0a66e0e6d00b5c50fa57c546cff9d7e6a978db77997082b4cb927df9847dfffef55138cb946c62c9f09b968033745b5b6868338c64819a8e92a827265f9abd409359a9471d8c3a2631b80e5b462ba42336717700998ff38536c2436e24ac19228cd2d7a909ead1a8494ff6c3a7151e888e115b68cc6a7a8c6cf8a6c005L
p = 0xe4e4b390c1d201dae2c00a4669c0865cc5767bc444f5d310f3cfc75872d96feb89e556972c99ae20753e3314240a52df5dccd076a47c6b5d11b531b92d901b2b512aeb0b263bbfd624fe3d52e5e238beeb581ebe012b2f176a4ffd1e0d2aa8c4d3a2656573b727d4d3136513a931428b92826225b6d0e735440b613a8336ffa3
q = n/p
e = 65537
c = 1422566584480199878714663051468143513667934216213366733442059106529451931078271460363335887054199577950679102659270179475911101747625120544429262334214483688332111552004535828182425152965223599160129610990036911146029170033592055768983427904835395850414634659565092191460875900237711597421272312032796440948509724492027247376113218678183443222364531669985128032971256792532015051829041230203814090194611041172775368357197854451201260927117792277559690205342515437625417792867692280849139537687763919269337822899746924269847694138899165820004160319118749298031065800530869562704671435709578921901495688124042302500361
phi = (p-1)*(q-1)
d = gmpy2.invert(e,phi)
m = pow(c,d,n)
print libnum.n2s(m)

flag{3d0914a1-1e97-4822-a745-c7e20c5179b9}

Backdoor

下载得到加密脚本，公钥以及密文

将公钥提取出来，可以分解n

import gmpy2
import base64
import libnum
cipher="MDIxNDJhZjdjZTcwZmUwZGRhZTExNmJiN2U5NjI2MDI3NGVlOTI1MmE4Y2I1MjhlN2ZkZDI5ODA5YzJhNjAzMjcyN2MwNTUyNjEzM2FlNDYxMGVkOTQ0NTcyZmYxYWJmY2QwYjE3YWEyMmVmNDRhMg=="
c=base64.b64decode(cipher)
print c
c = 0x02142af7ce70fe0ddae116bb7e96260274ee9252a8cb528e7fdd29809c2a6032727c05526133ae4610ed944572ff1abfcd0b17aa22ef44a2
n = 15518961041625074876182404585394098781487141059285455927024321276783831122168745076359780343078011216480587575072479784829258678691739
p = 3386619977051114637303328519173627165817832179845212640767197001941
q = 4582433561127855310805294456657993281782662645116543024537051682479
e = 65537
phi = (p-1) * (q-1)
d = gmpy2.invert(e,phi)
m = pow(c, d, n)
print libnum.n2s(m)

flag{760958c9-cca9-458b-9cbe-ea07aa1668e4}

SCERush's Blog

GKCTF2020wp