[SWPUCTF 2021 新生赛]PYRE WriteUp

Problem: [SWPUCTF 2021 新生赛]PYRE

[[toc]]

思路

RC4是对称加密，加密和解密的操作完全相同，因此使用相同的 Encrypt 函数即可解密已加密的数据。

EXP

# 题目
import hashlib
import base64


# 密钥调度
def init(a, b):
    n = 0
    b = hashlib.md5(b.encode()).hexdigest()
    m = []
    for i in range(256):
        a.append(i)
        m.append(b[i % len(b)])
    for i in range(256):
        n = (n + a[i] + ord(m[i])) % 256
        a[i], a[n] = a[n], a[i]


# 伪随机数生成
def Encrypt(a, b):
    n = c = 0
    s = ''
    for i in b:
        n = (n + 1) % 256
        c = (c + a[n]) % 256
        a[n], a[c] = a[c], a[n]
        t = chr(ord(i) ^ a[(a[n] + a[c]) % 256])
        s += t
    s = base64.b64encode(s.encode())
    return s


input_str = input('input flag pls:')
s = []
init(s, 'bJLVFYw3WI5ncGez')
if Encrypt(s, input_str).decode() == 'w4s1PUYsJ8OYwpRXVjvDkVPCgzIEJ27Dt2I=':
    print('good!')
​
            
AI代码解释
            
                
            
        

# 解密
import hashlib
import base64


# 密钥调度
def init(a, b):
    n = 0
    b = hashlib.md5(b.encode()).hexdigest()
    m = []
    for i in range(256):
        a.append(i)
        m.append(b[i % len(b)])
    for i in range(256):
        n = (n + a[i] + ord(m[i])) % 256
        a[i], a[n] = a[n], a[i]


# 伪随机数生成
def Encrypt(a, b):
    n = c = 0
    s = ''
    for i in b:
        n = (n + 1) % 256
        c = (c + a[n]) % 256
        a[n], a[c] = a[c], a[n]
        t = chr(ord(i) ^ a[(a[n] + a[c]) % 256])
        s += t
    # s = base64.b64encode(s.encode())
    return s


# 重现初始化步骤
s = []
init(s, 'bJLVFYw3WI5ncGez')

# 解码加密结果
encoded_str = 'w4s1PUYsJ8OYwpRXVjvDkVPCgzIEJ27Dt2I='
decoded_bytes = base64.b64decode(encoded_str)

# 使用 RC4 解密
decrypted_str = Encrypt(s, decoded_bytes.decode())

print(decrypted_str)
​
            
AI代码解释