E-CTF比赛 Writeup

import msoffcrypto
import io

encrypted_file = "parts.xlsx" 
password_list = "wordlist.txt"  

with open(password_list, "r", encoding="utf-8") as f:
    passwords = [line.strip() for line in f.readlines()]

for password in passwords:
    try:
        with open(encrypted_file, "rb") as file:
            office_file = msoffcrypto.OfficeFile(file)
            office_file.load_key(password=password)
            
            decrypted_file = io.BytesIO()
            office_file.decrypt(decrypted_file)
            
            print(f"成功破解密码: {password}")
            break
    except Exception:
        continue
# 成功破解密码: dolphin

from Crypto.Util.number import inverse, long_to_bytes

def rsa_decrypt(n, e, c, p):
    q = n // p
    phi_n = (p - 1) * (q - 1)
    d = inverse(e, phi_n)
    m = pow(c, d, n)
    return long_to_bytes(m).decode('utf-8')
n = 
e = 65537
c = 
p = 5054843  
plaintext = rsa_decrypt(n, e, c, p)
print("解密结果:", plaintext)
# 解密结果: ectf{b4sic_F4cT0rDb_rS4}

import secrets
import hashlib

def encryption(text):
    encrypted = []
    random = secrets.SystemRandom()

    padding_length = 256 - len(text) % 256
    raw_padding = [chr(random.randint(32, 126)) for _ in range(padding_length)]

    scrambled_padding = [chr((ord(c) * 3 + 7) % 94 + 32) for c in raw_padding]
    shifted_padding = scrambled_padding[::-1]

    padded_text = ''.join(shifted_padding) + text

    final_padded_text = ''.join(
        chr((ord(c) ^ 42) % 94 + 32) if i % 2 == 0 else c
        for i, c in enumerate(padded_text)
    )

    secret_key = str(sum(ord(c) for c in text))
    secret_key = secret_key[::-1]

    hashed_key = hashlib.sha256(secret_key.encode()).hexdigest()

    seed = int(hashed_key[:16], 16)

    random = secrets.SystemRandom(seed)

    for i, char in enumerate(text):
        char_code = ord(char)
        shift = (i + 1) * 3
        transformed = (char_code + shift + 67) % 256
        encrypted.append(chr(transformed))

    return ''.join(encrypted), seed

with open('VaultKey.txt', 'r') as f:
    text = f.read()

encrypted_text, seed = encryption(text)

with open('VaultKey_encrypted.txt', 'w') as f:
    f.write(encrypted_text)

print("The file has been successfully encrypted!")

for i, char in enumerate(text):
        char_code = ord(char)
        shift = (i + 1) * 3
        transformed = (char_code + shift + 67) % 256
        encrypted.append(chr(transformed))

    return ''.join(encrypted), seed

def decryption(encrypted_text):
    decrypted_chars = []
    for i, enc_char in enumerate(encrypted_text):
        enc_code = ord(enc_char)
        shift = 3 * (i + 1) + 67
        orig_code = (enc_code - shift) % 256
        decrypted_chars.append(chr(orig_code))
    return ''.join(decrypted_chars)

with open('VaultKey_encrypted.txt', 'r', encoding='utf-8', errors='ignore') as f:
    encrypted_text = f.read()

print(decryption(encrypted_text))

# Well done! I bet you're great at math. Here's your flag, buddy: ectf{1t_W45_ju5T_4_m1nu5}

import base64
import string

def caesar_cipher_decrypt(text, shift):
    decrypted_text = ""
    for char in text:
        if char in string.ascii_letters:
            is_upper = char.isupper()
            alphabet = string.ascii_uppercase if is_upper else string.ascii_lowercase
            new_index = (alphabet.index(char) - shift) % 26
            decrypted_text += alphabet[new_index]
        else:
            decrypted_text += char
    return decrypted_text

def try_base64_decode(text):
    try:
        decoded_data = base64.b64decode(text).decode('utf-8')
        return decoded_data
    except Exception:
        return None

cipher_text = "AEBvoE14n2JjDEhaEO5eAGnEFGdXluF2FNJxC01jXNPQX3PVl3T5oOm4DQrVXFXJGDBxEudVC3E5Xuh0oFzY"

for shift in range(26):
    decrypted_text = caesar_cipher_decrypt(cipher_text, shift)
    base64_decoded = try_base64_decode(decrypted_text)
    if base64_decoded:
        print(f"Shift: {shift}, 解码: {base64_decoded}")

# Shift: 10, 解码: ADeyMxwfsMLjPNnAgTUkMnEvT6gKMs41F7qKoryxG8LhK5SYY4gRKKKu96LtyZN

import jwt
import time

def brute_force_jwt(token):
    # header, payload, signature = token.split('.')
    
    with open("rockyou.txt", 'r', encoding='latin-1') as f:
        for line in f:
            secret = line.strip()
            try:
                decoded = jwt.decode(token, secret, algorithms=['HS256'])
                print(f"[+] Found secret key: {secret}")
                print(f"Decoded JWT: {decoded}")
                return secret
            except jwt.ExpiredSignatureError:
                print(f"[-] Expired token with key: {secret}")
                return secret
            except jwt.InvalidTokenError:
                pass
    
    print("[-] No valid secret found in wordlist.")
    return None


jwt_token = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VybmFtZSI6InVzZXIiLCJleHAiOjE3MzgzNTcwMDV9.0dmdQRyyCngN1JJTVoVVk5WYqz0I44yBvWHyUEMXTzM"

brute_force_jwt(jwt_token)

# [+] Found secret key: 1234

import zipfile
import os
import shutil
import zlib

# 定义初始zip文件路径和字典文件路径
zip_path = "Misc_5_-_dwarf_vault_200.zip"
dict_path = "rockyou.txt"
passwords = []  # 记录所有找到的密码

def brute_force_zip(zip_path, dict_path):
    try:
        with zipfile.ZipFile(zip_path, 'r') as zip_file:
            with open(dict_path, "r", encoding="latin-1") as f:
                for line in f:
                    password = line.strip().encode("latin-1")  # 转换为字节格式
                    try:
                        zip_file.extractall(pwd=password)
                        print(f"[+] 找到密码: {password.decode()}")
                        passwords.append(password.decode())

                        # 获取解压后的文件夹或文件名
                        extracted_files = zip_file.namelist()
                        return extracted_files  # 返回解压出的文件名列表
                    except (RuntimeError, zipfile.BadZipFile, zlib.error):
                        continue
        print("[-] 未找到密码，请尝试其他字典或方法。")
        return None
    except FileNotFoundError:
        print("[!] 文件未找到，请检查路径是否正确。")
        return None
    except zlib.error:
        print("[!] 遇到 zlib 解压错误，终止爆破。")
        return None

# 递归解压直到没有更多 zip 文件
def recursive_brute_force(zip_path, dict_path):
    try:
        while zip_path:
            extracted_files = brute_force_zip(zip_path, dict_path)
            if not extracted_files:
                break

            # 查找新的 ZIP 文件
            new_zip_path = None
            for file in extracted_files:
                if file.endswith(".zip"):
                    new_zip_path = file
                    break

            if new_zip_path:
                zip_path = new_zip_path  # 直接使用新找到的 ZIP 文件
            else:
                print("[!] 没有找到更多的 ZIP 文件，任务完成！")
                break
    except zlib.error:
        print("[!] 发生 zlib 错误，终止爆破。")
    finally:
        # 将所有找到的密码写入文件
        with open("found_passwords.txt", "w", encoding="utf-8") as f:
            for password in passwords:
                f.write(password + "\n")

# 运行爆破函数
recursive_brute_force(zip_path, dict_path)
print("所有找到的密码:", passwords)

#Maybe the flag was the friends we made along the way
password = " "

flag = "FAKE FLAG THIS IS NOT REAL"

def find_positions(flag, crew_list):
    positions = []
    for char in flag:
        if char == "_":
            positions.append("_")
            continue
        found = False
        for i, name in enumerate(crew_list):
            if char.lower() in name.lower():
                positions.append([i, name.lower().index(char.lower())])
                found = True
                break
        if not found:
            positions.append([None, None])
    return positions


positions = find_positions(flag, password.split())


output_text = "Mining report - flag coordinates: ectf{" + str(positions) + "}"


with open("mining_report.txt", "w") as file:
    file.write(output_text)


print("Rock and Stone! Report written to mining_report.txt:", output_text)

with open("found_passwords.txt", "r") as file:
    reversed_passwords = file.readlines()

# 去除换行符并反转列表（因为我们爆破时是从200开始的，所以这里需要反过来）
password_list = [line.strip() for line in reversed_passwords][::-1]

#txt里的内容
positions = [[0, 6], [6, 8], [4, 7], [4, 7], [15, 5], '_', 
             [0, 6], [6, 8], [4, 7], [4, 7], [15, 5], '_', 
             [0, 3], [0, 9], [1, 7], [28, 7]]

# 还原 flag
flag = ""
for pos in positions:
    if pos == "_":
        flag += "_"
    else:
        i, j = pos
        if 0 <= i < len(password_list) and 0 <= j < len(password_list[i]):
            flag += password_list[i][j]
        else:
            flag += "?"  # 标记错误或缺失数据

# 输出结果
print("flag:", "ectf{" + flag + "}")

# flag: ectf{d1ggy_d1ggy_h0l3}

import pyshark
import pyshark.packet
from binascii import unhexlify

capture = pyshark.FileCapture('justapcap.pcap', tshark_path='D:\\Program Files\\Wireshark\\tshark.exe')		# 将这个路径替换成自己电脑上tshark.exe的路径
hexstr = ""
cnt = 0
for packet in capture:
    s = str(packet)
    cur = s.split("Name:")[-1].split(".")[0].split("1m ")[1]
    hexstr += cur
hexstr = hexstr.split("exam")[0]

with open("a.png","wb") as f:
    f.write(unhexlify(hexstr))