ASISCTF2018-TheEarlySchool

Question

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
#!/usr/bin/python

from Crypto.Util.number import *
from flag import FLAG, round

def encrypt(msg):
    assert set(msg) == set(['0', '1'])
    enc = [msg[i:i+2] + str(int(msg[i]) ^ int(msg[min(i+1, len(msg)-1)])) for i in range(0, len(msg), 2)]
    return ''.join(enc)

ENC = bin(bytes_to_long(FLAG))[2:]

for _ in xrange(round):
    ENC = encrypt(ENC)

fp = open('FLAG.enc', 'w')
fp.write(long_to_bytes(int(ENC, 2)))
fp.close()

Encrypted flag:

FLAG.enc

Solution

見條script每次都係 msg[i:i+2] 再加堆奇怪野 , 咁唔理佢加咩啦
應該brute force個round就可以解得番條flag出黎

最後唔知點樣搵到個round係19

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
from Crypto.Util.number import *

round = 19

def decrypt(round):
	enc = open("FLAG.enc", "rb").read()
	enc = bin(bytes_to_long(enc))[2:]
	dec = ""
	for r in range(round):
		for i in range(0, len(enc), 3):
			dec += enc[i:i+2]
		enc = dec
		dec = ""
	return enc[:-1]

print hex(int(decrypt(round),2))[2:-1].decode('hex')

Flag

1
ASIS{50_S1mPl3_CryptO__4__warmup____}