# GipsyT 战队

# 一、战队信息

  • 名称:GipsyT
  • 排名:28

# 二、解题过程

题目按照顺序填写

# Web

# nisc_学校门户网站

找到登录页面 http://1.14.97.218:28261/home/login/

注册账号

登录得到 flag

# 吃豆人吃豆魂

在 index.js 中找到 flagbase 加密之后的

img

img

# Crypto

# easystream3

经过 4 次 getrandbits (8) 之后 state 重置了之后是三个 getrandbits 已知

可以爆破出 mask(非预期)有点慢

s=[189, 81, 22, 153, 205, 197, 241, 3, 18, 128, 36, 253, 5, 200, 170, 131, 25, 71, 9, 196, 164, 161, 9, 0, 7, 123, 149, 121, 32, 122, 149, 131, 170, 252, 189, 68, 162, 164, 153, 67]
b='DASCTF{'
a=[]
for i in range(len(b)):
    a.append(ord(b[i])^s[i])
print(a)
c=0b11111001000100000100010111011010
# d=100110011000001110001010
class lfsr():
    def __init__(self, seed, mask, length):
        self.length_mask = 2 ** length - 1
        self.mask = mask & self.length_mask
        self.state = seed & self.length_mask
        #print(self.state, self.mask)
    def next(self):
        next_state = (self.state << 1) & self.length_mask
        i = self.state & self.mask & self.length_mask
        output = 0
        while i != 0:
            output ^= (i & 1)
            i = i >> 1
        next_state ^= output
        self.state = next_state
        return output
    def getrandbit(self, nbit):
        output = 0
        for _ in range(nbit):
            output = (output << 1) ^ self.next()
        return output
for i in range(2**31,2**32):
    b = lfsr(c, i, 32)
    if(b.getrandbit(8)==153):
        if(b.getrandbit(8)==131):
            if(b.getrandbit(8)==138):
                print(i)
seed=2226048585
f=lfsr(c,seed,32)
for i in s:
    print(chr(f.getrandbit(8)^i),end='')
#TF{88ac22ea2ce99c7a325fe6ce2ddd3718}

# easyrsrsa1

hint:共模攻击

两次 encode 之后得到两个矩阵即可解得原矩阵

比赛时矩阵逆元没想到直接求逆。。

from gmpy2 import *
e1 = next_prime(65537)
e2 = next_prime(e1)
key1=
key2=
n= 
def egcd(a, b):
    if a == 0:
         return (b, 0, 1)
    else:
        g, y, x = egcd(b % a, a)
        return (g, x - (b // a) * y, y)
c1 = matrix(Zmod(n),key1)
c2 = matrix(Zmod(n),key2)
s = egcd(e1, e2)
s1 = s[1]
s2 = s[2]
if s1 < 0:
    s1 = - s1
    c1 = c1.inverse()
elif s2 < 0:
    s2 = - s2
    c2 = c1.inverse()
m = power_mod(c1,s1,n)*power_mod(c2,s2,n)
flag = []
for i in range(5):
    for j in range(5):
        if int(m[i][j])>1000:
             print(int(m[i][j])-n,end=' ')
        else:print(m[i][j],end=' ')

# MISC

# 好怪哦

010 打开发现他是倒的 PK

逆一下

with open("fuck.zip","rb") as f:
    a=f.read()
with open("1.zip","wb") as f1:
    f1.write(a)

解压得到 flag.png

发现他缺少头加上 png 头得到文件

改高度得到