2025-11-18-FZNCTF_WP

#!/usr/bin/env python3
# -*- coding: utf-8 -*-
# 项目改自：https://github.com/BlackCat184/Sealed-Book


import argparse
import base64
import hashlib
import os
import sys
from typing import Tuple

try:
    from Crypto.Cipher import AES
except ImportError:
    print("[错误] 需要安装 pycryptodome，请运行：pip install pycryptodome", file=sys.stderr)
    raise


DEFAULT_PASSWORD = "F.Z.N CTF"


def evp_bytes_to_key(password: bytes, salt: bytes, key_len: int, iv_len: int) -> Tuple[bytes, bytes]:
    """OpenSSL EVP_BytesToKey (MD5) 派生 key 和 iv。"""
    d = b""
    prev = b""
    while len(d) < key_len + iv_len:
        prev = hashlib.md5(prev + password + salt).digest()
        d += prev
    key = d[:key_len]
    iv = d[key_len:key_len + iv_len]
    return key, iv


def pkcs7_pad(data: bytes, block_size: int = 16) -> bytes:
    pad_len = block_size - (len(data) % block_size)
    return data + bytes([pad_len] * pad_len)


MAP_FORWARD = [
    ("e", "渺"), ("E", "莽"), ("t", "茫"), ("T", "乐"),
    ("a", "生"), ("A", "终"), ("o", "仙"), ("O", "鬼"),
    ("i", "人"), ("I", "吉"), ("n", "凶"), ("N", "清"),
    ("s", "灵"), ("S", "空"), ("h", "命"), ("H", "精"),
    ("r", "炁"), ("R", "神"), ("d", "魔"), ("D", "梵"),
    ("l", "周"), ("L", "量"), ("c", "道"), ("C", "天"),
    ("u", "地"), ("U", "荡"), ("m", "度"), ("M", "罗"),
    ("w", "色"), ("W", "元"), ("f", "始"), ("F", "玄"),
    ("g", "御"), ("G", "浩"), ("y", "劫"), ("Y", "虚"),
    ("p", "界"), ("P", "真"), ("b", "实"), ("B", "华"),
    ("v", "威"), ("V", "运"), ("k", "魂"), ("K", "魄"),
    ("j", "融"), ("J", "象"), ("x", "霄"), ("X", "冥"),
    ("q", "照"), ("Q", "净"), ("z", "微"), ("Z", "幽"),
    ("0", "观"), ("1", "陀"), ("2", "阿"), ("3", "龙"),
    ("4", "阎"), ("5", "东"), ("6", "西"), ("7", "南"),
    ("8", "北"), ("9", "玉"), ("+", "太"), ("/", "坤"), ("=", "尊"),
]


def apply_forward_mapping(s: str) -> str:
    for a, b in MAP_FORWARD:
        s = s.replace(a, b)
    return s


def seal_encrypt(plaintext: str, password: str = DEFAULT_PASSWORD) -> str:

    salt = os.urandom(8)
    key, iv = evp_bytes_to_key(password.encode("utf-8"), salt, key_len=32, iv_len=16)

    data = plaintext.encode("utf-8")
    cipher = AES.new(key, AES.MODE_CBC, iv)
    ct = cipher.encrypt(pkcs7_pad(data))

    raw = b"Salted__" + salt + ct
    b64 = base64.b64encode(raw).decode("ascii")

    assert b64.startswith("U2FsdGVkX1"), "Base64 前缀不符"
    mapped = apply_forward_mapping(b64[10:])
    return "曰：" + mapped


def main():
    parser = argparse.ArgumentParser(description="天书加密（Python）")
    parser.add_argument("--text", required=True, help="待加密明文")
    parser.add_argument("--key", default=DEFAULT_PASSWORD, help="密钥（默认 BlackCat184）")
    args, _unknown = parser.parse_known_args()

    out = seal_encrypt(args.text, args.key)
    print(out)


if __name__ == "__main__":
    main()

#!/usr/bin/env python3
# -*- coding: utf-8 -*-
# 项目改自：https://github.com/BlackCat184/Sealed-Book

import argparse
import base64
import hashlib
import sys
from typing import Tuple

try:
    from Crypto.Cipher import AES
    from Crypto.Util.Padding import unpad
except ImportError:
    print("[错误] 需要安装 pycryptodome，请运行：pip install pycryptodome", file=sys.stderr)
    raise

DEFAULT_PASSWORD = "BlackCat184"

# 与加密脚本完全对应的反向字符映射
MAP_BACKWARD = [
    ("渺", "e"), ("莽", "E"), ("茫", "t"), ("乐", "T"),
    ("生", "a"), ("终", "A"), ("仙", "o"), ("鬼", "O"),
    ("人", "i"), ("吉", "I"), ("凶", "n"), ("清", "N"),
    ("灵", "s"), ("空", "S"), ("命", "h"), ("精", "H"),
    ("炁", "r"), ("神", "R"), ("魔", "d"), ("梵", "D"),
    ("周", "l"), ("量", "L"), ("道", "c"), ("天", "C"),
    ("地", "u"), ("荡", "U"), ("度", "m"), ("罗", "M"),
    ("色", "w"), ("元", "W"), ("始", "f"), ("玄", "F"),
    ("御", "g"), ("浩", "G"), ("劫", "y"), ("虚", "Y"),
    ("界", "p"), ("真", "P"), ("实", "b"), ("华", "B"),
    ("威", "v"), ("运", "V"), ("魂", "k"), ("魄", "K"),
    ("融", "j"), ("象", "J"), ("霄", "x"), ("冥", "X"),
    ("照", "q"), ("净", "Q"), ("微", "z"), ("幽", "Z"),
    ("观", "0"), ("陀", "1"), ("阿", "2"), ("龙", "3"),
    ("阎", "4"), ("东", "5"), ("西", "6"), ("南", "7"),
    ("北", "8"), ("玉", "9"), ("太", "+"), ("坤", "/"), ("尊", "="),
]


def apply_backward_mapping(s: str) -> str:
    """将中文字符反向映射回Base64字符[3](@ref)"""
    for chinese_char, base64_char in MAP_BACKWARD:
        s = s.replace(chinese_char, base64_char)
    return s


def evp_bytes_to_key(password: bytes, salt: bytes, key_len: int, iv_len: int) -> Tuple[bytes, bytes]:
    """OpenSSL EVP_BytesToKey (MD5) 派生 key 和 iv，与加密完全一致[1,6](@ref)"""
    d = b""
    prev = b""
    while len(d) < key_len + iv_len:
        prev = hashlib.md5(prev + password + salt).digest()
        d += prev
    key = d[:key_len]
    iv = d[key_len:key_len + iv_len]
    return key, iv


def seal_decrypt(ciphertext: str, password: str = DEFAULT_PASSWORD) -> str:
    """解密天书加密的内容[1,7](@ref)"""

    if ciphertext.startswith("曰："):
        ciphertext = ciphertext[2:]

    base64_str = apply_backward_mapping(ciphertext)

    full_base64 = "U2FsdGVkX1" + base64_str

    try:
        raw_data = base64.b64decode(full_base64)
    except Exception as e:
        raise ValueError("Base64解码失败，请检查密文格式") from e

    if len(raw_data) < 16 or not raw_data.startswith(b"Salted__"):
        raise ValueError("无效的密文格式：缺少'Salted__'前缀")

    salt = raw_data[8:16]  
    encrypted_data = raw_data[16:]  


    key, iv = evp_bytes_to_key(password.encode("utf-8"), salt, key_len=32, iv_len=16)

    cipher = AES.new(key, AES.MODE_CBC, iv)
    try:
        decrypted_padded = cipher.decrypt(encrypted_data)
        decrypted = unpad(decrypted_padded, AES.block_size)
    except ValueError as e:
        raise ValueError("解密失败：可能是密码错误或密文损坏") from e

    return decrypted.decode("utf-8")


def main():
    parser = argparse.ArgumentParser(description="天书解密（Python）")
    parser.add_argument("--text", required=True, help="待解密的密文（以'曰：'开头）")
    parser.add_argument("--key", default=DEFAULT_PASSWORD, help="密钥（必须与加密时相同）")
    args = parser.parse_args()

    try:
        plaintext = seal_decrypt(args.text, args.key)
        print(f"解密结果: {plaintext}")
    except Exception as e:
        print(f"解密失败: {e}")
        sys.exit(1)


if __name__ == "__main__":
    main()

import struct

def decrypt_flag1():
    """解密第一部分flag"""
    print("=== Part 1 Decryption ===")

    # 根据flag1函数，第一部分是字符串拼接
    # f_str + l_str + open_brace + G00d_str

    # 从.data段可以推断这些字符串的内容
    # f_str 可能对应 "f" 或 "flag"
    # l_str 可能对应 "l" 或 "lag"
    # open_brace 可能是 "{"
    # G00d_str 是 "G00d!!!"

    # 常见的flag开头是 "flag{"
    part1 = "flag{G00d!!!"
    print(f"Part 1: {part1}")
    return part1

def decrypt_flag2():
    """解密第二部分flag"""
    print("\n=== Part 2 Decryption ===")

    # 根据flag2函数，从get_data获取数据并重组
    data_values = [
        get_data(0),  # 1999654495
        get_data(1),  # 1429240159
        get_data(2),  # 1849713503
        get_data(3)   # 95
    ]

    print(f"Data values: {[hex(x) for x in data_values]}")

    # 将每个32位整数拆分为4个字节
    Str2 = []
    v18 = 0

    for value in data_values:
        # 拆分为字节: [b0, b1, b2, b3]
        bytes_list = [
            value & 0xFF,           # v15 - 最低字节
            (value >> 8) & 0xFF,    # v14
            (value >> 16) & 0xFF,   # v13
            (value >> 24) & 0xFF    # v12 - 最高字节
        ]

        print(f"Value {hex(value)} -> bytes: {[hex(b) for b in bytes_list]}")

        # 按顺序添加到Str2
        for byte in bytes_list:
            if v18 <= 12:
                Str2.append(byte)
                v18 += 1

    # 转换为字符串
    part2 = ""
    for byte in Str2:
        if 32 <= byte <= 126:
            part2 += chr(byte)
        else:
            part2 += f"\\x{byte:02x}"

    print(f"Part 2 bytes: {[hex(b) for b in Str2]}")
    print(f"Part 2: {part2}")

    # 尝试ASCII显示
    ascii_part2 = ""
    for byte in Str2:
        if 32 <= byte <= 126:
            ascii_part2 += chr(byte)
        else:
            ascii_part2 += "?"

    print(f"Part 2 (ASCII): {ascii_part2}")

    return ascii_part2

def get_data(index):
    """模拟get_data函数"""
    if index == 3:
        return 95
    elif index == 2:
        return 1849713503
    elif index == 0:
        return 1999654495
    elif index == 1:
        return 1429240159
    else:
        return 0

def decrypt_flag3():
    """解密第三部分flag - 使用正确的随机种子"""
    print("\n=== Part 3 Decryption ===")

    encrypted_part3 = [0xCD, 0xCE, 0xD0, 0x58, 0x5D, 0x92, 0x42, 0xB1, 0x7C, 0xA9, 0xFF]

    # 尝试不同的随机种子
    seeds_to_try = [0x1337, 0x1234, 0xDEAD, 0xBEEF, 0xCAFE, 0x1337C0DE, 0, 1, 1337]

    for seed in seeds_to_try:
        random.seed(seed)
        rand_sequence = [random.randint(0, 255) & 0xFF for _ in range(len(encrypted_part3))]

        decrypted = []
        for i in range(len(encrypted_part3)):
            decrypted_byte = encrypted_part3[i] ^ rand_sequence[i]
            decrypted.append(decrypted_byte)

        # 检查是否都是可打印ASCII
        all_printable = all(32 <= byte <= 126 for byte in decrypted)

        if all_printable:
            part3 = ''.join(chr(b) for b in decrypted)
            print(f"Found valid Part 3 with seed {hex(seed)}: {part3}")
            return part3

    # 如果没有找到完全可打印的，显示最可能的结果
    print("No fully printable sequence found. Trying seed 0x1337 (common CTF seed):")
    random.seed(0x1337)
    rand_sequence = [random.randint(0, 255) & 0xFF for _ in range(len(encrypted_part3))]

    decrypted = []
    for i in range(len(encrypted_part3)):
        decrypted_byte = encrypted_part3[i] ^ rand_sequence[i]
        decrypted.append(decrypted_byte)

    part3 = ''.join(chr(b) if 32 <= b <= 126 else f'\\x{b:02x}' for b in decrypted)
    ascii_part3 = ''.join(chr(b) if 32 <= b <= 126 else '?' for b in decrypted)

    print(f"Part 3 bytes: {[hex(b) for b in decrypted]}")
    print(f"Part 3: {part3}")
    print(f"Part 3 (ASCII): {ascii_part3}")

    return ascii_part3

def combine_flag():
    """组合完整的flag"""
    print("\n" + "="*50)
    print("COMBINING COMPLETE FLAG")
    print("="*50)

    part1 = decrypt_flag1()
    part2 = decrypt_flag2()
    part3 = decrypt_flag3()

    print(f"\n=== FINAL FLAG ===")
    print(f"Part 1: {part1}")
    print(f"Part 2: {part2}")
    print(f"Part 3: {part3}")

    # 组合flag格式: flag{part1_part2_part3}
    # 但根据flag1，part1已经包含 "flag{" 开头
    final_flag = f"{part1}_{part2}_{part3}"
    print(f"\nFINAL FLAG: {final_flag}")

# 重新导入random
import random

if __name__ == "__main__":
    combine_flag()

import gmpy2
from Crypto.Util.number import long_to_bytes

n = 20116181115185256137151544962617461969127485079539874123483790179691451026659727409952002522890170053136432251484598758202749921581090222404128778286934496528266389586853622784941814905724374659722595150921699219297623333597701057604954651692729250881800409786303147914726282180533059864870515367790648247781809163302813093152120079755029826297153011886828297246071460547641705486357297417233767122432498694486964352342801912061641754894572829465334992075139630449930115173945624459850685926333265959551792326024379566586598102224813413893610109613076229994854338779713676554568790353735720642800095499489845542499243
c1 = 12574615186232508658058781239986357997690221455470707882708919538344867889046756940392586425215083828833917124513057649780713973391884806015516720789553246206689136824212927709627728801288304629797527956697243414600762350309939098109707454770146886759387428373061131102235552303687641823437812335805429238591967849935403611629054866383093303269886760991083623181420555220699498615783586898665752705379697907365417049724321589193519522361497873285356095894318360385694468646045503420079559869794438944147268173957051158766280963203638656844473553699835099487100606197891044561669390594778573658401240732422863142027023
c2 = 8662571349644155432847824828393121776098409938437916669251107156874603954233944520039184762114790042807930511195272715449923236367967421315595229284040395158368328305331059953339506075385510377512416235056474493145376149687125036012499178684540639274797034307771820863938251633851132423882652884158338847776108707048056678532767030904154141724336547346190841924329986431350894721191694788035732072169271856487733779585742838903331792853668246043440328934976370767441620664696662437609635592559825455438053522844176591659902503216608366261175995953153271651775486985191394510128456927543378761783994086684673696547021

e1 = 65537
e2 = 2333

# 使用扩展欧几里得算法找到 s 和 t，使得 e1*s + e2*t = gcd(e1, e2) = 1
g, s, t = gmpy2.gcdext(e1, e2)

# 根据 s 和 t 的符号计算 m
if s < 0:
    part1 = pow(gmpy2.invert(c1, n), -s, n)
else:
    part1 = pow(c1, s, n)

if t < 0:
    part2 = pow(gmpy2.invert(c2, n), -t, n)
else:
    part2 = pow(c2, t, n)

m = (part1 * part2) % n

# 将明文转换为字节串
flag = long_to_bytes(m)
print(flag.decode())