给新生做的2025XSWCTF复现（密码篇）

题目地址：

CTFblog-challenge/2025XSWCTF at main · alexdkfighter/CTFblog-challenge
已经上传github了，如果没在群里拿到压缩包可以直接去下载。

密码题使用python做反向很常见。需要安装

pip install pycryptodome

之后即可正常使用Crypto库。

BruteForce

flag:

xswctf{go0d_job!!_m@yb3_y0u_can_be_th3_b3st}

Icemarshal师傅做的是动态的题，这里为了方便自己写了一个flag之后做成静态的了。
使用Icemarshal师傅原本的wp：

• 这里N看起来很大，但是r很小，所以 $N\% r<r$ 也很小，可以把key直接暴力枚举出来

from Crypto.Cipher import AES
from Crypto.Util.Padding import pad

c = b'S\xc1\xa9\xce\xc9\x8bf\xbc:\xf5\xc5\xa0\xea\xb1\x10>6Qd*\xca \xc0\xa8\x83\x8f\xec\x03\\X\x85\xc0\x1f\xd7\x1d\x87\xc8\x8fG\x1f@\xb2\x91v\xb0\xf9A\xc7' #此处已经替换为我做的静态

def decrypt(cipher, key):
    inv_cipher = AES.new(key, AES.MODE_ECB)
    plain = inv_cipher.decrypt(cipher)
    return plain

for r in range(0, pow(2, 25)):
    key = str(r).encode('utf-8')
    padded_key = pad(key, AES.block_size)
    flag = decrypt(c, padded_key)
    if b"xswctf{" in flag:
        print(flag)
        print(r)
        break

由于是暴力算法，运行时间在4~5分钟。

classic-cipher

flag:

XSWCTF{h0p3_v1g3n3r3_c@n_help_y0u_f1nd_th3_w4y_t0_cryptography!!}

Lst4r师傅出的题目
wp如下：
解法一：直接使用在线网站 https://www.guballa.de/vigenere-solver
解法二：使用卡方法破解

# -*- coding: utf-8 -*-
import string
from collections import Counter

table = string.ascii_lowercase
dic = {'a': 0.08167,'b': 0.01492,'c': 0.02782,'d':0.04253,'e': 0.12702,'f':0.02228,'g': 0.02015,'h':0.06094,'i':0.06966,'j':0.00153,'k':0.00772,'l':0.04025,'m':0.02406,'n':0.06749,'o':0.07507,'p':0.01929,'q':0.00095,'r':0.05987,'s':0.06327,'t':0.09056,'u':0.02758,'v':0.00978,'w':0.02360,'x':0.00150,'y':0.01974,'z':0.00074} 
#obj:待分割字符串  #sec:分割长度
ENGV = [dic[ch] for ch in table]

def transfer(plaintext):
    plain = ""
    plaintext = plaintext.lower()
    for i in plaintext:
        if i not in string.ascii_lowercase:
            continue
        else :
            plain += i
    return plain  

def split_columns(text: str, keylen: int):
    cols = ['' for _ in range(keylen)]
    for idx, ch in enumerate(text):
        cols[idx % keylen] += ch
    return cols

def freq_vec(s: str):
    n = len(s)
    if n == 0:
        return [0.0]*26
    c = Counter(s)
    return [c[table[i]]/n for i in range(26)]

def chi2_score(col_freq, shift):
    # 把列“向左”移 s，相当于解密 s；与 ENG 做 χ²
    # χ² 越小越好
    # f_dec[j] = col_freq[(j + shift) % 26]
    chi2 = 0.0
    for j in range(26):
        fj = col_freq[(j + shift) % 26]
        pj = ENGV[j]
        if pj > 0:
            chi2 += (fj - pj)**2 / pj
    return chi2

def find_key_by_chi2(text: str, keylen: int):
    key = []
    cols = split_columns(text, keylen)
    for col in cols:
        f = freq_vec(col)
        best_s, best_score = 0, float('inf')
        for s in range(26):
            sc = chi2_score(f, s)
            if sc < best_score:
                best_s, best_score = s, sc
        key.append(table[best_s])
    return ''.join(key)

def vigenere_decrypt(ciphertext, key):
    ciphertext = ciphertext.lower()
    ks = []
    plaintext = ''
    for item in key:
        ks.append(ord(item) - ord('a'))
    k = 0
    for i in range(len(ciphertext)):
        if ciphertext[i] not in string.ascii_letters:
            plaintext += ciphertext[i]
        else:
            plaintext += chr((((ord(ciphertext[i]) - ord('a')) - ks[k % len(ks)]) % 26) + ord('a'))
            k += 1
    return plaintext

if __name__ == "__main__":
    with open("./ciphertext.txt", "r", encoding="utf-8") as f:
        ciphertext = f.read()
    t = transfer(ciphertext)



    best_k = 11
    key_chi2 = find_key_by_chi2(t, best_k)

    print(f"\nChosen key length: {best_k}")
    print(f"Key by χ²  : {key_chi2}")

    plaintext = vigenere_decrypt(ciphertext, key_chi2)
    print(plaintext)

lagrange

flag:

XSWCTF{N0w_Y0u_Kn0w_Wh4t_1s_L4gr4nge_1nt3rpl4t3!!}

Lst4r师傅出的，考察拉格朗日插值
wp：
注意，此处wp需要在运行环境中安装sage。
SageMath10.x最新版安装指引 | HvAng’s Nests
可以在平时只使用Arch的wsl，也可以双wsl。

from Crypto.Util.number import *
from tqdm import *
from sage.all import *

p =  224925654846497232212407499820112116319
xs =  [136950830539213461013448512095338902852, 90645524202145747422695639082081518889, 140899520398747083503130086958862034022, 219635405929479956612898957844621342753, 44715947864542206469148126413193123214]
cs =  [166421696289478715485099892507023535788, 156829338775339856252340109700388309254, 62910648280206468904667913241458595200, 57849642653735895787492693034633523347, 63893859299010613065016621643995053951]



def lagrange(n, x_s, y_s, p):
    PR = PolynomialRing(GF(p), 'x')
    x = PR.gen()
    res = 0
    F = GF(p)
    for i in range(n):
        l_i = F(1)
        for j in range(n):
            if i != j:
                l_i *= (x - x_s[j]) * inverse_mod(x_s[i] - x_s[j], p)
        res += l_i * y_s[i]
    return res

flag_ls = lagrange(5, xs, cs, p).coefficients()
flag = b""
for num in flag_ls:
    flag += long_to_bytes(int(num))
print(flag)

Loss N-3

flag:

xswctf{I_d0n't_w@nt_to_writ3_@_n3w_fl@g}

HvAng10师傅的动态题，这里我改成静态了。
wp：

• 简单的欧拉函数运用：$\phi(p^3)=p^3-p^2$，之后就是简单的RSA解密

from Crypto.Util.number import *

e = 65537
p = 9043255064959092026084732515631745692195034110748736313755447490771387105451492272245560437914377892807962136885187274122620257191006725543923327422338691
c = 403441529001432960727362217913369803879762405978094367617279441111293546472116598049018575076717125398333703537583479674930000612995272719152694049932528591385167846813469478672307495642188629264444452496006346646420523747169746504194759029700999224478060374613522358722686409583553535755937852387788345633441836089860895701344488556941015790098196967922301993852641530947776892805401860163192390861876632786236025568386584191109995596903872325458586090366315226
# p跟c当然已经换成我写的静态

phi = p**3-p**2
d = inverse(e, phi)
flag = long_to_bytes(pow(c, d, p**3)).decode()
print(flag)

简单RSA解密是很快的，秒出答案。