0%

某解谜游戏思路

题目来源: https://gist.github.com/zealic/38510fd8ecd1be75924a#file-email-L13
本答案保证可用时间截止于 2018-11-2

第一题

1
2
3
4
5
6
7
8
9
10
11
12
13
begin 777 portal.bin
M(R!796QC;VUE#0H-"B,C($ME>0T*#[email protected]'5B;&EC($ME>[email protected]*$XL(#<I
M#0I.(#[email protected],C,S("[email protected]*32!I<R!T:&[email protected])E871E<[email protected]]U<BUD:6=I="!P
M<FEM92!T:&%T(&UA:V5S([email protected]('=I=&@@,C,S#0H-"B,C($5N8W)Y<'1E
M9"!!=61I="!142!G<F]U<"!N=6UB97(-"@T*5&AE($%U9&ET(%%1(&=R;W5P
M(&YU;6)E<B!I<R!E;F-R>[email protected]=VET:"!T:&[email protected]*[email protected]'5B;&EC($ME
M>[email protected]*#[email protected]&`-"D-/3D-!5"A$14-265!4*#$Y-S,W,BDN=&]3=')I;F<H
M*[email protected]$5#4EE05"@S,S,P-SDI+G1O4W1R:6YG*"DI#[email protected]&`-"@T*(R!#05!4
M0TA!#0I5<[email protected]=&AI<R!G:7-T(')E=FES:6]N(&`W9#(S939E.3DY-&)B-F9A
[email protected]&1A8C,U930V9F0W-6(Y9&0Q-6)E8"!R97-U;'[email protected],@0T%05$-(02X-
!"@``
`
end


解谜提示:UUEncode
解谜工具网址:http://web.chacuo.net/charsetuuencode

解谜结果

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
# Welcome

## Key

RSA Public Key: (N, 7)
N = 233 * M
M is the greatest four-digit prime that makes N end with 233

## Encrypted Audit QQ group number

The Audit QQ group number is encrypted with the **RSA Public Key**.

CONCAT(DECRYPT(197372).toString(), DECRYPT(333079).toString())


# CAPTCHA
Use this gist revision `7d23e6e9994bb6fae874dab35e46fd75b9dd15be` result as CAPTCHA.

第二题

RSA 公钥:(N, 7)
N = 233 * M

M 是使 N 以 233 结尾的最大质数

群号为 CONCAT(DECRYPT(197372).toString(), DECRYPT(333079).toString())

解谜工具

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
def is_prime(n):
if n == 2 or n == 3: return True
if n < 2 or n%2 == 0: return False
if n < 9: return True
if n%3 == 0: return False
r = int(n**0.5)
f = 5
while f <= r:
if n%f == 0: return False
if n%(f+2) == 0: return False
f +=6
return True

for m in range(9999, 999, -1):
n = 233 * m
if str(n).endswith('233'):
if is_prime(m):
print(m, n)
break

结果:m = 9001, n = 2097233

参考 RSA 算法原理 可知上述 RSA 算法因子 p=233, q=9001, n=p*q=2097233, φ(n)=(p-1)*(q-1)=2088000, e=7

求解 d 算法

1
2
3
4
5
6
7
8
9
10
# ed ≡ 1 (mod φ(n))
# ed - 1 = kφ(n)
e = 7
fai_n = 2088000
d = 0
while True:
d += 1
if (e * d - 1) % fai_n == 0:
print(d)
break

解出 d=1193143

因此公钥:(2097233, 7) 私钥:(2097233, 1193143)

求解算法

1
2
3
4
d = 1193143
n = 2097233
def decrypt(num):
return num ** d % n

解得 decrypt(197372) = 378, decrypt(333079) = 390696

所以群号:378390696

第三题

验证码

使用 7d23e6e9994bb6fae874dab35e46fd75b9dd15be 版本的求解结果作为验证信息

直接访问网址 https://gist.github.com/zealic/38510fd8ecd1be75924a/7d23e6e9994bb6fae874dab35e46fd75b9dd15be 签出版本即可获取以下信息

1
2
3
4
5
6
7
8
9
10
11
12
13
14
begin 644 questions.bin
M_3=Z6%H```3FUK1&`@`A`1P````0SUC,X`(/`9]=`!N.;&N&K&,WE,:Z:&"_
M.H>=//80*Y./YOI$*@LU"[email protected]/%]Q<;1CEUQGGILPN<FARF"\H=E]C1
MJRI$35+PQD[7(+3PY9FD#83:F6KV\4:2WEF/"4+3Y-I6/0:5C!ITP9<;<6"'
M&6XR!BTZ#7+J(6M`(SWW(/"971/.Z*8!9]T][-"[email protected]\M+-#:QA'1/R"#
M&\O9AQ>!_EKD0\[2%L*[SR45;._(;/'.L+0%WL5XR$WL,4GXQ9G<RBA+1<:E
M.AI%Z:CA$8YH^-90T]PER65PZ#8HTN2C!<CO1>(:[@&;1Y'0Z"0*P940A,:9
M$W&7+NJ+YL#DXZ9WD,M<\EAN(""<3<A4*7,SQLQ=5D/B>N=<!>IKT1-(7(,%
MN[*!#TA?04GTUO7L#<?A^Y2QA;WHS`Q+<_7S;L9P`!S3+[`RM?D7;$YYV,K5
M?8IH&VQ-Y"=\5W,IVWCWZI1$G8]O%LGAJNUS=B`<#$*NH:\@G:.=W%2ARZY!
MB'LV(`$:##;*RSA2)::'Q,SR51I5<Y<IX\7R.$3?VN*SSUS>1+!+=,0``")$
>@7M0Y!TN``&[`Y`$``##!+%.L<1G^P(`````!%E:
`
end

很明显又是 UUEncode,但是这次不是纯文本文件了,因此使用 Python 模块解码

将文件存为 questions.uu

1
2
import uu
uu.decode('questions.uu')

解码后的文件会自动保存为 questions.bin

使用 magic 模块判断这个文件类型

1
2
3
4
import magic
with open('questions.bin', 'rb') as f:
data = f.read()
print(magic.from_buffer(data))


返回 XZ compressed data 也就是这个文件是 xz 格式,因此将这个文件重命名为 questions.xz ,使用 xz -d questions.xz 解压

第四题

得到结果

1
2
3
4
5
6
7
8
79955ff7576a0f5a167b3ccb506bed3a d46b6f8c1ea3b812c2bba0edc0e63c85 | Roman Hitman
================================================================
H4sIAAAAAAACA1WPT0+DQBDF7/spRgTttbRsZRPZ1d1Fwg0OBYKEhWqMlwZBqjaF
z+7Win8ylzeT95u8F8Otj4UkjIrCcxCKYzCmA0KqAMvFYFMRYA6SwTVZ4RykvvmU
3GEu9GZTB7DWoXQJvdqi6gRJTKULPVkwai+XBKjvLTDforqAeTsObWMlnS1x0XPm
7XEYMO4k0a6fgcBU6N/g2GGUFj3jni2T6HDouiiH6N0c758eSxWlOXzxAwt+TF3n
edr0z5bOdSv4YITChYkMA3ac+TfPKDuJ71xABGTZlKuuFIxq87CBF1XqUapMs0wj
l5iTVQhtc2a1b80Rmrqs9+scmsGcvZ4nhkp/dfVH18c0n2XEkwVzAQAA

猜测 == 上面为两个 md5,下面为 base64

通过在线 base64 解密工具可知这是一个二进制文件,因此通过 Python 解密并存储至 wtf.bin

1
2
3
4
5
6
7
8
9
import base64
s = '''H4sIAAAAAAACA1WPT0+DQBDF7/spRgTttbRsZRPZ1d1Fwg0OBYKEhWqMlwZBqjaF
z+7Win8ylzeT95u8F8Otj4UkjIrCcxCKYzCmA0KqAMvFYFMRYA6SwTVZ4RykvvmU
3GEu9GZTB7DWoXQJvdqi6gRJTKULPVkwai+XBKjvLTDforqAeTsObWMlnS1x0XPm
7XEYMO4k0a6fgcBU6N/g2GGUFj3jni2T6HDouiiH6N0c758eSxWlOXzxAwt+TF3n
edr0z5bOdSv4YITChYkMA3ac+TfPKDuJ71xABGTZlKuuFIxq87CBF1XqUapMs0wj
l5iTVQhtc2a1b80Rmrqs9+scmsGcvZ4nhkp/dfVH18c0n2XEkwVzAQAA'''
with open('wtf.bin', 'wb') as f:
f.write(base64.b64decode(s))

通过 magic 模块可知文件类型为 gzip compressed data, max compression, from Unix.gz 压缩文件,因此将至改名为 wtf.gz 后解压

1
gzip -d wtf.gz

得到 wtf 文件,打开看,乱码😒

上面的明文提示「Roman Hitman」,搜索找到了 这个网站

欢迎关注我的其它发布渠道