[SWPUCTF 2021 新生赛]简简单单的解密

nssctf

先看题目给的python源码

点击查看代码

import base64,urllib.parse
key = "HereIsFlagggg"
flag = "xxxxxxxxxxxxxxxxxxx"

s_box = list(range(256))
j = 0
for i in range(256):
    j = (j + s_box[i] + ord(key[i % len(key)])) % 256
    s_box[i], s_box[j] = s_box[j], s_box[i]
res = []
i = j = 0
for s in flag:
    i = (i + 1) % 256
    j = (j + s_box[i]) % 256
    s_box[i], s_box[j] = s_box[j], s_box[i]
    t = (s_box[i] + s_box[j]) % 256
    k = s_box[t]
    res.append(chr(ord(s) ^ k))
cipher = "".join(res)
crypt = (str(base64.b64encode(cipher.encode('utf-8')), 'utf-8'))
enc = str(base64.b64decode(crypt),'utf-8')
enc = urllib.parse.quote(enc)
print(enc)
# enc = %C2%A6n%C2%87Y%1Ag%3F%C2%A01.%C2%9C%C3%B7%C3%8A%02%C3%80%C2%92W%C3%8C%C3%BA

根据源码，可以大致看出，经过两个for循环，改变了s_box列表的值。

cipher="".join(res)是把异或后的值变为字符串，
crypt是对字符串进行utf-8编码然后base64加密,然后进行解密。
最后对enc进行urllib.parse.quote(enc)操作

然后开始逆

urllib.parse.quote也是一种编码方式，他的逆是urllib.parse.unquote

对于它的逆向则是把编码之后的enc进行反编码urllib.parse.unquote，然后在用k与反编码后的字符串进行异或即可得到flag

点击查看代码

import base64,urllib.parse
enc = "%C2%A6n%C2%87Y%1Ag%3F%C2%A01.%C2%9C%C3%B7%C3%8A%02%C3%80%C2%92W%C3%8C%C3%BA"
key = "HereIsFlagggg"
flag = ''
enc = urllib.parse.unquote(enc)
s_box = list(range(256))
j = 0
for i in range(256):
    j = (j + s_box[i] + ord(key[i % len(key)])) % 256
    s_box[i], s_box[j] = s_box[j], s_box[i]
i = j = 0
for s in enc:
    i = (i + 1) % 256
    j = (j + s_box[i]) % 256
    s_box[i], s_box[j] = s_box[j], s_box[i]
    t = (s_box[i] + s_box[j]) % 256
    k = s_box[t]
    flag += (chr(ord(s)^k))
print(flag)

flag如下

NSSCTF{REAL_EZ_RC4}

参考：https://blog.csdn.net/weixin_61154173/article/details/127455158