【春秋云实企安殿】听说是rc4算法 - Misc - 10pt
题目信息解题思路
三个关键点：
密文：UUyFTj8PCzF6geFn6xgBOYSvVTrbpNU4OF9db9wMcPD1yDbaJw==
Key：welcometoicqedu
提示：使用 RC4 算法
在第一次尝试用普通 RC4 解密时，得到的是乱码或不可读数据或无法解码。
CTF 常用“随机 salt + hash key + RC4/Stream cipher + Base64”模式
看到密文是 Base64，并且普通 RC4 失败 → 很可能有 salt 或 key 派生
# -*- coding: utf-8 -*-
import base64
from hashlib import sha1
def rc4(data: bytes, key: bytes) -> bytes:
"""RC4 algorithm, works with bytes"""
S = list(range(256))
j = 0
# KSA
for i in range(256):
j = (j + S + key) % 256
S, S = S, S
# PRGA
i = j = 0
out = bytearray()
for byte in data:
i = (i + 1) % 256
j = (j + S) % 256
S, S = S, S
K = S[(S + S) % 256]
out.append(byte ^ K)
return bytes(out)
def tdecode(data: str, key: str, salt_length: int = 16) -> bytes:
"""
RC4 decryption for data encrypted with random salt + Base64
"""
# Base64 decode
data_bytes = base64.b64decode(data)
# Extract salt
salt = data_bytes[:salt_length]
# RC4 key: sha1(key + salt)
rc4_key = sha1(key.encode('utf-8') + salt).digest()
# Decrypt
plaintext = rc4(data_bytes, rc4_key)
return plaintext
if __name__ == "__main__":
# 待解密 Base64 密文
cipher_b64 = "UUyFTj8PCzF6geFn6xgBOYSvVTrbpNU4OF9db9wMcPD1yDbaJw=="
# 密钥
key = "welcometoicqedu"
# 解密
plaintext = tdecode(cipher_b64, key)
print("明文（HEX）：", plaintext.hex())
try:
print("明文（ASCII）：", plaintext.decode('utf-8'))
except UnicodeDecodeError:
print("明文无法直接用 UTF-8 显示，可能是二进制数据")
页:
[1]