AIS3 2018 - Blind (Misc, 4)

Challenge

這是一個猜數字的題目,你送出去的東西,他會幫你用 AES.CBC decrypt.

因為不知道 key,密文解密成什麼已經不重要了,我不會知道

還好 iv 可以自己控制,iv 能幹嘛?

他會幫我 xor 我被解密的亂數呀。

能做的就是好好控制 iv ,測試我 “被解密的亂數” 跟 “正確答案” 哪顆 bit 不一樣,要不要翻過來

1bit 1bit 測試,看翻了是變大還是變小,來推測這顆該不該翻

怎麼樣知道自己翻對?

  1. 假設我翻了第一顆,不管狀態有沒有變,先把狀態記錄下來:
    • 亂翻後面的 bit 狀態如果又變了一次: 翻對
    • 亂翻後面的 bit ,狀態都不變: 翻錯

那要怎麼亂翻?

  1. 全部試一遍,一定會對: 100%
    • 翻不完,有 21282^{128} 個要翻
  2. 一顆一顆翻過去,但是遇到插隊的就錯了 QwQ :
    • 正確 (server端) vs 解密的亂數(要翻的)
    • 1111111111... vs 0000000011... 可以,翻過去狀態會變
    • 1111111110... vs 0001000011... 死,怎麼翻都不鳥你 …
  3. 反序,測試兩排 … :
    • 如果有兩顆錯開,照樣翻到死也不理你

最後想到,如果我每翻了一顆 MSB,我把後面7顆 brute force 有變就是翻對 “繼續”,沒變就是不用翻 “繼續”

因為如果連續 8 顆以上 MSB 是1 的機率很小,發生了 … 我就從算POW嘛!!!生氣 …

緊張的看著他一顆一顆翻過去 …

# b'===== Welcome to number game ====='
# b'Too big\n'
# 0 00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
# b'Too big\n'
# 1 00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
# b'Too big\n'
# 2 00100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
# b'Too big\n'
# 3 00110000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
# b'Too big\n'
# 4 00110000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
# b'Too big\n'
# 5 00110100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
# b'Too small\n'
# 6 00110100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
# b'Too small\n'
# 7 00110100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
# b'Too small\n'
# 8 00110100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
# b'Too small\n'
# 9 00110100010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
# b'Too small\n'
# 10 00110100010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
# b'Too small\n'
# 11 00110100010100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
# b'Too big\n'
# 12 00110100010110000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
# b'Too big\n'
# 13 00110100010110000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
# b'Too big\n'
# 14 00110100010110100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
# b'Too big\n'
# 15 00110100010110100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
# b'Too big\n'
# 16 00110100010110101000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
# b'Too small\n'
# 17 00110100010110101000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
# b'Too small\n'
# 18 00110100010110101000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
# b'Too small\n'
# 19 00110100010110101000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
# b'Too small\n'
# 20 00110100010110101000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
# b'Too small\n'
# 21 00110100010110101000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
# b'Too small\n'
# 22 00110100010110101000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
# b'Too small\n'
# 23 00110100010110101000001100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
# b'Too small\n'
# 24 00110100010110101000001110000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
# b'Too big\n'
# 25 00110100010110101000001110000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
# b'Too big\n'
# 26 00110100010110101000001110100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
# b'Too small\n'
# 27 00110100010110101000001110100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
# b'Too small\n'
# 28 00110100010110101000001110101000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
# b'Too big\n'
# 29 00110100010110101000001110101100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
# b'Too small\n'
# 30 00110100010110101000001110101100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
# b'Too small\n'
# 31 00110100010110101000001110101100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
# b'Too small\n'
# 32 00110100010110101000001110101100100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
# b'Too big\n'
# 33 00110100010110101000001110101100110000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
# b'Too big\n'
# 34 00110100010110101000001110101100110000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
# b'Too big\n'
# 35 00110100010110101000001110101100110100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
# b'Too big\n'
# 36 00110100010110101000001110101100110100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
# b'Too big\n'
# 37 00110100010110101000001110101100110101000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
# b'Too small\n'
# 38 00110100010110101000001110101100110101100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
# b'Too small\n'
# 39 00110100010110101000001110101100110101110000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
# b'Too small\n'
# 40 00110100010110101000001110101100110101110000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
# b'Too small\n'
# 41 00110100010110101000001110101100110101110000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
# b'Too small\n'
# 42 00110100010110101000001110101100110101110010000000000000000000000000000000000000000000000000000000000000000000000000000000000000
# b'Too big\n'
# 43 00110100010110101000001110101100110101110011000000000000000000000000000000000000000000000000000000000000000000000000000000000000
# b'Too big\n'
# 44 00110100010110101000001110101100110101110011100000000000000000000000000000000000000000000000000000000000000000000000000000000000
# b'Too big\n'
# 45 00110100010110101000001110101100110101110011100000000000000000000000000000000000000000000000000000000000000000000000000000000000
# b'Too big\n'
# 46 00110100010110101000001110101100110101110011100000000000000000000000000000000000000000000000000000000000000000000000000000000000
# b'Too big\n'
# 47 00110100010110101000001110101100110101110011100100000000000000000000000000000000000000000000000000000000000000000000000000000000
# b'Too small\n'
# 48 00110100010110101000001110101100110101110011100110000000000000000000000000000000000000000000000000000000000000000000000000000000
# b'Too small\n'
# 49 00110100010110101000001110101100110101110011100111000000000000000000000000000000000000000000000000000000000000000000000000000000
# b'Too big\n'
# 50 00110100010110101000001110101100110101110011100111100000000000000000000000000000000000000000000000000000000000000000000000000000
# b'Too small\n'
# 51 00110100010110101000001110101100110101110011100111110000000000000000000000000000000000000000000000000000000000000000000000000000
# b'Too small\n'
# 52 00110100010110101000001110101100110101110011100111111000000000000000000000000000000000000000000000000000000000000000000000000000
# b'Too small\n'
# 53 00110100010110101000001110101100110101110011100111111100000000000000000000000000000000000000000000000000000000000000000000000000
# b'Too small\n'
# 54 00110100010110101000001110101100110101110011100111111110000000000000000000000000000000000000000000000000000000000000000000000000
# b'Too big\n'
# 55 00110100010110101000001110101100110101110011100111111111000000000000000000000000000000000000000000000000000000000000000000000000
# b'Too small\n'
# 56 00110100010110101000001110101100110101110011100111111111100000000000000000000000000000000000000000000000000000000000000000000000
# b'Too small\n'
# 57 00110100010110101000001110101100110101110011100111111111110000000000000000000000000000000000000000000000000000000000000000000000
# b'Too big\n'
# 58 00110100010110101000001110101100110101110011100111111111111000000000000000000000000000000000000000000000000000000000000000000000
# b'Too big\n'
# 59 00110100010110101000001110101100110101110011100111111111111100000000000000000000000000000000000000000000000000000000000000000000
# b'Too small\n'
# 60 00110100010110101000001110101100110101110011100111111111111110000000000000000000000000000000000000000000000000000000000000000000
# b'Too small\n'
# 61 00110100010110101000001110101100110101110011100111111111111110000000000000000000000000000000000000000000000000000000000000000000
# b'Too small\n'
# 62 00110100010110101000001110101100110101110011100111111111111110000000000000000000000000000000000000000000000000000000000000000000
# b'Too small\n'
# 63 00110100010110101000001110101100110101110011100111111111111110000000000000000000000000000000000000000000000000000000000000000000
# b'Too small\n'
# 64 00110100010110101000001110101100110101110011100111111111111110000000000000000000000000000000000000000000000000000000000000000000
# b'Too small\n'
# 65 00110100010110101000001110101100110101110011100111111111111110000000000000000000000000000000000000000000000000000000000000000000
# b'Too small\n'
# 66 00110100010110101000001110101100110101110011100111111111111110000000000000000000000000000000000000000000000000000000000000000000
# b'Too small\n'
# 67 00110100010110101000001110101100110101110011100111111111111110000001000000000000000000000000000000000000000000000000000000000000
# b'Too big\n'
# 68 00110100010110101000001110101100110101110011100111111111111110000001000000000000000000000000000000000000000000000000000000000000
# b'Too big\n'
# 69 00110100010110101000001110101100110101110011100111111111111110000001010000000000000000000000000000000000000000000000000000000000
# b'Too big\n'
# 70 00110100010110101000001110101100110101110011100111111111111110000001011000000000000000000000000000000000000000000000000000000000
# b'Too big\n'
# 71 00110100010110101000001110101100110101110011100111111111111110000001011100000000000000000000000000000000000000000000000000000000
# b'Too big\n'
# 72 00110100010110101000001110101100110101110011100111111111111110000001011100000000000000000000000000000000000000000000000000000000
# b'Too big\n'
# 73 00110100010110101000001110101100110101110011100111111111111110000001011101000000000000000000000000000000000000000000000000000000
# b'Too small\n'
# 74 00110100010110101000001110101100110101110011100111111111111110000001011101000000000000000000000000000000000000000000000000000000
# b'Too small\n'
# 75 00110100010110101000001110101100110101110011100111111111111110000001011101010000000000000000000000000000000000000000000000000000
# b'Too big\n'
# 76 00110100010110101000001110101100110101110011100111111111111110000001011101011000000000000000000000000000000000000000000000000000
# b'Too small\n'
# 77 00110100010110101000001110101100110101110011100111111111111110000001011101011000000000000000000000000000000000000000000000000000
# b'Too small\n'
# 78 00110100010110101000001110101100110101110011100111111111111110000001011101011010000000000000000000000000000000000000000000000000
# b'Too small\n'
# 79 00110100010110101000001110101100110101110011100111111111111110000001011101011010000000000000000000000000000000000000000000000000
# b'Too small\n'
# 80 00110100010110101000001110101100110101110011100111111111111110000001011101011010000000000000000000000000000000000000000000000000
# b'Too small\n'
# 81 00110100010110101000001110101100110101110011100111111111111110000001011101011010010000000000000000000000000000000000000000000000
# b'Too small\n'
# 82 00110100010110101000001110101100110101110011100111111111111110000001011101011010011000000000000000000000000000000000000000000000
# b'Too big\n'
# 83 00110100010110101000001110101100110101110011100111111111111110000001011101011010011000000000000000000000000000000000000000000000
# b'Too big\n'
# 84 00110100010110101000001110101100110101110011100111111111111110000001011101011010011010000000000000000000000000000000000000000000
# b'Too small\n'
# 85 00110100010110101000001110101100110101110011100111111111111110000001011101011010011010000000000000000000000000000000000000000000
# b'Too small\n'
# 86 00110100010110101000001110101100110101110011100111111111111110000001011101011010011010100000000000000000000000000000000000000000
# b'Too small\n'
# 87 00110100010110101000001110101100110101110011100111111111111110000001011101011010011010100000000000000000000000000000000000000000
# b'Too small\n'
# 88 00110100010110101000001110101100110101110011100111111111111110000001011101011010011010100000000000000000000000000000000000000000
# b'Too small\n'
# 89 00110100010110101000001110101100110101110011100111111111111110000001011101011010011010100100000000000000000000000000000000000000
# b'Too big\n'
# 90 00110100010110101000001110101100110101110011100111111111111110000001011101011010011010100110000000000000000000000000000000000000
# b'Too small\n'
# 91 00110100010110101000001110101100110101110011100111111111111110000001011101011010011010100111000000000000000000000000000000000000
# b'Too big\n'
# 92 00110100010110101000001110101100110101110011100111111111111110000001011101011010011010100111000000000000000000000000000000000000
# b'Too big\n'
# 93 00110100010110101000001110101100110101110011100111111111111110000001011101011010011010100111010000000000000000000000000000000000
# b'Too big\n'
# 94 00110100010110101000001110101100110101110011100111111111111110000001011101011010011010100111011000000000000000000000000000000000
# b'Too small\n'
# 95 00110100010110101000001110101100110101110011100111111111111110000001011101011010011010100111011000000000000000000000000000000000
# b'Too small\n'
# 96 00110100010110101000001110101100110101110011100111111111111110000001011101011010011010100111011010000000000000000000000000000000
# b'Too big\n'
# 97 00110100010110101000001110101100110101110011100111111111111110000001011101011010011010100111011010000000000000000000000000000000
# b'Too big\n'
# 98 00110100010110101000001110101100110101110011100111111111111110000001011101011010011010100111011010100000000000000000000000000000
# b'Too big\n'
# 99 00110100010110101000001110101100110101110011100111111111111110000001011101011010011010100111011010110000000000000000000000000000
# b'Too small\n'
# 100 00110100010110101000001110101100110101110011100111111111111110000001011101011010011010100111011010110000000000000000000000000000
# b'Too small\n'
# 101 00110100010110101000001110101100110101110011100111111111111110000001011101011010011010100111011010110100000000000000000000000000
# b'Too big\n'
# 102 00110100010110101000001110101100110101110011100111111111111110000001011101011010011010100111011010110110000000000000000000000000
# b'Too small\n'
# 103 00110100010110101000001110101100110101110011100111111111111110000001011101011010011010100111011010110110000000000000000000000000
# b'Too small\n'
# 104 00110100010110101000001110101100110101110011100111111111111110000001011101011010011010100111011010110110100000000000000000000000
# b'Too small\n'
# 105 00110100010110101000001110101100110101110011100111111111111110000001011101011010011010100111011010110110110000000000000000000000
# b'Too small\n'
# 106 00110100010110101000001110101100110101110011100111111111111110000001011101011010011010100111011010110110110000000000000000000000
# b'Too small\n'
# 107 00110100010110101000001110101100110101110011100111111111111110000001011101011010011010100111011010110110110100000000000000000000
# b'Too big\n'
# 108 00110100010110101000001110101100110101110011100111111111111110000001011101011010011010100111011010110110110100000000000000000000
# b'Too big\n'
# 109 00110100010110101000001110101100110101110011100111111111111110000001011101011010011010100111011010110110110100000000000000000000
# b'Too big\n'
# 110 00110100010110101000001110101100110101110011100111111111111110000001011101011010011010100111011010110110110100100000000000000000
# b'Too big\n'
# 111 00110100010110101000001110101100110101110011100111111111111110000001011101011010011010100111011010110110110100110000000000000000
# b'Too big\n'
# 112 00110100010110101000001110101100110101110011100111111111111110000001011101011010011010100111011010110110110100110000000000000000
# b'Too big\n'
# 113 00110100010110101000001110101100110101110011100111111111111110000001011101011010011010100111011010110110110100110100000000000000
# b'Too big\n'
# 114 00110100010110101000001110101100110101110011100111111111111110000001011101011010011010100111011010110110110100110110000000000000
# b'Too small\n'
# 115 00110100010110101000001110101100110101110011100111111111111110000001011101011010011010100111011010110110110100110111000000000000
# b'Too small\n'
# 116 00110100010110101000001110101100110101110011100111111111111110000001011101011010011010100111011010110110110100110111000000000000
# b'Too small\n'
# 117 00110100010110101000001110101100110101110011100111111111111110000001011101011010011010100111011010110110110100110111010000000000
# b'Too big\n'
# 118 00110100010110101000001110101100110101110011100111111111111110000001011101011010011010100111011010110110110100110111010000000000
# b'Too big\n'
# 119 00110100010110101000001110101100110101110011100111111111111110000001011101011010011010100111011010110110110100110111010000000000
# b'Too big\n'
# 120 00110100010110101000001110101100110101110011100111111111111110000001011101011010011010100111011010110110110100110111010010000000
# b'Too big\n'
# 121 00110100010110101000001110101100110101110011100111111111111110000001011101011010011010100111011010110110110100110111010010000000
# b'Too big\n'
# 122 00110100010110101000001110101100110101110011100111111111111110000001011101011010011010100111011010110110110100110111010010000000
# b'Too big\n'
# 123 00110100010110101000001110101100110101110011100111111111111110000001011101011010011010100111011010110110110100110111010010000000
# b'Too big\n'
# 124 00110100010110101000001110101100110101110011100111111111111110000001011101011010011010100111011010110110110100110111010010000000
# b'Too big\n'
FLAG : AIS3{ag3NTs Of S.H.I.E.L.D. - I 10V3 d4Isy J0HNs0n}'

謝天謝地 XD"

AIS3{ag3NTs Of S.H.I.E.L.D. - I 10V3 d4Isy J0HNs0n}

solve.py