題目連結

https://learn.cylabacademy.org/library/719

題目解法

  1. 下載後得到兩個檔案，image.jpg 和 flag.enc 兩個檔案，其中 flag.enc 是加密後的結果，將其解密即可得到 flag。

  2. 根據提示知道私鑰藏在 image.jpg 的 metadata 中，使用 exiftool 查看發現 Comment 是一段使用 hex 編碼的內容，解碼後得到完整私鑰。

    2d2d2d2d2d424547494e2050524956415445204b45592d2d2d2d2d0a4d494945765149424144414e42676b71686b6947397730424151454641415343424b63776767536a41674541416f4942415143783072583072754c34674f36620a753372315a6a33376e5971456672665a334e704e4f767a786d554e477a6f4b64452f664d6c75423749507944533241662f4238784e62696d76616a6d5a4447750a5562443656716a584f785930615570514f3672585068516568352b5a4b624f52516f3833722b57647a57566e473339794c723054674861592b755355424f35780a3473675250704262733675324848456a746b32522b2f566a6f5a45345567645a753663316a36774150464334336c7a4d5462744a2b4d53694d38536148494a410a33746f58506b6a33743048474f5675334b57444b5639566b34712f6965756b4d2f6631636c737335424256377147346d375775766d316172623970416865437a0a4a716b466b6968576b44665a79494a6b7a664f4d79332b38327a48414f663669507372734d6f347544664d70316e364c354532686c596a704b486c4b57664d4e0a446e596a4753723941674d424141454367674541444b316c502f6d303444734f353862637241436252435131347837476e4339593139387639386878716174670a312f4a37764e66337a6f64715154442f5043434646385449386f6738635a7073695530314a512f48447a7363364f556c775755546c36394c4432636a57322f440a35385037516d445671614f69536c4446532f356c682b326c5a7541694b69525533495571747349445743704e77466930507a504977584c5a536e3554424655450a525963713259582b49626d6138764b644f2b5749712b626f4973575733667333704a79692b2f4b3255635a2b5132435855596e323447353364545a727a4b78470a3730466d525042354832787541344b777771766246344c483345372b38416b47476b37382f463738416868656f6d6753715541743779397a5232766d532f2b2f0a323144732f74526e7432576b747370577074693375594e57586a377465734b46535a6d6f784b504d59514b426751446c4f51386557695a354b3643627333646b0a776c775a4d6c555a744652434e564f6e7763354b6f315a762b3637433070587139534b59724d3262504132494f505561534b4a6d596a61326b42797a66644f610a3441343238686232625739354a78644543754a62424168485147665a436b683267715247573039457a4c57664e4832714f7748414b595052492f4a2b44796e660a6b6262685967486d783757776c44457146444e38532f326933514b42675144476d4969754964347269345258754d6c53302f496659486439616a7a57316c7a6f0a51695946433268484d73374231506f5270584e736f6748583459637345566b366c4e584e454f2b6f6e6335414a6256634c6d4d72764144736e51535a4e4567310a6a48674443417632436a76494355374239793868775a44716631497a7359615052664e6d465954716a674d5273454368524c4e2b64444e62654f7575326e56760a6c6a4539497158576f514b426746414765364339474846314b62307943707a437669534e7a65674c624e3877667551795a544c706b325046476c3470357530410a5a2f4f6c594b4b786449663657706579672f2f3669643979734a4a3565306132736a2b38685166446251642b2f6b426a44474e364a4f6d374d6f597a634e6a760a4179734d39622b764f446b3875694b554e79672f5669584e787672376b454c645046757a4f376132516c68445a4761735a7330654f6f3642416f4742414964450a324477375a31656a70525958454648786555617a37302b6d6343417054496b4b6e566a7352792f50784a4b3048557974744376335157676f2f6d6765765063770a3731764a5147524b634853792b6f2f364c4b52615877724c664a6c5a7969466e4e307468544c786568672b66663179516f444c4f3549564643646d5a2f7278520a2b684b37623568502b486b77347953315a636b7048743463512f514b61746b4270544975436d5668416f474150756c6f58447469766569726b576f47715079530a544a576e354a656645776878445a37546139716d786a6f6f783053414f6343554b4e495a454359346c3968557444697749416358754a54696254494c77486c520a764938594b2b557355784368464a71446178664362595571742b797657684f597934694f386e39724470612f444e50392f6d2b6a304b6f436c4a5977566b4d310a6b35497937625a57464f74765257395a7772787847684d3d0a2d2d2d2d2d454e442050524956415445204b45592d2d2d2d2d0a

    -----BEGIN PRIVATE KEY-----
MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQCx0rX0ruL4gO6b
u3r1Zj37nYqEfrfZ3NpNOvzxmUNGzoKdE/fMluB7IPyDS2Af/B8xNbimvajmZDGu
UbD6VqjXOxY0aUpQO6rXPhQeh5+ZKbORQo83r+WdzWVnG39yLr0TgHaY+uSUBO5x
4sgRPpBbs6u2HHEjtk2R+/VjoZE4UgdZu6c1j6wAPFC43lzMTbtJ+MSiM8SaHIJA
3toXPkj3t0HGOVu3KWDKV9Vk4q/ieukM/f1clss5BBV7qG4m7Wuvm1arb9pAheCz
JqkFkihWkDfZyIJkzfOMy3+82zHAOf6iPsrsMo4uDfMp1n6L5E2hlYjpKHlKWfMN
DnYjGSr9AgMBAAECggEADK1lP/m04DsO58bcrACbRCQ14x7GnC9Y198v98hxqatg
1/J7vNf3zodqQTD/PCCFF8TI8og8cZpsiU01JQ/HDzsc6OUlwWUTl69LD2cjW2/D
58P7QmDVqaOiSlDFS/5lh+2lZuAiKiRU3IUqtsIDWCpNwFi0PzPIwXLZSn5TBFUE
RYcq2YX+Ibma8vKdO+WIq+boIsWW3fs3pJyi+/K2UcZ+Q2CXUYn24G53dTZrzKxG
70FmRPB5H2xuA4KwwqvbF4LH3E7+8AkGGk78/F78AhheomgSqUAt7y9zR2vmS/+/
21Ds/tRnt2WktspWpti3uYNWXj7tesKFSZmoxKPMYQKBgQDlOQ8eWiZ5K6Cbs3dk
wlwZMlUZtFRCNVOnwc5Ko1Zv+67C0pXq9SKYrM2bPA2IOPUaSKJmYja2kByzfdOa
4A428hb2bW95JxdECuJbBAhHQGfZCkh2gqRGW09EzLWfNH2qOwHAKYPRI/J+Dynf
kbbhYgHmx7WwlDEqFDN8S/2i3QKBgQDGmIiuId4ri4RXuMlS0/IfYHd9ajzW1lzo
QiYFC2hHMs7B1PoRpXNsogHX4YcsEVk6lNXNEO+onc5AJbVcLmMrvADsnQSZNEg1
jHgDCAv2CjvICU7B9y8hwZDqf1IzsYaPRfNmFYTqjgMRsEChRLN+dDNbeOuu2nVv
ljE9IqXWoQKBgFAGe6C9GHF1Kb0yCpzCviSNzegLbN8wfuQyZTLpk2PFGl4p5u0A
Z/OlYKKxdIf6Wpeyg//6id9ysJJ5e0a2sj+8hQfDbQd+/kBjDGN6JOm7MoYzcNjv
AysM9b+vODk8uiKUNyg/ViXNxvr7kELdPFuzO7a2QlhDZGasZs0eOo6BAoGBAIdE
2Dw7Z1ejpRYXEFHxeUaz70+mcCApTIkKnVjsRy/PxJK0HUyttCv3QWgo/mgevPcw
71vJQGRKcHSy+o/6LKRaXwrLfJlZyiFnN0thTLxehg+ff1yQoDLO5IVFCdmZ/rxR
+hK7b5hP+Hkw4yS1ZckpHt4cQ/QKatkBpTIuCmVhAoGAPuloXDtiveirkWoGqPyS
TJWn5JefEwhxDZ7Ta9qmxjoox0SAOcCUKNIZECY4l9hUtDiwIAcXuJTibTILwHlR
vI8YK+UsUxChFJqDaxfCbYUqt+yvWhOYy4iO8n9rDpa/DNP9/m+j0KoClJYwVkM1
k5Iy7bZWFOtvRW9ZwrxxGhM=
-----END PRIVATE KEY-----

  3. 首先先將私鑰存到 private.pem（檔名隨意），使用 nano 或習慣的文字編輯器。

    nano private.pem

  4. 這個私鑰屬於 PEM 格式的私鑰，可以使用 openssl 指令來進行解密。

    openssl pkeyutl -decrypt -inkey private.pem -in flag.enc -out flag.txt

    指令詳細內容：

    • openssl: 呼叫 OpenSSL 核心工具。
    • pkeyutl: 全名是 Public Key Utility。它是 OpenSSL 較新的工具，專門用來處理公鑰與私鑰的各種演算法運算（包括 - RSA、ECDSA 等），支援加密、解密、簽名與驗證。
    • -decrypt: 指定操作模式為「解密」。這告訴程式我們要用私鑰來還原被加密的資料。
    • -inkey private.pem: 指定輸入的密鑰檔案（Input Key）。因為我們要解密，所以這裡必須提供私鑰。
    • -in flag.enc: 指定要處理的原始資料檔案（Input File），也就是題目給你的加密檔。
    • -out flag.txt: 指定輸出檔案名稱（Output File），解密後的明文會儲存在這裡。

  5. 讀取 flag.txt 即可得到 flag。

    picoCTF{rs4-----------------454}