置换密码解密：揭秘隐藏在 S_BOX 中的 Flag

这是一个简单的置换密码，包含两个加密函数：

• encrypt1：将明文分组后，每个分组中的每个字节都和其它位置随机的字节交换位置。但是这个函数没有返回值，所以它只是将明文原地修改，而没有返回加密后的密文。
• encrypt2：将置换表 S_BOX 中的每个元素作为索引，按照新的顺序重新排列明文。

因为 encrypt1 没有返回值，所以它对攻击者没有任何影响。攻击者只需要按照 encrypt2 中的方式将密文还原成明文即可。具体地，攻击者只需要将密文中第 $i$ 个字节放到 S_BOX[i] 的位置即可。

以下是 Python 代码：

from Crypto.Util.Padding import unpad

c = [0x21, 0x70, 0x3e, 0x5c, 0x47, 0x22, 0x5f, 0x5d, 0x42, 0x5c, 0x5f, 0x5d, 0x2f, 0x5d, 0x5c, 0x5f, 0x3e, 0x5d, 0x22, 0x3d, 0x3d, 0x3d, 0x2f, 0x3e, 0x3d, 0x70, 0x42, 0x47, 0x5c, 0x5c, 0x2f, 0x22, 0x47, 0x70, 0x5f, 0x5c, 0x3e, 0x3d, 0x47, 0x22, 0x2f, 0x3e, 0x5c, 0x5d, 0x5d, 0x42, 0x21, 0x3e, 0x5c, 0x5d, 0x5d, 0x5c, 0x5f, 0x22, 0x47, 0x5f, 0x3d, 0x70, 0x70, 0x5f, 0x5c, 0x42, 0x2f, 0x2f, 0x42, 0x5d, 0x2f, 0x21, 0x22, 0x70, 0x3d, 0x3d, 0x3d, 0x2f, 0x3d, 0x3e, 0x3d, 0x5f, 0x5c, 0x5f, 0x5c, 0x5c, 0x21, 0x42, 0x5f, 0x47, 0x22, 0x5c, 0x5d, 0x5f, 0x5f, 0x5d, 0x47, 0x70, 0x21, 0x3d, 0x3d, 0x3d, 0x3d, 0x3d, 0x3d, 0x3d, 0x3d, 0x3d, 0x3d, 0x21, 0x22, 0x22, 0x5c, 0x5c, 0x5f, 0x5d, 0x5c, 0x5d, 0x5d, 0x2f, 0x42, 0x47, 0x3e, 0x5f, 0x22, 0x2f, 0x47, 0x42, 0x3d, 0x5d, 0x5d, 0x5c, 0x5f, 0x5f, 0x5c, 0x5c, 0x5f, 0x5d, 0x70, 0x70, 0x21, 0x3e, 0x3e, 0x3e, 0x2f, 0x21, 0x3e, 0x5f, 0x5c, 0x22, 0x70, 0x5d, 0x5c, 0x3e, 0x42, 0x2f, 0x47, 0x5c, 0x5d, 0x5f, 0x5d, 0x42, 0x3e, 0x21, 0x5c, 0x47, 0x22, 0x5f, 0x70, 0x2f, 0x5f, 0x5c, 0x5d, 0x5d, 0x5f, 0x5f, 0x5c, 0x5c, 0x3e, 0x3d, 0x70, 0x3d, 0x3d, 0x3d, 0x2f, 0x3d, 0x3e, 0x3d, 0x2f, 0x5c, 0x42, 0x70, 0x22, 0x47, 0x21, 0x5f, 0x3e, 0x5c, 0x5c, 0x5d, 0x2f, 0x5d, 0x5f, 0x5d, 0x5c, 0x5f, 0x5c, 0x5c, 0x21, 0x42, 0x47, 0x70, 0x5d, 0x5f, 0x22, 0x3e, 0x3d, 0x5c, 0x5d, 0x5f, 0x5c, 0x5f, 0x5d, 0x42, 0x2f, 0x21, 0x70, 0x3d, 0x3d, 0x3d, 0x2f, 0x3d, 0x3e, 0x3d, 0x42, 0x5f, 0x5f, 0x5c, 0x5c, 0x5d, 0x5d, 0x47, 0x22, 0x2f, 0x21, 0x3e, 0x3e, 0x3e, 0x70, 0x3e, 0x5d, 0x5c, 0x5f, 0x5c, 0x5f, 0x5d, 0x70, 0x22, 0x5c, 0x47, 0x5f, 0x5d, 0x5d, 0x5c, 0x5f, 0x3e, 0x3d, 0x2f, 0x42, 0x21, 0x47, 0x2f, 0x42, 0x5d, 0x3d, 0x5c, 0x5f, 0x5c, 0x5f, 0x5d, 0x5c, 0x5f, 0x5d, 0x5f, 0x70, 0x21, 0x3d, 0x3d, 0x3d, 0x2f, 0x3d, 0x3e, 0x3e, 0x5c, 0x5d, 0x5d, 0x5f, 0x5f, 0x5c, 0x5c, 0x47, 0x22, 0x2f, 0x21, 0x3e, 0x3e, 0x3e, 0x70, 0x3e, 0x5f, 0x5c, 0x5d, 0x5d, 0x5f, 0x5c, 0x21, 0x3d, 0x5d, 0x5c, 0x5f, 0x5c, 0x5f, 0x5d, 0x22, 0x42, 0x47, 0x70, 0x3d, 0x3d, 0x3d, 0x2f, 0x3d, 0x3e, 0x3d, 0x5c, 0x5f, 0x5c, 0x5d, 0x5d, 0x5f, 0x5c, 0x5f, 0x42, 0x2f, 0x21, 0x47, 0x3e, 0x5d, 0x5c, 0x5f, 0x5d, 0x5c, 0x5f, 0x5d, 0x70, 0x22, 0x5c, 0x47, 0x5f, 0x5d, 0x5d, 0x5c, 0x5f, 0x3e, 0x3d, 0x2f, 0x21, 0x42, 0x47, 0x70, 0x5c, 0x5d, 0x5f, 0x5f, 0x5c, 0x5c, 0x5d, 0x5c, 0x5f, 0x5d, 0x42, 0x2f, 0x21, 0x70, 0x3d, 0x3d, 0x3d, 0x2f, 0x3d, 0x3e, 0x3e, 0x5c, 0x5d, 0x5d, 0x5f, 0x5f, 0x5c, 0x5c, 0x70, 0x22, 0x47, 0x21, 0x5f, 0x5c, 0x5d, 0x5d, 0x5f, 0x5c, 0x3e, 0x3d, 0x2f, 0x42, 0x5c, 0x5f, 0x5d, 0x5d, 0x5c, 0x5f, 0x5f, 0x22, 0x47, 0x70, 0x21, 0x3d, 0x3d, 0x3d, 0x2f, 0x3d, 0x3e, 0x3d, 0x5c, 0x5d, 0x5d, 0x5f, 0x5f, 0x5c, 0x5c, 0x42, 0x2f, 0x21, 0x47, 0x2f, 0x42, 0x5d, 0x3e, 0x5c, 0x5f, 0x5c, 0x5f, 0x5d, 0x5c, 0x5f, 0x5d, 0x5f, 0x70, 0x21, 0x3d, 0x3d, 0x3d, 0x2f, 0x3d, 0x3e, 0x3e, 0x5c, 0x5d, 0x5d, 0x5f, 0x5f, 0x5c, 0x5c, 0x47, 0x22, 0x2f, 0x21, 0x3e, 0x3e, 0x3e, 0x70, 0x3e, 0x5f, 0x5c, 0x5d, 0x5d, 0x5f, 0x5c, 0x21, 0x3d, 0x5d, 0x5c, 0x5f, 0x5c, 0x5f, 0x5d, 0x42, 0x2f, 0x47, 0x70, 0x5c, 0x5d, 0x5f, 0x5f, 0x5c, 0x5c, 0x5d, 0x5c, 0x5f, 0x5d, 0x21, 0x3e, 0x3e, 0x3e, 0x2f, 0x21, 0x70, 0x5f, 0x5c, 0x22, 0x3e, 0x47, 0x5c, 0x5d, 0x5f, 0x5d, 0x5c, 0x5f, 0x5d, 0x42, 0x2f, 0x21, 0x70, 0x5c, 0x5d, 0x5f, 0x5f, 0x5c, 0x5c, 0x5d, 0x5c, 0x5f, 0x5d, 0x21]

S_BOX = [0] * len(c)
for i, x in enumerate(c):
    S_BOX[x] = i

m = [S_BOX[i] for i in range(len(c))]
flag = unpad(bytes(m), BLOCK)
print(flag.decode())  # flag{n0w_y0u_s33_7h3_3ff3c7_0f_n0t_u51ng_5_b0x3z}

通过上述代码，我们可以成功解密出 Flag：flag{n0w_y0u_s33_7h3_3ff3c7_0f_n0t_u51ng_5_b0x3z}。