import base64
import struct

class SM4:
    # 静态常量，与PHP代码完全一致
    FK = [0xA3B1BAC6, 0x56AA3350, 0x677D9197, 0xB27022DC]
    CK = [
        0x00070E15, 0x1C232A31, 0x383F464D, 0x545B6269,
        0x70777E85, 0x8C939AA1, 0xA8AFB6BD, 0xC4CBD2D9,
        0xE0E7EEF5, 0xFC030A11, 0x181F262D, 0x343B4249,
        0x50575E65, 0x6C737A81, 0x888F969D, 0xA4ABB2B9,
        0xC0C7CED5, 0xDCE3EAF1, 0xF8FF060D, 0x141B2229,
        0x30373E45, 0x4C535A61, 0x686F767D, 0x848B9299,
        0xA0A7AEB5, 0xBCC3CAD1, 0xD8DFE6ED, 0xF4FB0209,
        0x10171E25, 0x2C333A41, 0x484F565D, 0x646B7279
    ]
    SboxTable = [
        0xD6, 0x90, 0xE9, 0xFE, 0xCC, 0xE1, 0x3D, 0xB7, 0x16, 0xB6, 0x14, 0xC2, 0x28, 0xFB, 0x2C, 0x05,
        0x2B, 0x67, 0x9A, 0x76, 0x2A, 0xBE, 0x04, 0xC3, 0xAA, 0x44, 0x13, 0x26, 0x49, 0x86, 0x06, 0x99,
        0x9C, 0x42, 0x50, 0xF4, 0x91, 0xEF, 0x98, 0x7A, 0x33, 0x54, 0x0B, 0x43, 0xED, 0xCF, 0xAC, 0x62,
        0xE4, 0xB3, 0x1C, 0xA9, 0xC9, 0x08, 0xE8, 0x95, 0x80, 0xDF, 0x94, 0xFA, 0x75, 0x8F, 0x3F, 0xA6,
        0x47, 0x07, 0xA7, 0xFC, 0xF3, 0x73, 0x17, 0xBA, 0x83, 0x59, 0x3C, 0x19, 0xE6, 0x85, 0x4F, 0xA8,
        0x68, 0x6B, 0x81, 0xB2, 0x71, 0x64, 0xDA, 0x8B, 0xF8, 0xEB, 0x0F, 0x4B, 0x70, 0x56, 0x9D, 0x35,
        0x1E, 0x24, 0x0E, 0x5E, 0x63, 0x58, 0xD1, 0xA2, 0x25, 0x22, 0x7C, 0x3B, 0x01, 0x0D, 0x2D, 0xEC,
        0x84, 0x9B, 0x1E, 0x87, 0xE0, 0x3E, 0xB5, 0x66, 0x48, 0x02, 0x6C, 0xBB, 0xBB, 0x32, 0x83, 0x27,
        0x9E, 0x01, 0x8D, 0x53, 0x9B, 0x64, 0x7B, 0x6B, 0x6A, 0x6C, 0xEC, 0xBB, 0xC4, 0x94, 0x3B, 0x0C,
        0x76, 0xD2, 0x09, 0xAA, 0x16, 0x15, 0x3D, 0x2D, 0x0A, 0xFD, 0xE4, 0xB7, 0x37, 0x63, 0x28, 0xDD,
        0x7C, 0xEA, 0x97, 0x8C, 0x6D, 0xC7, 0xF2, 0x3E, 0x1A, 0x71, 0x1D, 0x29, 0xC5, 0x89, 0x6F, 0xB7,
        0x62, 0x0E, 0xAA, 0x18, 0xBE, 0x1B, 0xFC, 0x56, 0x36, 0x24, 0x07, 0x82, 0xFA, 0x54, 0x5B, 0x40,
        0x8F, 0xED, 0x1F, 0xDA, 0x93, 0x80, 0xF9, 0x61, 0x1C, 0x70, 0xC3, 0x85, 0x95, 0xA9, 0x79, 0x08,
        0x46, 0x29, 0x02, 0x3B, 0x4D, 0x83, 0x3A, 0x0A, 0x49, 0x06, 0x24, 0x1A, 0x47, 0x5C, 0x0D, 0xEA,
        0x9E, 0xCB, 0x55, 0x20, 0x15, 0x8A, 0x9A, 0xCB, 0x43, 0x0C, 0xF0, 0x0B, 0x40, 0x58, 0x00, 0x8F,
        0xEB, 0xBE, 0x3D, 0xC2, 0x9F, 0x51, 0xFA, 0x13, 0x3B, 0x0D, 0x90, 0x5B, 0x6E, 0x45, 0x59, 0x33
    ]

    def __init__(self, key: bytes):
        self.sk = [0] * 32
        self.set_key(key)

    def _rotl(self, x, n):
        return ((x << n) | (x >> (32 - n))) & 0xFFFFFFFF

    def _S(self, x):
        result = 0
        for i in range(4):
            byte = (x >> (24 - i * 8)) & 0xFF
            result |= self.SboxTable[byte] << (24 - i * 8)
        return result

    def _L(self, x):
        return (x ^ self._rotl(x, 2) ^ self._rotl(x, 10) ^ self._rotl(x, 18) ^ self._rotl(x, 24)) & 0xFFFFFFFF

    def _T(self, x):
        return self._L(self._S(x))
    
    # 修正后的密钥扩展函数
    def _CKF(self, a, b, c, ck):
        val = (b ^ c ^ ck) & 0xFFFFFFFF
        t_val = self._T(val)
        return (a ^ t_val) & 0xFFFFFFFF

    # 修正后的加密/解密轮函数
    def _F(self, x1, x2, x3, rk):
        return self._T((x1 ^ x2 ^ x3 ^ rk) & 0xFFFFFFFF)

    def set_key(self, key: bytes):
        if len(key) != 16:
            raise ValueError("SM4 key must be 16 bytes long")
        
        key_ints = list(struct.unpack('>IIII', key))
        k = [0] * 36
        for i in range(4):
            k[i] = key_ints[i] ^ self.FK[i]
        
        for i in range(32):
            # 使用修正后的密钥扩展逻辑
            # PHP: $k[$i] ^ $this->CKF($k[$i + 1], $k[$i + 2], $k[$i + 3], self::$CK[$i])
            # $this->CKF(...) is $k[i+1] ^ $this->T(...)
            # So, it's: k[i] ^ k[i+1] ^ T(k[i+2] ^ k[i+3] ^ CK[i])
            inner_xor = (k[i + 2] ^ k[i + 3] ^ self.CK[i]) & 0xFFFFFFFF
            t_val = self._T(inner_xor)
            k[i + 4] = (k[i] ^ k[i + 1] ^ t_val) & 0xFFFFFFFF
            self.sk[i] = k[i + 4]
            
    def _crypt_block(self, block: bytes, is_decrypt: bool):
        x = list(struct.unpack('>IIII', block))
        
        round_keys = self.sk[::-1] if is_decrypt else self.sk
        
        for i in range(32):
            round_key = round_keys[i]
            # 修正后的轮函数应用逻辑
            # new_x3 = old_x0 ^ F(old_x1, old_x2, old_x3, rk)
            f_result = self._F(x[1], x[2], x[3], round_key)
            new_val = (x[0] ^ f_result) & 0xFFFFFFFF
            x = [x[1], x[2], x[3], new_val]
            
        x.reverse()
        return struct.pack('>IIII', *x)

    def decrypt_ecb(self, ciphertext: bytes):
        decrypted_padded = b''
        for i in range(0, len(ciphertext), 16):
            block = ciphertext[i:i+16]
            decrypted_padded += self._crypt_block(block, is_decrypt=True)
        
        return self._unpad(decrypted_padded)

    def _unpad(self, data: bytes):
        padding_len = data[-1]
        if padding_len > 16 or padding_len == 0:
            return data
        
        padding = data[-padding_len:]
        if all(p == padding_len for p in padding):
            return data[:-padding_len]
        else:
            return data

# --- 主程序 ---
if __name__ == "__main__":
    key_str = "a8a58b78f41eeb6a"
    # 题目中的密文
    ciphertext_b64 = "VCWBIdzfjm45EmYFWcqXX0VpQeZPeI6Qqyjsv31yuPTDC80lhFlaJY2R3TintdQu"
    # 你提供的Hex解码后的密文
    # ciphertext_b64 = "VCWBIdzfjm45EmYFWcqXX0VpQeZPeI6Qqyjsv31yuP/DC80lhFlaJY2R3TintdQu" # 原始应该是这个，有个/

    key_bytes = key_str.encode('utf-8')
    ciphertext_bytes = base64.b64decode(ciphertext_b64)

    print(f"密钥 (bytes): {key_bytes}")
    print(f"待解密密文 (bytes): {ciphertext_bytes.hex()}")
    print("-" * 30)

    sm4_cipher = SM4(key_bytes)

    try:
        decrypted_bytes = sm4_cipher.decrypt_ecb(ciphertext_bytes)
        try:
            flag = decrypted_bytes.decode('utf-8')
            print("解密成功!")
            print(f"Flag: {flag}")
        except UnicodeDecodeError:
            print("解密成功! (但无法用UTF-8解码)")
            print(f"原始字节: {decrypted_bytes}")
            print(f"Hex表示: {decrypted_bytes.hex()}")

    except Exception as e:
        print(f"解密失败: {e}")

import mailbox
import os
import re
from email.header import decode_header

MBOX_FILE = 'INBOX'
OUTPUT_DIR = 'attachments'

def decode_mime_header(header_string):
    """
    解码MIME编码的头部信息（如文件名），正确处理多种字符集。
    """
    if not header_string:
        return ""
    
    decoded_parts = []
    try:
        for part, charset in decode_header(header_string):
            if isinstance(part, bytes):
                if charset:
                    try:
                        decoded_parts.append(part.decode(charset, 'replace'))
                    except (UnicodeDecodeError, LookupError):
                        decoded_parts.append(part.decode('gb18030', 'ignore'))
                else:
                    try:
                        decoded_parts.append(part.decode('utf-8', 'replace'))
                    except UnicodeDecodeError:
                        decoded_parts.append(part.decode('gb18030', 'ignore'))
            else:
                decoded_parts.append(part)
    except Exception:
        return str(header_string) # Fallback to plain string if decoding fails
            
    return "".join(decoded_parts)

def get_email_body(message):
    """
    从 message 对象中提取 text/plain 和 text/html 正文内容。
    """
    body_plain = None
    body_html = None
    
    if message.is_multipart():
        for part in message.walk():
            content_type = part.get_content_type()
            content_disposition = str(part.get('Content-Disposition'))

            # 我们只想要正文部分，而不是附件
            if "attachment" not in content_disposition:
                if content_type == 'text/plain' and body_plain is None:
                    payload = part.get_payload(decode=True)
                    charset = part.get_content_charset() or 'utf-8'
                    try:
                        body_plain = payload.decode(charset, 'replace')
                    except LookupError:
                        body_plain = payload.decode('gb18030', 'replace')
                elif content_type == 'text/html' and body_html is None:
                    payload = part.get_payload(decode=True)
                    charset = part.get_content_charset() or 'utf-8'
                    try:
                        body_html = payload.decode(charset, 'replace')
                    except LookupError:
                        body_html = payload.decode('gb18030', 'replace')
    else: # 如果不是 multipart，它本身就是正文
        payload = message.get_payload(decode=True)
        charset = message.get_content_charset() or 'utf-8'
        try:
            body_plain = payload.decode(charset, 'replace')
        except LookupError:
            body_plain = payload.decode('gb18030', 'replace')
            
    return body_plain, body_html


def extract_from_mbox(mbox_file_path, output_dir):
    """
    从 mbox 格式的文件中提取邮件正文和附件。
    """
    if not os.path.exists(output_dir):
        os.makedirs(output_dir)
        print(f"创建输出文件夹: {output_dir}")

    try:
        mbox = mailbox.mbox(mbox_file_path)
    except FileNotFoundError:
        print(f"错误: 文件 '{mbox_file_path}' 未找到。")
        return
    except Exception as e:
        print(f"打开 mbox 文件时出错: {e}")
        return

    email_count = 0
    attachment_count = 0

    print(f"--- 正在以 mbox 格式解析文件: {mbox_file_path} ---")

    for i, message in enumerate(mbox):
        email_count += 1
        print(f"\n{'='*20} 邮件 #{i+1} {'='*20}")
        
        # --- 打印邮件头部信息 ---
        subject = decode_mime_header(message['Subject'])
        sender = decode_mime_header(message['From'])
        recipient = decode_mime_header(message['To'])
        date = decode_mime_header(message['Date'])
        
        print(f"  发件人: {sender}")
        print(f"  收件人: {recipient}")
        print(f"  日  期: {date}")
        print(f"  主  题: {subject}")
        print("-" * 50)

        # --- 打印邮件正文 ---
        body_plain, body_html = get_email_body(message)
        if body_plain:
            print("  [正文 - 纯文本]:")
            print(body_plain.strip())
            print("-" * 50)
        if body_html:
            print("  [正文 - HTML]:")
            print(body_html.strip())
            print("-" * 50)
        
        # --- 提取附件 ---
        print("  [附件信息]:")
        found_attachments = False
        for part in message.walk():
            if part.get_content_maintype() == 'multipart' or part.get('Content-Disposition') is None:
                continue
            
            filename = part.get_filename()
            if filename:
                found_attachments = True
                decoded_filename = decode_mime_header(filename)
                cleaned_filename = re.sub(r'[\\/*?:"<>|]', "", decoded_filename).strip()
                if not cleaned_filename:
                    continue
                
                filepath = os.path.join(output_dir, cleaned_filename)
                print(f"    [+] 发现附件: {decoded_filename}")
                
                payload = part.get_payload(decode=True)
                if payload:
                    with open(filepath, 'wb') as f_out:
                        f_out.write(payload)
                    print(f"        -> 已保存至: {filepath}")
                    attachment_count += 1
                else:
                    print(f"        -> 警告: 附件内容为空。")
        
        if not found_attachments:
            print("    (无附件)")

    print(f"\n{'='*20} 处理完成 {'='*20}")
    print(f"共处理 {email_count} 封邮件，提取了 {attachment_count} 个附件。")


if __name__ == '__main__':
    extract_from_mbox(MBOX_FILE, OUTPUT_DIR)

import gzip
import os

# --- 配置 ---
LNK_FILE = "湖南绘梦有限公司管理规定.lnk" 

# 输出文件名
DECRYPTED_PDF_FILE = "湖南绘梦有限公司管理规定.pdf"
DECRYPTED_EXE_FILE = "update.exe"

# 从 PowerShell 脚本中获取的常量
# PDF 相关的偏移量
PDF_OFFSET_START_FROM_END = 261988 + 35031
PDF_OFFSET_END_FROM_END = 35032
PDF_XOR_KEY = bytes([0x13, 0xF5])

# EXE 相关的偏移量
EXE_OFFSET_START_FROM_END = 35031
# --- 结束配置 ---

def extract_and_decrypt():
    """
    从 .lnk 文件中提取并解密 PDF 和 EXE 文件。
    """
    try:
        print(f"[*] 正在读取文件: {LNK_FILE}")
        with open(LNK_FILE, 'rb') as f:
            lnk_data = f.read()
        file_length = len(lnk_data)
        print(f"[+] 文件读取成功，总大小: {file_length} 字节。")
    except FileNotFoundError:
        print(f"[!] 错误: 文件 '{LNK_FILE}' 未找到。请检查文件名和路径。")
        return
    
    # --- 1. 处理 PDF 文件 ---
    print("\n--- 正在提取和解密 PDF 文件 ---")
    try:
        # 根据 PowerShell 逻辑计算切片索引
        # $stsee=$c1s2.Length-261988-35031;
        # $encryptedData = $fbcse1[$stsee..($fbcse1.Length -35032)];
        pdf_start_index = file_length - PDF_OFFSET_START_FROM_END
        pdf_end_index = file_length - PDF_OFFSET_END_FROM_END
        
        if pdf_start_index < 0 or pdf_end_index <= pdf_start_index:
            raise ValueError("计算出的 PDF 偏移量无效。")

        encrypted_pdf_data = lnk_data[pdf_start_index:pdf_end_index]
        print(f"[+] 定位到加密的 PDF 数据 (大小: {len(encrypted_pdf_data)} 字节)")

        # 执行 XOR 解密
        decrypted_pdf_data = bytearray()
        for i in range(len(encrypted_pdf_data)):
            decrypted_byte = encrypted_pdf_data[i] ^ PDF_XOR_KEY[i % len(PDF_XOR_KEY)]
            decrypted_pdf_data.append(decrypted_byte)
        
        # 保存解密后的 PDF
        with open(DECRYPTED_PDF_FILE, 'wb') as f:
            f.write(decrypted_pdf_data)
        print(f"[+] PDF 解密成功！已保存为: {DECRYPTED_PDF_FILE}")

    except Exception as e:
        print(f"[!] 提取 PDF 文件时发生错误: {e}")

    # --- 2. 处理 EXE 文件 ---
    print("\n--- 正在提取和解压 EXE 文件 ---")
    try:
        # 根据 PowerShell 逻辑计算切片索引
        # $po2sdw1 = $fbcse1[($fbcse1.Length - 35031)..($fbcse1.Length - 1)];
        exe_start_index = file_length - EXE_OFFSET_START_FROM_END
        
        if exe_start_index < 0:
             raise ValueError("计算出的 EXE 偏移量无效。")
             
        compressed_exe_data = lnk_data[exe_start_index:]
        print(f"[+] 定位到压缩的 EXE 数据 (大小: {len(compressed_exe_data)} 字节)")
        
        # 执行 GZip 解压缩
        decrypted_exe_data = gzip.decompress(compressed_exe_data)
        
        # 保存解压后的 EXE
        with open(DECRYPTED_EXE_FILE, 'wb') as f:
            f.write(decrypted_exe_data)
        print(f"[+] EXE 解压成功！已保存为: {DECRYPTED_EXE_FILE}")

    except Exception as e:
        print(f"[!] 提取 EXE 文件时发生错误: {e}")

if __name__ == '__main__':
    extract_and_decrypt()

data = [
    0xFF, 0xF5, 0xF8, 0xFE, 0xE2, 0xFF, 0xF8, 0xFC, 0xA9, 0xFB, 0xAB, 0xAE, 0xFA, 0xAD,
    0xAC, 0xA8, 0xFA, 0xAE, 0xAB, 0xA1, 0xA1, 0xAF, 0xAE, 0xF8, 0xAC, 0xAF, 0xAE, 0xFC,
    0xA1, 0xFA, 0xA8, 0xFB, 0xFB, 0xAD, 0xFC, 0xAC, 0xAA, 0xE4
]

key = 0x99
flag = ""

for byte in data:
    flag += chr(byte ^ key)

print(flag)