MDH
源题：
from secret import flag
r = 128
c = 96
p = 308955606868885551120230861462612873078105583047156930179459717798715109629
Fp = GF(p)
def gen():
a1 = random_matrix(Fp, r, c)
a2 = random_matrix(Fp, r, c)
A = a1 * a2.T
return (a1, a2), A
sk_alice, pk_alice = gen()
sk_bob, pk_bob = gen()
shared = (sk_alice[0].T * pk_bob * sk_alice[1]).trace()
ct = int(sha256(str(int(shared)).encode()).hexdigest(), 16) ^^ int.from_bytes(flag, 'big')
with open('output.txt', 'wb') as f:
f.write(str(ct).encode() + b'\n')
f.write(str(list(pk_alice)).encode() + b'\n')
f.write(str(list(pk_bob)).encode() + b'\n')
思路：本题思路很简单，高等代数，sk_alice[0].T * pk_bob * sk_alice[1]和pk_bob*pk_alice.T的迹的大小是相等的。
exp：
from Crypto.Util.number import*
r = 128
c = 96
p = 308955606868885551120230861462612873078105583047156930179459717798715109629
Fp = GF(p)
f = open('output.txt','r')
ct = eval(f.readline())
a1 = eval(f.readline())
a2 = eval(f.readline())
pk_alice = matrix(Fp,a1)
pk_bob = matrix(Fp,a2)
# print(pk_alice)
# print(pk_bob)
shared = (pk_bob*pk_alice.T).trace()
m = int(sha256(str(int(shared)).encode()).hexdigest(), 16) ^^ ct
print(long_to_bytes(m))
claw crane
源码：
from Crypto.Util.number import (
bytes_to_long, long_to_bytes
)
from hashlib import md5
import os, signal
import sys
import random
BITS = 128
class ClawCrane(object):
def __init__(self) -> None:
self.seed = bytes_to_long(os.urandom(BITS//8))
self.bless = 0
self.score = 0
def get_input(self, prompt="> "):
print(prompt, end="")
sys.stdout.flush()
return input()
def check_pos(self, pos, moves):
col, row = 0, 0
for move in moves:
if move == "W":
if row < 15: row += 1
elif move == "S":
if row > 0: row -= 1
elif move == "A":
if col > 0: col -= 1
elif move == "D":
if col < 15: col += 1
else:
return -1
print(col, row)
return pos == [col, row]
def gen_chaos(self, inp):
def mapping(x):
if x=='W': return "0"
if x=='S': return "1"
if x=='A': return "2"
if x=='D': return "3"
vs = int("".join(map(mapping, inp)), 4)
chaos = bytes_to_long(md5(
long_to_bytes((self.seed + vs) % pow(2,BITS))
).digest())
self.seed = (self.seed + chaos + 1) % pow(2,BITS)
return chaos
def destiny_claw(self, delta):
bits = bin(delta)[2:]
if len(bits) < 128+self.bless:
bits += "0"*(128+self.bless - len(bits))
c = random.choice(bits)
if c=='0': return True
else: return False
def run(self):
pos = [random.randrange(1,16), random.randrange(1,16)]
moves = self.get_input(f"i am at {pos}, claw me.\nYour moves: ")
if len(moves) > 100:
print("too many steps")
return
if not self.check_pos(pos, moves):
print("sorry, clawed nothing")
return
r = self.gen_chaos(moves[:64])
print(f"choas: {r}")
p, q = map(int, self.get_input(f"give me your claw using p,q and p,q in [0, 18446744073709551615] (e.g.: 1,1): ").split(","))
if not (p>0 and p<pow(2,BITS//2) and q>0 and q<pow(2,BITS//2)):
print("not in range")
return
delta = abs(r*q - p*pow(2,BITS))
if self.destiny_claw(delta):
self.score += 10
self.bless = 0
print("you clawed it")
else:
self.bless += 16
print("sorry, clawed nothing")
def main():
signal.alarm(600)
cc = ClawCrane()
for _ in range(256):
try:
cc.run()
print(f"your score: {cc.score}")
except:
print(f"abort")
break
if cc.score >= 2220:
print(f"flag: {open('/flag.txt').read()}")
if __name__ == "__main__":
main()
思路：在本题目中我们需要绕过proof验证、check_pos的位置验证和以下
chaos = bytes_to_long(md5(
long_to_bytes((self.seed + vs) % pow(2,BITS))
).digest())
self.seed = (self.seed + chaos + 1) % pow(2,BITS)
首先：
proof验证：我们知道是将十六进制数输入，进行sha1操作与已知输出对比，相同即可通过，我们在输入的十六进制数的前六位未知，直接爆破即可。
check_pos的位置验证：我们观察源码，源码是通过构造的输入序列（‘A’,'B','C','D'），对此时在（0，0）的点进行位移输入到随机确认的pos位置上，若最终移动的位置相同，即可通过。
由于 r = self.gen_chaos(moves[:64])，moves是我们自己输入的，此时函数仅仅需要前64位进行运算获得r的值，我们需要固定r的值的大小，所以此时便在seed上做文章，令每次输入的vs都在上一个vs的基础上减去（chaos + 1），此时，输出的chaos值固定。
于是，check_pos的位置验证中，我们输入序列的前64位由上述r取值中确认，我们需要计算出64次移动后的位置，再寻找到pos点的移动所需里程。
完成上述操作后，开始运算，当cc.score >= 2220时，我们即可得到flag的值
exp：
import itertools
from Crypto.Util.number import *
from hashlib import md5
import gmpy2
from pwn import *
from tqdm import tqdm
from hashlib import *
from time import *
BITS = 128
def proof():
sh.recvuntil(b'sha1(prefix+"')
k = sh.recvuntil(b'"')[:-1]
sh.recvuntil(b')==')
cc = sh.recvuntil(b'\n')[:-1]
sh.recvuntil(b'prefix = ?\n')
String = b'0123456789abcdef'
# print(k,cc)
start = time()
for i1, i2, i3, i4, i5, i6 in tqdm(itertools.product(String, String, String, String, String, String)):
kk = str(chr(i1)) + str(chr(i2)) + str(chr(i3)) + str(chr(i4)) + str(chr(i5)) + str(chr(i6)) + k.decode()
# print(kk,k.decode())
# print(sha1(kk.encode()).hexdigest(),cc.decode())
if sha1(kk.encode()).hexdigest() == cc.decode():
print(kk[:6])
sh.sendline(kk[:6].encode())
break
end = time()
print(f"consume {end - start} time")
def check_pos(pos, moves):
col, row = int(pos[0]), int(pos[1])
for move in moves:
if move == "W":
if row < 15: row += 1
elif move == "S":
if row > 0: row -= 1
elif move == "A":
if col > 0: col -= 1
elif move == "D":
if col < 15: col += 1
else:
return -1
print(col, row)
return [col, row]
def solve_chaos(la_chaos, idx):
def mapping(x):
if x == '0': return "W"
if x == '1': return "S"
if x == '2': return "A"
if x == '3': return "D"
New_vs = (-la_chaos - 1) * (idx - 1) % (2 ^ 128)
target = New_vs % 4
new_vs = ''
while New_vs:
if target == 0:
new_vs += 'W'
New_vs = New_vs // 4
if target == 1:
new_vs += 'S'
New_vs = New_vs // 4
if target == 2:
new_vs += 'A'
New_vs = New_vs // 4
if target == 3:
new_vs += 'D'
New_vs = New_vs // 4
target = New_vs % 4
# print(new_vs)
new_vs = new_vs[::-1]
if len(new_vs) != 64:
new_vs = mapping("0") * (64 - len(new_vs)) + new_vs
print('solve_chaos:', new_vs)
return new_vs
def solve_pos(cu_pos, new_pos, sol):
x0, y0 = cu_pos
x1, y1 = new_pos
if x0 < x1:
sol += 'D' * ((x1 - x0) % 16)
else:
sol += 'A' * ((x0 - x1) % 16)
if y0 < y1:
sol += 'W' * ((y1 - y0) % 16)
else:
sol += 'S' * ((y0 - y1) % 16)
return sol
def solve_pq(chaos):
K = matrix(ZZ, [[2 ^ 128, 0], [chaos, 1]])
KK = K.LLL()
# print(num)
v = K.solve_left(KK[0])
p, q = v[0], v[1]
return abs(p), abs(q)
for i in range(1, 10000):
print(f'Try {i} times')
sh = process(['python3', 'server.py'])
proof()
Assert, chaos, idx, failure, success = 0, -1, 0, 0, 0
p, q = 0, 0
try:
while idx < 256:
idx += 1
print(f'----------The {idx} quarters---------')
sh.recvuntil(b'i am at ')
pos = eval(sh.recvuntil(b']'))
sh.recvuntil(b'Your moves: ')
x1, y1 = int(pos[0]), int(pos[1])
# print(pos,x1,y1,chaos)
vs = solve_chaos(chaos, idx)
# print(vs)
x0, y0 = check_pos((0, 0), vs)
moves = solve_pos((x0, y0), (x1, y1), vs)
sh.sendline(moves.encode())
sh.recvuntil(b'choas: ')
chaos = int(sh.recvuntil(b'\n')[:-1])
if not p and not q:
p, q = solve_pq(chaos)
x = abs(chaos * q - p * pow(2, 128))
print(bin(x)[2:].count('1'))
print(bin(x)[2:])
if bin(x)[2:].count('1') > 23:
break
print(abs(chaos * q - p * pow(2, 128)))
sh.recvuntil(b'give me your claw using p,q and p,q in [0, 18446744073709551615] (e.g.: 1,1): ')
sh.sendline(f'{p},{q}'.encode())
ding = sh.recvline()
# print(ding)
sh.recvuntil(b'your score: ')
score = sh.recvuntil(b'\n')[:-1]
print('Your score: ', score)
sh.interactive()
except:
continue
EazyRSA
源码：
from secret import flag
from Crypto.Util.number import *
def genKey(nbits, dbits):
bbits = (nbits // 2 - dbits) // 2
while True:
a = getRandomNBitInteger(dbits)
b = getRandomNBitInteger(bbits)
c = getRandomNBitInteger(bbits)
p1 = a * b * c + 1
if isPrime(p1):
# print("p1 =", p1)
break
while True:
d = getRandomNBitInteger(dbits)
p2 = b * c * d + 1
if isPrime(p2):
# print("p2 =", p2)
break
while True:
e = getRandomNBitInteger(bbits)
f = getRandomNBitInteger(bbits)
q1 = e * d * f + 1
p3 = a * e * f + 1
if isPrime(q1) and isPrime(p3):
# print("p3 =", p3)
# print("q1 =", q1)
break
while True:
d_ = getRandomNBitInteger(dbits)
if GCD(a * b * c * d * e * f, d_) != 1:
continue
e_ = inverse(d_, a * b * c * d * e * f)
k1 = (e_ * d_ - 1) // (a * b * c * d * e * f)
assert e_ * d_ == (a * b * c * d * e * f) * k1 + 1
q2 = k1 * e * f + 1
q3 = k1 * b * c + 1
if isPrime(q2) and isPrime(q3):
# print("q2 =", q2)
# print("q3 =", q3)
# print("e =", e_)
# print("d =", d_)
break
n1 = p1 * q1
n2 = p2 * q2
n3 = p3 * q3
assert pow(pow(0xdeadbeef, e_, n1), d_, n1) == 0xdeadbeef
assert pow(pow(0xdeadbeef, e_, n2), d_, n2) == 0xdeadbeef
assert pow(pow(0xdeadbeef, e_, n3), d_, n3) == 0xdeadbeef
return(e_, n1, n2, n3)
nbits = 0x600
dbits = 0x210
m = bytes_to_long(flag)
e, n1, n2, n3 = genKey(nbits, dbits)
c = pow(m, e, n1)
print("c =", c)
print("e =", e)
print("n1 =", n1)
print("n2 =", n2)
print("n3 =", n3)
# c = 63442255298812942222810837512019302954917822996915527697525497640413662503768308023517128481053593562877494934841788054865410798751447333551319775025362132176942795107214528962480350398519459474033659025815248579631003928932688495682277210240277909527931445899728273182691941548330126199931886748296031014210795428593631253184315074234352536885430181103986084755140024577780815130067722355861473639612699372152970688687877075365330095265612016350599320999156644
# e = 272785315258275494478303901715994595013215169713087273945370833673873860340153367010424559026764907254821416435761617347240970711252213646287464416524071944646705551816941437389777294159359383356817408302841561284559712640940354294840597133394851851877857751302209309529938795265777557840238332937938235024502686737802184255165075195042860413556866222562167425361146312096189555572705076252573222261842045286782816083933952875990572937346408235562417656218440227
# n1 = 473173031410877037287927970398347001343136400938581274026578368211539730987889738033351265663756061524526288423355193643110804217683860550767181983527932872361546531994961481442866335447011683462904976896894011884907968495626837219900141842587071512040734664898328709989285205714628355052565784162841441867556282849760230635164284802614010844226671736675222842060257156860013384955769045790763119616939897544697150710631300004180868397245728064351907334273953201
# n2 = 327163771871802208683424470007561712270872666244394076667663345333853591836596054597471607916850284565474732679392694515656845653581599800514388800663813830528483334021178531162556250468743461443904645773493383915711571062775922446922917130005772040139744330987272549252540089872170217864935146429898458644025927741607569303966038195226388964722300472005107075179204987774627759625183739199425329481632596633992804636690274844290983438078815836605603147141262181
# n3 = 442893163857502334109676162774199722362644200933618691728267162172376730137502879609506615568680508257973678725536472848428042122350184530077765734033425406055810373669798840851851090476687785235612051747082232947418290952863499263547598032467577778461061567081620676910480684540883879257518083587862219344609851852177109722186714811329766477552794034774928983660538381764930765795290189612024799300768559485810526074992569676241537503405494203262336327709010421
思路：造格即可
exp：
from sage.all import *
from Crypto.Util.number import *
import random
c = 63442255298812942222810837512019302954917822996915527697525497640413662503768308023517128481053593562877494934841788054865410798751447333551319775025362132176942795107214528962480350398519459474033659025815248579631003928932688495682277210240277909527931445899728273182691941548330126199931886748296031014210795428593631253184315074234352536885430181103986084755140024577780815130067722355861473639612699372152970688687877075365330095265612016350599320999156644
e = 272785315258275494478303901715994595013215169713087273945370833673873860340153367010424559026764907254821416435761617347240970711252213646287464416524071944646705551816941437389777294159359383356817408302841561284559712640940354294840597133394851851877857751302209309529938795265777557840238332937938235024502686737802184255165075195042860413556866222562167425361146312096189555572705076252573222261842045286782816083933952875990572937346408235562417656218440227
n1 = 473173031410877037287927970398347001343136400938581274026578368211539730987889738033351265663756061524526288423355193643110804217683860550767181983527932872361546531994961481442866335447011683462904976896894011884907968495626837219900141842587071512040734664898328709989285205714628355052565784162841441867556282849760230635164284802614010844226671736675222842060257156860013384955769045790763119616939897544697150710631300004180868397245728064351907334273953201
n2 = 327163771871802208683424470007561712270872666244394076667663345333853591836596054597471607916850284565474732679392694515656845653581599800514388800663813830528483334021178531162556250468743461443904645773493383915711571062775922446922917130005772040139744330987272549252540089872170217864935146429898458644025927741607569303966038195226388964722300472005107075179204987774627759625183739199425329481632596633992804636690274844290983438078815836605603147141262181
n3 = 442893163857502334109676162774199722362644200933618691728267162172376730137502879609506615568680508257973678725536472848428042122350184530077765734033425406055810373669798840851851090476687785235612051747082232947418290952863499263547598032467577778461061567081620676910480684540883879257518083587862219344609851852177109722186714811329766477552794034774928983660538381764930765795290189612024799300768559485810526074992569676241537503405494203262336327709010421
M = int(random.randint(n1,2*n2) ** 0.5)
K = matrix([[M,e,e,e],[0,-n1,0,0],[0,0,-n2,0],[0,0,0,-n3]])
KK = K.LLL()
d = int(KK[0][0]/M)
m = pow(c,d,n1)
print(long_to_bytes(int(m)))
MidRSA
源码：
from secret import flag
from Crypto.Util.number import *
def genKey(nbits, dbits):
bbits = (nbits // 2 - dbits) // 2
while True:
a = getRandomNBitInteger(dbits)
b = getRandomNBitInteger(bbits)
c = getRandomNBitInteger(bbits)
p1 = a * b * c + 1
if isPrime(p1):
# print("p1 =", p1)
break
while True:
d = getRandomNBitInteger(dbits)
p2 = b * c * d + 1
if isPrime(p2):
# print("p2 =", p2)
break
while True:
e = getRandomNBitInteger(bbits)
f = getRandomNBitInteger(bbits)
q1 = e * d * f + 1
p3 = a * e * f + 1
if isPrime(q1) and isPrime(p3):
# print("p3 =", p3)
# print("q1 =", q1)
break
while True:
d_ = getRandomNBitInteger(dbits)
if GCD(a * b * c * d * e * f, d_) != 1:
continue
e_ = inverse(d_, a * b * c * d * e * f)
k1 = (e_ * d_ - 1) // (a * b * c * d * e * f)
assert e_ * d_ == (a * b * c * d * e * f) * k1 + 1
q2 = k1 * e * f + 1
q3 = k1 * b * c + 1
if isPrime(q2) and isPrime(q3):
# print("q2 =", q2)
# print("q3 =", q3)
# print("e =", e_)
print("d =", d_)
break
n1 = p1 * q1
n2 = p2 * q2
n3 = p3 * q3
assert pow(pow(0xdeadbeef, e_, n1), d_, n1) == 0xdeadbeef
assert pow(pow(0xdeadbeef, e_, n2), d_, n2) == 0xdeadbeef
assert pow(pow(0xdeadbeef, e_, n3), d_, n3) == 0xdeadbeef
return(e_, n1, n2, n3)
nbits = 0x600
dbits = 0x240
m = bytes_to_long(flag)
e, n1, n2, n3 = genKey(nbits, dbits)
c = pow(m, e, n1)
print("c =", c)
print("e =", e)
print("n1 =", n1)
print("n2 =", n2)
print("n3 =", n3)
# c = 598823083137858565473505718525815255620672892612784824187302545127574115000325539999824374357957135208478070797113625659118825530731575573239221853507638809719397849963861367352055486212696958923800593172417262351719477530809870735637329898331854130533160020420263724619225174940214193740379571953951059401685115164634005411478583529751890781498407518739069969017597521632392997743956791839564573371955246955738575593780508817401390102856295102225132502636316844
# e = 334726528702628887205076146544909357751287869200972341824248480332256143541098971600873722567713812425364296038771650383962046800505086167635487091757206238206029361844181642521606953049529231154613145553220809927001722518303114599682529196697410089598230645579658906203453435640824934159645602447676974027474924465177723434855318446073578465621382859962701578350462059764095163424218813852195709023435581237538699769359084386399099644884006684995755938605201771
# n1 = 621786427956510577894657745225233425730501124908354697121702414978035232119311662357181409283130180887720760732555757426221953950475736078765267856308595870951635246720750862259255389006679454647170476427262240270915881126875224574474706572728931213060252787326765271752969318854360970801540289807965575654629288558728966771231501959974533484678236051025940684114262451777094234017210230731492336480895879764397821363102224085859281971513276968559080593778873231
# n2 = 335133378611627373902246132362791381335635839627660359611198202073307340179794138179041524058800936207811546752188713855950891460382258433727589232119735602364790267515558352318957355100518427499530387075144776790492766973547088838586041648900788325902589777445641895775357091753360428198189998860317775077739054298868885308909495601041757108114540069950359802851809227248145281594107487276003206931533768902437356652676341735882783415106786497390475670647453821
# n3 = 220290953009399899705676642623181513318918775662713704923101352853965768389363281894663344270979715555659079125651553079702318700200824118622766698792556506368153467944348604006011828780474050012010677204862020009069971864222175380878120025727369117819196954091417740367068284457817961773989542151049465711430065838517386380261817772422927774945414543880659243592749932727798690742051285364898081188510009069286094647222933710799481899960520270189522155672272451
思路：相比于EazyRSA题目，提高了dbits的比特数，使得无法计算，此时我们需要爆破一定的高位即可。
exp：
from sage.all import *
from Crypto.Util.number import *
import random
from tqdm import tqdm
c = 598823083137858565473505718525815255620672892612784824187302545127574115000325539999824374357957135208478070797113625659118825530731575573239221853507638809719397849963861367352055486212696958923800593172417262351719477530809870735637329898331854130533160020420263724619225174940214193740379571953951059401685115164634005411478583529751890781498407518739069969017597521632392997743956791839564573371955246955738575593780508817401390102856295102225132502636316844
e = 334726528702628887205076146544909357751287869200972341824248480332256143541098971600873722567713812425364296038771650383962046800505086167635487091757206238206029361844181642521606953049529231154613145553220809927001722518303114599682529196697410089598230645579658906203453435640824934159645602447676974027474924465177723434855318446073578465621382859962701578350462059764095163424218813852195709023435581237538699769359084386399099644884006684995755938605201771
n1 = 621786427956510577894657745225233425730501124908354697121702414978035232119311662357181409283130180887720760732555757426221953950475736078765267856308595870951635246720750862259255389006679454647170476427262240270915881126875224574474706572728931213060252787326765271752969318854360970801540289807965575654629288558728966771231501959974533484678236051025940684114262451777094234017210230731492336480895879764397821363102224085859281971513276968559080593778873231
n2 = 335133378611627373902246132362791381335635839627660359611198202073307340179794138179041524058800936207811546752188713855950891460382258433727589232119735602364790267515558352318957355100518427499530387075144776790492766973547088838586041648900788325902589777445641895775357091753360428198189998860317775077739054298868885308909495601041757108114540069950359802851809227248145281594107487276003206931533768902437356652676341735882783415106786497390475670647453821
n3 = 220290953009399899705676642623181513318918775662713704923101352853965768389363281894663344270979715555659079125651553079702318700200824118622766698792556506368153467944348604006011828780474050012010677204862020009069971864222175380878120025727369117819196954091417740367068284457817961773989542151049465711430065838517386380261817772422927774945414543880659243592749932727798690742051285364898081188510009069286094647222933710799481899960520270189522155672272451
for i in tqdm(range(70000,2^20)):
t1 = bin(i)[2:].zfill(21)
h = int('1'+t1[:3],2) << 0x23c
h1 = int(t1[3:9],2) << 1338
h2 = int(t1[9:15],2) << 1338
h3 = int(t1[15:21],2) << 1338
M = Matrix(QQ,[[-e,-e,-e,2^766,0,0,0,0],
[n1,0,0,0,0,0,0,0],
[0,n2,0,0,0,0,0,0],
[0,0,n3,0,0,0,0,0],
[-h*e,-h*e,-h*e,0,2^(1338),0,0,0],
[-h1,0,0,0,0,2^1338,0,0],
[0,-h2,0,0,0,0,2^1338,0],
[0,0,-h3,0,0,0,0,2^1338]])
# e_*d_-k1*n1,n1
res = M.LLL()
d = int(res[0][3]//2^766) + h
if b'ACTF' in long_to_bytes(ZZ(pow(c,d,n1))):
print(long_to_bytes(ZZ(pow(c,d,n1))))