CTFshow-摆烂杯

easy-peasy

​ 签到题：

from Crypto.Util.number import *
from secret import flag

p = getPrime(1024)
q = getPrime(1024)
n = p * q
print(f'n = {n}')

l = len(flag)
assert(l == 86)
m = bytes_to_long(b'\x00' * (l - 1) + flag + b'\x00' * (l - 2))
e = 3
c = pow(m, e, n)
print(f'c = {c}')

# n = 23570098360097260908266914080954003513706885568390448463720576188146956287111601604870247233822682630020002051748117520481402155749832096007629686239669192722978473890311246293580246256300691145653885805730865515297134808702766299205253761028235483781919393575836334910012714628455073300114978717047912395404034141622115001451888302617428376998024080880564792294546406688814397757714979980790018933407614160131827023349206138480523080173634617167828920519758917549492886733519381497665596997617399404664611446202014908853898043742964782757859701755202188366852773164911994663079171498909577012208742001609095258401847
# c = 7802816471025387606454709075933309958303134972861203739854774032383575355964299097074709350633475519273512630813578801152996777689686451397201513854823239337669091889776200179028891111154423623765139235199507280104544068425347533121731521700106757148551520759776111224072064131087547685154285120156917449926992033491342535410929828988598182819897435365878832122138552492908774845437576910276499625679469289655841639181182040186931130789588869657335253479416209378458303531995734157105918063227453396477282662136225029972745246845372963076381252679409317314514131852117346576265346926741908194011319430767975281696400

​ 小指数加密的变种，先移位再进行小指数加密。解法就是先把移位扩大的倍数求逆（模除法），再小指数开方就可。

from Crypto.Util.number import *
import gmpy2
# a = b'\x00\01\x00\x00'
# print(bytes_to_long(a))

c = 7802816471025387606454709075933309958303134972861203739854774032383575355964299097074709350633475519273512630813578801152996777689686451397201513854823239337669091889776200179028891111154423623765139235199507280104544068425347533121731521700106757148551520759776111224072064131087547685154285120156917449926992033491342535410929828988598182819897435365878832122138552492908774845437576910276499625679469289655841639181182040186931130789588869657335253479416209378458303531995734157105918063227453396477282662136225029972745246845372963076381252679409317314514131852117346576265346926741908194011319430767975281696400
n = 23570098360097260908266914080954003513706885568390448463720576188146956287111601604870247233822682630020002051748117520481402155749832096007629686239669192722978473890311246293580246256300691145653885805730865515297134808702766299205253761028235483781919393575836334910012714628455073300114978717047912395404034141622115001451888302617428376998024080880564792294546406688814397757714979980790018933407614160131827023349206138480523080173634617167828920519758917549492886733519381497665596997617399404664611446202014908853898043742964782757859701755202188366852773164911994663079171498909577012208742001609095258401847

k = pow(16,504)

o = gmpy2.invert(k,n)
o1 = o*c
o1 = o1 % n
for i in range(1000000):
    m = gmpy2.iroot(o1+i*n,3)[0]
    if(long_to_bytes(m))[:3] == b"ctf":
        print(long_to_bytes(m))
#ctfshow{345Y_p345Y_4_p13C3_OF_R54_1f_you_533_7H15_yOU_W1ll_KnoW_hoW_7o_5oLV3_17_R1gh7}

你不知道的事

#!/usr/bin/env python3
from Crypto.Util.number import*
from secret import p, q, r, m_list

e = 0x10001
n = p*q
nn = pow(p + q, 2)
with open("output.txt", "w") as f:
    tuple(map(lambda x: f.write(f'{x}\n'), (n, (nn - q * (2*p + q)) * r, [pow(r*bytes_to_long(msg), e, n) for msg in m_list])))

​ 先破解msg的内容，分析过程：

​ exp1：

msg = []
e = 0x10001
n = ...
n0 = ...
#化简得p**2 * r = n0
p = gmpy2.gcd(n,n0)
r = n0//p**2
q = n//p
phi = (p-1)*(q-1)
d = gmpy2.invert(e,phi)
for i in msg:
    m = pow(i,d,n)//r
    print(long_to_bytes(m))
    
# F:\python3.9\python.exe C:/Users/CTF/PycharmProjects/摆烂杯—你不知道的事/main.py
b"# We're no strangers to love,\n"
b'# You know the rules and so do I.\n'
b"# A full commitment's what I'm thinking of,\n"
b"# You wouldn't get this from any other guy.\n"
b'from Crypto.Util.number import *\n'
b'from sympy import nextprime\n'
b'flag = we_know_each_other_for_so_long\n'
b"flag1 = flag[:len(flag) // 2] + __import__('os').urandom(88)\n"
b"flag2 = flag[len(flag) // 2:] + __import__('os').urandom(88)\n"
b'p = nextprime(bytes_to_long(flag1))\n'
b'q = nextprime(bytes_to_long(flag2))\n'

​ 根据输出的msg内容我们知道flag为flag1和flag2两部分组成，并且p和q就是flag1，2的整数的下一个素数。由于下一个素数大小与本数的差距并不大，只影响低位，于是可以直接将p和q转化成字节，可以看到高位部分就是flag：

b"ctfshow{086c67cb-a132-4\x88\x0b\n:r\xfc\x01)\xe6'\xccI\x1e@_\xf1\x80\x9c\xa8\xb5\xdc\x0fr\xeb\x8c\x11\xd8UWr\x82\xb7\xdd\xbe\xd6{V'\xcf\xbc\xeb\x85\xdcCh\xfcT\xbdK\x16\xb6\xa1\xf7\x06t1j\x95)\x00\xa3\xc6MKk@\xcc\xe2\xe03\xe1\xee\x8e\xf1\xa0\xcf\xef\xca\xa1\xac@\x1d\xb2n\nI\xc8a" b'509-8b6b-6c46386487dc}\n\xf3\x15\x99J\xa4\n}\x1f_ J\xcdMu\xb6\x1d0\x06\x18\xe5\x8b&yJ\xee\xe7\x94L\x96\x119\xa5`~\x9a<\xfdl\x88q\xf8Y"\xe8\x83\x970\xa9\'3hP\x1d\xc3\x16C\x016Y\xcf\xebQe\x99\x9b&\xf6\xf0\xdd\x81\x19\xbb9\xba\xbf\x1d\x07l\x16\xbb\xe8\xf4\xe0`ot\xa9\x8d'

春哥VS曾哥

​ 关于模运算的问题，需要根据服务端给出的数值对进行分类讨论：

from pwn import *
p=remote('pwn.challenge.ctf.show',28020)
def pwn():

    a=str(p.recvline())
    b=a.find('= (')
    c=a.find(',',9)
    d=int(a[b+3:c])#x
    e=int(a[c+2:-4])#y
    if(d>=e):
        p.sendline(str(d+e))
    else:
        f=e%d
        g=(e-f)//d
        h=g*d+f//2
        p.sendline(str(h))
for i in range(233):
    pwn()
    print('进行了',i,'轮验证')
p.interactive()
#flag: ctfshow{f28a4698-124e-4625-9a46-a92ff3c13756}