0xGame2025-week4 - Zsm's blog

前言#

包好的题目，不会写怎么办()

这里只写 week4 的，前几周的感觉还是挺简单的

题目#

Quaternion#

task.py

1
from Crypto.Util.number import *
2
from secret import flag
3

4

5
class Quaternion:
6
    def __init__(self, value=[0, 0, 0, 0]):
7
        if type(value) == str:
8
            self.value = [int(i[:-1]) if i[-1] in 'ijk' else int(i) for i in value.split(' + ')]
9
        elif type(value) == list:
10
            self.value = value
11
        else:
12
            raise ValueError("Invalid type for Quaternion initialization")
13

14
    def __str__(self):
15
        s = str(self.value[0])
16
        for k, i in enumerate(self.value[1:]):
17
            if i >= 0:
18
                s += ' + '
19
            s += str(i) + 'ijk'[k]
20
        return s
21

22
    def __add__(self, x: 'Quaternion'):
23
        return Quaternion([i + j for i, j in zip(self.value, x.value)])
24

25
    def __mul__(self, x):
26
        a = self.value[0] * x.value[0] - self.value[1] * x.value[1] - self.value[2] * x.value[2] - self.value[3] * x.value[3]
27
        b = self.value[0] * x.value[1] + self.value[1] * x.value[0] + self.value[2] * x.value[3] - self.value[3] * x.value[2]
28
        c = self.value[0] * x.value[2] - self.value[1] * x.value[3] + self.value[2] * x.value[0] + self.value[3] * x.value[1]
29
        d = self.value[0] * x.value[3] + self.value[1] * x.value[2] - self.value[2] * x.value[1] + self.value[3] * x.value[0]
30
        return Quaternion([a, b, c, d])
31

32
    def __mod__(self, x: 'Quaternion'):
33
        return Quaternion([i % x for i in self.value])
34

35
    def __pow__(self, x: 'Quaternion', n=None):
36
        tmp = Quaternion(self.value)
37
        a = Quaternion([1, 0, 0, 0])
38
        while x:
39
            if x & 1:
40
                a *= tmp
41
            tmp *= tmp
42
            if n:
43
                a %= n
44
                tmp %= n
45
            x >>= 1
46
        return a
47

48

49
p = getPrime(512)
50
a = 12279853477283008553357657492789763255038870106301916103237655771107240855639019740311384654049683518074767532668306533768786610265460170996795820601321909
51
b = 11210493117462584846695225251401309306620235323150317045189710917149538613051572049177523790232361862309737553875527265480632012163444954592595707353201593
52
c = 450430550110220511170706355346853127519361342092668926760254273216011478764445031538810577279916498307130264816119062480395788963919822889673835039577697
53
d = 3174124676656013174258111656715518261932447407587587373745001204373630194465607583875038303157271540416614763810219408013310091241179227844814818997567768
54
quaternion = Quaternion([a, b, c, d])
55
m = bytes_to_long(flag)
56
enc = pow(quaternion, m, p)
57
print(f"p = {p}")
58
print(f"public = \"{quaternion}\"")
59
print(f"enc = \"{enc}\"")

这里可以非预期（

exp.py

1
p = 12539865613843105911233856888270676153770546095381527984724592359575546777767977150390387506665349509251937298897654702160935929421300160106185683395163421
2

3
a = 12279853477283008553357657492789763255038870106301916103237655771107240855639019740311384654049683518074767532668306533768786610265460170996795820601321909
4
b = 11210493117462584846695225251401309306620235323150317045189710917149538613051572049177523790232361862309737553875527265480632012163444954592595707353201593
5
c = 450430550110220511170706355346853127519361342092668926760254273216011478764445031538810577279916498307130264816119062480395788963919822889673835039577697
6
d = 3174124676656013174258111656715518261932447407587587373745001204373630194465607583875038303157271540416614763810219408013310091241179227844814818997567768
7

8
a_prime = 2265462378761600430532145400101912094563084708128292610022357820427900202076518621271341061446425878932435592087810301613872104317791934633397153003692733
9
b_prime = 11782169557857342336271967041629416683561191223952219855027739818522859391187666351078682423218210372662669230179370323154138802086643543387102521811129172
10
c_prime = 10908162276945008648926361072155772044902584979394235365102141792914012158138256920012734972335441493996292123708617034711883958615075943172083534030307874
11
d_prime = 10540286960315438106114455060855856502156861387281507535140969278011407516259839611632861445654470081837664230792371993219647065751349771625197786828909473
12

13
b_inv = pow(b, -1, p)
14

15
k = (b_prime * b_inv) % p
16

17
a_prime_inv = pow(a_prime, -1, p)
18

19
m = (k * a * a_prime_inv) % p
20

21
from Crypto.Util.number import long_to_bytes
22

23
flag = long_to_bytes(m)
24
print(flag)

MT19937&MT19937-Revenge#

task.py

1
#!/usr/local/bin/python
2
import random
3

4
from secret import flag
5

6
seed = random.randint(0, 2**32 - 1)
7
RNG = random.Random(seed)
8

9
MENU = """
10
MT19937 Seed Challenge
11
======================
12
[G]et random number
13
[C]heck seed
14
"""
15

16
def challenge():
17
    while True:
18
        inputs = input(">> ")
19
        if inputs.strip().upper() == "G":
20
            print(RNG.getrandbits(2))
21
        elif inputs.strip().upper() == "C":
22
            guess = int(input("Guess the seed: "))
23
            if guess == seed:
24
                print(f"Correct! Here is your flag: {flag.decode()}")
25
            else:
26
                print("Incorrect seed. Exiting...")
27
            break
28
        else:
29
            print("Invalid option. Please choose G or C.")
30

31
if __name__ == "__main__":
32
    print("Welcome to the MT19937 Seed Challenge!")
33
    print("A random seed has been generated. You can get random numbers or try to guess the seed.")
34
    print(MENU)
35
    challenge()

就是随机数预测，然后恢复 seed。MT19937-Revenge是限制了时间。只会返回 0123 四种情况，收集个 1w 组先，这里用gf2bv恢复状态，然后 z3 恢复 seed

exp.py

1
import sys
2
import time
3

4
from gf2bv import LinearSystem
5
from gf2bv.crypto.mt import MT19937
6
from pwn import context, remote
7
from z3 import BitVec, BitVecVal, LShR, Solver, sat
8

9
HOST, PORT = "nc1.ctfplus.cn", 24940
10
WORDS, WORD_BITS = 624, 32
11
BITS_PER_QUERY = 2
12
NEED = WORDS * WORD_BITS // BITS_PER_QUERY
13
TOTAL_QUERIES = 10000
14
N, M = 624, 397
15
MATRIX_A = 0x9908B0DF
16
UPPER_MASK = 0x80000000
17
LOWER_MASK = 0x7fffffff
18

19
def twist_expr(prev):
20
    nxt = [None]*N
21
    for i in range(N):
22
        x = (prev[i] & BitVecVal(UPPER_MASK,32)) | (prev[(i+1)%N] & BitVecVal(LOWER_MASK,32))
23
        xa = LShR(x,1) ^ ((x & BitVecVal(1,32)) * BitVecVal(MATRIX_A,32))
24
        nxt[i] = prev[(i+M)%N] ^ xa
25
    return nxt
26

27
def init_by_array_expr_from_seed(seed_bv):
28
    s = [None]*N
29
    s[0] = BitVecVal(19650218, 32)
30
    for i in range(1, N):
31
        s[i] = (BitVecVal(1812433253,32)*(s[i-1]^LShR(s[i-1],30))+BitVecVal(i,32))
32
    i=1;j=0;k=N
33
    for _ in range(k):
34
        s[i]=(s[i]^((s[i-1]^LShR(s[i-1],30))*BitVecVal(1664525,32)))+seed_bv+BitVecVal(j,32)
35
        i+=1;j+=1
36
        if i>=N:
37
            s[0]=s[N-1];i=1
38
        if j>=1:
39
            j=0
40
    for _ in range(N-1):
41
        s[i]=(s[i]^((s[i-1]^LShR(s[i-1],30))*BitVecVal(1566083941,32)))-BitVecVal(i,32)
42
        i+=1
43
        if i>=N:
44
            s[0]=s[N-1];i=1
45
    s[0]=BitVecVal(0x80000000,32)
46
    return s
47

48
def recv_prompt(io):
49
    try:
50
        io.recvuntil(b">> ", timeout=2)
51
    except Exception:
52
        pass
53

54
def read_batch(io, batch_count=128, read_timeout=0.25):
55
    outs=[]
56
    buf=b""
57
    try:
58
        io.send(b"g\n"*batch_count)
59
    except Exception as e:
60
        print("[!] send error:", e)
61
        return outs
62
    deadline=time.time()+read_timeout
63
    while time.time()<deadline:
64
        try:
65
            chunk=io.recv(4096, timeout=read_timeout)
66
            if not chunk:
67
                break
68
            buf+=chunk
69
            parts=buf.split()
70
            new_outs=[]
71
            for tok in parts:
72
                if tok in (b"0",b"1",b"2",b"3"):
73
                    new_outs.append(int(tok))
74
            if new_outs:
75
                outs.extend(new_outs)
76
                buf=b""
77
            else:
78
                if len(buf)>4096:
79
                    buf=buf[-1024:]
80
        except Exception:
81
            break
82
    return outs
83

84
def collect():
85
    context.log_level="warning"
86
    io=remote(HOST,PORT)
87
    recv_prompt(io)
88
    outs=[]
89
    batch_size=128
90
    read_timeout=0.22
91
    start_time=time.time()
92
    MAX_DURATION=95
93
    try:
94
        while len(outs)<TOTAL_QUERIES and time.time()-start_time<MAX_DURATION:
95
            to_send=min(batch_size,TOTAL_QUERIES-len(outs))
96
            new=read_batch(io,batch_count=to_send,read_timeout=read_timeout)
97
            if new:
98
                outs.extend(new)
99
            print(f"[+] Collected {len(outs)}/{TOTAL_QUERIES}")
100
            if not new:
101
                time.sleep(0.05)
102
    except KeyboardInterrupt:
103
        print("[!] interrupted")
104
    return io,outs
105

106
def recover_pretwist_state(outs):
107
    lin=LinearSystem([WORD_BITS]*WORDS)
108
    mt=lin.gens()
109
    rng=MT19937(mt)
110
    zeros=[rng.getrandbits(BITS_PER_QUERY)^int(o) for o in outs]
111
    sol=lin.solve_one(zeros)
112
    return [int(w)&0xFFFFFFFF for w in sol]
113

114
def invert_seed_with_z3(block, allow_one_twist=True):
115
    seed=BitVec("seed",32)
116
    s0=init_by_array_expr_from_seed(seed)
117
    def try_model(target):
118
        S=Solver()
119
        for i in range(N):
120
            S.add(s0[i]==BitVecVal(target[i],32))
121
        if S.check()==sat:
122
            return S.model()[seed].as_long()&0xFFFFFFFF
123
        return None
124
    z=try_model(block)
125
    if z is not None:
126
        return z
127
    if allow_one_twist:
128
        tb=twist_expr(s0)
129
        S=Solver()
130
        for i in range(N):
131
            S.add(tb[i]==BitVecVal(block[i],32))
132
        if S.check()==sat:
133
            return S.model()[seed].as_long()&0xFFFFFFFF
134
    return None
135

136
def main():
137
    io,outs=collect()
138
    block=recover_pretwist_state(outs[:NEED])
139
    seed=invert_seed_with_z3(block,allow_one_twist=True)
140
    io.sendline(b"c")
141
    io.recvuntil(b"Guess the seed:")
142
    io.sendline(str(seed).encode())
143
    try:
144
        while True:
145
            line=io.recvline(timeout=1)
146
            if not line:
147
                break
148
            sys.stdout.write(line.decode(errors="ignore"))
149
    except Exception:
150
        pass
151
    io.close()
152

153
if __name__=="__main__":
154
    main()

AES Square#

task.py

1
from secret import flag
2
from utils import AES
3
import os
4

5
MENU = """
6
AES Machine
7
[E]ncrypt
8
[G]et Encrypted Flag
9
"""
10

11

12
def pad(msg): return msg + bytes([16 - len(msg) % 16] * (16 - len(msg) % 16))
13

14

15
print(MENU)
16
key = os.urandom(16)
17
cipher = AES(key, rounds=4)
18
enc = cipher.encrypt(pad(flag.encode()))
19
while True:
20
    try:
21
        choice = input("Choice: ").strip().upper()
22
        if choice == 'E':
23
            plaintext = input("Plaintext (hex): ").strip()
24
            try:
25
                plaintext_bytes = bytes.fromhex(plaintext)
26
                if len(plaintext_bytes) % 16 != 0:
27
                    print("Plaintext length must be a multiple of 16 bytes.")
28
                    continue
29
                ciphertext = cipher.encrypt(plaintext_bytes)
30
                print("Ciphertext (hex):", ciphertext.hex())
31
            except ValueError:
32
                print("Invalid hex input.")
33
        elif choice == 'G':
34
            print("Encrypted Flag (hex):", enc.hex())
35
    except Exception as e:
36
        print("Error:", str(e))

Square 攻击，这里固定前 15 字节，爆破最后一个字节，爆三组交上去，一般就可以确定末轮 16 字节了，然后再回推

exp.py

1
#!/usr/bin/env python3
2
# -*- coding: utf-8 -*-
3
from pwn import context, remote
4

5
context.log_level = "error"
6

7
HOST = "nc1.ctfplus.cn"
8
PORT = 21405
9

10
def gen_sboxes():
11
    S = [0x63] + [0] * 255
12
    def r(x, s):
13
        return ((x << s) | (x >> (8 - s))) & 0xff
14
    p, q = 1, 1
15
    for _ in range(255):
16
        p = (p ^ (p * 2) ^ (27 if p >= 128 else 0)) & 0xff
17
        q ^= (q * 2) & 0xff
18
        q ^= (q * 4) & 0xff
19
        q ^= (q * 16) & 0xff
20
        q ^= (9 if q >= 128 else 0)
21
        S[p] = q ^ r(q, 1) ^ r(q, 2) ^ r(q, 3) ^ r(q, 4) ^ 99
22
    S_inv = [0]*256
23
    for i in range(256):
24
        S_inv[S[i]] = i
25
    return S, S_inv
26

27
S, S_INV = gen_sboxes()
28
RCON = [0x01,0x02,0x04,0x08,0x10,0x20,0x40,0x80,0x1B,0x36]
29

30
def bxor(a, b):
31
    return [(x ^ y) & 0xff for x, y in zip(a, b)]
32

33
def T(word, r):
34
    w = word[1:] + word[:1]
35
    w = [S[x] for x in w]
36
    w[0] ^= RCON[r]
37
    return w
38

39
def bytes_to_words16(b16):
40
    return [list(b16[i:i+4]) for i in range(0, 16, 4)]
41

42
def words_to_bytes(words):
43
    return bytes(sum(words, []))
44

45
def last_round_key_bytes_to_words(k4_bytes):
46
    return [list(k4_bytes[j*4:(j+1)*4]) for j in range(4)]
47

48
def invert_key_schedule_from_last_round_key(k4_bytes, rounds=4):
49
    W = [None]*((rounds+1)*4)
50
    last_words = last_round_key_bytes_to_words(k4_bytes)
51
    for j in range(4):
52
        W[16+j] = last_words[j]
53
    for i in range((rounds+1)*4 - 1, 3, -1):
54
        if i % 4 == 0:
55
            W[i-4] = bxor(W[i], T(W[i-1], i//4 - 1))
56
        else:
57
            W[i-4] = bxor(W[i], W[i-1])
58
    return words_to_bytes(W[0:4])
59

60
class AES4:
61
    Rcon = RCON
62
    def __init__(self, key: bytes, rounds: int = 4):
63
        self.rounds = rounds
64
        self.key = key
65
        self.S = S
66
        self.S_inv = S_INV
67
        self.W = [list(key[i:i + 4]) for i in range(0, 16, 4)]
68
        self._key_expansion()
69
    def _xor(self, a, b=None):
70
        if b is None:
71
            assert len(a) > 0
72
            return a[0] ^ self._xor(a[1:]) if len(a) > 1 else a[0]
73
        assert len(a) == len(b)
74
        return [x ^ y for x, y in zip(a, b)]
75
    def _gmul(self, a, b):
76
        p = 0
77
        while b:
78
            if b & 1:
79
                p ^= a
80
            a = a << 1
81
            if a >> 8:
82
                a ^= 0b100011011
83
            b >>= 1
84
        return p & 0xff
85
    def _multiply(self, a, b):
86
        return self._xor([self._gmul(x, y) for x, y in zip(a, b)])
87
    def _matrix_multiply(self, const, state):
88
        return [[self._multiply(const[i], [state[k][j] for k in range(4)]) for j in range(4)] for i in range(4)]
89
    def _permutation(self, lis, table):
90
        return [table[i] for i in lis]
91
    def _block_permutation(self, block, table):
92
        return [self._permutation(row, table) for row in block]
93
    def _left_shift(self, block, n):
94
        return block[n:] + block[:n]
95
    def _bytes_to_matrix(self, text: bytes) -> list:
96
        return [[text[j * 4 + i] for j in range(4)] for i in range(4)]
97
    def _matrix_to_bytes(self, block: list) -> bytes:
98
        return bytes([block[j][i] for i in range(4) for j in range(4)])
99
    def _T(self, w: list, n) -> list:
100
        w = self._left_shift(w, 1)
101
        w = self._permutation(w, self.S)
102
        w[0] ^= self.Rcon[n]
103
        return w
104
    def _key_expansion(self):
105
        for i in range(4, (self.rounds + 1) * 4):
106
            if i % 4 == 0:
107
                self.W.append(self._xor(self.W[i - 4], self._T(self.W[i - 1], i // 4 - 1)))
108
            else:
109
                self.W.append(self._xor(self.W[i - 4], self.W[i -  1]))
110
    def _row_shift(self, block):
111
        return [self._left_shift(block[i], i) for i in range(4)]
112
    def _column_mix(self, block):
113
        return self._matrix_multiply([self._left_shift([2, 3, 1, 1], 4 - i) for i in range(4)], block)
114
    def _round_key_add(self, block, key):
115
        return [self._xor(block[i], [key[j][i] for j in range(4)]) for i in range(4)]
116
    def _encrypt(self, block):
117
        block = self._round_key_add(block, self.W[:4])
118
        for i in range(1, self.rounds):
119
            block = self._block_permutation(block, self.S)
120
            block = self._row_shift(block)
121
            block = self._column_mix(block)
122
            block = self._round_key_add(block, self.W[i * 4:(i + 1) * 4])
123
        block = self._block_permutation(block, self.S)
124
        block = self._row_shift(block)
125
        block = self._round_key_add(block, self.W[-4:])
126
        return block
127
    def _inv_row_shift(self, block):
128
        return [self._left_shift(block[i], 4 - i) for i in range(4)]
129
    def _inv_column_mix(self, block):
130
        return self._matrix_multiply([self._left_shift([14, 11, 13, 0x9], 4 - i) for i in range(4)], block)
131
    def _decrypt(self, block):
132
        block = self._round_key_add(block, self.W[-4:])
133
        for i in range(self.rounds - 1, 0, -1):
134
            block = self._inv_row_shift(block)
135
            block = self._block_permutation(block, self.S_inv)
136
            block = self._round_key_add(block, self.W[i * 4:(i + 1) * 4])
137
            block = self._inv_column_mix(block)
138
        block = self._inv_row_shift(block)
139
        block = self._block_permutation(block, self.S_inv)
140
        block = self._round_key_add(block, self.W[:4])
141
        return block
142
    def decrypt(self, ciphertext: bytes) -> bytes:
143
        assert len(ciphertext) % 16 == 0
144
        out = b''
145
        for i in range(0, len(ciphertext), 16):
146
            block = ciphertext[i:i+16]
147
            block = self._bytes_to_matrix(block)
148
            block = self._decrypt(block)
149
            out += self._matrix_to_bytes(block)
150
        return out
151

152
def pkcs7_unpad(data: bytes) -> bytes:
153
    if not data: return data
154
    pad = data[-1]
155
    if pad == 0 or pad > 16: return data
156
    if data.endswith(bytes([pad])*pad):
157
        return data[:-pad]
158
    return data
159

160
class Oracle:
161
    def __init__(self, host, port):
162
        self.io = remote(host, port)
163
        self._drain_to_choice()
164
    def _drain_to_choice(self):
165
        self.io.recvuntil(b"Choice")
166
        self.io.recvuntil(b":")
167
    def get_flag_ct(self) -> bytes:
168
        self.io.sendline(b"G")
169
        self.io.recvuntil(b"Encrypted Flag (hex): ")
170
        ct_hex = self.io.recvline().strip()
171
        self._drain_to_choice()
172
        return bytes.fromhex(ct_hex.decode())
173
    def encrypt(self, pt16: bytes) -> bytes:
174
        assert len(pt16) % 16 == 0
175
        self.io.sendline(b"E")
176
        self.io.recvuntil(b"Plaintext (hex): ")
177
        self.io.sendline(pt16.hex().encode())
178
        self.io.recvuntil(b"Ciphertext (hex): ")
179
        ct_hex = self.io.recvline().strip()
180
        self._drain_to_choice()
181
        return bytes.fromhex(ct_hex.decode())
182

183
def recover_last_round_key(oracle, max_sets=3):
184
    candidates = [set(range(256)) for _ in range(16)]
185
    def collect_delta_set(vary_pos: int, base_byte: int):
186
        cts = []
187
        base = bytearray([base_byte]*16)
188
        for x in range(256):
189
            pt = base[:]
190
            pt[vary_pos] = x
191
            ct = oracle.encrypt(bytes(pt))
192
            cts.append(ct)
193
        return cts
194
    used_sets = 0
195
    plan = [(0,0x00), (7,0x5a), (13,0xa7), (4,0x11), (10,0x33)]
196
    while used_sets < max_sets and any(len(c)>1 for c in candidates):
197
        vary_pos, base_byte = plan[used_sets % len(plan)]
198
        used_sets += 1
199
        cts = collect_delta_set(vary_pos, base_byte)
200
        for s in range(16):
201
            good = set()
202
            col = [ct[s] for ct in cts]
203
            for k in range(256):
204
                acc = 0
205
                for b in col:
206
                    acc ^= S_INV[b ^ k]
207
                if acc == 0:
208
                    good.add(k)
209
            candidates[s] &= good
210
        stat = [len(c) for c in candidates]
211
        print(f"[+] After set {used_sets}: remaining candidates per byte = {stat}")
212
    if any(len(c)!=1 for c in candidates):
213
        if used_sets < len(plan):
214
            vary_pos, base_byte = plan[used_sets % len(plan)]
215
            cts = collect_delta_set(vary_pos, base_byte)
216
            for s in range(16):
217
                good = set()
218
                col = [ct[s] for ct in cts]
219
                for k in range(256):
220
                    acc = 0
221
                    for b in col:
222
                        acc ^= S_INV[b ^ k]
223
                    if acc == 0:
224
                        good.add(k)
225
                candidates[s] &= good
226
    k4 = bytes([next(iter(c)) if len(c)==1 else min(c) for c in candidates])
227
    if any(len(c)!=1 for c in candidates):
228
        print("[!] Warning: some bytes not unique; chose minimal candidate. (You can increase max_sets)")
229
    return k4
230

231
def main():
232
    print(f"[*] Connecting to {HOST}:{PORT} ...")
233
    oracle = Oracle(HOST, PORT)
234
    flag_ct = oracle.get_flag_ct()
235
    print(f"[+] Encrypted flag ({len(flag_ct)} bytes): {flag_ct.hex()}")
236
    k4 = recover_last_round_key(oracle, max_sets=3)
237
    print(f"[+] Recovered last round key (round 4): {k4.hex()}")
238
    master_key = invert_key_schedule_from_last_round_key(k4, rounds=4)
239
    print(f"[+] Master key: {master_key.hex()}")
240
    aes = AES4(master_key, rounds=4)
241
    pt = aes.decrypt(flag_ct)
242
    pt = pkcs7_unpad(pt)
243
    s = pt.decode('latin1')
244
    print(f"[+] Flag (raw): {pt}")
245
    print(f"[+] Flag (str): {s}")
246

247
if __name__ == "__main__":
248
    main()

蓉凤#

task.py

1
from Crypto.Util.number import *
2
from os import urandom,getenv
3
from AES import AES
4
import signal
5
import uuid
6

7
flag = getenv('FLAG',f'0xGame{{{uuid.uuid4()}}}')
8

9
if __name__ == '__main__':
10
    print(f'[+] This is Hibiscus blooming in the glazing autumn wind.')
11
    print(f'[+] It\'s said that some of you at 0xGame loves brute-force, which raises Hibiscus\'s interest:)')
12
    print(f'[+] Enjoy it!')
13

14
    signal.alarm(2025)
15

16
    secret = urandom(16)
17
    key = urandom(16)
18
    aes = AES(key,4)
19
    op = 232
20

21

22
    def enc():
23
        global op
24

25
        if op <= 0:
26
            print(f'[!] You\'ve ran out of encryption attempts!')
27
            return
28

29
        op -= 1
30
        print(f'[+] You still have {op} chances to play with Hibiscus~')
31
        print(f'[+] Hibiscus\'s encrypted secret is:{aes.encrypt(secret[:-1] + urandom(1)).hex()}')
32

33

34
    def fetch():
35
        try:
36
            assert bytes.fromhex(input('[-] Enter Hibiscus\'s secret:')) == secret
37
            print(f'[+] You did it! But how....? Definitely astonishing!!!')
38
            print(f'[+] Can\'t be more delightful now, is it?')
39
            print(f'[+] Anyway here\'s the flag: {flag}')
40
            exit()
41

42
        except (AssertionError, ValueError):
43
            print(f'[!] Wrong!')
44

45

46
    fdc = {'E':enc,'F':fetch}
47

48
    while True:
49
        fdc.get(input('[-] Your option:'),lambda: print(f'[!] Invalid input'))()

升级版，4bits，这里找到了出题人的攻击，直接编译完梭哈的。

exp.py

1
#!/usr/bin/env python3
2
# -*- coding: utf-8 -*-
3
import re
4
import subprocess
5
from pwn import remote
6

7
HOST, PORT = "nc1.ctfplus.cn", 49403
8
MIN_UNIQUE = 100
9
OUTFILE = "pdelta.txt"
10

11
SBOX = (0x63,0x7c,0x77,0x7b,0xf2,0x6b,0x6f,0xc5,0x30,0x01,0x67,0x2b,0xfe,0xd7,0xab,0x76,
12
        0xca,0x82,0xc9,0x7d,0xfa,0x59,0x47,0xf0,0xad,0xd4,0xa2,0xaf,0x9c,0xa4,0x72,0xc0,
13
        0xb7,0xfd,0x93,0x26,0x36,0x3f,0xf7,0xcc,0x34,0xa5,0xe5,0xf1,0x71,0xd8,0x31,0x15,
14
        0x04,0xc7,0x23,0xc3,0x18,0x96,0x05,0x9a,0x07,0x12,0x80,0xe2,0xeb,0x27,0xb2,0x75,
15
        0x09,0x83,0x2c,0x1a,0x1b,0x6e,0x5a,0xa0,0x52,0x3b,0xd6,0xb3,0x29,0xe3,0x2f,0x84,
16
        0x53,0xd1,0x00,0xed,0x20,0xfc,0xb1,0x5b,0x6a,0xcb,0xbe,0x39,0x4a,0x4c,0x58,0xcf,
17
        0xd0,0xef,0xaa,0xfb,0x43,0x4d,0x33,0x85,0x45,0xf9,0x02,0x7f,0x50,0x3c,0x9f,0xa8,
18
        0x51,0xa3,0x40,0x8f,0x92,0x9d,0x38,0xf5,0xbc,0xb6,0xda,0x21,0x10,0xff,0xf3,0xd2,
19
        0xcd,0x0c,0x13,0xec,0x5f,0x97,0x44,0x17,0xc4,0xa7,0x7e,0x3d,0x64,0x5d,0x19,0x73,
20
        0x60,0x81,0x4f,0xdc,0x22,0x2a,0x90,0x88,0x46,0xee,0xb8,0x14,0xde,0x5e,0x0b,0xdb,
21
        0xe0,0x32,0x3a,0x0a,0x49,0x06,0x24,0x5c,0xc2,0xd3,0xac,0x62,0x91,0x95,0xe4,0x79,
22
        0xe7,0xc8,0x37,0x6d,0x8d,0xd5,0x4e,0xa9,0x6c,0x56,0xf4,0xea,0x65,0x7a,0xae,0x08,
23
        0xba,0x78,0x25,0x2e,0x1c,0xa6,0xb4,0xc6,0xe8,0xdd,0x74,0x1f,0x4b,0xbd,0x8b,0x8a,
24
        0x70,0x3e,0xb5,0x66,0x48,0x03,0xf6,0x0e,0x61,0x35,0x57,0xb9,0x86,0xc1,0x1d,0x9e,
25
        0xe1,0xf8,0x98,0x11,0x69,0xd9,0x8e,0x94,0x9b,0x1e,0x87,0xe9,0xce,0x55,0x28,0xdf,
26
        0x8c,0xa1,0x89,0x0d,0xbf,0xe6,0x42,0x68,0x41,0x99,0x2d,0x0f,0xb0,0x54,0xbb,0x16)
27
INV_SBOX = (0x52,0x09,0x6a,0xd5,0x30,0x36,0xa5,0x38,0xbf,0x40,0xa3,0x9e,0x81,0xf3,0xd7,0xfb,
28
            0x7c,0xe3,0x39,0x82,0x9b,0x2f,0xff,0x87,0x34,0x8e,0x43,0x44,0xc4,0xde,0xe9,0xcb,
29
            0x54,0x7b,0x94,0x32,0xa6,0xc2,0x23,0x3d,0xee,0x4c,0x95,0x0b,0x42,0xfa,0xc3,0x4e,
30
            0x08,0x2e,0xa1,0x66,0x28,0xd9,0x24,0xb2,0x76,0x5b,0xa2,0x49,0x6d,0x8b,0xd1,0x25,
31
            0x72,0xf8,0xf6,0x64,0x86,0x68,0x98,0x16,0xd4,0xa4,0x5c,0xcc,0x5d,0x65,0xb6,0x92,
32
            0x6c,0x70,0x48,0x50,0xfd,0xed,0xb9,0xda,0x5e,0x15,0x46,0x57,0xa7,0x8d,0x9d,0x84,
33
            0x90,0xd8,0xab,0x00,0x8c,0xbc,0xd3,0x0a,0xf7,0xe4,0x58,0x05,0xb8,0xb3,0x45,0x06,
34
            0xd0,0x2c,0x1e,0x8f,0xca,0x3f,0x0f,0x02,0xc1,0xaf,0xbd,0x03,0x01,0x13,0x8a,0x6b,
35
            0x3a,0x91,0x11,0x41,0x4f,0x67,0xdc,0xea,0x97,0xf2,0xcf,0xce,0xf0,0xb4,0xe6,0x73,
36
            0x96,0xac,0x74,0x22,0xe7,0xad,0x35,0x85,0xe2,0xf9,0x37,0xe8,0x1c,0x75,0xdf,0x6e,
37
            0x47,0xf1,0x1a,0x71,0x1d,0x29,0xc5,0x89,0x6f,0xb7,0x62,0x0e,0xaa,0x18,0xbe,0x1b,
38
            0xfc,0x56,0x3e,0x4b,0xc6,0xd2,0x79,0x20,0x9a,0xdb,0xc0,0xfe,0x78,0xcd,0x5a,0xf4,
39
            0x1f,0xdd,0xa8,0x33,0x88,0x07,0xc7,0x31,0xb1,0x12,0x10,0x59,0x27,0x80,0xec,0x5f,
40
            0x60,0x51,0x7f,0xa9,0x19,0xb5,0x4a,0x0d,0x2d,0xe5,0x7a,0x9f,0x93,0xc9,0x9c,0xef,
41
            0xa0,0xe0,0x3b,0x4d,0xae,0x2a,0xf5,0xb0,0xc8,0xeb,0xbb,0x3c,0x83,0x53,0x99,0x61,
42
            0x17,0x2b,0x04,0x7e,0xba,0x77,0xd6,0x26,0xe1,0x69,0x14,0x63,0x55,0x21,0x0c,0x7d)
43
RCON = (0x01,0x02,0x04,0x08)
44

45
def collect_cts():
46
    io = remote(HOST, PORT)
47
    uniq = set()
48
    io.recvuntil(b'Enjoy it!')
49
    while len(uniq) < MIN_UNIQUE:
50
        io.sendlineafter(b":", b"E")
51
        io.recvuntil(b"encrypted secret is:")
52
        hx = io.recvline().strip().decode()
53
        uniq.add(hx)
54
    with open(OUTFILE, "w") as f:
55
        for h in uniq:
56
            f.write(h + "\n")
57
    return io, uniq
58

59
def run_square_revenge(count):
60
    out = subprocess.check_output(["/Users/zsm/CTF/zsm/AES-Integrals/AES/build/bin/aes4-2", "-i", OUTFILE, "--count", str(count)])
61
    m = re.findall(rb"[0-9a-fA-F]{32}", out)
62
    keyhex = m[-1].decode()
63
    return bytes.fromhex(keyhex)
64

65
def gmul(a, b):
66
    p = 0
67
    for _ in range(8):
68
        if b & 1:
69
            p ^= a
70
        hi = a & 0x80
71
        a = (a << 1) & 0xff
72
        if hi:
73
            a ^= 0x1b
74
        b >>= 1
75
    return p
76

77
def inv_mix_columns(s):
78
    out = bytearray(16)
79
    for i in range(0, 16, 4):
80
        a, b, c, d = s[i:i+4]
81
        out[i]   = gmul(a, 0x0e) ^ gmul(b, 0x0b) ^ gmul(c, 0x0d) ^ gmul(d, 0x09)
82
        out[i+1] = gmul(a, 0x09) ^ gmul(b, 0x0e) ^ gmul(c, 0x0b) ^ gmul(d, 0x0d)
83
        out[i+2] = gmul(a, 0x0d) ^ gmul(b, 0x09) ^ gmul(c, 0x0e) ^ gmul(d, 0x0b)
84
        out[i+3] = gmul(a, 0x0b) ^ gmul(b, 0x0d) ^ gmul(c, 0x09) ^ gmul(d, 0x0e)
85
    return bytes(out)
86

87
def inv_shift_rows(s):
88
    return bytes([s[0], s[13], s[10], s[7],
89
                  s[4], s[1], s[14], s[11],
90
                  s[8], s[5], s[2], s[15],
91
                  s[12], s[9], s[6], s[3]])
92

93
def inv_sub_bytes(s):
94
    return bytes(INV_SBOX[b] for b in s)
95

96
def expand_key(key):
97
    rk = [key]
98
    for i in range(4):
99
        prev = rk[-1]
100
        t = bytes([SBOX[prev[13]] ^ RCON[i], SBOX[prev[14]], SBOX[prev[15]], SBOX[prev[12]]])
101
        nk = bytes(prev[j] ^ t[j] for j in range(4))
102
        for k in range(4, 16, 4):
103
            nk += bytes(prev[j+k] ^ nk[j+k-4] for j in range(4))
104
        rk.append(nk)
105
    return rk
106

107
def aes4_decrypt_block(ct, key):
108
    rks = expand_key(key)
109
    s = bytes(c ^ k for c, k in zip(ct, rks[-1]))
110
    s = inv_shift_rows(s)
111
    s = inv_sub_bytes(s)
112
    for r in range(3, 0, -1):
113
        s = bytes(c ^ k for c, k in zip(s, rks[r]))
114
        s = inv_mix_columns(s)
115
        s = inv_shift_rows(s)
116
        s = inv_sub_bytes(s)
117
    s = bytes(c ^ k for c, k in zip(s, rks[0]))
118
    return s
119

120
def brute_last_byte(io, prefix15):
121
    for b in range(256):
122
        guess = (prefix15 + bytes([b])).hex().encode()
123
        io.sendlineafter(b":", b"F")
124
        io.recvuntil(b"secret:")
125
        io.sendline(guess)
126
        resp = io.recvline(timeout=2) or b""
127
        if b"You did it!" in resp:
128
            print(resp.decode().strip())
129
            print(io.recvline().decode().strip())
130
            print(io.recvline().decode().strip())
131
            return True
132
    return False
133

134
if __name__ == "__main__":
135
    io, cset = collect_cts()
136
    key = run_square_revenge(len(cset))
137
    print("Master key =", key.hex())
138
    any_ct = next(iter(cset))
139
    pt = aes4_decrypt_block(bytes.fromhex(any_ct), key)
140
    prefix15 = pt[:-1]
141
    print("secret[:15] =", prefix15.hex())
142
    ok = brute_last_byte(io, prefix15)

逐望#

task.py

1
__import__('os').environ['TERM'] = 'xterm'
2

3
from sage.all import *
4
from Crypto.Util.number import *
5
from os import urandom,environ
6
from pwn import xor
7
import uuid
8

9
flag = environ.get('FLAG',f'0xGame{{{uuid.uuid4()}}}')
10

11

12
class _550C:
13
    def __init__(self,sec: bytes = None):
14
        self.p = 76884956397045344220809746629001649093037950200943055203735601445031516197751
15
        self.a = 56698187605326110043627228396178346077120614539475214109386828188763884139993
16
        self.b = 17577232497321838841075697789794520262950426058923084567046852300633325438902
17

18
        self.E = EllipticCurve(Zmod(self.p),[self.a,self.b])
19

20
        if sec is not None:
21
            while True:
22
                try:
23
                    m = sec + urandom(32-len(sec))
24
                    self.stat = self.E.lift_x(ZZ(int.from_bytes(m)))
25
                    break
26
                except:
27
                    continue
28
        else:
29
            self.stat = self.E.random_point()
30

31
        self.inc = self.E.random_point()
32
        for _ in range(int.from_bytes(urandom(2))):
33
            self.next()
34

35
    def next(self):
36
        ret = self.stat.xy()
37
        self.stat += self.inc
38
        return ret
39

40
    def _rand550(self):
41
        x,y = self.next()
42
        p1 = int(x).to_bytes(32,'little').rjust(35)
43
        p2 = int(y).to_bytes(32,'little').rjust(35)
44
        dev1 = urandom(7).ljust(35)
45
        dev2 = urandom(7).ljust(35)
46
        return int.from_bytes(xor(p1,dev1)+xor(p2,dev2)) % 2**550
47

48
    def getrandbits(self,bits:int):
49
        assert bits >= 0
50
        parts = []
51
        for _ in range(bits // 550 + 1):
52
            parts.append(self._rand550())
53

54
        return reduce(lambda x,y: (x<<550) + y,reversed(parts),0) % 2**bits
55

56
if __name__=='__main__':
57
    key = '0xGGGGame#' + urandom(7).hex()
58

59
    print(f'[+] Initializing 550C...')
60
    r = _550C(key.encode())
61
    print(f'[+] Your random number: {r.getrandbits(2025)}')
62

63
    if(input('[-] Your secret code:') == key):
64
        print(f'[+] Good job! The flag is {flag}')
65
        exit()
66
    else:
67
        print(f'[!] Wrong!')

其实能很快的意识到这是二元 copper？

x=X+u \\ y=Y+v \\ f(u,v)=(Y+v)^2-(X+u)^3-a(X+u)-b=0 \mod p

在这里面 uv 是比较小的，可以直接 copper 出来，然后再回溯求 seed，然后求 key，这里后面的步骤 ai 写的，我写前面的 copper

exp.py

1
import itertools
2
from pwn import remote
3
from sage.all import *
4

5
HOST = "nc1.ctfplus.cn"
6
PORT = 24852
7

8
p = 76884956397045344220809746629001649093037950200943055203735601445031516197751
9
a = 56698187605326110043627228396178346077120614539475214109386828188763884139993
10
b = 17577232497321838841075697789794520262950426058923084567046852300633325438902
11

12
F = GF(p)
13
E = EllipticCurve(F, [a, b])
14
N = E.order()
15
inv = lambda d: inverse_mod(d, N)
16

17
HEXDIGITS = set(b"0123456789abcdef")
18
PREFIX = b"0xGGGGame#"
19

20
def small_roots(f, bounds, m=1, d=None):
21
    if not d:
22
        d = f.degree()
23
    if isinstance(f, Polynomial):
24
        x, = polygens(f.base_ring(), f.variable_name(), 1)
25
        f = f(x)
26

27
    R = f.base_ring()
28
    Nmod = R.cardinality()
29
    leading = 1 / f.coefficients().pop(0)
30
    f = f.map_coefficients(lambda x: x * leading).change_ring(ZZ)
31

32
    G = Sequence([], f.parent())
33
    for i in range(m+1):
34
        base = Nmod**(m-i) * f**i
35
        for shifts in itertools.product(range(d), repeat=f.nvariables()):
36
            g = base * prod(v**e for v, e in zip(f.variables(), shifts))
37
            G.append(g)
38

39
    B, monomials = G.coefficient_matrix()
40
    monomials = vector(monomials)
41
    factors = [monomial(*bounds) for monomial in monomials]
42

43
    for i, factor in enumerate(factors):
44
        B.rescale_col(i, factor)
45

46
    B = B.dense_matrix().LLL().change_ring(QQ)
47
    for i, factor in enumerate(factors):
48
        B.rescale_col(i, 1/factor)
49

50
    H = Sequence([], f.parent().change_ring(QQ))
51
    for h in filter(None, B*monomials):
52
        H.append(h)
53
        I = H.ideal()
54
        if I.dimension() == 0:
55
            roots = []
56
            for root in I.variety(ring=ZZ):
57
                roots.append(tuple(R(root[var]) for var in f.variables()))
58
            return roots
59
    return []
60

61
def split_blocks_550(Rint):
62
    MASK = (1 << 550) - 1
63
    return [(Rint >> (550 * i)) & MASK for i in range(4)]
64

65
def point_from_block(block):
66
    C = int(block).to_bytes(70, "big")
67
    p1_tail = C[7:35]
68
    p2_tail = C[42:70]
69

70
    x_bytes = [0]*32
71
    y_bytes = [0]*32
72
    for i in range(28):
73
        x_bytes[4 + i] = p1_tail[i] ^ 0x20
74
        y_bytes[4 + i] = p2_tail[i] ^ 0x20
75
    X = sum(x_bytes[k] * (256**k) for k in range(32))
76
    Y = sum(y_bytes[k] * (256**k) for k in range(32))
77

78
    Ruv = PolynomialRing(GF(p), names=("u", "v"))
79
    u, v = Ruv.gens()
80
    f = (Y + v)**2 - (X + u)**3 - a*(X + u) - b
81
    bounds = (2**32, 2**32)
82

83
    sol = None
84
    for m in [1, 2, 3]:
85
        for d in [3, 4, 5]:
86
            roots = small_roots(f, bounds, m=m, d=d)
87
            if roots:
88
                sol = roots[0]
89
                break
90
        if sol:
91
            break
92
    if not sol:
93
        raise ValueError("Coppersmith failed")
94

95
    ur, vr = map(int, sol)
96
    x = (X + ur) % p
97
    y = (Y + vr) % p
98
    return E.point((F(x), F(y)))
99

100
def is_hex_ascii(bs):
101
    return all(c in HEXDIGITS for c in bs)
102

103
def try_recover_key_from_seed_x(seed_x):
104
    for k in range(3):
105
        m = seed_x + k * p
106
        if m >= (1 << 256):
107
            continue
108
        ms = m.to_bytes(32, "big")
109
        if ms.startswith(PREFIX) and is_hex_ascii(ms[10:24]):
110
            return ms[:24].decode("ascii")
111
    return None
112

113
def recover_key(base_point, inc, offset):
114
    B = base_point - (offset * inc)
115
    for c in range(0, (1 << 16) + 8):
116
        S = B - (c * inc)
117
        key = try_recover_key_from_seed_x(int(S.xy()[0]))
118
        if key:
119
            return key
120
    raise ValueError("Key not found")
121

122
def solve_once():
123
    io = remote(HOST, PORT)
124
    io.recvuntil(b"Your random number:")
125
    Rint = int(io.recvline().strip().decode())
126

127
    blocks = split_blocks_550(Rint)
128
    solved = []
129
    for idx in range(4):
130
        try:
131
            P = point_from_block(blocks[idx])
132
            solved.append((idx, P))
133
        except Exception:
134
            pass
135

136
    if len(solved) < 2:
137
        raise RuntimeError("Not enough points")
138

139
    inc = None
140
    for (i, Pi) in solved:
141
        for (j, Pj) in solved:
142
            if j <= i:
143
                continue
144
            d = j - i
145
            if gcd(d, N) != 1:
146
                continue
147
            inc = (Pj - Pi) * int(inv(d))
148
            base_idx, base_point = i, Pi
149
            break
150
        if inc:
151
            break
152

153
    if inc is None:
154
        raise RuntimeError("Failed to compute inc")
155

156
    key = recover_key(base_point, inc, base_idx)
157
    io.recvuntil(b"Your secret code:")
158
    io.sendline(key.encode())
159
    out = io.recvall(timeout=2).decode(errors="ignore")
160
    print("[+] KEY =", key)
161
    print(out)
162

163
if __name__ == "__main__":
164
    solve_once()

a ctfer on the load

前言#

题目#

Quaternion#

MT19937&MT19937-Revenge#

AES Square#

蓉凤#

逐望#