2025PolarCTF春季赛

前言#

去南京的路上，顺手写写

题目#

crypto#

RSA1-2#

task

1
import os
2
from Crypto.Util.number import *
3
from typing import Union
4
from flag import flag
5

6
bits = 512
7

8

9
def polar(msg: Union[bytes, bytearray], length: int) -> bytes:
10
    assert length > len(msg), "指定的长度必须大于原始消息长度加 1。"
11
    return bytes(msg) + b'\x00' + os.urandom(length - len(msg) - 1)
12

13

14
def unpolar(msg: Union[bytes, bytearray]) -> bytes:
15
    msg = bytes(msg)
16
    assert b'\x00' in msg, "输入的字节串中不包含分隔符。"
17
    return msg.split(b'\x00')[0]
18

19

20
def getflag1(m):
21
    result = []
22
    for i in range(2):
23
        result.append(getPrime(bits))
24
    p, q = result
25
    if p <= q:
26
        p, q = q, p
27
    e = 0x10001
28
    n = p * q
29
    c = pow(m, e, n)
30
    hint = pow(2024 * p + 2025, q, n)
31
    print('---------- getflag 1 ----------')
32
    print(f'{c = }')
33
    print(f'{n = }')
34
    print(f'{hint = }')
35

36

37
def getflag2(m):
38
    result = []
39
    for i in range(2):
40
        result.append(getPrime(bits))
41
    p, q = result
42
    n = p * q
43
    hint1 = pow(m, p, n)
44
    hint2 = pow(m, q, n)
45
    print('---------- getflag 2 ----------')
46
    print(f'{hint1 = }')
47
    print(f'{hint2 = }')
48
    print(f'{n = }')
49

50

51

52
def getflag3(m):
53
    result = []
54
    for i in range(2):
55
        result.append(getPrime(bits))
56
    p, q = result
57
    e = 0x10001
58
    n = p * q
59
    g = 20242025
60
    hint = pow(g + p * 1111, e, n)
61
    c = pow(m, e, n)
62
    print('---------- getflag 3 ----------')
63
    print(f'{c = }')
64
    print(f'{n = }')
65
    print(f'{hint = }')
66

67

68
assert len(flag) == 42
69
mm = []
70
for i in range(0, 42, 14):
71
    mm.append(bytes_to_long(polar(flag[i:i + 14], bits // 4 - 1)))
72

73
m1, m2, m3 = mm
74
getflag1(m1)
75
getflag2(m2)
76
getflag3(m3)

三个很经典的数论题堆到了一起，额，后面补长度，其实没啥区别，直接写就行了，如果想看细节推导的话，可以等我下周写（

exp

1
from Crypto.Util.number import *
2
import gmpy2
3

4
c =
5
n =
6
hint =
7

8
e=65537
9

10
p = gmpy2.gcd(pow(2025,n,n)-hint,n)
11
q = n // p
12
d = gmpy2.invert(e,(p-1)*(q-1))
13
m = pow(c,d,n)
14
print(long_to_bytes(m))
15

16

17
from Crypto.Util.number import *
18

19
n =
20
x =
21
y =
22
a=pow(x,n,n)
23
p=GCD(a-y,n)
24
q=n//p
25
d = inverse(p,(p-1)*(q-1))
26
m = pow(x,d,n)
27
print(long_to_bytes(m))
28

29

30

31
from Crypto.Util.number import *
32
import gmpy2
33

34
c =
35
n =
36
hint =
37

38
e = 65537
39
b = 20242025
40

41
p = gmpy2.gcd(pow(b,e,n)-hint,n)
42
q = n // p
43
d = gmpy2.invert(e,(p-1)*(q-1))
44
m = pow(c,d,n)
45
print(long_to_bytes(m))

beginner#

task

1
assert(len(open('flag.txt', 'rb').read()) <= 50)
2
assert(str(int.from_bytes(open('flag.txt', 'rb').read(), byteorder='big') << 10000).endswith('16732186163543403522711798960598469149029861032300263763941636254755451456334507142958574415880945599253440468447483752611840'))
3

4
#endwith后为125位
5
#其中加密方式为utf-8

10^{125}=2^{125}*5^{125}

{{< /raw >}} 分解模数之后分开处理，计算 1840 能被 2 整除的最高次幂，然后搞定就行了

1
K = 16732186163543403522711798960598469149029861032300263763941636254755451456334507142958574415880945599253440468447483752611840
2
m = 5**125
3
r = pow(2, 10000, m)
4
r_inv = pow(r, -1, m)
5
F = (K % m * r_inv) % m
6
uflag = F.to_bytes((F.bit_length() + 7) // 8, byteorder='big').decode('utf-8')
7
print(uflag)

Ununicast#

task

1
import libnum
2
import gmpy2
3
import random
4
from flag import *
5

6
m = libnum.s2n(flag)
7

8
n_list = []
9
c_list = []
10
q_list = []
11
p_list = []
12

13
for i in range(1, 6):
14
    p = libnum.generate_prime(1024)
15
    q = libnum.generate_prime(1024)
16
    n = p * q * (i + 1)
17

18
    p_list.append(p)
19
    q_list.append(q)
20
    n_list.append(n)
21

22
while True:
23
    e = random.randint(10, 30)
24

25
    if gmpy2.is_prime(e):
26
        break
27

28
for index in range(len(n_list)):
29
    c = pow(m, e, n_list[index])
30
    c_list.append(c_list.append(c * (index + 1)))
31
    print("n" + str(index + 1) + " =", n_list[index])
32
    print("c" + str(index + 1) + " =", c_list[index])

经典的crt问题，稍微复杂一点，看看互素的是哪几个，然后算模逆，e的筛选不用管，遍历就行了 exp

1
import gmpy2
2

3
k1 = c1
4
k2 = c2 // 2
5
k4 = c4 // 4
6

7
# 计算 N 和 CRT 参数
8
N = n1 * n2 * n4
9
y1 = n2 * n4
10
y2 = n1 * n4
11
y4 = n1 * n2
12

13
# 计算模逆
14
z1 = gmpy2.invert(y1, n1)
15
z2 = gmpy2.invert(y2, n2)
16
z4 = gmpy2.invert(y4, n4)
17

18
# 计算 a = m^e mod N
19
a = (k1 * y1 * z1 % N + k2 * y2 * z2 % N + k4 * y4 * z4 % N) % N
20

21
# 可能的 e 值
22
possible_e = [11, 13, 17, 19, 23, 29]
23

24
# 尝试每个 e，计算 m
25
for e in possible_e:
26
    root, exact = gmpy2.iroot(a, e)
27
    if exact:
28
        m = int(root)
29
        # 将 m 转换为字节
30
        flag_bytes = m.to_bytes((m.bit_length() + 7) // 8, 'big')
31
        try:
32
            # 尝试解码为字符串
33
            flag = flag_bytes.decode('ascii')
34
            print(f"e = {e}, flag = {flag}")
35
            # 检查是否符合 flag 格式
36
            if flag.startswith('flag{'):
37
                print(f"找到 flag: {flag}")
38
                break
39
        except UnicodeDecodeError:
40
            print(f"e = {e}, flag_bytes = {flag_bytes}")

LCG#

task

1
a =
2
b =
3
c =
4
m =
5
一共循环十次

这个就更简单了，直接逆十次

1
a =
2
b =
3
c =
4
m =
5
inv_a = pow(a, -1, m)
6
x = c
7
for _ in range(10):
8
    x = (inv_a * (x - b)) % m
9

10
x0 = x
11

12
byte_length = (x0.bit_length() + 7) // 8
13
flag_bytes = x0.to_bytes(byte_length, byteorder='big')
14

15
flag = flag_bytes.decode('ascii')
16
print(f"Flag: {flag}")

playstreamone#

task

1
from Flag import flag
2
assert flag.startswith("flag{")
3
assert flag.endswith("}")
4
assert len(flag) == 24
5

6

7
def LFSR(R, mask):
8
    output = (R << 1) & 0xffffff
9
    i = (R & mask) & 0xffffff
10
    lastbit = 0
11
    while i != 0:
12
        lastbit ^= (i & 1)
13
        i = i >> 1
14
    output ^= lastbit
15
    return output, lastbit
16

17

18

19
def Fx1x2x3(R1, R1_mask, R2, R2_mask, R3, R3_mask):
20
    R1_NEW, x1 = LFSR(R1, R1_mask)
21
    R2_NEW, x2 = LFSR(R2, R2_mask)
22
    R3_NEW, x3 = LFSR(R3, R3_mask)
23

24
    output = (x1 * x2) ^ ((x2 ^ 1) * x3)
25

26
    return R1_NEW, R2_NEW, R3_NEW, output
27

28

29

30
R1 = int(flag[5:11], 16)
31
R2 = int(flag[11:17], 16)
32
R3 = int(flag[17:23], 16)
33

34

35
assert len(bin(R1)[2:]) == 21
36
assert len(bin(R2)[2:]) == 22
37
assert len(bin(R3)[2:]) == 21
38

39
R1_mask = 0x20010
40
R2_mask = 0x8002c
41
R3_mask = 0x200004
42

43
for fi in range(1024):
44
    print(f"Processing file {fi}")
45
    tmp1mb = bytearray()
46

47
    for i in range(1024):
48
        tmp1kb = bytearray()
49

50
        for j in range(1024):
51
            tmp = 0
52

53
            for k in range(8):
54
                R1, R2, R3, out = Fx1x2x3(R1, R1_mask, R2, R2_mask, R3, R3_mask)
55
                tmp = (tmp << 1) ^ out
56

57
            tmp1kb.append(tmp)
58

59
        tmp1mb.extend(tmp1kb)
60

61
    with open(f"./output/{fi}", "ab") as f:
62
        f.write(tmp1mb)
63

64
    print(f"File {fi} written successfully.")

看源码知道是个lfsr，三组，生成 output = (x1 * x2) ^ ((x2 ^ 1) * x3)，但是貌似只能爆破，在车上写了一个范围在10**21~10**22的，但是不行，回头修改一下，按着wp稍微修改了一下代码，发现第一开始写的复杂了，Geffe 的输出与 x1相同的概率为 3/4，Geffe 的输出与 x2 相同的概率为 1/2，Geffe 的输出与 x3 相同的概率为 3/4这说明输出与第一个和第三个的关联性非常大。因此，我们可以暴力去枚举第一个和第三个 LFSR 的输出判断其与类 Geffe 的输出相等的个数，如果大约在 75% 的话，就可以认为是正确的。第二个就直接暴力枚举了，R1和R3可以单独通过correlation attack求出来，最后再用brute force找出R2，第一开始还真的不知道这两个方法？一直都是手搓的

1
def LFSR(R, mask):
2
    output = (R << 1) & 0xffffff
3
    i = (R & mask) & 0xffffff
4
    lastbit = 0
5
    while i != 0:
6
        lastbit ^= (i & 1)
7
        i = i >> 1
8
    output ^= lastbit
9
    return output, lastbit
10

11

12
def Fx1x2x3(R1, R1_mask, R2, R2_mask, R3, R3_mask):
13
    R1_NEW, x1 = LFSR(R1, R1_mask)
14
    R2_NEW, x2 = LFSR(R2, R2_mask)
15
    R3_NEW, x3 = LFSR(R3, R3_mask)
16

17
    output = (x1 * x2) ^ ((x2 ^ 1) * x3)
18

19
    return R1_NEW, R2_NEW, R3_NEW, output
20

21
n3 = 21
22
n2 = 22
23
n1 = 21
24

25
R1_mask = 0x20010
26
R2_mask = 0x8002c
27
R3_mask = 0x200004
28

29

30
def guess(beg, end, num, mask):
31
    ansn = range(beg, end)
32

33
    with open('./output/0', 'rb') as f:
34
        data = f.read(num)
35

36
    data = ''.join(bin(byte)[2:].zfill(8) for byte in data)
37

38
    now = 0
39
    res = 0
40
    for i in ansn:
41
        r = i
42
        cnt = 0
43
        for j in range(num * 8):
44
            r, lastbit = LFSR(r, mask)
45
            lastbit = str(lastbit)
46
            cnt += (lastbit == data[j])
47
        if cnt > now:
48
            now = cnt
49
            res = i
50
            print(now, res)
51
    return res
52

53

54
def bruteforce2(x, z):
55
    with open('./output/0', 'rb') as f:
56
        data = f.read(50)
57
        data = ''.join(bin(byte)[2:].zfill(8) for byte in data)
58

59
    for y in range(pow(2, n2 - 1), pow(2, n2)):
60
        R1, R2, R3 = x, y, z
61
        flag = True
62
        for i in range(len(data)):
63
            (R1, R2, R3, out) = Fx1x2x3(R1, R1_mask, R2, R2_mask, R3, R3_mask)
64
            if str(out) != data[i]:
65
                flag = False
66
                break
67
        if y % 10000 == 0:
68
            print('now: ', x, y, z)
69
        if flag:
70
            print('ans: ', hex(x)[2:], hex(y)[2:], hex(z)[2:])
71
            break
72

73

74
'''R1 = guess(pow(2, n1 - 1), pow(2, n1), 40, R1_mask)
75
print(R1)
76
R3 = guess(pow(2, n3 - 1), pow(2, n3), 40, R3_mask)
77
print(R3)'''
78

79
R1 = 1225459
80
R3 = 1613986
81
R2= bruteforce2(R1, R3)
82
print(R2)

web#

来个弹窗#

就是个xss，直接一把梭哈

椰子树晕淡水鱼#

真正的信息收集，你可以看见藏头诗“文件上传”，然后关于里面是用户名，密码本可以靠dirb扫出来，然后bp开爆，然后是个文件上传，传个png马，然后蚂剑上不去，手打得到flag，在根目录

coke的登陆#

f12看cookie是密码，账户是coke

其他的忘了过程了

总结#

2025PolarCTF春季赛质量还好吧，在车上不能认真的去写，有很多琐事缠身，最后rank是12有点可惜吧，毕竟后面几个小时一直没写，wp也懒得写了

a ctfer on the load

前言#

题目#

crypto#

RSA1-2#

beginner#

Ununicast#

LCG#

playstreamone#

web#

来个弹窗#

椰子树晕淡水鱼#

coke的登陆#

总结#