a ctfer on the load

1
import matplotlib.pyplot as plt
2
import cv2
3
import numpy as np
4
from PIL import Image
5
def arnold_encode(image, shuffle_times, a, b):
6
    """ Arnold shuffle for rgb image
7
    Args:
8
        image: input original rgb image
9
        shuffle_times: how many times to shuffle
10
    Returns:
11
        Arnold encode image
12
    """
13
    arnold_image = np.zeros(shape=image.shape)
14

15
    h, w = image.shape[0], image.shape[1]
16
    N = h
17

18
    for time in range(shuffle_times):
19
        for ori_x in range(h):
20
            for ori_y in range(w):
21

22
                new_x = (1*ori_x + b*ori_y)% N
23
                new_y = (a*ori_x + (a*b+1)*ori_y) % N
24

25
                arnold_image[new_x, new_y, :] = image[ori_x, ori_y, :]
26

27
        image = np.copy(arnold_image)
28

29
    cv2.imwrite('en_flag.png', arnold_image, [int(cv2.IMWRITE_PNG_COMPRESSION), 0])
30
    return arnold_image
31

32
img = cv2.imread('coke.png')
33
arnold_encode(img,6,9,1)

1
import cv2
2
import numpy as np
3

4
def arnold_decode(image, shuffle_times, a, b):
5
    """ Arnold inverse shuffle for RGB image
6
    Args:
7
        image: input encoded RGB image
8
        shuffle_times: how many times it was shuffled
9
    Returns:
10
        Decoded image
11
    """
12
    h, w = image.shape[:2]
13
    N = h
14
    arnold_image = np.zeros_like(image)
15

16
    # 逆Arnold变换矩阵
17
    for time in range(shuffle_times):
18
        for x in range(h):
19
            for y in range(w):
20
                ori_x = ((b * a + 1) * x - b * y) % N
21
                ori_y = (-a * x + y) % N
22
                arnold_image[ori_x, ori_y, :] = image[x, y, :]
23

24
        image = np.copy(arnold_image)
25

26
    cv2.imwrite('decoded_flag.png', arnold_image, [int(cv2.IMWRITE_PNG_COMPRESSION), 0])
27
    return arnold_image
28

29
# 解密主逻辑
30
encoded_img = cv2.imread('en_flag.png')
31
decoded_img = arnold_decode(encoded_img, 6, 9, 1)

1
from Crypto.Util.number import *
2
import gmpy2
3
import random
4
import uuid
5
n = getPrime(1024)
6
flag = b'H&NCTF{' + str(uuid.uuid4()).encode() + b'}'
7
flag=bytes_to_long(flag)
8
print(flag)
9
e = 2024
10
c=pow(e, flag, n)
11

12
class LCG:
13
    def __init__(self, seed, a, b, m):
14
        self.seed = seed
15
        self.a = a
16
        self.b = b
17
        self.m = m
18

19
    def generate(self):
20
        self.seed = (self.a * self.seed + self.b) % self.m
21
        return self.seed
22

23
lcg = LCG(c, getPrime(256), getPrime(256), getPrime(2048))
24
random = [lcg.generate() for _ in range(5)]
25

26
print(random)
27
print("n=",n)

1
from math import gcd
2
from functools import reduce
3
from Crypto.Util.number import inverse
4

5
def recover_modulus(states):
6
    diffs = [s2 - s1 for s1, s2 in zip(states, states[1:])]
7
    zeroes = []
8
    for i in range(len(diffs) - 2):
9
        x = diffs[i + 2] * diffs[i] - diffs[i + 1] ** 2
10
        zeroes.append(abs(x))
11
    return reduce(gcd, zeroes)
12

13
def recover_lcg_params(states, m):
14
    s0, s1, s2 = states[:3]
15
    a = ((s2 - s1) * inverse(s1 - s0, m)) % m
16
    b = (s1 - a * s0) % m
17
    return a, b
18

19
def recover_seed(states, a, b, m):
20
    s1 = states[0]
21
    seed = ((s1 - b) * inverse(a, m)) % m
22
    return seed
23

24
states = [
25
]
26

27
m = recover_modulus(states)
28
a, b = recover_lcg_params(states, m)
29

30
c = recover_seed(states, a, b, m)
31
print("[*] Recovered c =", c)
32
from Crypto.Util.number import long_to_bytes
33
from sage.all import *
34
n=
35
cc=
36
e = 2024
37
F = GF(n)
38
g = F(2024)
39
c = F(cc)
40
flag_int = discrete_log(c, g)
41
print(flag_int)
42
print(long_to_bytes(flag_int))

1
from Crypto.Util.number import bytes_to_long
2
import random
3
flag = b"H&NCTF{}"
4

5
btl = str(bytes_to_long(flag))
6
lowercase = '0123456789'
7
uppercase = '7***4****5'
8

9
table = ''.maketrans(lowercase, uppercase)
10

11
new_flag = btl.translate(table)
12
n = 2 ** 512
13

14
m = random.randint(2, n - 1) | 1
15

16

17
c = pow(m, int(new_flag), n)
18
print('m = ' + str(m))
19
print('c = ' + str(c))

1
from Crypto.Util.number import long_to_bytes
2
from sage.all import *
3
m =
4
cc =
5
n = 2 ** 512
6

7
flag_int = discrete_log(cc, mod(m,n))
8
print(flag_int)
9

10
from itertools import permutations
11
from Crypto.Util.number import long_to_bytes
12

13
new_flag = ''
14

15
known_map = {
16
    '7': '0',
17
    '4': '4',
18
    '5': '9'
19
}
20

21
used_digits = {'0', '4', '9'}
22
available_digits = [d for d in '0123456789' if d not in used_digits]
23

24
unknown_chars = sorted(set(new_flag) - set(known_map.keys()))
25

26
for perm in permutations(available_digits):
27
    full_map = dict(known_map)
28
    for ch, digit in zip(unknown_chars, perm):
29
        full_map[ch] = digit
30

31
    try:
32
        btl = ''.join(full_map[ch] for ch in new_flag)
33
        num = int(btl)
34
        flag = long_to_bytes(num)
35
        if flag.startswith(b'H&NCTF{'):
36
            print("[+] 找到啦！")
37
            print("映射表：", full_map)
38
            print("flag:", flag)
39
            break
40
    except:
41
        continue

1
#part 1
2

3
def pad(flag, bits=1024):
4
    pad = os.urandom(bits//8 - len(flag))
5
    return int.from_bytes(flag + pad, "big")
6

7
p = random_prime(2**1024)
8
q = random_prime(2**1024)
9
a = randint(0, 2**1024)
10
b = randint(0, 2**1024)
11
n = p * q
12
e = 0x10001
13
flag = b''
14
m = pad(flag)
15
assert m < n
16

17
c = pow(m, e, n)
18

19
print(f"c={c}")
20
print(f"n={n}")
21
print(f"h1={p + b * q}")
22
print(f"h2={a * p + q}")
23

24
#part 2
25

26
from Crypto.Util.number import *
27
from gmpy2 import *
28
a = random_prime()
29
b = random_prime()
30
g = random_prime()
31
h = 2*g*a*b+a+b
32
while not is_prime(h):
33
    a = random_prime()
34
    b = random_prime()
35
    g = random_prime()
36
    h = 2*g*a*b+a+b
37
N = 2*h*g+1
38
e from part1's flag
39
flag=b''
40
c=pow(bytes_to_long(flag),e,N)
41
print(N)
42
print(g)
43
print(c)

1
from sage.all import *
2
from Crypto.Util.number import long_to_bytes
3
from lll_cvp import solve_inequality
4

5

6
c=
7
n=
8
x=
9
y=
10

11
# f(t,u)=(x-t)(y-u)
12
# f(p,q)=0 (mod n)
13
# f(t,u)=xy-ux-ty+tu=xy-ux-ty (mod n)
14
# x, y ~ 2^1024 -> LLL
15

16
L = matrix([[n, 0, 0, 0], [x * y, 1, 0, 0], [-y, 0, 1, 0], [-x, 0, 0, 1]])
17
lb = [0, 1, 0, 0]
18
ub = [0, 1, 2**1024, 2**1024]
19
sol = solve_inequality(L, lb, ub)
20

21
_, _, p, q = map(int, sol)
22
assert p * q == n
23
phi = (p - 1) * (q - 1)
24
d = pow(0x10001, -1, phi)
25
m = pow(c, d, n)
26
print(long_to_bytes(m))
27

28
N=
29
g=
30
from sage.groups.generic import bsgs
31
nbits = 2048
32
gamma = 0.244
33
cbits = ceil(nbits * (0.5 - 2 * gamma))
34

35
M = (N - 1) // (2 * g)
36
u = M // (2 * g)
37
v = M - 2 * g * u
38
GF = Zmod(N)
39
x = GF.random_element()
40
y = x ^ (2 * g)
41
# c的范围大概与N^(0.5-2*gamma)很接近
42
c = bsgs(y, y ^ u, ((2**(cbits-5)), (2**(cbits+5))))
43
ab = u - c
44
apb = v + 2 * g * c
45
P.<x> = ZZ[]
46
f = x ^ 2 - apb * x + ab
47
a = f.roots()
48
if a:
49
    a, b = a[0][0], a[1][0]
50
    p = 2 * g * a + 1
51
    q = 2 * g * b + 1
52
    assert p * q == N
53
    print(p,q)
54

55
from Crypto.Util.number import*
56
c=
57
p=
58
q=
59
e=81733668723981020451323
60
n=
61

62
phi=(p-1)*(q-1)
63
print(pow(c,inverse(e,phi),n))
64
print(long_to_bytes(pow(c,inverse(e,phi),n)))

1
from Crypto.Util.number import *
2
import uuid
3

4
rbits = 248
5
Nbits = 1024
6

7
p = getPrime(Nbits // 2)
8
q = getPrime(Nbits // 2)
9
N = p * q
10
r = getPrime(rbits)
11
hint = getPrime(Nbits // 2) * p + r
12
R = 2^rbits
13
e=0x10001
14
n=p*q
15
phi=(p-1)*(q-1)
16
flag = b'H&NCTF{' + str(uuid.uuid4()).encode() + b'}'
17
m=bytes_to_long(flag)
18
c=pow(m,e,n)
19
print("N=",N)
20
print("hint=",hint)
21
print(c)

1
from Crypto.Util.number import*
2
from sage.all import *
3

4
N=
5
hint=
6
c=
7

8
e=65537
9
rbits = 248
10
Nbits = 1024
11
R = 2^rbits
12

13
PR.<x> = PolynomialRing(Zmod(N))
14
f=x-hint
15
roots=f.small_roots(X=2^248,beta=0.4,epsilon=0.01)
16
r=roots[0]
17
print(r)
18

19
r=
20
p=GCD(hint-r,N)
21
q=N//p
22
phi=(p-1)*(q-1)
23
print(long_to_bytes(pow(c,inverse(e,phi),N)))

1
from Crypto.Util.number import *
2
from Crypto.Util.Padding import *
3
from gmssl.sm4 import CryptSM4, SM4_ENCRYPT
4
from hashlib import sha256
5
from random import *
6
import uuid
7
rbits = 252
8
Nbits = 1024
9

10
p = getPrime(Nbits//2)
11
q = getPrime(Nbits//2)
12
N = p*q
13
r = getPrime(rbits)
14
hint = getPrime(Nbits// 2)*p+r
15
R = 2^rbits
16
flag = b'H&NCTF{'+str(uuid.uuid4()).encode()+b'}'
17
leak=p*q*r
18
r_bytes = long_to_bytes(leak)
19
iv = r_bytes[:16] if len(r_bytes) >= 16 else r_bytes + b'\0'*(16-len(r_bytes))
20
key = sha256(str(p + q + r).encode()).digest()[:16]
21
crypt_sm4 = CryptSM4()
22
crypt_sm4.set_key(key, SM4_ENCRYPT)
23
padded_flag = pad(flag, 16)
24
c = crypt_sm4.crypt_cbc(iv, padded_flag)
25
print("N=",N)
26
print("hint=",hint)
27
print(c)

1
from Crypto.Util.number import*
2
from sage.all import *
3
from tqdm import*
4
N =
5
hint =
6

7
rbits = 252
8
Nbits = 1024
9
R = 2^rbits
10

11
high=12
12

13
for r in trange(2^high,-1,-1):
14
    rh=r<<(rbits-high)
15
    PR.<x> = PolynomialRing(Zmod(N))
16
    f=hint-(rh+x)
17
    f=f.monic()
18
    roots=f.small_roots(X=2^(rbits-high)-1,beta=0.495,epsilon=0.03)
19
    if roots:
20
        rl=roots[0]
21
        print(rh+rl)
22
        break

1
from Crypto.Util.number import *
2
from secret import flag
3
from rsa.prime import getprime
4
while(1):
5
    p=getprime(256)
6
    q=getprime(256)
7
    if isPrime(3*p**5+4*q**5):
8
        print(3*p**5+4*q**5)
9
        break
10

11
e = 65537
12
print(pow(bytes_to_long(flag), e, p * q))

1
from sage.all import Zmod, ZZ, matrix, inverse_mod, GF
2
from functools import reduce
3
import Crypto.Util.number as cun
4

5
r=
6
ct=
7

8
e = 65537
9

10
# adwa solution
11

12
R = Zmod(r)["x"]
13
x = R.gen()
14
f = 3*x**5 + 4
15
root = f.roots()[0][0]
16
M = matrix(ZZ, [[1, root], [0, r]])
17

18
# by adwa:
19
# 似乎 ax^n + by^n, 都可以用格解决
20
# f = x ** 7 - 7
21
# e = f.roots()[0][0]
22
# 压力来到了 roots 函数, (其实就是个有限域求根)
23

24
b, a = map(abs, M.LLL()[0])
25
b, a = [int(i) for i in [a, b]]
26
print(f"a = {a}\nb = {b}")
27
print(f"{cun.isPrime(a) = }, {cun.isPrime(b) = }")
28

29
phi =(a-1)*(b-1)
30
n = a * b
31
d = cun.inverse(e, phi)
32
m = pow(ct, d, n)
33
print(f"{m = }")
34
print(cun.long_to_bytes((m)))