a ctfer on the load

1
from Crypto.Util.number import *
2
from Crypto.Cipher import AES
3
import os
4
from secret import flag
5
import numpy as np
6

7

8
def gen(q, n, N, sigma):
9
    t = np.random.randint(0, high=q // 2, size=n)
10
    s = np.concatenate([np.ones(1, dtype=np.int32), t])
11
    A = np.random.randint(0, high=q // 2, size=(N, n))
12
    e = np.round(np.random.randn(N) * sigma**2).astype(np.int32) % q
13
    b = ((np.dot(A, t) + e).reshape(-1, 1)) % q
14
    P = np.hstack([b, -A])
15
    return P, s
16

17

18
def enc(P, M, q):
19
    N = P.shape[0]
20
    n = len(M)
21
    r = np.random.randint(0, 2, (n, N))
22
    Z = np.zeros((n, P.shape[1]), dtype=np.int32)
23
    Z[:, 0] = 1
24
    C = np.zeros((n, P.shape[1]), dtype=np.int32)
25
    for i in range(n):
26
        C[i] = (np.dot(P.T, r[i]) + (np.floor(q / 2) * Z[i] * M[i])) % q
27
    return C
28

29

30
q = 127
31
n = 3
32
N = int(1.1 * n * np.log(q))
33
sigma = 1.0
34

35
P, s = gen(q, n, N, sigma)
36

37

38
def prep(s):
39
    return np.array([int(b) for char in s for b in f"{ord(char):08b}"], dtype=np.int32)
40

41

42
C = enc(P, prep(hint), q)
43
P = P.tolist()
44
C = C.tolist()
45
print(f"{P=}")
46
print(f"{C=}")

1
import numpy as np
2
from Crypto.Cipher import AES
3

4
leak = -3.257518803980229925210589904230583482986646342139415561576950148286382674434770529248486501793457710730252401258721482142654716015216299244487794967600132597049154513815052213387666360825101667524635777006510550117512116441539852315185793280311905620746025669520152068447372368293640072502196959919309286241
5
key =
6
encrypted =
7
iv = encrypted[:16]
8
cipher = AES.new(key, AES.MODE_CBC, iv)
9
decrypted = cipher.decrypt(encrypted[16:])
10
print(decrypted.decode().strip())

1
from Crypto.Util.number import *
2
import gmpy2
3
flag = b'flag{fake_flag}'
4
assert len(flag) == 39
5
p = getPrime(512)
6
q = getPrime(512)
7
n = p * q
8
e = 0x3
9
pad1 = b'easy_problem'
10
pad2 = b'How_to_solve_it'
11
c = pow(bytes_to_long(pad1 + flag + pad2),e,n)
12
print(f'n = {n}')
13
print(f'c = {c}')

1
from Crypto.Util.number import *
2
import hashlib
3
from tqdm import *
4

5
def hash(x):
6
    return hashlib.sha256(x.encode()).digest()
7

8
e = 3
9
n =
10
c =
11
pad1 = b'easy_problem'
12
pad2 = b'How_to_solve_it'
13

14
pad1 = bytes_to_long(pad1)
15
pad2 = bytes_to_long(pad2)
16

17
PR.<x> = PolynomialRing(Zmod(n))
18

19
f = (pad1 * 256 ** 54 + x * 256 ** 15 + pad2 )^e - c
20
f = f.monic()
21
res = f.small_roots(X=256^39,beta=1,epsilon=0.04)
22
if(res != []):
23
    print(long_to_bytes(int(res[0])))

1
import os, utils
2
from secret import flag
3
assert flag.startswith(b'flag{') and flag.endswith(b'}')
4

5
seed = int(os.urandom(16).hex(), 16)
6
gen = utils.Gen(seed)
7
msg = b'Happy4321: ' + flag
8
enc = bytes(m ^ next(gen) for m in msg).hex()
9
print(enc)

1
class Gen:
2
    def __init__(self, state):
3
        self.nbits = 128
4
        self.state = state & ((1 << self.nbits) - 1)
5
        self.mask = 109908700282042807039366676242995409413
6

7

8
    def func0(self, steps=1):
9
        for _ in range(steps):
10
            res = self.state & self.mask
11
            bit = sum([(res >> i) & 1 for i in range(self.nbits)]) & 1
12
            self.state = ((self.state << 1) ^ bit) & ((1 << self.nbits) - 1)
13
        return bit
14

15
    def __next__(self):
16
        out = 0
17
        for _ in range(8):
18
            bit = self.func0(2023)
19
            out = (out << 1) ^ bit
20
        return out

1
# SageMath
2
class Gen:
3
    def __init__(self, state):
4
        self.nbits = 128
5
        self.state = state & ((1 << self.nbits) - 1)
6
        self.mask = 109908700282042807039366676242995409413
7

8

9
    def func0(self, steps=1):
10
        for _ in range(steps):
11
            res = self.state & self.mask
12
            bit = sum([(res >> i) & 1 for i in range(self.nbits)]) & 1
13
            self.state = ((self.state << 1) ^ bit) & ((1 << self.nbits) - 1)
14
        return bit
15

16
    def __next__(self):
17
        out = 0
18
        for _ in range(8):
19
            bit = self.func0(2023)
20
            out = (out << 1) ^ bit
21
        return out
22

23
n = 128
24
msg = b'Happy4321: flag{'
25
mask = 109908700282042807039366676242995409413
26

27
enc = ''
28
enc = bytes.fromhex(enc)
29
Round = 2023
30

31
# 构建M矩阵
32
M = matrix(GF(2), n, n)
33
for i in range(n):
34
    if i+1<n:
35
        M[i+1, i] = 1
36
    if mask&(1<<(n-i-1)):
37
        M[i, -1] = 1
38
    else:
39
        M[i, -1] = 0
40

41
# seed * M2 = output_s
42
M2 = matrix(GF(2), n, n)
43

44
for i in range(n):
45
    tmp = M^(Round*(i+1))
46
    for y in range(n):
47
        M2[y, i] = tmp[y, -1]
48

49
# 构建output_s矩阵
50
output_s = []
51

52
for i in range(len(msg)):
53
    tmp = msg[i]^^enc[i]
54
    for x in range(8):
55
        if tmp&(1<<(8-x-1)):
56
            output_s.append(1)
57
        else:
58
            output_s.append(0)
59

60
output_s = vector(GF(2), output_s)
61

62
S = M2.solve_left(output_s)
63
seed = int(''.join([str(each) for each in S]), 2)
64
print(seed)
65

66
import os
67

68
enc = ''
69
enc = bytes.fromhex(enc)
70
seed = 16527323701539137374460041583215952894
71

72
gen = Gen(seed)
73
flag = bytes(c ^ next(gen) for c in enc)
74
print(flag)

1
from Crypto.Util.number import *
2
from gmpy2 import*
3
from secret import flag,a,b,c
4

5
m = bytes_to_long(flag)
6
p = getPrime(256)
7
q = getPrime(256)
8
n = p * q
9
e = 65537
10
_q = int(bin(q)[2:][::-1] , 2)
11
c = pow(m,e,n)
12

13
print('n =',n)
14
print('c =',c)
15

16
assert a**3+b**3+c**3 == 3*a*b*c
17
gift = secert**3 - 9*secert + 8
18
print(gift)
19

20
assert 3*(p ^ _q) == a + b + c

1
import string
2

3
from secret import hint
4
from secret import encrypt
5

6
import random
7

8
dicts = string.ascii_lowercase +"{=}"
9

10
key = (''.join([random.choice(dicts) for i in range(4)])) * 8
11

12
assert(len(hint) == 32)
13

14
assert(len(key) == 32)
15

16

17
cipher = encrypt(hint, key)
18

19
print(cipher)

1
from itertools import product
2

3
dicts = "abcdefghijklmnopqrstuvwxyz{=}"
4
cipher = "cp=wmaunapgimjfpopeblvup=aywqygb"
5

6
# 暴力破解 4 字节 key
7
for key in product(dicts, repeat=4):
8
    key = ''.join(key) * 8
9
    plain = ''
10
    for i in range(len(cipher)):
11
        c = dicts.index(cipher[i])
12
        k = dicts.index(key[i])
13
        p = (c - k) % 29
14
        plain += dicts[p]
15
    if "secret" in plain:
16
        print("Key:", key[:4])
17
        print("Plaintext:", plain)
18
        break
19
# tellasecret{a=secert}keepsilentt

1
gift =
2
k = var('secret')
3

4
p = k
5

6
polys = (p**3 - 9*p + 8 == gift)
7
x = solve(polys, k)
8
print(x)
9

10
from Crypto.Util.number import *
11
import sys
12

13
sys.setrecursionlimit(1500)
14

15
pxorq =
16
n =
17
c =
18
e = 65537
19
pxorq = str(bin(pxorq)[2:]).zfill(256)
20

21

22
def find(ph, qh, pl, ql):
23
    l = len(ph)
24
    tmp0 = ph + (256 - 2 * l) * "0" + pl
25
    tmp1 = ph + (256 - 2 * l) * "1" + pl
26
    tmq0 = qh + (256 - 2 * l) * "0" + ql
27
    tmq1 = qh + (256 - 2 * l) * "1" + ql
28
    if (int(tmp0, 2) * int(tmq0, 2) > n):
29
        return
30
    if (int(tmp1, 2) * int(tmq1, 2) < n):
31
        return
32
    if (int(pl, 2) * int(ql, 2) % (2 ** (l - 1)) != n % (2 ** (l - 1))):
33
        return
34

35
    if (l == 128):
36
        pp0 = int(tmp0, 2)
37
        if (n % pp0 == 0):
38
            pf = pp0
39
            qf = n // pp0
40
            phi = (pf - 1) * (qf - 1)
41
            d = inverse(e, phi)
42
            m1 = pow(c, d, n)
43
            print(long_to_bytes(m1))
44
            exit()
45

46
    else:
47
        if (pxorq[l] == "1" and pxorq[255 - l] == "1"):
48
            find(ph + "1", qh + "0", "1" + pl, "0" + ql)
49
            find(ph + "0", qh + "0", "1" + pl, "1" + ql)
50
            find(ph + "1", qh + "1", "0" + pl, "0" + ql)
51
            find(ph + "0", qh + "1", "0" + pl, "1" + ql)
52
        elif (pxorq[l] == "1" and pxorq[255 - l] == "0"):
53
            find(ph + "1", qh + "0", "0" + pl, "0" + ql)
54
            find(ph + "0", qh + "0", "0" + pl, "1" + ql)
55
            find(ph + "1", qh + "1", "1" + pl, "0" + ql)
56
            find(ph + "0", qh + "1", "1" + pl, "1" + ql)
57
        elif (pxorq[l] == "0" and pxorq[255 - l] == "1"):
58
            find(ph + "0", qh + "0", "1" + pl, "0" + ql)
59
            find(ph + "0", qh + "1", "0" + pl, "0" + ql)
60
            find(ph + "1", qh + "0", "1" + pl, "1" + ql)
61
            find(ph + "1", qh + "1", "0" + pl, "1" + ql)
62
        elif (pxorq[l] == "0" and pxorq[255 - l] == "0"):
63
            find(ph + "0", qh + "0", "0" + pl, "0" + ql)
64
            find(ph + "1", qh + "0", "0" + pl, "1" + ql)
65
            find(ph + "0", qh + "1", "1" + pl, "0" + ql)
66
            find(ph + "1", qh + "1", "1" + pl, "1" + ql)
67

68

69
find("1", "1", "1", "1")