a ctfer on the load

1
from Crypto.Util.number import *
2
from enc import flag
3

4
m = bytes_to_long(flag)
5
n = getPrime(1024)
6
e = 65537
7
c = pow(m,e,n)
8
print(f"n = {n}")
9
print(f"e = {e}")
10
print(f"c = {c}")

1
n =
2
e = 65537
3
c =
4

5
from Crypto.Util.number import*
6
print(long_to_bytes(pow(c,inverse(e,n-1),n)))

1
from sage.all import *
2
from Crypto.Util.number import *
3
from uuid import uuid4
4

5
flag = b'LitCTF{'+ str(uuid4()).encode() + b'}'
6
flag = bytes_to_long(flag)
7
len_flag = flag.bit_length()
8
e = 65537
9
p = getPrime(512)
10
P = GF(p)
11
A = [[flag,                 getPrime(len_flag)],
12
     [getPrime(len_flag),   getPrime(len_flag)]]
13
A = matrix(P, A)
14
B = A ** e
15

16
print(f"e = {e}")
17
print(f"p = {p}")
18
print(f"B = {list(B)}".replace('(', '[').replace(')', ']'))

1
from sage.all import *
2
from Crypto.Util.number import long_to_bytes
3
e = 65537
4
p =
5
B =
6
P = GF(p)
7
B = matrix(P, B)
8

9
phi = p - 1
10
e_inv = inverse_mod(e, phi)
11

12
A = B ** e_inv
13

14
flag_int = A[0,0]
15

16
flag = long_to_bytes(int(flag_int))
17
print(flag.decode())

1
import gmpy2
2
from Crypto.Util.number import *
3
from enc import flag
4

5

6
m = bytes_to_long(flag)
7
g = getPrime(512)
8
t = getPrime(150)
9
data = (t * gmpy2.invert(m, g)) % g
10
print(f'g = {g}')
11
print(f'data = {data}')

1
import libnum
2
from Crypto.Util.number import*
3
g =
4
h =
5

6
Ge = Matrix(ZZ,[[1,2**200*h],[0,2**200*g]])
7
m,t = Ge.LLL()[0]
8
m,t = abs(m),abs(t)
9

10
print(long_to_bytes(m))

1
from Crypto.Util.number import *
2
from enc import flag
3

4
m = bytes_to_long(flag)
5
e = 65537
6
p,q = getPrime(1024),getPrime(1024)
7
n = p*q
8
noise = getPrime(40)
9
tmp1 = noise*p+noise*q
10
tmp2 = noise*noise
11
hint = p*q+tmp1+tmp2
12
c = pow(m,e,n)
13
print(f"n = {n}")
14
print(f"e = {e}")
15
print(f"c = {c}")
16
print(f"hint = {hint}")

1
n =
2
e = 65537
3
c =
4
hint =
5
from Crypto.Util.number import *
6
res=hint-n
7
noise=942430120937#factor分解得到的
8
pq=(res-noise**2)//noise
9
print(pq)
10

11
from sympy import *
12
p, q = symbols('p q')
13

14
eq1 = p + q - pq
15
eq2 = p * q - n
16
solutions = solve((eq1, eq2), (p, q))
17
print("p 和 q 的解：", solutions)
18
p=
19
q=n//p
20
phi=(p-1)*(q-1)
21
print(long_to_bytes(pow(c,inverse(e,phi),n)))

1
from Crypto.Util.number import *
2
from enc import flag
3

4
m = bytes_to_long(flag)
5
p,q,e = getPrime(1024),getPrime(1024),getPrime(101)
6
n = p*q
7
temp = gmpy2.invert(e,p-1)
8
c = pow(m,e,n)
9
hint = temp>>180
10
print(f"e = {e}")
11
print(f"n = {n}")
12
print(f"c = {c}")
13
print(f"hint = {hint}")

1
from Crypto.Util.number import *
2
import gmpy2
3
import itertools
4

5
def small_roots(f, bounds, m=1, d=None):
6
    if not d:
7
        d = f.degree()
8
        print(d)
9
    R = f.base_ring()
10
    N = R.cardinality()
11
    f /= f.coefficients().pop(0)
12
    f = f.change_ring(ZZ)
13
    G = Sequence([], f.parent())
14
    for i in range(m + 1):
15
        base = N ^ (m - i) * f ^ i
16
        for shifts in itertools.product(range(d), repeat=f.nvariables()):
17
            g = base * prod(map(power, f.variables(), shifts))
18
            G.append(g)
19
    B, monomials = G.coefficient_matrix()
20
    monomials = vector(monomials)
21
    factors = [monomial(*bounds) for monomial in monomials]
22
    for i, factor in enumerate(factors):
23
        B.rescale_col(i, factor)
24
    B = B.dense_matrix().LLL()
25
    B = B.change_ring(QQ)
26
    for i, factor in enumerate(factors):
27
        B.rescale_col(i, 1 / factor)
28
    H = Sequence([], f.parent().change_ring(QQ))
29
    for h in filter(None, B * monomials):
30
        H.append(h)
31
        I = H.ideal()
32
        if I.dimension() == -1:
33
            H.pop()
34
        elif I.dimension() == 0:
35
            roots = []
36
            for root in I.variety(ring=ZZ):
37
                root = tuple(R(root[var]) for var in f.variables())
38
                roots.append(root)
39
            return roots
40
    return []
41

42
e =
43
n =
44
c =
45
leak =
46
leak <<= 180
47
R.<x,y> = PolynomialRing(Zmod(n),implementation='generic')
48
f = e * (leak + x) + (y - 1)
49
res = small_roots(f,(2^180,2^101),m=2,d=4)
50
print(res)
51
for root in res:
52
    dp_low = root[0]
53
    dp = leak + dp_low
54
    tmp = pow(2,e*dp,n) - 2
55
    p = gmpy2.gcd(tmp,n)
56
    q = n // p
57
    d = inverse(e,(p-1)*(q-1))
58
    m = pow(c,d,n)
59
    print(long_to_bytes(m))

1
from Crypto.Util.number import *
2
import random
3
import string
4

5
def get_flag(length):
6
    characters = string.ascii_letters + string.digits + '_'
7
    flag = 'LitCTF{' + ''.join(random.choice(characters) for _ in range(length)) + '}'
8
    return flag.encode()
9

10
flag = get_flag(8)
11
print(flag)
12
flag = bin(bytes_to_long(flag))[2:]
13

14
p = getPrime(128)
15
pubkey = [getPrime(128) for i in range(len(flag))]
16
enc = 0
17
for i in range(len(flag)):
18
    enc += pubkey[i] * int(flag[i])
19
    enc %= p
20
f = open("output.txt","w")
21
f.write(f"p = {p}\n")
22
f.write(f"pubkey = {pubkey}\n")
23
f.write(f"enc = {enc}\n")
24
f.close()

1
from Crypto.Util.number import long_to_bytes
2
import re
3

4
def validate_flag(s):
5
    if not s.startswith(b'LitCTF{') or not s.endswith(b'}'):
6
        return False
7
    allowed_chars = set(b'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789_')
8
    return all(c in allowed_chars for c in s[7:-1])
9

10
def attack(p, pubkey, enc, prefix=b'LitCTF{', suffix=b'}'):
11
    try:
12
        prefix_bits = bin(bytes_to_long(prefix))[2:]
13
        for i in range(len(prefix_bits)):
14
            enc = (enc - pubkey[i] * int(prefix_bits[i])) % p
15

16
        suffix_bits = bin(bytes_to_long(suffix))[2:].zfill(8)
17
        for i in range(-8, 0):
18
            enc = (enc - int(suffix_bits[i+8]) * pubkey[i]) % p
19

20
        mid_pubkey = pubkey[len(prefix_bits):-8]
21
        n = len(mid_pubkey)
22

23
        Ge = Matrix(ZZ, n + 2, n + 2)
24
        for i in range(n):
25
            Ge[i, i] = 1
26
            Ge[i, -1] = mid_pubkey[i]
27
        Ge[-2, -2] = 1
28
        Ge[-2, -1] = enc
29
        Ge[-1, -1] = p
30

31
        for vec in Ge.BKZ(block_size=25):
32
            if vec[-1] != 0:
33
                continue
34
            bits = []
35
            valid = True
36
            for x in vec[:-2]:
37
                if abs(x) not in (0, 1):
38
                    valid = False
39
                    break
40
                bits.append('1' if x == 1 else '0')
41
            if not valid:
42
                continue
43

44
            mid_bits = ''.join(bits)
45
            full_bits = prefix_bits + mid_bits + suffix_bits
46
            try:
47
                flag = long_to_bytes(int(full_bits, 2))
48
                if validate_flag(flag):
49
                    return flag
50
            except:
51
                continue
52

53
        return b"Attack failed: No valid solution found"
54
    except Exception as e:
55
        return f"Error: {str(e)}".encode()
56

57
p =
58
pubkey =
59
enc =
60

61
flag = attack(p, pubkey, enc)
62
print(flag.decode())

1
from Crypto.Util.number import *
2
from tqdm import *
3

4
p =
5
pubkey =
6
enc =
7

8
known = b'LitCTF{' + b'\x00'*8 + b'}'
9
bin_known = bin(bytes_to_long(known))[2:]
10
for i in range(len(bin_known)):
11
    enc -= pubkey[i] * int(bin_known[i])
12
    enc %= p
13

14
new_pubkey = pubkey[-72:-8]
15
n = len(new_pubkey)
16
d = n / log(max(new_pubkey), 2)
17
print(CDF(d))
18

19
for k in trange(256):
20
    S = enc + k*p
21
    L = Matrix(ZZ,n+1,n+1)
22
    for i in range(n):
23
        L[i,i] = 2
24
        L[-1,i] = 1
25
        L[i,-1] = new_pubkey[i]
26
    L[-1,-1] = S
27
    L[:,-1] *= 2^200
28

29
    for line in L.LLL():
30
        if set(line[:-1]).issubset({-1,1}):
31
            m = ''
32
            for i in line[:-1]:
33
                if i == 1:
34
                    m += '0'
35
                else:
36
                    m += '1'
37
            flag = b'LitCTF{' + long_to_bytes(int(m,2)) + b'}'
38
            print(flag)