a ctfer on the load

1
from Crypto.Util.number import bytes_to_long, getPrime
2
from secret import flag
3
p = getPrime(128)
4
q = getPrime(128)
5
n = p*q
6
e = 65537
7
m = bytes_to_long(flag)
8
c = pow(m, e, n)
9
print(f"n = {n}")
10
print(f"p = {p}")
11
print(f"q = {q}")
12
print(f"c = {c}")
13
'''
14
n = 40600296529065757616876034307502386207424439675894291036278463517602256790833
15
p = 197380555956482914197022424175976066223
16
q = 205695522197318297682903544013139543071
17
c = 36450632910287169149899281952743051320560762944710752155402435752196566406306
18
'''

1
n = 40600296529065757616876034307502386207424439675894291036278463517602256790833
2
p = 197380555956482914197022424175976066223
3
q = 205695522197318297682903544013139543071
4
c = 36450632910287169149899281952743051320560762944710752155402435752196566406306
5
e=65537
6

7
from Crypto.Util.number import*
8

9
phi = (p-1)*(q-1)
10
d = inverse(e,phi)
11
m = pow(c,d,n)
12
print(long_to_bytes(m))

1
from Crypto.Util.number import *
2
from secret import flag
3

4

5
l = len(flag)
6
m1, m2 = flag[:l//2], flag[l//2:]
7
a = bytes_to_long(m1)
8
b = bytes_to_long(m2)
9
k = 0x2227e398fc6ffcf5159863a345df85ba50d6845f8c06747769fee78f598e7cb1bcf875fb9e5a69ddd39da950f21cb49581c3487c29b7c61da0f584c32ea21ce1edda7f09a6e4c3ae3b4c8c12002bb2dfd0951037d3773a216e209900e51c7d78a0066aa9a387b068acbd4fb3168e915f306ba40
10
assert ((a**2 + 1)*(b**2 + 1) - 2*(a - b)*(a*b - 1)) == 4*(k + a*b)

1
from gmpy2 import *
2
from Crypto.Util.number import *
3
from math import *
4

5
k = 0x2227e398fc6ffcf5159863a345df85ba50d6845f8c06747769fee78f598e7cb1bcf875fb9e5a69ddd39da950f21cb49581c3487c29b7c61da0f584c32ea21ce1edda7f09a6e4c3ae3b4c8c12002bb2dfd0951037d3773a216e209900e51c7d78a0066aa9a387b068acbd4fb3168e915f306ba40
6

7
x = iroot(4*k,2)
8
print(x)
9

10
# factor(x)
11
factors = [2,2,2,2,3,3,31,61,223,4013,281317,4151351,5404604441993,
12
           26798471753993,25866088332911027256931479223,64889106213996537255229963986303510188999911,370523737,339386329]
13

14

15
T = prod(factors)
16
t = T ** 0.5
17
n = len(factors)
18
dp = {1: []}
19

20
for i in factors:
21
    for j in list(dp.keys()):
22
        cnt = j * i
23
        if cnt not in dp:
24
            dp[cnt] = dp[j] + [i]
25

26

27
min = min(dp.keys(), key=lambda x: abs(x - t))
28

29
factor1 = min
30
factor2 = T // min
31

32
print(factor1)
33
print(factor2)
34

35
print(long_to_bytes(2948658764987911698882278955266869405625105496652193856947916257370492+1))
36
print(long_to_bytes(2950365559902224963252311699604518749050102395042841254385700637274676-1))

1
from secret import flag
2
from Crypto.Util.number import*
3
m = long_to_bytes(flag)
4
p = getPrime(1024)
5
q = getPrime(1024)
6
n = p*q
7
e = 3
8
c = pow(m,e,n)
9
'''
10
c = 150409620528288093947185249913242033500530715593845912018225648212915478065982806112747164334970339684262757
11
e = 3
12
n = 20279309983698966932589436610174513524888616098014944133902125993694471293062261713076591251054086174169670848598415548609375570643330808663804049384020949389856831520202461767497906977295453545771698220639545101966866003886108320987081153619862170206953817850993602202650467676163476075276351519648193219850062278314841385459627485588891326899019745457679891867632849975694274064320723175687748633644074614068978098629566677125696150343248924059801632081514235975357906763251498042129457546586971828204136347260818828746304688911632041538714834683709493303900837361850396599138626509382069186433843547745480160634787
13
'''

1
c = 150409620528288093947185249913242033500530715593845912018225648212915478065982806112747164334970339684262757
2
e = 3
3
n = 20279309983698966932589436610174513524888616098014944133902125993694471293062261713076591251054086174169670848598415548609375570643330808663804049384020949389856831520202461767497906977295453545771698220639545101966866003886108320987081153619862170206953817850993602202650467676163476075276351519648193219850062278314841385459627485588891326899019745457679891867632849975694274064320723175687748633644074614068978098629566677125696150343248924059801632081514235975357906763251498042129457546586971828204136347260818828746304688911632041538714834683709493303900837361850396599138626509382069186433843547745480160634787
4

5
from Crypto.Util.number import*
6
from gmpy2 import*
7

8
flag=iroot(c,e)[0]
9
print(long_to_bytes(flag))

1
from hashlib import sha256
2
from secret import flag, secrets
3

4
assert flag == b'moectf{' + secrets + b'}'
5
assert secrets[:4] == b'2100' and len(secrets) == 10
6
hash_value = sha256(secrets).hexdigest()
7
print(f"{hash_value = }")
8
# hash_value = '3a5137149f705e4da1bf6742e62c018e3f7a1784ceebcb0030656a2b42f50b6a'

1
import hashlib
2

3
target_hash = '3a5137149f705e4da1bf6742e62c018e3f7a1784ceebcb0030656a2b42f50b6a'
4

5
for i in range(100000000):
6
    secrets_candidate = f'2100{i:06}'.encode()  # 生成 '2100XXXXXX' 格式的字节串
7
    if hashlib.sha256(secrets_candidate).hexdigest() == target_hash:
8
        flag = b'moectf{' + secrets_candidate + b'}'
9
        print(flag)
10
        break

1
from Crypto.Util.number import*
2
from secret import flag
3

4

5
m = bytes_to_long(flag)
6
p = getPrime(1024)
7
q = getPrime(1024)
8
n = p*q
9
e = 65537
10
c = pow(m,e,n)
11
pq = (p-1)*(q-2)
12
qp = (q-1)*(p-2)
13
p_q = p + q
14

15

16
print(f"{c = }")
17
print(f"{pq = }")
18
print(f"{qp = }")
19
print(f"{n = }")
20
print(f"{p_q = }")
21
'''
22
c = 5654386228732582062836480859915557858019553457231956237167652323191768422394980061906028416785155458721240012614551996577092521454960121688179565370052222983096211611352630963027300416387011219744891121506834201808533675072141450111382372702075488292867077512403293072053681315714857246273046785264966933854754543533442866929316042885151966997466549713023923528666038905359773392516627983694351534177829247262148749867874156066768643169675380054673701641774814655290118723774060082161615682005335103074445205806731112430609256580951996554318845128022415956933291151825345962528562570998777860222407032989708801549746
23
pq = 18047017539289114275195019384090026530425758236625347121394903879980914618669633902668100353788910470141976640337675700570573127020693081175961988571621759711122062452192526924744760561788625702044632350319245961013430665853071569777307047934247268954386678746085438134169871118814865536503043639618655569687154230787854196153067547938936776488741864214499155892870610823979739278296501074632962069426593691194105670021035337609896886690049677222778251559566664735419100459953672218523709852732976706321086266274840999100037702428847290063111455101343033924136386513077951516363739936487970952511422443500922412450462
24
qp = 18047017539289114275195019384090026530425758236625347121394903879980914618669633902668100353788910470141976640337675700570573127020693081175961988571621759711122062452192526924744760561788625702044632350319245961013430665853071569777307047934247268954386678746085438134169871118814865536503043639618655569687077087914198877794354459669808240133383828356379423767736753506794441545506312066344576298453957064590180141648690226266236642320508613544047037110363523129966437840660693885863331837516125853621802358973786440314619135781324447765480391038912783714312479080029167695447650048419230865326299964671353746764860
25
n = 18047017539289114275195019384090026530425758236625347121394903879980914618669633902668100353788910470141976640337675700570573127020693081175961988571621759711122062452192526924744760561788625702044632350319245961013430665853071569777307047934247268954386678746085438134169871118814865536503043639618655569687534959910892789661065614807265825078942931717855566686073463382398417205648946713373617006449901977718981043020664616841303517708207413215548110294271101267236070252015782044263961319221848136717220979435486850254298686692230935985442120369913666939804135884857831857184001072678312992442792825575636200505903
26
p_q = 279533706577501791569740668595544511920056954944184570513187478007551195831693428589898548339751066551225424790534556602157835468618845221423643972870671556362200734472399328046960316064864571163851111207448753697980178391430044714097464866523838747053135392202848167518870720149808055682621080992998747265496
27
'''

1
from sympy import symbols, Eq, solve
2

3
p, q = symbols('p q')
4

5
c = 5654386228732582062836480859915557858019553457231956237167652323191768422394980061906028416785155458721240012614551996577092521454960121688179565370052222983096211611352630963027300416387011219744891121506834201808533675072141450111382372702075488292867077512403293072053681315714857246273046785264966933854754543533442866929316042885151966997466549713023923528666038905359773392516627983694351534177829247262148749867874156066768643169675380054673701641774814655290118723774060082161615682005335103074445205806731112430609256580951996554318845128022415956933291151825345962528562570998777860222407032989708801549746
6
pq = 18047017539289114275195019384090026530425758236625347121394903879980914618669633902668100353788910470141976640337675700570573127020693081175961988571621759711122062452192526924744760561788625702044632350319245961013430665853071569777307047934247268954386678746085438134169871118814865536503043639618655569687154230787854196153067547938936776488741864214499155892870610823979739278296501074632962069426593691194105670021035337609896886690049677222778251559566664735419100459953672218523709852732976706321086266274840999100037702428847290063111455101343033924136386513077951516363739936487970952511422443500922412450462
7
qp = 18047017539289114275195019384090026530425758236625347121394903879980914618669633902668100353788910470141976640337675700570573127020693081175961988571621759711122062452192526924744760561788625702044632350319245961013430665853071569777307047934247268954386678746085438134169871118814865536503043639618655569687077087914198877794354459669808240133383828356379423767736753506794441545506312066344576298453957064590180141648690226266236642320508613544047037110363523129966437840660693885863331837516125853621802358973786440314619135781324447765480391038912783714312479080029167695447650048419230865326299964671353746764860
8
n = 18047017539289114275195019384090026530425758236625347121394903879980914618669633902668100353788910470141976640337675700570573127020693081175961988571621759711122062452192526924744760561788625702044632350319245961013430665853071569777307047934247268954386678746085438134169871118814865536503043639618655569687534959910892789661065614807265825078942931717855566686073463382398417205648946713373617006449901977718981043020664616841303517708207413215548110294271101267236070252015782044263961319221848136717220979435486850254298686692230935985442120369913666939804135884857831857184001072678312992442792825575636200505903
9
p_q = 279533706577501791569740668595544511920056954944184570513187478007551195831693428589898548339751066551225424790534556602157835468618845221423643972870671556362200734472399328046960316064864571163851111207448753697980178391430044714097464866523838747053135392202848167518870720149808055682621080992998747265496
10
e=65537
11

12
eq1 = Eq(p * q, n)
13
eq2 = Eq((p - 1) * (q - 2), pq)
14
eq3 = Eq((q - 1) * (p - 2), qp)
15
eq4 = Eq(p + q, p_q)
16

17
solution = solve((eq1, eq2, eq3, eq4), (p, q))
18

19
print(solution)
20

21
from Crypto.Util.number import*
22

23
p=101195416461091716428326199733504078281010548412226222689665080411126731520752210150756388683557219973649948209094722629248795549538890771346214761833764975454769057589710497693291150424006859232283601953197097456280805871953601208233200402046794268614613979577032173301390416040533984248749301081715040789947
24
q=178338290116410075141414468862040433639046406531958347823522397596424464310941218439142159656193846577575476581439833972909039919079954450077429211036906580907431676882688830353669165640857711931567509254251656241699372519476443505864264464477044478438521412625815994217480304109274071433871779911283706475549
25

26
phi=(p-1)*(q-1)
27
d = inverse(e,phi)
28
m = pow(c,d,n)
29
print(long_to_bytes(m))

1
from Crypto.Util.number import *
2

3
flag = b'moectf{xxxxxxxxxx}'
4
m = bytes_to_long(flag)
5

6
e1 = 12886657667389660800780796462970504910193928992888518978200029826975978624718627799215564700096007849924866627154987365059524315097631111242449314835868137
7
e2 = 12110586673991788415780355139635579057920926864887110308343229256046868242179445444897790171351302575188607117081580121488253540215781625598048021161675697
8

9
def encrypt(m , e1 , e2):
10
    p = getPrime(512)
11
    q = getPrime(512)
12
    N = p*q
13
    c1 = pow((3*p + 7*q),e1,N)
14
    c2 = pow((2*p + 5*q),e2,N)
15
    e = 65537
16
    c = pow(m , e , N)
17
    return c
18

19

20
print(encrypt(m ,e1 , e2))
21

22
'''
23
N = 107840121617107284699019090755767399009554361670188656102287857367092313896799727185137951450003247965287300048132826912467422962758914809476564079425779097585271563973653308788065070590668934509937791637166407147571226702362485442679293305752947015356987589781998813882776841558543311396327103000285832158267
24
c1 = 15278844009298149463236710060119404122281203585460351155794211733716186259289419248721909282013233358914974167205731639272302971369075321450669419689268407608888816060862821686659088366316321953682936422067632021137937376646898475874811704685412676289281874194427175778134400538795937306359483779509843470045
25
c2 = 21094604591001258468822028459854756976693597859353651781642590543104398882448014423389799438692388258400734914492082531343013931478752601777032815369293749155925484130072691903725072096643826915317436719353858305966176758359761523170683475946913692317028587403027415142211886317152812178943344234591487108474
26
c = 21770231043448943684137443679409353766384859347908158264676803189707943062309013723698099073818477179441395009450511276043831958306355425252049047563947202180509717848175083113955255931885159933086221453965914552773593606054520151827862155643433544585058451821992566091775233163599161774796561236063625305050
27
'''

1
from gmpy2 import*
2
from Crypto.Util.number import *
3
N = 107840121617107284699019090755767399009554361670188656102287857367092313896799727185137951450003247965287300048132826912467422962758914809476564079425779097585271563973653308788065070590668934509937791637166407147571226702362485442679293305752947015356987589781998813882776841558543311396327103000285832158267
4
c1 = 15278844009298149463236710060119404122281203585460351155794211733716186259289419248721909282013233358914974167205731639272302971369075321450669419689268407608888816060862821686659088366316321953682936422067632021137937376646898475874811704685412676289281874194427175778134400538795937306359483779509843470045
5
c2 = 21094604591001258468822028459854756976693597859353651781642590543104398882448014423389799438692388258400734914492082531343013931478752601777032815369293749155925484130072691903725072096643826915317436719353858305966176758359761523170683475946913692317028587403027415142211886317152812178943344234591487108474
6
c = 21770231043448943684137443679409353766384859347908158264676803189707943062309013723698099073818477179441395009450511276043831958306355425252049047563947202180509717848175083113955255931885159933086221453965914552773593606054520151827862155643433544585058451821992566091775233163599161774796561236063625305050
7
e1 = 12886657667389660800780796462970504910193928992888518978200029826975978624718627799215564700096007849924866627154987365059524315097631111242449314835868137
8
e2 = 12110586673991788415780355139635579057920926864887110308343229256046868242179445444897790171351302575188607117081580121488253540215781625598048021161675697
9

10
f1 = pow(2, e1*e2, N) * pow(c1, e2, N)
11
f2 = pow(3, e1*e2, N) * pow(c2, e1, N)
12
q = abs(gcd(N, f1-f2))
13
p = N//q
14
print(p)
15
print(q)
16

17
phi= (p-1)*(q-1)
18
e= 65537
19
d= inverse(e, phi)
20
m= pow(c, d, N)
21
print(long_to_bytes(m))

1
from Crypto.Util.number import *
2

3
flag = b'moectf{xxxxxxxxxxxxxxxxx}'
4

5

6
m = bytes_to_long(flag)
7
p = getPrime(1024)
8
q = getPrime(1024)
9
n = p * q
10
e = 0x10001
11
c = pow(m, e, n)
12
print(f'c = {c}')
13
print(f'n = {n}')
14

15
'''
16
Oh,it isn't secure enough!
17
'''
18
r = getPrime(1024)
19
n = n * r
20
c = pow(m, e, n)
21
print(f'C = {c}')
22
print(f'N = {n}')
23

24
'''
25
c = 12992001402636687796268040906463852467529970619872166160007439409443075922491126428847990768804065656732371491774347799153093983118784555645908829567829548859716413703103209412482479508343241998746249393768508777622820076455330613128741381912099938105655018512573026861940845244466234378454245880629342180767100764598827416092526417994583641312226881576127632370028945947135323079587274787414572359073029332698851987672702157745794918609888672070493920551556186777642058518490585668611348975669471428437362746100320309846155934102756433753034162932191229328675448044938003423750406476228868496511462133634606503693079
26
n = 16760451201391024696418913179234861888113832949815649025201341186309388740780898642590379902259593220641452627925947802309781199156988046583854929589247527084026680464342103254634748964055033978328252761138909542146887482496813497896976832003216423447393810177016885992747522928136591835072195940398326424124029565251687167288485208146954678847038593953469848332815562187712001459140478020493313651426887636649268670397448218362549694265319848881027371779537447178555467759075683890711378208297971106626715743420508210599451447691532788685271412002723151323393995544873109062325826624960729007816102008198301645376867
27
C = 1227033973455439811038965425016278272592822512256148222404772464092642222302372689559402052996223110030680007093325025949747279355588869610656002059632685923872583886766517117583919384724629204452792737574445503481745695471566288752636639781636328540996436873887919128841538555313423836184797745537334236330889208413647074397092468650216303253820651869085588312638684722811238160039030594617522353067149762052873350299600889103069287265886917090425220904041840138118263873905802974197870859876987498993203027783705816687972808545961406313020500064095748870911561417904189058228917692021384088878397661756664374001122513267695267328164638124063984860445614300596622724681078873949436838102653185753255893379061574117715898417467680511056057317389854185497208849779847977169612242457941087161796645858881075586042016211743804958051233958262543770583176092221108309442538853893897999632683991081144231262128099816782478630830512
28
N = 1582486998399823540384313363363200260039711250093373548450892400684356890467422451159815746483347199068277830442685312502502514973605405506156013209395631708510855837597653498237290013890476973370263029834010665311042146273467094659451409034794827522542915103958741659248650774670557720668659089460310790788084368196624348469099001192897822358856214600885522908210687134137858300443670196386746010492684253036113022895437366747816728740885167967611021884779088402351311559013670949736441410139393856449468509407623330301946032314939458008738468741010360957434872591481558393042769373898724673597908686260890901656655294366875485821714239821243979564573095617073080807533166477233759321906588148907331569823186970816432053078415316559827307902239918504432915818595223579467402557885923581022810437311450172587275470923899187494633883841322542969792396699601487817033616266657366148353065324836976610554682254923012474470450197
29
'''

1
from sympy import mod_inverse
2
from Crypto.Util.number import long_to_bytes
3

4
c = 12992001402636687796268040906463852467529970619872166160007439409443075922491126428847990768804065656732371491774347799153093983118784555645908829567829548859716413703103209412482479508343241998746249393768508777622820076455330613128741381912099938105655018512573026861940845244466234378454245880629342180767100764598827416092526417994583641312226881576127632370028945947135323079587274787414572359073029332698851987672702157745794918609888672070493920551556186777642058518490585668611348975669471428437362746100320309846155934102756433753034162932191229328675448044938003423750406476228868496511462133634606503693079
5
N = 1582486998399823540384313363363200260039711250093373548450892400684356890467422451159815746483347199068277830442685312502502514973605405506156013209395631708510855837597653498237290013890476973370263029834010665311042146273467094659451409034794827522542915103958741659248650774670557720668659089460310790788084368196624348469099001192897822358856214600885522908210687134137858300443670196386746010492684253036113022895437366747816728740885167967611021884779088402351311559013670949736441410139393856449468509407623330301946032314939458008738468741010360957434872591481558393042769373898724673597908686260890901656655294366875485821714239821243979564573095617073080807533166477233759321906588148907331569823186970816432053078415316559827307902239918504432915818595223579467402557885923581022810437311450172587275470923899187494633883841322542969792396699601487817033616266657366148353065324836976610554682254923012474470450197
6
e = 0x10001
7
n = 16760451201391024696418913179234861888113832949815649025201341186309388740780898642590379902259593220641452627925947802309781199156988046583854929589247527084026680464342103254634748964055033978328252761138909542146887482496813497896976832003216423447393810177016885992747522928136591835072195940398326424124029565251687167288485208146954678847038593953469848332815562187712001459140478020493313651426887636649268670397448218362549694265319848881027371779537447178555467759075683890711378208297971106626715743420508210599451447691532788685271412002723151323393995544873109062325826624960729007816102008198301645376867
8
C = 1227033973455439811038965425016278272592822512256148222404772464092642222302372689559402052996223110030680007093325025949747279355588869610656002059632685923872583886766517117583919384724629204452792737574445503481745695471566288752636639781636328540996436873887919128841538555313423836184797745537334236330889208413647074397092468650216303253820651869085588312638684722811238160039030594617522353067149762052873350299600889103069287265886917090425220904041840138118263873905802974197870859876987498993203027783705816687972808545961406313020500064095748870911561417904189058228917692021384088878397661756664374001122513267695267328164638124063984860445614300596622724681078873949436838102653185753255893379061574117715898417467680511056057317389854185497208849779847977169612242457941087161796645858881075586042016211743804958051233958262543770583176092221108309442538853893897999632683991081144231262128099816782478630830512
9

10
r=N//n
11
phi=r-1
12
d=mod_inverse(e,phi)
13
m=pow(C,d,r)
14
print(long_to_bytes(m))

1
from sympy import *
2
from Crypto.Util.number import *
3

4
p = getPrime(128)
5
e = randprime(2, p)
6

7

8
FLAG = b'm'
9

10

11
def encrypt_flag(flag):
12
    ciphertext = []
13
    plaintext = ''.join([bin(i)[2:].zfill(8) for i in flag])
14
    print(plaintext)
15
    for bit in plaintext:
16
        n = pow(int(bit) + e, e , p)
17
        ciphertext.append(n)
18
    return ciphertext
19

20
print(f"p = {p}")
21
print(encrypt_flag(FLAG))

1
conversion_dict = {
2
    83185897643827119919760550833655486588: 0,
3
    171219394072263643527316538070481587611: 1
4
}
5

6
converted_c = [conversion_dict.get(x, x) for x in c]
7

8
converted_c_str = ''.join(map(str, converted_c))
9

10
print(converted_c_str)
11

12
s=b'01101101011011110110010101100011011101000110011001111011011011010110100101101110011101010111001101011111011011110110111001100101010111110011000101110011010111110110111000110000011101000101111101110001011101010011010001100100011100100011010001110100011010010110001101011111011100100011010001110011011010010110010001110101001101000101111101110111011010000110010101101110010111110111000001011111011011010110111101100100010111110110011000110000011101010111001001011111011001010111000101110101001101000011000101011111011101000110111101011111011101000110100001110010001100110011001101111101'
13

14
binary_string = b'01101101011011110110010101100011011101000110011001111011011011010110100101101110011101010111001101011111011011110110111001100101010111110011000101110011010111110110111000110000011101000101111101110001011101010011010001100100011100100011010001110100011010010110001101011111011100100011010001110011011010010110010001110101001101000101111101110111011010000110010101101110010111110111000001011111011011010110111101100100010111110110011000110000011101010111001001011111011001010111000101110101001101000011000101011111011101000110111101011111011101000110100001110010001100110011001101111101'
15

16
text = ''.join(chr(int(binary_string[i:i+8], 2)) for i in range(0, len(binary_string), 8))
17

18
print(text)

1
from random import randint
2
from Crypto.Util.number import getPrime,bytes_to_long
3

4

5
flag = b'moectf{???????????????}'
6
gift = bytes_to_long(flag)
7

8

9
def parametergenerate():
10
    q = getPrime(256)
11
    gift1 = randint(1, q)
12
    gift2 = (gift - gift1) % q
13
    x =  randint(1, q)
14
    assert gift == (gift1 + gift2) % q
15
    return q , x , gift1, gift2
16

17

18
def encrypt(m , q , x):
19
    a = randint(1, q)
20
    c = (a*x + m) % q
21
    return [a , c]
22

23

24
q , x , gift1 , gift2 = parametergenerate()
25
print(encrypt(gift1 , q , x))
26
print(encrypt(gift2 , q , x))
27
print(encrypt(gift , q , x))
28
print(f'q = {q}')
29

30
'''
31
[48152794364522745851371693618734308982941622286593286738834529420565211572487, 21052760152946883017126800753094180159601684210961525956716021776156447417961]
32
[48649737427609115586886970515713274413023152700099032993736004585718157300141, 6060718815088072976566240336428486321776540407635735983986746493811330309844]
33
[30099883325957937700435284907440664781247503171217717818782838808179889651361, 85333708281128255260940125642017184300901184334842582132090488518099650581761]
34
q = 105482865285555225519947662900872028851795846950902311343782163147659668129411
35
'''

1
from Crypto.Util.number import inverse, long_to_bytes
2

3
a1, c1 = 48152794364522745851371693618734308982941622286593286738834529420565211572487, 21052760152946883017126800753094180159601684210961525956716021776156447417961
4
a2, c2 = 48649737427609115586886970515713274413023152700099032993736004585718157300141, 6060718815088072976566240336428486321776540407635735983986746493811330309844
5
a3, c3 = 30099883325957937700435284907440664781247503171217717818782838808179889651361, 85333708281128255260940125642017184300901184334842582132090488518099650581761
6
q = 105482865285555225519947662900872028851795846950902311343782163147659668129411
7

8
x = ((c3 - c2 - c1) * inverse(a3 - a2 - a1, q)) % q
9

10
gift1 = (c1 - a1 * x) % q
11
gift2 = (c2 - a2 * x) % q
12
gift = (gift1 + gift2) % q
13

14
flag = long_to_bytes(gift)
15
print(flag)

1
from Crypto.Util.number import getPrime, isPrime, bytes_to_long
2
from secret import flag
3

4

5
def emirp(x):
6
    y = 0
7
    while x !=0:
8
        y = y*2 + x%2
9
        x = x//2
10
    return y
11

12

13
while True:
14
    p = getPrime(512)
15
    q = emirp(p)
16
    if isPrime(q):
17
        break
18

19
n = p*q
20
e = 65537
21
m = bytes_to_long(flag)
22
c = pow(m,e,n)
23
print(f"{n = }")
24
print(f"{c = }")
25

26
"""
27
n = 141326884939079067429645084585831428717383389026212274986490638181168709713585245213459139281395768330637635670530286514361666351728405851224861268366256203851725349214834643460959210675733248662738509224865058748116797242931605149244469367508052164539306170883496415576116236739853057847265650027628600443901
28
c = 47886145637416465474967586561554275347396273686722042112754589742652411190694422563845157055397690806283389102421131949492150512820301748529122456307491407924640312270962219946993529007414812671985960186335307490596107298906467618684990500775058344576523751336171093010950665199612378376864378029545530793597
29
"""

1
n = 141326884939079067429645084585831428717383389026212274986490638181168709713585245213459139281395768330637635670530286514361666351728405851224861268366256203851725349214834643460959210675733248662738509224865058748116797242931605149244469367508052164539306170883496415576116236739853057847265650027628600443901
2
def t(a, b, k):
3
    if k == 256:
4
        if a*b == n:
5
            print(a, b)
6
        return
7
    for i in range(2):
8
        for j in range(2):
9
            a1 = a + i*(2**k) + j*(2**(511-k))
10
            b1 = b + j*(2**k) + i*(2**(511-k))
11
            if a1*b1 > n:
12
                continue
13
            if (a1+(2**(511-k)))*(b1+(2**(511-k))) < n:
14
                continue
15
            if ((a1*b1)%(2**(k+1))) != (n%(2**(k+1))):
16
                continue
17
            t(a1, b1, k+1)
18

19
for i in range(2):
20
    t(i*(2**256), i*(2**256), 0)
21

22

23
p=12119998731259483292178496920109290754181396164390285597126378297678818779092115139911720576157973310671490865211601201831597946479039132512609504866583931
24
q=11660635291534613230423193509391946961264539191735481147071890944740311229658362673314192872117237108949853531941630122241060679012089130178372253390640871
25
c=47886145637416465474967586561554275347396273686722042112754589742652411190694422563845157055397690806283389102421131949492150512820301748529122456307491407924640312270962219946993529007414812671985960186335307490596107298906467618684990500775058344576523751336171093010950665199612378376864378029545530793597
26
from Crypto.Util.number import *
27
n=p*q
28
phi=(p-1)*(q-1)
29
d=inverse(65537,phi)
30
m=pow(c,d,n)
31
print(long_to_bytes(m))

1
from Crypto.Util.number import getStrongPrime, bytes_to_long, GCD, inverse
2
from Crypto.Util.Padding import pad
3
from secret import flag
4
import random
5

6

7
def genKey(nbits,dbits):
8
    p = getStrongPrime(nbits//2)
9
    q = getStrongPrime(nbits//2)
10
    n = p*q
11
    phi = (p-1)*(q-1)
12
    while True:
13
        d = random.getrandbits(dbits)
14
        if d.bit_length() == dbits:
15
            if GCD(d, phi) == 1:
16
                e = inverse(d, phi)
17
                pk = (n, e)
18
                sk = (p, q, d)
19
                return pk, sk
20

21

22
nbits = 1024
23
dbits = 258
24
message = pad(flag,16)
25
msg = pad(message, 16)
26
m = bytes_to_long(msg)
27
pk= genKey(nbits, dbits)[0]
28
n, e = pk
29
ciphertext = pow(m, e, n)
30

31
with open("data.txt","w") as f:
32
    f.write(f"pk = {pk}\n")
33
    f.write(f"ciphertext = {ciphertext}\n")
34
    f.close()

1
from Crypto.Util.number import *
2
from secret import flag
3
import random
4

5

6
p = 2050446265000552948792079248541986570794560388346670845037360320379574792744856498763181701382659864976718683844252858211123523214530581897113968018397826268834076569364339813627884756499465068203125112750486486807221544715872861263738186430034771887175398652172387692870928081940083735448965507812844169983643977
7
assert len(flag) == 42
8

9

10
def encode(msg):
11
    return bin(bytes_to_long(msg))[2:].zfill(8*len(msg))
12

13

14
def genkey(len):
15
    sums = 0
16
    keys = []
17
    for i in range(len):
18
        k = random.randint(1,7777)
19
        x = sums + k
20
        keys.append(x)
21
        sums += x
22
    return keys
23

24

25
key = genkey(42*8)
26

27

28
def enc(m, keys):
29
    msg = encode(m)
30
    print(len(keys))
31
    print(len(msg))
32
    assert len(msg) == len(keys)
33
    s = sum((k if (int(p,2) == 1) else 1) for p, k in zip(msg, keys))
34
    print(msg)
35
    for p0,k in zip(msg,keys):
36
        print(int(p0,2))
37
    return pow(7,s,p)
38

39

40
cipher = enc(flag,key)
41

42
with open("output.txt", "w") as fs:
43
    fs.write(str(key)+'\n')
44
    fs.write(str(cipher))

1
from Crypto.Util.number import*
2
from sympy import discrete_log
3
#pow(7,s,p)
4
s=363965742933281351259442199216117822475210003294088371760914916341815880641228470807683148775152284520244
5

6
decoded_bits = []
7
for k in reversed(key):
8
    if s >= k:
9
        decoded_bits.append('1')
10
        s -= k
11
    else:
12
        decoded_bits.append('0')
13

14
decoded_bits = ''.join(reversed(decoded_bits))
15

16
flag = long_to_bytes(int(decoded_bits, 2))
17
print(flag)

1
from Crypto.Util.number import *
2
from secret import FLAG,secrets,SECERT_T
3

4

5
assert len(secrets) == 16
6
assert FLAG == b'moectf{' + secrets + b'}'
7
assert len(SECERT_T) <= 127
8

9

10
class LFSR:
11
    def __init__(self):
12
        self._s = list(map(int,list("{:0128b}".format(bytes_to_long(secrets)))))
13
        for _ in range(8*len(secrets)):
14
            self.clock()
15

16
    def clock(self):
17
        b = self._s[0]
18
        c = 0
19
        for t in SECERT_T:c ^= self._s[t]
20
        self._s = self._s[1:] + [c]
21
        return b
22

23
    def stream(self, length):
24
        return [self.clock() for _ in range(length)]
25

26

27
c = LFSR()
28
stream = c.stream(256)
29
print("".join(map(str,stream))[:-5])
30
# 11111110011011010000110110100011110110110101111000101011001010110011110011000011110001101011001100000011011101110000111001100111011100010111001100111101010011000110110101011101100001010101011011101000110001111110100000011110010011010010100100000000110

1
from Crypto.Util.number import *
2
from gmpy2 import*
3

4
def xor(a,b):
5
    res=0
6
    for i,j in zip(a,b):
7
        if j==1:
8
            res^=int(i)
9
    return res
10

11
def rev(stream,mask):
12
    temp = [0] + stream[:-1]
13
    if xor(temp, mask) == stream[-1]:
14
        return temp
15

16
    temp = [1] + stream[:-1]
17
    if xor(temp, mask) == stream[-1]:
18
        return temp
19
    return None
20

21
lfsr_stream='11111110011011010000110110100011110110110101111000101011001010110011110011000011110001101011001100000011011101110000111001100111011100010111001100111101010011000110110101011101100001010101011011101000110001111110100000011110010011010010100100000000110'
22

23
M=matrix(Zmod(2),0,128)
24

25
for i in range(len(lfsr_stream)-128):
26
    v=vector([int(x) for x in lfsr_stream[i:i+128]])
27
    M=M.stack(v)
28

29
res=vector(Zmod(2), [int(x) for x in lfsr_stream[128:]])
30

31
mask = M.solve_right(res)
32
for k in range(5):
33
    stream = [int(x) for x in lfsr_stream[:128]]
34
    for idx in range(16 * 8):
35
        tmp = rev(stream, list(mask))
36

37
        if tmp is None:
38
            break
39
        stream = tmp
40
    flag=int(''.join([str(x) for x in stream]), 2)
41
    print(long_to_bytes(flag))
42
    mask += M.right_kernel().basis()[k]

1
from Crypto.Util.Padding import pad
2
from Crypto.Util.number import *
3
from Crypto.Cipher import AES
4
import os
5

6

7
q = 264273181570520944116363476632762225021
8
key = os.urandom(16)
9
iv = os.urandom(16)
10
root = 122536272320154909907460423807891938232
11
f = sum([a*root**i for i,a in enumerate(key)])
12
assert key.isascii()
13
assert f % q == 0
14

15
with open('flag.txt','rb') as f:
16
    flag = f.read()
17

18
cipher = AES.new(key,AES.MODE_CBC, iv)
19
ciphertext = cipher.encrypt(pad(flag,16)).hex()
20

21
with open('output.txt','w') as f:
22
    f.write(f"{iv = }" + "\n")
23
    f.write(f"{ciphertext = }" + "\n")

1
iv = b'Gc\xf2\xfd\x94\xdc\xc8\xbb\xf4\x84\xb1\xfd\x96\xcd6\\'
2
ciphertext ='d23eac665cdb57a8ae7764bb4497eb2f79729537e596600ded7a068c407e67ea75e6d76eb9e23e21634b84a96424130e'
3
q = 264273181570520944116363476632762225021
4
root = 122536272320154909907460423807891938232
5

6
from Crypto.Util.number import *
7
from Crypto.Cipher import AES
8

9
L = Matrix(ZZ, 16, 16)
10
for i in range(16 - 1):
11
    L[i, i] = 1
12
    L[i, 15] = root ** (i + 1)
13

14
L[-1, -1] = q
15
L = L.LLL()
16

17
for res in L:
18
    tmp = []
19
    for idx in res:
20
        tmp.append(int(abs(idx)))
21
    tmp = [tmp[-1]] + tmp[:-1]
22
    if all(0 < x < 128 for x in tmp):
23
        key = bytearray([x for x in tmp])
24
        cipher = AES.new(key,AES.MODE_CBC, iv)
25
        flag = cipher.decrypt(long_to_bytes(int(ciphertext, 16)))
26
        print(flag)

1
from Crypto.Util.number import *
2
from secret import flag
3

4

5
p = getPrime(512)
6
q = getPrime(512)
7
n = p*q
8
e = 0x1001
9
d = inverse(e, (p-1)*(q-1))
10
bit_leak = 400
11
d_leak = d & ((1<<bit_leak)-1)
12
msg = bytes_to_long(flag)
13
cipher = pow(msg,e,n)
14
pk = (n, e)
15

16
with open('output.txt','w') as f:
17
    f.write(f"pk = {pk}\n")
18
    f.write(f"cipher = {cipher}\n")
19
    f.write(f"hint = {d_leak}\n")
20
    f.close()
21

22
n,e = (53282434320648520638797489235916411774754088938038649364676595382708882567582074768467750091758871986943425295325684397148357683679972957390367050797096129400800737430005406586421368399203345142990796139798355888856700153024507788780229752591276439736039630358687617540130010809829171308760432760545372777123, 4097)
23
cipher = 14615370570055065930014711673507863471799103656443111041437374352195976523098242549568514149286911564703856030770733394303895224311305717058669800588144055600432004216871763513804811217695900972286301248213735105234803253084265599843829792871483051020532819945635641611821829176170902766901550045863639612054
24
hint = 1550452349150409256147460237724995145109078733341405037037945312861833198753379389784394833566301246926188176937280242129

1
from Crypto.Util.number import long_to_bytes,inverse
2
n,e = (53282434320648520638797489235916411774754088938038649364676595382708882567582074768467750091758871986943425295325684397148357683679972957390367050797096129400800737430005406586421368399203345142990796139798355888856700153024507788780229752591276439736039630358687617540130010809829171308760432760545372777123, 4097)
3
c = 14615370570055065930014711673507863471799103656443111041437374352195976523098242549568514149286911564703856030770733394303895224311305717058669800588144055600432004216871763513804811217695900972286301248213735105234803253084265599843829792871483051020532819945635641611821829176170902766901550045863639612054
4
dlow = 1550452349150409256147460237724995145109078733341405037037945312861833198753379389784394833566301246926188176937280242129
5

6

7
def get_full_p(p_low,n,pbits):
8
    kbits = p_low.bit_length()
9
    R.<x> = PolynomialRing(Zmod(n))
10
    f = x * 2^kbits + p_low
11
    f = f.monic()
12
    res = f.small_roots(X = 2^(pbits-kbits),beta=0.4)
13
    if res != []:
14
        p = int(res[0]) * 2^kbits + p_low
15
        return p
16

17
for k in range(e):
18
    var('p')
19
    f1 = e*dlow*p - (k*n*p - k*p^2 - k*n + (k+1)*p)
20
    roots = solve_mod(f1,2^400)
21
    if roots != []:
22
        for root in roots:
23
            if int(root[0]).bit_length() == 400:
24
                p = get_full_p(int(root[0]),n,512)
25
                if p:
26
                    q = n // p
27
                    d = inverse(e,(p-1)*(q-1))
28
                    m = pow(c,d,n)
29
                    print(long_to_bytes(m))
30
                    break

1
from sage.all import *
2
from random import getrandbits, randint
3
from secrets import randbelow
4
from Crypto.Util.number import getPrime,isPrime,inverse
5
from Crypto.Util.Padding import pad
6
from Crypto.Cipher import AES
7
from secret import priKey, flag
8
from hashlib import sha1
9
import os
10

11

12
q = getPrime(160)
13
while True:
14
    t0 = q*getrandbits(864)
15
    if isPrime(t0+1):
16
        p = t0 + 1
17
        break
18

19

20
x = priKey
21
assert p % q == 1
22
h = randint(1,p-1)
23
g = pow(h,(p-1)//q,p)
24
y = pow(g,x,p)
25

26

27
def sign(z, k):
28
    r = pow(g,k,p) % q
29
    s = (inverse(k,q)*(z+r*priKey)) % q
30
    return (r,s)
31

32

33
def verify(m,s,r):
34
    z = int.from_bytes(sha1(m).digest(), 'big')
35
    u1 = (inverse(s,q)*z) % q
36
    u2 = (inverse(s,q)*r) % q
37
    r0 = ((pow(g,u1,p)*pow(y,u2,p)) % p) % q
38
    return r0 == r
39

40

41
def lcg(a, b, q, x):
42
    while True:
43
        x = (a * x + b) % q
44
        yield x
45

46

47
msg = [os.urandom(16) for i in range(5)]
48

49
a, b, x = [randbelow(q) for _ in range(3)]
50
prng = lcg(a, b, q, x)
51
sigs = []
52
for m, k in zip(msg,prng):
53
    z = int.from_bytes(sha1(m).digest(), "big") % q
54
    r, s = sign(z, k)
55
    assert verify(m, s, r)
56
    sigs.append((r,s))
57

58

59
print(f"{g = }")
60
print(f"{h = }")
61
print(f"{q = }")
62
print(f"{p = }")
63
print(f"{msg = }")
64
print(f"{sigs = }")
65
key = sha1(str(priKey).encode()).digest()[:16]
66
iv = os.urandom(16)
67
cipher = AES.new(key, AES.MODE_CBC,iv)
68
ct = cipher.encrypt(pad(flag,16))
69
print(f"{iv = }")
70
print(f"{ct = }")
71

72

73
'''
74
g = 81569684196645348869992756399797937971436996812346070571468655785762437078898141875334855024163673443340626854915520114728947696423441493858938345078236621180324085934092037313264170158390556505922997447268262289413542862021771393535087410035145796654466502374252061871227164352744675750669230756678480403551
75
h = 13360659280755238232904342818943446234394025788199830559222919690197648501739683227053179022521444870802363019867146013415532648906174842607370958566866152133141600828695657346665923432059572078189013989803088047702130843109809724983853650634669946823993666248096402349533564966478014376877154404963309438891
76
q = 1303803697251710037027345981217373884089065173721
77
p = 135386571420682237420633670579115261427110680959831458510661651985522155814624783887385220768310381778722922186771694358185961218902544998325115481951071052630790578356532158887162956411742570802131927372034113509208643043526086803989709252621829703679985669846412125110620244866047891680775125948940542426381
78
msg = [b'I\xf0\xccy\xd5~\xed\xf8A\xe4\xdf\x91+\xd4_$', b'~\xa0\x9bCB\xef\xc3SY4W\xf9Aa\rO', b'\xe6\x96\xf4\xac\n9\xa7\xc4\xef\x82S\xe9 XpJ', b'3,\xbb\xe2-\xcc\xa1o\xe6\x93+\xe8\xea=\x17\xd1', b'\x8c\x19PHN\xa8\xbc\xfc\xa20r\xe5\x0bMwJ']
79
sigs = [(913082810060387697659458045074628688804323008021, 601727298768376770098471394299356176250915124698), (406607720394287512952923256499351875907319590223, 946312910102100744958283218486828279657252761118), (1053968308548067185640057861411672512429603583019, 1284314986796793233060997182105901455285337520635), (878633001726272206179866067197006713383715110096, 1117986485818472813081237963762660460310066865326), (144589405182012718667990046652227725217611617110, 1028458755419859011294952635587376476938670485840)]
80
iv = b'M\xdf\x0e\x7f\xeaj\x17PE\x97\x8e\xee\xaf:\xa0\xc7'
81
ct = b"\xa8a\xff\xf1[(\x7f\xf9\x93\xeb0J\xc43\x99\xb25:\xf5>\x1c?\xbd\x8a\xcd)i)\xdd\x87l1\xf5L\xc5\xc5'N\x18\x8d\xa5\x9e\x84\xfe\x80\x9dm\xcc"
82
'''
83
from sage.all import *
84
from random import getrandbits, randint
85
from secrets import randbelow
86
from Crypto.Util.number import getPrime,isPrime,inverse
87
from Crypto.Util.Padding import pad
88
from Crypto.Cipher import AES
89
from secret import priKey, flag
90
from hashlib import sha1
91
import os
92

93

94
q = getPrime(160)
95
while True:
96
    t0 = q*getrandbits(864)
97
    if isPrime(t0+1):
98
        p = t0 + 1
99
        break
100

101

102
x = priKey
103
assert p % q == 1
104
h = randint(1,p-1)
105
g = pow(h,(p-1)//q,p)
106
y = pow(g,x,p)
107

108

109
def sign(z, k):
110
    r = pow(g,k,p) % q
111
    s = (inverse(k,q)*(z+r*priKey)) % q
112
    return (r,s)
113

114

115
def verify(m,s,r):
116
    z = int.from_bytes(sha1(m).digest(), 'big')
117
    u1 = (inverse(s,q)*z) % q
118
    u2 = (inverse(s,q)*r) % q
119
    r0 = ((pow(g,u1,p)*pow(y,u2,p)) % p) % q
120
    return r0 == r
121

122

123
def lcg(a, b, q, x):
124
    while True:
125
        x = (a * x + b) % q
126
        yield x
127

128

129
msg = [os.urandom(16) for i in range(5)]
130

131
a, b, x = [randbelow(q) for _ in range(3)]
132
prng = lcg(a, b, q, x)
133
sigs = []
134
for m, k in zip(msg,prng):
135
    z = int.from_bytes(sha1(m).digest(), "big") % q
136
    r, s = sign(z, k)
137
    assert verify(m, s, r)
138
    sigs.append((r,s))
139

140

141
print(f"{g = }")
142
print(f"{h = }")
143
print(f"{q = }")
144
print(f"{p = }")
145
print(f"{msg = }")
146
print(f"{sigs = }")
147
key = sha1(str(priKey).encode()).digest()[:16]
148
iv = os.urandom(16)
149
cipher = AES.new(key, AES.MODE_CBC,iv)
150
ct = cipher.encrypt(pad(flag,16))
151
print(f"{iv = }")
152
print(f"{ct = }")
153

154

155
'''
156
g = 81569684196645348869992756399797937971436996812346070571468655785762437078898141875334855024163673443340626854915520114728947696423441493858938345078236621180324085934092037313264170158390556505922997447268262289413542862021771393535087410035145796654466502374252061871227164352744675750669230756678480403551
157
h = 13360659280755238232904342818943446234394025788199830559222919690197648501739683227053179022521444870802363019867146013415532648906174842607370958566866152133141600828695657346665923432059572078189013989803088047702130843109809724983853650634669946823993666248096402349533564966478014376877154404963309438891
158
q = 1303803697251710037027345981217373884089065173721
159
p = 135386571420682237420633670579115261427110680959831458510661651985522155814624783887385220768310381778722922186771694358185961218902544998325115481951071052630790578356532158887162956411742570802131927372034113509208643043526086803989709252621829703679985669846412125110620244866047891680775125948940542426381
160
msg = [b'I\xf0\xccy\xd5~\xed\xf8A\xe4\xdf\x91+\xd4_$', b'~\xa0\x9bCB\xef\xc3SY4W\xf9Aa\rO', b'\xe6\x96\xf4\xac\n9\xa7\xc4\xef\x82S\xe9 XpJ', b'3,\xbb\xe2-\xcc\xa1o\xe6\x93+\xe8\xea=\x17\xd1', b'\x8c\x19PHN\xa8\xbc\xfc\xa20r\xe5\x0bMwJ']
161
sigs = [(913082810060387697659458045074628688804323008021, 601727298768376770098471394299356176250915124698), (406607720394287512952923256499351875907319590223, 946312910102100744958283218486828279657252761118), (1053968308548067185640057861411672512429603583019, 1284314986796793233060997182105901455285337520635), (878633001726272206179866067197006713383715110096, 1117986485818472813081237963762660460310066865326), (144589405182012718667990046652227725217611617110, 1028458755419859011294952635587376476938670485840)]
162
iv = b'M\xdf\x0e\x7f\xeaj\x17PE\x97\x8e\xee\xaf:\xa0\xc7'
163
ct = b"\xa8a\xff\xf1[(\x7f\xf9\x93\xeb0J\xc43\x99\xb25:\xf5>\x1c?\xbd\x8a\xcd)i)\xdd\x87l1\xf5L\xc5\xc5'N\x18\x8d\xa5\x9e\x84\xfe\x80\x9dm\xcc"
164
'''

1
from Crypto.Util.number import *
2
from Crypto.Cipher import AES
3
from hashlib import sha1
4
g = 81569684196645348869992756399797937971436996812346070571468655785762437078898141875334855024163673443340626854915520114728947696423441493858938345078236621180324085934092037313264170158390556505922997447268262289413542862021771393535087410035145796654466502374252061871227164352744675750669230756678480403551
5
h = 13360659280755238232904342818943446234394025788199830559222919690197648501739683227053179022521444870802363019867146013415532648906174842607370958566866152133141600828695657346665923432059572078189013989803088047702130843109809724983853650634669946823993666248096402349533564966478014376877154404963309438891
6
q = 1303803697251710037027345981217373884089065173721
7
p = 135386571420682237420633670579115261427110680959831458510661651985522155814624783887385220768310381778722922186771694358185961218902544998325115481951071052630790578356532158887162956411742570802131927372034113509208643043526086803989709252621829703679985669846412125110620244866047891680775125948940542426381
8
msg = [b'I\xf0\xccy\xd5~\xed\xf8A\xe4\xdf\x91+\xd4_$', b'~\xa0\x9bCB\xef\xc3SY4W\xf9Aa\rO', b'\xe6\x96\xf4\xac\n9\xa7\xc4\xef\x82S\xe9 XpJ', b'3,\xbb\xe2-\xcc\xa1o\xe6\x93+\xe8\xea=\x17\xd1', b'\x8c\x19PHN\xa8\xbc\xfc\xa20r\xe5\x0bMwJ']
9
sigs = [(913082810060387697659458045074628688804323008021, 601727298768376770098471394299356176250915124698), (406607720394287512952923256499351875907319590223, 946312910102100744958283218486828279657252761118), (1053968308548067185640057861411672512429603583019, 1284314986796793233060997182105901455285337520635), (878633001726272206179866067197006713383715110096, 1117986485818472813081237963762660460310066865326), (144589405182012718667990046652227725217611617110, 1028458755419859011294952635587376476938670485840)]
10
iv = b'M\xdf\x0e\x7f\xeaj\x17PE\x97\x8e\xee\xaf:\xa0\xc7'
11
ct = b"\xa8a\xff\xf1[(\x7f\xf9\x93\xeb0J\xc43\x99\xb25:\xf5>\x1c?\xbd\x8a\xcd)i)\xdd\x87l1\xf5L\xc5\xc5'N\x18\x8d\xa5\x9e\x84\xfe\x80\x9dm\xcc"
12

13
msg = [bytes_to_long(sha1(x).digest()) for x in msg]
14
r = []
15
s = []
16

17
for i, j in sigs:
18
    r.append(i)
19
    s.append(j)
20

21
PR.<k1,k2,k3,k4,k5,a,b,x> = PolynomialRing(Zmod(q))
22
f1 = a * k1 + b - k2
23
f2 = a * k2 + b - k3
24
f3 = a * k3 + b - k4
25
f4 = a * k4 + b - k5
26
f5 = msg[0] + r[0] * x - s[0] * k1
27
f6 = msg[1] + r[1] * x - s[1] * k2
28
f7 = msg[2] + r[2] * x - s[2] * k3
29
f8 = msg[3] + r[3] * x - s[3] * k4
30
f9 = msg[4] + r[4] * x - s[4] * k5
31

32
Fs = [f1, f2, f3, f4, f5, f6, f7, f8, f9]
33
I = Ideal(Fs)
34
B = I.groebner_basis()
35

36
print(B)
37
prikey = -1144162652064701115049643134487732928553039124427
38

39
priKey = prikey % q
40
key = sha1(str(priKey).encode()).digest()[:16]
41

42
cipher = AES.new(key, AES.MODE_CBC,iv)
43
flag = cipher.decrypt(ct)
44
print(flag)