能源大赛2025 - Zsm's blog

zsm

Time can create anything

浏览量：-，访问次数：-

Announcement

A ctfer? maybe.

Learn More

分类

标签

笔记 crypto docker golang HMV HTB k8s mac nodejs sagemath shell THM vscode vuln web windows wsl2

703 字

4 分钟

能源大赛2025

2025-04-23

CTF-crypto

crypto

浏览量：加载中...，访问次数：加载中...

前言#

最近期中考试没怎么刷题来着，复现复现没参加的比赛吧～

题目#

simpleSignin#

task.py

1
from Crypto.Util.number import *
2
from gmpy2 import *
3
import os
4

5
flag = b'xxx'
6
p = next_prime(bytes_to_long(os.urandom(128)))
7
q = next_prime(bytes_to_long(os.urandom(128)))
8
r = next_prime(q)
9
n = p * q * r
10
e = 0x10001
11
print(f"n = {n}")
12
print(f"c = {pow(bytes_to_long(flag), e, n)}")
13
print(f"gift1 = {p % (2**10)}")
14
print(f"gift2 = {(p >> 20) % 2 ** 800}")

拿到题就知道这玩意是copper，好像比赛当天还有人在群里问来着，有点意思(，简单分析一下
gift1->低10位
gift2->右移20位后的低800位
我们可以认为已知了低820位，那10位可以爆破，那么前面直接copper求出

exp.py

1
n =
2
c =
3
gift1 = 513
4
gift2 =
5
e=65537
6
from Crypto.Util.number import *
7

8
PR.<x> = PolynomialRing(Zmod(n))
9
for i in range(2**10):
10
    p_low = (gift2<<20)+(i<<10)+gift1
11
    f = x*2**820+p_low
12
    root = f.monic().small_roots(X=2^204,beta=0.33)
13
    if root:
14
        p = int(root[0]*2**820+p_low)
15
        if n%p==0:
16
            phi = p-1
17
            d = inverse(e,phi)
18
            m = pow(c,d,p)
19
            flag=long_to_bytes(m)
20
            print(flag)
21
            break

NumberTheory#

task.py

1
from Crypto.Util.number import *
2
import hint
3

4
flag=b'xxx'
5
e=65537
6
p=getPrime(512)
7
q=getPrime(512)
8
n=p*q
9
m=bytes_to_long(flag)
10
c=pow(m,e,n)
11
k=getPrime(1024)
12
assert hint + 233 * k == 233 * k * p
13
print(n)
14
print(c)
15
print(hint)

经典数论题

hint=233k(p-1) \\ a^{hint}=a^{233k(p-1)} \mod p =1 \mod p \\ p=\gcd(a^{hint}-1,p)

exp.py

1
from Crypto.Util.number import *
2

3
n=
4
c=
5
hint=
6
e = 65537
7
p = GCD(pow(2,hint,n)-1,n)
8
q = n//p
9
phi = (p-1)*(q-1)
10
d = inverse(e,phi)
11
m = pow(c,d,n)
12
flag = long_to_bytes(m)
13
print(flag)

easy_lwe#

task.py

1
from Crypto.Util.number import *
2
from secrets import flag
3
assert len(flag) == 38
4

5
p = getPrime(512)
6
m = getPrime(512)
7
while m > p:
8
    m = getPrime(512)
9

10
aa = []
11
cc = []
12
bb = []
13
for i in range(30):
14
    a = getPrime(512)
15
    b = getPrime(400)
16
    c = (a * m + b) % p
17
    aa.append(a)
18
    cc.append(c)
19
    bb.append(b)
20

21
enc = pow(m,flag,p)
22
print(f'p = {p}')
23
print(f'aa = {aa}')
24
print(f'cc = {cc}')
25
print(f'enc = {enc}')

part1是hnp问题，所以题目为什么叫lwe？直接用la佬的脚本就行了，微微改一下
part2是dlp问题，p-1是可分解的，经典Pohlig-Hellman，这里借鉴山石的思路，最后一个素数不用，而去爆破求解，效率更加快

exp.py

1
from Crypto.Util.number import *
2
p =
3
aa =
4
enc =
5
K = 2 ** 400
6
P = identity_matrix(30) * p
7
RC = matrix([[-1, 0], [0, 1]]) * matrix([aa, cc])
8
KP = matrix([[K / p, 0], [0, K]])
9
M = block_matrix([[P, 0], [RC, KP]], subdivide=False)
10
shortest_vector = M.LLL()
11
x = shortest_vector[1, -2] / K * p % p
12
print(x)
13

14
factors=[]#sage就能出来
15

16
dlogs = []
17
for fac in factors[:-1]:
18
    t = (p - 1) // fac
19
    dlog = discrete_log(G(pow(enc, t, p)), G(pow(x, t, p)))
20
    dlogs += [dlog]
21
s = (p - 1) // factors[-1]
22
print(s)
23
res = crt(dlogs, factors[:-1])
24
for i in range(100):
25
    if b'flag{'in long_to_bytes(res + i * s):
26
        print(long_to_bytes(res + i * s))
27
        break

easy_crypto#

task.py

1
from secret import flag
2
from Crypto.Util.number import getPrime
3

4
flag = bin(int.from_bytes(flag, 'big'))[2:]
5

6
private_key = []
7
g = getPrime(10)
8
private_key.append(g)
9
for i in range(len(flag) - 1):
10
    g = g * 2
11
    private_key.append(g)
12

13
a = getPrime(20)
14
b = getPrime(len(flag) + 20)
15
public_key = []
16
for i in private_key:
17
    public_key.append((a * i) % b)
18
print(public_key)
19

20
c = 0
21
for i in range(len(flag)):
22
    c += int(str(flag)[i])*public_key[i]
23
print(c)

前面先套了个lcg，直接求出seed，后面就是背包

exp.py

1
from Crypto.Util.number import *
2
#我是取的最后两组
3
y =
4
x =
5
public_key =
6
c =
7
b = 2*x - y
8
a = factor(public_key[0])[1][0]
9

10
private_key = []
11
for i in public_key:
12
    private_key.append(int(i*pow(a,-1,b)%b))
13

14
c = c*pow(a,-1,b)%b
15
flag = ''
16
for i in private_key[::-1]:
17
    if c >= i:
18
        c -= i
19
        flag = '1' + flag
20
    else:
21
        flag = '0' + flag
22

23
print(long_to_bytes(int(flag,2)))