Seccon beginner 2025 Wp

整体概况#

rank 135/880

感觉可以更高的，毕竟没有一直打，这次主要水了一下cry和re，下面是整体题目情况

1
## crypto
2

3
### seesaw (100pt / 612 solves)
4

5
### 01-Translator (100pt / 280 solves)
6

7
### Elliptic4b (272pt / 171 solves)
8

9
### Golden Ticket (491pt / 35 solves)
10

11
### mathmyth (452pt / 79 solves)
12

13
## reversing
14

15
### CrazyLazyProgram1 (100pt / 654 solves)
16

17
### CrazyLazyProgram2 (100pt / 468 solves)
18

19
### D-compile (100pt / 335 solves)
20

21
### wasm_S_exp (100pt / 330 solves)
22

23
### MAFC (339pt / 144 solves)
24

25
### code_injection (441pt / 88 solves)

加*号的是没出来的

Crypto#

seesaw#

task.py

1
import os
2
from Crypto.Util.number import getPrime
3

4
FLAG = os.getenv("FLAG", "ctf4b{dummy_flag}").encode()
5
m = int.from_bytes(FLAG, 'big')
6

7
p = getPrime(512)
8
q = getPrime(16)
9
n = p * q
10
e = 65537
11
c = pow(m, e, n)
12

13
print(f"{n = }")
14
print(f"{c = }")

分解后用p即可

1
p =
2
n =
3
c =
4

5
from Crypto.Util.number import*
6

7
print(long_to_bytes(pow(c,inverse(65537,p-1),p)))

01-Translator#

task.py

1
import os
2
from Crypto.Cipher import AES
3
from Crypto.Util.Padding import pad
4
from Crypto.Util.number import bytes_to_long
5

6

7
def encrypt(plaintext, key):
8
    cipher = AES.new(key, AES.MODE_ECB)
9
    return cipher.encrypt(pad(plaintext.encode(), 16))
10

11
flag = os.environ.get("FLAG", "CTF{dummy_flag}")
12
flag_bin = f"{bytes_to_long(flag.encode()):b}"
13
trans_0 = input("translations for 0> ")
14
trans_1 = input("translations for 1> ")
15
flag_translated = flag_bin.translate(str.maketrans({"0": trans_0, "1": trans_1}))
16
key = os.urandom(16)
17
print("ct:", encrypt(flag_translated, key).hex())

一个很有意思的题目，把二进制里面的0/1替换掉，然后再AES-ECB加密。

主要解密的方法就是输入两个字符串，然后根据频率选出两块，分别尝试A->1,B->0/B->1,A->0，然后就可以解密成功了，这里脚本通过gemini编写

1
from Crypto.Util.number import long_to_bytes
2

3
ct = ''
4
zero = ''
5
one = ''
6

7
ct = ''
8
zero = ''
9
one = ''
10

11
block_size = 32
12
blocks = [ct[i:i+block_size] for i in range(0, len(ct), block_size)]
13

14
bitstring = ''
15
for block in blocks:
16
    if block == one:
17
        bitstring += '1'
18
    elif block == zero:
19
        bitstring += '0'
20

21
num = int(bitstring, 2)
22
print(long_to_bytes(num))

Elliptic4b#

task.py

1
import os
2
import secrets
3
from fastecdsa.curve import secp256k1
4
from fastecdsa.point import Point
5

6
flag = os.environ.get("FLAG", "CTF{dummy_flag}")
7
y = secrets.randbelow(secp256k1.p)
8
print(f"{y = }")
9
x = int(input("x = "))
10
if not secp256k1.is_point_on_curve((x, y)):
11
    print("// Not on curve!")
12
    exit(1)
13
a = int(input("a = "))
14
P = Point(x, y, secp256k1)
15
Q = a * P
16
if a < 0:
17
    print("// a must be non-negative!")
18
    exit(1)
19
if P.x != Q.x:
20
    print("// x-coordinates do not match!")
21
    exit(1)
22
if P.y == Q.y:
23
    print("// P and Q are the same point!")
24
    exit(1)
25
print("flag =", flag)

这个ECC题目就很就简单了，题目生成了一个y值，我们要输入一个x并且确保在曲线上，然后输入a，并且满足后面的条件

解密方法很简单。你首先要知道secp256k1曲线的方程是y² = x³ + 7 (mod p)，x可以直接求出，后面就是ECC的常识(q−1)⋅P=−P，那么a就出来了

1
import sympy
2
from pwn import remote
3
from fastecdsa.curve import secp256k1
4

5
p = secp256k1.p
6
q = secp256k1.q
7

8
while True:
9
    try:
10
        io = remote('elliptic4b.challenges.beginners.seccon.jp', 9999)
11
        io.recvuntil(b'y = ')
12
        y = int(io.recvline().strip())
13
        print(f"[*] Received y = {y}")
14
        c = (y * y - 7) % p
15
        x = sympy.nthroot_mod(c, 3, p, all_roots=False)
16
        io.sendlineafter(b'x = ', str(x).encode())
17
        print("[*] Sent x.")
18

19
        a = q - 1
20
        io.sendlineafter(b'a = ', str(a).encode())
21
        print("[*] Sent a.")
22

23
        # 4. 接收 flag 并退出循环
24
        print("\n[+] Success! Flag:")
25
        response = io.recvall(timeout=2)
26
        print(response.decode())
27
        io.close()
28
        break
29

30
    except Exception as e:
31
        print(f"[!] An error occurred: {e}. Retrying...")
32
        if 'io' in locals() and io:
33
            io.close()

mathmyth#

task.py

1
from Crypto.Util.number import getPrime, isPrime, bytes_to_long
2
import os, hashlib, secrets
3

4

5
def next_prime(n: int) -> int:
6
    n += 1
7
    while not isPrime(n):
8
        n += 1
9
    return n
10

11

12
def g(q: int, salt: int) -> int:
13
    q_bytes = q.to_bytes((q.bit_length() + 7) // 8, "big")
14
    salt_bytes = salt.to_bytes(16, "big")
15
    h = hashlib.sha512(q_bytes + salt_bytes).digest()
16
    return int.from_bytes(h, "big")
17

18

19
BITS_q = 280
20
salt = secrets.randbits(128)
21

22
r = 1
23
for _ in range(4):
24
    r *= getPrime(56)
25

26
for attempt in range(1000):
27
    q = getPrime(BITS_q)
28
    cand = q * q * next_prime(r) + g(q, salt) * r
29
    if isPrime(cand):
30
        p = cand
31
        break
32
else:
33
    raise RuntimeError("Failed to find suitable prime p")
34

35
n = p * q
36

37
e = 0x10001
38
d = pow(e, -1, (p - 1) * (q - 1))
39

40
flag = os.getenv("FLAG", "ctf4b{dummy_flag}").encode()
41
c = pow(bytes_to_long(flag), e, n)
42

43
print(f"n = {n}")
44
print(f"e = {e}")
45
print(f"c = {c}")
46
print(f"r = {r}")

一个有趣的数学题。

n=p*q=q^3*rr+g*q*r \\ n=q^3*rr \mod r

r是四个素数相乘，自然而然crt，q = t+kr是不能求出的，后面发现直接硬爆，假设g那一块为0，我们可以轻易的求出q，那么随着k的下降，g的值就会上升，g大约在512bits一下，那么爆破的次数就是几百次。很好的一种方法

1
from sage.all import*
2
from Crypto.Util.number import*
3
n =
4
e = 65537
5
c =
6
r =
7

8
def solve(n, e, c, r, max_steps=600):
9
    rp = next_prime(r)
10

11
    prime_factors_r = [p for p, _ in factor(r)]
12
    residues_per_prime = []
13

14
    for pi in prime_factors_r:
15
        Z_pi = IntegerModRing(pi)
16
        Ai = Z_pi(n) * Z_pi(rp)^-1
17
        roots = Ai.nth_root(3, all=True)
18
        residues_per_prime.append(list(map(int, roots)))
19

20
    # 使用 itertools.product 生成所有余数组合，然后用CRT求解
21
    from itertools import product
22
    t_list = [crt(list(res_combo), prime_factors_r) for res_combo in product(*residues_per_prime)]
23
    print(t_list)
24
    for t in t_list:
25
        Q0, _ = (n // rp).nth_root(3, truncate_mode=True)
26
        # q = t + k*r, 因此 k ≈ (Q0 - t) / r
27
        k0 = (Q0 - t) // r
28

29
        for k in range(k0, k0 - max_steps, -1):
30
            q_candidate = t + k * r
31

32
            if q_candidate <= 1 or not is_prime(q_candidate):
33
                continue
34

35
            num = n - q_candidate^3 * rp
36
            den = r * q_candidate
37

38
            if num > 0 and num % den == 0:
39
                S = num // den
40
                p_candidate = q_candidate^2 * rp + r * S
41

42
                if p_candidate * q_candidate == n and is_prime(p_candidate):
43
                    p, q = p_candidate, q_candidate
44
                    print(f"✅ 成功找到因子!")
45
                    print(f"  p = {p}")
46
                    print(f"  q = {q}")
47

48
                    # 3. 解密
49
                    phi = (p - 1) * (q - 1)
50
                    d = inverse_mod(e, phi)
51
                    m = power_mod(c, d, n)
52

53
                    return long_to_bytes(m)
54

55
    return None
56
flag = solve(n, e, c, r)
57
print(flag)

copper的写法#

最近cuso库公开了，可以用这个直接求，非常的nb

1
from sage.all import *
2
from Crypto.Util.number import *
3
import cuso
4
import ast
5

6
n =
7
e = 65537
8
c =
9
r =
10
a = next_prime(r) - r
11
for Q in Zmod(r)(n/a).nth_root(3, all=True):
12
    Q = int(Q)
13
    x, p = var("x, p")
14
    roots = cuso.find_small_roots(
15
        relations=[Q+x*r],
16
        bounds={x: (0, 2**59)},
17
        modulus_multiple=n,
18
        modulus_lower_bound=2**279,
19
        modulus_upper_bound=2**280
20
    )
21
    for root in roots:
22
        p = int(root[p])
23
        q = n // p
24
        print(long_to_bytes(pow(c, pow(e, -1, (p-1)*(q-1)), n)))
25
        break

Golden Ticket(*)#

task.py

1
import os
2
from Crypto.Cipher import AES
3
from Crypto.Util.Padding import pad
4

5

6
flag = os.environ.get("FLAG", "ctf4b{dummy_flag}")
7
iv = os.urandom(16)
8
key = os.urandom(16)
9
challenge = os.urandom(16 * 6)
10
ENC_TICKET = 3
11
DEC_TICKET = 3
12
GOLDEN_TICKET = 0
13

14
def menu() -> int:
15
    print("Your tickets:")
16
    if ENC_TICKET > 0:
17
        print(f"{ENC_TICKET} encryption ticket(s)")
18
    if DEC_TICKET > 0:
19
        print(f"{DEC_TICKET} decryption ticket(s)")
20
    if GOLDEN_TICKET > 0:
21
        print(f"{GOLDEN_TICKET} golden ticket(s)")
22
    print()
23
    print(f"1. Encrypt")
24
    print(f"2. Decrypt")
25
    print(f"3. Get ticket")
26
    print(f"4. Get flag")
27
    print(f"5. Quit")
28
    while True:
29
        i = int(input("> "))
30
        if 1 <= i <= 5:
31
            return i
32
        print("Invalid input!")
33

34
def consume_ticket(enc: int = 0, dec: int = 0, golden: int = 0):
35
    global ENC_TICKET, DEC_TICKET, GOLDEN_TICKET
36
    if ENC_TICKET < enc or DEC_TICKET < dec or GOLDEN_TICKET < golden:
37
        print("Not enough tickets.")
38
        exit(1)
39
    ENC_TICKET -= enc
40
    DEC_TICKET -= dec
41
    GOLDEN_TICKET -= golden
42

43
while True:
44
    i = menu()
45

46
    if i == 1:
47
        consume_ticket(enc=1)
48
        pt = bytes.fromhex(input("pt> "))
49
        if len(pt) > 16:
50
            print("Input must not be longer than 16 bytes.")
51
            continue
52
        cipher = AES.new(key, AES.MODE_CBC, iv=iv)
53
        print(f"ct:", cipher.encrypt(pad(pt, 16)).hex())
54

55
    if i == 2:
56
        consume_ticket(dec=1)
57
        ct = bytes.fromhex(input("ct> "))
58
        if len(ct) > 16:
59
            print("Input must not be longer than 16 bytes.")
60
            continue
61
        cipher = AES.new(key, AES.MODE_CBC, iv=iv)
62
        print("pt:", cipher.decrypt(pad(ct, 16)).hex())
63

64
    if i == 3:
65
        print("challenge:", challenge.hex())
66
        answer = bytes.fromhex(input("answer> "))
67
        if len(answer) != len(challenge) + 16:
68
            print("Wrong length.")
69
            continue
70
        cipher = AES.new(key, AES.MODE_CBC, iv=answer[:16])
71
        if cipher.decrypt(answer[16:]) == challenge:
72
            print("Correct!")
73
            GOLDEN_TICKET += 1337
74
        else:
75
            print("Wrong :(")
76

77
    if i == 4:
78
        consume_ticket(golden=1)
79
        print("flag:", flag)
80

81
    if i == 5:
82
        print("Bye!")
83
        exit(0)

我对aes的了解还是太少了，需要补充一下这方面的知识了。

整个代码应该挺好阅读的吧

选项一就是加密
选项二就是解密
选项三，服务器给一个challenge，我们传一个answer并且加密后要满足AES-CBC-Decrypt(ciphertext, iv, key) == challenge
选项四得到flag

首先我们肯定要获取challenge的值，然后我们要求出iv，求iv的方法老生常谈了，我们输入b"\x10"*16，加密时会padding，也就是实际加密了b"\x10"*32，那么我们可以得到的是d1和d2，分别是d1 = xor(encrypt(b"\x10"*16), iv)、d2 = xor(encrypt(b"\x10"*16), b"\x10"*16)，这里xor就可以求出iv 那么前面几段可以通过xor求出来后面的部分通过encrypt就可以推出来

1
import os
2
from pwn import *
3

4
sc = remote("golden-ticket.challenges.beginners.seccon.jp", 9999)
5

6
def enc_oracle(pt):
7
    sc.recvuntil(b"> ")
8
    sc.sendline(b"1")
9
    sc.recvuntil(b"> ")
10
    sc.sendline(pt.hex().encode())
11
    sc.recvuntil(b": ")
12
    return bytes.fromhex(sc.recvline().decode())
13

14
def dec_oracle(pt):
15
    sc.recvuntil(b"> ")
16
    sc.sendline(b"2")
17
    sc.recvuntil(b"> ")
18
    sc.sendline(pt.hex().encode())
19
    sc.recvuntil(b": ")
20
    return bytes.fromhex(sc.recvline().decode())
21

22
def get_ticket(answer):
23
    sc.recvuntil(b"> ")
24
    sc.sendline(b"3")
25
    sc.recvuntil(b": ")
26
    challenge = bytes.fromhex(sc.recvline().decode())
27
    sc.recvuntil(b"> ")
28
    sc.sendline(answer.hex().encode())
29
    sc.recvline()
30
    return challenge
31

32
chal = get_ticket(b"a")
33
chal = [chal[i:i+16] for i in range(0, len(chal), 16)]
34

35
f3 = b"\x10"*16
36
d = dec_oracle(f3)
37
print(d)
38
iv = xor(b"\x10"*16, d[:16], d[16:])
39
f2 = xor(f3, d[16:], chal[2])
40
f1 = xor(dec_oracle(f2)[:16], iv, chal[1])
41
f0 = xor(dec_oracle(f1)[:16], iv, chal[0])
42
f4 = enc_oracle(xor(f3, iv, chal[3]))[:16]
43
f5 = enc_oracle(xor(f4, iv, chal[4]))[:16]
44
f6 = enc_oracle(xor(f5, iv, chal[5]))[:16]
45

46
get_ticket(f0+f1+f2+f3+f4+f5+f6)
47

48
sc.recvuntil(b"> ")
49
sc.sendline(b"4")
50
print(sc.recvline().decode())

总结#

seccon beginner的题还是一如既往的又新又好

a ctfer on the load

整体概况#

Crypto#

seesaw#

01-Translator#

Elliptic4b#

mathmyth#

copper的写法#

Golden Ticket(*)#

总结#