a ctfer on the load

1
import base64
2
import random
3
from secret import flag
4
import numpy as np
5
def init_sbox(key):
6
    s_box = list(range(256))
7
    j = 0
8
    for i in range(256):
9
        j = (j + s_box[i] + ord(key[i % len(key)])) % 256
10
        s_box[i], s_box[j] = s_box[j], s_box[i]
11
    return s_box
12
def decrypt(cipher, box):
13
    res = []
14
    i = j = 0
15
    cipher_bytes = base64.b64decode(cipher)
16
    for s in cipher_bytes:
17
        i = (i + 1) % 256
18
        j = (j + box[i]) % 256
19
        box[i], box[j] = box[j], box[i]
20
        t = (box[i] + box[j]) % 256
21
        k = box[t]
22
        res.append(chr(s ^ k))
23
    return (''.join(res))
24
def random_num(seed_num):
25
    random.seed(seed_num)
26
    for i in range(36):
27
        print(chr(int(str(random.random()*10000)[0:2]) ^ (data[i])))
28

29
if __name__ == '__main__':
30
    ciphertext = "MjM184anvdA="
31
    key = "XR4"
32
    box = init_sbox(key)
33
    a=decrypt(ciphertext, box)
34
    random_num(int(a))

1
import base64
2

3
def init_sbox(key: str) -> list[int]:
4
    """
5
    初始化 RC4 的 S 盒（KSA 阶段）
6
    """
7
    s_box = list(range(256))
8
    j = 0
9
    for i in range(256):
10
        j = (j + s_box[i] + ord(key[i % len(key)])) % 256
11
        s_box[i], s_box[j] = s_box[j], s_box[i]
12
    return s_box
13

14
def decrypt(cipher: str, box: list[int]) -> str:
15
    """
16
    RC4 解密（PRGA 阶段），输入是 base64 编码的密文
17
    返回解密后的 ASCII 字符串
18
    """
19
    res = []
20
    i = j = 0
21
    cipher_bytes = base64.b64decode(cipher)
22
    for byte in cipher_bytes:
23
        i = (i + 1) % 256
24
        j = (j + box[i]) % 256
25
        box[i], box[j] = box[j], box[i]
26
        t = (box[i] + box[j]) % 256
27
        k = box[t]
28
        res.append(chr(byte ^ k))
29
    return ''.join(res)
30

31
# 测试解密
32
ciphertext = "MjM184anvdA="
33
key = "XR4"
34
seed_str = decrypt(ciphertext, init_sbox(key))
35
print("[*] RC4 解密后得到的 seed 字符串：", seed_str)
36

37
import numpy as np
38

39
# 题目给出的转置后矩阵
40
transposed_matrix = np.array([
41
    [  1, 111,  38, 110,  95,  44],
42
    [ 11,  45,  58,  39,  84,   1],
43
    [116,  19, 113,  60,  91, 118],
44
    [ 33,  98,  38,  57,  10,  29],
45
    [ 68,  52, 119,  56,  43, 125],
46
    [ 32,  32,   7,  26,  41,  41]
47
])
48

49
# 先转置回来，再展平为一维数组
50
data = transposed_matrix.T.reshape(-1)
51
import random
52

53
def recover_flag(seed: int, data: np.ndarray) -> str:
54
    random.seed(seed)
55
    chars = []
56
    for i in range(len(data)):
57
        # 取 “[0:2]” 的做法和题目一致
58
        two_digits = str(random.random() * 10000)[0:2]
59
        rand_val = int(two_digits)
60
        chars.append(chr(rand_val ^ data[i]))
61
    return ''.join(chars)
62

63
# 执行还原
64
seed = int(seed_str)  # 78910112
65
flag = recover_flag(seed, data)
66
print("[*] 恢复出的 flag：", flag)

1
from gmpy2 import *
2
from hashlib import md5
3
from Crypto.Util.number import *
4
from sympy import *
5

6
message= xxxxxx
7
flag = 'flag{'+md5(message).hexdigest()+'}'
8
p = getPrime(250)
9
q = getPrime(250)
10
assert p > q
11
n = p * q
12
e = 65537
13
phi = (p - 1) * (q - 1)
14
m = bytes_to_long(message)
15

16
Rod = getPrime(5)
17
I = Rod + len(str(Rod))
18
k = pow(p, Rod)
19
N = pow(p, I) * q
20
d1 = getPrime(2000)
21
d2 = nextprime(d1 + getPrime(1000))
22
e_1 = inverse(d1, (k * phi))
23
e_2 = inverse(d2, (k * phi))
24
c = pow(m,e,n)
25

26
print(f'e_1 = {e_1}')
27
print(f'e_2 = {e_2}')
28
print(f'N = {N}')
29
print(f'c = {c}')

1
e = 65537
2
e1 =
3
e2 =
4
N =
5
c =
6
PR.<x>=PolynomialRing(Zmod(N))
7
f=e1*e2*x-(e1-e2)
8
f=f.monic()
9
root=f.small_roots(X=2^1020,beta=0.75,epsilon=0.05)
10
print(e1*e2*root[0]-(e1-e2))
11

12
from Crypto.Util.number import *
13
import gmpy2
14
from hashlib import md5
15
Rod = getPrime(5)
16
I = Rod + len(str(Rod))
17
e = 65537
18
e1 =
19
e2 =
20
N =
21
c =
22
g=
23
p=gmpy2.iroot(gmpy2.gcd(g,N),Rod)[0]
24
q=N//(p**I)
25
d=gmpy2.invert(0x10001,(p-1)*(q-1))
26
msg=long_to_bytes(pow(c,d,p*q))
27
print(msg)
28
flag = 'flag{'+md5(msg).hexdigest()+'}'
29
print(flag)

1
import random
2
from sympy import nextprime
3
def part1():
4
    p = random_prime(2^512, 2^513)
5
    a = random.randint(0, p-1)
6
    b = random.randint(0, p-1)
7
    while (4 * a**3 + 27 * b**2) % p == 0:
8
        a = random.randint(0, p-1)
9
        b = random.randint(0, p-1)
10

11
    E = EllipticCurve(GF(p), [a, b])
12

13
    P=E.random_point()
14

15
    n = [random.randint(1, 2**20) for _ in range(3)]
16
    assert part1=''.join([hex(i)[2:] for i in n])
17
    cipher = [n[i] * P for i in range(3)]
18

19
    print(f"N = {p}")
20
    print(f"a = {a}, b = {b}")
21
    print(f"P = {P}")
22
    for i in range(3):
23
        print(f"cipher{i} = {cipher[i]}")
24
def part2():
25
    p =
26
    a =
27
    b =
28
    P = E.random_point()
29
    Q = key*P
30
    print("p = ",p)
31
    print("a = ",a)
32
    print("b = ",b)
33
    print("P = ",P)
34
    print("Q = ",Q)
35
    assert part2=key
36
part1()
37
print("-------------------------------------------")
38
part2()
39
assert flag="flag{"+str(part1)+"-"+str(part2)+"}"

1
import math
2

3
def inv_mod(x: int, p: int) -> int:
4
    return pow(x, p-2, p)
5

6
def point_add(P, Q, a, p):
7
    if P is None:
8
        return Q
9
    if Q is None:
10
        return P
11

12
    x1, y1 = P
13
    x2, y2 = Q
14
    if x1 == x2 and (y1 + y2) % p == 0:
15
        return None
16

17
    if P != Q:
18
        lam = ((y2 - y1) * inv_mod(x2 - x1, p)) % p
19
    else:
20
        lam = ((3 * x1 * x1 + a) * inv_mod(2 * y1, p)) % p
21

22
    x3 = (lam * lam - x1 - x2) % p
23
    y3 = (lam * (x1 - x3) - y1) % p
24
    return (x3, y3)
25

26
def scalar_mul(P, n, a, p):
27
    R = None      # 初始结果为无穷远点
28
    Q = P         # 临时变量 Q = P, 逐位处理 n
29
    while n > 0:
30
        if n & 1:
31
            R = point_add(R, Q, a, p)
32
        Q = point_add(Q, Q, a, p)
33
        n >>= 1
34
    return R
35

36
def dlog_bsgs(P, Q, order_bound, a, p):
37
    m = int(math.ceil(math.sqrt(order_bound)))
38
    table = {}
39
    R = None
40
    for j in range(m):
41
        table[R] = j
42
        R = point_add(R, P, a, p)
43
    mP = scalar_mul(P, m, a, p)
44
    neg_mP = (mP[0], (-mP[1]) % p) if mP is not None else None
45

46
    S = Q
47
    for i in range(m):
48
        if S in table:
49
            return i * m + table[S]
50
        S = point_add(S, neg_mP, a, p)
51
    return None
52

53
def attack_part1():
54
    p1 =
55
    a1 =
56
    b1 =
57
    P1 = ()
58
    cipher = []
59

60
    bound = 2**20
61
    ns = []
62
    for i in range(3):
63
        ni = dlog_bsgs(P1, cipher[i], bound, a1, p1)
64
        assert ni is not None, "Part1 的 n{} 恢复失败！".format(i)
65
        ns.append(ni)
66
    print("Part1 恢复出的 n 值：", ns)
67
    hex_str = ''.join([hex(x)[2:] for x in ns])
68
    print("拼接后的十六进制字符串：", hex_str)
69
    return hex_str
70

71

72
if __name__ == "__main__":
73
    part11 = attack_part1()
74
    print(part11)
75

76
from sage.all import *
77
from Crypto.Util.number import *
78
p =
79
a =
80
b =
81
E = EllipticCurve(GF(p),[a,b])
82
P =  E()
83
Q =  E()
84
print(p== E.order())
85
def SmartAttack(P,Q,p):
86
    E = P.curve()
87
    Eqp = EllipticCurve(Qp(p, 2), [ ZZ(t) + randint(0,p)*p for t in E.a_invariants() ])
88

89
    P_Qps = Eqp.lift_x(ZZ(P.xy()[0]), all=True)
90
    for P_Qp in P_Qps:
91
        if GF(p)(P_Qp.xy()[1]) == P.xy()[1]:
92
            break
93

94
    Q_Qps = Eqp.lift_x(ZZ(Q.xy()[0]), all=True)
95
    for Q_Qp in Q_Qps:
96
        if GF(p)(Q_Qp.xy()[1]) == Q.xy()[1]:
97
            break
98

99
    p_times_P = p*P_Qp
100
    p_times_Q = p*Q_Qp
101

102
    x_P,y_P = p_times_P.xy()
103
    x_Q,y_Q = p_times_Q.xy()
104

105
    phi_P = -(x_P/y_P)
106
    phi_Q = -(x_Q/y_Q)
107
    k = phi_Q/phi_P
108
    return ZZ(k)
109
m3 = SmartAttack(P,Q,p)
110
print(m3)

1
from Crypto.Util.number import *
2
from random import randint
3
from hashlib import md5
4

5
flag1 = b'xxx'
6
flag2 = b'xxx'
7
Flags = 'flag{' + md5(flag1+flag2).hexdigest()[::-1] + '}'
8

9
def backpack_encrypt_flag(flag_bytes, M, group_len):
10
    bits = []
11
    for byte in flag_bytes:
12
        bits.extend([int(b) for b in format(byte, "08b")])
13

14
    while len(bits) % group_len != 0:
15
        bits.append(0)
16

17
    S_list = []
18
    for i in range(0, len(bits), group_len):
19
        group = bits[i:i + group_len]
20
        S = sum(bit * m for bit, m in zip(group, M))
21
        S_list.append(S)
22
    return S_list
23

24
def backpack(flag_bytes):
25
    R = [10]
26
    while len(R) < 8:
27
        next_val = randint(2 * R[-1], 3 * R[-1])
28
        R.append(next_val)
29
    B = randint(2 * R[-1] + 1, 3 * R[-1])
30
    A = getPrime(100)
31
    M = [A * ri % B for ri in R]
32
    S_list = backpack_encrypt_flag(flag_bytes, M, len(M))
33
    return R, A, B, M, S_list
34

35
p = getPrime(512)
36
q = getPrime(512)
37
n = p*q
38
e = 0x10000
39
m = bytes_to_long(flag1)
40
k = randint(1, 999)
41
problem1 = (pow(p,e,n)-pow(q,e,n)) % n
42
problem2 = pow(p-q,e,n)*pow(e,k,n)
43
c = pow(m,e,n)
44

45
R, A, B, M, S_list = backpack(flag2)
46

47
with open(r"C:\Users\Rebirth\Desktop\data.txt", "w") as f:
48
    f.write(f"problem1 = {problem1}\n")
49
    f.write(f"problem2 = {problem2}\n")
50
    f.write(f"n = {n}\n")
51
    f.write(f"c = {c}\n")
52
    f.write("-------------------------\n")
53
    f.write(f"R = {R}\n")
54
    f.write(f"A = {A}\n")
55
    f.write(f"B = {B}\n")
56
    f.write(f"M = {M}\n")
57
    f.write(f"S_list = {S_list}\n")
58
    f.write("-------------------------\n")
59
    f.write(f"What you need to submit is Flags!\n")

1
problem1 =
2
problem2 =
3
n =
4
c =
5
e = 0x10000
6
from Crypto.Util.number import *
7
import gmpy2
8
# problem1 = (pow(p,e,n)-pow(q,e,n)) % n
9
# problem2 = pow(p-q,e,n)*pow(e,k,n)
10
for k in range(1, 999):
11
   tmp = problem1+problem2//pow(e,k,n)
12

13
   p = gmpy2.gcd(n,tmp)
14
   q = n // p
15
   if q!=1 and p!=1:
16
       print(p,q)
17

18
p=
19
q=n//p
20
inv_p = gmpy2.invert(p, q)
21
inv_q = gmpy2.invert(q, p)
22

23
cs = [c]
24
for i in range(16):
25
    ps = []
26
    for c2 in cs:
27
        r = pow(c2, (p + 1) // 4, p)
28
        s = pow(c2, (q + 1) // 4, q)
29

30
        x = (r * inv_q * q + s * inv_p * p) % n
31
        y = (r * inv_q * q - s * inv_p * p) % n
32
        if x not in ps:
33
            ps.append(x)
34
        if n - x not in ps:
35
            ps.append(n - x)
36
        if y not in ps:
37
            ps.append(y)
38
        if n - y not in ps:
39
            ps.append(n - y)
40
    cs = ps
41

42
for m in cs:
43
    print(long_to_bytes(m))
44

45
from Crypto.Util.number import inverse
46

47
def decrypt_backpack(R, A, B, S_list):
48
    invA = inverse(A, B)
49

50
    bits = []
51
    for S in S_list:
52
        s = (invA * S) % B
53

54
        group_bits = []
55
        for r in reversed(R):
56
            if s >= r:
57
                group_bits.append(1)
58
                s -= r
59
            else:
60
                group_bits.append(0)
61
        bits.extend(reversed(group_bits))
62

63
    flag2_bytes = bytearray()
64
    for i in range(0, len(bits), 8):
65
        byte = 0
66
        for b in bits[i:i+8]:
67
            byte = (byte << 1) | b
68
        flag2_bytes.append(byte)
69

70
    return bytes(flag2_bytes).rstrip(b'\x00')
71

72

73
if __name__ == "__main__":
74
    R = [10, 29, 83, 227, 506, 1372, 3042, 6163]
75
    A = 1253412688290469788410859162653
76
    B = 16036
77
    M =
78
    S_list =
79

80
    flag2 = decrypt_backpack(R, A, B, S_list)
81
    print("解密得到的 flag2 =", flag2)
82

83
from hashlib import md5
84

85
flag1=b'CRYPTO_ALGORIT'
86
flag2=b'HMS_WELL_DONE'
87
Flags = 'flag{' + md5(flag1+flag2).hexdigest()[::-1] + '}'
88
print(Flags)