闲题杂记2

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64

from Crypto.Util.number import *
from icecream import *
from hashlib import sha256
from gmpy2 import *
import libnum
from pwn import *
from libnum import *
def h2(m):
    return int(sha256(m).hexdigest(), 16)

io=remote('0.0.0.0',10001)


#1
io.recvuntil('choice>')
io.sendline('1')
io.recvuntil('Please take good care of it!\n')
pk_sk=io.recvuntil('\n')[:-1].decode()[2:-1].split('L,0x')
pk,sk=int(pk_sk[0],16),int(pk_sk[1],16)

#2
io.recvuntil('choice>')
io.sendline('2')
pp, g = 0xb5655f7c97e8007baaf31716c305cf5950a935d239891c81e671c39b7b5b2544b0198a39fd13fa83830f93afb558321680713d4f6e6d7201d27256567b8f70c3, 0x85fd9ae42b57e515b7849b232fcd9575c18131235104d451eeceb991436b646d374086ca751846fdfec1ff7d4e1b9d6812355093a8227742a30361401ccc5577
group_list = [32, 64, 128, 256]
DD=1
for group in group_list:
    io.recvuntil('The cipher shared to you\n')
    cc=int(io.recvuntil('L, ')[1:-3])
    new_cipher=[cc]
    new_cipher+=eval(io.recvuntil(')\n')[:-2].decode().replace('L',''))
    c,E_,V_,s_=new_cipher

    io.recvuntil('prefix, encoder = ')
    Enc2,prefix=pre_enc=eval(io.recvuntil('\n')[:-1].decode().replace('L',''))
    prefix=int(prefix,16)
    encoder=[1,(-pow(prefix,sk,pp)) %pp]
    prefix = long_to_bytes(prefix).rjust(64, b'\x00')

    ml=[1]
    for i in range(len(Enc2)):
        ml.append((ml[-1]*encoder[-1]+Enc2[i]*(-1)**(i+1))%pp)
    r=-ml[-1]%pp
    dd = h2(prefix + long_to_bytes(r).rjust(64, b'\x00')) | 1
    DD*=dd
    d=libnum.invmod(dd,pp-1)
    tmp=E_*V_%pp
    xx=pow(tmp,d,pp)
    m=c*libnum.invmod(xx,pp)%pp
    io.send(hex(m)[2:])
io.recvuntil('You are a clever boy! Now I can share you some other information!\n0x')
mul=int(io.recvuntil('\n')[:-2],16)


ic(DD)
ic(mul)

#3
io.recvuntil('choice>')
io.sendline('3')
cc=int(io.recvuntil('L, ')[1:-3])
cipher=[cc]
cipher+=eval(io.recvuntil(')\n')[:-2].decode().replace('L',''))
ic(cipher)

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12

from gmpy2 import *
io=0xb5655f7c97e8007baaf31716c305cf5950a935d239891c81e671c39b7b5b2544b0198a39fd13fa83830f93afb558321680713d4f6e6d7201d27256567b8f70c3
D=15987058835088036058838351739905403758810826722245822649290306549906899936826738229650730140126509371862930340608846190807298868677166971678478129606238898364288362139315516922003581996769819030117310508402522153899137933429897987557331966070437119010259514160059698255241259153692392463260794449949596746727
mul=7194716155235037744823597029059822446255314248196377746260315999958188811928743123657567494196521690514320209430663462342437059567384744437239548754416135
c=mul*libnum.invmod(D,io)%io
e=4
R.<x> = Zmod(io)[]
f = x ^ e- c
f = f.monic()
res1 = f.roots()
print(res1)

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

from Crypto.Util.number import *
from gmpy2 import *
pp=0xb5655f7c97e8007baaf31716c305cf5950a935d239891c81e671c39b7b5b2544b0198a39fd13fa83830f93afb558321680713d4f6e6d7201d27256567b8f70c3
sk=3415391405045794570454819264678842883406589094879440924771251075986414212665514615692960890299627279215019657097231396800926908716766924569917256830117771
cipher=[1452085683981538837849557434841689674477096081702343000869186835544808468459192026693029532721465657214194362000756249662047209552808256166535501585736401, 9299317806552199012103361766715291248186887467752322286719294121971787657296205598139365760833959784768412272593061318430853065277862724140493914797711689, 9287316455075844376168558534606543590293095721271733423230961724912040658757071778242087450272981713664977773510705690081763692753388091475741636185572383, 229110517869350912236518454062717456777603700368163296438479618211042488031942897036793380693680124455343059560507824269299022538059530971380675264277197]
c,E,V,s=cipher
xx=E*V%pp
m=c*libnum.invmod(pow(xx,sk,pp),pp)%pp
print(long_to_bytes(m))
#flag{504d0411-6707-469b-be31-9868200aca95}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97

from subprocess import run
from Crypto.Util.number import long_to_bytes
from icecream import *
from pwn import *
import re

from pwnlib.util.iters import pad
def b2s(s):
    if(type(s)==str):
        return s
    else:
        return s.decode()

def CatNum(txt):
    txt = b2s(txt)
    matchObj = re.findall(r'[0-9]+', txt)
    return matchObj



def dec(n):
    print(io.recvuntil('Your choice: '))
    io.sendline('1')
    print(io.recvuntil('Your cipher: '))
    io.sendline(str(n))
    return io.recvline()[:-1]
def bigger(mid,c):
    # tmp1 = pow(mid,e,n)
    # ic(tmp1)
    tmp = (c*pow(mid,e,n))%n
    print(tmp)
    # ic(padding)
    m = dec(tmp)
    ic(m)
    if(m!=b'0000'):
        return True
    else:
        return False


io=remote('0.0.0.0',10001)
# print(io.recv(1024))
io.recvuntil('PKCS1_v1_6?(y/n)')
io.sendline('n')
e = int(CatNum(io.recvline())[0])
n = int(CatNum(io.recvline())[0])
c = int(CatNum(io.recvline())[0])
ic(e,c,n)

'''估算padding范围
padding = 1
h = 0
for i in range(512):
    tmp1 = pow(padding,e,n)
    ic(tmp1)
    tmp = (c*tmp1)%n
    print(tmp)
    ic(padding)
    m = dec(tmp)
    ic(m,i)
    if(m!=b'0000'):
        h=i
        input()
        break
    padding *= 2

'''


# pad=240~260
pl = 2**200
ph = 2**496
mid= (pl+ph)//2
input()
for i in range(512):
    # tmp = m*mid
    # ic(tmp-n)
    if(bigger(mid,c)==True):
        ph=mid-1
        mid = (mid+pl)//2
    else:
        pl=mid+1
        mid  =(mid+ph)//2
    # print(mid)
    # input()
ic(mid)
n=2**496
s =n//mid
secret = long_to_bytes(s)
ic(secret)
ic(secret.hex())
print(io.recvuntil('Your choice: '))
io.sendline('2')
io.sendline(secret.hex())
sleep(0.5)
print(io.recv(1024))

1
2
3
4
5

b'Your choice: '
b"You know my secret? (in hex): b'flag{ba1f2511fc30423bdbb183fe33f3dd0f}'\n"
[*] Closed connection to 0.0.0.0 port 10001
  /mnt/c/U/16953/Desktop/twoBytes took  11s at  11:38:42 AM
❯

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64

print 'Try to solve the 3 ECC'

from secret import flag
from Crypto.Util.number import *
assert(flag[:5]=='flag{')
flag = flag[5:-1]
num1 = bytes_to_long(flag[:7])
num2 = bytes_to_long(flag[7:14])
num3 = bytes_to_long(flag[14:])

def ECC1(num):
    p = 146808027458411567
    A = 46056180
    B = 2316783294673
    E = EllipticCurve(GF(p),[A,B])
    P = E.random_point() 
    Q = num*P
    print E
    print 'P:',P
    print 'Q:',Q

def ECC2(num):
    p = 1256438680873352167711863680253958927079458741172412327087203
    #import random
    #A = random.randrange(389718923781273978681723687163812)
    #B = random.randrange(816378675675716537126387613131232121431231)
    A = 377999945830334462584412960368612
    B = 604811648267717218711247799143415167229480
    E = EllipticCurve(GF(p),[A,B])
    P = E.random_point() 
    Q = num*P
    print E
    print 'P:',P
    print 'Q:',Q
    factors, exponents = zip(*factor(E.order()))
    primes = [factors[i] ^ exponents[i] for i in range(len(factors))][:-1]
    print primes
    dlogs = []
    for fac in primes:
        t = int(int(P.order()) / int(fac))
        dlog = discrete_log(t*Q,t*P,operation="+")
        dlogs += [dlog]
        print("factor: "+str(fac)+", Discrete Log: "+str(dlog)) #calculates discrete logarithm for each prime order
    print num
    print crt(dlogs,primes)



def ECC3(num):
    p = 0xd3ceec4c84af8fa5f3e9af91e00cabacaaaecec3da619400e29a25abececfdc9bd678e2708a58acb1bd15370acc39c596807dab6229dca11fd3a217510258d1b
    A = 0x95fc77eb3119991a0022168c83eee7178e6c3eeaf75e0fdf1853b8ef4cb97a9058c271ee193b8b27938a07052f918c35eccb027b0b168b4e2566b247b91dc07
    B = 0x926b0e42376d112ca971569a8d3b3eda12172dfb4929aea13da7f10fb81f3b96bf1e28b4a396a1fcf38d80b463582e45d06a548e0dc0d567fc668bd119c346b2
    E = EllipticCurve(GF(p),[A,B])
    P = E.random_point() 
    Q = num*P
    print E
    print 'P:',P
    print 'Q:',Q

ECC1(num1)
print '=============='
ECC2(num2)
print '=============='
ECC3(num3)

1
2
3
4
5
6
7
8
9

p = 146808027458411567
A = 46056180
B = 2316783294673
E = EllipticCurve(GF(p),[A,B])
P = E(119851377153561800,50725039619018388) 
Q = E(22306318711744209, 111808951703508717) 
n = discrete_log(Q, P, operation='+') 
print(n)
# 13566003730592612

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39

p = 1256438680873352167711863680253958927079458741172412327087203
a = 377999945830334462584412960368612
b = 604811648267717218711247799143415167229480
gx = 550637390822762334900354060650869238926454800955557622817950
gy = 700751312208881169841494663466728684704743091638451132521079

px = 1152079922659509908913443110457333432642379532625238229329830
py = 819973744403969324837069647827669815566569448190043645544592

E = EllipticCurve(GF(p), [a, b])
G = E(gx, gy)
n = E.order()
QA = E(px, py)

factors = list(factor(n))
m = 1
moduli = []
remainders = []

print(f"[+] Running Pohlig Hellman")
print(factors)

for i, j in factors:
    if i > 10**9:
        print(i)
        break
    mod = i**j
    g2 = G*(n//mod)
    q2 = QA*(n//mod)
    r = discrete_log(q2, g2, operation='+')
    remainders.append(r)
    moduli.append(mod)
    m *= mod


r = crt(remainders, moduli)
print(r)
# 16093767336603949
# 9-2521-

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36

p = 0xd3ceec4c84af8fa5f3e9af91e00cabacaaaecec3da619400e29a25abececfdc9bd678e2708a58acb1bd15370acc39c596807dab6229dca11fd3a217510258d1b
A = 0x95fc77eb3119991a0022168c83eee7178e6c3eeaf75e0fdf1853b8ef4cb97a9058c271ee193b8b27938a07052f918c35eccb027b0b168b4e2566b247b91dc07
B = 0x926b0e42376d112ca971569a8d3b3eda12172dfb4929aea13da7f10fb81f3b96bf1e28b4a396a1fcf38d80b463582e45d06a548e0dc0d567fc668bd119c346b2
E = EllipticCurve(GF(p),[A,B])
P = E(10121571443191913072732572831490534620810835306892634555532657696255506898960536955568544782337611042739846570602400973952350443413585203452769205144937861,8425218582467077730409837945083571362745388328043930511865174847436798990397124804357982565055918658197831123970115905304092351218676660067914209199149610)
Q = E(964864009142237137341389653756165935542611153576641370639729304570649749004810980672415306977194223081235401355646820597987366171212332294914445469010927,5162185780511783278449342529269970453734248460302908455520831950343371147566682530583160574217543701164101226640565768860451999819324219344705421407572537)
def SmartAttack(P,Q,p):
    E = P.curve()
    Eqp = EllipticCurve(Qp(p, 2), [ ZZ(t) + randint(0,p)*p for t in E.a_invariants() ])

    P_Qps = Eqp.lift_x(ZZ(P.xy()[0]), all=True)
    for P_Qp in P_Qps:
        if GF(p)(P_Qp.xy()[1]) == P.xy()[1]:
            break

    Q_Qps = Eqp.lift_x(ZZ(Q.xy()[0]), all=True)
    for Q_Qp in Q_Qps:
        if GF(p)(Q_Qp.xy()[1]) == Q.xy()[1]:
            break

    p_times_P = p*P_Qp
    p_times_Q = p*Q_Qp

    x_P,y_P = p_times_P.xy()
    x_Q,y_Q = p_times_Q.xy()

    phi_P = -(x_P/y_P)
    phi_Q = -(x_Q/y_Q)
    k = phi_Q/phi_P
    return ZZ(k)


r = SmartAttack(P, Q, p)
print(r)
# 19597596255129283097357413993866074145935170485891892
# 4a81-9957-8c3381622434

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85

from Crypto.Util.number import*
from hashlib import sha256
import socketserver
import signal
import string
import random
from secret import flag

table = string.ascii_letters+string.digits
flag = bytes_to_long(flag)

MENU = br'''[+] 1.Get Encrypt:
[+] 2.Exit:
'''

class Task(socketserver.BaseRequestHandler):
    def _recvall(self):
        BUFF_SIZE = 2048
        data = b''
        while True:
            part = self.request.recv(BUFF_SIZE)
            data += part
            if len(part) < BUFF_SIZE:
                break
        return data.strip()

    def send(self, msg, newline=True):
        try:
            if newline:
                msg += b'\n'
            self.request.sendall(msg)
        except:
            pass

    def recv(self, prompt=b'[-] '):
        self.send(prompt, newline=False)
        return self._recvall()

    def proof_of_work(self):
        proof = (''.join([random.choice(table)for _ in range(20)])).encode()
        sha = sha256( proof ).hexdigest().encode()
        self.send(b"[+] sha256(XXXX+" + proof[4:] + b") == " + sha )
        XXXX = self.recv(prompt = b'[+] Plz Tell Me XXXX :')
        if len(XXXX) != 4 or sha256(XXXX + proof[4:]).hexdigest().encode() != sha:
            return False
        return True

    def EncRy(self):
        p,q = getPrime(512),getPrime(512)
        n = p * q
        phi = (p - 1) * (q - 1)
        e = inverse(self.d, phi)
        c = pow(flag, e, n)
        return(e,n,c)

    def handle(self):
        signal.alarm(60)
        if not self.proof_of_work():
            return
        self.send(b"Welcome to my RSA!")
        self.d = getPrime(random.randint(435, 436))

        while 1:
            self.send(MENU)
            self.send(b"Now!What do you want to do?")
            option = self.recv()
            if option == b'1':
                self.send(str(self.EncRy()).encode())
            else:
                break

        self.request.close()

class ThreadedServer(socketserver.ThreadingMixIn, socketserver.TCPServer):
    pass

class ForkedServer(socketserver.ForkingMixIn, socketserver.TCPServer):
    pass

if __name__ == "__main__":
    HOST, PORT = '0.0.0.0', 10004
    print("HOST:POST " + HOST+":" + str(PORT))
    server = ForkedServer((HOST, PORT), Task)
    server.allow_reuse_address = True
    server.serve_forever()

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37

#sagemath
from Crypto.Util.number import *
from gmpy2 import iroot
e1,n1,c1=(42930516866813661342965746223080520747639541783178165319930798466029922118238472375394025163017796792784301240279788973937514266651107411418409008126879890591634663600650622272276047586523991529128830751549916767006347857754606279093837920255744001556692088644997689518547315534397835105708024032114104233381, 77791057667316752688491344909349631143733665781985333450578141862483326292146944912417154290062439390262044781769179125790833684914883275144238169619259170245799297149721759503884049470266984858779855785527134093827380541390671671421065142834758715718012985245418556303458870683285396736465075774918756943849, 27391282824232696321494182390733866553767929957526280387298565758936575846502788790274502139115326807546265156509536800727262991966913839267428385697513824611497066201158201419561518562486879276509945503450941372856450148181065616319630297566761526958666976256485612007573889257294374864202830099675167224618)
e2,n2,c2=(19018427406275508266725318182604693048036959850117857989040747866263767206396699322550948080332092809132375761217132996919018670944100226583113345224541762253472497934634295339952030040768111601599444464038423922436192382234875739639531699502158126381323466372283051777517214602215819494796932567681821951661, 79650072081042322662491093415989067423342888043380140123956989961183485888095357404757819859263343837741065918473041502132392064045360290315160760995892876549211580451883428599900857896989098491504167023490425266678783550124590746460833416198860457961338080633882718390420924183342764921882749848062331837157, 47371054845953307458071281584547821822800567401012561479295024891414125620585367467768382853051493673297474227621983913977611690329004811247719468085248653560735761224575841708898687339051979667968682445741679494814049520035089826802489552786717808162007554429409373562206869161512981004103668781786261071642)
e3,n3,c3=(56543738058355787650458463296434379628548490866377456720748305513368031407432713681493384526759984858874833739323541806113831186630548095096957902346105190080635673052132358289744367039154224900185478860894300958278206372821874050674031918453348499825234769506256225325221089605204424199863739802675837768205, 79745878045239534073349506401894614077391259818245570439963094062152853043757431813193065050329923218395626939202508409314449221246402655169069682907439636880572885333431797158404833511447487493689075229003167933950464179409482597295179818105362744282535280033320439360295379327350145598779754591726149053127, 8406272869509814810291187732784177513812310985481896410437026715571367365909106171597609902128681517191154832846694541582315046341089395251486352127008536629880180333790535980063006233315170237788757595367545197059456798192233574190206607791108247915315239293315856045620536743732064060419019383653017754432)
e4,n4,c4=(7084543689346197121827870073257673792657047196994323608218552636377497641605010832530473677981880825830062575269956770329035892637961925305684535520357897676757195804280616332451896105146968442795337854851958165225390355543144975973394614878012047483478453541789213191489356453542050105788672267671186622349, 84193779290507365404703859402732143439109001210124769414375603074891153195964512465635919253078833439745459555371587096356222637979782540883867956964113419688015746698472168356238337484900265019835855499846392509934587316309130977694018626484013012355408173625138875013785514921191427955103949196185104270953, 57188209081624431651145335231083235968076151504975133709205719008833316979899965113559550632823577949531094733328627686996343950189156687337540064474041791342122016380351392782138752676861412964076387375179224936788921872659232295048921383561342206164767267043862968315447568792822076799329961025512641107246)
e5,n5,c5=(42832642928335275352734567465034497040617823999922718556444541540637575945318881858516365030723712293566938969239323128990546490351954020139702168583195387467822779475617077682710213996418869245088581793014583647801408719774140042233362914483058594181044708264940880873371340427513033621237883600041744259821, 100914764703986796503524746926824107407478498950896766954709765945739896574588237451261683044947676026816706250675210414995572771552251740398776761522312876711308663303631592599847201703544166011694904414367791567937596616962437750298179607007543994344224571625128530174980427056520743554240699599606017732453, 21119798060505043638458066841637396779462197838711219768901795233508035124251444985142140372296435557972489164083922904128749582124708137219016012302886951596946166275929450048887248788479585841059063956921630092232393741155010454512377332292347344811575552765907485744387780176768333870372377008256136186807)
e6,n6,c6=(92302858091592048530164341892874939881833483518095068563859833484262743798872223903571012516471302801063982503961657026303472815350321491051234131656128422061238653211376015684800612577226731646341043305151595034538237258802687294046312571159904343739248977644957644677771388548256577367489970379574172464797, 117679207537303828303181692131284163456980142622326819854887578740836701695007074712199364783113450072522001526705110176578644797269399966145551464701075583136732122232247312391436901027876012971338176518412247421456590394727819899354372288058334724615114926953982773216858342784870874502568283116049857599697, 694728970163274338952272545132120395722399912878027385515433411574332882874655233664187165540396449753083157039600465154030742189987900065124001404191085619372639241055402339355981737758090185934672051842827196968679043511560501886410676350912217561099905662581686696249610217183042166978654689061472935255)
e7,n7,c7=(107958832210740007280315466139290077026935359625782760172740000594364460869128124940009236566874443252250812468875065019322671201219651761405497245501179554045401769228061173131905805679002507830926816675819378142336365243119257538909791638758850962854709130774816448647965771903108760260693930942445832581613, 124514631670412396955583333186310036282392256402221528788219590875160132086163249366732298557562280446982290995056571347900001555142302304165284003543211879382117786568833925378625035366897845326134848510307881296792070242801270087606140027163068970890264029919788362871312210162525628755395528824620664275981, 122802204066940916090785459557228909264312462241661083272739613123469038467287559936112649653314041478655145859464338716094314561339632033669065696677349425900229495594900454878607113262204411164149182327233978867883052370242620750529133958835635598563284037235210030872798337887481034016325891031269539006959)
e8,n8,c8=(93032879096884833976354856506992993862316449685244948137669996162571278621479404733170084750947866321488473290655001676203288675188640293830346141700535957251408373865922564197265494466697836691672035371673758770683433485891640334014710181418750508413205768593981082149070901287189919968858883490943111987181, 126814261604881133528727989048158217150888497288150533655112145843950045425282139821602599229665745129453799945609742281626549287640177663087578340721569938344685390347348772958990014616194819409373556039354672378457009008450988307789399181204535224407248419395946571885338535639198634359608298711433536942733, 95330490027741440826424434337219961367405797139516869535055648011514837588374299753114991801669135223731470401046346436845011624597842223950760050976711965720535288001750040424144530196787933771814541562581236974965361143703635725068380670591839954283253531181890717506164459934317393787888216914582168459996)
sqrn8=iroot(n8,2)[0]
M=[
    [sqrn8,e1,e2,e3,e4,e5,e6,e7,e8],
    [0,-n1,0,0,0,0,0,0,0],
    [0,0,-n2,0,0,0,0,0,0],
    [0,0,0,-n3,0,0,0,0,0],
    [0,0,0,0,-n4,0,0,0,0],
    [0,0,0,0,0,-n5,0,0,0],
    [0,0,0,0,0,0,-n6,0,0],
    [0,0,0,0,0,0,0,-n7,0],
    [0,0,0,0,0,0,0,0,-n8]
]
M=matrix(ZZ,M)
M=M.LLL()
if M[0][0]<0:
    M=-M
d,t1=M[0][0]//sqrn8,M[0][1]
k1=(d*e1-t1)//n1
s1=(t1-1)//k1-1
var('x')
F=x^2-s1*x+n1
p,q=F.roots()[0][0],F.roots()[1][0]
p,q=abs(p),abs(q)
d=inverse_mod(Integer(e1),(Integer(p)-1)*(Integer(q)-1))
print(long_to_bytes(pow(c1,d,n1)))
#b'flag{338f4482-4f11-496c-a0d7-b06df53f79c5}'

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97

from Crypto.Util.number import*
from Crypto.Cipher import AES
from secret import flag
from my_encrypt import block_encrypt
from hashlib import sha256
import socketserver
import signal
import string
import random
import os

table = string.ascii_letters+string.digits

MENU = br'''[+] 1.Encrypt the Flag:
[+] 2.Encrypt your Plaintext:
[+] 3.Exit:
'''

def pad(m):
    padlen = 16 - len(m) % 16
    return m + padlen * bytes([padlen])

def xor(msg1,msg2):
    assert len(msg1)==len(msg2)
    return long_to_bytes(bytes_to_long(msg1)^bytes_to_long(msg2))

class Task(socketserver.BaseRequestHandler):
    def _recvall(self):
        BUFF_SIZE = 2048
        data = b''
        while True:
            part = self.request.recv(BUFF_SIZE)
            data += part
            if len(part) < BUFF_SIZE:
                break
        return data.strip()

    def send(self, msg, newline=True):
        try:
            if newline:
                msg += b'\n'
            self.request.sendall(msg)
        except:
            pass

    def recv(self, prompt=b'[-] '):
        self.send(prompt, newline=False)
        return self._recvall()

    def proof_of_work(self):
        proof = (''.join([random.choice(table)for _ in range(20)])).encode()
        sha = sha256( proof ).hexdigest().encode()
        self.send(b"[+] sha256(XXXX+" + proof[4:] + b") == " + sha )
        XXXX = self.recv(prompt = b'[+] Plz Tell Me XXXX :')
        if len(XXXX) != 4 or sha256(XXXX + proof[4:]).hexdigest().encode() != sha:
            return False
        return True


    def enc_msg(self,msg):
        return block_encrypt(pad(msg),self.key,self.ivv)

    def handle(self):
        signal.alarm(50)
        if not self.proof_of_work():
            return
        self.ivv = os.urandom(16)
        self.key = os.urandom(16)
        while 1:
            self.send(MENU,newline = False)
            option = self.recv()

            if (option == b'1'):
                self.send(b"My Encrypted flag is:")
                self.send(self.enc_msg(flag))

            elif option == b'2':
                self.send(b"Give me Your Plain & I'll give you the Cipher.")
                plaintext = self.recv()
                self.send(b'PlainText:' + plaintext + b'\nCipherText:' + self.enc_msg(plaintext))
            else:
                break
        self.send(b"\n[.]Down the Connection.")
        self.request.close()

class ThreadedServer(socketserver.ThreadingMixIn, socketserver.TCPServer):
    pass

class ForkedServer(socketserver.ForkingMixIn, socketserver.TCPServer):
    pass

if __name__ == "__main__":
    HOST, PORT = '0.0.0.0', 10004
    print("HOST:POST " + HOST+":" + str(PORT))
    server = ForkedServer((HOST, PORT), Task)
    server.allow_reuse_address = True
    server.serve_forever()

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168

from Crypto.Util.number import *
Sbox = (
    0x63, 0x7C, 0x77, 0x7B, 0xF2, 0x6B, 0x6F, 0xC5, 0x30, 0x01, 0x67, 0x2B, 0xFE, 0xD7, 0xAB, 0x76,
    0xCA, 0x82, 0xC9, 0x7D, 0xFA, 0x59, 0x47, 0xF0, 0xAD, 0xD4, 0xA2, 0xAF, 0x9C, 0xA4, 0x72, 0xC0,
    0xB7, 0xFD, 0x93, 0x26, 0x36, 0x3F, 0xF7, 0xCC, 0x34, 0xA5, 0xE5, 0xF1, 0x71, 0xD8, 0x31, 0x15,
    0x04, 0xC7, 0x23, 0xC3, 0x18, 0x96, 0x05, 0x9A, 0x07, 0x12, 0x80, 0xE2, 0xEB, 0x27, 0xB2, 0x75,
    0x09, 0x83, 0x2C, 0x1A, 0x1B, 0x6E, 0x5A, 0xA0, 0x52, 0x3B, 0xD6, 0xB3, 0x29, 0xE3, 0x2F, 0x84,
    0x53, 0xD1, 0x00, 0xED, 0x20, 0xFC, 0xB1, 0x5B, 0x6A, 0xCB, 0xBE, 0x39, 0x4A, 0x4C, 0x58, 0xCF,
    0xD0, 0xEF, 0xAA, 0xFB, 0x43, 0x4D, 0x33, 0x85, 0x45, 0xF9, 0x02, 0x7F, 0x50, 0x3C, 0x9F, 0xA8,
    0x51, 0xA3, 0x40, 0x8F, 0x92, 0x9D, 0x38, 0xF5, 0xBC, 0xB6, 0xDA, 0x21, 0x10, 0xFF, 0xF3, 0xD2,
    0xCD, 0x0C, 0x13, 0xEC, 0x5F, 0x97, 0x44, 0x17, 0xC4, 0xA7, 0x7E, 0x3D, 0x64, 0x5D, 0x19, 0x73,
    0x60, 0x81, 0x4F, 0xDC, 0x22, 0x2A, 0x90, 0x88, 0x46, 0xEE, 0xB8, 0x14, 0xDE, 0x5E, 0x0B, 0xDB,
    0xE0, 0x32, 0x3A, 0x0A, 0x49, 0x06, 0x24, 0x5C, 0xC2, 0xD3, 0xAC, 0x62, 0x91, 0x95, 0xE4, 0x79,
    0xE7, 0xC8, 0x37, 0x6D, 0x8D, 0xD5, 0x4E, 0xA9, 0x6C, 0x56, 0xF4, 0xEA, 0x65, 0x7A, 0xAE, 0x08,
    0xBA, 0x78, 0x25, 0x2E, 0x1C, 0xA6, 0xB4, 0xC6, 0xE8, 0xDD, 0x74, 0x1F, 0x4B, 0xBD, 0x8B, 0x8A,
    0x70, 0x3E, 0xB5, 0x66, 0x48, 0x03, 0xF6, 0x0E, 0x61, 0x35, 0x57, 0xB9, 0x86, 0xC1, 0x1D, 0x9E,
    0xE1, 0xF8, 0x98, 0x11, 0x69, 0xD9, 0x8E, 0x94, 0x9B, 0x1E, 0x87, 0xE9, 0xCE, 0x55, 0x28, 0xDF,
    0x8C, 0xA1, 0x89, 0x0D, 0xBF, 0xE6, 0x42, 0x68, 0x41, 0x99, 0x2D, 0x0F, 0xB0, 0x54, 0xBB, 0x16,
)

InvSbox = (
    0x52, 0x09, 0x6A, 0xD5, 0x30, 0x36, 0xA5, 0x38, 0xBF, 0x40, 0xA3, 0x9E, 0x81, 0xF3, 0xD7, 0xFB,
    0x7C, 0xE3, 0x39, 0x82, 0x9B, 0x2F, 0xFF, 0x87, 0x34, 0x8E, 0x43, 0x44, 0xC4, 0xDE, 0xE9, 0xCB,
    0x54, 0x7B, 0x94, 0x32, 0xA6, 0xC2, 0x23, 0x3D, 0xEE, 0x4C, 0x95, 0x0B, 0x42, 0xFA, 0xC3, 0x4E,
    0x08, 0x2E, 0xA1, 0x66, 0x28, 0xD9, 0x24, 0xB2, 0x76, 0x5B, 0xA2, 0x49, 0x6D, 0x8B, 0xD1, 0x25,
    0x72, 0xF8, 0xF6, 0x64, 0x86, 0x68, 0x98, 0x16, 0xD4, 0xA4, 0x5C, 0xCC, 0x5D, 0x65, 0xB6, 0x92,
    0x6C, 0x70, 0x48, 0x50, 0xFD, 0xED, 0xB9, 0xDA, 0x5E, 0x15, 0x46, 0x57, 0xA7, 0x8D, 0x9D, 0x84,
    0x90, 0xD8, 0xAB, 0x00, 0x8C, 0xBC, 0xD3, 0x0A, 0xF7, 0xE4, 0x58, 0x05, 0xB8, 0xB3, 0x45, 0x06,
    0xD0, 0x2C, 0x1E, 0x8F, 0xCA, 0x3F, 0x0F, 0x02, 0xC1, 0xAF, 0xBD, 0x03, 0x01, 0x13, 0x8A, 0x6B,
    0x3A, 0x91, 0x11, 0x41, 0x4F, 0x67, 0xDC, 0xEA, 0x97, 0xF2, 0xCF, 0xCE, 0xF0, 0xB4, 0xE6, 0x73,
    0x96, 0xAC, 0x74, 0x22, 0xE7, 0xAD, 0x35, 0x85, 0xE2, 0xF9, 0x37, 0xE8, 0x1C, 0x75, 0xDF, 0x6E,
    0x47, 0xF1, 0x1A, 0x71, 0x1D, 0x29, 0xC5, 0x89, 0x6F, 0xB7, 0x62, 0x0E, 0xAA, 0x18, 0xBE, 0x1B,
    0xFC, 0x56, 0x3E, 0x4B, 0xC6, 0xD2, 0x79, 0x20, 0x9A, 0xDB, 0xC0, 0xFE, 0x78, 0xCD, 0x5A, 0xF4,
    0x1F, 0xDD, 0xA8, 0x33, 0x88, 0x07, 0xC7, 0x31, 0xB1, 0x12, 0x10, 0x59, 0x27, 0x80, 0xEC, 0x5F,
    0x60, 0x51, 0x7F, 0xA9, 0x19, 0xB5, 0x4A, 0x0D, 0x2D, 0xE5, 0x7A, 0x9F, 0x93, 0xC9, 0x9C, 0xEF,
    0xA0, 0xE0, 0x3B, 0x4D, 0xAE, 0x2A, 0xF5, 0xB0, 0xC8, 0xEB, 0xBB, 0x3C, 0x83, 0x53, 0x99, 0x61,
    0x17, 0x2B, 0x04, 0x7E, 0xBA, 0x77, 0xD6, 0x26, 0xE1, 0x69, 0x14, 0x63, 0x55, 0x21, 0x0C, 0x7D,
)

xc = lambda a: (((a << 1) ^ 0x1B) & 0xFF) if (a & 0x80) else (a << 1)

R = (
    0x00, 0x01, 0x02, 0x04, 0x08, 0x10, 0x20, 0x40,
    0x80, 0x1B, 0x36, 0x6C, 0xD8, 0xAB, 0x4D, 0x9A,
    0x2F, 0x5E, 0xBC, 0x63, 0xC6, 0x97, 0x35, 0x6A,
    0xD4, 0xB3, 0x7D, 0xFA, 0xEF, 0xC5, 0x91, 0x39,
)

def t2m(text):
    text = bytes_to_long(text)
    matrix = []
    for i in range(16):
        byte = (text >> (8 * (15 - i))) & 0xFF
        if i % 4 == 0:
            matrix.append([byte])
        else:
            matrix[i // 4].append(byte)
    return matrix


def m2t(matrix):
    text = 0
    for i in range(4):
        for j in range(4):
            text |= (matrix[i][j] << (120 - 8 * (4 * i + j)))
    return long_to_bytes(text)


class myAES:
    def __init__(self, MasterKey):
        self.ChangeKey(MasterKey)

    def ChangeKey(self, MasterKey):
        self.RoundKeys = t2m(MasterKey)
        # print self.RoundKeys

        for i in range(4, 4 * 11):
            self.RoundKeys.append([])
            if i % 4 == 0:
                byte = self.RoundKeys[i - 4][0]        \
                     ^ Sbox[self.RoundKeys[i - 1][1]]  \
                     ^ R[i // 4]
                self.RoundKeys[i].append(byte)

                for j in range(1, 4):
                    byte = self.RoundKeys[i - 4][j]    \
                         ^ Sbox[self.RoundKeys[i - 1][(j + 1) % 4]]
                    self.RoundKeys[i].append(byte)
            else:
                for j in range(4):
                    byte = self.RoundKeys[i - 4][j]    \
                         ^ self.RoundKeys[i - 1][j]
                    self.RoundKeys[i].append(byte)

        # print self.RoundKeys

    def encrypt(self, plaintext):
        self.plain_state = t2m(plaintext)

        self.__add_round_key(self.plain_state, self.RoundKeys[:4])

        for i in range(1, 10):
            self.__round_encrypt(self.plain_state, self.RoundKeys[4 * i : 4 * (i + 1)])

        self.__sub_bytes(self.plain_state)
        self.__shift_rows(self.plain_state)
        self.__sub_bytes(self.plain_state)
        self.__add_round_key(self.plain_state, self.RoundKeys[40:])

        return m2t(self.plain_state)

    def __add_round_key(self, s, k):
        for i in range(4):
            for j in range(4):
                s[i][j] ^= k[i][j]

    def __round_encrypt(self, state_matrix, key_matrix):
        self.__sub_bytes(state_matrix)
        self.__shift_rows(state_matrix)
        self.__mix_columns(state_matrix)
        self.__add_round_key(state_matrix, key_matrix)

    def __sub_bytes(self, s):
        for i in range(4):
            for j in range(4):
                s[i][j] = Sbox[s[i][j]]

    def __shift_rows(self, s):
        s[0][1], s[1][1], s[2][1], s[3][1] = s[1][1], s[2][1], s[3][1], s[0][1]
        s[0][2], s[1][2], s[2][2], s[3][2] = s[2][2], s[3][2], s[0][2], s[1][2]
        s[0][3], s[1][3], s[2][3], s[3][3] = s[3][3], s[0][3], s[1][3], s[2][3]

    def __mix_single_column(self, a):
        # please see Sec 4.1.2 in The Design of Rijndael
        t = a[0] ^ a[1] ^ a[2] ^ a[3]
        u = a[0]
        a[0] ^= t ^ xc(a[0] ^ a[1])
        a[1] ^= t ^ xc(a[1] ^ a[2])
        a[2] ^= t ^ xc(a[2] ^ a[3])
        a[3] ^= t ^ xc(a[3] ^ u)

    def __mix_columns(self, s):
        for i in range(4):
            self.__mix_single_column(s[i])

def xor(a,b):
    assert len(a) == len(b)
    tmp = []
    for i in range(len(a)):
        tmp.append(a[i]^b[i])
    return bytes(tmp)

def exchange_plain(plaintext):
    new_plain = []
    for i in plaintext:
        new_plain.append(i<<1)
    new_plain = bytes(new_plain)
    return new_plain

def block_encrypt(plaintext,key,iv):
    aes = myAES(key)
    block = len(plaintext)//16
    new_plain = exchange_plain(plaintext)
    cipher = b''
    for i in range(block):
        iv = aes.encrypt(iv) 
        cipher += xor(iv,new_plain[16*i:16*i+16])
    return cipher

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58

from pwn import *
from Crypto.Util.number import *
from hashlib import sha256
import string
from pwnlib.util.iters import mbruteforce

table = string.ascii_letters+string.digits
def pow():
    io.recvuntil("XXXX+")
    suffix = io.recv(16).decode("utf8")
    io.recvuntil("== ")
    cipher = io.recvline().strip().decode("utf8")
    proof = mbruteforce(lambda x: sha256((x + suffix).encode()).hexdigest() ==
                        cipher, table, length=4, method='fixed')
    io.sendlineafter("XXXX :", proof) 

def pad(m):
    padlen = 16 - len(m) % 16
    return m + padlen * bytes([padlen])

def enc(plaintext):
    print(io.recvuntil(b'[-]').decode())
    io.sendline(b"2")
    print(io.recvuntil(b'[-] ').decode())
    io.sendline(plaintext)
    io.recvuntil(b"CipherText:")
    c = io.recvuntil(b'[+]')[:-4]
    return c

def xor(msg1,msg2):
    assert len(msg1)==len(msg2)
    return long_to_bytes(bytes_to_long(msg1)^bytes_to_long(msg2))

if __name__ == "__main__":
    io = remote("127.0.0.1",10004)
    pow()
    print(io.recvuntil(b'[-] ').decode())
    io.sendline(b"1")
    print(io.recvuntil(b"My Encrypted flag is:").decode())
    c = io.recvuntil(b'[+]')[1:-4]

    cipherlen = len(c) - 1
    fakeplain = cipherlen * b'\x01'
    blocksize = cipherlen//16
    newcipher = enc(fakeplain)
    fakeplain = pad(fakeplain)
    new_plain = []
    for i in fakeplain:
        new_plain.append((i)<<1)
    new_plain = bytes(new_plain)
    s = (xor(new_plain,newcipher[:]))

    fakeplain2 = (xor(s,c))
    new_plain = []
    for i in fakeplain2:
        new_plain.append((i)>>1)
    new_plain = bytes(new_plain)
    print(new_plain)

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167

from Crypto.Util.number import*
import random
from secret import flag
from hashlib import sha256
import socketserver
import signal
import string

def trans_flag(flag):
    new_flag = []
    for i in range(6):
        new_flag.append(bytes_to_long(flag[i*7:i*7+7]))
    return new_flag

kbits = 1024
table = string.ascii_letters+string.digits
flag = trans_flag(flag)

def Setup(kbits):
    p_bit = kbits//2
    q_bit = kbits - p_bit
    while 1:
        p = getPrime(p_bit)
        p_tmp = (p-1)//2
        if isPrime(p_tmp):
            break
    while 1:
        q = getPrime(q_bit)
        q_tmp = (q-1)//2
        if isPrime(q_tmp):
            break
    N = p*q
    while 1:
        g = random.randrange(N*N)
        if (pow(g,p_tmp * q_tmp,N*N) - 1)%N == 0 and  (pow(g,p_tmp * q_tmp,N*N) - 1)//N >= 1 and (pow(g,p_tmp * q_tmp,N*N) - 1)//N <= N - 1:
            break
    public = (N,g)
    return public,p

def KeyGen(public):
    N,g = public
    a = random.randrange(N*N)
    h = pow(g,a,N*N)

    pk = h
    sk = a 

    return pk,sk

def Encrypt(public,pk,m):
    N,g = public
    r = random.randrange(N*N)
    A = pow(g,r,N*N)
    B = (pow(pk,r,N*N) * (1 + m * N)) % (N * N)
    return A,B

def Add(public,dataCipher1,dataCipher2):
    N = public[0]
    A1,B1 = dataCipher1
    A2,B2 = dataCipher2

    A = (A1*A2)%(N*N)
    B = (B1*B2)%(N*N)

    return (A,B)

def hint(p):
    _p = getPrime(2048)
    _q = getPrime(2048)
    n = _p*_q
    e = 0x10001
    s = getPrime(300)
    tmp = (160 * s ** 5 - 4999 * s ** 4 + 3 * s ** 3 +1)

    phi = (_p-1)*(_q-1)
    d = inverse(e,phi)
    k = (_p-s)*d
    enc = pow(p,e,n)
    return (tmp,k,enc,n)

class Task(socketserver.BaseRequestHandler):
    def _recvall(self):
        BUFF_SIZE = 2048
        data = b''
        while True:
            part = self.request.recv(BUFF_SIZE)
            data += part
            if len(part) < BUFF_SIZE:
                break
        return data.strip()

    def send(self, msg, newline=True):
        try:
            if newline:
                msg += b'\n'
            self.request.sendall(msg)
        except:
            pass

    def recv(self, prompt=b'SERVER <INPUT>: '):
        self.send(prompt, newline=False)
        return self._recvall()

    def proof_of_work(self):
        proof = (''.join([random.choice(table)for _ in range(20)])).encode()
        sha = sha256(proof).hexdigest().encode()
        self.send(b"[+] sha256(XXXX+" + proof[4:] + b") == " + sha )
        XXXX = self.recv(prompt = b'[+] Plz Tell Me XXXX :')
        if len(XXXX) != 4 or sha256(XXXX + proof[4:]).hexdigest().encode() != sha:
            return False
        return True

    def handle(self):
        proof = self.proof_of_work()
        if not proof:
            self.request.close()


        public,p = Setup(kbits)
        signal.alarm(60)
        pk = []

        for i in range(6):
            pki,ski = KeyGen(public)
            pk.append(pki)

        msg = [123,456,789,123,456,789]
        CipherPair = []
        for i in range(len(pk)):
            TMP = Encrypt(public,pk[i],msg[i])
            CipherPair.append(((TMP),pk[i]))

        CipherDate = []
        for i in range(len(pk)):
            CipherDate.append(Add(public,Encrypt(public,pk[i],flag[i]),CipherPair[i][0]))

        self.send(b'What do you want to get?\n[1]pk_list\n[2]public_parameters\n[3]hint_for_p\n[4]EncRypt_Flag\n[5]exit')
        while 1:
            option = self.recv()
            if option == b'1':
                self.send(b"[~]My pk_list is:")
                self.send(str(pk).encode())
            elif option == b'2':
                self.send(b"[~]My public_parameters is")
                self.send(str(public).encode())
            elif option == b'3':
                self.send(b"[~]My hint for p is")
                self.send(str(hint(p)).encode())
            elif option == b'4':
                self.send(b'[~]What you want is the flag!')
                self.send(str(CipherDate).encode())
            else:
                break
        self.request.close()

class ThreadedServer(socketserver.ThreadingMixIn, socketserver.TCPServer):
    pass

class ForkedServer(socketserver.ForkingMixIn, socketserver.TCPServer):
    pass

if __name__ == "__main__":
    HOST, PORT = '0.0.0.0', 10004
    print("HOST:POST " + HOST+":" + str(PORT))
    server = ForkedServer((HOST, PORT), Task)
    server.allow_reuse_address = True
    server.serve_forever()