XYCTF 2024 CRYPTO wp1

声明：可能有些操作并非最优解，仅提供一种可行思路，勿喷。 

  sign_in签到

题目：

from Crypto.Util.number import *
from tqdm import *
import gmpy2
flag=b'XYCTF{uuid}'
flag=bytes_to_long(flag)
leak=bin(int(flag))
while 1:
    leak += "0"
    if len(leak) == 514:
        break

def swap_bits(input_str):
    input_list = list(input_str[2:])
    length = len(input_list)

    for i in range(length // 2):
        temp = input_list[i]
        input_list[i] = input_list[length - 1 - i]
        input_list[length - 1 - i] = temp

    return ''.join(input_list)

input_str = leak
result = swap_bits(input_str)
a=result

def custom_add(input_str):
    input_list = list(input_str)
    length = len(input_list)
    
    for i in range(length):
        input_list[i] = str((int(input_list[i]) + i + 1) % 10)

    result = ''.join(input_list)
    return result


input_str = a
result = custom_add(input_str)
b=result
print(b)
#12345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567891134567799012455779902334577801133457889012356679901245568891223457780112355788911245667800134456889122355788001334568990123566799013445688902335578800134456899012456678011245567991223557880012355788912234677900124556789122355788001245578890123566799112455689912235577801123556899122346779911245578801233467789112355779912234577990233556780113

本质就是将flag转二进制再用0填充，得到514位加密后二进制串，再将二进制翻转后进行加密程序custom_add,最后直接输出结果。

加密程序是按位置值进行加法后取模，于是反向得到解密方案即按位加上（10-位置值）后再对10取模，接着利用现成的翻转函数，从而得到填充后的二进制数。不确定填充了多少0，保险起见手动从最后一个1开始去0再转字节型字符串，若不成功就加一位0，不过不需要加。

from Crypto.Util.number import *



def swap_bits(input_str):
    input_list = list(input_str[2:])
    length = len(input_list)

    for i in range(length // 2):
        temp = input_list[i]
        input_list[i] = input_list[length - 1 - i]
        input_list[length - 1 - i] = temp

    return ''.join(input_list)
def custom_add(input_str):
    input_list = list(input_str)
    length = len(input_list)
    
    for i in range(length):
         input_list[i] = str((int(input_list[i]) +1-i)%10)

    result = ''.join(input_list)
    return result


c=b'12345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567891134567799012455779902334577801133457889012356679901245568891223457780112355788911245667800134456889122355788001334568990123566799013445688902335578800134456899012456678011245567991223557880012355788912234677900124556789122355788001245578890123566799112455689912235577801123556899122346779911245578801233467789112355779912234577990233556780113'
cc=custom_add(c)

cccc=swap_bits(cc)
print(cccc)
#此处将cccc手动处理后输入ans
ans=b'1011000010110010100001101010100010001100111101101100101011000110110010001100101001101100110010100110000001101100010110100110000011000110110001100110100001011010011010001100110001110000110001100101101011000100011000100110000011000010010110100110010001100100011100100110100011001000011001001100001001100000011000101100100011001010110000101111101'
result=int(ans,2)

print(long_to_bytes(result))
#XYCTF{ecde6e06-0cc4-4f8c-b10a-2294d2a01dea}

sign_in_revenge方法同上

happy_to_solve1

题目：

from Crypto.Util.number import *
import sympy
from secrets import flag


def get_happy_prime():
    p = getPrime(512)
    q = sympy.nextprime(p ^ ((1 << 512) - 1))
    return p, q


m = bytes_to_long(flag)
p, q = get_happy_prime()
n = p * q
e = 65537
print(n)
print(pow(m, e, n))
# 24852206647750545040640868093921252282805229864862413863025873203291042799096787789288461426555716785288286492530194901130042940279109598071958012303179823645151637759103558737126271435636657767272703908384802528366090871653024192321398785017073393201385586868836278447340624427705360349350604325533927890879
# 14767985399473111932544176852718061186100743117407141435994374261886396781040934632110608219482140465671269958180849886097491653105939368395716596413352563005027867546585191103214650790884720729601171517615620202183534021987618146862260558624458833387692782722514796407503120297235224234298891794056695442287

 观察题目，在基础rsa上仅增加获得质数的方式get_happy_prime，从中得到线索q为p的512位全部取反。基础rsa解密需要d,已经给出e，也就是还需要phi，而phi=(p-1)(q-1)=n+1-(p+q),即需要p+q,由取反可知p+q=2**512-1，512为数字位数。又由于此处采用忽略的方式应对next_prime，因此有误差，需要进行循环消除误差，结果中寻找正常的即为答案

from Crypto.Util.number import *
import gmpy2
n=24852206647750545040640868093921252282805229864862413863025873203291042799096787789288461426555716785288286492530194901130042940279109598071958012303179823645151637759103558737126271435636657767272703908384802528366090871653024192321398785017073393201385586868836278447340624427705360349350604325533927890879
c=14767985399473111932544176852718061186100743117407141435994374261886396781040934632110608219482140465671269958180849886097491653105939368395716596413352563005027867546585191103214650790884720729601171517615620202183534021987618146862260558624458833387692782722514796407503120297235224234298891794056695442287
e = 65537

for t in range (500):
  k=2**512-1+t#t为next_prime造成的误差
  phi=n+1-k#k=p+q
  d=gmpy2.invert(e,phi)
  m=pow(c,d,n)
  print(long_to_bytes(m))#从结果中观察是否有答案，没有则加大循环次数
#XYCTF{3f22f4efe3bbbc71bbcc999a0a622a1a23303cdc}