2019强网杯crypto writeup

本次write包含以下题目

• copperstudy
• randomstudy
• 强网先锋-辅助

---

copperstudy

题目描述
nc 119.3.245.36 12345
连上去返回

[+]proof: skr=os.urandom(8)
[+]hashlib.sha256(skr).hexdigest()=1651d7f27f35e8f177633a014dbc4eb04a99e74c09a7545d1c1f08e0f8b7f7c3
[+]skr[0:5].encode('hex')=58d0f5f7fc
[-]skr.encode('hex')=

破解一个原文8个字符的sha256，已知前5个字符
可以使用hashcat爆破比较快(10秒内)，也可以自己写python破解

#python3
#path修改为本地hashcat文件夹路径
import os
path="D:\\hashcat-5.1.0\\"
str1=input("[+]hashlib.sha256(skr).hexdigest()=")
str2=input("[+]skr[0:5].encode('hex')=")
print(path+f"hashcat64.exe -a 3 --hex-salt -m 1420 {str1}:{str2} --potfile-disable ?b?b?b  -o res.txt --outfile-format=2")
os.chdir(path)
os.system(path+f"hashcat64.exe -a 3 --hex-salt -m 1420 {str1}:{str2} --potfile-disable ?b?b?b  -o res.txt --outfile-format=2")
with open(path+"res.txt", 'r') as f:
    lines = f.readlines()
    last_line = lines[-1]
    #print(last_line)
    if(last_line[0:4]=="$HEX"):
        print(str2+last_line[5:11])
    else:
        print(str2+hex(last_line))

第一问

[+]Generating challenge 1
[+]n=0x20918380c97c52ae96b53b371e822a972927d4cc96e1659a52ff4ba6849fd16856959ae83a91d2c0775fb06de75c5117c82f8c0eccb225db0ce49f03948c6e693a79f882fd5d4c13d1ea88662f29517dc554dcd4725b3a3910d7815d290585f160367d072aa88b5576e5f8a22d7d987f4791ffbb855e2e1551316a7fcefdaa9L
[+]e=3
[+]m=random.getrandbits(512)
[+]c=pow(m,e,n)=0x1e494321effffbaf32beebe37f042db1baeb12f42740ffe43c8b7d8e18b79170208231610e8f2f65ff85e8f5cdbf2f26fcd500f8ab0e57b3bd3a1cc5255303354cd08b10c5c2b82e5cb7c31569edb4b94a8d1e3834072094d172794f1607dc87e325d49f9228237ee904f1823806682219843a3a51091cf80b4bf9303794d6aL
[+]((m>>72)<<72)=0x258aa871ef627602f03f2100efe0c045d4a307153ca71f26e22fc2bcb72a16ae695d5bad767d258aa42e02a5c6b270a8c355c8a358814e000000000000000000L
[-]long_to_bytes(m).encode('hex')=

一开始没有思路，看到题目叫做copperstudy，搜索关键字ctf rsa copper，果然搜出东西，有一位叫Coppersmith对RSA提出了很多种攻击算法。
题外话，搜索是有技巧的，通常题目的解法不是第一次出现，利用题目的标题/hint/部分关键代码，加上ctf或writeup关键字，通常能搜到点有用的东西。
参考链接
强网杯2018 - nextrsa - Writeup
CTF中常见的RSA相关问题总结
RSA大礼包（二）Coppersmith 相关

第一问的解法
coppersmith攻击，已知m的高位

#sage脚本
load("coppersmith.sage")
N = #N的值
e = 3 #e的值
m = #m的大概值
c = #c的值
ZmodN = Zmod(N)
P. = PolynomialRing(ZmodN)
f = (m + x)^e - c
dd = f.degree()
beta = 1
epsilon = beta / 7
mm = ceil(beta**2 / (dd * epsilon))
tt = floor(dd * mm * ((1/beta) - 1))
XX = ceil(N**((beta**2/dd) - epsilon))
roots = coppersmith_howgrave_univariate(f, N, beta, mm, tt, XX)

第二问

[++++++++++++++++]challenge 1 completed[++++++++++++++++]
[+]Generating challenge 2
[+]n=0x4ac5cbf84a2f9a1042c552c77075459d2273994453caea11fbf696b9a8d41937b48be43c71ec6c37470ba9d280a23301b817314a94c786962e4a98ddb260bf2d53a51a6f9c87258110fb2bc9fe8fa44a24e6f95fd5d098bd907d5f8565a0ed7c681cf5e6a79b28438077f6b8d3ae1edf4229102b4ebe29d1f37b9357d3ffff39L
[+]e=65537
[+]m=random.getrandbits(512)
[+]c=pow(m,e,n)=0x19304208b44ce0bf457d757e368edde74922e89a51290937a386cb320e9c59bb80f77c4a4f1d1b0699593dc1c36748f581c81d1e84a559e4627f0736a68db5fb71109e6784317b8e935d3faaecc8d3248d11728adfd825f54d98b53e66239d4fa19e2b4aefdad101f1c82ae2b9b1640c1c9d851e199373199992c57ab13bf377L
[+]((p>>128)<<128)=0x80f7a73798f638d10180223d7b482035b69b51ffe09ad9e42602cc9d489837be7d1ac92e90b09837144c1220ed4ff0ea00000000000000000000000000000000L

还是coppersmith攻击，已知因子p的高位

load("coppersmith.sage")
N = 0x4ac5cbf84a2f9a1042c552c77075459d2273994453caea11fbf696b9a8d41937b48be43c71ec6c37470ba9d280a23301b817314a94c786962e4a98ddb260bf2d53a51a6f9c87258110fb2bc9fe8fa44a24e6f95fd5d098bd907d5f8565a0ed7c681cf5e6a79b28438077f6b8d3ae1edf4229102b4ebe29d1f37b9357d3ffff39
ZmodN = Zmod(N)
P.<x> = PolynomialRing(ZmodN)
qbar = 0x80f7a73798f638d10180223d7b482035b69b51ffe09ad9e42602cc9d489837be7d1ac92e90b09837144c1220ed4ff0ea00000000000000000000000000000000
f = x - qbar
beta = 0.5
dd = f.degree()
epsilon = beta / 7
mm = ceil(beta**2 / (dd * epsilon))
tt = floor(dd * mm * ((1/beta) - 1))
XX = ceil(N**((beta**2/dd) - epsilon)) + 1000000000000000000000000000000000
roots = coppersmith_howgrave_univariate(f, N, beta, mm, tt, XX)

第三问

[++++++++++++++++]challenge 2 completed[++++++++++++++++]
[+]Generating challenge 3
[+]n=0x6076ea10cc4cef8ceb867f3958946426d25fb06a9d3192d55390bd5611664432bf57d8e2c50cbb897e6086d185145b0af11eaad7ca6593daab707eafc880228fb82765d2aee1d6216418aef2b8c5bfbdf1a03c26552a6170085f0eab020a4c824bb51ae80fc89f05bf2a3bb1d222302c9c7af0ab348c3a5210924f21f76968cfL
[+]e=3
[+]m=random.getrandbits(512)
[+]c=pow(m,e,n)=0x27fcc420e465972031f4ef78bed383aa40af28f940a15b8366d640653241e26cc0cfe9f7df9e884b68c2594566038cefbd61c444fbdcfed0701e22274758494333737e670d48fa8f53104db24c310d20576c7f075a39e839ed78c1db1628f0045ac5c092aeac314805de934338e98c35d8ba8e9730750230721bda9ff5d37334L
[+]d=invmod(e,(p-1)*(q-1))
[+]d&((1<<512)-1)=0xfd7a028dfde00006c3c94b076e29b9786800722872f5ffabe50df2eac3766d801903baafa26eab26e5aa7c90a7d0540d43cdbf6eeea82f1b190