2022-01-08

长安“战疫”网络安全卫士守护赛

no_cry_no_can

有幸二血

from Crypto.Util.number import*
from secret import flag,key

assert len(key) <= 5
assert flag[:5] == b'cazy{'
def can_encrypt(flag,key):
    block_len = len(flag) // len(key) + 1
    new_key = key * block_len
    return bytes([i^j for i,j in zip(flag,new_key)])

c = can_encrypt(flag,key)
print(c)

# b'<pH\x86\x1a&"m\xce\x12\x00pm\x97U1uA\xcf\x0c:NP\xcf\x18~l'

约等于签到题了
先求key

c = b'<pH\x86\x1a&"m\xce\x12\x00pm\x97U1uA\xcf\x0c:NP\xcf\x18~l'
b = b'cazy{'
print([i^j for i,j in zip(c,b)])
#[95, 17, 50, 255, 97]

然后解flag

from Crypto.Util.number import*
key = [95,17,50,255,97]
def can_decrypt(c,key):
    block_len = len(c) // len(key) + 1
    new_key = key * block_len
    return bytes([i^j for i,j in zip(c,new_key)])
c = b'<pH\x86\x1a&"m\xce\x12\x00pm\x97U1uA\xcf\x0c:NP\xcf\x18~l'
m = can_decrypt(c,key)
print(m)

运行得到cazy{y3_1s_a_h4nds0me_b0y!}

no_can_no_bb

有幸三血

import random
from Crypto.Util.number import long_to_bytes
from Crypto.Cipher import AES
from secret import flag

assert flag[:5] ==b'cazy{'

def pad(m):
    tmp = 16-(len(m)%16)
    return m + bytes([tmp for _ in range(tmp)])

def encrypt(m,key):
    aes = AES.new(key,AES.MODE_ECB)
    return aes.encrypt(m)

if __name__ == "__main__":
    flag = pad(flag)
    key = pad(long_to_bytes(random.randrange(1,1<<20)))
    c = encrypt(flag,key)
    print(c)
# b'\x9d\x18K\x84n\xb8b|\x18\xad4\xc6\xfc\xec\xfe\x14\x0b_T\xe3\x1b\x03Q\x96e\x9e\xb8MQ\xd5\xc3\x1c'

直接爆破就好

from Crypto.Util.number import long_to_bytes
from Crypto.Cipher import AES

def pad(m):
    tmp = 16-(len(m)%16)
    return m + bytes([tmp for _ in range(tmp)])

def decrypt(m,key):
    aes = AES.new(key,AES.MODE_ECB)
    return aes.decrypt(m)

c = b'\x9d\x18K\x84n\xb8b|\x18\xad4\xc6\xfc\xec\xfe\x14\x0b_T\xe3\x1b\x03Q\x96e\x9e\xb8MQ\xd5\xc3\x1c'
while True:
    key = pad(long_to_bytes(random.randrange(1, 1 << 20)))
    m = decrypt(c, key)
    if m[:5] ==b'cazy{':
        print(m)
        break

得到：b'cazy{n0_c4n,bb?n0p3!}\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b'
则cazy{n0_c4n,bb?n0p3!}

LinearEquations

from Crypto.Util.number import*
from secret import flag
assert flag[:5] == b'cazy{'
assert flag[-1:] == b'}'
flag = flag[5:-1]
assert(len(flag) == 24)

class my_LCG:
    def __init__(self, seed1 , seed2):
        self.state = [seed1,seed2]
        self.n = getPrime(64)
        while 1:
            self.a = bytes_to_long(flag[:8])
            self.b = bytes_to_long(flag[8:16])
            self.c = bytes_to_long(flag[16:])
            if self.a < self.n and self.b < self.n and self.c < self.n:
                break
    
    def next(self):
        new = (self.a * self.state[-1] + self.b * self.state[-2] + self.c) % self.n
        self.state.append( new )
        return new

def main():
    lcg = my_LCG(getRandomInteger(64),getRandomInteger(64))
    print("data = " + str([lcg.next() for _ in range(5)]))
    print("n = " + str(lcg.n))

if __name__ == "__main__":
    main() 

# data = [2626199569775466793, 8922951687182166500, 454458498974504742, 7289424376539417914, 8673638837300855396]
# n = 10104483468358610819

没做出来，补上参考WP

from Crypto.Util.number import long_to_bytes
import gmpy2
data = [2626199569775466793, 8922951687182166500, 454458498974504742, 7289424376539417914, 8673638837300855396]
n = 10104483468358610819
r = []
for i in range(10):
  r.append([])
  for j in range(10):
    r[i].append(0)
    
for i in range(3):
  for j in range(3):
    r[i][j] = data[i + j]

for i in range(2):
  for j in range(3):
    r[i][j] = (r[i][j] - r[i + 1][j]) % n 

k = gmpy2.invert(r[0][0], n)
for j in range(3):
  r[0][j] = (r[0][j] * k) % n

k = r[1][0]
for j in range(3):
  r[1][j] = (r[1][j] - k * r[0][j]) % n

k = gmpy2.invert(r[1][1], n)

for j in range(3):
  r[1][j] = (r[1][j] * k) % n

k = r[0][1]
for j in range(3):
  r[0][j] = (r[0][j] - k * r[1][j]) % n #解出a和b
#用a和b求c
a = 8175498372211240502
b = 5490290802446982981
c = data[2] - a * data[0] - b * data[1]
c=c%n
print(long_to_bytes(b) + long_to_bytes(a) + long_to_bytes(c))

运行得到：b'L1near_Equ4t1on6_1s_34sy'
则，cazy{L1near_Equ4t1on6_1s_34sy}

math

数学最重要的就是推导

pinvq:0x63367a2b947c21d5051144d2d40572e366e19e3539a3074a433a92161465543157854669134c03642a12d304d2d9036e6458fe4c850c772c19c4eb3f567902b3
qinvp:0x79388eb6c541fffefc9cfb083f3662655651502d81ccc00ecde17a75f316bc97a8d888286f21b1235bde1f35efe13f8b3edb739c8f28e6e6043cb29569aa0e7b
c:0x5a1e001edd22964dd501eac6071091027db7665e5355426e1fa0c6360accbc013c7a36da88797de1960a6e9f1cf9ad9b8fd837b76fea7e11eac30a898c7a8b6d8c8989db07c2d80b14487a167c0064442e1fb9fd657a519cac5651457d64223baa30d8b7689d22f5f3795659ba50fb808b1863b344d8a8753b60bb4188b5e386
e:0x10005
d:0xae285803302de933cfc181bd4b9ab2ae09d1991509cb165aa1650bef78a8b23548bb17175f10cddffcde1a1cf36417cc080a622a1f8c64deb6d16667851942375670c50c5a32796545784f0bbcfdf2c0629a3d4f8e1a8a683f2aa63971f8e126c2ef75e08f56d16e1ec492cf9d26e730eae4d1a3fecbbb5db81e74d5195f49f1

已知c、e、d，求出n即可

注意pinvq和qinvp并不是p，q

所以应该

from Crypto.Util.number import *
import gmpy2
pinvq=0x63367a2b947c21d5051144d2d40572e366e19e3539a3074a433a92161465543157854669134c03642a12d304d2d9036e6458fe4c850c772c19c4eb3f567902b3
qinvp=0x79388eb6c541fffefc9cfb083f3662655651502d81ccc00ecde17a75f316bc97a8d888286f21b1235bde1f35efe13f8b3edb739c8f28e6e6043cb29569aa0e7b
c=0x5a1e001edd22964dd501eac6071091027db7665e5355426e1fa0c6360accbc013c7a36da88797de1960a6e9f1cf9ad9b8fd837b76fea7e11eac30a898c7a8b6d8c8989db07c2d80b14487a167c0064442e1fb9fd657a519cac5651457d64223baa30d8b7689d22f5f3795659ba50fb808b1863b344d8a8753b60bb4188b5e386
e=0x10005
d=0xae285803302de933cfc181bd4b9ab2ae09d1991509cb165aa1650bef78a8b23548bb17175f10cddffcde1a1cf36417cc080a622a1f8c64deb6d16667851942375670c50c5a32796545784f0bbcfdf2c0629a3d4f8e1a8a683f2aa63971f8e126c2ef75e08f56d16e1ec492cf9d26e730eae4d1a3fecbbb5db81e74d5195f49f1
ed_1=e*d-1
for k in range(1,e):
  if gmpy2.gcd(k,ed_1)==k:
    phi=ed_1//k
    kq=(phi-1)*pinvq+1
    kqq=pow(2,phi,kq)-1
    q=GCD(kq,kqq)
    if q.bit_length()>500:
      kp=(phi-1)*qinvp+1
      kpp=pow(2,phi,kp)-1
      p=GCD(kp,kpp)
      print(p.bit_length(),q.bit_length())
# 515 514
# print(p,q)
p=13037022248776485455765657990760031649738172382291971431270088348293679826726124550312158873896310916822494678913767968443939161716318872022577275748319923
q=10128772559601471072353923779846641051004718955169494777946479385229803757744931078384914461587380307767146578124123558724977391368157332433788725638715891
print(long_to_bytes(pow(c,d,p*q)))
# b'flag{c4617a206ba83d7f824dc44e5e67196a}'

代码参考

no_math_no_cry

from Crypto.Util.number import*
from secret import flag

assert len(flag) <= 80
def sec_encry(m):
    cip = (m - (1<<500))**2 + 0x0338470
    return cip

if __name__ == "__main__":
    m = bytes_to_long(flag)
    c = sec_encry(m)
    print(c)

# 10715086071862673209484250490600018105614048117055336074437503883703510511248211671489145400471130049712947188505612184220711949974689275316345656079538583389095869818942817127245278601695124271626668045250476877726638182396614587807925457735428719972874944279172128411500209111406507112585996098530169

逆过去

这几种方法都不能看到开根号结果，最后还是用的factor

并没有得到正确的flag

终于想明白了，加根号有正根负根两个结果
果然

>>> c = 10715086071862673209484250490600018105614048117055336074437503883703510511248211671489145400471130049712947188505612184220711949974689275316345656079538583389095869818942817127245278601695124271626668045250476877726638182396614587807925457735428719972874944279172128411500209111406507112585996098530169

>>> c - 0x0338470
10715086071862673209484250490600018105614048117055336074437503883703510511248211671489145400471130049712947188505612184220711949974689275316345656079538583389095869818942817127245278601695124271626668045250476877726638182396614587807925457735428719972874944279172128411500209111406507112585996095153929
>>> a = -3273390607896141870013189696827599152216642046043064789483291368096133796404498964252554434588102155560771835821852805191141799486904636527518547805827
>>> from Crypto.Util.number import long_to_bytes
>>> long_to_bytes(a+(1<<500))
b'cazy{1234567890_no_m4th_n0_cRy}'
>>> 

八卦迷宫（MISC）

也就是：战长恙长战恙河长山山安战疫疫战疫安疫长安恙
注意最后的flag是要拼音