【2020年第二届“网鼎杯”网络安全大赛 青龙组】Crypto you raise me up / SageMath 一波骚操作
一、用Ubuntu装好的sagemath
#!/usr/bin/env python
# -*- coding: utf-8 -*-
from Crypto.Util.number import *
import random
n = 2 ** 512
m = random.randint(2, n-1) | 1
c = pow(m, bytes_to_long(flag), n)
print 'm = ' + str(m)
print 'c = ' + str(c)
# m = 391190709124527428959489662565274039318305952172936859403855079581402770986890308469084735451207885386318986881041563704825943945069343345307381099559075
# c = 6665851394203214245856789450723658632520816791621796775909766895233000234023642878786025644953797995373211308485605397024123180085924117610802485972584499
题目很…一看就嫩看懂!but…
打开Ubuntu,安装sagemath,开算!
在线求解网址:https://sagecell.sagemath.org/
n = 2 ** 512
m = 391190709124527428959489662565274039318305952172936859403855079581402770986890308469084735451207885386318986881041563704825943945069343345307381099559075
c=6665851394203214245856789450723658632520816791621796775909766895233000234023642878786025644953797995373211308485605397024123180085924117610802485972584499
ZmodN = Zmod(2^512)
m = ZmodN(m)
c = ZmodN(c)
c.log(m)
hex(56006392793405651552924479293096841126763872290794186417054288110043102953612574215902230811593957757)
最后的输出16进制结果
'0x666c61677b35663935636139332d313539342d373632642d656430622d6139313339363932636234617d'
16进制再转为字符串
在线转换网址:https://www.sojson.com/hexadecimal.html
flag{5f95ca93-1594-762d-ed0b-a9139692cb4a}
二、SageMath 的安装使用方法:
下载地址
http://www.sagemath.org/download-linux.html
1. windows版
2. linux Debian系的kali,或者ubuntu
上面的网址随便选个亚洲的镜像,然后下载,扔进linux
下面的图是windows的在:https://github.com/sagemath/sage-windows/releases/tag/0.6.0-9.0
官方教程
http://doc.sagemath.org/html/en/tutorial/index.html
翻译参考
https://www.lainme.com/doku.php/topic/sage/start
下面以自带py2,3的 kali 作演示:
我很早之前安装的时候,解压时间特别特别长,等不及没注意直接 ./sage
安装就会出大问题!!!
耐心!细心!恒心!
选中压缩包,右键在此解压
或者命令行
tar xvf sage-9.0-Debian_GNU_Linux_9-x86_64.tar.bz2
解压后的样子:
进解压的文件夹里
cd SageMath/
在这里空白处,右键打开终端输入:
./sage
Done!
Ubuntu 自带py3,无py2的的环境安装故障
ubuntu ./sage后报错
已安装py3
运行reloacte.py
usr/bin/env python 没有这个目录
打开报错relocate-once.py,在第一行python后面加3,改为usr/bin/env python3 让她找到python的目录即可解决!
三、python sympy解法
从大佬那里截的图,这个小知识点非常重要,写的很好
https://blog.csdn.net/qq_43531895/article/details/106108139
from sympy.ntheory import discrete_log
n = 2**512
m = 391190709124527428959489662565274039318305952172936859403855079581402770986890308469084735451207885386318986881041563704825943945069343345307381099559075
c = 6665851394203214245856789450723658632520816791621796775909766895233000234023642878786025644953797995373211308485605397024123180085924117610802485972584499
flag_dec = discrete_log(n,c,m) #得到flag的十进制值
print(hex(flag_dec)) #转为十六进制后打印出来
0x666c61677b35663935636139332d313539342d373632642d656430622d6139313339363932636234617d
这里,可以把上面的扔进Notepad++,去掉前面的0x,然后选中全部,插件转换为ascii码
import binascii
#16进制整数转ASCii编码字符串
a = 0x666c61677b35663935636139332d313539342d373632642d656430622d6139313339363932636234617d
#a 是需要转换的,带0x的16进制整数
b = hex(a) #加引号,把int转换成相同的str字符串类型
b = b[2:] #截取去掉开头的 0x
c = binascii.a2b_hex(b) #转换成ASCii编码的字符串,类型是bytes
print(c)
b’flag{5f95ca93-1594-762d-ed0b-a9139692cb4a}’
整合后的脚本
import binascii
from sympy.ntheory import discrete_log
n = 2**512
m = 391190709124527428959489662565274039318305952172936859403855079581402770986890308469084735451207885386318986881041563704825943945069343345307381099559075
c = 6665851394203214245856789450723658632520816791621796775909766895233000234023642878786025644953797995373211308485605397024123180085924117610802485972584499
flag_dec = discrete_log(n,c,m) #得到flag的十进制值
a = hex(flag_dec)
b = a[2:] #截取去掉开头的 0x
c = binascii.a2b_hex(b) #转换成ASCii编码的字符串,类型是bytes
print(c, sep='\n')
flag{5f95ca93-1594-762d-ed0b-a9139692cb4a}