BUU-RSA入门题合集 第二弹

BUUCTF-RSA签到题第二弹，有意思或者有难度的RSA题目单独放在专栏里了BUUCTF RSA专栏_晓寒的博客-CSDN博客

Dangerous RSA(低加密指数攻击)

题目

n=0x52d483c27cd806550fbe0e37a61af2e7cf5e0efb723dfc81174c918a27627779b21fa3c851e9e94188eaee3d5cd6f752406a43fbecb53e80836ff1e185d3ccd7782ea846c2e91a7b0808986666e0bdadbfb7bdd65670a589a4d2478e9adcafe97c6ee23614bcb2ecc23580f4d2e3cc1ecfec25c50da4bc754dde6c8bfd8d1fc16956c74d8e9196046a01dc9f3024e11461c294f29d7421140732fedacac97b8fe50999117d27943c953f18c4ff4f8c258d839764078d4b6ef6e8591e0ff5563b31a39e6374d0d41c8c46921c25e5904a817ef8e39e5c9b71225a83269693e0b7e3218fc5e5a1e8412ba16e588b3d6ac536dce39fcdfce81eec79979ea6872793L
e=0x3
c=0x10652cdfaa6b63f6d7bd1109da08181e500e5643f5b240a9024bfa84d5f2cac9310562978347bb232d63e7289283871efab83d84ff5a7b64a94a79d34cfbd4ef121723ba1f663e514f83f6f01492b4e13e1bb4296d96ea5a353d3bf2edd2f449c03c4a3e995237985a596908adc741f32365
so,how to get the message?

解题思路

题目只给出了n，e，c，且模数n很大，难以分解

但是我们注意到公钥e = 3，这就给加密带来了很大的不安全性

利用这一点可以针对小加密指数进行攻击：

• 若m^e < n，则m可以由c直接开3次方得到
• 若m^e > n，令m^e = c + kn，则m可以由(c+kn)开3次方得到，这里对k进行遍历

附上代码：

import gmpy2
import binascii

n=0x52d483c27cd806550fbe0e37a61af2e7cf5e0efb723dfc81174c918a27627779b21fa3c851e9e94188eaee3d5cd6f752406a43fbecb53e80836ff1e185d3ccd7782ea846c2e91a7b0808986666e0bdadbfb7bdd65670a589a4d2478e9adcafe97c6ee23614bcb2ecc23580f4d2e3cc1ecfec25c50da4bc754dde6c8bfd8d1fc16956c74d8e9196046a01dc9f3024e11461c294f29d7421140732fedacac97b8fe50999117d27943c953f18c4ff4f8c258d839764078d4b6ef6e8591e0ff5563b31a39e6374d0d41c8c46921c25e5904a817ef8e39e5c9b71225a83269693e0b7e3218fc5e5a1e8412ba16e588b3d6ac536dce39fcdfce81eec79979ea6872793
e=0x3
c=0x10652cdfaa6b63f6d7bd1109da08181e500e5643f5b240a9024bfa84d5f2cac9310562978347bb232d63e7289283871efab83d84ff5a7b64a94a79d34cfbd4ef121723ba1f663e514f83f6f01492b4e13e1bb4296d96ea5a353d3bf2edd2f449c03c4a3e995237985a596908adc741f32365

k = 0
while(True):
    #gmpy2.iroot(x,n) x开n次方根
    #返回值m为开方计算结果，f为bool变量，标识x能否被开方
    m, f = gmpy2.iroot(c+k*n, e)
    if f:
        m = hex(m)[2:]
        print("明文数据为：0x" + m)
        flag = binascii.unhexlify(m)
        print(flag) #flag{25df8caf006ee5db94d48144c33b2c3b}
        break
    k += 1

此题中，直接开方就得到了结果

flag

flag{25df8caf006ee5db94d48144c33b2c3b}

[HDCTF2019]basic rsa(基础题)

题目

给我们的是一个代码文件attachment.py，内容如下

import gmpy2
from Crypto.Util.number import *
from binascii import a2b_hex,b2a_hex

flag = "*****************"

p = 262248800182277040650192055439906580479
q = 262854994239322828547925595487519915551

e = 65533
n = p*q


c = pow(int(b2a_hex(flag),16),e,n)

print c

# 27565231154623519221597938803435789010285480123476977081867877272451638645710

解题思路

先运行一下试试

这里有点坑，因为我用的python3，需要修改一些地方才能解决报错问题，修改如下：

c = pow(int(b2a_hex(bytes(flag, encoding = "utf8")),16),e,n)
print(c)

1. b2a_hex()接受的参数必须为bytes类型，这里进行了强制类型转换
2. print函数在python3中要加括号

分析一下代码：

b2a_hex()是将字节类型数据转换为十六进制数据，然后用int()又转换成十进制

最后用pow()函数进行模幂运算，c = flag^(e) % n，也就是说把flag用RSA加密了

加密输出结果如下：

9544552122426002996962843810441848397036784063191487784065817764908998519819

嗯，完全不知道这波操作在干什么，可能在教大家如何使用RSA加密文本? （斜眼笑.jpg）

那么真正的flag在哪呢

注意到代码最后一行注释有一串数据，尝试对其解密

附上代码：

import gmpy2
import binascii

p = 262248800182277040650192055439906580479
q = 262854994239322828547925595487519915551
e = 65533
n = p*q
c = 27565231154623519221597938803435789010285480123476977081867877272451638645710

d = gmpy2.invert(e,(p-1)*(q-1)) # 求逆元，de = 1 mod fai(n)
m = gmpy2.powmod(c,d,n)# 幂取模，求明文

flag = binascii.unhexlify(hex(m)[2:])
print(flag) #flag{B4by_Rs4}

get flag! 这行注释才是密文本文

flag

flag{B4by_Rs4}

BabyRsa(基础题)

题目

p+q : 0x1232fecb92adead91613e7d9ae5e36fe6bb765317d6ed38ad890b4073539a6231a6620584cea5730b5af83a3e80cf30141282c97be4400e33307573af6b25e2ea
(p+1)(q+1) : 0x5248becef1d925d45705a7302700d6a0ffe5877fddf9451a9c1181c4d82365806085fd86fbaab08b6fc66a967b2566d743c626547203b34ea3fdb1bc06dd3bb765fd8b919e3bd2cb15bc175c9498f9d9a0e216c2dde64d81255fa4c05a1ee619fc1fc505285a239e7bc655ec6605d9693078b800ee80931a7a0c84f33c851740
e : 0xe6b1bee47bd63f615c7d0a43c529d219
d : 0x2dde7fbaed477f6d62838d55b0d0964868cf6efb2c282a5f13e6008ce7317a24cb57aec49ef0d738919f47cdcd9677cd52ac2293ec5938aa198f962678b5cd0da344453f521a69b2ac03647cdd8339f4e38cec452d54e60698833d67f9315c02ddaa4c79ebaa902c605d7bda32ce970541b2d9a17d62b52df813b2fb0c5ab1a5
enc_flag : 0x50ae00623211ba6089ddfae21e204ab616f6c9d294e913550af3d66e85d0c0693ed53ed55c46d8cca1d7c2ad44839030df26b70f22a8567171a759b76fe5f07b3c5a6ec89117ed0a36c0950956b9cde880c575737f779143f921d745ac3bb0e379c05d9a3cc6bf0bea8aa91e4d5e752c7eb46b2e023edbc07d24a7c460a34a9a

解题思路

这道题直接给出了私钥d，但是没给模数n，因此要从p+q和(p+1)(q+1)中求出n = pq

非常简单就能得到：

(p+1)(q+1) = pq + p + q + 1

pq = (p+1)(q+1) - (p+q) - 1

得到n之后正常解密就能拿到flag

附上代码：

import gmpy2
import  binascii
    
#p+q = 0x1232fecb92adead91613e7d9ae5e36fe6bb765317d6ed38ad890b4073539a6231a6620584cea5730b5af83a3e80cf30141282c97be4400e33307573af6b25e2ea
#(p+1)(q+1) = 0x5248becef1d925d45705a7302700d6a0ffe5877fddf9451a9c1181c4d82365806085fd86fbaab08b6fc66a967b2566d743c626547203b34ea3fdb1bc06dd3bb765fd8b919e3bd2cb15bc175c9498f9d9a0e216c2dde64d81255fa4c05a1ee619fc1fc505285a239e7bc655ec6605d9693078b800ee80931a7a0c84f33c851740
e = 0xe6b1bee47bd63f615c7d0a43c529d219
d = 0x2dde7fbaed477f6d62838d55b0d0964868cf6efb2c282a5f13e6008ce7317a24cb57aec49ef0d738919f47cdcd9677cd52ac2293ec5938aa198f962678b5cd0da344453f521a69b2ac03647cdd8339f4e38cec452d54e60698833d67f9315c02ddaa4c79ebaa902c605d7bda32ce970541b2d9a17d62b52df813b2fb0c5ab1a5
enc_flag = 0x50ae00623211ba6089ddfae21e204ab616f6c9d294e913550af3d66e85d0c0693ed53ed55c46d8cca1d7c2ad44839030df26b70f22a8567171a759b76fe5f07b3c5a6ec89117ed0a36c0950956b9cde880c575737f779143f921d745ac3bb0e379c05d9a3cc6bf0bea8aa91e4d5e752c7eb46b2e023edbc07d24a7c460a34a9a
a = 0x1232fecb92adead91613e7d9ae5e36fe6bb765317d6ed38ad890b4073539a6231a6620584cea5730b5af83a3e80cf30141282c97be4400e33307573af6b25e2ea
b = 0x5248becef1d925d45705a7302700d6a0ffe5877fddf9451a9c1181c4d82365806085fd86fbaab08b6fc66a967b2566d743c626547203b34ea3fdb1bc06dd3bb765fd8b919e3bd2cb15bc175c9498f9d9a0e216c2dde64d81255fa4c05a1ee619fc1fc505285a239e7bc655ec6605d9693078b800ee80931a7a0c84f33c851740
n = b - a - 1   #计算模数n

m = gmpy2.powmod(enc_flag, d, n)    #解密
  
print("明文数据为：" + hex(m))
flag = binascii.unhexlify(hex(m)[2:])
print(flag)

flag

flag{cc7490e-78ab-11e9-b422-8ba97e5da1fd}

RSA5(多N分解)

题目

[外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-C6X6udkC-1626313465179)(C:\Users\xiao_han\AppData\Roaming\Typora\typora-user-images\image-20210709092753224.png)]

给出了加密指数e，以及不同模数n对应的加密结果c，一共给出20组nc

解题思路

由于这道题中e不是小指数，因此不能像RSA4一样用中国剩余定理求解

因为我们手上一共有20个模数n，尝试一下是否会有某两个n的大素数因子相同

因为p，q都为素数，所以n的因子只有{1, p, q, n}

直接计算两个n的公约数，若大于1则必定是p或者q中的一个

有了p或者q中的一个，就可以分解出n = p * q，从而计算出私钥d进行解密

附上代码：

import gmpy2
import  binascii

def solve(nList, cList):
    for i in range(len(nList)):
        for j in range(i+1, len(nList)):
            p = gmpy2.gcd(nList[i], nList[j])   #计算最大公约数
            if p != 1:  #若存在最大公约数，则该数为n[i]和n[j]共有的大素数因子，即p或者q
                print("n[%d]和n[%d]存在公约数为\n%d" % (i,j,p))
                q = nList[i] // p
                print("分解n[%d]得到:\n%d =\n%d * \n%d" % (i,nList[i],p,q))
                d = gmpy2.invert(e,(p-1)*(q-1)) #计算e的逆元，即私钥d
                m = gmpy2.powmod(cList[i], d, nList[i]) #模幂运算，解密
                return (binascii.unhexlify(hex(m)[2:]))
                
if __name__ == "__main__":
    e = 65537
    #========== n c ==========
    n1 = 20474918894051778533305262345601880928088284471121823754049725354072477155873778848055073843345820697886641086842612486541250183965966001591342031562953561793332341641334302847996108417466360688139866505179689516589305636902137210185624650854906780037204412206309949199080005576922775773722438863762117750429327585792093447423980002401200613302943834212820909269713876683465817369158585822294675056978970612202885426436071950214538262921077409076160417436699836138801162621314845608796870206834704116707763169847387223307828908570944984416973019427529790029089766264949078038669523465243837675263858062854739083634207
    c1 = 974463908243330865728978769213595400782053398596897741316275722596415018912929508637393850919224969271766388710025195039896961956062895570062146947736340342927974992616678893372744261954172873490878805483241196345881721164078651156067119957816422768524442025688079462656755605982104174001635345874022133045402344010045961111720151990412034477755851802769069309069018738541854130183692204758761427121279982002993939745343695671900015296790637464880337375511536424796890996526681200633086841036320395847725935744757993013352804650575068136129295591306569213300156333650910795946800820067494143364885842896291126137320
    n2 = 20918819960648891349438263046954902210959146407860980742165930253781318759285692492511475263234242002509419079545644051755251