from Crypto.Util.number import * from random import getrandbits from secret import flag
defgetN(): N = 1 for i inrange(16): tmp = getPrime(32) N *= tmp return N
mask = getrandbits(256) e = 65537 n = getN() m = bytes_to_long(flag) c = pow(m*mask,e,n) print(f'n = {n}') print(f'e = {e}') print(f'c = {c}') print(f'mask = {mask}')
''' n = 93099494899964317992000886585964221136368777219322402558083737546844067074234332564205970300159140111778084916162471993849233358306940868232157447540597 e = 65537 c = 54352122428332145724828674757308827564883974087400720449151348825082737474080849774814293027988784740602148317713402758353653028988960687525211635107801 mask = 54257528450885974256117108479579183871895740052660152544049844968621224899247 '''
主要利用sagemath的factor函数，然后最后记得除mask
exp:
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17
from Crypto.Util.number import * import gmpy2
n = 93099494899964317992000886585964221136368777219322402558083737546844067074234332564205970300159140111778084916162471993849233358306940868232157447540597 c = 54352122428332145724828674757308827564883974087400720449151348825082737474080849774814293027988784740602148317713402758353653028988960687525211635107801 mask = 54257528450885974256117108479579183871895740052660152544049844968621224899247
phi = 1 for i in factor(n): phi *= i[0] - 1 d = gmpy2.invert(65537,phi) m1 = pow(c,d,n) #m = m1 // mask m = 334526535497992378634036751902245187892235112866317344720327978830278781 print(long_to_bytes(m)) #0xGame{Magic_M@th_Make_Crypt0}
#sage from Crypto.Util.number import * import gmpy2
w = mod = pubkey = [w*pow(3, i) % mod for i inrange(512)] c =
n = len(pubkey)
Ge = Matrix(ZZ,n+2,n+2) for i inrange(n): Ge[i,i] = 1 Ge[i,-1] = pubkey[i]
Ge[-2,-2] = 1 Ge[-2,-1] = c Ge[-1,-1] = mod
for i in Ge.LLL(): if i[-1] == 0: tmp = i[:-2] ans = '' for j in tmp: ifabs(j) == 0: ans += '0' ifabs(j) == 1: ans += '1' e = int(ans[::-1],2) flag = long_to_bytes(e) ifb"0xGame"in flag: print(flag) #0xGame{Welc0me_2_Crypt0_G@me!#$&%}
defpad(text): iflen(text)%8: return text else: pad = 8-(len(text)%8) text += pad.to_bytes(1,'big')*pad return text
defEncrypt_CBC(text,iv,key): result = b'' text = pad(text) block=[text[_*8:(_+1)*8] for _ inrange(len(text)//8)] for i in block: tmp = bytes_xor(iv,i) iv = encrypt(tmp,key) result += iv return result
defencrypt(text,key): result = b'' for i in text: result += ((i^key)).to_bytes(1,'big') return result
iv = b'11111111' enc = (Encrypt_CBC(flag,iv,key)) print(f'enc = {enc}')
defencrypt(text,key): result = b'' for i in text: result += ((i^key)).to_bytes(1,'big') return result
iv = b'11111111' c = b"\x8e\xc6\xf9\xdf\xd3\xdb\xc5\x8e8q\x10f>7.5\x81\xcc\xae\x8d\x82\x8f\x92\xd9o'D6h8.d\xd6\x9a\xfc\xdb\xd3\xd1\x97\x96Q\x1d{\\TV\x10\x11"
# for i in range(256): # m = b"0xGame{" + long_to_bytes(i) # tmp = bytes_xor(iv,m) # key = tmp[0] ^ c[0] # cc = encrypt(tmp,key) # if cc == c[:8]: # print(m) #0xGame{0 # print(key) #143
key = 143
block=[c[_*8:(_+1)*8] for _ inrange(len(c)//8)] block = block[::-1]
m = [] for i inrange(len(block)-1): tmp = encrypt(block[i],key) mm = bytes_xor(tmp,block[i+1]) m.append(mm) m = m[::-1] flag = b"0xGame{0" + b"".join(m) print(flag) #0xGame{098f6bcd4621d373cade4e832627b4f6}
defenc(text): code = 'AP3IXYxn4DmwqOlT0Q/JbKFecN8isvE6gWrto+yf7M5d2pjBuk1Hh9aCRZGUVzLS' text = ''.join([str(bin(i))[2:].zfill(8) for i in text]) length = len(text) pad = b'' if length%3 == 1: text += '00' pad = b'==' elif length%3 == 2: text += '0' pad = b'=' result = [code[int(text[3*i:3*(i+1)],2)] for i inrange(0,len(text)//3)] return''.join(result).encode()+pad
defencrypt(flag): result = b'' for i inrange(len(flag)): result += (key[i%7]^(flag[i]+i)).to_bytes(1,'big') return result
c = enc(encrypt(flag)) print(f'c = {c}')
''' c = b'IPxYIYPYXPAn3nXX3IXA3YIAPn3xAYnYnPIIPAYYIA3nxxInXAYnIPAIxnXYYYIXIIPAXn3XYXIYAA3AXnx=' '''
c = 'IPxYIYPYXPAn3nXX3IXA3YIAPn3xAYnYnPIIPAYYIA3nxxInXAYnIPAIxnXYYYIXIIPAXn3XYXIYAA3AXnx' code = 'AP3IXYxn4DmwqOlT0Q/JbKFecN8isvE6gWrto+yf7M5d2pjBuk1Hh9aCRZGUVzLS'
enc = [] for i in c: enc.append(bin(code.index(i))[2:].zfill(3)) text = ''.join(enc)
block = [text[8*i:8*(i+1)] for i inrange(len(text) // 8)] print(block)
m = b"0xGame{" key = [] for i inrange(7): kk = int(block[i],2) ^ (m[i] + i) key.append(kk) print(key) flag = "" for i inrange(len(block)): mm = (key[i%7] ^ (int(block[i],2))) - i flag += chr(mm) print(flag) #0xGame{Kn0wn_pl@intext_Att@ck!}
from Crypto.Util.number import * import gmpy2 from sympy.ntheory.modular import crt
p = 8237763448327424871950828228273863325587732991938648753016149761004918521337676972763871570006722552014080958105888713975090350689060892327170546305946879 q = 7687653192574283689842465763299611592007909813801176843577189341409409692975753037402253496632410364594655611337156337669083582400443042348458268161331043 c = 12623780002384219022772693100787925315981488689172490837413686188416255911213044332780064192900824150269364486747430892667624289724721692959334462348218416297309304391635919115701692314532111050955120844126517392040880404049818026059951326039894605004852370344012563287210613795011783419126458214779488303552 e = 260792700
defdecrypt(c,e,phi,n): t = gmpy2.gcd(e,phi) if t != 1: print(t) e1 = e // t d = gmpy2.invert(e1,phi) m = pow(c,d,n) return m else: d = gmpy2.invert(e,phi) m = pow(c,d,n) return m
from Crypto.Cipher import AES from Crypto.Util.number import * from hashlib import sha256
defHellman(h, g, N, p, qi): h = pow(h, N//qi, p) g = pow(g, N//qi, p) ai = discrete_log(mod(h,p), mod(g,p)) returnint(ai)
g = 2 p = 250858685680234165065801734515633434653 B = 33067794433420687511728239091450927373 A = 235866450680721760403251513646370485539 enc=b's\x04\xbc\x8bT6\x846\xd9\xd6\x83 y\xaah\xde@\xc9\x17\xdc\x04v\x18\xef\xcf\xef\xc5\xfd|\x0e\xca\n\xbd#\x94{\x8e[.\xe8\xe1GU\xfa?\xda\x11w' iv = b"0xGame0xGameGAME"
x = discrete_log(mod(B,p),mod(g,p)) print(x) print(B == pow(g,x,p)) # x = 1620639479 # True key = pow(A,x,p) key = sha256(long_to_bytes(int(key))).digest() aes = AES.new(key, AES.MODE_CBC, iv) flag = aes.decrypt(enc) print(flag) #0xGame{51393fe1fd5fc2df1bf018d06f0fa11d}\x08\x08\x08\x08\x08\x08\x08\x08
from Crypto.Util.number import * import socketserver import signal from secret import flag import random import os import string from hashlib import sha256 from string import ascii_uppercase from random import shuffle,choice,randint import os
q = getPrime(512) p = getPrime(512) e = 65537 n = q*p phi = (q-1)*(p-1) d = inverse(e,phi)
def_recvall(self): BUFF_SIZE = 2048 data = b'' whileTrue: part = self.request.recv(BUFF_SIZE) data += part iflen(part) < BUFF_SIZE: break return data.strip()
self.send(MEMU.encode()) whileTrue: code = self.recv() if code == b'S': self.send(b'What you want to sign?:') m = bytes_to_long(self.recv()) c = pow(m,e,n) self.send(f'{n}\n{e}\n{c}'.encode()) elif code == b'F': self.send(b'Give me the Signatrue:') Signatrue = int(self.recv()) self.send(b'Where you want to interfere?') index = int(self.recv()) self.send(b'The decrypt text:') self.send(decrypt(Signatrue,d,n,index).encode())
elif code == b'C': self.send(b'Give me the private key:') ans = int(self.recv()) if ans == d: self.send(b'Here is your flag:') self.send(flag) else: self.send(b'invaild input')
print("未知数:",Xnum) print(tail) print(hash) print("开始爆破") for i in product(table,repeat=Xnum): head = ''.join(i) t = hashlib.sha256((head + tail).encode()).hexdigest() if t == hash: print('爆破成功！结果是：', end='') print(head) sh.send(head.encode()) break
print("以下是提交完XXXX之后的流程\n") data = sh.recvuntil(b">") sh.sendline(b"S") message = b"flag{ABCDEFGHIJKLMNOPQRSTUVWXYZ}" m = bytes_to_long(message) sh.sendline(message) sh.recvline() n = int(sh.recvline().decode().split(' ')[1].split('\n')[0]) print("n =",n) e = sh.recvline().decode().split('\n')[0] print("e =",e) c = int(sh.recvline().decode().split('\n')[0]) print("c =",c) d = '' for i in trange(1024): sh.sendline(b"F") sh.recvline() # print(sh.recvline().decode().split('\n')[0]) sh.sendline(str(c).encode()) sh.recvline() # print(sh.recvline().decode().split('\n')[0]) sh.sendline(str(i).encode()) sh.recvline() m_ = int(sh.recvline().decode().split('\n')[0]) # print(m_) C = m_ * gmpy2.invert(m,n) % n if C == pow(c,2**i,n): d += "0" else: d += '1' print("d = ",d) if (pow(c,int(d[::-1],2),n) == m): break sh.sendline('C') sh.sendline(str(int(d[::-1],2)).encode()) sh.interactive() #0xGame{F@ult_Milest0ne!!}
for i inrange(128): s = S[i:i+128] A.append(s) A = Matrix(Zmod(2),A) B = vector(Zmod(2),R[:128]) M = A.solve_right(B) print(M) m = '' for i in M: m += str(i) flag = b"0xGame{" + bytes.fromhex(hex(int(m,2))[2:]) + b"}" print(flag) #0xGame{Rec0ver_the_M@sk}
from challenges.challenge1 import RSAServe as challenge1 from challenges.challenge2 import RSAServe as challenge2 from challenges.challenge3 import RSAServe as challenge3 from secret import flag import random import os import string from hashlib import sha256 from string import ascii_uppercase from random import shuffle,choice,randint import os import socketserver import signal
SCORE = [0, 0, 0] BANNER = """ ____ ____ _ | _ \/ ___| / \ | |_) \___ \ / _ \ | _ < ___) / ___ \ |_| \_\____/_/ \_\ Here are four challenges(1, 2, 3), solve them all then you can get flag. """ MEMU = """ /----------------------------\\ | options | | 1. get public key | | 2. get cipher text | | 3. check | \\---------------------------/ """
def_recvall(self): BUFF_SIZE = 2048 data = b'' whileTrue: part = self.request.recv(BUFF_SIZE) data += part iflen(part) < BUFF_SIZE: break return data.strip()
from Crypto.Util.number import * from itertools import product from pwn import * import string import hashlib import gmpy2
defsmooth(N): a = 2 n = 2 whileTrue: a = pow(a, n, N) res = gmpy2.gcd(a - 1, N) if res != 1and res != N: return res n += 1
#展开为连分数列表 defcontinuedFra(x, y): cF = [] while y: cF += [x // y] x, y = y, x % y return cF #将当前连分数列表计算成有理分数 defSimplify(ctnf): numerator = 0 denominator = 1 for x in ctnf[::-1]: numerator, denominator = denominator, x * denominator + numerator return (numerator, denominator) #将连分数列表变成不同的有理数逼近列表 defgetit(c): cf=[] for i inrange(1,len(c)): cf.append(Simplify(c[:i])) return cf
defdecrypt3(n1, n2,c): cf = continuedFra(n1, n2) for (q2,q1) in getit(cf): #前面一个参数是分母 try: if n2 % q2 == 0and q2 != 1: p2 = n2 // q2 d = gmpy2.invert(65537,(p2-1)*(q2-1)) m = pow(c,d,n2) message = long_to_bytes(m) return message except: continue defgetflag1(): sh.send(b"1") sh.recvuntil(b">").decode() sh.send(b"1") n = int(sh.recvline().decode()) e = int(sh.recvline().decode()) gift = int(sh.recvline().decode()) sh.recvuntil(b">") sh.sendline(b"2") c = int(sh.recvline().decode().split(' ')[1],16) p = gmpy2.gcd(n,gift - 1) q = n // p d = gmpy2.invert(e,(p-1)*(q-1)) m = pow(c,d,n) message = long_to_bytes(m) print("m1 =",message) sh.recvuntil(b">") sh.send(b"3") sh.send(message) #Fermat's little theorem?
defgetflag2(): sh.send(b"2") sh.recvuntil(b">").decode() sh.send(b"1") n = int(sh.recvline().decode()) e = int(sh.recvline().decode()) sh.recvuntil(b">") sh.sendline(b"2") c = int(sh.recvline().decode().split(' ')[1],16) p = smooth(n) q = n // p d = gmpy2.invert(e,(p-1)*(q-1)) m = pow(c,d,n) message = long_to_bytes(m) print("m2 =",message) sh.recvuntil(b">") sh.send(b"3") sh.send(message) #EzFactor!
print("未知数:",Xnum) print(tail) print(hash) print("开始爆破") for i in product(table,repeat=Xnum): head = ''.join(i) t = hashlib.sha256((head + tail).encode()).hexdigest() if t == hash: print('爆破成功！结果是：', end='') print(head) sh.send(head.encode()) break
for i inrange(100): sh.recvline() data = sh.recvuntil(b"=").decode().strip('=').split("+") a = int(data[0]) b = int(data[1]) message = a+b sh.sendline(str(message).encode()) sh.recvline()
from Crypto.Util.number import getPrime from random import randint from secert import secert,flag from hashlib import md5 defn2b(n):return md5(str(n).encode()).hexdigest()
assert secert < pow(2,64) assert flag == '0xGame{'+n2b(secert)+'}'
defMartix2list(Martix): result = [] Martix = list(Martix) for i in Martix: result.append(list(i)) return result
A = # 12 * 12的矩阵 p = A = Matrix(GF(p),A) enc = A**secert
defMartix2list(Martix): result = [] Martix = list(Martix) for i in Martix: result.append(list(i)) return result
withopen('enc.txt','w') as f: f.write(str(Martix2list(enc)))
由$A^m = C$，结合线代知识知道
存在矩阵$P$,使得$P^{-1}AP = B$（B是对角矩阵）
$\therefore B^m = P^{-1}A^mP$
即$B^m = P^{-1}CP$
根据对角矩阵相乘的性质（主对角线上的元素自乘），这样就把矩阵的乘法转为求解$b^m \equiv c \mod p$这样的离散对数问题，其中$b$是矩阵$B$主对角线上任意一个元素，$c$是右边矩阵$P^{-1}CP$主对角线上任意一个元素
A = Matrix(GF(p),A) C = Matrix(GF(p),C) A,P = A.diagonalization() # print(A)
P_ = P.inverse() C = P_ * C * P
a = A[0][0] c = C[0][0] m = discrete_log(mod(c,p),mod(a,p)) print(m) #6208835615336459559 flag = "0xGame{" + hashlib.md5(str(m).encode()).hexdigest() + "}" print(flag) #0xGame{06450201eb6171d40151563d967e59ea}
from Crypto.Util.number import getPrime,GCD,inverse,bytes_to_long import random
defgetKey(bits): p = getPrime(bits) g = getPrime(bits//2) d = random.randint(1,p-2) y = pow(g,d,p) public,private = (p,g,y),d return public,private
defsign(m,public,private): m = bytes_to_long(m) p,g,y = public d = private whileTrue: k = random.randint(1,p-1) if GCD(k,p-1)==1:break r = pow(g,k,p) s = ((m-d*r)*inverse(k,p-1)) % (p-1) return (r,s)
defverity(m,sign,public): m = bytes_to_long(m) p,g,y = public r,s = sign ifpow(g,m,p) == (pow(y,r,p)*pow(r,s,p)) % p: returnTrue else: returnFalse
def_recvall(self): BUFF_SIZE = 2048 data = b'' whileTrue: part = self.request.recv(BUFF_SIZE) data += part iflen(part) < BUFF_SIZE: break return data.strip()
self.send(b'Here are your public key:') self.send(str(pub).encode()) whileTrue: #sign self.send(b'Pz tell me what you want to sign?') message = self.recv() if message == b'0xGame': self.send(b"Permission denied!") quit() self.send(b'Here are your sign:') r,s = sign(message,pub,pri) self.send(f'r={r}\ns={s}'.encode()) #ver self.send(b'Tell me your signature,if you want to get the flag.') r = int(self.recv()) s = int(self.recv())
if verity(b'0xGame',(r,s),pub): self.send(b'Here you are:'+flag) self.send(b'bye~') quit() else: self.send(b"sorry~you can't get it.")
import gmpy2 from Crypto.Util.number import * import random from Crypto.Util.number import getPrime,GCD,inverse,bytes_to_long import random
defgetKey(bits): p = getPrime(bits) g = getPrime(bits//2) d = random.randint(1,p-2) y = pow(g,d,p) public,private = (p,g,y),d return public,private
defsign(m,public,private): m = bytes_to_long(m) p,g,y = public d = private whileTrue: k = random.randint(1,p-1) if GCD(k,p-1)==1:break r = pow(g,k,p) s = ((m-d*r)*inverse(k,p-1)) % (p-1) return (r,s)
defverity(m,sign,public): m = bytes_to_long(m) p,g,y = public r,s = sign ifpow(g,m,p) == (pow(y,r,p)*pow(r,s,p)) % p: returnTrue else: returnFalse
pub,pri = getKey(512) p,g,y = pub flag = b"0xGame" m = long_to_bytes(bytes_to_long(flag)*p) (r,s) = sign(m,pub,pri)
print("未知数:",Xnum) print(tail) print(hash) print("开始爆破") for i in product(table,repeat=Xnum): head = ''.join(i) t = hashlib.sha256((head + tail).encode()).hexdigest() if t == hash: print('爆破成功！结果是：', end='') print(head) sh.send(head.encode()) break
print("以下是提交完XXXX之后的流程\n")
sh.recvuntil(b"Here are your public key:\n") sign = eval(sh.recvline().decode()) p,g,y = sign m = b"0xGame" message = long_to_bytes(bytes_to_long(m) + (p-1)) sh.recvuntil(b">") sh.sendline(message) sh.recvuntil(b"Here are your sign:\n") r = int(sh.recvline().decode().split('=')[-1]) s = int(sh.recvline().decode().split('=')[-1]) sh.recvuntil(b">") sh.sendline(str(r).encode()) sh.recvuntil(b">") sh.sendline(str(s).encode()) sh.interactive()
#0xGame{24b6edfdc07d71311774ed15248f434e}
Re
代码启示录
0xGame{038e8685-0a59-a868-ed44-979261e99faf}
旋转密码城
把上面脚本跑一下即可
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17
import java.util.Scanner;
classexp{ publicstaticvoidmain(String args[]){ Stringcipher="_Iv2>6L424c_4c2\\f__5\\7fec\\da32\\3ef2`cgd4b46N"; StringBuilderflag=newStringBuilder(); for (char c : cipher.toCharArray()) { if (c >= '!' && c <= '~') { flag.append((char)((c - 33 + 47) % 94 + 33)); } else { flag.append(c); } } System.out.println(flag); } } # 0xGame{cac40c4a-700d-f764-52ba-b67a1485c3ce}
import os import string import random from hashlib import sha256 from string import ascii_uppercase from random import shuffle,choice,randint import socketserver import signal from DSA import * from secret import flag GAME = DSA()
def_recvall(self): BUFF_SIZE = 2048 data = b'' whileTrue: part = self.request.recv(BUFF_SIZE) data += part iflen(part) < BUFF_SIZE: break return data.strip()
defhandle(self): signal.signal(signal.SIGALRM, self.timeout_handler) signal.alarm(300) ifnot self.proof_of_work(): self.send(b'[!] Wrong!') return self.send(MENU.encode()) self.send(b'Here are your public key:') self.send(f'q={GAME.q}\np={GAME.p}\ng={GAME.g}\ny={GAME.y}'.encode()) whileTrue: self.send(b'What you want to choice?') code = self.recv() if code == b'S': self.send(b'What you want to sign?') msg = self.recv() if msg == b'admin': self.send(b'Permission denied!') self.send(b'Are you trying hack me?No way!') quit() self.send(b'Here are your signature:') s,r = GAME.sign(msg) self.send(f's = {s}'.encode()) self.send(f'r = {r}'.encode())
elif code == b'V': self.send(b"Let's check your signature.") self.send(b'Tell me your message:') msg = self.recv() self.send(b'Tell me the signature (s,r):') s = int(self.recv()) r = int(self.recv()) if GAME.verify(msg,s,r): self.send(b'OK,it work') else: self.send(b'Something wrong?')
elif code == b'C': self.send(b"Tell me the signature of 'admin'") s = int(self.recv()) r = int(self.recv()) if GAME.verify(b'admin',s,r): self.send(b'Congratulations!You are Master of Cryptography!') self.send(b'Here are your flag:') self.send(flag) quit() else: self.send(b'It seems Something wrong?') else: self.send(b'invaild input')
print("未知数:",Xnum) print(tail) print(hash) print("开始爆破") for i in product(table,repeat=Xnum): head = ''.join(i) t = hashlib.sha256((head + tail).encode()).hexdigest() if t == hash: print('爆破成功！结果是：', end='') print(head) sh.send(head.encode()) break
print("以下是提交完XXXX之后的流程\n")
sh.recvuntil(b"Here are your public key:\n") q = eval(sh.recvline().decode().split("=")[1]) p = eval(sh.recvline().decode().split("=")[1]) g = eval(sh.recvline().decode().split("=")[1]) y = eval(sh.recvline().decode().split("=")[1])
R = [] S = [] H = [] for i inrange(20): sh.recvuntil(b"What you want to choice?") sh.sendline(b"S") sh.recvuntil(b"What you want to sign?") m = getPrime(128) msg = long_to_bytes(m) h = bytes_to_long(sha1(msg).digest()) sh.sendline(msg) sh.recvuntil(b"Here are your signature:\n") s = eval(sh.recvline().decode().split("=")[1]) r = eval(sh.recvline().decode().split("=")[1]) S.append(s) R.append(r) H.append(h) n = len(S) Ge = Matrix(ZZ,n+2,n+2) for i inrange(n): Ge[i,i] = q Ge[-2,i] = gmpy2.invert(S[i],q) * R[i] Ge[-1,i] = gmpy2.invert(S[i],q) * H[i] K = 2^128 Ge[-1,-1] = K Ge[-2,-2] = 1
defsign(m,k,x): H = bytes_to_long(sha1(m).digest()) r = pow(g,k,p)%q s = (inverse(k,q)*(H+r*x))%q return r,s for line in Ge.LLL(): ifabs(line[-1]) == K: k1 = abs(line[0]) d = abs(line[-2]) print("d =",d) r,s = sign(b"admin",int(k1),int(d)) sh.recvuntil(b"What you want to choice?") sh.sendline(b"C") sh.recvuntil(b"> Tell me the signature of 'admin'") sh.sendline(str(s).encode()) sh.sendline(str(r).encode()) sh.interactive() # 0xGame{31260c7522632a69031d07133aedebfe}
''' n = 20890649807098098590988367504589884104169882461137822700915421138825243082401073285651688396365119177048314378342335630003758801918471770067256781032441408755600222443136442802834673033726750262792591713729454359321085776245901507024843351032181392621160709321235730377105858928038429561563451212831555362084799868396816620900530821649927143675042508754145300235707164480595867159183020730488244523890377494200551982732673420463610420046405496222143863293721127847196315699011480407859245602878759192763358027712666490436877309958694930300881154144262012786388678170041827603485103596258722151867033618346180314221757 e = 18495624691004329345494739768139119654869294781001439503228375675656780205533832088551925603457913375965236666248560110824522816405784593622489392063569693980307711273262046178522155150057918004670062638133229511441378857067441808814663979656329118576174389773223672078570346056569568769586136333878585184495900769610485682523713035338815180355226296627023856218662677851691200400870086661825318662718172322697239597148304400050201201957491047654347222946693457784950694119128957010938708457194638164370689969395914866589468077447411160531995194740413950928085824985317114393591961698215667749937880023984967171867149 c = 7268748311489430996649583334296342239120976535969890151640528281264037345919563247744198340847622671332165540273927079037288463501586895675652397791211130033797562320858177249657627485568147343368981852295435358970875375601525013288259717232106253656041724174637307915021524904526849025976062174351360431089505898256673035060020871892556020429754849084448428394307414301376699983203262072041951835713075509402291301281337658567437075609144913905526625759374465018684092236818174282777215336979886495053619105951835282087487201593981164477120073864259644978940192351781270609702595767362731320959397657161384681459323 leak=136607909840146555806361156873618892240715868885574369629522914036807393164542930308166609104735002945881388216362007941213298888307579692272865700211608126496105057113506756857793463197250909161173116422723246662094695586716106972298428164926993995948528941241037242367190042120886133717 '''
defsmall_roots(f, bounds, m=1, d=None): ifnot d: d = f.degree()
R = f.base_ring() N = R.cardinality()
f /= f.coefficients().pop(0) f = f.change_ring(ZZ)
G = Sequence([], f.parent()) for i inrange(m + 1): base = N ^ (m - i) * f ^ i for shifts in itertools.product(range(d), repeat=f.nvariables()): g = base * prod(map(power, f.variables(), shifts)) G.append(g)
factors = [monomial(*bounds) for monomial in monomials] for i, factor inenumerate(factors): B.rescale_col(i, factor)
B = B.dense_matrix().LLL()
B = B.change_ring(QQ) for i, factor inenumerate(factors): B.rescale_col(i, 1 / factor)
H = Sequence([], f.parent().change_ring(QQ)) for h infilter(None, B * monomials): H.append(h) I = H.ideal() if I.dimension() == -1: H.pop() elif I.dimension() == 0: roots = [] for root in I.variety(ring=ZZ): root = tuple(R(root[var]) for var in f.variables()) roots.append(root) return roots
from Crypto.Util.number import getPrime from Crypto.Cipher import AES from random import getrandbits from secret import flag,M from hashlib import md5
defMD5(m):return md5(str(m).encode()).hexdigest()
p = 11093300438765357787693823122068501933326829181518693650897090781749379503427651954028543076247583697669597230934286751428880673539155279232304301123931419 a = getPrime(int(512)) b = getPrime(int(512)) assert p>a assert p>b E = EllipticCurve(GF(p),[a,b]) G = E.random_point() k = getPrime(int(512)) K = k*G r = getrandbits(64) M = E(M)
