Crypto#

1
import random
2
from flags import flag
3

4
base = 86844066927987146567678238756515930889952488499230423029593188005934867676767
5
seed = random.getrandbits(6767)
6
random.seed(seed)
7

8
for i in range(10):
9
    print("<", random.getrandbits(256))
10

11

12
a = int(input("a>"))
13
b = int(input("b>"))
14

15
if a==0 or a==1:
16
    print("[-] bad hacker")
17
    exit()
18

19
random.seed(a*seed + b)
20

21
for i in range(10):
22
    cur = int(input("> "))
23
    if random.randrange(base) != cur:
24
        print("[-] byebye")
25
        exit()
26

27
print("[+]", flag)

1
from flags import flag
2
from Crypto.Util.number import *
3
from hashlib import md5
4
import os
5

6
p, q = getPrime(64), getPrime(64)
7
e = 0x10001
8
N = p * q
9
d = pow(e, -1, (p-1)*(q-1))
10

11
seed = os.urandom(16)
12

13
def sign(msg):
14
    global d, N
15
    m = bytes_to_long(md5(msg).digest())
16
    return pow(m, d, N)
17

18
used_keys = []
19
print(f"SEED: {seed.hex()}")
20
print(f"{e=}")
21

22
for i in range(100):
23
    print("My turn owo")
24
    cur_key = bytes.fromhex(input("key:"))
25
    print(sign(cur_key+seed))
26
    used_keys.append(cur_key)
27
    print("Your turn ^w^")
28
    cur_key = bytes.fromhex(input("key:"))
29
    if cur_key in used_keys:
30
        print("Can u be more creative LOL")
31
        exit()
32

33
    proof = int(input("proof:"))
34
    if proof != sign(cur_key+seed):
35
        print("Sorry u didn't proof anything ...")
36
        exit()
37
    used_keys.append(cur_key)
38
    print("PASS!")
39

40
phi = int(input("phi?"))
41

42
if phi != (p-1)*(q-1):
43
    print("FAILED at LAST haha")
44
    exit()
45

46
print("Well done", flag)

1
from pwn import *
2
from Crypto.Util.number import bytes_to_long, inverse
3
from hashlib import md5
4
import math
5
import sympy
6
import sys
7

8
# 放寬 Python 對超大整數的限制 (因為 S^e 會非常大)
9
sys.set_int_max_str_digits(1000000)
10

11
# ==========================================
12
# 1. 準備好已知的 MD5 碰撞組合 (Hex String)
13
# 這兩個字串內容不同，但 MD5 Hash 值完全一樣
14
# ==========================================
15
col1_hex = "d131dd02c5e6eec4693d9a0698aff95c2fcab58712467eab4004583eb8fb7f8955ad340609f4b30283e488832571415a085125e8f7cdc99fd91dbdf280373c5bd8823e3156348f5bae6dacd436c919c6dd53e2b487da03fd02396306d248cda0e99f33420f577ee8ce54b67080a80d1ec69821bcb6a8839396f9652b6ff72a70"
16
col2_hex = "d131dd02c5e6eec4693d9a0698aff95c2fcab50712467eab4004583eb8fb7f8955ad340609f4b30283e4888325f1415a085125e8f7cdc99fd91dbd7280373c5bd8823e3156348f5bae6dacd436c919c6dd53e23487da03fd02396306d248cda0e99f33420f577ee8ce54b67080280d1ec69821bcb6a8839396f965ab6ff72a70"
17

18
# 連線到伺服器 (請替換成實際的 IP 與 Port)
19
r = remote('chal.thjcc.org', 48763)
20
#r = process(['python3', 'encrypt.py']) # 如果你在本地測試，用這行
21

22
# 接收 Seed 與 e
23
r.recvuntil(b"SEED: ")
24
seed_hex = r.recvline().strip().decode()
25
seed = bytes.fromhex(seed_hex)
26

27
r.recvuntil(b"e=")
28
e = int(r.recvline().strip().decode())
29
print(f"[+] 取得 Seed: {seed_hex}")
30
print(f"[+] 取得 e: {e}")
31

32
# ==========================================
33
# 第一回合：利用 MD5 碰撞「白嫖」簽章
34
# ==========================================
35
print("\n[+] 進入第一回合 (MD5 碰撞利用)...")
36
r.recvuntil(b"key:")
37
r.sendline(col1_hex.encode())
38
sig1 = int(r.recvline().strip().decode())
39

40
r.recvuntil(b"key:")
41
r.sendline(col2_hex.encode()) # 送出碰撞的另一個 key
42
r.recvuntil(b"proof:")
43
r.sendline(str(sig1).encode()) # 因為 MD5 一樣，拿第一個簽章當證明
44
r.recvline() # PASS!
45

46
# ==========================================
47
# 第二回合：隨便送一個 Key，並在空檔中萃取 N 與 d
48
# ==========================================
49
print("\n[+] 進入第二回合 (萃取 N 並破解私鑰)...")
50
key3_hex = "11223344"
51
r.recvuntil(b"key:")
52
r.sendline(key3_hex.encode())
53
sig3 = int(r.recvline().strip().decode())
54

55
# === 核心數學破解階段 ===
56
print("[!] 正在計算 m1 與 m3...")
57
m1 = bytes_to_long(md5(bytes.fromhex(col1_hex) + seed).digest())
58
m3 = bytes_to_long(md5(bytes.fromhex(key3_hex) + seed).digest())
59

60
print("[!] 正在計算 GCD 以萃取 N (這會花幾秒鐘)...")
61
# N 會是 (S^e - m) 的因數
62
val1 = pow(sig1, e) - m1
63
val2 = pow(sig3, e) - m3
64
N_candidate = math.gcd(val1, val2)
65

66
print("[!] 正在分解 N (128-bit 質因數分解)...")
67
# GCD 算出來的結果可能會是 N 乘上一個小常數，我們直接對其作質因數分解
68
factors = sympy.factorint(N_candidate)
69
primes = [p for p in factors.keys() if p.bit_length() > 60] # 濾掉小常數，只取 60 bit 以上的質數
70

71
p = primes[0]
72
q = primes[1]
73
N = p * q
74
phi = (p - 1) * (q - 1)
75
d = inverse(e, phi)
76

77
print(f"[+] 成功破解 RSA！")
78
print(f"    p = {p}")
79
print(f"    q = {q}")
80
print(f"    N = {N}")
81

82
# ==========================================
83
# 第二回合證明：我們已經有私鑰了，直接自己簽章
84
# ==========================================
85
key4_hex = "55667788"
86
r.recvuntil(b"key:")
87
r.sendline(key4_hex.encode())
88

89
# 自己算簽章
90
m4 = bytes_to_long(md5(bytes.fromhex(key4_hex) + seed).digest())
91
proof4 = pow(m4, d, N)
92

93
r.recvuntil(b"proof:")
94
r.sendline(str(proof4).encode())
95
r.recvline() # PASS!
96

97
# ==========================================
98
# 剩下 98 回合：暴力通關
99
# ==========================================
100
print("\n[+] 自動通關剩餘回合...")
101
for i in range(3, 101):
102
    # My turn
103
    key_my_hex = f"{i:08x}aa"  # <--- 這裡
104
    r.recvuntil(b"key:")
105
    r.sendline(key_my_hex.encode())
106
    r.recvline() # 伺服器給的 sig，我們不需要了
107

108
    # Your turn
109
    key_your_hex = f"{i:08x}bb" # <--- 這裡
110
    r.recvuntil(b"key:")
111
    r.sendline(key_your_hex.encode())
112

113
    # 自己簽
114
    m_your = bytes_to_long(md5(bytes.fromhex(key_your_hex) + seed).digest())
115
    my_proof = pow(m_your, d, N)
116

117
    r.recvuntil(b"proof:")
118
    r.sendline(str(my_proof).encode())
119

120
    if i % 10 == 0:
121
        print(f"    已完成 {i}/100 回合")
122

123
# ==========================================
124
# 最終挑戰：送出 phi，拿 Flag
125
# ==========================================
126
r.recvuntil(b"phi?")
127
r.sendline(str(phi).encode())
128
print("\n[🎉] 成功送出 phi！接收 Flag 中...")
129

130
r.interactive() # 進入互動模式，看噴出來的 Flag

1
44GD44Cx44Cz44GS44GS44KH44KG44CW44G044KA44GZ44CA44Gj44CT44Gh44CZ44Gk44C344Gi44GZ44CW44Gp44KF44GZ44G144Gz44CW44Gp44G044Gh44CS44Gz44Go44CT44Gp44Gi44Ci44GT44KJ

1
44GD44Cx44Cz44GS44GS44KH44KG44CW44G044KA44GZ44CA44Gj44CT44Gh44CZ44Gk44C344Gi44GZ44CW44Gp44KF44GZ44G144Gz44CW44Gp44G044Gh44CS44Gz44Go44CT44Gp44Gi44Ci44GT44KJ
2
=> ぃ〱〳げげょゆ〖ぴむす　っ〓ち〙つ〷ぢす〖どゅすふび〖どぴち〒びと〓どぢ〢こら

1
ぃ〱〳げげょゆ〖ぴむす　っ〓ち〙つ〷ぢす〖どゅすふび〖どぴち〒びと〓どぢ〢こら
2
=> \u3043\u3031\u3033\u3052\u3052\u3087\u3086\u3016\u3074\u3080\u3059\u3000\u3063\u3013\u3061\u3019\u3064\u3037\u3062\u3059\u3016\u3069\u3085\u3059\u3075\u3073\u3016\u3069\u3074\u3061\u3012\u3073\u3068\u3013\u3069\u3062\u3022\u3053\u3089

1
\u3043\u3031\u3033\u3052\u3052\u3087\u3086\u3016\u3074\u3080\u3059\u3000\u3063\u3013\u3061\u3019\u3064\u3037\u3062\u3059\u3016\u3069\u3085\u3059\u3075\u3073\u3016\u3069\u3074\u3061\u3012\u3073\u3068\u3013\u3069\u3062\u3022\u3053\u3089
2
=> 43 31 33 52 52 87 86 16 74 80 59 00 63 13 61 19 64 37 62 59 16 69 85 59 75 73 16 69 74 61 12 73 68 13 69 62 22 53 89

1
79 67 69 88 88 123 122 52 110 116 95 36 99 49 97 55 100 73 98 95 52 105 121 95 111 109 52 105 110 97 48 109 104 49 105 98 58 89 125
2
=> OCEXX{z4nt_$c1a7dIb_4iy_om4ina0mh1ib:Y}

5 collapsed lines
1
ROT0  OCEXX{z4nt_$c1a7dIb_4iy_om4ina0mh1ib:Y}
2
ROT1  PDFYY{a4ou_$d1b7eJc_4jz_pn4job0ni1jc:Z}
3
ROT2  QEGZZ{b4pv_$e1c7fKd_4ka_qo4kpc0oj1kd:A}
4
ROT3  RFHAA{c4qw_$f1d7gLe_4lb_rp4lqd0pk1le:B}
5
ROT4  SGIBB{d4rx_$g1e7hMf_4mc_sq4mre0ql1mf:C}
6
ROT5  THJCC{e4sy_$h1f7iNg_4nd_tr4nsf0rm1ng:D}
20 collapsed lines
7
ROT6  UIKDD{f4tz_$i1g7jOh_4oe_us4otg0sn1oh:E}
8
ROT7  VJLEE{g4ua_$j1h7kPi_4pf_vt4puh0to1pi:F}
9
ROT8  WKMFF{h4vb_$k1i7lQj_4qg_wu4qvi0up1qj:G}
10
ROT9  XLNGG{i4wc_$l1j7mRk_4rh_xv4rwj0vq1rk:H}
11
ROT10  YMOHH{j4xd_$m1k7nSl_4si_yw4sxk0wr1sl:I}
12
ROT11  ZNPII{k4ye_$n1l7oTm_4tj_zx4tyl0xs1tm:J}
13
ROT12  AOQJJ{l4zf_$o1m7pUn_4uk_ay4uzm0yt1un:K}
14
ROT13  BPRKK{m4ag_$p1n7qVo_4vl_bz4van0zu1vo:L}
15
ROT14  CQSLL{n4bh_$q1o7rWp_4wm_ca4wbo0av1wp:M}
16
ROT15  DRTMM{o4ci_$r1p7sXq_4xn_db4xcp0bw1xq:N}
17
ROT16  ESUNN{p4dj_$s1q7tYr_4yo_ec4ydq0cx1yr:O}
18
ROT17  FTVOO{q4ek_$t1r7uZs_4zp_fd4zer0dy1zs:P}
19
ROT18  GUWPP{r4fl_$u1s7vAt_4aq_ge4afs0ez1at:Q}
20
ROT19  HVXQQ{s4gm_$v1t7wBu_4br_hf4bgt0fa1bu:R}
21
ROT20  IWYRR{t4hn_$w1u7xCv_4cs_ig4chu0gb1cv:S}
22
ROT21  JXZSS{u4io_$x1v7yDw_4dt_jh4div0hc1dw:T}
23
ROT22  KYATT{v4jp_$y1w7zEx_4eu_ki4ejw0id1ex:U}
24
ROT23  LZBUU{w4kq_$z1x7aFy_4fv_lj4fkx0je1fy:V}
25
ROT24  MACVV{x4lr_$a1y7bGz_4gw_mk4gly0kf1gz:W}
26
ROT25  NBDWW{y4ms_$b1z7cHa_4hx_nl4hmz0lg1ha:X}