持续更新中~

1
#!/usr/bin/env python3
2
# -*- coding: utf-8 -*-
3

4
from Crypto.Util.number import bytes_to_long
5

6
def encrypt_message(flag: bytes, n: int):
7
    m = bytes_to_long(flag)
8

9
    e1 = 65537
10
    e2 = 17
11

12
    c1 = pow(m, e1, n)
13
    c2 = pow(m, e2, n)
14

15
    return e1, e2, c1, c2

1
n = 78429219359517922271023478963814594552681246043944770910304760471867765174623304038843626799213010074714647155283331308571847776870166597053823412781788611608177305819593874012686298378748721435009046767613360191457980203020570462985478543330425482286818857391023923223033155751757576833456411434713984471383
2
e1 = 65537
3
e2 = 17
4
c1 = 71282312105868131740394478794008286284074152062907735987516077413351604126882776234623911447307962528308126218712123568701353026231889282844009867916343556840839139885445525543186695511199429927944296268193188530317628821728534582820389657490317666947095834711636160892093284048993666399747630728635978820198
5
c2 = 70751964066395185933408819650408191047287659276501425712138199434404000627978244880544478152411510337684996008892030606559772725285766060014956720285732207231186134371296910276169402781919701351782279058927891124229021162906608266092058475936622126108377526917909078829421351716554783863514592590874754685769

1
ZeroG-CTF Crypto 1 - Twin Orbit
2

3
Two orbit modules encrypted the same message with RSA.
4

5
Known:
6
- Same n
7
- Different e
8
- Same plaintext
9

10
Recover the plaintext.
11

12
Flag format:
13
flag{...}

1
from gmpy2 import gcdext
2
from Crypto.Util.number import long_to_bytes
3

4
n = 78429219359517922271023478963814594552681246043944770910304760471867765174623304038843626799213010074714647155283331308571847776870166597053823412781788611608177305819593874012686298378748721435009046767613360191457980203020570462985478543330425482286818857391023923223033155751757576833456411434713984471383
5
e1 = 65537
6
e2 = 17
7
c1 = 71282312105868131740394478794008286284074152062907735987516077413351604126882776234623911447307962528308126218712123568701353026231889282844009867916343556840839139885445525543186695511199429927944296268193188530317628821728534582820389657490317666947095834711636160892093284048993666399747630728635978820198
8
c2 = 70751964066395185933408819650408191047287659276501425712138199434404000627978244880544478152411510337684996008892030606559772725285766060014956720285732207231186134371296910276169402781919701351782279058927891124229021162906608266092058475936622126108377526917909078829421351716554783863514592590874754685769
9
g, s1, s2 = gcdext(e1, e2)
10
m = (pow(c1, s1, n) * pow(c2, s2, n)) % n
11
print(long_to_bytes(m).decode())
12
# flag{ZeroG_common_modulus_attack}

1
#!/usr/bin/env python3
2
# -*- coding: utf-8 -*-
3

4
class LunarLCG:
5
    def __init__(self, m, a, c, state):
6
        self.m = m
7
        self.a = a
8
        self.c = c
9
        self.state = state
10

11
    def next_state(self):
12
        self.state = (self.a * self.state + self.c) % self.m
13
        return self.state
14

15
    def next_byte(self):
16
        """
17
        The relay station uses the lowest 8 bits of each new state
18
        as one byte of keystream.
19
        """
20
        return self.next_state() & 0xff
21

22
def xor_encrypt(data: bytes, prng: LunarLCG) -> bytes:
23
    out = bytearray()
24

25
    for b in data:
26
        k = prng.next_byte()
27
        out.append(b ^ k)
28

29
    return bytes(out)

1
m = 170141183460469231731687303715884105727
2
leak_states = [
3
    48077378362307815584689819960136019875,
4
    100310108693164117002347749113390493183,
5
    145646689101109657050476193569066602802,
6
    63949818470656288394594660187785964270,
7
    46314465195318558087862397882705709486,
8
    103138436636073932218183299598776830813,
9
]
10
ciphertext = 39fe07de62fdc9bf74bbbcbd7e202386ca9e40451b46c74968e30fff138a95

1
ZeroG-CTF Crypto 2 - Lunar LCG
2

3
The lunar relay station uses a Linear Congruential Generator to build a byte-wise XOR keystream.
4

5
Some consecutive PRNG states were leaked before encryption.
6

7
Recover the flag.
8

9
Flag format:
10
flag{...}

1
m = 170141183460469231731687303715884105727
2
leak_states = [
3
    48077378362307815584689819960136019875,
4
    100310108693164117002347749113390493183,
5
    145646689101109657050476193569066602802,
6
    63949818470656288394594660187785964270,
7
    46314465195318558087862397882705709486,
8
    103138436636073932218183299598776830813,
9
]
10
ciphertext = bytes.fromhex("39fe07de62fdc9bf74bbbcbd7e202386ca9e40451b46c74968e30fff138a95")
11

12
# 计算差值模m
13
d0 = (leak_states[1] - leak_states[0]) % m
14
d1 = (leak_states[2] - leak_states[1]) % m
15
# 求逆
16
inv_d0 = pow(d0, -1, m)
17
a = (d1 * inv_d0) % m
18
c = (leak_states[1] - a * leak_states[0]) % m
19
print(f"a = {a}")
20
print(f"c = {c}")
21
# 验证
22
for i in range(1, 6):
23
    assert (a * leak_states[i-1] + c) % m == leak_states[i]
24
# 生成后续状态
25
state = leak_states[-1]
26
keystream = []
27
for i in range(32):
28
    state = (a * state + c) % m
29
    keystream.append(state & 0xff)
30
plain = bytes([c ^ k for c, k in zip(ciphertext, keystream)])
31
print(plain.decode())
32
# a = 47706504925832043350690201375217556277
33
# c = 106332766362414553063251587032479728762
34
# flag{ZeroG_lcg_stream_recovery}

1
#!/usr/bin/env python3
2
# -*- coding: utf-8 -*-
3

4
from Crypto.Util.number import bytes_to_long
5

6
def encrypt(flag: bytes, public_keys):
7
    """
8
    public_keys:
9
        [
10
            (n1, e),
11
            (n2, e),
12
            (n3, e),
13
        ]
14

15
    Warning:
16
        This demo intentionally uses raw RSA without padding.
17
    """
18
    m = bytes_to_long(flag)
19

20
    result = []
21

22
    for n, e in public_keys:
23
        c = pow(m, e, n)
24
        result.append((n, e, c))
25

26
    return result

1
e = 3
2

3
n1 = 9203118261705868019110006623273896134322296004495934622126321588206198211590594608536574205500841860912183113474492528101942483463604127057100041845594123
4
c1 = 225326225723570437926892098700724301640108952320044616725184090895511961737080288471190011942447422341235122945729017303171992927231675218640713872178033
5

6
n2 = 8218974785294030613346971087108222043759818458429043768635262660088269400867661193359046399568686339887944628791712180696779799918022646158973494803220299
7
c2 = 3407676048044393024576659577470571794093695115844258472643168272782162860244002027327745232045383478691907846926814490953793141526176684717238078901972654
8

9
n3 = 8640442409248695297781745462901828098989267118787634310572918885729221856234292677073935037333836295724444289085611427540896246989248186559475612627680863
10
c3 = 6492260343134932927953198433174002823828534869771319070490239692685600132982822403083735209163800494671140850876058194194328293660168048521787716473266503

1
ZeroG-CTF Crypto 3 - Phobos Padding
2

3
The same core command was broadcast to three RSA receivers.
4

5
Known:
6
- e = 3
7
- different n
8
- same plaintext
9
- no padding
10

11
Recover the flag.
12

13
Flag format:
14
flag{...}

1
from Crypto.Util.number import long_to_bytes
2
from gmpy2 import iroot
3
from sympy.ntheory.residue_ntheory import crt
4

5
e = 3
6
n1 = 9203118261705868019110006623273896134322296004495934622126321588206198211590594608536574205500841860912183113474492528101942483463604127057100041845594123
7
c1 = 225326225723570437926892098700724301640108952320044616725184090895511961737080288471190011942447422341235122945729017303171992927231675218640713872178033
8
n2 = 8218974785294030613346971087108222043759818458429043768635262660088269400867661193359046399568686339887944628791712180696779799918022646158973494803220299
9
c2 = 3407676048044393024576659577470571794093695115844258472643168272782162860244002027327745232045383478691907846926814490953793141526176684717238078901972654
10
n3 = 8640442409248695297781745462901828098989267118787634310572918885729221856234292677073935037333836295724444289085611427540896246989248186559475612627680863
11
c3 = 6492260343134932927953198433174002823828534869771319070490239692685600132982822403083735209163800494671140850876058194194328293660168048521787716473266503
12
m3 = crt([n1, n2, n3], [c1, c2, c3])[0]
13
m = iroot(m3, e)[0]
14
print(long_to_bytes(m).decode())
15
# flag{ZeroG_hastad_broadcast_attack}