题面：#

from Crypto.Util.number import getPrime, bytes_to_long
from random import randint
import os

FLAG = os.getenv("FLAG").encode()
flag1 = FLAG[:15]
flag2 = FLAG[15:]

def crypto1():
    p = getPrime(1024)
    q = getPrime(1024)
    n = p * q
    e = 0x10001
    x1=randint(0,2**11)
    y1=randint(0,2**114)
    x2=randint(0,2**11)
    y2=randint(0,2**514)
    hint1=x1*p+y1*q-0x114
    hint2=x2*p+y2*q-0x514
    c = pow(bytes_to_long(flag1), e, n)
    print(n)
    print(c)
    print(hint1)
    print(hint2)


def crypto2():
    p = getPrime(1024)
    q = getPrime(1024)
    n = p * q
    e = 0x10001
    hint = pow(514*p - 114*q, n - p - q, n)
    c = pow(bytes_to_long(flag2),e,n)
    print(n)
    print(c)
    print(hint)
print("==================================================================")
crypto1()
print("==================================================================")
crypto2()
print("==================================================================")

分析：#

题解：#

from Crypto.Util.number import *
from gmpy2 import invert
from sympy import symbols,solve
from itertools import product
from math import gcd

n = 26431208729444714023658171519567999611655156163666012461049377852754522364967983334888008719169005067132147457768145650432224601627572396711625740992434441502981404085906974043449692385194523725663285381805341752664655843649525267244306284262782760081144936989568445791452171942309762572110024693191466625296798707442953800544083663459059607487968090942333009755531218995107857576848493115570943076327104093937764106177027114753702492658138243770682404261523142313860233316535573423753816665712808112231455199413993508133831121471131906694009124041404243156970894355864766787488671710960092926014349891982419011949171
c = 24515238681833205058342606937833381623401245973168414853552637114967604304443295650716165826636269802104285585640785686262729645662905133105311101575743339728027740930198498392537921389394080685434963506716037135352849525789611087440143854066880720394035373451872403694792246563655156782022724836500224286369632521434968249788657352092826521450427795603602500323214480586810427570710369585376924983594043248745989472914214103122255392581242195061296966498148760190374756531179592246985996456594796901388558130935937584350155732932245278425238100668963908762448069803640676369050750711244794874869155287504403144983084
h1 = 2064120122486440703610541536570451884663780216683065730451818597055621226031049075464398251942835554536690853529198524753557660960594411178812768720190155976723066113826153103576041405021206449486249562762593250513782438363830385600090683687760866931577267493622854286079464141370933615968731326955680488344822733325742351465125946700985576519
h2 = 2935698460648172088063031410750512508234908976540687720254424133725835569164297032235762632619856285739290168966048772112064235471499992380139042298936926206905432523718824033938889756149990133197711316969898581370101026667914673283950069188676249801734232382073910838997288966102918790204590242077807341645627422986361111366813082512392024620482091820573855446248318944454642989583450100570999255020573141528738185667463913084742564103197376665933282101287161274

for a, b in product(range(2**12), repeat=2):
    q = gcd(a * (h1+0x114) - b * (h2+0x514), n)
    if q != 1 and q < n:
        break

p = n // q
e = 0x10001
d = invert(e, (p-1)*(q-1))
m = pow(c, d, n)

flag1 = long_to_bytes(m)

n = 22609502097790234125054452787465543003647975511286840768095519946651235118302804436788755412589909626630822145015825153818779779406749336821713379108753050305179390093992333638236889201725893091374485649096766519789288950500200124189067656148700692399356901167146079967302004119252705512230526542099543413171942892112669026043001010017788228299811485314813319990227836194271303053376683758456535811698702038204149156337167048777194593272366445920406472017012914585645482400546617935822140434931173826866414324753906604262460223764100204237134789955255188106972496113478446427586130414140010823891272297003194926230023
c = 11599167986640895898781971259081838478524805543534436356054053614288967740440439361412680894217412846279034763231201956049305130725083515069792707920325789590198230645640731674949349040881104339923854646475865931356220992256393916882975836109215524206787560218489872579272148059406709057819992106787893281165549258146984026281104140400064989463689031911589624412291434825131580945272270843483732459446239491502847830350348745117392825584823793179119646757780211829113540370632558380288667034742149996713717201156473783389810018832390320177801407677970433685648156375816420344601563935714086163474936282133816876218251
hint = 1801425683678256606736404706447142164110264221348335073457890665037517041006658717190218795103561882775943412524505051746427315467091725945198550139035086086528039220163979654809744394104028007130486086748767327965439536725142791444317255854784220030075101640255172837483479293192967227954809841132893568187834401490795446371023027485194836171461214656614519811563111503945847345035068021888333767209423865470845356512967566901488058778855984568194053176100466569889237262126196055681993939938349250044641142168939615976989387885567607621744997101058855951708381880183650217398458332988742908791818405712081953286265
e = 65537

val = invert(hint,n)

p = symbols('p')
ans = solve([514*p**2-114*n-val*p],p)

p = 150247279952912796628319439167087598658960209857939715481384766412377887286917020812600778554628283790584194733223642988071731185823236097710318351169230270503948468805605661101833776560552877189520975508661723196203726478092488148840301081427770623476948137746893798233610291628878063995483607207704552192627

d = invert(e,p-1)
m = pow(c,d,p)

flag2 = long_to_bytes(m)

print(flag1+flag2)

题面：#

分析：#

题解：#

from Crypto.Util.number import *

h0 = 0x6c62272e07bb014262b821756295c58d
x = 0x0000000001000000000000000000013b
c = 201431453607244229943761366749810895688
MOD = 2^128
n = 16

M = matrix(ZZ,n+2,n+2)

for i in range(n):
    M[i,i] = 1
    M[i,-1] = x^i

M[-2,-1] = x^16*h0 - c
M[-2,-2] = 1
M[-1,-1] = MOD
Q = Matrix.diagonal([2^4]*n+[2^8]+[2^20])
M *= Q
M = M.LLL()
M /= Q

for r in M:
    if r[-1] == 0 and abs(r[-2]) == 1:
        r *= (r[-2]//1)
        good = r[:-2]
        res = []
        t = x*h0
        h1 = (x*h0 + good[-1]) % MOD
        for i in range(n):
            for j in range(256):
                h1_ = (t ^^ j) % MOD
                if h1_ == h1:
                    print('good',i,j)
                    res.append(j)
                    if i < n-1:
                        h1 = (x*h1 + good[n-i-2]) % MOD
                        t = (t ^^ j)*x % MOD
                    break
        print(bytes(res).hex())

原题题解 修改(DownUnderCTF2023 fnv)：#

TARGET = 201431453607244229943761366749810895688
h0 = 0x6c62272e07bb014262b821756295c58d
p = 0x0000000001000000000000000000013b
MOD = 2**128

n = 16
M = Matrix.column([p^(n - i - 1) for i in range(n)] + [-(TARGET - h0*p^n), MOD])
M = M.augment(identity_matrix(n+1).stack(vector([0] * (n+1))))
Q = Matrix.diagonal([2^128] + [2^4] * n + [2^8])
M *= Q
M = M.BKZ()
M /= Q
for r in M:
    if r[0] == 0 and abs(r[-1]) == 1:
        r *= r[-1]
        good = r[1:-1]
        print(good)
        break
inp = []
y = int(h0*p)
t = (h0*p^n + good[0] * p^(n-1)) % MOD
for i in range(n):
    for x in range(256):
        y_ = (int(y) ^^ int(x)) * p^(n-i-1) % MOD
        if y_ == t:
            print('good', i, x)
            inp.append(x)
            if i < n-1:
                t = (t + good[i+1] * p^(n-i-2)) % MOD
                y = ((int(y) ^^ int(x)) * p) % MOD
            break
    else:
        print('bad', i)
print(bytes(inp).hex())