1.AGCD

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
*from* Crypto.Util.number *import* getPrime, getRandomRange
*from* Crypto.Util.number *import* *
*from* gmpy2 *import* *
*import* random
*from* secret *import* flag, hint

def rsa_hint(hint):
    p1 = getPrime(1024)
    q1 = getPrime(1024)
    n1 = p1 * q1
    e1 = 0x10001
    a = (p >> 256) << 256
    c1 = powmod(bytes_to_long(hint), e1, n1)
    print('a =', hex(a))
    print('n1 =', hex(n1))
    print('c1 =', hex(c1))

rsa_hint(hint)
*# a = 0xfff76060a8c9b10fca9aed3e1a9e3392603333048f89b457fe401f9f8f31cd7957f0712395ec8a43bdf854f5e3d4ff731d108982189e58d0438dea6a4a222665b34986d541bd7bebd71b133baabb5ffd74b46be3490704ecab510ebd3cc1dafd0000000000000000000000000000000000000000000000000000000000000000*
*# n1 = 0x8852c740a92c3b3ecba16b19a01fd5e0a7d5c16bf6b9c3659df09eb206d9c99457b05829af505e525d09af62dd09f44f2b0fcf3520d04134203a60fb16317656205101fc76e9050cf796874f1f055be28be4e5390062c13952d1c4f81c43ffb5bfc5b3547b417f444e3ea7c7a8d961f12d184fdebe462fd427fa1d237e1774638622a21a1b04d88b712d634aa5f46f91e35cfb19263a6ff0d1e33fa8d28d84645afef9e86022d08daca399f6302b9960e26d0576f962c39990b1e85e076d51ae0b1ce5236548a12cd32701a227ac12e41f02f232d759dc349a13b81583a1b7c59864767b5fcf7b5ebcb453e9b4fcf39fa4f9bffdacbceae7ae56733906268617*
*# c1 = 0x3c990a9cea31b447307371a7483d4d5efcc2eef47f98a0c76694e715dde5675d610c077bb67a680c4264cf8791d0292d8d24ae6420428c450cda8c0fa38b9d8c882f81a7ed97cbebdf7e017a33264879828c0c7b0fd9690f2c44b90fb4ee8f041961aee831bcd7e9ead6f8c3ad1134e4eb7de476fef975fdd363b8e8637ab6cb01f67c98d71caadceeb01d21197ddbf695ded98204e37139935e7935be3ce5521ca1015e9c853af07770ddd1a528a977bfc658dc0739fae67fcbf5e115d40f5c6f578ac8860aa24a3e25b6afa6c81d3a8a30f2a22981d2cc635e7613aa7c45605a4f671982b0c1265fcf7d3f6596312017567197d2a14cb2c94351232beaf29f*

def gen(k:int, gamma: int, eta: int, rho: int):
    xs = []
    qs = []
    es = []
    p = getPrime(eta)
    *for* _ *in* range(k):
        q = getPrime(gamma - eta)
        e = getRandomRange(-pow(2, rho) + 1, pow(2, rho) - 1)
        qs.append(q)
        es.append(e)
        xs.append(p * q + e)
    *return* p, qs, es, xs

k = 5
eta = *?*
gamma = *?*
rho = *?*
p2, qs, es, xs = gen(k, gamma, eta, rho)
*# print(f'{p = }')*
*# print(f'{qs = }')*
*# print(f'{es = }')*
print(f'{xs = }')

flag = b'HnuCTF{***********}'
q2 = next_prime(p)
e2 = 65537
n2 = p2*q2
m = bytes_to_long(flag)
c2 = pow(m, e2, n2)
print(f'{c2 = }')

*# xs = [189804273939737041455946567797138859500874671673522203778643036413257334173619052212861256074594960245405116918240807190679485466188554190974613087115383313518069520319310473994834723374923639371237172101281964999472816045870426466717957940045304999403615464038403622335878856256857829303665852425080186733926994157428496185464219881618664271927195354781549040384368359871305723744999806604495817910520288452485982004773690030411128873643858916970523855682318385155539924071598263776351895693989126238943691706958754043895140183588011490788, 207795535036139450683337601521444908092321077358599578713510594973555600288921220836400288210399708943771328683313978626884663302422867276948812380092703087095904477872201607460660869788606827673885581478471749839446518087424779707716146013352036376036061397553177912867574728081318296281650519495894600717103013941458641486341033880434368705188495404480914691179354080549631550248484542755769593408142210632295161131086448945062335239549044237003515509110529341237051500025091738258178215739953457960343793787578285357877388739014187525156, 189994185352590774529630932214626871252311305961563048124585934081889180043636573953252521859059047265525413059491458326536135060592734422300398219109329995083966156755825670985443013477984362644391040154155701042429677182487160501718869822484074939059782570937089212821785166514716094087765236027402227284151445399116993490289058272677793680434641798502115562583245579703938633856557914788707919539228886666581293163243921525579086420430011533790845736668648333778396968655184758570691028026018115693112927777939357403411228181927154909674, 186066040429514356852138849432589755738910407973256512014732383994492048566702414217760781983462701499627622297673661542159281056279362950680849357179177043218152245369150515895365498644655764692571625852292599849294151593392466547849601364623366043842953781913786379266637168931136081473367449901546868891940222862562830590640018323474739117402615048735551828249914303898352928196413396064079643930500215836927678757495202976353370382886583808520343648766860557572504858201505688093141714242763172179569820220732609801143878277757665599495, 246017794731075374891144210063957255988869789152812791813203594187846399586405743678836685907732615737692868761922077875079527467495495276500651238120932092619906704908906270231729068331746935296602868561233942208137753536198396337871408071883396111367168846514128494263826348029400206221668683987968596185380522290948797201140644802724489837786765192374896673885276022647319989455868539336565456933152935818927423747249413501727216325760582311346324583041697673458566892000265789412047140097974776661189932562559588720251210518137647513833]*
*# c2 = 1504472429165976670565861345337195824368586614074086064745200965862948310137626585623292312738519269047532673969523414363447025385966302553616596157837747734155676087028338134508252453284213685859550079106484951692107187903752562259662783400560771080807536791562057059712925869400898111952261858184813049125471363341110647697915761143880745542873825897596263081622423605791216878625527481417345638037624865888004131705969551569745726379292898710025437900298567730*

（1）解答

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49

*from* Crypto.Util.number *import* *
*from* gmpy2 *import* *

n1 = 0x8852c740a92c3b3ecba16b19a01fd5e0a7d5c16bf6b9c3659df09eb206d9c99457b05829af505e525d09af62dd09f44f2b0fcf3520d04134203a60fb16317656205101fc76e9050cf796874f1f055be28be4e5390062c13952d1c4f81c43ffb5bfc5b3547b417f444e3ea7c7a8d961f12d184fdebe462fd427fa1d237e1774638622a21a1b04d88b712d634aa5f46f91e35cfb19263a6ff0d1e33fa8d28d84645afef9e86022d08daca399f6302b9960e26d0576f962c39990b1e85e076d51ae0b1ce5236548a12cd32701a227ac12e41f02f232d759dc349a13b81583a1b7c59864767b5fcf7b5ebcb453e9b4fcf39fa4f9bffdacbceae7ae56733906268617
a = 0xfff76060a8c9b10fca9aed3e1a9e3392603333048f89b457fe401f9f8f31cd7957f0712395ec8a43bdf854f5e3d4ff731d108982189e58d0438dea6a4a222665b34986d541bd7bebd71b133baabb5ffd74b46be3490704ecab510ebd3cc1dafd0000000000000000000000000000000000000000000000000000000000000000
c1 = 0x3c990a9cea31b447307371a7483d4d5efcc2eef47f98a0c76694e715dde5675d610c077bb67a680c4264cf8791d0292d8d24ae6420428c450cda8c0fa38b9d8c882f81a7ed97cbebdf7e017a33264879828c0c7b0fd9690f2c44b90fb4ee8f041961aee831bcd7e9ead6f8c3ad1134e4eb7de476fef975fdd363b8e8637ab6cb01f67c98d71caadceeb01d21197ddbf695ded98204e37139935e7935be3ce5521ca1015e9c853af07770ddd1a528a977bfc658dc0739fae67fcbf5e115d40f5c6f578ac8860aa24a3e25b6afa6c81d3a8a30f2a22981d2cc635e7613aa7c45605a4f671982b0c1265fcf7d3f6596312017567197d2a14cb2c94351232beaf29f
e1 = 0x10001
Pr.<x>=PolynomialRing(Zmod(n1))
f =x+a
roots=f.small_roots(X=2^256, beta=0.5, epsilon=0.05)
x=roots[0]
p1=a+int(x)
q1=n1 // p1
phi1=(p1-1)*(q1-1)
d1=inverse(e1, phi1)
m1=pow(c1, d1, n1)
hint=long_to_bytes(m1)
print("Hint:", hint)
*#Ohhhh~You get hint!!!Keep in mind~[eta = 769, gamma = 1024 + eta, rho = 257]*
e2=65537
xs = [189804273939737041455946567797138859500874671673522203778643036413257334173619052212861256074594960245405116918240807190679485466188554190974613087115383313518069520319310473994834723374923639371237172101281964999472816045870426466717957940045304999403615464038403622335878856256857829303665852425080186733926994157428496185464219881618664271927195354781549040384368359871305723744999806604495817910520288452485982004773690030411128873643858916970523855682318385155539924071598263776351895693989126238943691706958754043895140183588011490788, 207795535036139450683337601521444908092321077358599578713510594973555600288921220836400288210399708943771328683313978626884663302422867276948812380092703087095904477872201607460660869788606827673885581478471749839446518087424779707716146013352036376036061397553177912867574728081318296281650519495894600717103013941458641486341033880434368705188495404480914691179354080549631550248484542755769593408142210632295161131086448945062335239549044237003515509110529341237051500025091738258178215739953457960343793787578285357877388739014187525156, 189994185352590774529630932214626871252311305961563048124585934081889180043636573953252521859059047265525413059491458326536135060592734422300398219109329995083966156755825670985443013477984362644391040154155701042429677182487160501718869822484074939059782570937089212821785166514716094087765236027402227284151445399116993490289058272677793680434641798502115562583245579703938633856557914788707919539228886666581293163243921525579086420430011533790845736668648333778396968655184758570691028026018115693112927777939357403411228181927154909674, 186066040429514356852138849432589755738910407973256512014732383994492048566702414217760781983462701499627622297673661542159281056279362950680849357179177043218152245369150515895365498644655764692571625852292599849294151593392466547849601364623366043842953781913786379266637168931136081473367449901546868891940222862562830590640018323474739117402615048735551828249914303898352928196413396064079643930500215836927678757495202976353370382886583808520343648766860557572504858201505688093141714242763172179569820220732609801143878277757665599495, 246017794731075374891144210063957255988869789152812791813203594187846399586405743678836685907732615737692868761922077875079527467495495276500651238120932092619906704908906270231729068331746935296602868561233942208137753536198396337871408071883396111367168846514128494263826348029400206221668683987968596185380522290948797201140644802724489837786765192374896673885276022647319989455868539336565456933152935818927423747249413501727216325760582311346324583041697673458566892000265789412047140097974776661189932562559588720251210518137647513833]
c2 = 1504472429165976670565861345337195824368586614074086064745200965862948310137626585623292312738519269047532673969523414363447025385966302553616596157837747734155676087028338134508252453284213685859550079106484951692107187903752562259662783400560771080807536791562057059712925869400898111952261858184813049125471363341110647697915761143880745542873825897596263081622423605791216878625527481417345638037624865888004131705969551569745726379292898710025437900298567730
k=5
rho=257
x0,x1,x2,x3,x4=xs
A=2**rho
M = matrix(ZZ,[
    [A,x1,x2,x3,x4],
    [0,-x0,0,0,0],
    [0,0,-x0,0,0],
    [0,0,0,-x0,0],
    [0,0,0,0,-x0]
])
L=M.LLL()
q0=ZZ(L[0, 0]/A).abs()
e0=ZZ(x0 % q0)
p2= ZZ((x0-e0)/q0)
print("p2=", p2)
q2=gmpy2.next_prime(p2)
phi2=(p2-1)*(q2-1)
n2=p2*q2
d2=gmpy2.invert(e2,phi2)
m=pow(c2,d2,n2)
flag=long_to_bytes(m)
print(flag)

*#p2= 1554372551401070891899047564767289086291608112828119446026239497605144516754928605016577531617775558399943302774343450624624238669916206057901180124111705842887191703227702088346036473241653700913869838740153597060761914419375387683*
*#b'HnuCTF{0hh_y0u_r3a11y_kn0w_th3_agcd}'*

（2）思路

hint:已知p的高位，用coppersmith求到低位然后RSA解密得到hint

$flag:由题意得：x_i=p*q_i+e_i$

$则x_0q_1-q_0x_1=(e_0+pq_0)q_1-(e_1+pq_1)q_0=e_0q_1-e_1q_0$

构造：

$\begin{pmatrix}
q_0&q_1&…&q_4
\end{pmatrix}
\begin{pmatrix}
2^k&x_1&x_2&x_3&x_4\
&-x_0&&&\
&&-x_0&&\
&&&-x_0&\
&&&&-x_0
\end{pmatrix}

\begin{pmatrix}
q_02^k&q_0e_1-q_1e_0&…&q_0e_4-q_4e_0
\end{pmatrix}$

$为了使q_02^k和后面的一堆处于同一量级，取k=rho$

$得到的短向量取第一个除以2^k，得到q_0从而得到p，RSA解密即可$

2.CTR

1
2
3
4
5
6
7
8
9
10
11
*from* Crypto.Util.Padding *import* pad
*from* Crypto.Cipher *import* AES
*# from secret import flag*
flag = 'HnuCTF{*****************}'

*assert* len(flag)==35
key, iv = flag[:16].encode(), b"HnuCTF2026"
print("c =", AES.new(key=key,nonce=iv,mode=AES.MODE_CTR).encrypt(pad(flag.encode(),16)) + AES.new(key=key,nonce=iv,mode=AES.MODE_CTR).encrypt(b"".join([pad(i.encode(),16) *for* i *in* flag])))

*# c = b'~k\xc3&\xd2\xf8\x12\xef\x99\xec\xb8\xf9\xe7\'EpeA$?\xd0\x0ct\xb5d~\xeb\xe2B\xc1\xef\xa2\xc8/hO\xc5\x16\x9d\xe3_!\xcd\xcc\x9d\xc5\x92\xee~\n\xb9j\x89\xb1f\xae\xa6\x94\xe8\x8f\xd8}\x15\x14e!\\o\x973\x0c\xe5\x1fA\xbb\xb8x\xab\xbf\xf5\xf2r\x1aM\xc7\x14\x9f\xe1]#\xcf\xce\x9f\xc7\x90\xec\x01\x0e/H@\x83\x8eJ})#\xaf\xc4\x00\xb8\x02\x05\x9b\xa0`In\x9e*\n\xba\xcc(\xc1\xc4\xees\x98\xbe+\xde\xdb\xe5\xb4\xd4\x82\xfb\xf2_<\x8c!\x80\x88\x8bC\xc3\x1e\xa6\x9b\x85\xa5ME\xfe\x01\x05`[\x8f;\'\x9e\x92\x80\xd0\x08\x90\xcb\x98\xab\x83\xbd\xe1\xc7\x19\xe3\t-\xb9\xc3\x9a%\x1f\xef\xa56\xf2\x1e<\x80CM\x9a\x01\xcdz93\xd1\x06x\x17\xc4\xfa\xb1\xa1\n\xd7\xca2\x07Et\xc9\r\xb0\xe9\x9d\xba\x98\x96\xa5V\x9a<4\x8dUNu\xa4\xa3/njHj\xfdE\x1f\x92\xd3\x1d\xd4<\x8c\xd7\xb9aG\xd4p\xaa\x1b=\x80\x88d.\x01z7\x05\x12\xed\xc6\xfb\x8a\x12"X\xc2\x07\xda\xd0 \xf6H\x8b\xae\x17w\x17Tw\xbfj\xea0\xc2\xbf\x1b\x80\x8aZ\xad\xdc\xfaF\x9f~\xe4\\\x03\xb43\x02\xb76]~3rC\xd2X\x16\xd4b\xca;\xb9\xccL\xb5\xfe\xd8K\x8d\x8a]\xb1\xfb}\xe7\xf3\x92\x97\xe8\xf2\xe6\x85\xcd9\xee\xd7\xd4\xf5v\x99\xd0k\xc6\xbeWe\x03\x8f\x8b\xf1Am\x8e\x10\x8c\x0eH\xd1\x88\x01\xf4\xc1\xb8\xa9\x7f"\x07)\x06\x93\xa4y\xf3\xf8\xef\xce\xd8L\x91\x81q<\xbeu\x18:\xad\xe98\xc6\xc0\n\x96\xd2&\xea/X\xbcT\xeeg\x96\xc7\xcc\xa0g\x0b\x01\xd6|-x5B\xe12C\x1f:\xd9\xea\x15\xa3\x05)\xea\xe9\x1bJF\xc0L]\xdf3*\xdf.\xbc\x8d$\x80!sr\xce[\xaa\xc1\x0e]^<r\x04\xc4\\M.\xdc\xc0a\x1f1\x15\x02vt\xf3\xd90\x16\x9e\xe3\xaa\x1e\xe46$\xdf\xae4\x15{\xf0\xab\xe5)6Rb\xcb\xb0\xd7KC1\x8d\x12\xfc\xcb\x95\x0c\xd2j"\xce\x95a\xe6\xe7\xac\xa1\xd1r\xc4\xcdXmh\xb1;Q\x8c\x0188\xb3{}\x08}\x9f\xedM+\x8b0\xe6o\xeb\xb7\xed\xd2o\xfdc\xbf\x85G\x85E\xce\n\xaf4\xb3\xdd\x7f\x98\x7f\xf2*\xb1\x95\x99\xd4\xe1pAS\xd2e\x88\xb27\x0f\xa1\xbc\xc9\x1b\xcc\xab^\x9d\xae\xef&\x0c\xd6\x12\xa4D7\''*

（1）解答

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
*from* Crypto.Cipher *import* AES
*from* Crypto.Util.number *import* *
*from* Crypto.Util.Padding *import* pad

c = b'~k\xc3&\xd2\xf8\x12\xef\x99\xec\xb8\xf9\xe7\'EpeA$?\xd0\x0ct\xb5d~\xeb\xe2B\xc1\xef\xa2\xc8/hO\xc5\x16\x9d\xe3_!\xcd\xcc\x9d\xc5\x92\xee~\n\xb9j\x89\xb1f\xae\xa6\x94\xe8\x8f\xd8}\x15\x14e!\\o\x973\x0c\xe5\x1fA\xbb\xb8x\xab\xbf\xf5\xf2r\x1aM\xc7\x14\x9f\xe1]#\xcf\xce\x9f\xc7\x90\xec\x01\x0e/H@\x83\x8eJ})#\xaf\xc4\x00\xb8\x02\x05\x9b\xa0`In\x9e*\n\xba\xcc(\xc1\xc4\xees\x98\xbe+\xde\xdb\xe5\xb4\xd4\x82\xfb\xf2_<\x8c!\x80\x88\x8bC\xc3\x1e\xa6\x9b\x85\xa5ME\xfe\x01\x05`[\x8f;\'\x9e\x92\x80\xd0\x08\x90\xcb\x98\xab\x83\xbd\xe1\xc7\x19\xe3\t-\xb9\xc3\x9a%\x1f\xef\xa56\xf2\x1e<\x80CM\x9a\x01\xcdz93\xd1\x06x\x17\xc4\xfa\xb1\xa1\n\xd7\xca2\x07Et\xc9\r\xb0\xe9\x9d\xba\x98\x96\xa5V\x9a<4\x8dUNu\xa4\xa3/njHj\xfdE\x1f\x92\xd3\x1d\xd4<\x8c\xd7\xb9aG\xd4p\xaa\x1b=\x80\x88d.\x01z7\x05\x12\xed\xc6\xfb\x8a\x12"X\xc2\x07\xda\xd0 \xf6H\x8b\xae\x17w\x17Tw\xbfj\xea0\xc2\xbf\x1b\x80\x8aZ\xad\xdc\xfaF\x9f~\xe4\\\x03\xb43\x02\xb76]~3rC\xd2X\x16\xd4b\xca;\xb9\xccL\xb5\xfe\xd8K\x8d\x8a]\xb1\xfb}\xe7\xf3\x92\x97\xe8\xf2\xe6\x85\xcd9\xee\xd7\xd4\xf5v\x99\xd0k\xc6\xbeWe\x03\x8f\x8b\xf1Am\x8e\x10\x8c\x0eH\xd1\x88\x01\xf4\xc1\xb8\xa9\x7f"\x07)\x06\x93\xa4y\xf3\xf8\xef\xce\xd8L\x91\x81q<\xbeu\x18:\xad\xe98\xc6\xc0\n\x96\xd2&\xea/X\xbcT\xeeg\x96\xc7\xcc\xa0g\x0b\x01\xd6|-x5B\xe12C\x1f:\xd9\xea\x15\xa3\x05)\xea\xe9\x1bJF\xc0L]\xdf3*\xdf.\xbc\x8d$\x80!sr\xce[\xaa\xc1\x0e]^<r\x04\xc4\\M.\xdc\xc0a\x1f1\x15\x02vt\xf3\xd90\x16\x9e\xe3\xaa\x1e\xe46$\xdf\xae4\x15{\xf0\xab\xe5)6Rb\xcb\xb0\xd7KC1\x8d\x12\xfc\xcb\x95\x0c\xd2j"\xce\x95a\xe6\xe7\xac\xa1\xd1r\xc4\xcdXmh\xb1;Q\x8c\x0188\xb3{}\x08}\x9f\xedM+\x8b0\xe6o\xeb\xb7\xed\xd2o\xfdc\xbf\x85G\x85E\xce\n\xaf4\xb3\xdd\x7f\x98\x7f\xf2*\xb1\x95\x99\xd4\xe1pAS\xd2e\x88\xb27\x0f\xa1\xbc\xc9\x1b\xcc\xab^\x9d\xae\xef&\x0c\xd6\x12\xa4D7\''

C1=c[:48]
C2=c[48:]
C11=[C1[i:i+16] *for* i *in* range(0,48,16)]
c22=[C2[i:i+16] *for* i *in* range(0,560,16)]

D=[]
*for* i *in* range(3):
    d=bytes([a ^ b *for* a,b *in* zip(C11[i], c22[i])])
    D.append(d)

flag = [0]*35

*for* j *in* range(1,16):
    flag[j]=D[0][j] ^ 15
flag[16]=D[1][0] ^ flag[1]
*for* j *in* range(1,16):
    flag[16+j]=D[1][j] ^ 15

flag[32]=D[2][0] ^ flag[2]
flag[33]=D[2][1] ^ 15
flag[34]=D[2][2] ^ 15
flag[0]=ord('H')

flag= bytes(flag)
print(flag)
b'HnuCTF{N0w_y0U_know_H0w_t0_U5e_XOR}'

（2）思路

这道题进行了两次加密

先讲密文分为前48字节和后560字节，再对c1、c2分块处理，对应块进行异或得到D，最后恢复flag。需要注意是flag[0]无法恢复，但已知HnuCTF{}

3.Coppersmith

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
*from* secret *import* flag
*from* Crypto.Util.number *import* getPrime, bytes_to_long

m = bytes_to_long(flag)
p = getPrime(1024)
q = getPrime(1024)
n = p * q
e = 65537
c = pow(m, e, n)
ph = p >> 576
gift = (p % (2 ** 570)) % bytes_to_long(b'Welcome to HnuCTF2026')
print(f"{n = }")
print(f"{e = }")
print(f"{c = }")
print(f"{ph = }")
print(f"{gift = }")
*# n = 10009214721542670987254806153023821182945033678188723335579922208632323519726893772683575840208229246338773616380918139271794909264883764782760062336325158749526519888672475910036320954595528042993706096117856145863458412416941500458916006990105265631815741609517077178024592899268269925519316305062299747301038628357077626110475521758024178893315228753456120687071225793717567214350176025106940038633096190183161065065254951643903808674479529578020029220067096019447701862479770407096060180542387810158195063157852572267323502475445823159362276741192420297487358458567263901345568691982465836770183403813725529367141*
*# e = 65537*
*# c = 6543865653394441573590164022104824069940017606301093270422647941502504776088507426547758878885306137148149044204970853111688680010157321400854638053279418106422220624349345925194182324530024651314146701277003830814853454161700307862082683361797218877797380415918471753210899751957954672400283787200170072220155681807691826664118264219780963132859446534649732197318583971734931081272022182840967091600898693467855767463768967142944310189136825082214478097611648520971408784754073647871666701439428432181420708925630373790765352200772285924954094125370268330871100549104656007398077011988977301245011329237988225610363*
*# ph = 426189912875926034808271470450071475904716064533992324396652808596359709064676023027956733835646666097320941503073813508185858444737605*
*# gift = 20496032015708587471213521250739180815581879333113*

（1）解答

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
*from* Crypto.Util.number *import* *
*from* tqdm *import* trange
*from* gmpy2 *import* *
n = 10009214721542670987254806153023821182945033678188723335579922208632323519726893772683575840208229246338773616380918139271794909264883764782760062336325158749526519888672475910036320954595528042993706096117856145863458412416941500458916006990105265631815741609517077178024592899268269925519316305062299747301038628357077626110475521758024178893315228753456120687071225793717567214350176025106940038633096190183161065065254951643903808674479529578020029220067096019447701862479770407096060180542387810158195063157852572267323502475445823159362276741192420297487358458567263901345568691982465836770183403813725529367141
e = 65537
c = 6543865653394441573590164022104824069940017606301093270422647941502504776088507426547758878885306137148149044204970853111688680010157321400854638053279418106422220624349345925194182324530024651314146701277003830814853454161700307862082683361797218877797380415918471753210899751957954672400283787200170072220155681807691826664118264219780963132859446534649732197318583971734931081272022182840967091600898693467855767463768967142944310189136825082214478097611648520971408784754073647871666701439428432181420708925630373790765352200772285924954094125370268330871100549104656007398077011988977301245011329237988225610363
ph = 426189912875926034808271470450071475904716064533992324396652808596359709064676023027956733835646666097320941503073813508185858444737605
gift = 20496032015708587471213521250739180815581879333113

w=bytes_to_long(b'Welcome to HnuCTF2026')
ph=ph << 576
*for* t *in* trange(64):
    Rt=ph+gift+(t << 570)
    P.<x>=PolynomialRing(Zmod(n))
    f=Rt+w*x
    f=f.monic()
    roots=f.small_roots(X=2^410,beta=0.5,epsilon=0.02)
    *if* roots:
        print(t)
        p=Rt+w*int(roots[0])
        *if* n%p == 0:
            q=n//p
            phi=(p-1)*(q-1)
            d=gmpy2.invert(e,phi)
            m=pow(c,d,n)
            flag=long_to_bytes(m)
            print(flag)
t=0
HnuCTF{*0hhhhhh_Y0u_4re_A_G00D_CopperSm1th*}

（2）思路

$由题易得：gift等于 p的低570位模w，则p_low=gift+w*x (x\in [1,2^{402}])$

4.DPEM

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
-----BEGIN RSA PRIVATE KEY-----
MIIEoQIBAAKCAQBci3sA1u4nP0qtZROqGjm61QCF7K7AIPinNpMKOgiFDANqYmLA
7Os7yIv7QGKeFiOWeJKqShd9px6lSp6FzJ5/fSmXHJ/70Qkb83qMCKnqRoNRisMt
gHvEoWrue9jtwB6qkH9V+KKiCrPL5NtlRAQVRvww2eWRXBdXcrsmdVP7cpa4Y4A7
YXGZD68lnkWJrYt7rjQgtTl0X722rdxseyZP1LABMtX6sfqIVSw6KxyFS2WAxDJF
AVmD6oaAVU9Ps6aMXocGymDrQ7xio7s9j28i294ThBy7ntqsocVk4MZ+vnhrUhLf
QHXK+PRl+Nqr9yz38B2jcEpXlEobxXeBwPcHAgMBAAECggE*****************
****************************************************************
****************************************************************
****************************************************************
****************************************************************
****************************************************************
****MQKBgQC4e***************************************************
****************************************************************
****************************************************6QKBgQCA****
****************************************************************
****************************************************************
************************************bwKBgAi/sjTpRqp6y3gvHebE18OW
ue4IOlfuHutWtzVN8Z9pyBBojE9DcRK/3k8vJ6FvdCEbcdNMTV8Gtm710SkQzdFs
MlVcaC+E2iIc0Y9zo3mx66tdWLz8mtPOWcjz7v1G7204zE/PqoO6dZlWq4ix0ONm
jfNNGrvKjjh/lZaMzuy*AoGA****************************************
****************************************************************
****************************************************************
**8CgYBf********************************************************
****************************************************************
****************************************************
-----END RSA PRIVATE KEY-----

c = 2205247149691154792238625059108141903321341004423526202571837450061180461990129291940266160523857399464252718136674627152739509924101297101800178066994126006030003245089875833452274811507649642021949268156688048278386653956059093361959506045911447928059225165041086846159886219762441643226213913899946485261748759605345127151330659850903921331012729524734075808254240863674328911608921356655274887723001637899618153788449745097206562667461072586471758920828774667348992595311989694667287952434986854112823449582667332555299705626059290629382640961146172571883310367613013619437161137149538202097368057538815817902960

（1）解答

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
*import* base64

private_key = '''MIIEoQIBAAKCAQBci3sA1u4nP0qtZROqGjm61QCF7K7AIPinNpMKOgiFDANqYmLA
7Os7yIv7QGKeFiOWeJKqShd9px6lSp6FzJ5/fSmXHJ/70Qkb83qMCKnqRoNRisMt
gHvEoWrue9jtwB6qkH9V+KKiCrPL5NtlRAQVRvww2eWRXBdXcrsmdVP7cpa4Y4A7
YXGZD68lnkWJrYt7rjQgtTl0X722rdxseyZP1LABMtX6sfqIVSw6KxyFS2WAxDJF
AVmD6oaAVU9Ps6aMXocGymDrQ7xio7s9j28i294ThBy7ntqsocVk4MZ+vnhrUhLf
QHXK+PRl+Nqr9yz38B2jcEpXlEobxXeBwPcHAgMBAAECggE/////////////////
////////////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////////
////MQKBgQC4e///////////////////////////////////////////////////
////////////////////////////////////////////////////////////////
////////////////////////////////////////////////////6QKBgQCA////
////////////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////////
////////////////////////////////////bwKBgAi/sjTpRqp6y3gvHebE18OW
ue4IOlfuHutWtzVN8Z9pyBBojE9DcRK/3k8vJ6FvdCEbcdNMTV8Gtm710SkQzdFs
MlVcaC+E2iIc0Y9zo3mx66tdWLz8mtPOWcjz7v1G7204zE/PqoO6dZlWq4ix0ONm
jfNNGrvKjjh/lZaMzuy/AoGA////////////////////////////////////////
////////////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////////
//8CgYBf////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////////
////////////////////////////////////////////////////
'''
private_key = private_key.split("\n")
*for* i *in* private_key:
   print(base64.b64decode(i).hex())
'''
308204a1020100028201005c8b7b00d6ee273f4aad6513aa1a39bad50085ecaec020f8a736930a3a08850c036a6262c0
eceb3bc88bfb40629e1623967892aa4a177da71ea54a9e85cc9e7f7d29971c9ffbd1091bf37a8c08a9ea4683518ac32d
807bc4a16aee7bd8edc01eaa907f55f8a2a20ab3cbe4db6544041546fc30d9e5915c175772bb267553fb7296b863803b
6171990faf259e4589ad8b7bae3420b539745fbdb6addc6c7b264fd4b00132d5fab1fa88552c3a2b1c854b6580c43245
015983ea8680554f4fb3a68c5e8706ca60eb43bc62a3bb3d8f6f22dbde13841cbb9edaaca1c564e0c67ebe786b5212df
4075caf8f465f8daabf72cf7f01da3704a57944a1bc57781c0f70702030100010282013fffffffffffffffffffffffff
ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff
ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff
ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff
ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff
ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff
ffffff3102818100b87bffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff
ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff
ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffe90281810080ffffff
ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff
ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff
ffffffffffffffffffffffffffffffffffffffffffffffffffffff6f02818008bfb234e946aa7acb782f1de6c4d7c396
b9ee083a57ee1eeb56b7354df19f69c810688c4f437112bfde4f2f27a16f74211b71d34c4d5f06b66ef5d12910cdd16c
32555c682f84da221cd18f73a379b1ebab5d58bcfc9ad3ce59c8f3eefd46ef6d38cc4fcfaa83ba759956ab88b1d0e366
8df34d1abbca8e387f95968cceecbf028180ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff
ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff
ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff
ffff0281805fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff
ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff
ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
*from* Crypto.Util.number *import* *
*import* gmpy2
*import* re
*from* tqdm *import* *
c = 2205247149691154792238625059108141903321341004423526202571837450061180461990129291940266160523857399464252718136674627152739509924101297101800178066994126006030003245089875833452274811507649642021949268156688048278386653956059093361959506045911447928059225165041086846159886219762441643226213913899946485261748759605345127151330659850903921331012729524734075808254240863674328911608921356655274887723001637899618153788449745097206562667461072586471758920828774667348992595311989694667287952434986854112823449582667332555299705626059290629382640961146172571883310367613013619437161137149538202097368057538815817902960
n = int("5c8b7b00d6ee273f4aad6513aa1a39bad50085ecaec020f8a736930a3a08850c036a6262c0eceb3bc88bfb40629e1623967892aa4a177da71ea54a9e85cc9e7f7d29971c9ffbd1091bf37a8c08a9ea4683518ac32d807bc4a16aee7bd8edc01eaa907f55f8a2a20ab3cbe4db6544041546fc30d9e5915c175772bb267553fb7296b863803b6171990faf259e4589ad8b7bae3420b539745fbdb6addc6c7b264fd4b00132d5fab1fa88552c3a2b1c854b6580c43245015983ea8680554f4fb3a68c5e8706ca60eb43bc62a3bb3d8f6f22dbde13841cbb9edaaca1c564e0c67ebe786b5212df4075caf8f465f8daabf72cf7f01da3704a57944a1bc57781c0f707".replace(" ", ""), 16)
e = 65537

*#n=11682704445815246614799975682795598561928308176776753307509765025966313702057385208641664325250242211714957814990728643294128984880713203151486006051003529512579918958625243529901799548712546693206365093660307202090422471359299300243795393845610495855153117803981228156471770331776749530990557704687798452281330024083803504839378404772678535639733056503795019398040933442130222345224168899866467387978605502975268735392335011490784404995412746734217388532525701913870559899983097599586663240015486534012563135146646565007319199247589173051250886092567398881687184149593736443661375964379839302666644936779973613647623*
#dp=383976587186102438132231145904054366063856984147351019983326357208220536503914565165787156299005568804400067589269862908504829040717008415134384436515583040617907409054569824896954628635065306800128953296666918382918471799258988181989381204671262024991557233046545681879097864609389311297840648928908603083
print(dp.bit_length())

*for* i *in* trange(2**8):
    dp=dp<<8+i
    *for* k *in* range(1,e):
        *if* (e*dp-1) % k == 0:
            p=(e*dp-1)//k + 1
            *if* n % p == 0:
                q=n//p
                print(q)
                d=gmpy2.invert(e,(p-1)*(q-1))
                m=pow(c,d,n)
                flag=long_to_bytes(m)
                print(flag) 
b'HnuCTF{I_th1nk_PEM_4nd_dpleak_i5_34sy_for_y0u}'

（2）思路

首先对PEM文件进行解密，根据格式提取n,e,dp

Image

注意dp没有泄露完全，故需要枚举