RSA公私钥

1
RSAPublicKey ::= SEQUENCE {
2
    modulus           INTEGER,  -- n
3
    publicExponent    INTEGER   -- e
4
}

1
RSAPrivateKey ::= SEQUENCE {
2

3
version Version,
4

5
modulus INTEGER, -- n
6

7
publicExponent INTEGER, -- e
8

9
privateExponent INTEGER, -- d
10

11
prime1 INTEGER, -- p
12

13
prime2 INTEGER, -- q
14

15
exponent1 INTEGER, -- d mod (p-1) （dp）
16

17
exponent2 INTEGER, -- d mod (q-1) （dq）
18

19
coefficient INTEGER, -- (inverse of q) mod p （inv）
20

21
otherPrimeInfos OtherPrimeInfos OPTIONAL
22

23
}

1
import base64
2

3
common_key = '''MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAzGjK21FO8/FjPZM+gGJ3
4
TvykTBocH9CReiBWuzkZwZmVt6wTJzerWS+DPRFJo7IviUxR0VOncEwxNgBzy5Ii
5
DXDvR6gwSXRjCvKD8fHBg3I96Lj2yV29t0J0mVyCoWqVAnxv09cUBIa25K5vmUIU
6
Pd1pA1m2xDLCQ54knHUjwK/fayGMrHHrT+bhSSFSIIguqKUOQ5ucgwWApTTF8CF7
7
yXITpq3kkYoZtSS4XewWr90xE+4v6vXNJ6vWJnxjaztEJ5meThH0DTgGTyq2/R59
8
jlCQ7suLqjH0S8HtSGQ4bM7sJkL+3WWDoyCgqKNvMpJmx9cQ5Gq8qgQ5ZZnqEI+0
9
MQIDAjKf'''
10
#common_key = "".join(common_key.split("\n"))
11
common_key = common_key.split("\n")
12
for i in common_key:
13
    print(base64.b64decode(i).hex())
14
'''
15
30820122300d06092a864886f70d01010105000382010f003082010a0282010100cc68cadb514ef3f1633d933e806277
16
4efca44c1a1c1fd0917a2056bb3919c19995b7ac132737ab592f833d1149a3b22f894c51d153a7704c31360073cb9222
17
0d70ef47a8304974630af283f1f1c183723de8b8f6c95dbdb74274995c82a16a95027c6fd3d7140486b6e4ae6f994214
18
3ddd690359b6c432c2439e249c7523c0afdf6b218cac71eb4fe6e149215220882ea8a50e439b9c830580a534c5f0217b
19
c97213a6ade4918a19b524b85dec16afdd3113ee2feaf5cd27abd6267c636b3b4427999e4e11f40d38064f2ab6fd1e7d
20
8e5090eecb8baa31f44bc1ed4864386cceec2642fedd6583a320a0a8a36f329266c7d710e46abcaa04396599ea108fb4
21
31020302329f
22
'''

1
import base64
2

3
private_key = '''MIIEowIBAAKCAQEAw6JUixKmoIZjLyR1Qc/D/3mfTC3YvqKienLM7Nt/83UqpYeg
4
9rOw02xLtIqgBdVyVkI+MknQdB5tB1W/bo95M8JjmNxi5rcEzXK4A5HiKtNxK9hC
5
dE1GIt78XcT1FLoM86zxFonkDQ8LxHXPbU22+Ex8ov269pS/BEwZuKohqbIUU4iZ
6
UltNYW2kaVsavAZw4NyQcQCQoijprdrQZLV6XjC/3+uX6baLaZS+NWHm1M16UHde
7
IF9B1gNuifO0xnuAWxRENjBIXw/3W8OVvRuRUppY2WYgeEG31fgfOCDoXhWVbqAD
8
6fJA9JWdkOPDqUAsqFCr2VKnORa2X9V9HdO5lwIDAQABAoIBAQD/////////////
9
////////////////////////////////////////////////////////////////
10
////////////////////////////////////////////////////////////////
11
////////////////////////////////////////////////////////////////
12
////////////////////////////////////////////////////////////////
13
////////////////////////////////////////////////////////////////
14
////////AoGBAP//////////////////////////////////////////////////
15
////////////////////////////////////////////////////////////////
16
////////////////////////////////////////////////////////AoGBAP//
17
////////////////////////////////////////////////////////////////
18
////////////////////////////////////////////////////////////////
19
////////////////////////////////////////AoGAZFBey/5KFQ1nOL6xe00r
20
ehGXxxNQF/7oym0kzI6BBi4awYZ4FCtuGiiAfkcsOS0UhlhFn1gEemnl2f2EF78M
21
THN5zVM5FSY5Cf8XwJT/fEytuWdCQke7JxVYOLNsEJeViicsasXeWeSL1nPYS3a5
22
+T4027LUdjikIbu508dTT6UCgYAY+t0pv5nJ93J3773ZZYkLSCG+zXZBSgUtcCoQ
23
GTBa4Qcr3MLeeUGDkb4qNIBdqWsQR0GiIXLkoIxcmOr66Rs+Hl60MD0kWQA6uz5/
24
aJOhZc8pO0vGVG3+RbKA4xTxZshopp4CVdCrM20SqXXa3OEqr48Ec1aIES/ymZO8
25
GuaOwQKBgB4ZWvOfPzCFOselDYyjz2Tub1RY3YrvI1do3jl42nhy/1Aoc6G3XLi4
26
AIg8gxJGx36aPjpxBfe1HTicBhtUThBxq/A2/Ed1TwxFDvDPjhDc1Js/LL0qxhaP
27
Z/xYCgGGZftjQqPTy+S62ppYVcTxjDON6vNBssatGUIzuGglC2Lf
28
'''
29
private_key = private_key.split("\n")
30
for i in private_key:
31
   print(base64.b64decode(i).hex())
32
'''
33
308204a30201000282010100c3a2548b12a6a086632f247541cfc3ff799f4c2dd8bea2a27a72ccecdb7ff3752aa587a0
34
f6b3b0d36c4bb48aa005d57256423e3249d0741e6d0755bf6e8f7933c26398dc62e6b704cd72b80391e22ad3712bd842
35
744d4622defc5dc4f514ba0cf3acf11689e40d0f0bc475cf6d4db6f84c7ca2fdbaf694bf044c19b8aa21a9b214538899
36
525b4d616da4695b1abc0670e0dc90710090a228e9addad064b57a5e30bfdfeb97e9b68b6994be3561e6d4cd7a50775e
37
205f41d6036e89f3b4c67b805b14443630485f0ff75bc395bd1b91529a58d966207841b7d5f81f3820e85e15956ea003
38
e9f240f4959d90e3c3a9402ca850abd952a73916b65fd57d1dd3b99702030100010282010100ffffffffffffffffffff
39
ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff
40
ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff
41
ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff
42
ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff
43
ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff
44
ffffffffffff02818100ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff
45
ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff
46
ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff02818100ffff
47
ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff
48
ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff
49
ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff02818064505ecbfe4a150d6738beb17b4d2b
50
7a1197c7135017fee8ca6d24cc8e81062e1ac18678142b6e1a28807e472c392d148658459f58047a69e5d9fd8417bf0c
51
4c7379cd533915263909ff17c094ff7c4cadb967424247bb27155838b36c1097958a272c6ac5de59e48bd673d84b76b9
52
f93e34dbb2d47638a421bbb9d3c7534fa502818018fadd29bf99c9f77277efbdd965890b4821becd76414a052d702a10
53
19305ae1072bdcc2de79418391be2a34805da96b104741a22172e4a08c5c98eafae91b3e1e5eb4303d2459003abb3e7f
54
6893a165cf293b4bc6546dfe45b280e314f166c868a69e0255d0ab336d12a975dadce12aaf8f04735688112ff29993bc
55
1ae68ec10281801e195af39f3f30853ac7a50d8ca3cf64ee6f5458dd8aef235768de3978da7872ff502873a1b75cb8b8
56
00883c831246c77e9a3e3a7105f7b51d389c061b544e1071abf036fc47754f0c450ef0cf8e10dcd49b3f2cbd2ac6168f
57
67fc580a018665fb6342a3d3cbe4bada9a5855c4f18c338deaf341b2c6ad194233b868250b62df
58
'''

1
from Crypto.Util.number import *
2
import gmpy2
3

4
c = 2280855825153079369164514405327170396436620371664464526496429415733055203155893358484242996086505609777681080427906338470140692619928813296029361848636902023401977358243759630394370381376771421271028169492126347929997983519619222735581769019133156193638407197605823449074124544232663174637158818370904094998560600412703805652546502801423946150024740398302185572802694514470006408627417645654400501165391976205173956917696904810606259304153658230235808250378495226246727449749944446621780268923502478344984402162063011322533642498211989023200258638304752854056875616723925602248635708248865548095231743243612632966212
5
n = int("c3 a2 54 8b 12 a6 a0 86 63 2f 24 75 41 cf c3 ff 79 9f 4c 2d d8 be a2 a2 7a 72 cc ec db 7f f3 75 2a a5 87 a0 f6 b3 b0 d3 6c 4b b4 8a a0 05 d5 72 56 42 3e 32 49 d0 74 1e 6d 07 55 bf 6e 8f 79 33 c2 63 98 dc 62 e6 b7 04 cd 72 b8 03 91 e2 2a d3 71 2b d8 42 74 4d 46 22 de fc 5d c4 f5 14 ba 0c f3 ac f1 16 89 e4 0d 0f 0b c4 75 cf 6d 4d b6 f8 4c 7c a2 fd ba f6 94 bf 04 4c 19 b8 aa 21 a9 b2 14 53 88 99 52 5b 4d 61 6d a4 69 5b 1a bc 06 70 e0 dc 90 71 00 90 a2 28 e9 ad da d0 64 b5 7a 5e 30 bf df eb 97 e9 b6 8b 69 94 be 35 61 e6 d4 cd 7a 50 77 5e 20 5f 41 d6 03 6e 89 f3 b4 c6 7b 80 5b 14 44 36 30 48 5f 0f f7 5b c3 95 bd 1b 91 52 9a 58 d9 66 20 78 41 b7 d5 f8 1f 38 20 e8 5e 15 95 6e a0 03 e9 f2 40 f4 95 9d 90 e3 c3 a9 40 2c a8 50 ab d9 52 a7 39 16 b6 5f d5 7d 1d d3 b9 97".replace(" ", ""), 16)
6
e = 65537
7
dp = int("64 50 5e cb fe 4a 15 0d 67 38 be b1 7b 4d 2b 7a 11 97 c7 13 50 17 fe e8 ca 6d 24 cc 8e 81 06 2e 1a c1 86 78 14 2b 6e 1a 28 80 7e 47 2c 39 2d 14 86 58 45 9f 58 04 7a 69 e5 d9 fd 84 17 bf 0c 4c 73 79 cd 53 39 15 26 39 09 ff 17 c0 94 ff 7c 4c ad b9 67 42 42 47 bb 27 15 58 38 b3 6c 10 97 95 8a 27 2c 6a c5 de 59 e4 8b d6 73 d8 4b 76 b9 f9 3e 34 db b2 d4 76 38 a4 21 bb b9 d3 c7 53 4f a5".replace(" ", ""), 16)
8
dq = int("18 fa dd 29 bf 99 c9 f7 72 77 ef bd d9 65 89 0b 48 21 be cd 76 41 4a 05 2d 70 2a 10 19 30 5a e1 07 2b dc c2 de 79 41 83 91 be 2a 34 80 5d a9 6b 10 47 41 a2 21 72 e4 a0 8c 5c 98 ea fa e9 1b 3e 1e 5e b4 30 3d 24 59 00 3a bb 3e 7f 68 93 a1 65 cf 29 3b 4b c6 54 6d fe 45 b2 80 e3 14 f1 66 c8 68 a6 9e 02 55 d0 ab 33 6d 12 a9 75 da dc e1 2a af 8f 04 73 56 88 11 2f f2 99 93 bc 1a e6 8e c1".replace(" ", ""), 16)
9
inv = int("1e 19 5a f3 9f 3f 30 85 3a c7 a5 0d 8c a3 cf 64 ee 6f 54 58 dd 8a ef 23 57 68 de 39 78 da 78 72 ff 50 28 73 a1 b7 5c b8 b8 00 88 3c 83 12 46 c7 7e 9a 3e 3a 71 05 f7 b5 1d 38 9c 06 1b 54 4e 10 71 ab f0 36 fc 47 75 4f 0c 45 0e f0 cf 8e 10 dc d4 9b 3f 2c bd 2a c6 16 8f 67 fc 58 0a 01 86 65 fb 63 42 a3 d3 cb e4 ba da 9a 58 55 c4 f1 8c 33 8d ea f3 41 b2 c6 ad 19 42 33 b8 68 25 0b 62 df".replace(" ", ""), 16)
10

11
def dp_leak(dp, c, n, e):
12
    for i in range(1, e):
13
        t = (dp * e - 1) % i
14
        if t == 0:
15
            p = (dp * e - 1) // i + 1
16
            if n % p == 0:
17
                q = n // p
18
                d = gmpy2.invert(e, (p - 1) * (q - 1))
19
                print(long_to_bytes(pow(c, d, n)))
20

21
dp_leak(dp, c, n, e)
22
#NSSCTF{(115.36517E, 39.30839N)}

1
import sys
2
from Crypto.Util.number import *
3
from random import *
4
sys.setrecursionlimit(2000)
5

6
################################################### part1 read pem
7
# with open('./certificate/private.pem', 'r') as file:
8
#     cipher = file.readlines()[1:-1]
9
cipher='''MIICewIBAAKBgQCdA0+pqynKvc3/BH5ojnUXBMdWy9Lzi9TwSaOgiJ6ky//QBrWG
10
CNan98CYNcoKux2yOtHKIjxUrPh+LdgjmW+/paWPJyrnoQw5SqD+FvqNTjG7Akvx
11
+TUXyMflL9qodrWBEbl/xmN01Qbivo36+U1mFDB+6LENk/3BwWXHVj0DvQIhAL7t
12
Vc3/3jEFe+paWKNoTV++2B8D1T+ii7ZYsy3kU1yNAoGA????????????????????
13
????????????????????????????????????????????????????????????????
14
????????????????????????????????????????????????????????????????
15
??????????????????????kCQQ??????????????????????????????????????
16
????????????????????????????????????????????????AkE?????????????
17
????????????????????????????????????????????????????????????????
18
?????????wJAJrKFhI5pl/oBN2BZqLTf+NacGqTFrzmbi7RVFaN43kXYXu11urXy
19
LTncfJXBpRhtGFdsL31jiswhiYRp9yjT+wJB????????????????????????????
20
??????????????????????????????????????????????????????????MCQQ??
21
????????????????????????????????????????????????????????????????
22
????????????????????
23
'''
24
cipher = ''.join(cipher).replace('\n','')
25
print(cipher)
26
table = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/'
27

28
bitstream = ""
29
for i in cipher:
30
    if(i == "?"):
31
        bitstream += "******"
32
    else:
33
        bitstream += bin(table.index(i))[2:].zfill(6)
34
print(bitstream)
35

36
################################################### part2 split params
37
info1 = hex(int(bitstream[:4*8],2))[2:].zfill(4*2)
38
print(info1) # 30（标识头） 82 027b（总长度）
39
bitstream = bitstream[4*8:]
40
info2 = hex(int(bitstream[:3*8],2))[2:].zfill(3*2)
41
bitstream = bitstream[3*8:]
42
print(info2)# 0201 00 （版本信息）
43
##### n,e
44
infon = hex(int(bitstream[:3*8],2))[2:].zfill(3*2)
45
print(infon) # 0281 81 （数据长度0x81字节）
46
bitstream = bitstream[3*8:]
47
n = int(bitstream[:0x81*8],2)
48
print(n.bit_length())
49
print('n='+hex(n))
50
bitstream = bitstream[0x81*8:]
51

52
infoe = hex(int(bitstream[:2*8],2))[2:].zfill(2*2)
53
print(infoe) # 02 21 （数据长度0x21字节）
54
bitstream = bitstream[2*8:]
55
e = int(bitstream[:0x21*8],2)
56
print(e.bit_length())
57
print('e='+hex(e))
58
bitstream = bitstream[0x21*8:]
59

60
###### d
61
infod = hex(int(bitstream[:3*8],2))[2:].zfill(3*2)
62
print(infod) # 0281 80 (数据长度0x80字节)
63
bitstream = bitstream[3*8:]
64
d = bitstream[:0x80*8]
65
bitstream = bitstream[0x80*8:]
66

67
###### p,q
68
infop = hex(int(bitstream[:2*8],2))[2:].zfill(2*2)
69
print(infop) # 02 41 (数据长度0x41字节)
70
bitstream = bitstream[2*8:]
71
p = bitstream[:0x41*8]
72
# print('p=',hex(p))
73
bitstream = bitstream[0x41*8:]
74
infoq = hex(int(bitstream[:2*8],2))[2:].zfill(2*2)
75
print(infoq) # 02 41 (数据长度0x41字节)
76
bitstream = bitstream[2*8:]
77
q = bitstream[:0x41*8]
78
bitstream = bitstream[0x41*8:]
79

80
# ##### dp,dq
81
infodp = hex(int(bitstream[:2*8],2))[2:].zfill(2*2)
82
print(infodp) # 02 40 (数据长度0x40字节)
83
bitstream = bitstream[2*8:]
84
dp = int(bitstream[:0x40*8],2)
85
print('dp=',hex(dp))
86

87
bitstream = bitstream[0x40*8:]
88
infodq = hex(int(bitstream[:2*8],2))[2:].zfill(2*2)
89
print(infodq)# 02 41 (数据长度0x41字节)
90
bitstream = bitstream[2*8:]
91
dq = bitstream[:0x41*8]
92
bitstream = bitstream[0x41*8:]
93

94
###### invert(q, p)
95
infodmqp = hex(int(bitstream[:2*8],2))[2:].zfill(2*2)
96
print(infodmqp)# 02 41 (数据长度0x41字节)
97
bitstream = bitstream[2*8:]
98
dmpq = bitstream[:0x41*8]
99
bitstream = bitstream[0x41*8:]
100
print(bitstream)
101

102
################################################### part3 recover the flag
103
cipher = 82404436498466895324733436901056359489189960512493202570903960333247277400247388969097533191635462377037232768074464944681385506170855774688613792302290304494481765906529480985984818897269069587516233500512849282866396228645039453616712857020451120948641770106851301755195757766245239907077580562163260112662
104
p = GCD(pow(2, e*dp, n) - 2, n)
105
q = n // p
106
d = inverse(e, (p - 1) * (q - 1))
107
m = pow(cipher, d, n)
108
print(long_to_bytes(m))

1
# %%
2
import rsa
3
from Crypto.PublicKey import RSA
4
from gmpy2 import *  # gmpy2模块
5
from Crypto.Cipher import PKCS1_OAEP
6

7
pub = open('pub.key', 'r').read()
8
key = RSA.import_key(pub)
9
n = key.n
10
e = key.e
11
print('n =', n)
12
print('e =', e)
13
p = 285960468890451637935629440372639283459
14
q = 304008741604601924494328155975272418463
15

16
# %%
17
phi = (p - 1) * (q - 1)
18
d = invert(e, phi)  # gmpy2.invert(),用来求模逆的方法
19

20
print('d =', d)
21
d = 81176168860169991027846870170527607562179635470395365333547868786951080991441
22

23
key = rsa.PrivateKey(n, e, d, p, q)
24
print(key)
25
with open("flag.enc", 'rb') as f:
26
    f = f.read()
27
    flag = rsa.decrypt(f,key)
28
    print(flag)

1
with open("flag.enc", 'rb') as f:
2
    f = f.read()
3
    c = bytes_to_long(f)
4
    print(long_to_bytes(pow(c,d,n)))
5
    flag = rsa.decrypt(f,key)
6
    print(flag)

1
key.export_key(passphrase=passphrase).split(b'\n')

1
from Crypto.Cipher import DES3
2
from Crypto.Protocol.KDF import PBKDF1
3
from Crypto.Hash import MD5
4
import base64
5

6

7
enc1 = "9phAgeyjnJYZ6lgLYflgduBQjdX+V/Ph/fO8QB2ZubhBVOFJMHbwHbtgBaN3eGlhWiEFEdQWoOFvpip0whr4r7aGOhavWhIfRjiqfQVcKZx4/f02W4pcWVYo9/p3otdDig+kofIR9Ky8o9vQk7H1eESNMdq3PPmvd7KTE98ZPqtIIrjbSsJ9XRL+gr5a91gH"
8
enc2 = "hQds7ZdA9yv+yKUYv2e4de8RxX356wYq7r8paBHPXisOkGIVEBYNviMSIbgelkSIjLQka+ZmC2YOgY/DgGJ82JmFG8mmYCcSooGL4ytVUY9dZa1khfhceg=="
9

10
salt = bytes.fromhex("435bf84c562fe793")
11
dict = [str(i).zfill(6).encode() for i in range(0,1000000)]
12
for passphrase in dict:
13
    key = PBKDF1(passphrase, salt, 16, 1, MD5)
14
    key += PBKDF1(key + passphrase, salt, 8, 1, MD5)
15
    cipher = DES3.new(key, DES3.MODE_CBC, salt)
16
    data = cipher.decrypt(base64.b64decode(enc1)).hex()
17
    if data.startswith("3082") and "028181" in data and "0203010001" in data:
18
        print(data)
19
        print(passphrase)
20
        data2 = cipher.decrypt(base64.b64decode(enc2)).hex()
21
        print(data2)
22
        break

1
30 82 02 5c
2
    02 01
3
        00
4

5
    02 81 81 00
6
a1 8f 01 1b eb ac ce da 1c 68 12 73 0b 9e 62 72 0d 3c bd 68 57 af 2c f8 43 18 60 f5 dc 83 c5 52 0f 24 2f 3b e7 c9 e9 6d 7f 96 b4 18 98 ff 00 0f db 7e 43 ef 6f 1e 71 7b 2b 79 00 f3 56 60 a2 1d 1b 16 b5 18 49 be 97 a0 b0 f7 cb cf 5c fe 0f 00 37 0c ce 61 93 fe fa 1f ed 97 b3 7b d3 67 a6 73 56 51 62 ce 17 b0 22 57 08 c0 32 96 1d 17 5b bc 2c 82 9b f2 e1 6e ab c7 e0 88 1f ec a0 97 5c 81
7

8
    02 03
9
        01 00 01
10

11
6a 03 30 64 c5 a0 dff c8 f2 36 3b 34 0e 50 24 05 f1 52 c4 29 87 1a 7a cd d2 8b e1 b6 43 b4 65 28 00 b8 8a 3d 23 cc 57 47 7d 75 dd 55 55 b6 35 16 76 16 ef 5c 60 9d 69 ce 3c 2a ed cb 03 b6 2f 92 9b bc d8 91 ca dc 0b a0 31 ae 6f ec 8a 21 16 d0 80 80 80 80 80 80 80 8

1
n = 0xa18f011bebacceda1c6812730b9e62720d3cbd6857af2cf8431860f5dc83c5520f242f3be7c9e96d7f96b41898ff000fdb7e43ef6f1e717b2b7900f35660a21d1b16b51849be97a0b0f7cbcf5cfe0f00370cce6193fefa1fed97b37bd367a673565162ce17b0225708c032961d175bbc2c829bf2e16eabc7e0881feca0975c81
2
e = 65537
3
dq_leak= 0x8f2363b340e5
4
inv = 0x5f152c429871a7acdd28be1b643b4652800b88a3d23cc57477d75dd5555b635167616ef5c609d69ce3c2aedcb03b62f929bbcd891cadc0ba031ae6fec8a2116d

1
from tqdm import *
2
from Crypto.Util.number import *
3
from Crypto.PublicKey import RSA
4
from Crypto.Cipher import PKCS1_OAEP
5

6
n = 0xa18f011bebacceda1c6812730b9e62720d3cbd6857af2cf8431860f5dc83c5520f242f3be7c9e96d7f96b41898ff000fdb7e43ef6f1e717b2b7900f35660a21d1b16b51849be97a0b0f7cbcf5cfe0f00370cce6193fefa1fed97b37bd367a673565162ce17b0225708c032961d175bbc2c829bf2e16eabc7e0881feca0975c81
7
e = 65537
8
dq_leak= 0x8f2363b340e5
9
inv = 0x5f152c429871a7acdd28be1b643b4652800b88a3d23cc57477d75dd5555b635167616ef5c609d69ce3c2aedcb03b62f929bbcd891cadc0ba031ae6fec8a2116d
10
c = 55149764057291700808946379593274733093556529902852874590948688362865310469901900909075397929997623185589518643636792828743516623112272635512151466304164301360740002369759704802706396320622342771513106879732891498365431042081036698760861996177532930798842690295051476263556258192509634233232717503575429327989
11

12
def coppersmith(k):
13
    R.<x> = PolynomialRing(Zmod(n))
14
    tmp = e * (x * 2^48 + dq_leak) + k - 1          # kq
15
    f = inv * tmp^2 - k*tmp
16
    f = f.monic()
17
    x0 = f.small_roots(X=2^464,beta=1,epsilon=0.09)
18
    return x0
19

20
for k in trange(1，e):
21
    x0 = coppersmith(k)
22
    if x0 != []:
23
        dq = int(x0[0]) * 2^48 + dq_leak
24
        q = (e*dq + k - 1) // k
25
        # print(f"k = {k}")
26
        # k = 47794
27
        p = n // q
28
        d = inverse(e,(p-1)*(q-1))
29
        m = pow(c,d,n)
30
        print(long_to_bytes(int(m)))
31
        # b'flag{df4a4054-23eb-4ba4-be5e-15b247d7b819}'
32
        break

1
from Crypto.Util.number import *
2
from Crypto.PublicKey import RSA
3
from Crypto.Cipher import PKCS1_OAEP
4
import base64
5
import gmpy2
6

7
with open("flag.enc", "rb")as f:
8
    c = f.read()
9

10
n = 0xd7152506aa9cec05e5335d6b46f5491407c3199fd51091f1f6030d3762b9e03f49c9dcdc075054e0cc148b974b41854bd93b4ee16a2a876ee62005e80ef806b7aa3b64b1bf9b1fa773e353d0cdb9ff9783ddd5f5e67499ad10f361e938d00b82a6a4c42a0535c5e76721798e86b45cd4b8d03b0d7e75c2be8766a1e843bdc641
11
e = 0x10001
12
dq = 11263269100321843418340309033584057768246046953115325020896491943793759194249558697334095131684279304657225064156696057310019203890620314290203835007881649
13
p = 12112790828812363063315417237469719611888243756064158121348026938824270601623590308149025542977097905953795136774300936003505715307199422663647014200158449
14
q = 12469144192094336933187534132907623337514842804208163244218540727384104398951558782195384932941310035462094951428865175221316720981428462265191789302379089
15
phi = (p - 1) * (q - 1)
16

17
d = int(gmpy2.invert(e, phi))
18
key = RSA.construct((n, e, d, p, q))
19
flag = PKCS1_OAEP.new(key)
20
flag = flag.decrypt(c)
21
print(flag)

1
import gmpy2
2
from Crypto.Util.number import bytes_to_long, long_to_bytes
3
p = (2**4244)*699549860111847+1
4
q = (2**4244)*699549860111847-1
5
n=0x62D3D61C92452630147E89670FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF
6

7
e=65537
8
phi = (p-1)*(q-1)
9
d=gmpy2.invert(e,phi)
10
with open('.\cry200\cipher.bin', 'rb') as file:
11
    data = bytes_to_long(file.read())
12
    res = long_to_bytes(pow(data, d, n)).decode()
13
    print(res)

1
import gmpy2
2
from Crypto.Util.number import *
3
from base64 import b64decode
4
from Crypto.PublicKey import RSA
5
f = open("D:\\ctf-problems\\bf930316910b451c94c41ce8a9d851a8\\key.pub","rb").read()
6
pub = RSA.importKey(f)
7
n=pub.n
8
e=pub.e
9
print(pub.n,pub.e)
10
f = open("D:\\ctf-problems\\bf930316910b451c94c41ce8a9d851a8\\flag.b64",'r').read()
11
c = b64decode(f)
12
c = bytes_to_long(c)
13
p=863653476616376575308866344984576466644942572246900013156919
14
q=965445304326998194798282228842484732438457170595999523426901
15
phi=(p-1)*(q-1)
16
d=gmpy2.invert(e,phi)
17
m=pow(c,d,n)
18
print(long_to_bytes(m))