1.you raise me up

The title source code is as follows
#!/usr/bin/env python # -*- coding: utf-8 -*- from Crypto.Util.number import *
import random n = 2 ** 512 m = random.randint(2, n-1) | 1 c = pow(m,
bytes_to_long(flag), n) print 'm = ' + str(m) print 'c = ' + str(c) # m =
391190709124527428959489662565274039318305952172936859403855079581402770986890308469084735451207885386318986881041563704825943945069343345307381099559075
# c =
6665851394203214245856789450723658632520816791621796775909766895233000234023642878786025644953797995373211308485605397024123180085924117610802485972584499
This is a problem of solving discrete logarithm —— After inquiry in sage There are discrete_log Function can solve the problem directly
e=discrete_log(Mod(c,n),Mod(m,n))
2.boom

Give a question exe, We run exe Solve each problem and you will get results

First pass

  go md5 Query en5oy

Second level

use sympy solve equations
from sympy import * x = Symbol('x') y = Symbol('y') z = Symbol('z') print
solve([3*x-y+z-185,2*x+3*y-z-321,x+y+z-173],[x, y,z])
  The third pass

Solving equation as above
from sympy import * x = Symbol('x') print solve([x*x+x-7943722218936282],[x])
 3.easy_ya

First, we get the data after blasting
from pwn import * import gmpy2 def md5(a): for i in xrange(128): for j in
xrange(128): for k in xrange(128): for o in xrange(128):
jie=chr(i)+chr(j)+chr(k)+chr(o) ll=hashlib.md5(jie).hexdigest()[:20] if ll==a:
return jie def proof(a,b): if b=="md5": return md5(a) else: return ""
io=remote("39.96.90.217",17497) io.recvuntil("= ")
hashh=io.recvuntil("\n")[:-1] io.recvuntil("function openssl_")
hashfunction=io.recvuntil(">")[:-1] print hashh.encode("hex") print
hashfunction xx=proof(hashh,hashfunction) io.sendline(xx) io.interactive()

obtain RSA Encrypted ciphertext and XOR encrypted ciphertext , according to RSA Encrypted ciphertext acquisition key, Because of two reasons RSA in p It's the same , We can use to find two RSA Of n Solving the greatest common divisor of p, decompose n, So as to decrypt the ciphertext key
import gmpy2
n1=789306495874737874620251644558883005086451337890076263459093389913919784496551095660546717446897168591297482448040054702015369990861333368710159463952037656052007452260723036584075897209576238058627783895644334979443701434265381565651767488407392247134916873495890092227545153177787965015924853434671782806026738630714101426175109961766658449154801268090247331157294558996166192206147198408256434728508044705930411291899266430110295862646748525612066436069476493370329185915991658440766039830846303105531830809611262741610474699773151979080813834790273062423729384553677965432622154245290912292679488377716067059759386202639833957086593557638327035029187319293173837435431227400296481038962076108285766911541296080364173455683676712122101202312075284530334702438288607921589806410180737979893444657027069430299457126760287780953125831719245181682153143461561441374532758413145727049056650457961647891034631590890538038040027564051098619932628908967424968287976106901116044792095733477373351213643409897907565888601864174125553983648226258381017328971516190198087207276303995689451299423291075589337193870432332275680597517386046055671356228740224950999187196387838845193024075847279848382885019569898326026017126144478643664938945357
c1=310858776314834563108091662844882232099161830593721701111120017379750075145705904495880255474836202965034323014253869861000483059458461449050900249975783855599869169294583105262864472021013592036652208473564574235420514153400947181665059054938192251274758306090928680033651035857535902694193252193270583053080079017485446343398289822766355050363719016126642919968558517189821604049563964621000261550254848186110374507253720658046127377955817892416370590113348870743318315935411105659385843357239682367871077945888823185604199631881614025030120723957219525492900407030826129618266906107103116894516086523752314231676294945811319697005713024512979386072101075062723579473029722167837044862377945655182730883369018563758457202509632770830710012672449670053061539942506282734821093227904208237595408645662413866774009743791844179237217909301192059521698103157349829922113105061023145640802654900143982295118177516648259847553577235331802550812646673313259363871194862004538782093838031455226614207356799354706144410457948631342399333105986789216334725956389824677056119497541494466054773293794793744852205777329323655311326730850608707221386567870163799656423510153516700065933345817840466135073787484357932542225976636742966567992266218
n2=894509755055108161439132906503019403146704073927753208056829561900225619071199911468187238447391132929313154211551531477941422930490408413782353935029657208164290088969980735538581689080715039909357982904714644364266549745873152308766543628527268316597618662523474007547773017459107257332884236313184460850954280624662243779571655949305738281249107136280004783247757409824802074623401334736840004432941420505279378777689041742181331251247137755542179777546531218168496148686489795967234356780406912093646267939306813902379621269086716282540556228932568367836693056377560737545847705303839780710441298043302762783656353176823444327614068093927743642477445629355009109977277292610049677279167513064535591831754967089303744503964894783741835575233748404305974266067798249602607749769896881320955131681996693435115396410231056088426114343902231505243644620604746592982991695022490177796825435801306040833495822467188761740825640059967503141847639068252615354904816912346586003616866898345589441596199457119345672577828180583226696311705795141570498268016018053243873463889418977181220990536526168006042752163026266534025006008918278472921490359661477677626490248643862140099401679343007194054205640109456607539247677894810420441979067461
c2=528972389247312585378629663696392693055686375179278029638667190964692052783073017807551939334261000996163558242128104867540768684049559049525407149014731783042390367661092415680249601663545196404022884999272586441615085471682318512300153349165030098747041017128442769074002808089193409510119610289630559682963309775767999758564064928278043820487959233562735628617511847435585190366677403317880058998862999113974421975760320267513637863718339374139596630651802333407775163816014555821574738880479935898640643739974998144410701513929091008788587976032872757196570474469736462084848557102890031498021024009095780924479572183294227767509235577098906352725607253650188801402859196858830647480250631325761939494871977505452352472503454893940835122174543166931732681581545876331827185015098821807532905558998450091434405046147364975393680898106344685169302827792312041969477843346976965098687388763765600017983767537206815623042848542514982575258285911126636253816475536679487610775682690450923181421080726812613115975231013130692807742652662374410071046284725744649986585460738457744829566365817977760126409253497920943713110466588163706640466625140463434525294930071651124728686325017768817249212029172543659721243069218962849436465803226
e=0x10001 p=gmpy2.gcd(n1,n2) q1=n1/p q2=n2/p d1=gmpy2.invert(e,(p-1)*(q1-1))
d2=gmpy2.invert(e,(p-1)*(q2-1)) print hex(pow(c1,d1,n1)) print
hex(pow(c2,d2,n2))

Then we go back to the topic , It's found in the final results z The top three and pads The last three XORs of cannot get the original value , Here we use blasting , First of all, guarantee pad Yes, it can be 32 Divisible and divisible in (0x10000000,0xffffffff) between , Then leave the part of the result that is the visible character ( be careful flag There is padding at the end of \x00)
import gmpy2 limit = lambda n: n & 0xffffffff
key="8891898088b197a0bfa78199b28195bfae89".decode("hex") Key = [ord(i) for i in
key] a = limit((Key[0] << 24) | (Key[1] << 16) | (Key[2] << 8) | Key[3]) b =
limit((Key[4] << 24) | (Key[5] << 16) | (Key[6] << 8) | Key[7]) c =
limit((Key[8] << 24) | (Key[9] << 16) | (Key[10] << 8) | Key[11]) d =
limit((Key[12] << 24) | (Key[13] << 16) | (Key[14] << 8) | Key[15])
y=int("939660b2b1d42d5f47fb"[:7],16)
pp=int("939660b2b1d42d5f47fb"[7:12]+"000",16)
z=int("939660b2b1d42d5f47fb"[12:20],16) ll=[] for j in xrange(0,34):
pps=pp+j*0x100000000 for k in xrange(0,0xfff): if (pps+k)%32==0: if
(pps+k)/32>0x10000000 and (pps+k)/32<0xffffffff: ll.append(pps+k) for pps in
ll: pad=pps/32 y=int("939660b2b1d42d5f47fb"[:7],16)
z=int("939660b2b1d42d5f47fb"[12:20],16) sign=True
z=((int(hex(pps)[-4:-1],16))<<20)^z for k in range(32): padss=limit(pps-k*pad)
z=z-limit((y*16 + c) ^ (y + padss) ^ ((y>>5) + d)) if z<0: z=z+0x100000000
y=y-limit((z*16 + a) ^ (z + padss) ^ ((z>>5) + b)) if y<0: y=y+0x100000000
s=hex((y<<32)+z)[2:-1] s1=["","0"][len(s)%2]+s for i in xrange(len(s1)/2): if
(int(s1[i*2:i*2+2],16)>128): sign=False break if sign: print s1.decode("hex")
 

Technology
©2019-2020 Toolsou All rights reserved,
Bitcoin in ten years ,VDS Opportunity or fraud Don't annoy the panda with any cat !「 Kung Fu Panda 」20 It's the year of man 4 blood sort ( one ) bubble sort Random forest R Language implementation java Realize the function of grabbing red packets Python Basic knowledge and notes python To solve the problem of dictionary writing list in CSS architecture design Vue Common features ( one )2021 year 2 Monthly programmer salary statistics , average 15144 element