from Cryptodome.Util.number import*e =0x10001s =pow(p + q,2)n = p*qa =pow(s,3, r)b =(s - q*(2*p + q))*rm_list =[findme]c_list =[]for i inrange(len(m_list)): m =bytes_to_long(m_list[i]) c =pow(m*r, e, n) c_list.append(c)output =open("output.txt","w")output.writelines([str(i)+"\n"for i in[e, s, n, a, b, c_list]])output.close()
Terlihat terdapat beberapa parameter tambahan hasil operasi dari parameter lain yang dituliskan pada output.txt , jadi disini kami menjabarkan parameter yang ada tersebut.
Karena b dan n sama sama memiliki faktor p , maka lakukan gcd didapatkan p , selanjutnya bagi n dengan p dapat q. Untuk r tinggal bagi b dengan p2 . Sisanya tinggal decrypt rsa kemudian bagi dengan r.
Ternyata didapatkan source code lain
Karena nilai p dan q diketahui jadi kurangi saja dengan nilai r dan didapatkan flagnya . Flag dibagi berdasarkan ganjil genpa jadi tinggal reverse saja.
Flag : COMPFEST13{y0U_d1DnT_3xpEcT_t0_FinD_pQ_4s_a_fl4g_DiD_y0u_7e1877a801}
Secure Channel (479 pts)
Description
-
Solution
Diberikan 4 source code , disini kami melakukan analisis pada file inti yaitu dimana percakapan antara bob dan alice terjadi.
Sepertinya tidak ada yang aneh , kemudian cek file secrets.py
Terlihat pada constraint pada constructor kelas bob bahwa nilai secret > 2 dan < 100 . Jadi bisa dibruteforce . Yang jadi maslaah kita tidak tahu plaintextnya apa untuk pembandingnya, tapi bisa diatasi dengan melakukan >= 2 kali request ke server dan melakukan decrypt keduanya dengan key 3-100 , jika ada nilai yang sama dikeduanya berarti itulah plaintextnya. Berikut contohnya
Didapatkan outputnya “87d&”. Jadi bisa digunakan sebagai pembanding di script utama.
Output
Didapatkan output aneh , cukup lama stuck disini karena kami tidak memisahkan setiap percakapannya dan langsung melakukan decode secara keseluruhan. Namun untungnya kami sempat mencoba di cyberchef dan terlihat bahwa ada beberapa string yang terbaca ketika menggunakan base85 decode , kemudian kami sadar ternyata harusnya di decode per percakapan ( tidak berkelanjutan ) . Jadi decode saja sampai ketemu flagnya
Flag : COMPFEST13{4fd29464a28a1b39559f4fc500b41c4b17ec8ad74512394a830b51506628caf4_734b39d538}
You AES Me Up (482 pts)
Description
-
Solution
Diberikan source code sebagai berikut
Setelah kami lakukan analisis kami menemukan 2 bug , yang pertama kita bisa leak iv , iv nya digunakan berulang kali. Untuk mudahnya encrypt satu block null byte lalu decrypt null byte + enc(null byte) -> otomatis bakal melakukan xor null byte dengan hasil decrypt null byte ( harusnya di xor dengan iv biar null byte hasilnya , tapi malah di xor dengan null byte jadinya dapat iv ). Yang kedua ada ini baru sadar setelah coba coba running filenya + debug nilainya , ternyata hasil enkripsi flag di padding , jadi kita tau nilai akhir dari flag hasil padding , yaitu “\x10”*16 . Jadi tinggal balik aja prosesnya
berikut solver yang kami gunakan
Flag : COMPFEST13{Y0u_aes_me_Uppppppp_____t0_c0dE_on_st0rmy_Seaaaas____e0212d1a34}
s = p2 + 2pq + q2
b = (p2 + 2pq + q2 - q(2p + q))*r
b = (p2 + 2pq + q2 - 2pq - q2)*r
b = p2r + 2pqr + q2r - 2pqr - q2r
b = p2r
n = p*q
from Crypto.Util.number import *
import gmpy2
b = 1443061772954701335732136128869248910288995712185482317126411260349775148932784597588115548780067761993841192961205698418501468762734686695975550561598140253475710348439640002745286347562
n = 121789376487960809489253386587170686658768726657045553214623415992384832614485249137256874454267032401365173859563210814953487893574413409932117585950570225259024509903129746392143101
p = gmpy2.gcd(b,n)
q = n/p
r = b/p**2
e = 0x10001
enc = [95844532553991737600355244654272099305361975575150371319709729091243030203575898742071987199800250922501746626433985253038713853151746857514762678605619742310839669559545627531098676, 42098262117872607180245376226279234844537189667792611290978137770131205295202393318329675438677406769928295941768074280915365884838027414974072838410934952571392616562898636004189303, 8604504123043858588289398284978073629384165878986588408956445422750740896636700840713408309772547146776823067482307495576552057400894861616123713400577813256614795674220942022738198, 66896916235028791010554130879834163456721897024453929564151545727202320039792487273512943832159287883050106923587075192390665897004465138382234040927275478139131450371794658563343368, 88176130128782413821390318550151008388570132120182664342566671328546119423517817326934034720909238554168653863093116429325532932401977519369212892117707167802400008407395125896733332, 42250039274640778630603717605163827961176577828564055370588929192401015587247485151024369147022833032549004175634147831360114651662490704138925606397505368573040950634048151235675964, 106267843822546752528780879737401351948170741446817769684516569656816005147897267321452764634553751488085440938706773625287154372645991244141121226180609731226228509942129690482744498, 7344462713592491879813960159075800353984094813742489003735150623847056840460595091048879286634691169764793649426176975158414555454778075430233699780146900520609629142406422725693811, 68155732896092345896827379516624133280166986984023541993085330906321960888421556683672078055376548346464764100036149614632795220030187229733989823788323988946361921828069707823065198, 2456638129741631242062051214133833843357605035108383884677777076160879939756985403557604264648903511528401478876871578775440101482814072714355366084122429853207060638683606389504551, 99671982271645788903414016384550975165361965345980177928115018027271173062935625698434769263846972984813377601618481025600240081090732166957299336765744471217496851539810214590361856]
phi = (p-1)*(q-1)
d = inverse(e,phi)
flag = ""
for i in enc:
flag += long_to_bytes(pow(i,d,n)/r)
print flag
#Snab says good job! But you're not done yet
flag = findme
halfa = ''.join([flag[i] for i in range (0, len(flag), 2)])
halfb = ''.join([flag[i] for i in range (1, len(flag), 2)]
p = bytes_to_long(bytes(halfa, encoding = 'utf-8'))
q = bytes_to_long(bytes(halfb, encoding = 'utf-8'))
r = 0
while (not(isPrime(p) and isPrime(q))):
p += 1
q += 1
r += 1
from Crypto.Util.number import *
import gmpy2
b = 1443061772954701335732136128869248910288995712185482317126411260349775148932784597588115548780067761993841192961205698418501468762734686695975550561598140253475710348439640002745286347562
n = 121789376487960809489253386587170686658768726657045553214623415992384832614485249137256874454267032401365173859563210814953487893574413409932117585950570225259024509903129746392143101
p = gmpy2.gcd(b,n)
q = n/p
r = b/p**2
e = 0x10001
enc = [95844532553991737600355244654272099305361975575150371319709729091243030203575898742071987199800250922501746626433985253038713853151746857514762678605619742310839669559545627531098676, 42098262117872607180245376226279234844537189667792611290978137770131205295202393318329675438677406769928295941768074280915365884838027414974072838410934952571392616562898636004189303, 8604504123043858588289398284978073629384165878986588408956445422750740896636700840713408309772547146776823067482307495576552057400894861616123713400577813256614795674220942022738198, 66896916235028791010554130879834163456721897024453929564151545727202320039792487273512943832159287883050106923587075192390665897004465138382234040927275478139131450371794658563343368, 88176130128782413821390318550151008388570132120182664342566671328546119423517817326934034720909238554168653863093116429325532932401977519369212892117707167802400008407395125896733332, 42250039274640778630603717605163827961176577828564055370588929192401015587247485151024369147022833032549004175634147831360114651662490704138925606397505368573040950634048151235675964, 106267843822546752528780879737401351948170741446817769684516569656816005147897267321452764634553751488085440938706773625287154372645991244141121226180609731226228509942129690482744498, 7344462713592491879813960159075800353984094813742489003735150623847056840460595091048879286634691169764793649426176975158414555454778075430233699780146900520609629142406422725693811, 68155732896092345896827379516624133280166986984023541993085330906321960888421556683672078055376548346464764100036149614632795220030187229733989823788323988946361921828069707823065198, 2456638129741631242062051214133833843357605035108383884677777076160879939756985403557604264648903511528401478876871578775440101482814072714355366084122429853207060638683606389504551, 99671982271645788903414016384550975165361965345980177928115018027271173062935625698434769263846972984813377601618481025600240081090732166957299336765744471217496851539810214590361856]
phi = (p-1)*(q-1)
d = inverse(e,phi)
flag = ""
for i in enc:
flag += long_to_bytes(pow(i,d,n)/r)
a = long_to_bytes(p-r)
b = long_to_bytes(q-r)
res = ""
for i in range(len(a)):
res += a[i]
res += b[i]
print res
#!/usr/bin/env python3
import sys
from base64 import b64encode, b64decode
from Crypto.Util.number import getPrime, bytes_to_long as bl, long_to_bytes as lb
from secrets import Alice, Bob
from chats import alice_dialogue, bob_dialogue
import time
class Unbuffered(object):
def __init__(self, stream):
self.stream = stream
def write(self, data):
self.stream.write(data)
self.stream.flush()
def writelines(self, datas):
self.stream.writelines(datas)
self.stream.flush()
def __getattr__(self, attr):
return getattr(self.stream, attr)
sys.stdout = Unbuffered(sys.stdout)
try:
g = bl(b64decode(input('g: ')))
assert g > 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF
p = getPrime(512)
alice = Alice()
bob = Bob()
alice_public_part = alice.make_public_part(g, p)
bob_public_part = bob.make_public_part(g, p)
alice.make_private_part(bob_public_part, p)
bob.make_private_part(alice_public_part, p)
print('p:', p)
print('Alice\'s public part:', b64encode(lb(alice_public_part)).decode())
#print('Bob\'s public part:', b64encode(lb(bob_public_part)).decode()) # Bob doesn't want to share it to you :(
print()
assert len(alice_dialogue) == len(bob_dialogue)
while True:
for i in range(len(alice_dialogue)):
print('Messages from Alice:')
msg = alice.send_message(alice_dialogue[i])
print(b64encode(msg).decode())
print(bob.receive_message(msg))
print()
time.sleep(0.5)
print('Messages from Bob:')
msg = bob.send_message(bob_dialogue[i])
print(b64encode(msg).decode())
print(alice.receive_message(msg))
print()
time.sleep(0.5)
except:
print('Something is wrong.')
exit(0)
#!/usr/bin/env python3
from Crypto.Util.number import bytes_to_long as bl, long_to_bytes as lb
from Crypto.Cipher import AES
import os
import random
import string
sp = list(map(ord, list(string.printable)))
def pad(msg):
pad_length = random.randint(20, 100)
for i in range(pad_length):
c = random.randint(0, 255)
while c in sp:
c = random.randint(0, 255)
pos = random.randint(0, len(msg) - 1)
msg = msg[:pos] + chr(c).encode() + msg[pos:]
while True:
c = random.randint(0, 255)
while c in sp:
c = random.randint(0, 255)
pos = random.randint(0, len(msg) - 1)
msg = msg[:pos] + chr(c).encode() + msg[pos:]
if (len(msg) % 16 == 0):
break
return msg
class Person:
def make_public_part(self, g, p):
return pow(g, self.secret, p)
def make_private_part(self, gx, p):
self.key = pow(gx, self.secret, p) % 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF
self.key = lb(self.key)
while (len(self.key) != 16):
self.key += b'\x01'
return self.key
def send_message(self, msg):
iv = os.urandom(16)
cipher = AES.new(self.key, AES.MODE_CBC, iv)
enc = iv + cipher.encrypt(pad(msg))
return enc
def receive_message(self, enc_message):
try:
iv = enc_message[:16]
enc = enc_message[16:]
cipher = AES.new(self.key, AES.MODE_CBC, iv)
msg = cipher.decrypt(enc)
return 'Message received!'
except:
return 'Message not received!'
class Alice(Person):
def __init__(self):
self.secret = 0 # REDACTED
class Bob(Person):
def __init__(self):
self.secret = 0 # REDACTED
assert 2 < self.secret < 100
class You(Person):
def __init__(self, secret):
self.secret = secret
from Crypto.Util.number import *
import base64
from Crypto.Cipher import AES
import string
from pwn import *
def decrypt(enc,key,iv):
cipher = AES.new(key, AES.MODE_CBC, iv)
msg = cipher.decrypt(enc)
return msg
sp = list(string.printable)
g = 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF+1
r = remote("103.152.242.242",1457)
# r = process("./alice-bob.py")
r.recvuntil("g: ")
r.sendline(base64.b64encode(long_to_bytes(g)))
r.recvuntil("p: ")
p = int(r.recvline().strip())
r.recvuntil("public part: ")
alice_pub = r.recvline().strip()
a_pub = bytes_to_long(base64.b64decode(alice_pub))
list_msg = []
for i in range(40):
# print(i)
r.recvuntil("Alice:\n")
list_msg.append(base64.b64decode(r.recvline().strip()))
r.recvuntil("Bob:\n")
list_msg.append(base64.b64decode(r.recvline().strip()))
r.close()
# print(list_msg)
hmm = []
for msg in list_msg[:1]:
for k in range(3,101):
ss = pow(a_pub, k, p) % 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF
key = long_to_bytes(ss)
while (len(key) != 16):
key += '\x01'
tmp = decrypt(msg[16:],key,msg[:16])
flag = ""
for i in tmp:
if(i in sp):
flag += i
if(flag=='87d&'):
break
flag = []
for msg in list_msg:
tmp = decrypt(msg[16:],key,msg[:16])
tmp2 = ""
for i in tmp:
if(i in sp):
tmp2 += i
flag.append(tmp2)
print(flag)
# print(list_msg)
#!/usr/bin/env python3
import sys
import os
import random
import binascii
from Crypto.Cipher import AES
from Crypto.Util.number import long_to_bytes, bytes_to_long
from secret import FLAG
IV = os.urandom(AES.block_size)
KEY = os.urandom(AES.block_size)
class Unbuffered(object):
def __init__(self, stream):
self.stream = stream
def write(self, data):
self.stream.write(data)
self.stream.flush()
def writelines(self, datas):
self.stream.writelines(datas)
self.stream.flush()
def __getattr__(self, attr):
return getattr(self.stream, attr)
sys.stdout = Unbuffered(sys.stdout)
def pad(msg):
return msg + (chr(16 - len(msg) % 16) * (16 - len(msg) % 16)).encode()
def get_flag():
flag = pad(FLAG)
cipher = AES.new(IV, AES.MODE_ECB)
flag = cipher.encrypt(flag)
enc = b''
flag = pad(flag)
iv = IV
for i in range(0, len(flag), 16):
cipher = AES.new(KEY, AES.MODE_CBC, iv)
enc += cipher.encrypt(flag[i:i+16])
iv = long_to_bytes(bytes_to_long(enc[i:i+16]) ^ bytes_to_long(flag[i:i+16]))
print('flag (in hex) =', binascii.hexlify(enc).decode())
def encrypt():
msg = input('msg (in hex) = ')
if (len(msg) % 2 != 0):
print('Invalid input!')
return
msg = binascii.unhexlify(msg.encode())
cipher = AES.new(KEY, AES.MODE_CBC, IV)
enc = cipher.encrypt(pad(msg))
print('enc (in hex) =', binascii.hexlify(enc).decode())
def decrypt():
enc = input('enc (in hex) = ')
if (len(enc) % 32 != 0):
print('Invalid input!')
return
enc = binascii.unhexlify(enc.encode())
cipher = AES.new(KEY, AES.MODE_CBC, IV)
msg = cipher.decrypt(enc)
print('msg (in hex) =', binascii.hexlify(msg).decode())
def menu():
print('1. Get encrypted flag')
print('2. Encrypt a message')
print('3. Decrypt a message')
print('4. Exit')
if __name__ == '__main__':
while True:
try:
menu()
choice = input('> ')
if choice == '1':
get_flag()
elif (choice == '2'):
encrypt()
elif (choice == '3'):
decrypt()
elif (choice == '4'):
print('Bye.')
break
else:
print('Invalid input!')
except:
print('Something went wrong.')
break
Block = block[::1] Urutan block dibalik
dec(enc(block[i]),iv)^iv -> biar dapet nilai asli dari dec (tanpa xor iv)
dec(enc(block[i]),iv)^iv^known_plain -> dapet nilai iv yang digunain buat encrypt di looping ke-i
dec(enc(block[i]),iv)^iv^known_plain^block[i+1] -> dapet plaintext ( value flag )
from Crypto.Util.strxor import strxor
from pwn import *
from Crypto.Cipher import AES
r = remote("103.152.242.242",5592)
r.recvuntil(">")
r.sendline("2")
r.recvuntil(" = ")
r.sendline("00"*16)
r.recvuntil(" = ")
leak_enc = r.recvline().strip()
r.recvuntil(">")
r.sendline("3")
r.recvuntil(" = ")
r.sendline("00"*16+leak_enc)
r.recvuntil(" = ")
tmp = r.recvline().strip()
iv = tmp[32:64].decode('hex')
# print(iv)
r.sendline("1")
r.recvuntil(" = ")
enc_flag = r.recvline().strip()
list_enc = []
for i in range(0,len(enc_flag),32):
list_enc.append(enc_flag[i:i+32])
known_plain = "10101010101010101010101010101010".decode('hex')
list_enc = list_enc[::-1]
list_flag = []
for i in range(len(list_enc)-1):
r.recvuntil(">")
r.sendline("3")
r.recvuntil(" = ")
r.sendline(list_enc[i])
r.recvuntil(" = ")
tmp_dec = r.recvline().strip()
tmp_dec = tmp_dec.decode('hex')
tmp_iv = strxor(strxor(known_plain,tmp_dec),iv)
known_plain = strxor(tmp_iv,list_enc[i+1].decode('hex'))
list_flag.append(known_plain)
cipher = AES.new(iv, AES.MODE_ECB)
res = ""
for i in list_flag[::-1]:
res += cipher.decrypt(i)
print res
