from pwn import *import stringimport hashlibcontext.log_level = 'debug'sh = remote("39.96.90.217","17497")sh.recvuntil("x[:20] = ")pa = sh.recv(len('f91a551dfa31e47458df'))sh.recvuntil('openssl_sha')fun = sh.recvuntil(">")[:-1]sh.recvuntil("> ")table = string.printabledef getpow(fun,mess):    for i in table:        for j in table:            for k in table:                for l in table:                    password=i+j+k+l                    if fun == "256":                        if hashlib.sha256(password.encode()).hexdigest()[:20] == mess:                            return i+j+k+l                    elif fun == "384":                        if hashlib.sha384(password.encode()).hexdigest()[:20] == mess:                            return i+j+k+l                    elif fun == "1":                        if hashlib.sha1(password.encode()).hexdigest()[:20] == mess:                            return i+j+k+l                    elif fun == "512":                        if hashlib.sha512(password.encode()).hexdigest()[:20] == mess:                            return i+j+k+l                    elif fun == "224":                        if hashlib.sha224(password.encode()).hexdigest()[:20] == mess:                            return i+j+k+l                    else:                        print(fun)    else:        print("no ans")sh.sendline(getpow(fun,pa))sh.interactive()

from Crypto.Util.number import *limit = lambda n: n & 0xffffffffkey = '\x88\x91\x89\x80\x88\xb1\x97\xa0\xbf\xa7\x81\x99\xb2\x81\x95\xbf\xae\x89'def init(key):    Key  = [ord(i) for i in key]    #Data = [ord(i) for i in data]    a = limit((Key[0] << 24) | (Key[1] << 16) | (Key[2] << 8) | Key[3])    b = limit((Key[4] << 24) | (Key[5] << 16) | (Key[6] << 8) | Key[7])    c = limit((Key[8] << 24) | (Key[9] << 16) | (Key[10] << 8) | Key[11])    d = limit((Key[12] << 24) | (Key[13] << 16) | (Key[14] << 8) | Key[15])    return (a,b,c,d)    #y = limit((Data[0] << 24) | (Data[1] << 16) | (Data[2] << 8) | Data[3])    #z = limit((Data[4] << 24) | (Data[5] << 16) | (Data[6] << 8) | Data[7])(a,b,c,d)=init(key)ans = 0x9d98a72f5c82c26680a65def check(s):    for i in s:        if i not in "flag{0123456789bcde-_}\x00":            return False    return Truefor ans in [0xcf4add0cf5469a49d19c,0xcccd38faa373af5059b5f,0xad0e355d4d8b1cc9771d1,0x703ccca78d36e770d0613,0x54e05275b03e2cdedc053]:    for h in range(2**6):        for l in range(2**8):            y = ans >> 52#取y            mix = ans & (2**52-1)#剩下的为不确定z和pad混合            pads_true = mix >> 32#拿到pad的有效的20位            source_pad = (h<<27)| (pads_true<<7)| l#爆破pad            z = limit(mix ^ (source_pad<<25))#根据猜的pad，然后mix中pad和z的混合部分，确定z            for round in range(32):                pads = limit(source_pad*(32-round))#根据encode来用pads                z = limit( z - ((y*16 + c) ^ (y + pads) ^ ((y>>5) + d)))#加密函数反一下                y = limit( y - ((z*16 + a) ^ (z + pads) ^ ((z>>5) + b)))            flag = (y<<32)+z            #print flag            if check(long_to_bytes(flag)):#根据flag的可能字符来判断咯                print(long_to_bytes(flag))

import randomclass MT19937Recover:    """Reverses the Mersenne Twister based on 624 observed outputs.    The internal state of a Mersenne Twister can be recovered by observing    624 generated outputs of it. However, if those are not directly    observed following a twist, another output is required to restore the    internal index.    See also https://en.wikipedia.org/wiki/Mersenne_Twister#Pseudocode .    """    def unshiftRight(self, x, shift):        res = x        for i in range(32):            res = x ^ res >> shift        return res    def unshiftLeft(self, x, shift, mask):        res = x        for i in range(32):            res = x ^ (res << shift & mask)        return res    def untemper(self, v):        """ Reverses the tempering which is applied to outputs of MT19937 """        v = self.unshiftRight(v, 18)        v = self.unshiftLeft(v, 15, 0xefc60000)        v = self.unshiftLeft(v, 7, 0x9d2c5680)        v = self.unshiftRight(v, 11)        return v    def go(self, outputs, forward=True):        """Reverses the Mersenne Twister based on 624 observed values.        Args:            outputs (List[int]): list of >= 624 observed outputs from the PRNG.                However, >= 625 outputs are required to correctly recover                the internal index.            forward (bool): Forward internal state until all observed outputs                are generated.        Returns:            Returns a random.Random() object.        """        result_state = None        assert len(outputs) >= 624       # need at least 624 values        ivals = []        for i in range(624):            ivals.append(self.untemper(outputs[i]))        if len(outputs) >= 625:            # We have additional outputs and can correctly            # recover the internal index by bruteforce            challenge = outputs[624]            for i in range(1, 626):                state = (3, tuple(ivals+[i]), None)                r = random.Random()                r.setstate(state)                if challenge == r.getrandbits(32):                    result_state = state                    break        else:            # With only 624 outputs we assume they were the first observed 624            # outputs after a twist -->  we set the internal index to 624.            result_state = (3, tuple(ivals+[624]), None)        rand = random.Random()        rand.setstate(result_state)        if forward:            for i in range(624, len(outputs)):                assert rand.getrandbits(32) == outputs[i]        return randdef test_PythonMT19937Recover():    """Just a testcase to ensure correctness"""    mtb = MT19937Recover()    #r1 = random.Random(0x31337)    # just some discarded random numbers to move internal state forward    #[r1.getrandbits(32) for _ in range(1234)]    # the actual leak of 1000 values    #n = [r1.getrandbits(32) for _ in range(1000)]    with open ("random") as f:        nn= f.read().split("\n")        print(nn)        n = [int(_) for _ in nn[:-1]]    r2 = mtb.go(n)    print (r2.getrandbits(32))    #assert r1.getrandbits(32) == r2.getrandbits(32)test_PythonMT19937Recover()

# -*- coding: utf-8 -*-import base64import randomflag = "flag{************************************}"hexadecimalcontrast = {    '0': '0000',    '1': '0001',    '2': '0010',    '3': '0011',    '4': '0100',    '5': '0101',    '6': '0110',    '7': '0111',    '8': '1000',    '9': '1001',    'a': '1010',    'b': '1011',    'c': '1100',    'd': '1101',    'e': '1110',    'f': '1111',}IP = [58, 50, 42, 34, 26, 18, 10, 2,      60, 52, 44, 36, 28, 20, 12, 4,      62, 54, 46, 38, 30, 22, 14, 6,      64, 56, 48, 40, 32, 24, 16, 8,      57, 49, 41, 33, 25, 17, 9, 1,      59, 51, 43, 35, 27, 19, 11, 3,      61, 53, 45, 37, 29, 21, 13, 5,      63, 55, 47, 39, 31, 23, 15, 7]IP_1 = [40, 8, 48, 16, 56, 24, 64, 32,        39, 7, 47, 15, 55, 23, 63, 31,        38, 6, 46, 14, 54, 22, 62, 30,        37, 5, 45, 13, 53, 21, 61, 29,        36, 4, 44, 12, 52, 20, 60, 28,        35, 3, 43, 11, 51, 19, 59, 27,        34, 2, 42, 10, 50, 18, 58, 26,        33, 1, 41, 9, 49, 17, 57, 25]E = [32, 1, 2, 3, 4, 5,     4, 5, 6, 7, 8, 9,     8, 9, 10, 11, 12, 13,     12, 13, 14, 15, 16, 17,     16, 17, 18, 19, 20, 21,     20, 21, 22, 23, 24, 25,     24, 25, 26, 27, 28, 29,     28, 29, 30, 31, 32, 1]S = [[15, 1, 8, 14, 6, 11, 3, 4, 9, 7, 2, 13, 12, 0, 5, 10,      3, 13, 4, 7, 15, 2, 8, 14, 12, 0, 1, 10, 6, 9, 11, 5,      0, 14, 7, 11, 10, 4, 13, 1, 5, 8, 12, 6, 9, 3, 2, 15,      13, 8, 10, 1, 3, 15, 4, 2, 11, 6, 7, 12, 0, 5, 14, 9, ],     [10, 0, 9, 14, 6, 3, 15, 5, 1, 13, 12, 7, 11, 4, 2, 8,      13, 7, 0, 9, 3, 4, 6, 10, 2, 8, 5, 14, 12, 11, 15, 1,      13, 6, 4, 9, 8, 15, 3, 0, 11, 1, 2, 12, 5, 10, 14, 7,      1, 10, 13, 0, 6, 9, 8, 7, 4, 15, 14, 3, 11, 5, 2, 12, ],     [14, 4, 13, 1, 2, 15, 11, 8, 3, 10, 6, 12, 5, 9, 0, 7,      0, 15, 7, 4, 14, 2, 13, 1, 10, 6, 12, 11, 9, 5, 3, 8,      4, 1, 14, 8, 13, 6, 2, 11, 15, 12, 9, 7, 3, 10, 5, 0,      15, 12, 8, 2, 4, 9, 1, 7, 5, 11, 3, 14, 10, 0, 6, 13, ],     [7, 13, 14, 3, 0, 6, 9, 10, 1, 2, 8, 5, 11, 12, 4, 15,      13, 8, 11, 5, 6, 15, 0, 3, 4, 7, 2, 12, 1, 10, 14, 9,      10, 6, 9, 0, 12, 11, 7, 13, 15, 1, 3, 14, 5, 2, 8, 4,      3, 15, 0, 6, 10, 1, 13, 8, 9, 4, 5, 11, 12, 7, 2, 14, ],     [2, 12, 4, 1, 7, 10, 11, 6, 8, 5, 3, 15, 13, 0, 14, 9,      14, 11, 2, 12, 4, 7, 13, 1, 5, 0, 15, 10, 3, 9, 8, 6,      4, 2, 1, 11, 10, 13, 7, 8, 15, 9, 12, 5, 6, 3, 0, 14,      11, 8, 12, 7, 1, 14, 2, 13, 6, 15, 0, 9, 10, 4, 5, 3, ],     [12, 1, 10, 15, 9, 2, 6, 8, 0, 13, 3, 4, 14, 7, 5, 11,      10, 15, 4, 2, 7, 12, 9, 5, 6, 1, 13, 14, 0, 11, 3, 8,      9, 14, 15, 5, 2, 8, 12, 3, 7, 0, 4, 10, 1, 13, 11, 6,      4, 3, 2, 12, 9, 5, 15, 10, 11, 14, 1, 7, 6, 0, 8, 13, ],     [4, 11, 2, 14, 15, 0, 8, 13, 3, 12, 9, 7, 5, 10, 6, 1,      13, 0, 11, 7, 4, 9, 1, 10, 14, 3, 5, 12, 2, 15, 8, 6,      1, 4, 11, 13, 12, 3, 7, 14, 10, 15, 6, 8, 0, 5, 9, 2,      6, 11, 13, 8, 1, 4, 10, 7, 9, 5, 0, 15, 14, 2, 3, 12, ],     [13, 2, 8, 4, 6, 15, 11, 1, 10, 9, 3, 14, 5, 0, 12, 7,      1, 15, 13, 8, 10, 3, 7, 4, 12, 5, 6, 11, 0, 14, 9, 2,      7, 11, 4, 1, 9, 12, 14, 2, 0, 6, 10, 13, 15, 3, 5, 8,      2, 1, 14, 7, 4, 10, 8, 13, 15, 12, 9, 0, 3, 5, 6, 11, ]]PC_1 = [57, 49, 41, 33, 25, 17, 9, 1,        58, 50, 42, 34, 26, 18, 10, 2,        59, 51, 43, 35, 27, 19, 11, 3,        60, 52, 44, 36, 63, 55, 47, 39,        31, 23, 15, 7, 62, 54, 46, 38,        30, 22, 14, 6, 61, 53, 45, 37,        29, 21, 13, 5, 28, 20, 12, 4, ]PC_2 = [14, 17, 11, 24, 1, 5, 3, 28,        15, 6, 21, 10, 23, 19, 12, 4,        26, 8, 16, 7, 27, 20, 13, 2,        41, 52, 31, 37, 47, 55, 30, 40,        51, 45, 33, 48, 44, 49, 39, 56,        34, 53, 46, 42, 50, 36, 29, 32, ]P = [16, 7, 20, 21,     29, 12, 28, 17,     1, 15, 23, 26,     5, 18, 31, 10,     2, 8, 24, 14,     32, 27, 3, 9,     19, 13, 30, 6,     22, 11, 4, 25, ]movnum = [1, 1, 2, 2, 2, 2, 2, 2, 1, 2, 2, 2, 2, 2, 2, 1]def HexToBin(string):    "Convert sixteen to binary"    Binstring = ""    string = string.lower()    for i in string:        try:            Binstring += hexadecimalcontrast[i]        except:            return -1    return Binstringdef BinToStr(strbin):    "Turn the binary string to a ASCII string"    strten = ""    for i in range(len(strbin) // 8):        num = 0        test = strbin[i * 8:i * 8 + 8]        for j in range(8):            num += int(test[j]) * (2**(7 - j))        strten += chr(num)    return strtendef StrToHex(string):    "Converts a string to HEX"    hexStr = ''    for i in string:        tmp = str(hex(ord(i)))        if len(tmp) == 3:            hexStr += tmp.replace('0x', '0')        else:            hexStr += tmp.replace('0x', '')    return hexStrdef Binxor(string1, string2):    "If the length is different, only the short one is returned."    strlen = 0    xorstr = ""    if len(string1) > len(string2):        strlen = len(string2)    else:        strlen = len(string1)    for i in range(strlen):        if string1[i] == string2[i]:            xorstr += '0'        else:            xorstr += '1'    return xorstrdef SubstitutionBox(keyfield, sub):    newkeyfield = ''    for i in range(len(sub)):        newkeyfield += keyfield[sub[i] - 1]    return newkeyfielddef SubkeyGeneration(freq, C, D):    for i in range(movnum[freq]):        C = C[1:] + C[:1]        D = D[1:] + D[:1]    return C, D, SubstitutionBox(C + D, PC_2)def enkey(secretkey):     netss = SubstitutionBox(HexToBin(StrToHex(secretkey)), PC_1)    C, D = netss[:28], netss[28:]    key = []    for i in range(16):         C, D, keyone = SubkeyGeneration(i, C, D)        key.append(keyone)    return keydef Sbox(plaintext, sub):    return HexToBin("%x" % S[sub][int(plaintext[:1] + plaintext[-1:], 2) * 16 + int(plaintext[1:-1], 2)])def Function(plaintext, secretkey):    plaintext = Binxor(SubstitutionBox(plaintext, E),                       secretkey)    sout = ''    for i in range(8):        sout += Sbox(plaintext[i * 6:(i + 1) * 6], i)    sout = SubstitutionBox(sout, P)    return soutdef endecrypt(plaintext, secretkey):    netss = SubstitutionBox(HexToBin(StrToHex(plaintext)), IP)    L, R = netss[:32], netss[32:]    for i in range(16):        L, R = R, Binxor(L, Function(R, secretkey[i]))    return SubstitutionBox(R + L, IP_1)def encryption(plaintext, secretkey):    plaintext = plaintext + (8 - len(plaintext) % 8) * '\0'    keys = enkey(secretkey[:8])    print(keys)    ciphertext = ''    for i in range(len(plaintext) / 8):        ciphertext += endecrypt(plaintext[i * 8:(i + 1) * 8], keys)    return base64.b64encode(BinToStr(ciphertext))def decryption(plaintext, secretkey):    plaintext = "t2GzuEfVDaJsNLBqC8N7C3/2UgIeCoQLC2qLkT1ukFULskzMc1u9QeFizVUfFYfA"    plaintext = base64.b64decode(plaintext)    print plaintext    keys = enkey(secretkey[:8])[::-1]    #print(keys)    ciphertext = ''    for i in range(len(plaintext) / 8):        ciphertext += endecrypt(plaintext[i * 8:(i + 1) * 8], keys)    return (BinToStr(ciphertext))def generate():    fw = open("random", "w")    for i in range(700):        fw.write(str(random.getrandbits(32))+"\n")    fw.close()generate()f = open("flag.txt", "r")key = str(random.getrandbits(32))key = '2990136190'ciphertext = decryption(flag, key)print ciphertext

from Crypto.Util.number import inverseflag = ''.join(i if i not in "qwertyuiopasdfghjklzxcvbnm" else chr(((ord(i)-ord('a') - 321564))*inverse(123456,13)%13+ord('a')) for i in 'kgws{m8u8cm65-ue9k-44k5-8361-we225m76eeww}')print(flag)

import binascii,gmpy2def CRT(mi, ai):    assert(reduce(gmpy2.gcd,mi)==1)    assert (isinstance(mi, list) and isinstance(ai, list))    M = reduce(lambda x, y: x * y, mi)    ai_ti_Mi = [a * (M / m) * gmpy2.invert(M / m, m) for (m, a) in zip(mi, ai)]    return reduce(lambda x, y: x + y, ai_ti_Mi) % Mfor e in range(1,20):    try:        m=gmpy2.iroot(CRT([n1,n2,n3], [c1,c2,c3]), e)[0]        print(binascii.unhexlify(hex(m)[2:].strip("L")))    except:        pass

# -*- coding: utf-8 -*-from Crypto.Util.number import long_to_bytes,bytes_to_long,inversefrom pwn import *context.log_level = 'debug'def gcd(a, b):    while b:        a, b = b, a%b    return adef crack_unknown_increment(states, modulus, multiplier):    """    利用伪随机序列s,模数n,乘数m，恢复增数c    states:伪随机数序列s    modulus:模数n，    multiplier:乘数m    increment：增量c    return:根据n,m,s0,s1恢复c，并返回    """    increment = (states[1] - states[0]*multiplier) % modulus    return modulus, multiplier, incrementdef crack_unknown_multiplier(states, modulus):    """    利用伪随机序列s和模数n，恢复乘数m    states:伪随机数序列s    modulus:模数n，    multiplier:乘数m    return:根据n,s0,s1,s2恢复m，然后利用crack_unknown_increment恢复c    """    multiplier = (states[2] - states[1]) * inverse(states[1] - states[0], modulus) % modulus    return crack_unknown_increment(states, modulus, multiplier)def crack_unknown_modulus(states):    """    利用初值和随后LCG产生的连续的几个值,恢复模数n    modulus:模数n    states:伪随机数序列s    diffs:相邻随机数s的差值：t序列              zeroes:与t系列有关的差值，zeroes = t2*t0 - t1*t1,t0,t1,t2相邻    return:根据n,s0,s1,s2恢复m，然后利用crack_unknown_increment恢复c    """    diffs = [s1 - s0 for s0, s1 in zip(states, states[1:])]    zeroes = [t2*t0 - t1*t1 for t0, t1, t2 in zip(diffs, diffs[1:], diffs[2:])]    modulus = abs(reduce(gcd, zeroes))    return crack_unknown_multiplier(states, modulus)def lcg(seed,params):    """    LCG算法    params:(multiplier,increment,modulus)    seed:伪随机序列中第一个值s0    return：返回一个迭代器，其中的值是私钥序列    """    (m,c,n)=params    x = seed % n    yield int(x)    while True:        x = (m * x + c) % n        yield int(x)def decode(pri,pub,c,p):        """    ElGamal解密算法    pri:一方私钥    pub:另一方公钥    sharekey:双方协商密钥    c:密文    p:模数    m:明文    return:返回明文字符    """    sharekey = pow(pub,pri,p)    m=long_to_bytes(c*inverse(sharekey,p)%p)    return mclass Game:    def __init__(self, n, key, r, b):        self.n = n#40        self.key = key         self.r = r & (2 ** self.n - 1)        self.b = b#8    def out(self):        o = self.r & 1        p = self.r & self.key        q = 0        while p:            q = q + p & 1            p = p >> 1        q = q & 1        t = q << (self.n - 2) & (2 ** self.n - 1)        self.r = t | (self.r >> 1) & (2 ** self.n - 1)        return o    def next(self):        res = 0        for i in range(self.b):            o = self.out()            res |=  o << (self.b - 1 - i)        return resdef getr(s):    r = ''    for i in s:        b = bin(i)[2:].rjust(8,'0')        for each in b:            r = each+r    print int(r,2)    return int(r,2)def getk(s):    k=""    for i in s:        b = bin(i)[2:].rjust(8,'0')        for each in b:            k += each    return ksh = remote('59.110.243.101','5123')sh.recvuntil("Your choice:\n")sh.sendline("2")sh.recvuntil("Baby:")Baby = sh.recvuntil("\n")[:-1]sh.recvuntil("Easy:")Easy = sh.recvuntil("\n")[:-1]sh.recvuntil("Normal:")Normal = sh.recvuntil("\n")[:-1]sh.recvuntil("Hard:")Hard = sh.recvuntil("\n")[:-1]sh.recvuntil("Master:")Master = sh.recvuntil("\n")[:-1]sh.recvuntil("Crazy:")Crazy = sh.recvuntil("\n")[:-1]pri=[Baby,Easy,Normal,Hard,Master,Crazy](n,m,c)=crack_unknown_modulus([int(each) for each in pri])x=int(pri[0])key = lcg(x,(m,c,n))for _ in range(6):    next(key)choice = next(key)sh.recvuntil("Input the level code:\n")sh.sendline(str(choice))sh.recvuntil("Your choice:\n")sh.sendline("1")#flag=""s=[]F = 0for _ in range(9):    sh.recvuntil("Input your answer:\n")    sh.sendline("0")    ans = sh.recvuntil("The answer is ")    if 'Right' in ans:        F = 1        print("NICE")    s.append(int(sh.recvuntil("!")[:-1]))if F == 1:    sh.recvuntil("Input your answer:\n")    sh.sendline("0")    ans = sh.recvuntil("The answer is ")    s.append(int(sh.recvuntil("!")[:-1]))r = getr(s[:5])output = getk(s[:])print "r:"+str(r)print "output:"+ outputprint sk = input("k:")game = Game(40,k,r,8)for _ in range(10):    next(game)for _ in range(500):    sh.recvuntil("Input your answer:\n")    sh.sendline(str(next(game)))sh.interactive()[DEBUG] Received 0x3f bytes:    'Your coin: 500\n'    'You Win!\n'    'flag{12727f129b72e685388c6a67538ee9b0}\n'

# -*- coding: utf8 -*-from Crypto.PublicKey import RSAfrom Crypto.Util.number import *import rewith open('data.txt') as f:    data = f.read()ms = re.findall("{'a': 1, 'b': (.*?)L}",data)c = re.findall("flag:(.*)",data)m1 = b'-----BEGIN RSA PRIVATE KEY-----\\nMIICXAIB'es = int(ms[0])-bytes_to_long(m1)print espri=""for i in ms:    pri = pri + long_to_bytes(int(i)-es)print pripri = RSA.importKey(pri.replace("\\"",""))print(long_to_bytes(pow(int(c[0]),pri.d,pri.n)))

from os import urandom as uafrom Crypto.Util.number import *magic=32805def calc(m,p):    res=0    lens=hlen(p)    for i in bin(m)[2:]:        res*=2        res^=m if i=='1' else 0        res^=p if hlen(res) == lens else 0    return resdef check(s):    for i in s:        if i not in "flag{0123456789bcde-_}\x00":            return False    return Trueflags=[3723147309,8016759097521062564,267529443716352603115102819467183104162,110068498753042154535753131190467876514149603112955078214309283006458454378660]FLAG=""r = 2for flag in flags:    r*=2    while True:        flag=calc(flag,magic + (1<<r*8))        if check(long_to_bytes(flag)[:10]):            FLAG+=(long_to_bytes(flag))            print FLAG            break