0x01 前言

这次比赛感觉打得并不好,密码就出了一题。。。。还是菜了,继续加油吧。

0x02 FlowerCipher

题目源码:

# python3

from secret import flag
import random

# flag = b'flag{%s}' % md5(something).hexdigest()
# note that md5 only have characters 'abcdef' and digits

def Flower(x, key):
    flower = random.randint(0, 4096)
    return x * (key ** 3 + flower)

flag = flag[5:-1]
rounds = len(flag)

L, R = 1, 0
for i in range(rounds):
    L, R = R + Flower(L, flag[i]), L

print(L, R)
'''
15720197268945348388429429351303006925387388927292304717594511259390194100850889852747653387197205392431053069043632340374252629529419776874410817927770922310808632581666181899 139721425176294317602347104909475448503147767726747922243703132013053043430193232376860554749633894589164137720010858254771905261753520854314908256431590570426632742469003
'''

$R_n = L_{n-1},L_n = L_{n-2} + L_{n-1} * (key^3+flower),对L_n模L_{n-1}, 由于L是递增的所以L_n mod L_{n-1} = L_{n-2}$

用下面的代码可以求出前一位的flag以及L和R,递归求解应该可以求出flag,冲!!

from gmpy2 import *

R = 139721425176294317602347104909475448503147767726747922243703132013053043430193232376860554749633894589164137720010858254771905261753520854314908256431590570426632742469003
L = 15720197268945348388429429351303006925387388927292304717594511259390194100850889852747653387197205392431053069043632340374252629529419776874410817927770922310808632581666181899

def decrypt(L, R):
        L_pre2 = L % R
        Flower = L - L_pre2
        for i in range(0, 4096):
                key = Flower // R - i
                if iroot(key, 3)[1]:
                        print(int(iroot(key, 3)[0]), '(to ascii):', chr(int(iroot(key, 3)[0])), f'(i = {i})')
                        flag_bit = chr(int(iroot(key, 3)[0]))
                
        if i == 4096:
                print('oh no')
        
        L = R
        R = L_pre2
        
        return flag_bit, L, R

flag = ''
while L != 1 and R != 0:
        key, L, R = decrypt(L, R)
        flag += str(key)
        
print('flag{' + str(flag) + '}')
#flag{052801c9bbcdd176e83d62fe66b708e3}

0x03 最后

现在在作那道DSA的题,做出来之后应该也会写一篇wp,尽请期待。。。。。。