ASIS-CTF-Finals-2017-Handicraft_RSA

题目

下载得到一个附件
f5346507773f4b909479387d59a01710
用Notepad++打开看看

?zXZ  嬷碏 !   t/澹?j] 4J 鹘?d(/脘R?.窗(3幐U嶴D慗∑r嘔c縹谮}厍DZワk'磰~傊[杢?铹秄掑醾祖倻R{]`糷*2誻]~?Ъ师宼臬!?釼8Vi(船k~櫘?^霏蛽伸O蚬6ο輐j/恵1瑅??搥?m溣/?簂[%秫蕮Iv?鸡v7卽?噽e逸弓:殮簎樍畉洅b蘕*嗹゜?ZYSf繜烰!嚣飔痍燬藈N) H??{?h?x襸M櫚)+6H埊檸Y磖b壸阷&5??嵳?@U$晈Σ?幘嘗?餁聱e鹽尓?\R%+?......

一堆乱码，啥也不是
然后通过二进制方式打开读取看一看

f = open("f5346507773f4b909479387d59a01710","rb")
f = f.read()
print(f)
b'\xfd7zXZ\x00\x00\x04\xe6\xd6\xb4F\x02\x00!\x01\x16\x00\x00\x00t/\xe5\xa3\xe0\'\xff\x05j]\x004\x18J \xf7\xbd\xb8\x16d(/\xeb\xe4R\x1a?\x03.\xb4\xb0(3\x12\x8e\xb8U\x8eSD\x91J\xa1\xc6r\x87Ic\xbf~\xda\xda}\xd8\xc7D\x0eZ\xa5\xefk\'\x1e\xb4\x8a~\x82\xd6[\x96t\xfc\x06\xef\xa9\xb6f\x92\xe5\xe1\x82\xd7\xe6\x04\x82\x9cR{]\x1f`\xbch\x7f*2\xd5w]~\x8f\x12\xa7\xbc\xca\xa6\x12\x....

也看不懂
丢进kali里file一下看看

┌──(kali㉿kali)-[~]
└─$ file /home/kali/Desktop/f5346507773f4b909479387d59a01710
/home/kali/Desktop/f5346507773f4b909479387d59a01710: XZ compressed data, checksum CRC64

XZ格式
没见过，去搜一搜发现是一个linux自带的压缩
那就先把后缀名改为.XZ后
通过指令xz -d xxx.xz解压一下
然后发现他变成了一个tar achive文件夹，可以看到里面有题目内容了

py文件

#!/usr/bin/python

from Crypto.Util.number import *
from Crypto.PublicKey import RSA
from secret import s, FLAG

def gen_prime(s):
    while True:
        r = getPrime(s)
        R = [r]
        t = int(5 * s / 2) + 1
        for i in range(0, t):
            R.append(r + getRandomRange(0, 4 * s ** 2))
        p = reduce(lambda a, b: a * b, R, 2) + 1
        if isPrime(p):
            if len(bin(p)[2:]) == 1024:
                return p

while True:
    p = gen_prime(s)
    q = gen_prime(s)
    n = p * q
    e = 65537
    d = inverse(e, (p-1)*(q-1))
    if len(bin(n)[2:]) == 2048:
        break

msg = FLAG
key = RSA.construct((long(n), long(e), long(d), long(p), long(p)))
for _ in xrange(s):
    enc = key.encrypt(msg, 0)[0]
    msg = enc

print key.publickey().exportKey()
print '-' * 76
print enc.encode('base64')
print '-' * 76

output:

-----BEGIN PUBLIC KEY-----
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAq+m7iHurBa9G8ujEiTpZ
71aHOVNhQXpd6jCQNhwMN3hD6JHkv0HSxmJwfGe0EnXDtjRraWmS6OYzT4+LSrXs
z9IkWGzRlJ4lC7WHS8D3NWIWYHCP4TRt2N0TlWXWm9nFCrEXqQ3IWgYQpQvKzsds
etnIZJL1tf1wQzGE6rbkbvURlUBbzBSuidkmi0kY5Qxp2Jfb6OUI647zx2dPxJpD
ffSCNffVIDUYOvrgYxIhs5HmCF3XECC3VfaKtRceL5JM8R0qz5nVU2Ns8hPvSVP+
7/i7G447cjW151si0joB7RpBplu44Vk8TXXDAk0JZdW6KwJn7ITaX04AAAAAAAAA
AQIDAQAB
-----END PUBLIC KEY-----
----------------------------------------------------------------------------
eER0JNIcZYx/t+7lnRvv8s8zyMw8dYspZlne0MQUatQNcnDL/wnHtkAoNdCalQkpcbnZeAz4qeMX
5GBmsO+BXyAKDueMA4uy3fw2k/dqFSsZFiB7I9M0oEkqUja52IMpkGDJ2eXGj9WHe4mqkniIayS4
2o4p9b0Qlz754qqRgkuaKzPWkZPKynULAtFXF39zm6dPI/jUA2BEo5WBoPzsCzwRmdr6QmJXTsau
5BAQC5qdIkmCNq7+NLY1fjOmSEF/W+mdQvcwYPbe2zezroCiLiPNZnoABfmPbWAcASVU6M0YxvnX
sh2YjkyLFf4cJSgroM3Aw4fVz3PPSsAQyCFKBA==

----------------------------------------------------------------------------

分析一下

def gen_prime(s):
   while True:
       r = getPrime(s)#生成一个s位的素数
       R = [r]#初始化列表R，默认元素为r
       t = int(5 * s / 2) + 1#需要(5*s//2)+1那么多个扩展元素(下面循环中的次数)
       for i in range(0, t):#循环t次
           R.append(r + getRandomRange(0, 4 * s ** 2)) #扩展r+(0---4*s^2)这个元素
       p = reduce(lambda a, b: a * b, R, 2) + 1 #lambda提供乘法这个函数，reduce提供参与运算的对象为R中的每一个元素，然后初始值为2，最后得到的所有值再加上1
       if isPrime(p):
           if len(bin(p)[2:]) == 1024:# 如果p的位数为1024且为素数的话，则返回
               return p

函数的意思大概就是传入一个s,返回一个1024位的素数
经过上面的分析得知，最后这个经过所有列表中元素的乘积运算后的素数为1024位，则代表原来的s的值应该不大。

while True:
    p = gen_prime(s)
    q = gen_prime(s)
    n = p * q
    e = 65537
    d = inverse(e, (p-1)*(q-1))
    if len(bin(n)[2:]) == 2048:
        break

一个正常生成rsa 参数的过程，只是要求了n的长度应为2048位

msg = FLAG
key = RSA.construct((long(n), long(e), long(d), long(p), long(p)))
for _ in xrange(s):
    enc = key.encrypt(msg, 0)[0]
    msg = enc

print key.publickey().exportKey()
print '-' * 76
print enc.encode('base64')
print '-' * 76

RSA循环加密s次得到最后的密文，然后最后输出了公钥文件和最后密文的base64
先把公钥信息拿出来，public.key然后用openssl解出公钥来

openssl rsa -pubin -text -modulus -in warmup -in /home/kali/Desktop/public.key
RSA Public-Key: (2048 bit)
Modulus:
   00:ab:e9:bb:88:7b:ab:05:af:46:f2:e8:c4:89:3a:
   59:ef:56:87:39:53:61:41:7a:5d:ea:30:90:36:1c:
   0c:37:78:43:e8:91:e4:bf:41:d2:c6:62:70:7c:67:
   b4:12:75:c3:b6:34:6b:69:69:92:e8:e6:33:4f:8f:
   8b:4a:b5:ec:cf:d2:24:58:6c:d1:94:9e:25:0b:b5:
   87:4b:c0:f7:35:62:16:60:70:8f:e1:34:6d:d8:dd:
   13:95:65:d6:9b:d9:c5:0a:b1:17:a9:0d:c8:5a:06:
   10:a5:0b:ca:ce:c7:6c:7a:d9:c8:64:92:f5:b5:fd:
   70:43:31:84:ea:b6:e4:6e:f5:11:95:40:5b:cc:14:
   ae:89:d9:26:8b:49:18:e5:0c:69:d8:97:db:e8:e5:
   08:eb:8e:f3:c7:67:4f:c4:9a:43:7d:f4:82:35:f7:
   d5:20:35:18:3a:fa:e0:63:12:21:b3:91:e6:08:5d:
   d7:10:20:b7:55:f6:8a:b5:17:1e:2f:92:4c:f1:1d:
   2a:cf:99:d5:53:63:6c:f2:13:ef:49:53:fe:ef:f8:
   bb:1b:8e:3b:72:35:b5:e7:5b:22:d2:3a:01:ed:1a:
   41:a6:5b:b8:e1:59:3c:4d:75:c3:02:4d:09:65:d5:
   ba:2b:02:67:ec:84:da:5f:4e:00:00:00:00:00:00:
   00:01
Exponent: 65537 (0x10001)
Modulus=ABE9BB887BAB05AF46F2E8C4893A59EF5687395361417A5DEA3090361C0C377843E891E4BF41D2C662707C67B41275C3B6346B696992E8E6334F8F8B4AB5ECCFD224586CD1949E250BB5874BC0F735621660708FE1346DD8DD139565D69BD9C50AB117A90DC85A0610A50BCACEC76C7AD9C86492F5B5FD70433184EAB6E46EF51195405BCC14AE89D9268B4918E50C69D897DBE8E508EB8EF3C7674FC49A437DF48235F7D52035183AFAE0631221B391E6085DD71020B755F68AB5171E2F924CF11D2ACF99D553636CF213EF4953FEEFF8BB1B8E3B7235B5E75B22D23A01ED1A41A65BB8E1593C4D75C3024D0965D5BA2B0267EC84DA5F4E0000000000000001
writing RSA key
-----BEGIN PUBLIC KEY-----
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAq+m7iHurBa9G8ujEiTpZ
71aHOVNhQXpd6jCQNhwMN3hD6JHkv0HSxmJwfGe0EnXDtjRraWmS6OYzT4+LSrXs
z9IkWGzRlJ4lC7WHS8D3NWIWYHCP4TRt2N0TlWXWm9nFCrEXqQ3IWgYQpQvKzsds
etnIZJL1tf1wQzGE6rbkbvURlUBbzBSuidkmi0kY5Qxp2Jfb6OUI647zx2dPxJpD
ffSCNffVIDUYOvrgYxIhs5HmCF3XECC3VfaKtRceL5JM8R0qz5nVU2Ns8hPvSVP+
7/i7G447cjW151si0joB7RpBplu44Vk8TXXDAk0JZdW6KwJn7ITaX04AAAAAAAAA
AQIDAQAB
-----END PUBLIC KEY-----

把Modulus转为十进制以后试试能不能分解一下
进入factordb

看到可以成功地分解出p,q
$p=139457081371053313087662621808811891689477698775602541222732432884929677435971504758581219546068100871560676389156360422970589688848020499752936702307974617390996217688749392344211044595211963580524376876607487048719085184308509979502505202804812382023512342185380439620200563119485952705668730322944000000001$
$q=155617827023249833340719354421664777126919280716316528121008762838820577123085292134385394346751341309377546683859340593439660968379640585296350265350950535158375685103003837903550191128377455111656903429282868722284520586387794090131818535032744071918282383650099890243578253423157468632973312000000000000001$
现在该知道的n,e,p,q,c都知道了，虽然s不知道，但由刚刚上面的分析，s应该不大，跑一跑看一看

n = 0xABE9BB887BAB05AF46F2E8C4893A59EF5687395361417A5DEA3090361C0C377843E891E4BF41D2C662707C67B41275C3B6346B696992E8E6334F8F8B4AB5ECCFD224586CD1949E250BB5874BC0F735621660708FE1346DD8DD139565D69BD9C50AB117A90DC85A0610A50BCACEC76C7AD9C86492F5B5FD70433184EAB6E46EF51195405BCC14AE89D9268B4918E50C69D897DBE8E508EB8EF3C7674FC49A437DF48235F7D52035183AFAE0631221B391E6085DD71020B755F68AB5171E2F924CF11D2ACF99D553636CF213EF4953FEEFF8BB1B8E3B7235B5E75B22D23A01ED1A41A65BB8E1593C4D75C3024D0965D5BA2B0267EC84DA5F4E0000000000000001
#print(int(n))
from gmpy2 import invert
from Crypto.Util.number import long_to_bytes,bytes_to_long
e=65537
p = 139457081371053313087662621808811891689477698775602541222732432884929677435971504758581219546068100871560676389156360422970589688848020499752936702307974617390996217688749392344211044595211963580524376876607487048719085184308509979502505202804812382023512342185380439620200563119485952705668730322944000000001
q = 155617827023249833340719354421664777126919280716316528121008762838820577123085292134385394346751341309377546683859340593439660968379640585296350265350950535158375685103003837903550191128377455111656903429282868722284520586387794090131818535032744071918282383650099890243578253423157468632973312000000000000001
d = invert(e, (p-1)*(q-1))
assert(p*q==n)
msg = open("msg.txt",'r')
msg = msg.read()
import base64
a = bytes_to_long(base64.b64decode(msg))
s=0
while True:
    a=pow(a,d,n)
    if(b'flag'in long_to_bytes(a)):
        print(long_to_bytes(a))
        #b'the flag is: ASIS{n0t_5O_e4sy___RSA___in_ASIS!!!}'
        print(f"s={s}")
        #s=19
        break
    s+=1

总结

了解到XZ这种格式，然后整个rsa解密过程也不复杂，复习了一下公钥文件的读取。

参考

openssl 命令查看rsa密钥文件明文参数值
https://blog.youkuaiyun.com/qq_41137110/article/details/109138685