【2020年第二届“网鼎杯”网络安全大赛 青龙组】Crypto you raise me up / SageMath 一波骚操作

一、用Ubuntu装好的sagemath

#!/usr/bin/env python
# -*- coding: utf-8 -*-
from Crypto.Util.number import *
import random

n = 2 ** 512
m = random.randint(2, n-1) | 1
c = pow(m, bytes_to_long(flag), n)
print 'm = ' + str(m)
print 'c = ' + str(c)

# m = 391190709124527428959489662565274039318305952172936859403855079581402770986890308469084735451207885386318986881041563704825943945069343345307381099559075
# c = 6665851394203214245856789450723658632520816791621796775909766895233000234023642878786025644953797995373211308485605397024123180085924117610802485972584499

题目很…一看就嫩看懂！but…

打开Ubuntu，安装sagemath，开算！

在线求解网址：https://sagecell.sagemath.org/

n = 2 ** 512

m = 391190709124527428959489662565274039318305952172936859403855079581402770986890308469084735451207885386318986881041563704825943945069343345307381099559075

c=6665851394203214245856789450723658632520816791621796775909766895233000234023642878786025644953797995373211308485605397024123180085924117610802485972584499

ZmodN = Zmod(2^512)

m = ZmodN(m)
c = ZmodN(c)

c.log(m)

hex(56006392793405651552924479293096841126763872290794186417054288110043102953612574215902230811593957757)

最后的输出16进制结果

'0x666c61677b35663935636139332d313539342d373632642d656430622d6139313339363932636234617d'

16进制再转为字符串

在线转换网址：https://www.sojson.com/hexadecimal.html

flag{5f95ca93-1594-762d-ed0b-a9139692cb4a}

二、SageMath 的安装使用方法：

下载地址
http://www.sagemath.org/download-linux.html
1. windows版
2. linux Debian系的kali，或者ubuntu

上面的网址随便选个亚洲的镜像，然后下载，扔进linux

下面的图是windows的在：https://github.com/sagemath/sage-windows/releases/tag/0.6.0-9.0

官方教程
http://doc.sagemath.org/html/en/tutorial/index.html

翻译参考
https://www.lainme.com/doku.php/topic/sage/start

下面以自带py2，3的 kali 作演示：

我很早之前安装的时候，解压时间特别特别长，等不及没注意直接 ./sage 安装就会出大问题！！！

耐心！细心！恒心！

选中压缩包，右键在此解压

或者命令行

tar xvf sage-9.0-Debian_GNU_Linux_9-x86_64.tar.bz2

解压后的样子：
进解压的文件夹里

cd SageMath/

在这里空白处，右键打开终端输入：

./sage

Done！

Ubuntu 自带py3，无py2的的环境安装故障

ubuntu ./sage后报错
	已安装py3
	运行reloacte.py
	usr/bin/env python 没有这个目录
	
	打开报错relocate-once.py，在第一行python后面加3，改为usr/bin/env python3  让她找到python的目录即可解决！

三、python sympy解法

从大佬那里截的图，这个小知识点非常重要，写的很好

https://blog.youkuaiyun.com/qq_43531895/article/details/106108139

from sympy.ntheory import discrete_log
n = 2**512
m = 391190709124527428959489662565274039318305952172936859403855079581402770986890308469084735451207885386318986881041563704825943945069343345307381099559075
c = 6665851394203214245856789450723658632520816791621796775909766895233000234023642878786025644953797995373211308485605397024123180085924117610802485972584499
flag_dec = discrete_log(n,c,m) #得到flag的十进制值
print(hex(flag_dec)) #转为十六进制后打印出来

0x666c61677b35663935636139332d313539342d373632642d656430622d6139313339363932636234617d

这里，可以把上面的扔进Notepad++，去掉前面的0x，然后选中全部，插件转换为ascii码

import binascii
#16进制整数转ASCii编码字符串

a = 0x666c61677b35663935636139332d313539342d373632642d656430622d6139313339363932636234617d
#a 是需要转换的，带0x的16进制整数

b = hex(a) #加引号，把int转换成相同的str字符串类型
b = b[2:]  #截取去掉开头的 0x
c = binascii.a2b_hex(b) #转换成ASCii编码的字符串，类型是bytes
print(c)

b’flag{5f95ca93-1594-762d-ed0b-a9139692cb4a}’

整合后的脚本

import binascii
from sympy.ntheory import discrete_log
n = 2**512
m = 391190709124527428959489662565274039318305952172936859403855079581402770986890308469084735451207885386318986881041563704825943945069343345307381099559075
c = 6665851394203214245856789450723658632520816791621796775909766895233000234023642878786025644953797995373211308485605397024123180085924117610802485972584499
flag_dec = discrete_log(n,c,m) #得到flag的十进制值
a = hex(flag_dec)
b = a[2:]  #截取去掉开头的 0x
c = binascii.a2b_hex(b) #转换成ASCii编码的字符串，类型是bytes
print(c, sep='\n')

flag{5f95ca93-1594-762d-ed0b-a9139692cb4a}