题目脚本
#!/usr/bin/env python3from Crypto.Util.number import getPrime, inverse, bytes_to_long, long_to_bytese = 3
d = -1while d == -1:p = getPrime(1024)q = getPrime(1024)phi = (p - 1) * (q - 1)d = inverse(e, phi)n = p * qflag = b"XXXXXXXXXXXXXXXXXXXXXXX"
pt = bytes_to_long(flag)
ct = pow(pt, e, n)print(f"n = {n}")
print(f"e = {e}")
print(f"ct = {ct}")pt = pow(ct, d, n)
decrypted = long_to_bytes(pt)
assert decrypted == flag# n = 17258212916191948536348548470938004244269544560039009244721959293554822498047075403658429865201816363311805874117705688359853941515579440852166618074161313773416434156467811969628473425365608002907061241714688204565170146117869742910273064909154666642642308154422770994836108669814632309362483307560217924183202838588431342622551598499747369771295105890359290073146330677383341121242366368309126850094371525078749496850520075015636716490087482193603562501577348571256210991732071282478547626856068209192987351212490642903450263288650415552403935705444809043563866466823492258216747445926536608548665086042098252335883
# e = 3
# ct = 243251053617903760309941844835411292373350655973075480264001352919865180151222189820473358411037759381328642957324889519192337152355302808400638052620580409813222660643570085177957
由于题目给定的 \(e\) 较小，我们可以尝试爆破得到答案。
因为 \(ct = m^e \pmod n\)，所以当 \(e = 3\) 时，我们利用
\[\sqrt[3]{ct + k \times n}
\]
暴力枚举 \(k\) 即可。
解题脚本
import requests
from tqdm import *
from Crypto.Util.number import *
from pwn import *
from hashlib import *
from sympy import *
from gmpy2 import *requests.adapters.DEFAULT_RETRIES = 100000
s = requests.Session()
s.timeout = (1000.0, 1000.0)n = 17258212916191948536348548470938004244269544560039009244721959293554822498047075403658429865201816363311805874117705688359853941515579440852166618074161313773416434156467811969628473425365608002907061241714688204565170146117869742910273064909154666642642308154422770994836108669814632309362483307560217924183202838588431342622551598499747369771295105890359290073146330677383341121242366368309126850094371525078749496850520075015636716490087482193603562501577348571256210991732071282478547626856068209192987351212490642903450263288650415552403935705444809043563866466823492258216747445926536608548665086042098252335883
e = 3
ct = 243251053617903760309941844835411292373350655973075480264001352919865180151222189820473358411037759381328642957324889519192337152355302808400638052620580409813222660643570085177957for k in trange(0, 100000):m = ct + k * nrt = gmpy2.iroot(m, 3)if rt[1] == True:print(long_to_bytes(rt[0]))break
