2024_VCTF_crypto_狂飙

题目

import os
from secrets import flag
from Crypto.Util.number import *
from Crypto.Cipher import AES
m = 88007513702424243702066490849596817304827839547007641526433597788800212065249
key = os.urandom(24)
key = bytes_to_long(key)
n=m % key
flag += (16 - len(flag) % 16) * b'\x00'
iv = os.urandom(16)
aes = AES.new(key,AES.MODE_CBC,iv)
enc_flag = aes.encrypt(flag)

print(n)
print(enc_flag)
print(iv)


#103560843006078708944833658339172896192389513625588
#b'\xfc\x87\xcb\x8e\x9d\x1a\x17\x86\xd9~\x16)\xbfU\x98D\xfe\x8f\xde\x9c\xb0\xd1\x9e\xe7\xa7\xefiY\x95C\x14\x13C@j1\x9d\x08\xd9\xe7W>F2\x96cm\xeb'
#b'UN\x1d\xe2r<\x1db\x00\xdb\x9a\x84\x1e\x82\xf0\x86'

由已知我们可以得到

m-s*key = n

将 m-n 分解即可得到 s*key 的组合

根据一个字节 8 位，得到 key 为 192 位

然后可以利用 sage 进行爆破即可

#sage
from Crypto.Cipher import AES
from Crypto.Util.number import *
n = 103560843006078708944833658339172896192389513625588
m = 88007513702424243702066490849596817304827839547007641526433597788800212065249
key = m-n
# 88007513702424243702066490746035974298749130602173983187260701596410698439661
enc = b'\xfc\x87\xcb\x8e\x9d\x1a\x17\x86\xd9~\x16)\xbfU\x98D\xfe\x8f\xde\x9c\xb0\xd1\x9e\xe7\xa7\xefiY\x95C\x14\x13C@j1\x9d\x08\xd9\xe7W>F2\x96cm\xeb'
iv = b'UN\x1d\xe2r<\x1db\x00\xdb\x9a\x84\x1e\x82\xf0\x86'
for i in key.divisors():
    i=long_to_bytes(i,24)
    aes=AES.new(i,AES.MODE_CBC,iv)
    flag=aes.decrypt(enc)
    if b'flag{' in flag:
        print(flag)