安洵杯2023

signin

from Crypto.Util.number import *
from random import *
from sage.all import *
from gmpy2 import *
from libnum import *
data3 = 1.42870767357206600351348423521722279489230609801270854618388981989800006431663026299563973511233193052826781891445323183272867949279044062899046090636843802841647378505716932999588
c = 1046004343125860480395943301139616023280829254329678654725863063418699889673392326217271296276757045957276728032702540618505554297509654550216963442542837
n = 2793178738709511429126579729911044441751735205348276931463015018726535495726108249975831474632698367036712812378242422538856745788208640706670735195762517
leak = 1788304673303043190942544050868817075702755835824147546758319150900404422381464556691646064734057970741082481134856415792519944511689269134494804602878628
e = 65537

data4 = continued_fraction(data3)
data5 = data4.convergents()
# print(data5)

datap = []
dataq = []
for i in data5:
    data = str(i).split('/')
    if(isPrime(ZZ(data[0])) and isPrime(ZZ(data[1]))):
        datap.append(ZZ(data[0]))
        dataq.append(ZZ(data[1]))
data1 = datap[1]
data2 = dataq[1]

data_phi = (data1 - 1)*(data2 - 1)
data_d = inverse(data1,data_phi)
p_q = pow(leak,data_d,data1 * data2)
p_q = ZZ(p_q)

var('p q')
f1 = p * q == n
f2 = p - q == p_q
v = solve([f1,f2],p,q)
# print(v)
p = 89050782851818876669770322556796705712770640993210984822169118425068336611139
q = 31366133449465349655535843217834713141354178841659172525867412449648339136903
phi = (p-1)*(q-1)
d = inverse(e,phi)
m = pow(c,d,n) - data2
flag = n2s(int(m))
print(flag)

CrzcyTream

from Crypto.Util.number import *
from random import randint
from gmpy2 import *

pbar = 63462225359079726817825349453766010803387423517027320052424207251770338126237824799485273317
n = 128259792862716016839189459678072057136816726330154776961595353705839428880480571473066446384217522987161777524953373380960754160008765782711874445778198828395697797884436326877471408867745183652189648661444125231444711655242478825995283559948683891100547458186394738621410655721556196774451473359271887941209
c = 10585127810518527980133202456076703601165893288538440737356392760427497657052118442676827132296111066880565679230142991175837099225733564144475217546829625689104025101922826124473967963669155549692317699759445354198622516852708572517609971149808872997711252940293211572610905564225770385218093601905012939143618159265562064340937330846997881816650140361013457891488134685547458725678949
pbits = 512 - 305
PR.<x> = PolynomialRing(Zmod(n))
f = ZZ(pbar<<207) + x
f = f.monic()
roots = f.small_roots(X=2^207, beta=0.44)
print(roots)
# p = ZZ(pbar<<207) + 76347864203588455868161824448305083084387260376528823546715135
p = 13053422630763887754872929794631414002868675984142851995620494432706465523574529389771830464531559991042565319610790540616696456104018890243275374098291711
q = n/p

e = 65537
phi = ZZ((p-1)*(q-1))
d = invert(e,phi)
m = pow(c,d,n)
print(long_to_bytes(ZZ(m)))

# [76347864203588455868161824448305083084387260376528823546715135]
# b'SYC{N0b0dy_Kn0vvs_CryPt0_be7t3r_7haN_Me}'