Commit a3be763

committed

Add SECCON 2022 Quals

1 parent 4aef3f6 commit a3be763Copy full SHA for a3be763

File tree

+1192

-0

lines changed

+1192

-0

lines changed

Lines changed: 54 additions & 0 deletions

Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,54 @@`
	`1`	`+from pwn import *`
	`2`	`+from Crypto.Util.number import *`
	`3`	`+from gmpy2 import *`
	`4`	`+`
	`5`	`+r = remote('BBB.seccon.games', 8080)`
	`6`	`+`
	`7`	`+r.recvuntil(b'a=')`
	`8`	`+a = int(r.recvline().decode().strip())`
	`9`	`+r.recvuntil(b'p=')`
	`10`	`+p = int(r.recvline().decode().strip())`
	`11`	`+`
	`12`	`+F = Zmod(p)`
	`13`	`+P.<x> = PolynomialRing(F)`
	`14`	`+b = int((-11*a - 110) % p)`
	`15`	`+`
	`16`	`+f = x^2+a*x+b`
	`17`	`+r.sendlineafter(b'!!:', str(b).encode())`
	`18`	`+`
	`19`	`+sols = set()`
	`20`	`+def get_sol(target, depth):`
	`21`	`+ if depth == 0:`
	`22`	`+ global sols`
	`23`	`+ if target not in sols:`
	`24`	`+ sols.add(target)`
	`25`	`+ return`
	`26`	`+`
	`27`	`+ roots = (f - target).roots()`
	`28`	`+ for root, _ in roots:`
	`29`	`+ get_sol(root, depth - 1)`
	`30`	`+`
	`31`	`+get_sol(11, 4)`
	`32`	`+`
	`33`	`+assert len(sols) >= 5`
	`34`	`+`
	`35`	`+for v in list(sols)[:5]:`
	`36`	`+ r.sendlineafter(b'seed: ', str(v).encode())`
	`37`	`+`
	`38`	`+l1, l2 = [], []`
	`39`	`+`
	`40`	`+for i in range(5):`
	`41`	`+ r.recvuntil(b'n=')`
	`42`	`+ n = int(r.recvline().decode().strip())`
	`43`	`+ r.recvuntil(b'e=')`
	`44`	`+ e = int(r.recvline().decode().strip())`
	`45`	`+ assert e == 11`
	`46`	`+ r.recvuntil(b'Cipher Text:')`
	`47`	`+ c = int(r.recvline().decode().strip())`
	`48`	`+`
	`49`	`+ l1.append(c)`
	`50`	`+ l2.append(n)`
	`51`	`+`
	`52`	`+res = crt(l1, l2)`
	`53`	`+print(res)`
	`54`	`+print(long_to_bytes(iroot(int(res), 65537)[0]))`

Lines changed: 9 additions & 0 deletions

Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,9 @@`
	`1`	`+import angr`
	`2`	`+import claripy`
	`3`	`+p = angr.Project('./chall.baby')`
	`4`	`+flag = claripy.BVS('flag', 50 * 8)`
	`5`	`+st = p.factory.entry_state(argc=2, args=[b'prog', flag])`
	`6`	`+sim = p.factory.simulation_manager(st)`
	`7`	`+sim.explore(find=0x4012c2, avoid=0x40127d)`
	`8`	`+sim.move('found', 'active')`
	`9`	`+print(sim.active[-1].solver.eval(flag).to_bytes(50, 'big'))`

Comments

(0)