Guest User

LostKey.py

a guest
Oct 21st, 2018
238
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. from pwn import *
  2. from sympy import *
  3.  
  4. r = remote('18.179.251.168',21700)
  5. r.recvline()
  6. flag = int(r.recvline().strip(),16)
  7.  
  8. def enc(v):
  9. r.sendline('A')
  10. data = hex(v)[2:].strip('L')
  11. if len(data)%2 == 1: data = '0'+data
  12. r.sendline(data)
  13. r.recvuntil('cmd: input: ')
  14. return int(r.recvline().strip(),16)
  15.  
  16. def dec(v):
  17. r.sendline('B')
  18. data = hex(v)[2:].strip('L')
  19. if len(data)%2 == 1: data = '0'+data
  20. r.sendline(data)
  21. r.recvuntil('cmd: input: ')
  22. return int(r.recvline().strip(),16)
  23.  
  24. e2 = enc(2)
  25. e4 = enc(4)
  26. e8 = enc(8)
  27. e16 = enc(16)
  28.  
  29. n = gcd(e2*e2-e4,e2*e2*e2-e8)
  30. n = gcd(n,e4*e4-e16)
  31. n = int(n)
  32. print n
  33.  
  34. x = e2
  35. step = pow(2,2**20,n)
  36. data1 = []
  37. tbl = {}
  38. v = 1
  39. for i in xrange(2**20):
  40. data1.append(v)
  41. tbl[v] = i
  42. v = v*2
  43. if v>=n: v-=n
  44. data1 = set(data1)
  45. inv = invert(step,n)
  46. data2 = []
  47. tbl2 = {}
  48. for i in xrange(2**20):
  49. data2.append(x)
  50. tbl2[x] = i
  51. x = (x*inv)%n
  52. data2 = set(data2)
  53. midl = list(data1&data2)
  54. mid = midl[0]
  55. e = tbl2[mid]*(2**20)+tbl[mid]
  56. print e
  57.  
  58. v = (-n)%256
  59. tbl = {}
  60. for i in xrange(256):
  61. z = (v*i)%256
  62. tbl[z] = i
  63. upper = n
  64. lower = 0
  65.  
  66.  
  67. b = flag
  68. step = pow(256,e,n)
  69. for i in xrange(128):
  70. b = (b*step)%n
  71. q = dec(b)
  72. ii = tbl[q]
  73. gap = (upper-lower)/256
  74. lower += ii*gap
  75. upper = lower+gap
  76.  
  77. g = upper-upper%256+dec(flag)
  78. print hex(g)[2:].strip('L').decode('hex')
RAW Paste Data