| package main | |
| import "net" | |
| import "fmt" | |
| import "time" | |
| import "os" | |
| import "crypto/tls" | |
| import "github.com/hashicorp/consul/agent/structs" | |
| import "github.com/hashicorp/consul-net-rpc/net/rpc" | |
| import "github.com/hashicorp/consul/agent/pool" |
| //-O2 -std=c++17 -lpthread -lcrypto | |
| // 4 GB - 1 hour | |
| #include <openssl/des.h> | |
| #include <iostream> | |
| #include <vector> | |
| #include <cstring> | |
| #include <thread> | |
| constexpr uint64_t flip_endian(uint64_t x) { | |
| return __builtin_bswap64(x); |
| from pwn import * | |
| r = remote("defis.unitedctf.ca", 3007) | |
| def alloc(n, t=1): | |
| r.recvuntil(b"> Your choice:") | |
| r.sendline(b"1") | |
| r.recvuntil(b"Eagle number (1, 2 or 3):") | |
| r.sendline(str(n).encode()) | |
| r.recvuntil(b"Eagle type (1, 2 or 3):") |
For this challenge we are given a go program and json payloads.
message.json
{
"V":584221881758507213769903010020339815950057645818648920364983549601225341062365062520391665711126204114735381305339677935863870281557078300036090892608892021129276590502981260857531205402850896018739268436262147451812156349860568744247316332461855247671922521643140703633415753776548859345314133294397634741631,
"Nonce":"2NXgQhueKbVm5Pd8",
"Body":"0ZWAaAxvazGfyTJSRPkyeHU9ZUSWSoWFObggHmmfb835TWFAzA=="
| class pol(): | |
| def __init__(self, val): | |
| self.val = val | |
| def __str__(self): | |
| val = self.val | |
| if val == 0: | |
| return "0" | |
| s = "" | |
| if val & 3 == 1: |
| seeds = list(map(int, ['15263995', '99292587', '83108575', '69157256', '53593135', '32614750', '72435852', '59371645', '88765826', '73891487', '76996128', '87338327', '51292662', '34244764', '93739263', '93381390', '37741190', '99729892', '89714956', '19729172', '44104587', '92354649', '36299720', '91952937', '68573958', '31008520', '47981027', '93963483', '59082756', '85758382', '55569837', '99371858', '91718005', '78978703', '81056465', '58522849', '76102909', '16988486', '71647790', '30871496', '12296607', '76389359', '39000160', '61356577', '80419802', '13334445', '19876423', '96992530', '68199663', '99511569', '19886603', '65911430', '31830592', '30839713', '42342954', '22909344', '72992866', '91155636', '10583298', '32584615'])) | |
| lb = 10000000 | |
| ub = 99999999 | |
| intmax = 0x7FFFFFFF | |
| revert = lambda x: int((x-lb)/(ub-lb)*intmax) | |
| def predict(a, b): | |
| s1 = revert(b) | |
| s2 = revert(a) | |
| s3 = s2 - s1 |
| # sources | |
| # https://www.iacr.org/archive/asiacrypt2006/42840270/42840270.pdf | |
| # http://www.jscoron.fr/publications/bivariate.pdf | |
| def solve_trivariate(pol, modulus, mm, XX, YY, WW): | |
| PR.<x, y, z> = PolynomialRing(ZZ) | |
| print "Generating shift polynomials" |
| from base64 import b64encode | |
| from struct import pack | |
| from math import ceil | |
| pgp_header = "-----BEGIN PGP PUBLIC KEY BLOCK-----\nVersion: GnuPG v1\n" | |
| pgp_trail = "-----END PGP PUBLIC KEY BLOCK-----" | |
| # paket type, algo, ... | |
| packet_header = b'\x99\x02\r\x04W\xe1\xbd\xa5\x01' | |
| # n is followed by e |
| /* xocopy - Program for copying an executable with execute but no read perms. | |
| * Copyright (C) 2002, 2003 Dion Mendel. | |
| * | |
| * This program is free software; you can redistribute it and/or modify | |
| * it under the terms of the GNU General Public License as published by | |
| * the Free Software Foundation; either version 2 of the License, or | |
| * (at your option) any later version. | |
| * | |
| * This program is distributed in the hope that it will be useful, | |
| * but WITHOUT ANY WARRANTY; without even the implied warranty of |