secureHMAC-solver.py

from Crypto.Util.number import *
from pwn import *
from Crypto.Cipher import AES
from Crypto.Util.strxor import strxor
from binascii import hexlify, unhexlify
from Crypto.Util.number import *
import sys

def sign(key, message):
    try:
        ECB = AES.new(key, AES.MODE_ECB)
        messageblocks = [message[i:i + 16] for i in range(0, len(message), 16)]
        tag = ECB.encrypt(messageblocks[0])
        for i in range(1,len(messageblocks)):
            tag = ECB.encrypt(strxor(messageblocks[i], tag))
        return hexlify(tag)
    except:
        sys.exit()

r = remote("35.188.170.152", 1337)
r.recvuntil("\n")
r.recvuntil("n: ")
n = int(r.recvuntil("\n"))
r.recvuntil("c: ")
c_faulty = int(r.recvuntil("\n"))
r.recvuntil("enc_key: ")
enc_key = int(r.recvuntil("\n"))
r.recvuntil("\n")

# factorize n
m = bytes_to_long("fake_flag")
e = 65537
c_real = pow(m, e, n)
p = GCD(c_faulty - c_real, n)
q = n/p
print "[+] p:", p
print "[+] q:", q
phi = (p-1)*(q-1)
d = inverse(e, phi)
key = long_to_bytes(pow(enc_key, d, n))
m1 = "a" * 16
m2 = "b" * 16
s1 = sign(key, m1)
m1 += unhexlify(s1)
s2 = sign(key, m2)
m2 += unhexlify(s2)
payload1 = hexlify(m1)
payload2 = hexlify(m2)
r.recvuntil("\n")
r.sendline(payload1)
r.recvuntil("\n")
r.sendline(payload2)
r.recvuntil("flag: ")
flag = r.recvuntil("\n").strip()
print "[+] Flag:", flag