SSM2024 kval crypto (Really Secure Autput, md10, BlackSmith och rsAI)

solve_blacksmith.py

from Crypto.Util.number import *
from pwn import *
import string
import random

io = remote('46.246.39.165', 50000)

io.recvuntil(b'card: ')
e, N = eval(io.recvuntil(b'. ', drop=True))

alph = string.ascii_letters + string.digits

while True:
    a, b = [''.join(random.choice(alph) for _ in range(4)).encode() for _ in range(2)]
    c = long_to_bytes(bytes_to_long(a)*bytes_to_long(b))
    if c.isalnum(): break

assert bytes_to_long(a)*bytes_to_long(b) == bytes_to_long(c)

io.sendlineafter(b'craft: ', c)

io.sendlineafter(b'of: ', a)
io.sendlineafter(b'else: ', b)

io.recvuntil(b'samples: ')
sig1, sig2 = eval(io.recvuntil(b'. ', drop=True))
sig3 = (sig1*sig2)%N

io.sendlineafter(b'for: ', hex(sig3).encode())
io.interactive()

solve_md10.py

from string import printable
from hashlib import md5
from itertools import product
from tqdm import tqdm
alph = printable.strip()

tot = 189692690630402486056927840753055665775

part1 = b'SSM{d0nt_3v3n_try_t0_' # + 4*x
part2 = b'_gu3ss_y0u_l1ttl3...}' # 3*x +

tbl = {}
for comb in product(alph, repeat=3):
    s = ''.join(comb).encode() + part2
    h = int(md5(s).hexdigest(), 16)
    tbl[tot-h] = s

for comb in tqdm(product(alph, repeat=4), total=len(alph)**4):
    s = part1 + ''.join(comb).encode()
    h = int(md5(s).hexdigest(), 16)
    if h in tbl:
        print(s + tbl[h])
        break

solve_really_secure_autput.py

from pwn import *
from sage.all import *
from Crypto.Util.number import *

a = 1493511718305384798969108408462916357433162875489360842729567185132495650072335886734882101580934663428729584646758421599026963636762790758890989315303189394344033577780151934219173698518918852742306449995844052835515242518232455932971448380781607267919800150681713124553160079773602280696402007700176246013662430611037117607652763462981120254176842203209222416190055361393500895838082757394403955036364950329896714267196391316308516727692079225686148096804413011924735031203065423095494320900931034951275616781912647079561880769784007690894953658722050990714842537130080101903987284489406831289722623018960650263885580402030127186722144087170369775489063298683764639379944398580203459825531656069117866558342083661531697066362919505651564799976937500574632035364657669828
n = 119009254253727093932053785710365753128545910675036456268432474025248823187686332732461549391099690837849176491422559175154572098491139043050668949624051052986080710175793261339586726069389412615430080871213165713944258049246310224603350895563192986569748857717791450955515863971242952286509655831154266617067
c = 5774351134239564446149337965063162288080463880789044350173592963009128953813760807190499205096637754160800759771581660523065721474776745102587358943446752616484109489189087007452629087344049090619694593639685718324715019212944981713271059549378190394419879820827475332687525322584630222066357864926344773621
e = 0x10001

R, px = ZZ['x'].objgen()

for x in range(1, 17):
    for y in range(1, 17):
        r = (x * px**8 - a * px**3 + y*n**3).roots()
        if r:
            p = r[0][0]
            break
    else: continue
    break

q = n // p
assert p*q == n

d = pow(e, -1, (p-1) * (q-1))
print(long_to_bytes(int(pow(c, d, n))).decode())

solve_really_secure_autput_chopingu.py

from pwn import *
from sage.all import *
from Crypto.Util.number import *

a = 1493511718305384798969108408462916357433162875489360842729567185132495650072335886734882101580934663428729584646758421599026963636762790758890989315303189394344033577780151934219173698518918852742306449995844052835515242518232455932971448380781607267919800150681713124553160079773602280696402007700176246013662430611037117607652763462981120254176842203209222416190055361393500895838082757394403955036364950329896714267196391316308516727692079225686148096804413011924735031203065423095494320900931034951275616781912647079561880769784007690894953658722050990714842537130080101903987284489406831289722623018960650263885580402030127186722144087170369775489063298683764639379944398580203459825531656069117866558342083661531697066362919505651564799976937500574632035364657669828
n = 119009254253727093932053785710365753128545910675036456268432474025248823187686332732461549391099690837849176491422559175154572098491139043050668949624051052986080710175793261339586726069389412615430080871213165713944258049246310224603350895563192986569748857717791450955515863971242952286509655831154266617067
c = 5774351134239564446149337965063162288080463880789044350173592963009128953813760807190499205096637754160800759771581660523065721474776745102587358943446752616484109489189087007452629087344049090619694593639685718324715019212944981713271059549378190394419879820827475332687525322584630222066357864926344773621
e = 0x10001

for x in range(1, 17):
    p = round((a//x)**QQ('1/5'))
    if n%p == 0: break
q = n // p
d = pow(e, -1, (p-1) * (q-1))
print(long_to_bytes(int(pow(c, d, n))).decode())

solve_rsai.py

from sage.all import *
from tqdm import tqdm

'''
e = mc^2 + ai
but since ai is overhyped we can approximate that
e = mc^2 + 0
another good approximation is c ~= e (only two letters off)
e = me^2
f(x) = me^2 - e
f'(x) = 2me - 1
but since me is constant (i'm very stubborn) f'(x) is constant, so
the activation function is also linear Q.E.D.

then just do linear algebra backwards
'''

e = 0x100
n = int(open('modulus', 'r').read())
R = Zmod(n)

with open('ai_weights', 'r') as f:
    weights = [matrix(R, w) for w in eval(f.read())]

with open('ai_biases', 'r') as f:
    biases = [matrix(R, b) for b in eval(f.read())]

c = matrix(R, eval(open('enc_flag', 'r').read())[0])
for _ in tqdm(range(e)):
    for W, b in zip(reversed(weights), reversed(biases)):
        c = W.solve_left(c-b)
print(bytes(c[0]).decode())