padrsa solver

solver.py

from Crypto.Util.number import *
from binascii import unhexlify, hexlify
import gmpy2

from pwn import *

def get_cube():
    sock = remote('crypto.kosenctf.com', 13001)
    n = int(sock.recvuntil('\n')[3:-1].decode())

    def recv_msg(e):
        sock.recvuntil("> ")
        sock.sendline('1')
        sock.recvuntil('e: ')
        sock.sendline(str(e))
        recv = sock.recvuntil('\n')
        c = bytes_to_long(unhexlify(recv[3:-1]))
        return c

    for i in range(64):
        recv_msg(65537 - i)

    c = recv_msg(3)
    sock.close()

    return n, c

n, c = get_cube()
while gmpy2.iroot(c, 3)[1] is False:
    n2, c2 = get_cube()

    c = (c * n2 * inverse(n2, n) + c2 * n * inverse(n, n2)) % (n * n2)
    n = n * n2

print(long_to_bytes(gmpy2.iroot(c, 3)[0]))