Crypto on QingKong996

XiDianCTF MoeCTF 2025 Crypto Random

Sat, 19 Sep 2026 21:09:47 +0800

本文人工撰写；生成式AI用于校对和润色。

题目链接

题目附件random.py:

from Crypto.Util.number import bytes_to_long

def lfsr(data, mask):
 mask = mask.zfill(len(data))
 res_int = int(data, base=2)^int(mask, base=2)
 bit = 0
 while res_int > 0:
 bit ^= res_int % 2
 res_int >>= 1

 res = data[1:]+str(bit)
 return res

def lcg(x, a, b, m):
 return (a*x+b)%m

flag = b'moectf{???}'

x = bin(bytes_to_long(flag))[2:].zfill(len(flag)*8)
l = len(x)//2
L, R = x[:l], x[l:]
b = -233
m = 1<<l

for _ in range(2025):
 mask = R
 seed = int(L, base=2)
 L = lfsr(L, mask)
 R = bin(lcg(int(R, base=2), b, seed, m))[2:].zfill(l)
 L, R = R, L

en_flag = L+R
print(int(en_flag, base=2))
# en_flag = 4567941593066862873653209393990031966807270114415459425382356207107640

改写成更易读的形式:

XiDianCTF MoeCTF 2025 Crypto Ez_legendre

Thu, 17 Sep 2026 20:35:23 +0800

本文人工撰写；生成式AI仅用于校对和手写公式转 LaTeX。

题目链接

题目附件ezlegendre.py:

from Crypto.Util.number import getPrime, bytes_to_long
from secret import flag

p = 258669765135238783146000574794031096183
a = 144901483389896508632771215712413815934

def encrypt_flag(flag):
 ciphertext = []
 plaintext = ''.join([bin(i)[2:].zfill(8) for i in flag])
 for b in plaintext:
 e = getPrime(16)
 d = randint(1,10)
 n = pow(a+int(b)*d, e, p)
 ciphertext.append(n)
 return ciphertext

print(encrypt_flag(flag))

e = \operatorname{getPrime}(16)

d \xleftarrow{\$} [1,10]

h = \left(a + \operatorname{int}(b)\cdot d\right)^e \bmod p

当 $b=0$ 时：

XiDianCTF MoeCTF 2025 Crypto Ez_det

Thu, 17 Sep 2026 20:07:58 +0800

本文为人工撰写，仅使用生成式AI校对。

题目链接

题目附件ez_det.py:

from random import randrange
from Crypto.Util.number import *
from sage.all import*
from secret import flag


m_blocks = [bytes_to_long(flag), 0, 0, 0, 0]
p = getPrime(128)

def make_mask(n, p):
 upper = identity_matrix(n)
 low = identity_matrix(n)
 for i in range(n-1):
 for j in range(i+1, n):
 upper[i, j] = randrange(1, p)
 low[j, i] = randrange(1, p)
 result = upper * low
 assert det(result) == 1
 return result

def matrix_to_list(mat):
 return [list(row) for row in mat]

Noise = [[randrange(1, p) for _ in range(5)] for _ in range(4)]
Noise.append(m_blocks)

M = matrix(Noise)
A = make_mask(5, p)
C = A * M

print(f"Noise1={Noise[:4]}")
print(f"C={matrix_to_list(C)}")

'''
Noise1=[[188812369255757304700348466434858375423, 76227193101418053889793512137074274620, 182929943832562556837712357618449460966, 64089028822730485232228634757000880362, 105507998932915134646335608660824492778], [4164794451584365777414445214789654548, 218757364601017507642266976969178375594, 80900478205358595781985716970856912691, 8764894144288116721496194715688099729, 79843254020740598090548214477874901303], [117987853743114490372656147763454194438, 50462363711517823694719231238846607862, 223281008935308694936858040719274425965, 195686161149314741102381604090940280685, 255190262449767615741787613735615935193], [307996560867129103907440061301439467482, 244201634915439060595306901855401348278, 274311101173570181270086450310341285623, 107302772162122998219258251480409135045, 315856112749570024634898328181978603678]]
C=[[7549095046255750332237801728336040859334772097519102730041282718732588591286097116869332416391022019738347242276278766698156906555705385851, 32678071039005558259592443246596641034769961322822499350366597948506472312915956551829187426906905768184753514179380, 31986323782328762703818368292112429682487091705728337251517881966706448578725743041694735758215711997792479769768416, 14436850250809986882782230577460631764129797817847230901081280722327130562429243257968190463942277773451746453462582, 31121292454052422843719847188102625117398366197500933959853889186763173066605507892602645982827425901283104778292221], [7706938594218644198645262655888361646573462940640081908275744852516151826239618763929906370800935778758096453251327285086629846779468981315, 26330878424043569869214392883993117044708778826827450051713283720472446757085846592062228494046203274166331743213602, 24857177273083291760656086063531873337958479151212324100479828413230261594714770234719748627881602969003382340380303, 10701204334950696222836110814413459387113860196518011873575984392967690319665313155329101129794370494393952679549077, 24572394800395786579595451015986631185722061305759568372474188631404251754512686224709746129129276120602728383257777], [11413455295705082653945547551313333546335036834235413197142176083174466031786153627000022789417263202077931290945822526991594782041300524125, 25471180545905160889030953371219380924922739584058682948172053287466750144384688090173028639859506036824244304812158, 23570951485381148259743320056649061955890256395181599806489281180362961403987830105788981766739476950908584368018627, 8841273587596585448471713556252655344096448791123375053031642275508541897721478004315380581332333817343578483340851, 23502822195946748272231324934092148411160563639610181086553014413960808728166902969170101670012466997233946213819590], [7421950296415236255036285581661337216129672288628712160389173037334393744768886600555189991422762979394744362636715364094486754236805831283, 16457769281700732267826820071355765748300396519230181861693252076848397846956971602019313162032913030284068627192114, 15232356277146271770603816377269797778450646710986085702474591663364338830922301462505542520099289082804882409151229, 5693502364474910323896757819607564638117454538178679511671477570223524538553118891790661947619622326354006014535725, 15181756068875350357539670338144919822125852732174677771977932249778796486753690167705637589507167437374977859311864], [59840522766444025407946425909283435223280191210362668490197896687634499232220940811715879746607366608, 132693089828716473864848325625146553043330396013143903078592425572668035653388, 122813024364958858827663640077111626536436424651790581462109994081368873477982, 45904667136712185617747319952029678281659955585596441487265034839694031397236, 122405053037464876158961757478015519072596230291468407215303518565294845901638]]
'''

注意到 make_mask() 生成的矩阵 $A$ 满足 $\det(A)=1$ ，同时矩阵 $M$ 中仅有一个未知元素 $x$ 。

XiDianCTF MoeCTF 2025 Crypto EzAES

Thu, 17 Sep 2026 17:00:28 +0800

本文人工撰写；生成式AI仅用于校对和手写公式转 LaTeX。

题目链接

题目附件ez_aes.py:

from secret import flag

rc = [0x12, 0x23, 0x34, 0x45, 0x56, 0x67, 0x78, 0x89, 0x9a, 0xab, 0xbc, 0xcd, 0xde, 0xef,0xf1]

s_box = [
 [0x63, 0x7c, 0x77, 0x7b, 0xf2, 0x6b, 0x6f, 0xc5, 0x30, 0x01, 0x67, 0x2b, 0xfe, 0xd7, 0xab, 0x76],
 [0xca, 0x82, 0xc9, 0x7d, 0xfa, 0x59, 0x47, 0xf0, 0xad, 0xd4, 0xa2, 0xaf, 0x9c, 0xa4, 0x72, 0xc0],
 [0xb7, 0xfd, 0x93, 0x26, 0x36, 0x3f, 0xf7, 0xcc, 0x34, 0xa5, 0xe5, 0xf1, 0x71, 0xd8, 0x31, 0x15],
 [0x04, 0xc7, 0x23, 0xc3, 0x18, 0x96, 0x05, 0x9a, 0x07, 0x12, 0x80, 0xe2, 0xeb, 0x27, 0xb2, 0x75],
 [0x09, 0x83, 0x2c, 0x1a, 0x1b, 0x6e, 0x5a, 0xa0, 0x52, 0x3b, 0xd6, 0xb3, 0x29, 0xe3, 0x2f, 0x84],
 [0x53, 0xd1, 0x00, 0xed, 0x20, 0xfc, 0xb1, 0x5b, 0x6a, 0xcb, 0xbe, 0x39, 0x4a, 0x4c, 0x58, 0xcf],
 [0xd0, 0xef, 0xaa, 0xfb, 0x43, 0x4d, 0x33, 0x85, 0x45, 0xf9, 0x02, 0x7f, 0x50, 0x3c, 0x9f, 0xa8],
 [0x51, 0xa3, 0x40, 0x8f, 0x92, 0x9d, 0x38, 0xf5, 0xbc, 0xb6, 0xda, 0x21, 0x10, 0xff, 0xf3, 0xd2],
 [0xcd, 0x0c, 0x13, 0xec, 0x5f, 0x97, 0x44, 0x17, 0xc4, 0xa7, 0x7e, 0x3d, 0x64, 0x5d, 0x19, 0x73],
 [0x60, 0x81, 0x4f, 0xdc, 0x22, 0x2a, 0x90, 0x88, 0x46, 0xee, 0xb8, 0x14, 0xde, 0x5e, 0x0b, 0xdb],
 [0xe0, 0x32, 0x3a, 0x0a, 0x49, 0x06, 0x24, 0x5c, 0xc2, 0xd3, 0xac, 0x62, 0x91, 0x95, 0xe4, 0x79],
 [0xe7, 0xc8, 0x37, 0x6d, 0x8d, 0xd5, 0x4e, 0xa9, 0x6c, 0x56, 0xf4, 0xea, 0x65, 0x7a, 0xae, 0x08],
 [0xba, 0x78, 0x25, 0x2e, 0x1c, 0xa6, 0xb4, 0xc6, 0xe8, 0xdd, 0x74, 0x1f, 0x4b, 0xbd, 0x8b, 0x8a],
 [0x70, 0x3e, 0xb5, 0x66, 0x48, 0x03, 0xf6, 0x0e, 0x61, 0x35, 0x57, 0xb9, 0x86, 0xc1, 0x1d, 0x9e],
 [0xe1, 0xf8, 0x98, 0x11, 0x69, 0xd9, 0x8e, 0x94, 0x9b, 0x1e, 0x87, 0xe9, 0xce, 0x55, 0x28, 0xdf],
 [0x8c, 0xa1, 0x89, 0x0d, 0xbf, 0xe6, 0x42, 0x68, 0x41, 0x99, 0x2d, 0x0f, 0xb0, 0x54, 0xbb, 0x16]
]

s_box_inv = [
 [0x52, 0x09, 0x6a, 0xd5, 0x30, 0x36, 0xa5, 0x38, 0xbf, 0x40, 0xa3, 0x9e, 0x81, 0xf3, 0xd7, 0xfb],
 [0x7c, 0xe3, 0x39, 0x82, 0x9b, 0x2f, 0xff, 0x87, 0x34, 0x8e, 0x43, 0x44, 0xc4, 0xde, 0xe9, 0xcb],
 [0x54, 0x7b, 0x94, 0x32, 0xa6, 0xc2, 0x23, 0x3d, 0xee, 0x4c, 0x95, 0x0b, 0x42, 0xfa, 0xc3, 0x4e],
 [0x08, 0x2e, 0xa1, 0x66, 0x28, 0xd9, 0x24, 0xb2, 0x76, 0x5b, 0xa2, 0x49, 0x6d, 0x8b, 0xd1, 0x25],
 [0x72, 0xf8, 0xf6, 0x64, 0x86, 0x68, 0x98, 0x16, 0xd4, 0xa4, 0x5c, 0xcc, 0x5d, 0x65, 0xb6, 0x92],
 [0x6c, 0x70, 0x48, 0x50, 0xfd, 0xed, 0xb9, 0xda, 0x5e, 0x15, 0x46, 0x57, 0xa7, 0x8d, 0x9d, 0x84],
 [0x90, 0xd8, 0xab, 0x00, 0x8c, 0xbc, 0xd3, 0x0a, 0xf7, 0xe4, 0x58, 0x05, 0xb8, 0xb3, 0x45, 0x06],
 [0xd0, 0x2c, 0x1e, 0x8f, 0xca, 0x3f, 0x0f, 0x02, 0xc1, 0xaf, 0xbd, 0x03, 0x01, 0x13, 0x8a, 0x6b],
 [0x3a, 0x91, 0x11, 0x41, 0x4f, 0x67, 0xdc, 0xea, 0x97, 0xf2, 0xcf, 0xce, 0xf0, 0xb4, 0xe6, 0x73],
 [0x96, 0xac, 0x74, 0x22, 0xe7, 0xad, 0x35, 0x85, 0xe2, 0xf9, 0x37, 0xe8, 0x1c, 0x75, 0xdf, 0x6e],
 [0x47, 0xf1, 0x1a, 0x71, 0x1d, 0x29, 0xc5, 0x89, 0x6f, 0xb7, 0x62, 0x0e, 0xaa, 0x18, 0xbe, 0x1b],
 [0xfc, 0x56, 0x3e, 0x4b, 0xc6, 0xd2, 0x79, 0x20, 0x9a, 0xdb, 0xc0, 0xfe, 0x78, 0xcd, 0x5a, 0xf4],
 [0x1f, 0xdd, 0xa8, 0x33, 0x88, 0x07, 0xc7, 0x31, 0xb1, 0x12, 0x10, 0x59, 0x27, 0x80, 0xec, 0x5f],
 [0x60, 0x51, 0x7f, 0xa9, 0x19, 0xb5, 0x4a, 0x0d, 0x2d, 0xe5, 0x7a, 0x9f, 0x93, 0xc9, 0x9c, 0xef],
 [0xa0, 0xe0, 0x3b, 0x4d, 0xae, 0x2a, 0xf5, 0xb0, 0xc8, 0xeb, 0xbb, 0x3c, 0x83, 0x53, 0x99, 0x61],
 [0x17, 0x2b, 0x04, 0x7e, 0xba, 0x77, 0xd6, 0x26, 0xe1, 0x69, 0x14, 0x63, 0x55, 0x21, 0x0c, 0x7d]
]

def sub_bytes(grid):
 for i, v in enumerate(grid):
 grid[i] = s_box[v >> 4][v & 0xf]

def shift_rows(grid):
 for i in range(4):
 grid[i::4] = grid[i::4][i:] + grid[i::4][:i]
 grid =grid[0::4]+grid[1::4]+grid[2::4]+grid[3::4]

def mix_columns(grid):
 def mul_by_2(n):
 s = (n << 1) & 0xff
 if n & 128:
 s ^= 0x1b
 return s

 def mul_by_3(n):
 return n ^ mul_by_2(n)

 def mix_column(c):
 return [
 mul_by_2(c[0]) ^ mul_by_3(c[1]) ^ c[2] ^ c[3], # [2 3 1 1]
 c[0] ^ mul_by_2(c[1]) ^ mul_by_3(c[2]) ^ c[3], # [1 2 3 1]
 c[0] ^ c[1] ^ mul_by_2(c[2]) ^ mul_by_3(c[3]), # [1 1 2 3]
 mul_by_3(c[0]) ^ c[1] ^ c[2] ^ mul_by_2(c[3]), # [3 1 1 2]
 ]

 for i in range(0, 16, 4):
 grid[i:i + 4] = mix_column(grid[i:i + 4])

def key_expansion(grid):
 for i in range(10 * 4):
 r = grid[-4:]
 if i % 4 == 0: # 对上一轮最后4字节自循环、S-box置换、轮常数异或，从而计算出当前新一轮最前4字节
 for j, v in enumerate(r[1:] + r[:1]):
 r[j] = s_box[v >> 4][v & 0xf] ^ (rc[i // 4] if j == 0 else 0)

 for j in range(4):
 grid.append(grid[-16] ^ r[j])

 return grid

def add_round_key(grid, round_key):
 for i in range(16):
 grid[i] ^= round_key[i]

def encrypt(b, expanded_key):
 # First round
 add_round_key(b, expanded_key)

 for i in range(1, 10):
 sub_bytes(b)
 shift_rows(b)
 mix_columns(b)
 add_round_key(b, expanded_key[i * 16:])

 # Final round
 sub_bytes(b)
 shift_rows(b)
 add_round_key(b, expanded_key[-16:])
 return b


def aes(key, msg):
 expanded = key_expansion(bytearray(key))

 # Pad the message to a multiple of 16 bytes
 b = bytearray(msg + b'\x00' * (16 - len(msg) % 16))
 # Encrypt the message
 for i in range(0, len(b), 16):
 b[i:i + 16] = encrypt(b[i:i + 16], expanded)
 return bytes(b)

if __name__ == '__main__':
 key = b'Slightly different from the AES.'
 enc = aes(key, flag)

 print('Encrypted:', enc)
 #Encrypted: b'%\x98\x10\x8b\x93O\xc7\xf02F\xae\xedA\x96\x1b\xf9\x9d\x96\xcb\x8bT\r\xd31P\xe6\x1a\xa1j\x0c\xe6\xc8'

注意到Rcon和ShiftRows为非标过程，但仍保持可逆，所以需要我们手写解密过程:(。

XiDianCTF MoeCTF 2025 Crypto Ez_square

Wed, 16 Sep 2026 21:24:18 +0800

本文人工撰写；生成式AI仅用于校对和手写公式转 LaTeX。

题目链接

题目附件ez_square.py:

from Crypto.Util.number import *
from secret import flag

assert len(flag) == 35
assert flag[:7] == b'moectf{'
assert flag[-1:] == b'}'

def main():
 p = getPrime(512)
 q = getPrime(512)

 n = p * q
 e = 65537

 m = bytes_to_long(flag)

 c = pow(m, e, n)
 hint = pow(p + q, 2, n)

 print(f'{n = }')
 print(f'{c = }')
 print(f'{hint = }')

if __name__ == '__main__':
 main()

"""
n = 83917281059209836833837824007690691544699901753577294450739161840987816051781770716778159151802639720854808886223999296102766845876403271538287419091422744267873129896312388567406645946985868002735024896571899580581985438021613509956651683237014111116217116870686535030557076307205101926450610365611263289149
c = 69694813399964784535448926320621517155870332267827466101049186858004350675634768405333171732816667487889978017750378262941788713673371418944090831542155613846263236805141090585331932145339718055875857157018510852176248031272419248573911998354239587587157830782446559008393076144761176799690034691298870022190
hint = 5491796378615699391870545352353909903258578093592392113819670099563278086635523482350754035015775218028095468852040957207028066409846581454987397954900268152836625448524886929236711403732984563866312512753483333102094024510204387673875968726154625598491190530093961973354413317757182213887911644502704780304
"""

依旧是RSA加解密，需要我们想办法求出 $p$ 和 $q$ 。

XiDianCTF MoeCTF 2025 Crypto EzBSGS

Wed, 16 Sep 2026 20:29:31 +0800

本文为人工撰写，仅使用生成式AI校对。

题目链接

题目:

西小电注意到，第一周的题目中出现了若干神秘数字，并且他还发现这些神秘数字与神秘Flag有关，具体地，xx 是能够满足神秘式子 13x=114514mod 10000000000009913x=114514mod100000000000099 的最小整数，flag内容即为 xx ，你能帮助西小电求出正确的 Flag 吗？

XiDianCTF MoeCTF 2025 Crypto Baby_next

Tue, 15 Sep 2026 22:29:41 +0800

本文为人工撰写，仅使用生成式AI校对。

题目链接

题目附件baby_next.py:

from Crypto.Util.number import *
from gmpy2 import next_prime
from functools import reduce
from secret import flag

assert len(flag) == 38
assert flag[:7] == b'moectf{'
assert flag[-1:] == b'}'

def main():
 p = getPrime(512)
 q = int(reduce(lambda res, _: next_prime(res), range(114514), p))

 n = p * q
 e = 65537

 m = bytes_to_long(flag)

 c = pow(m, e, n)

 print(f'{n = }')
 print(f'{c = }')

if __name__ == '__main__':
 main()

"""
n = 96742777571959902478849172116992100058097986518388851527052638944778038830381328778848540098201307724752598903628039482354215330671373992156290837979842156381411957754907190292238010742130674404082688791216045656050228686469536688900043735264177699512562466087275808541376525564145453954694429605944189276397
c = 17445962474813629559693587749061112782648120738023354591681532173123918523200368390246892643206880043853188835375836941118739796280111891950421612990713883817902247767311707918305107969264361136058458670735307702064189010952773013588328843994478490621886896074511809007736368751211179727573924125553940385967
"""

注意到这是RSA加密，并且公钥(n, e)已给出，私钥缺少d。

XiDianCTF MoeCTF 2025 Crypto Ez_DES

Tue, 15 Sep 2026 21:54:13 +0800

本文为人工撰写，仅使用生成式AI校对。

题目链接

题目附件ez_des.py:

from Crypto.Cipher import DES
import secrets
import string

flag = 'moectf{???}'
characters = string.ascii_letters + string.digits + string.punctuation
key = 'ezdes'+''.join(secrets.choice(characters) for _ in range(3))
assert key[:5] == 'ezdes'
key = key.encode('utf-8')
l = 8

def encrypt(text, key):
 cipher = DES.new(key, DES.MODE_ECB)
 padded_text = text + (l - len(text) % l) * chr(len(text))
 data = cipher.encrypt(padded_text.encode('utf-8'))
 return data

c = encrypt(flag, key)
print('c =', c)

# c = b'\xe6\x8b0\xc8m\t?\x1d\xf6\x99sA>\xce \rN\x83z\xa0\xdc{\xbc\xb8X\xb2\xe2q\xa4"\xfc\x07'

注意到key之后后三位随机，并且flag头部特征已给出，所以可以尝试爆破。