aes_key = shared_secret[:16]

iv = shared_secret[16:]

random.seed(int(iv.hex(),16))

def sign(message, private_key:SigningKey):

    message = message.encode()

    k = random.randint(1, SECP256k1.order - 1)  

    signature = private_key.sign(message,hashfunc=hashlib.sha256 ,k=k)

    return signature

def compute_shared_secret(private_key, public_key):

    shared_point = private_key.privkey.secret_multiplier * public_key.pubkey.point

    shared_secret_bytes = shared_point.to_bytes()

    return hashlib.sha256(shared_secret_bytes).digest()

shared_secret = compute_shared_secret(alice_private_key, bob_public_key)

print(f"\nSend to Aice:")

        ciphertext_forged = bytes.fromhex(input("Ciphertext (hex): "))

        signature_forged = bytes.fromhex(input("Signature (hex): "))

        plaintext = decrypt(ciphertext_forged)

        print("Debug: ",plaintext)

        verified = verify(plaintext,signature_forged,bob_public_key)

        if verified and plaintext.decode() == "Can I have the key again, I think I forgot where I kept the key.":

            print("Very good, now we wait.")

            ciphertext = encrypt(secret)

            signature = sign(secret,alice_private_key)

            print(f"\nIntercepted from Alice:\nCiphertext: {ciphertext.hex()}\nSignature: {signature.hex()}\n")

from pwn import *

import re

from binascii import hexlify, unhexlify

from hashlib import sha256

import random

from ecdsa import SigningKey, SECP256k1, VerifyingKey

from Crypto.Cipher import AES

from Crypto.Util.Padding import pad, unpad

def xor(a,b):

    return bytearray([x^y for (x,y) in zip(a,b)])

io = process(["py","chall.py"])

msg = io.recvuntil(b"Ciphertext (hex): ").decode()

print(msg)

alice_public_key_hexstr = re.search(r"Alice's public key:\s*([0-9a-fA-F]+)", msg).group(1) 

bos_public_key_hexstr = re.search(r"Bob's public key:\s*([0-9a-fA-F]+)", msg).group(1)

alice_public_key = VerifyingKey.from_string(unhexlify(alice_public_key_hexstr), curve=SECP256k1)

bob_public_key = VerifyingKey.from_string(unhexlify(bos_public_key_hexstr), curve=SECP256k1)

alice_ciphertext_1 = re.search(r"Ciphertext:\s*([0-9a-fA-F]+)", msg).group(1)

alice_signature_1 = re.search(r"Signature:\s*([0-9a-fA-F]+)", msg).group(1)

c1 = b"1"*16 + b"\x00"*16 + b"1"*16

c1_hex = hexlify(c1)

io.sendline(c1_hex)

print(io.recvuntil(b"Signature (hex): ").decode())

io.sendline(c1_hex)

msg = io.recvuntil(b"Ciphertext (hex): ").decode()

print(msg)

pt_hexstr = re.search(r"and this is what they found:\s*([0-9a-fA-F]+)", msg).group(1)

pt_bytes = unhexlify(pt_hexstr)

iv_bytes = xor(pt_bytes[:16], pt_bytes[32:48])

print(iv_bytes)

random.seed(int(iv_bytes.hex(),16))

    # k = random.randint(1, SECP256k1.order - 1)  

def sign(message, private_key:SigningKey, k):

    signature = private_key.sign(message,hashfunc=hashlib.sha256 ,k=k)

    return signature

io.sendline(alice_ciphertext_1.encode())

io.sendlineafter(b"Signature (hex): ", alice_signature_1.encode())

# io.sendline(c1_hex)

# print(io.recvuntil(b"Signature (hex): ").decode())

k = random.randint(1, SECP256k1.order - 1)

k = random.randint(1, SECP256k1.order - 1)

# io.sendline(hexlify(sig_c1))

io.recvuntil(b"Ciphertext: ")

ciphertext = bytes.fromhex(io.readline().decode())

io.recvuntil(b"Signature: ")

signature = bytes.fromhex(io.readline().decode())

bob_sigature = signature

print("BEFORE")

def compute_shared_secret(private_key, public_key):

    shared_point = private_key.privkey.secret_multiplier * public_key.pubkey.point

    shared_secret_bytes = shared_point.to_bytes()

    return hashlib.sha256(shared_secret_bytes).digest()

r = int.from_bytes(signature[:32])

s = int.from_bytes(signature[32:])

z = int.from_bytes(sha256(b"msg2").digest()) % SECP256k1.order

print(r,s)

io.sendlineafter(b"Ciphertext (hex): ", ciphertext.hex().encode())

io.sendlineafter(b"Signature (hex): ", signature.hex().encode())

maybe_d = (((s * k) - z) * pow(r, -1, SECP256k1.order)) % SECP256k1.order

bob_private_key = SigningKey.from_secret_exponent(maybe_d, curve=SECP256k1)

shared_secret = compute_shared_secret(bob_private_key, alice_public_key)

assert(shared_secret[16:] == iv_bytes)

aes_key = shared_secret[:16]

# print(io.recv(512).decode())

print(io.recvuntil(b"Send to Aice:").decode())

chosen_plaintext = b"Can I have the key again, I think I forgot where I kept the key."

cipher = AES.new(aes_key, AES.MODE_CBC, iv_bytes)

ciphertext = cipher.encrypt(pad(chosen_plaintext, AES.block_size))

k = random.randint(1, SECP256k1.order - 1)

signature = bob_private_key.sign(chosen_plaintext,hashfunc=sha256 ,k=k)

io.sendlineafter(b"Ciphertext (hex): ", ciphertext.hex().encode())

io.sendlineafter(b"Signature (hex): ", signature.hex().encode())

# then alice should send us the flag encrypted...

# ... along with a signature that we can ignore

# print(io.recv(512).decode())

io.readuntil(b"Ciphertext: ")

flag_ciphertext = bytes.fromhex(io.readline().decode())

io.readuntil(b"Signature: ")

flag_signature = bytes.fromhex(io.readline().decode())

cipher = AES.new(aes_key, AES.MODE_CBC, iv_bytes)

plaintext = unpad(cipher.decrypt(flag_ciphertext), AES.block_size)

# flag = plaintext[59:].decode()

print(plaintext.decode())

# n = SECP256k1.order

# s = pow(k,-1,n) * (z + r*d)

from sympy import Eq, symbols, solve

from tqdm import tqdm

from Crypto.Util.number import long_to_bytes

e = 65537

n = 94391578028846794543970306963076155289398888845132329034244336898352288130614402434536624297683695128972774452047972797577299176726976054101512298009248486464357336027594075427866979990479026404794249095503495046303993475122649145761379383861274918580282133794104162177538259963029805672413580517485119968223

ct = 39104570513649572073989733086496155533723794051858605899505397827989625611665929344072330992965609070817627613891751881019486310635360263164859429539044097039969287153948226763672953863052936937079161030077852648023719781006057880499973169570114083902285555659303311508836688226455433255342509705736365222119

K = 20846957286553798859449981607534380028938425515469447720112802165918184044375264023823946177012518880630631981155207307372567493851397122661053548491580627249805353321445391571601385814438186661146844697737274273249806871709168307518276727937806212329164651501381607714573451433576078813716191884613278097774416977870414769368668977000867137595804897175325233583378535207450965916514442776136840826269286229146556626874736082105623962789881101475873449157946816513513532838149452759771630220014344325387486921028690085783785067988074331005737389865053848981113695310344572311901555735038842261745556925398852334383830822697851

C = 0xbaaaaaad

D = 0xdeadbeef

A= 0xbaadf00d

p = symbols("p",integer=True)

START=42675

# START=1

flag = False

for z in tqdm(range(START,e+1)):

    equation = Eq(K*e, (A*p**2 - C*p + D)*(1+z*(n/p-1)*(p-1)))

    solutions = solve(equation, p)

    for sol in solutions:

        if sol.is_integer:

            print(sol)

            flag = True

            break

    if flag:

        break

# p = 10406216443192169173533723167461845081683996237790486467542778667477564930803546070928131853072839096935544813786122096301171127932695303325352097678393621

phi = (n//p-1)*(p-1)

d = pow(e, -1, phi)

m = pow(ct, d, n)

print(long_to_bytes(m).decode())

#!/usr/bin/env python3

from pwn import remote, context, log

from math import gcd

from Cryptodome.Util.number import long_to_bytes, inverse

from gmpy2 import iroot

context.log_level = "debug"

def rsa_decrypt_modp(c, e, p):

    g = gcd(e, p - 1)

    if g == 1:

        d = inverse(e, p - 1)

        return pow(c, d, p)

    else:

        e_prime = e // g

        t = (p - 1) // g

        d_prime = inverse(e_prime, t)

        X = pow(c, d_prime, p)

        log.info("Computed X = m^g mod p: {}".format(X))

        root, exact = iroot(X, g)

        if exact:

            log.info("Successfully extracted integer g-th root using gmpy2")

            return int(root)

        else:

            raise Exception("No valid g-th root found")

def recv_until_keyword(r, keyword):

    while True:

        line = r.recvline().decode().strip()

        log.debug("Received: " + line)

        if keyword in line:

            return line

def get_lucky_output(r, x):

    r.recvuntil("Enter your lucky number : ")

    r.sendline(str(x))

    line = r.recvline().decode().strip()

    if "Your lucky output" not in line:

        line = r.recvline().decode().strip()

    val = int(line.split(':')[-1].strip())

    r.recvline()

    return val

def main():

    HOST = "chals.bitskrieg.in"

    PORT = 7001

    r = remote(HOST, PORT)

    line = recv_until_keyword(r, "Pseudo_n")

    pseudo_n = int(line.split('=')[-1].strip())

    log.info("Parsed Pseudo_n = {}".format(pseudo_n))

    line = recv_until_keyword(r, "e =")

    e = int(line.split('=')[-1].strip())

    log.info("Parsed e = {}".format(e))

    cts = []

    for i in range(3):

        line = recv_until_keyword(r, "Ciphertext")

        ct = int(line.split('=')[-1].strip())

        cts.append(ct)

        log.info("Parsed Ciphertext {}: {}".format(i+1, ct))

    F3 = get_lucky_output(r, 3)

    log.info("F(3) = {}".format(F3))

    F4 = get_lucky_output(r, 4)

    log.info("F(4) = {}".format(F4))

    n_val = F3 + 4 * F4

    log.info("Recovered n (p * r) = {}".format(n_val))

    r_val = gcd(n_val, pseudo_n)

    log.info("Recovered r = {}".format(r_val))

    p_val = n_val // r_val

    log.info("Recovered p = {}".format(p_val))

    flag_parts = []

    for idx, ct in enumerate(cts, start=1):

        m_int = rsa_decrypt_modp(ct, e, p_val)

        part = long_to_bytes(m_int)

        log.info("Decrypted part {}: {}".format(idx, part))

        flag_parts.append(part)

    flag = b"".join(flag_parts)

    log.success("Flag: {}".format(flag.decode()))

    r.close()

if __name__ == "__main__":

    main()

#F(x) is the output of the func 'lmao' you can get that F(x)+(x+1)F(x+1)=p*r. send 2 small values to the server and use the printed value which is psudo_n=(r*(e^p mod q)) then gcd(psudo_n,n) you can get r then p=n/r  decrypt mod p will give the flag

import random

import os

seed = int.from_bytes(os.urandom(8), "big")

random.seed(seed)

flag = "REDACTED"

def generate_password():

    global i

    password = (random.getrandbits(32) ^ i ^ 195894762) ^ 322420958

    return password

print("Vault is locked! Enter the password to unlock.")

i = 1

while True:

    password = generate_password()

    attempt = input("> ")

    if not attempt.isdigit():

        print("Invalid input! Enter a number.")

        continue

    difference = abs(password - int(attempt))

    if difference == 0:

        print("Access Granted! Here is your flag:")

        print(flag)

        break

    print(f"Access Denied! You are {difference} away from the correct password. Try again!")

    i += 1

def generate_password():

    global i

    password = random.getrandbits(32) *  ( i ^ 195894762 ^ 322420958) * 2969596945

    return password

import random

from mt19937predictor import MT19937Predictor

predictor = MT19937Predictor()

for _ in range(624):

    x = random.getrandbits(32)

    predictor.setrandbits(x, 32)  # Submit samples here

# When enough samples are given, you can start predicting:

assert random.getrandbits(32) == predictor.getrandbits(32)

import numpy as np

import matplotlib.pyplot as plt

from scipy.signal import hilbert

from scipy.io import wavfile

# 1. Wczytanie pliku IQ

file_path = "modulated.iq"

iq_data = np.fromfile(file_path, dtype=np.complex64)

# 2. Parametry

Fs = 24000  # Sampling rate 24kHz

Fc = 1550000  # Przybliżona nośna (np. 1550 kHz)

t = np.arange(len(iq_data)) / Fs

# 3. Przemiana częstotliwości (mixing)

demod_signal = iq_data * np.exp(-1j * 2 * np.pi * Fc * t)

# 4. Demodulacja AM (obwiednia)

audio_signal = np.abs(hilbert(demod_signal.real))

# 5. Normalizacja i zapis do pliku WAV

audio_signal = (audio_signal / np.max(np.abs(audio_signal)) * 32767).astype(np.int16)

wavfile.write("output.wav", Fs, audio_signal)

print("Demodulacja zakończona! Otwórz output.wav, aby odsłuchać.")