好久没水文章了，贴一篇以前做过的一道题目

Task

from Crypto.Util.number import *
from flag import p, q, a, b, c, d, e, flag

assert p.bit_length() == 512
assert q.bit_length() == 512
n = p * q
assert a * a + e * b * b == n
assert c * c + e * d * d == n

m = bytes_to_long(flag)
cipher = pow(m, e, n)
print('n =', n)
print('cipher =', cipher)
print('a =', a)
print('b =', b)
print('c =', c)
print('d =', d)

"""
n = 60759060882959791909904396677188989949758090199603630243982902422381690538885036721260587316981956179159099537464766520810988299027308891716697721325694989187113132568281096643090555966502943628821584608317087986774067361766441006582461264783625589284748285132591500064467264821214540974749792006934616412217
cipher = 20458653228553322014465307182393782250675128141639209159045300541287741675246921642347569059959881263633155911063532171465637193709348356233437155581027365642514135793800584667963139842701093152576878356429568990356697857264248093880916698956321511178224500312370845360786231377700287611408999899734512143183
a = 7794809868300816476939749391923181660663599092817735689970830403880360740950291069966802056703842257352942487715953634294627774900178116901736408438781725
b = 19283995921825875899155714134110227538038032500196406129941198508864582000463560816723795975202107099295086076956040133684
c = 7794809868300816476939748778965768208814733337627617321244638924271232070361166330324980435743037906985498772947115676315756364476413563742000304770717475
d = 172332404813056620110912939211150875333966617506319147214329967023854401850532359816888852973202924631133349299841944983684

"""

思路

e很好求，问题是怎么分解n

相关论文

https://cs.uwaterloo.ca/journals/JIS/VOL17/Matthews/matt10.pdf

类似题目（plus版

https://github.com/Sarkoxed/ctf-writeups/tree/master/hacktm2023/kaitenzushi

Exp

from math import gcd
from Crypto.Util.number import inverse, long_to_bytes

n = 60759060882959791909904396677188989949758090199603630243982902422381690538885036721260587316981956179159099537464766520810988299027308891716697721325694989187113132568281096643090555966502943628821584608317087986774067361766441006582461264783625589284748285132591500064467264821214540974749792006934616412217
cipher = 20458653228553322014465307182393782250675128141639209159045300541287741675246921642347569059959881263633155911063532171465637193709348356233437155581027365642514135793800584667963139842701093152576878356429568990356697857264248093880916698956321511178224500312370845360786231377700287611408999899734512143183
a = 7794809868300816476939749391923181660663599092817735689970830403880360740950291069966802056703842257352942487715953634294627774900178116901736408438781725
b = 19283995921825875899155714134110227538038032500196406129941198508864582000463560816723795975202107099295086076956040133684
c = 7794809868300816476939748778965768208814733337627617321244638924271232070361166330324980435743037906985498772947115676315756364476413563742000304770717475
d = 172332404813056620110912939211150875333966617506319147214329967023854401850532359816888852973202924631133349299841944983684

e = (n - a * a) // (b * b)

z1 = (a * pow(b, -1, n)) % n
z2 = (c * pow(d, -1, n)) % n

sum_z = (z1 + z2) % n

p = gcd(sum_z, n)
q = n//p

phi_n = (p - 1) * (q - 1)
d = inverse(e, phi_n)

m = pow(cipher, d, n)

flag = long_to_bytes(m)
print(flag)