[广东强网杯 2021 团队组]RSA and BASE? cigerant的WriteUp

首先，使用factordb分解得到p和q，分别为
p = 127059276863396320706295330136200886609600493401056775186365515611547962912096366560863480830412003882577863014816249680438671577507675892180828563868163627
q = 445943381059409537717658916522990906261609738909680208927145849237389096915733551127729182559244164126263654638010224865124975773193229727063534492604345147
这样，就可以使用RSA求解出m

然后，题目中给出了如下提示，说明是换表base32，但有4位不确定，需要爆破得出
BASE:
"GHI45FQRSCX****UVWJK67DELMNOPAB3"

综上所述，编写exp如下


from gmpy2 import invert
from Crypto.Util.number import long_to_bytes
from itertools import permutations
import base64

n = 56661243519426563299920058134092862370737397949947210394843021856477420959615132553610830104961645574615005956183703191006421508461009698780382360943562001485153455401650697532951591191737164547520951628336941289873198979641173541232117518791706826699650307105202062429672725308809988269372149027026719779368169
e = 36269788044703267426177340992826172140174404390577736281478891381612294207666891529019937732720246602062358244751177942289155662197410594434293004130952671354973700999803850153697545606312859272554835232089533366743867361181786472126124169787094837977468259794816050397735724313560434944684790818009385459207329
c = 137954301101369152742229874240507191901061563449586247819350394387527789763579249250710679911626270895090455502283455665178389917777053863730286065809459077858674885530015624798882224173066151402222862023045940035652321621761390317038440821354117827990307003831352154618952447402389360183594248381165728338233
# factordb result
p = 127059276863396320706295330136200886609600493401056775186365515611547962912096366560863480830412003882577863014816249680438671577507675892180828563868163627
q = 445943381059409537717658916522990906261609738909680208927145849237389096915733551127729182559244164126263654638010224865124975773193229727063534492604345147

m = pow(c, invert(e, (p - 1) * (q - 1)), n)
print("flag:", long_to_bytes(m))

str_list = ['T', 'Y', 'Z', '2']
perms = permutations(str_list)
middle_part = []
for perm in perms:
    middle_part.append(''.join(perm))
for str_part in middle_part:
    flag = 'TCMDIEOH2MJFBLKHT2J7BLYZ2WUE5NYR2HNG===='
    t = 'GHI45FQRSCX' + str_part + 'UVWJK67DELMNOPAB3='
    table = 'ABCDEFGHIJKLMNOPQRSTUVWXYZ234567='
    table = str.maketrans(t, table)
    flag = base64.b32decode(flag.translate(table))
    print(flag)