ctf-crypto-attack-templates
When to Use
- Attacking RSA with known weaknesses (small e, small d, shared factors)
- Exploiting AES ECB mode (byte-at-a-time, block shuffling)
- Exploiting AES CBC mode (bit-flipping, IV manipulation, padding oracle)
- Recovering XOR keys from ciphertext (known plaintext, frequency analysis, repeating key)
- Using Z3 to solve constraint satisfaction problems in crypto challenges
- Performing hash length extension attacks
- Factoring RSA moduli using known methods
- Brute-forcing small keyspaces
- Implementing custom cipher analysis
Quick Start
from Crypto.Util.number import long_to_bytes, bytes_to_long, inverse, GCD
# RSA decrypt with known factors
n, e, c = ... # Given values
p, q = ... # Factored
phi = (p - 1) * (q - 1)
d = inverse(e, phi)
print(long_to_bytes(pow(c, d, n)))
# XOR decrypt with known key
ct = bytes.fromhex('...')
key = b'secret'
pt = bytes(c ^ key[i % len(key)] for i, c in enumerate(ct))
print(pt)
Attack Decision Tree
What type of crypto challenge?
│
├─ RSA (n, e, c given)
│ ├─ Factors known → Standard decrypt
│ ├─ e is small (3) → Cube root or Hastad broadcast
│ ├─ d is small → Wiener's attack
│ ├─ Same n, different e → Common modulus
│ └─ Factor n → factordb, Fermat, Pollard p-1, shared factor
│
├─ AES / Block cipher
│ ├─ ECB mode + oracle → Byte-at-a-time
│ ├─ CBC mode + controlled input → Bit-flipping
│ └─ CBC + padding error visible → Padding oracle
│
├─ XOR cipher
│ ├─ Single byte key → Brute-force (256 keys)
│ ├─ Repeating key → Hamming distance + per-position brute
│ └─ Known plaintext → Direct key recovery
│
├─ Custom cipher / keygen
│ └─ Z3 constraint solver
│
└─ Hash-based
├─ MAC with known data → Length extension
└─ Short secret/PIN → Brute-force
Technique Reference Files
Full templates with copy-paste code are in the references/ directory — loaded on demand, not into context:
| Technique |
Reference File |
Key Templates |
| RSA Attacks |
references/rsa-attacks.md |
Standard decrypt, small-e, Hastad broadcast, Wiener, common modulus, factordb, Fermat, Pollard p-1, shared factor |
| Symmetric & XOR |
references/symmetric-xor.md |
ECB byte-at-a-time, CBC bit-flip, padding oracle, single-byte XOR, repeating-key XOR, known plaintext |
| Z3 & Hash |
references/z3-hash.md |
Z3 basic, key recovery, cipher reversal, hash length extension, hash brute-force, baby-step giant-step |
Usage: When you need a specific technique, read the corresponding reference file for the full template.
Common Pitfalls
- Always try
factordb before implementing factorization from scratch
- Check if
e and phi are coprime before computing inverse(e, phi)
- For padding oracle: handle false positives on second-to-last byte position
- XOR frequency analysis needs sufficient ciphertext length to be reliable
- Z3 BitVec width must match the actual data size (8 for bytes, 32 for ints, 64 for longs)
Examples
Example 1: RSA with Small e
from Crypto.Util.number import long_to_bytes
import gmpy2
m, exact = gmpy2.iroot(c, 3)
if exact:
print(long_to_bytes(int(m)))
Example 2: Z3 License Key
from z3 import *
key = [BitVec(f'k{i}', 8) for i in range(20)]
s = Solver()
s.add(key[0] + key[1] == 200)
s.add(key[2] ^ key[3] == 42)
if s.check() == sat:
m = s.model()
print(''.join(chr(m[k].as_long()) for k in key))
1---2name: ctf-crypto-attack-templates3description: Cryptographic attack templates for CTF challenges. Provides ready-to-run Python scripts for RSA attacks (small-e, Wiener, Hastad, common modulus, factorization), AES exploitation (ECB byte-at-a-time, CBC bit-flipping, padding oracle), hash attacks (length extension, collision), XOR key recovery, and Z3 constraint solving. Use when attacking RSA implementations, when exploiting block cipher misuse, when performing frequency analysis, when using Z3 for constraint satisfaction, or when automating crypto challenge solves.4---56# ctf-crypto-attack-templates78## When to Use910- Attacking RSA with known weaknesses (small e, small d, shared factors)11- Exploiting AES ECB mode (byte-at-a-time, block shuffling)12- Exploiting AES CBC mode (bit-flipping, IV manipulation, padding oracle)13- Recovering XOR keys from ciphertext (known plaintext, frequency analysis, repeating key)14- Using Z3 to solve constraint satisfaction problems in crypto challenges15- Performing hash length extension attacks16- Factoring RSA moduli using known methods17- Brute-forcing small keyspaces18- Implementing custom cipher analysis1920## Quick Start2122```python23from Crypto.Util.number import long_to_bytes, bytes_to_long, inverse, GCD24# RSA decrypt with known factors25n, e, c = ... # Given values26p, q = ... # Factored27phi = (p - 1) * (q - 1)28d = inverse(e, phi)29print(long_to_bytes(pow(c, d, n)))30```3132```python33# XOR decrypt with known key34ct = bytes.fromhex('...')35key = b'secret'36pt = bytes(c ^ key[i % len(key)] for i, c in enumerate(ct))37print(pt)38```3940## Attack Decision Tree4142```43What type of crypto challenge?44│45├─ RSA (n, e, c given)46│ ├─ Factors known → Standard decrypt47│ ├─ e is small (3) → Cube root or Hastad broadcast48│ ├─ d is small → Wiener's attack49│ ├─ Same n, different e → Common modulus50│ └─ Factor n → factordb, Fermat, Pollard p-1, shared factor51│52├─ AES / Block cipher53│ ├─ ECB mode + oracle → Byte-at-a-time54│ ├─ CBC mode + controlled input → Bit-flipping55│ └─ CBC + padding error visible → Padding oracle56│57├─ XOR cipher58│ ├─ Single byte key → Brute-force (256 keys)59│ ├─ Repeating key → Hamming distance + per-position brute60│ └─ Known plaintext → Direct key recovery61│62├─ Custom cipher / keygen63│ └─ Z3 constraint solver64│65└─ Hash-based66 ├─ MAC with known data → Length extension67 └─ Short secret/PIN → Brute-force68```6970## Technique Reference Files7172Full templates with copy-paste code are in the `references/` directory — loaded on demand, not into context:7374| Technique | Reference File | Key Templates |75| ------------------- | ---------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------- |76| **RSA Attacks** | [references/rsa-attacks.md](references/rsa-attacks.md) | Standard decrypt, small-e, Hastad broadcast, Wiener, common modulus, factordb, Fermat, Pollard p-1, shared factor |77| **Symmetric & XOR** | [references/symmetric-xor.md](references/symmetric-xor.md) | ECB byte-at-a-time, CBC bit-flip, padding oracle, single-byte XOR, repeating-key XOR, known plaintext |78| **Z3 & Hash** | [references/z3-hash.md](references/z3-hash.md) | Z3 basic, key recovery, cipher reversal, hash length extension, hash brute-force, baby-step giant-step |7980> **Usage**: When you need a specific technique, read the corresponding reference file for the full template.8182## Common Pitfalls8384- Always try `factordb` before implementing factorization from scratch85- Check if `e` and `phi` are coprime before computing `inverse(e, phi)`86- For padding oracle: handle false positives on second-to-last byte position87- XOR frequency analysis needs sufficient ciphertext length to be reliable88- Z3 BitVec width must match the actual data size (8 for bytes, 32 for ints, 64 for longs)8990## Examples9192### Example 1: RSA with Small e9394```python95from Crypto.Util.number import long_to_bytes96import gmpy297m, exact = gmpy2.iroot(c, 3)98if exact:99 print(long_to_bytes(int(m)))100```101102### Example 2: Z3 License Key103104```python105from z3 import *106key = [BitVec(f'k{i}', 8) for i in range(20)]107s = Solver()108s.add(key[0] + key[1] == 200)109s.add(key[2] ^ key[3] == 42)110if s.check() == sat:111 m = s.model()112 print(''.join(chr(m[k].as_long()) for k in key))113```
zebbern