RSA选择密文攻击

#!/usr/local/bin/python3
import json
import socket
import threading
from Crypto.Util.number import *
from Crypto.Cipher import AES
from Crypto.Util.Padding import pad
from secrets import randbelow, token_bytes
from hashlib import sha256

HOST = "0.0.0.0"
PORT = 1337
flag = 'flag{fdfdb6c7-5fb4-4681-9cd0-a2e7d42652fa}'
p = getPrime(512)
q = getPrime(512)
n = p * q
e = 65537
d = pow(e, -1, (p-1)*(q-1))
c = pow(bytes_to_long(flag),e,n)
def handle_client(conn, addr):
    try:
        param = {
            "n": n,
            "c": c
        }
        conn.sendall(json.dumps(param).encode() + b"\n")
        for _ in range(1024):
            data = conn.recv(1024)
            if not data:
                break
            try:
                response = json.loads(data.strip())
                c_in = response['c'] % n
                assert c_in != c
                m = pow(c_in, d, n)
                b = m % 2
            except (json.JSONDecodeError, KeyError, AssertionError, TypeError, ValueError):
                b = 2
            conn.sendall(json.dumps({"b": b}).encode() + b"\n")
    finally:
        conn.close()

def main():
    with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as s:
        s.bind((HOST, PORT))
        s.listen()
        print(f"[+] Listening on {HOST}:{PORT}")
        while True:
            conn, addr = s.accept()
            print(f"[+] Connection from {addr}")
            threading.Thread(target=handle_client, args=(conn, addr), daemon=True).start()

if __name__ == "__main__":
    main()

from pwn import *
from Crypto.Util.number import *
import json
from tqdm import *

p = remote("127.0.0.1",1337)
param = p.recvline()[:-1]
param = json.loads(param)
n = int(param['n'])
c = int(param['c'])
from fractions import Fraction
lb = Fraction(0)
ub = Fraction(n)

e = 65537
for i in trange(1024):
    cipher = (pow(2,e*(i+1),n) * c) % n
    input = b'{"c": '+str(cipher).encode()+b'}'
    p.sendline(input)
    b = int(json.loads(p.recvline().strip())['b'])
    plain = (lb+ub)/2
    if b == 0:
        ub = plain
    else:
        lb = plain
m = [int(ub),int(lb)]
print([long_to_bytes(int(i)) for i in m])