Tags: rsa twister 


1. Recover `n` as `gcd(m^e - encrypt(m))` for several small `m`.
2. Decrypt AES key using last byte provided by `decrypt` command.
3. Recover state of python's PRNG by collecting multiple IV from `encrypt` command.
4. Decrypt the flag using AES key and predicted IV.

Sage script: [https://gist.github.com/neex/27c272fdfb466db98db67e84ef093926](http://gist.github.com/neex/27c272fdfb466db98db67e84ef093926)

vimk1ngSept. 3, 2018, 3:58 a.m.

This is mixed cipher not Revolutional Secure Angou

s0rc3r3rSept. 3, 2018, 4:13 a.m.

Hey, isn't this the solution for Mixed Cipher and not RevolutionalSecureAngou?