from Crypto.Util.number import *
from gmpy2 import next_prime
from random import getrandbits
from secret import flag

p = getStrongPrime(1024)
q = next_prime(p ^ ((1 << 1024) - 1) ^ getrandbits(16))
n = p * q
e = 65537

m = bytes_to_long(flag)
assert m < n
c = pow(m, e, n)

print(hex(n))
# 0x2d664b36d81e6b469d7ecf3e92b4635a9361b834484478cdd58258a2a68abc3ebc4a5cd75cd2b9f2e2a851955f7dc08253d39ec9cc0443fcf3836bef9fbfd1f66fac032247d573ee6f647b40de0b76dd1250ec2ff0de257c3e9d8626aa0f9627852669492476f399878e26b8744089ebdf3d1d5b58adc6ce080a49c27d1d04440a692ecaa4621642c034b516f5b11e25d448e970f8212c72a63f30dee5658bb97d72c3216dcf5fbf111d14f0945bda5f3cd79769ecf867a28ea581986d1e906322542d114f021e2bc5597c57cad9be1e284b5ad3632a827a052b4ef6da125e8987aeccddba47c1201e9156e5245c753a5806d5d6a7bfd0c1e627a6694db42fa1

print(hex(c))
# 0x51d7e86e676e3816646d9b1dddc60505b08004176ded1f4dcfbc2be43b4ad7db28e750e923b2c31a67e61c75a1080c8d2e984f5180186085739d2e1ee591837c3579d1e399aabeb28c0adcc0851791c865e4b2eafc4753e274b0a3240a96fb07c9b5e99f1fe524913faf082161aaf4ceda5367805642e7b3fe4c2a34289aee31f95d54aa70bbd2356d0ff634f9118d93bdf1d7fef44ee291c37de0bc19cc2cfbcde8f2d35a0083a543fe073ecbf5f599091a2e4c49f914bf7001111fe28baa1726cbfe23964d743db93091f9486399b5f611e94cf0891707d69b4ba9299eda098a0f157a5cdde2279c3e7291fc2e1a63b158b37d767b7d3b5ee333e2681779c

把n拿去因数分解得到p、q

剩下就是简单的RSA计算了

import gmpy2
from Crypto.Util.number import *
from gmpy2 import next_prime
from random import getrandbits


p = getStrongPrime(1024)
q = next_prime(p ^ ((1 << 1024) - 1) ^ getrandbits(16))
n = p * q
e = 65537


n=0x2d664b36d81e6b469d7ecf3e92b4635a9361b834484478cdd58258a2a68abc3ebc4a5cd75cd2b9f2e2a851955f7dc08253d39ec9cc0443fcf3836bef9fbfd1f66fac032247d573ee6f647b40de0b76dd1250ec2ff0de257c3e9d8626aa0f9627852669492476f399878e26b8744089ebdf3d1d5b58adc6ce080a49c27d1d04440a692ecaa4621642c034b516f5b11e25d448e970f8212c72a63f30dee5658bb97d72c3216dcf5fbf111d14f0945bda5f3cd79769ecf867a28ea581986d1e906322542d114f021e2bc5597c57cad9be1e284b5ad3632a827a052b4ef6da125e8987aeccddba47c1201e9156e5245c753a5806d5d6a7bfd0c1e627a6694db42fa1

c=0x51d7e86e676e3816646d9b1dddc60505b08004176ded1f4dcfbc2be43b4ad7db28e750e923b2c31a67e61c75a1080c8d2e984f5180186085739d2e1ee591837c3579d1e399aabeb28c0adcc0851791c865e4b2eafc4753e274b0a3240a96fb07c9b5e99f1fe524913faf082161aaf4ceda5367805642e7b3fe4c2a34289aee31f95d54aa70bbd2356d0ff634f9118d93bdf1d7fef44ee291c37de0bc19cc2cfbcde8f2d35a0083a543fe073ecbf5f599091a2e4c49f914bf7001111fe28baa1726cbfe23964d743db93091f9486399b5f611e94cf0891707d69b4ba9299eda098a0f157a5cdde2279c3e7291fc2e1a63b158b37d767b7d3b5ee333e2681779c

n=int(n)
print(n)
c=int(c)
print(c)
p=41427615574922818615870497590264788984878330623614823365788624588067290662132972276830553350544263188329219388461888128760348042119000971150498763797335331915664682077793213136862057225934618971962218321032125964414900615217531251852893168429999770297833347112559672824403473047463579317227474739272349823799
q=138341697911308772157060021488637684376919367270615833907641456569665385143367990855877923971863272832790894491409505228898441726695415651342348666842138792462103211347072272139440162375311475147490864631052879804423250067124931629621019942110827466865517163572026625415543772891016136987607881590351874346983
d=gmpy2.invert(e,(p-1)*(q-1))
m=pow(c,d,n)
flag=long_to_bytes(m).decode()
print(flag)

得到flag:0xGame{c3c7bca98ce4dc4cce797d8197597a40}