RSA-共模攻击

给出n1,n2,e1,e2,c1,c2,其中：
n1 = n2
e1 != e2,e1与e2互素

例题：

n: 9262301239516368689096260834916084043086781131015342151023772466662705697547083389653670083723144339786510554365528119133425341402250313392201627600355329
e: 195103693610432243979378102667076121713
c: 2180659822078075061965646574795380580996836367950522800445610727194087470390808771618813146076607874590171542024164863796768529598674191134581480949679274

n: 9262301239516368689096260834916084043086781131015342151023772466662705697547083389653670083723144339786510554365528119133425341402250313392201627600355329
e: 328153122420069787700455946254518672263
c: 69605536872002076635485508160948074819083416004775204561271394860632244108777285179012045689207647713675306838159730950355285462644656824181512511407633

解题脚本：

from libnum import n2s,s2n
from gmpy2 import invert
def egcd(a, b):
  if a == 0:
    return (b, 0, 1)
  else:
    g, y, x = egcd(b % a, a)
    return (g, x - (b // a) * y, y)

def main():
  n = 9262301239516368689096260834916084043086781131015342151023772466662705697547083389653670083723144339786510554365528119133425341402250313392201627600355329
  c1 = 2180659822078075061965646574795380580996836367950522800445610727194087470390808771618813146076607874590171542024164863796768529598674191134581480949679274
  c2 = 69605536872002076635485508160948074819083416004775204561271394860632244108777285179012045689207647713675306838159730950355285462644656824181512511407633
  e1 = 195103693610432243979378102667076121713
  e2 = 328153122420069787700455946254518672263
  s = egcd(e1, e2)
  s1 = s[1]
  s2 = s[2]
  if s1<0:
    s1 = - s1
    c1 = invert(c1, n)
  elif s2<0:
    s2 = - s2
    c2 = invert(c2, n)

  m = pow(c1,s1,n)*pow(c2,s2,n) % n
  a = hex(m)
  print a[2:].decode('hex')

if __name__ == '__main__':
  main()

解得flag:

flag{asdhkjahd-askghdkja-dashjdka}