A nice SageMath guide by team behind this CTF:
https://nusgreyhats.org/posts/guides/sage_note/


Archive:
https://github.com/NUSGreyhats/greyctf-2022-public/tree/main/challenges

Equation

Challenge:

from Crypto.Util.number import bytes_to_long 
FLAG = <REDACTED> 
n = len(FLAG)
m1 = bytes_to_long(FLAG[:n//2])
m2 = bytes_to_long(FLAG[n//2:]) 
print(13 * m2 ** 2 + m1 * m2 + 5 * m1 ** 7)
print(7 * m2 ** 3 + m1 ** 5) 


# 13 * m2 ** 2 + m1 * m2 + 5 * m1 ** 7 == 6561821624691895712873377320063570390939946639950635657527777521426768466359662578427758969698096016398495828220393137128357364447572051249538433588995498109880402036738005670285022506692856341252251274655224436746803335217986355992318039808507702082316654369455481303417210113572142828110728548334885189082445291316883426955606971188107523623884530298462454231862166009036435034774889739219596825015869438262395817426235839741851623674273735589636463917543863676226839118150365571855933
# 7 * m2 ** 3 + m1 ** 5 == 168725889275386139859700168943249101327257707329805276301218500736697949839905039567802183739628415354469703740912207864678244970740311284556651190183619972501596417428866492657881943832362353527907371181900970981198570814739390259973631366272137756472209930619950549930165174231791691947733834860756308354192163106517240627845889335379340460495043


Solve:

from Crypto.Util.number import long_to_bytes

R.<m1, m2> = ZZ[]

f = (13 * m2 ** 2 + m1 * m2 + 5 * m1 ** 7) - 6561821624691895712873377320063570390939946639950635657527777521426768466359662578427758969698096016398495828220393137128357364447572051249538433588995498109880402036738005670285022506692856341252251274655224436746803335217986355992318039808507702082316654369455481303417210113572142828110728548334885189082445291316883426955606971188107523623884530298462454231862166009036435034774889739219596825015869438262395817426235839741851623674273735589636463917543863676226839118150365571855933
g = (7 * m2 ** 3 + m1 ** 5) - 168725889275386139859700168943249101327257707329805276301218500736697949839905039567802183739628415354469703740912207864678244970740311284556651190183619972501596417428866492657881943832362353527907371181900970981198570814739390259973631366272137756472209930619950549930165174231791691947733834860756308354192163106517240627845889335379340460495043

part1 = f.resultant(g, m2).univariate_polynomial().roots()[0][0]
part2 = f.resultant(g, m1).univariate_polynomial().roots()[0][0]

print(long_to_bytes(int(part1)).decode() + long_to_bytes(int(part2)).decode())
#grey{solving_equation_aint_that_hard_rite_gum0pX6XzA5PJuro}




Equation 2

Challenge:

from Crypto.Util.number import bytes_to_long, getPrime

FLAG = <REDACTED>

n = len(FLAG)
assert n == 56
m1 = bytes_to_long(FLAG[:n//2])
m2 = bytes_to_long(FLAG[n//2:])

p = getPrime(1024)
e = 0x10001

m1 = pow(m1, e, p)
m2 = pow(m2, e, p)

f = (13 * m2 ** 2 + m1 * m2 + 5 * m1) % p
g = (7 * m2 + m1 ** 2) % p

print(f'p = {p}')
print(f'f = {f}')
print(f'g = {g}')

# p = 103175188797926467794365402146472305817623761879128747225492097277626216627064890773124903103942263902880073158462949094876078060352602582505838370568606641642143416491553506524368432898012947786698824409089072941778713130992743267066646633897036334818393192089607379999023849803338329132706986517333957876157
# f = 12007259745842242280897721905106524804972805434809465355097667482291976192173361484056175756784023994182016359970824997356800198849045895285980893566035604886672770139052369644408240324158758607586820734645633027680433641407820858271937125808392065164047302911139630520723813406877292531894480838737341125665
# g = 14868160977738536859136095723100026799380920209352178074244834245108315133627956366876482302774602020543740958092684461826136509794939069238937895832467226262667089117198620580137137152271988358980727205735098576514972624305429482835648459574572124501994866016592650445995385179310049853777303859337741470187


Solve (credit to Joseph for resultant function):

from Crypto.Util.number import *
from sage.matrix.matrix2 import Matrix

def resultant(f1, f2, var):
    return Matrix.determinant(f1.sylvester_matrix(f2, var))

p = 103175188797926467794365402146472305817623761879128747225492097277626216627064890773124903103942263902880073158462949094876078060352602582505838370568606641642143416491553506524368432898012947786698824409089072941778713130992743267066646633897036334818393192089607379999023849803338329132706986517333957876157
e = 0x10001

R.<m1,m2> = PolynomialRing(GF(p))

f = (13 * m2 ** 2 + m1 * m2 + 5 * m1) - 12007259745842242280897721905106524804972805434809465355097667482291976192173361484056175756784023994182016359970824997356800198849045895285980893566035604886672770139052369644408240324158758607586820734645633027680433641407820858271937125808392065164047302911139630520723813406877292531894480838737341125665
g = (7 * m2 + m1 ** 2) - 14868160977738536859136095723100026799380920209352178074244834245108315133627956366876482302774602020543740958092684461826136509794939069238937895832467226262667089117198620580137137152271988358980727205735098576514972624305429482835648459574572124501994866016592650445995385179310049853777303859337741470187

part1 = resultant(f, g, m2).univariate_polynomial().roots()[0][0]
part2 = resultant(f, g, m1).univariate_polynomial().roots()[0][0]

d = pow(e, -1, p-1)
part1 = pow(part1, d, p)
part2 = pow(part2, d, p)

print(long_to_bytes(int(part1)).decode() + long_to_bytes(int(part2)).decode())
#grey{Equations_are_beautify_arent_they_Gb9kkmVPHDUNpJCU}