Overview
Reused ECDSA nonces (k) across signatures leak administrator private key d.
Reconnaissance
Extract signatures r, s1, s2, z1, z2. Calculate k = (z1 - z2) * (s1 - s2)^-1 mod n.
Exploitation Strategy
Recover private key d = (s1*k - z1) * r^-1 mod n, derive AES key SHA256(d), and decrypt payload.
Solution Code
k = ((z1 - z2) * pow(s1 - s2, -1, n)) % n
d = ((s1 * k - z1) * pow(r, -1, n)) % n
key = hashlib.sha256(str(d).encode()).digest()
cipher = AES.new(key, AES.MODE_CBC, iv)
print(unpad(cipher.decrypt(ct), 16).decode())Flag
hwj{n0nc3_r3us3_m33ts_A3S_d3crypt10n}