exploit.sage

from sage.all import *

# All the variable names mean the same as mentioned in the explanation
# For eg, a,b are the values in the function f = ax + b

def gcd(a, b): 
    while b:
        a, b = b, a % b
    return a.monic()

def franklinreiter(C1, C2, e, N, a, b):
    P.<X> = PolynomialRing(Zmod(N))
    g1 = (a*X + b)^e - C1
    g2 = X^e - C2
    print "Result"
    result = -gcd(g1, g2).coefficients()[0]
    return hex(int(result))[2:].replace("L","").decode("hex")