Baby Time Capsule

Author: 0xIDA
Platform: HTB · Category: crypto · Difficulty: Very Easy

Platform: HTB | Category: Crypto | Difficulty: Very Easy
Target: 154.57.164.69:31040

Solvers

• solve.py

Summary

RSA with exponent e=5 and the same plaintext encrypted under 5 different moduli. Solved via Hastad's broadcast attack (CRT + integer 5th root).

Analysis

The server (server.py) generates a fresh 1024-bit RSA key for each request, then encrypts the flag with e=5:

self.e = 5
n = p * q
m = bytes_to_long(FLAG)
m = pow(m, e, n)

Since the same flag is encrypted with 5 different keys:

• CRT combines the 5 congruences into one congruence: m^5 mod (n1·n2·n3·n4·n5)
• Because m^5 < n1·n2·n3·n4·n5, the modular reduction doesn't change the result
• The integer 5th root of the CRT result gives m directly

Solution Steps

1. Collect 5 time capsules via raw TCP, each yielding {"time_capsule": hex_ct, "pubkey": [hex_n, hex_e]}
2. Apply CRT: solve for X ≡ c_i (mod n_i) across all 5 tuples
3. Compute m = floor(5th_root(X)) using Newton's method
4. Convert m to bytes

Solver: solvers/solve.py (pwntools + Python CRT)

Tools & Libraries

• pwntools — TCP connections
• Crypto.Util.number — bytes_to_long / long_to_bytes
• Custom CRT and integer nth root implementations

Flag

HTB{8c662fca5ee30a820f8b4bc43c780eb0}

References

• Hastad's broadcast attack: RSA with small e, same message, e+ different moduli → CRT + eth root
• Always check e in RSA challenges — small exponents (3, 5, 7) are vulnerable to this attack