Flagportation

Author: 0xIDA
Platform: HTB · Category: web · Difficulty: Very Easy

Platform: HTB | Category: Web | Difficulty: Very Easy
Target: 154.57.164.64:31989

Solvers

• solve.py

Summary

The flag is transmitted via quantum teleportation through a QuTiP-based terminal (QTT). By applying the standard Bob-side correction gates based on Alice's measurement results, we recover each teleported qubit and reconstruct the flag.

Analysis

The Teleporter class reads the flag, converts it to 2-bit chunks, encodes each as a qubit state (|0⟩, |1⟩, |+⟩, or |−⟩), and runs a standard 3-qubit teleportation circuit:

1. Bell pair creation: H on q1, CNOT(q1, q2)
2. Alice's encoding: CNOT(q0, q1), H on q0
3. Alice measures q0, q1 in Z basis → two classical bits
4. Bob's turn: we apply correction gates on q2, then measure in the basis the server announces

The decoding table:

• |0⟩ (Z, result 0) → 00
• |1⟩ (Z, result 1) → 01
• |+⟩ (X, result 0) → 10
• |−⟩ (X, result 1) → 11

Solution Steps

1. Connect to the target (raw TCP)
2. For each of 204 qubit pairs:
   • Read Alice's measurements (q0, q1) and the encoding basis
   • Apply correction: X:2 if q1=1, Z:2 if q0=1
   • Measure qubit 2 in the announced basis
   • Decode the 2-bit chunk
3. Concatenate all bitpairs → bytes → flag string

Solver: solvers/solve.py (pwntools)

Flag

HTB{c0mpL371ng_7h3_qu4n7um_73L3p0r74710n_pr070c0L!}

("completing the quantum teleportation protocol!")

Tools Used

• pwntools — socket interaction
• nc — initial probing

Key Takeaways

• Quantum teleportation uses entanglement + classical communication to transfer an unknown qubit state
• Correction gates: X if Alice's q1=1, Z if Alice's q0=1
• The measurement basis (Z or X) must match the encoding basis to recover the correct classical bitpair