Cry on Zero's Blog

HTB - Crypto: Raining Primes

Wed, 11 Mar 2026 22:12:00 +0700

Challenge Summary

Name: Raining Primes
Category: Crypto
Difficulty: Hard
Goal: Recover the flag from an RSA-wrapped AES ciphertext.

Root Cause

The service uses one hidden 640-bit prime r in multiple places:

Prime oracle outputs x = a*r + b where:
- a is 384-bit random
- b is 256-bit random
RSA primes are generated with the same form:
- p = a*r + b, q = c*r + d
Key update transforms each AES key bit via:
- bit' = ((k0 * k1) mod r) mod 2

This creates two exploitable links:

HTB - Quantum: Phase Madness

Wed, 04 Mar 2026 10:55:00 +0700

Challenge Summary

Name: Phase Madness
Category: Quantum
Difficulty: Medium-Hard
Goal: Recover all encoded bytes from qubit phase rotations.

Root Cause

Each flag byte is encoded directly as a rotation angle in degrees.

From source:

index % 3 == 0: RX(byte)
index % 3 == 1: RY(byte)
index % 3 == 2: H then RZ(byte)

The service lets us:

choose qubit index,
apply extra known rotations (RX/RY/RZ),
receive high-shot measurement counts.

That is enough to estimate sin/cos components and recover the original angle (thus byte).

HTB - Quantum: Flagportation

Wed, 04 Mar 2026 10:50:00 +0700

Challenge Summary

Name: Flagportation
Category: Quantum
Difficulty: Easy-Medium
Goal: Decode all teleported 2-bit symbols and recover the flag.

Root Cause

The challenge is a teleportation protocol correctness trap. The server reveals:

encoding basis (Z or X),
Bell-side measurement bits (qubit 0, qubit 1),
then asks user operations before measuring receiver (qubit 2).

If the correction mapping is wrong, decoded bits are wrong.

Correct mapping for this implementation:

HTB - Quantum: Global Hyperlink Zone

Wed, 04 Mar 2026 10:45:00 +0700

Challenge Summary

Name: Global Hyperlink Zone
Category: Quantum
Difficulty: Medium
Goal: Satisfy the hidden hyperlink pattern check and print the flag.

Root Cause

The server checks only a specific relationship between measured bitstreams (shares) and does not constrain users to a trusted circuit template.

From source analysis, success requires:

shares[0] == shares[1] == shares[3]
shares[2] == shares[4]
shares[2] != shares[0]
and no share may be all-0 or all-1 bytes.

Because arbitrary gate sequences are allowed, we can construct a circuit that enforces exactly those relations.

HTB - Crypto: Neon Core

Sat, 28 Feb 2026 16:25:00 +0700

Challenge Summary

Name: Neon Core
Category: Crypto
Difficulty: Medium
Goal: Recover the hidden configuration blueprint (flag) from the encrypted output.

Root Cause

The service encrypts each 16-byte block as a 4x4 matrix over GF(257) using:

$$ C = K \cdot S(M) \cdot L + T, \quad S(x)=x^3 $$

where K, L, and T are fixed per service instance.

Although this looks nonlinear, the nonlinearity is only the per-element cube. After lifting each input byte to $u_i = m_i^3$, the full block transform is affine linear:

HTB - Crypto: Shambles

Sat, 28 Feb 2026 14:55:00 +0700

Challenge Summary

Name: Shambles
Category: Crypto
Difficulty: Medium
Goal: Trigger the withdraw condition that drops target balance to zero and get the flag.

Root Cause

The service decrypts user-supplied token ciphertext with AES-CBC and runs PKCS#7 unpad before JWT verification.

Error behavior leaks padding validity:

Invalid padding → Decryption error!
Valid padding but bad JWT/signature → different response (Validation error! path)

That creates a classic CBC padding oracle.

HTB - Crypto: POPO

Fri, 27 Feb 2026 17:15:00 +0700

Challenge Summary

Name: POPO
Category: Crypto
Difficulty: Medium
Goal: Recover the secret plaintext from a flawed Paillier-based service.

Root Cause

The service is Paillier-like with:

g = n + 1
c = g^m * r^n mod n^2

but it adds an “optimization” switch:

first positive non-secret message computes normally
later positive non-secret messages use local = m (skipping g^m)

Also, a fixed r is reused unless explicitly supplied.

HTB - Crypto: ReMeeting the Wheel

Fri, 27 Feb 2026 17:10:00 +0700

Challenge Summary

Name: ReMeeting the Wheel
Category: Crypto
Difficulty: Medium
Goal: Recover the AES key from RSA data and decrypt the final secret.

Root Cause

The AES key is not random 128/256-bit material. Instead, it is constructed as:

key1 = randint(2^20, 2^21)
key2 = randint(2^20, 2^21)
k = key1 * key2

So k is only about 40–42 bits. The challenge publishes:

c = k^e mod n

with standard RSA parameters. This structure enables a meet-in-the-middle recovery.

HTB - Crypto: AliEnS

Fri, 27 Feb 2026 17:05:00 +0700

Challenge Summary

Name: AliEnS
Category: Crypto
Difficulty: Medium
Goal: Recover the hidden flag from a custom AES-ECB oracle.

Root Cause

The service builds plaintext as:

aaes.pad(user_input) || aaes.pad(FLAG)

where:

aaes.pad(x) = x + P[:(-len(x) % 16)] + P
P = "CryptoHackTheBox"  # 16 bytes

Then it encrypts with AES-ECB and a fresh random key per query.

A fresh key blocks classic cross-query byte-at-a-time attacks. But ECB still leaks equality within the same response: equal plaintext blocks produce equal ciphertext blocks under that query key.

HTB - Crypto: Twisted Entanglement

Fri, 27 Feb 2026 13:15:00 +0700

Challenge Summary

Name: Twisted Entanglement
Category: Crypto
Difficulty: Medium
Goal: Recover the server private key and decrypt the encrypted flag.

Root Cause

The challenge exposes scalar multiplication on attacker-controlled points with curve params fixed only as:

a = 0, p = secp256k1 prime

but it does not verify that user points belong to the intended curve subgroup.

That enables an invalid-curve / small-subgroup attack:

send crafted points with known small order q
observe k*P from the server
recover k mod q by brute-force discrete log in tiny subgroup
combine residues with CRT to recover the bounded private key (k < 8748541127929402731638)

Then option 2 seeds Python RNG with that k, so basis choices become predictable and AES key is recoverable.

HTB - Crypto: Shamir's Secret

Fri, 27 Feb 2026 11:35:00 +0700

Challenge Summary

Name: Shamir’s Secret
Category: Crypto
Difficulty: Medium
Goal: Recover the hidden flag from a custom share-encryption service.

Root Cause

The service returns 64 pairs (x, y) where only 32 are genuine polynomial evaluations and 32 are random noise.

For a message m, real pairs satisfy:

y = f(x) mod 2^1024
f(t) = m + a1*t + a2*t^2 + ... + a31*t^31

The same hidden 64-bit mask decides which indices are real/fake for the whole process.

HTB - Crypto: quick maffs

Fri, 27 Feb 2026 09:58:00 +0700

Challenge Summary

Name: quick maffs
Category: Crypto
Difficulty: Hard
Goal: Recover the plaintext triplet and reconstruct the flag.

Root Cause

The service encrypts three related plaintext chunks under the same RSA modulus/exponent pair:

c1 = m1^e mod N
c2 = m2^e mod N
c3 = m3^e mod N
and leaks m1 + m2 + m3 = hint

Because e is a prime < 1024, we can iterate candidate exponents and solve the algebraic system directly.

HTB - Crypto: YALM

Fri, 27 Feb 2026 02:26:00 +0700

Challenge Summary

Name: YALM
Category: Crypto
Difficulty: Medium
Goal: Recover encrypted secret despite hidden RSA modulus.

Root Cause

Server encrypts with RSA (e=3) but does not reveal n.

However, test endpoint leaks comparison against n:

if plaintext < n → accepted
if plaintext >= n → Too many messages!

So we can recover exact n by binary searching this boundary.

Then ciphertext equation is:

c = (prefix || flag)^3 mod n

With known prefix and small unknown suffix (flag), this becomes a univariate small-root problem solved by Coppersmith.

HTB - Crypto: Birds of randomness

Fri, 27 Feb 2026 02:24:00 +0700

Challenge Summary

Name: Birds of randomness
Category: Crypto
Difficulty: Medium
Goal: Predict destination coordinates within 6 guesses and retrieve the flag.

Root Cause

Station coordinates are generated as d*G on a fixed ECC curve, where d = x*y*z from a weak PRNG state triplet with tiny moduli (~30k).

That puts d in a bounded range:

d < 30269 * 30307 * 30323 ≈ 2.78e13

A bounded discrete log is feasible with BSGS.

HTB - Crypto: Rhome

Fri, 27 Feb 2026 02:22:00 +0700

Challenge Summary

Name: Rhome
Category: Crypto
Difficulty: Easy
Goal: Recover shared secret and decrypt AES-encrypted flag.

Root Cause

The challenge builds prime p = 2*q*r + 1, then sets generator:

g = h^(2r) mod p

This forces g into the subgroup of order q (small, ~42-bit). So both public keys A = g^a, B = g^b leak exponents modulo small q, making discrete log feasible.

Exploit Strategy

Query (p,g,A,B) and ciphertext.
Factor p-1, identify small prime subgroup order q.
Solve a = dlog_g(A) and b = dlog_g(B) modulo q.
Recompute shared secret ss = g^(ab mod q).
Derive AES key from sha256(ss)[:16] and decrypt.

Solve Script (Full PoC)

#!/usr/bin/env python3
import re
import argparse
from hashlib import sha256

from pwn import remote
from sympy import factorint
from sympy.ntheory import discrete_log
from Crypto.Cipher import AES
from Crypto.Util.Padding import unpad
from Crypto.Util.number import long_to_bytes


def recv_menu(io):
    return io.recvuntil(b'> ').decode(errors='ignore')


def parse_params(blob):
    p = int(re.search(r'p = (\d+)', blob).group(1))
    g = int(re.search(r'g = (\d+)', blob).group(1))
    A = int(re.search(r'A = (\d+)', blob).group(1))
    B = int(re.search(r'B = (\d+)', blob).group(1))
    return p, g, A, B


def main():
    ap = argparse.ArgumentParser()
    ap.add_argument('--host', required=True)
    ap.add_argument('--port', required=True, type=int)
    args = ap.parse_args()

    io = remote(args.host, args.port)

    recv_menu(io)
    io.sendline(b'1')
    p, g, A, B = parse_params(recv_menu(io))

    io.sendline(b'3')
    ct_blob = recv_menu(io)
    ct = bytes.fromhex(re.search(r'encrypted = ([0-9a-f]+)', ct_blob).group(1))
    io.close()

    fac = factorint(p - 1)
    q_small = None
    for f in fac:
        if 35 <= int(f).bit_length() <= 43:
            q_small = int(f)
            break
    if q_small is None:
        raise SystemExit('small subgroup order not found')

    a = discrete_log(p, A, g, order=q_small)
    b = discrete_log(p, B, g, order=q_small)
    ss = pow(g, (a * b) % q_small, p)

    key = sha256(long_to_bytes(ss)).digest()[:16]
    pt = unpad(AES.new(key, AES.MODE_ECB).decrypt(ct), 16)
    print(pt.decode())


if __name__ == '__main__':
    main()

Run

python3 solve.py --host <ip> --port <port>

Result

HTB{00ps_wh4t_4_sm411_0rd3r}

HTB - Crypto: Embryonic Plant

Fri, 27 Feb 2026 02:20:00 +0700

Challenge Summary

Name: Embryonic Plant
Category: Crypto
Difficulty: Easy
Goal: Recover AES key and decrypt encrypted flag.

Root Cause

Service prints:

n = p*q*r
five consecutive RNG states from:

s_{i+1} = (s_i * p + q) mod r

Same p,q,r are RSA factors and used to derive private exponent d; AES key is sha256(d).

Leaking several states lets us recover the LCG modulus/parameters, which also recovers RSA factors.

HTB - Crypto: Quantum-Safe

Fri, 27 Feb 2026 02:18:00 +0700

Challenge Summary

Name: Quantum-Safe
Category: Crypto
Difficulty: Easy
Goal: Recover flag from matrix-based encoding output.

Root Cause

The challenge encodes each character with:

y = [ord(c), a, b] * P + r

P is public and invertible.
a,b are small random values in [0,100].
r is a fixed unknown offset vector.

Because P is invertible and noise is bounded, we can recover r and decode all rows exactly.

HTB - Crypto: Protein Cookies

Fri, 27 Feb 2026 02:16:00 +0700

Challenge Summary

Name: Protein Cookies
Category: Crypto
Difficulty: Easy
Goal: Access protected /program content and recover flag.

Root Cause

Cookie signature uses SHA-512 over a construction equivalent to:

sig = SHA512(secret || payload)

This is vulnerable to length extension. We can append &isLoggedIn=True and forge a valid new signature without knowing secret.

Exploit Strategy

Obtain guest login_info cookie.
Parse payload+digest.
Perform SHA-512 length-extension with guessed secret length.
Send forged cookie to /program.
Extract flag from returned PDF/content.

Solve Script (Full PoC)

#!/usr/bin/env python3
import base64
import argparse
import requests
from hashpumpy import hashpump


def main():
    ap = argparse.ArgumentParser()
    ap.add_argument('--base', required=True, help='e.g. http://<ip>:<port>')
    ap.add_argument('--secret-len', type=int, default=16)
    args = ap.parse_args()

    s = requests.Session()
    s.get(args.base + '/program', allow_redirects=True, timeout=10)
    guest = s.cookies.get('login_info')
    if not guest:
        raise SystemExit('missing guest cookie')

    payload_b64, sig_b64 = guest.split('.', 1)
    payload = base64.b64decode(payload_b64)
    sig_hex = base64.b64decode(sig_b64).decode()

    append = b'&isLoggedIn=True'
    new_sig_hex, forged_payload = hashpump(sig_hex, payload.decode('latin1'), append.decode('latin1'), args.secret_len)
    forged_cookie = (
        base64.b64encode(forged_payload.encode('latin1')).decode() + '.' +
        base64.b64encode(new_sig_hex.encode()).decode()
    )

    r = requests.get(args.base + '/program', headers={'Cookie': f'login_info={forged_cookie}'}, timeout=10)
    print('status:', r.status_code)
    print(r.text[:400])


if __name__ == '__main__':
    main()

Run

python3 solve.py --base http://<ip>:<port>

Result

HTB{l1ght_w31ght_b4b3h!}

HTB - Crypto: RSAisEasy

Fri, 27 Feb 2026 02:14:00 +0700

Challenge Summary

Name: RSAisEasy
Category: Crypto
Difficulty: Easy
Goal: Recover two RSA-encrypted halves of the flag.

Root Cause

Given values follow:

n1 = p*q
n2 = q*z
leak = n1*E + n2

So:

gcd(n1, leak) = gcd(p*q, n1*E + q*z) = q

Once q is recovered, both RSA systems collapse.

Exploit Strategy

Compute q = gcd(n1, leak).
Recover p = n1 // q and decrypt c1.
Recover n2 from leak % n1 (check valid branch r or r+n1).
Decrypt c2 and concatenate both parts.

Solve Script (Full PoC)

#!/usr/bin/env python3
from math import gcd
from Crypto.Util.number import long_to_bytes

# paste challenge constants
n1 = ...
c1 = ...
c2 = ...
leak = ...
e = 0x10001

q = gcd(n1, leak)
p = n1 // q

phi1 = (p - 1) * (q - 1)
d1 = pow(e, -1, phi1)
part1 = long_to_bytes(pow(c1, d1, n1))

r = leak % n1
part2_candidates = []
for k in (0, 1):
    n2 = r + k * n1
    if n2 <= 0 or n2 % q != 0:
        continue
    z = n2 // q
    phi2 = (q - 1) * (z - 1)
    d2 = pow(e, -1, phi2)
    m2 = long_to_bytes(pow(c2, d2, n2))
    if all(32 <= b < 127 for b in m2):
        part2_candidates.append(m2)

if not part2_candidates:
    raise SystemExit('no valid second part')

flag = (part1 + part2_candidates[0]).decode()
print(flag)

Run

python3 solve.py

Result

HTB{1_m1ght_h4v3_m3ss3d_uP_jU$t_4_l1ttle_b1t?}

HTB - Crypto: xorxorxor

Fri, 27 Feb 2026 02:12:00 +0700

Challenge Summary

Name: xorxorxor
Category: Crypto
Difficulty: Easy
Goal: Decrypt XOR-encrypted flag.

Root Cause

The challenge encrypts flag bytes with a repeating random 4-byte key:

xored[i] = flag[i] ^ key[i % 4]

HTB flags start with HTB{, so we can recover all 4 key bytes directly from the first 4 ciphertext bytes.

Exploit Strategy

Parse hex ciphertext.
Compute key from known prefix b'HTB{'.
XOR-decrypt the full ciphertext with repeating key.

Solve Script (Full PoC)

#!/usr/bin/env python3
import argparse


def xor_repeat(data: bytes, key: bytes) -> bytes:
    return bytes(b ^ key[i % len(key)] for i, b in enumerate(data))


def main():
    ap = argparse.ArgumentParser()
    ap.add_argument('--hex', required=True, help='ciphertext hex from challenge output')
    args = ap.parse_args()

    ct = bytes.fromhex(args.hex)
    known = b'HTB{'
    key = bytes(ct[i] ^ known[i] for i in range(4))

    pt = xor_repeat(ct, key)
    print('key =', key.hex())
    print(pt.decode(errors='ignore'))


if __name__ == '__main__':
    main()

Run

python3 solve.py --hex <ciphertext_hex>

Result

HTB{rep34t3d_x0r_n0t_s0_s3cur3}

HTB - Crypto: Baby Time Capsule

Fri, 27 Feb 2026 02:10:00 +0700

Challenge Summary

Name: Baby Time Capsule
Category: Crypto
Difficulty: Easy
Goal: Recover the plaintext flag from repeated RSA encryptions under fresh moduli.

Root Cause

The service keeps encrypting the same message with RSA exponent e = 5, but with different fresh moduli (n_i).

When we collect at least e ciphertexts from pairwise-coprime moduli, Håstad’s broadcast attack applies:

c_i = m^e mod n_i

Using CRT, we reconstruct m^e over N = ∏n_i, then compute the exact integer 5th root.

HTB - Crypto: Broken Decryptor

Wed, 25 Feb 2026 05:35:00 +0700

Challenge Summary

Name: Broken Decryptor
Category: Crypto
Difficulty: Medium
Target: Recover server flag from encryption oracle behavior

Root Cause

This challenge combines two critical mistakes:

AES-CTR stream reuse with fixed key and iv for every encryption call.
Biased OTP generation:

otp = os.urandom(len(data)).replace(b'\x00', b'\xff')

Replacing 0x00 means each byte position can only produce 255 possible OTP values, not 256. That creates a forbidden-byte leak: after enough samples at one position, the single unseen byte is the hidden pre-OTP byte.

HTB - Crypto: mysterybox

Wed, 25 Feb 2026 05:35:00 +0700

Challenge Summary

Name: mysterybox
Category: Crypto
Difficulty: Medium
Goal: Forge a valid signature for the protected admin message and retrieve the flag.

Root Cause

The server implements textbook RSA signatures directly over raw integers:

sign(m) = m^d mod n
verify(m, s) checks s^e mod n == m

There is no hashing and no padding (e.g., no PKCS#1 v1.5/PSS). This makes signatures multiplicatively malleable:

sig(m1 * m2) = sig(m1) * sig(m2) mod n

The app blocks signing the exact admin message, but it still signs related values, which is enough to forge an admin signature.

0x2 - Learn CTF: Cryptography

Mon, 23 Feb 2026 23:40:00 +0700

error-code — Merkle-Hellman implementation bug

Summary

Category: Cryptography
Challenge: error-code
Core scheme: Merkle-Hellman knapsack (subset-sum)
Given files: chall.py, output
Recovered flag:

CBC{4_cl4ss1c_subs3t_sum_pr0blem_r1ght_9c209955}

Problem statement (practical)

The challenge author says they implemented Merkle-Hellman, but decryption does not work. The job is to identify the implementation error and recover the plaintext.