ctf-writeups

Half Baked

Difficulty: Easy
Author: Nissen

Boss wanted our cake webshop secured with RSA and said I should remember to use some good primes.
Not sure what that means, but he specifically asked for 2, I guess to save money.
Sounded easy enough, but now the whole system feels a bit half-baked 😕

Attachment:

n = 2999882211429630485883650302877390551374775896896788078868325571891218714007953558505041388044334470201821965796391409921668122818083570668568660678895962925314655342154580738160357641047430373917156721861167458749434940591017306495880180805391185380307427539761080193213111534709378234670214284858143824384128077373871882033779166821558334466322908873171079631967672353755842618738501413251304204009472
e = 65537
c = 406899880095774364291729342954053590589397159355690238625035627993181937179155345315119680672959072539867481892078815991872758149967716015787715641627573675995588117336214614607141418649060621601912927211427125930492034626696064268888134600578061035823593102305974307471288655933533166631878786592162718700742194241218161182091193661813824775250046054642533470046107935752737753871183553636510066553725

From the description, we know that p=2. Factorize n using sage:

sage: n = 299988221142963048588365030287739055137477589689678807886832557189121871400795355850504138804433447020182196579639140992166812281808357066856866067889
....: 5962925314655342154580738160357641047430373917156721861167458749434940591017306495880180805391185380307427539761080193213111534709378234670214284858143824
....: 384128077373871882033779166821558334466322908873171079631967672353755842618738501413251304204009472
sage: factor(n)
2^1337

So $n=2^{1337}$, $\phi(n)=2^{1337}/2=2^{1336}$. Compute RSA decryption using the primes:

n = 2999882211429630485883650302877390551374775896896788078868325571891218714007953558505041388044334470201821965796391409921668122818083570668568660678895962925314655342154580738160357641047430373917156721861167458749434940591017306495880180805391185380307427539761080193213111534709378234670214284858143824384128077373871882033779166821558334466322908873171079631967672353755842618738501413251304204009472
e = 65537
c = 406899880095774364291729342954053590589397159355690238625035627993181937179155345315119680672959072539867481892078815991872758149967716015787715641627573675995588117336214614607141418649060621601912927211427125930492034626696064268888134600578061035823593102305974307471288655933533166631878786592162718700742194241218161182091193661813824775250046054642533470046107935752737753871183553636510066553725

p = 2
phi = n // p
d = pow(e, -1, phi)
value = hex(pow(c, d, n))
print(bytes.fromhex(value[2:]))

Get flag: brunner{s1ngl3_pr1m3_1s_d0ubl3_tr0ubl3}