Tags: coppersmith rsa-crt oaep 

Rating: 4.5

tl;dr:

  1. Notice that qInv RSA-CRT parameter (named cf) is not removed from public key
  2. Use Coppersmith attack to recover d using polynomial cf*x -1 == 0 mod q**2
  3. Decrypt the flag

Full writeup: https://github.com/p4-team/ctf/tree/master/2019-09-02-tokyowesterns/happy

Original writeup (https://github.com/p4-team/ctf/tree/master/2019-09-02-tokyowesterns/happy).