Tags: rsa hastad 

Rating:

![image](https://github.com/jeromepalayoor/ctf-archive-hub/assets/63996033/b36d9497-95fd-4da4-ad64-40e85464754a)

Assuming the string the server is encrypting is the same flag, this is just Håstad's broadcast attack.

```py
from pwn import *
from sympy.ntheory.modular import crt
from gmpy2 import iroot
from Crypto.Util.number import long_to_bytes

ns=[]
cs=[]
for i in range(17):
r = remote('challs.n00bzunit3d.xyz', 2069)
e = eval(r.recvline().rstrip().lstrip(b'e = '))
cs.append(eval(r.recvline().rstrip().lstrip(b'ct = ')))
ns.append(eval(r.recvline().rstrip().lstrip(b'n = ')))
r.close()

M17 = crt(ns, cs)[0]
print(long_to_bytes(iroot(M17,17)[0]))
```

Flag: `n00bz{5m4ll_3_1s_n3v3r_g00d!}`

Original writeup (https://jp-ch.gq/cryptography/n00bzCTF-2023.html#rsa).