Embryonic Plant

Technical Walkthrough

Writeup

Challenge

• Name: Embryonic-Plant
• Category: Crypto
• Difficulty: Easy
• Mode: hybrid

Summary

The server prints a three-prime RSA modulus n, five outputs from a linear

recurrence modulo one prime factor r, and an AES-encrypted flag. The recurrence

outputs leak r through standard LCG determinant relations. After recovering

r, p and q follow directly from output differences, allowing recovery of

the RSA private exponent d. The AES key is sha256(long_to_bytes(d)), so the

flag decrypts locally.

Artifact Inventory

• files/a12c7374-1a55-4bfc-aa2e-4ddc453c66aa.zip: original challenge ZIP.
• files/extracted/crypto_embryonic_plant/server.py: source for the remote

service.

• Remote instance: <TARGET>:30340.
• analysis/remote-instance-output.txt: captured live n, s, and

enc_flag.

• analysis/decrypt-redacted.txt: decrypted plaintext with the flag redacted.

Analysis

The source has:

s_next = (s*p + q) mod r
n = p*q*r

For output differences d_i = s_{i+1} - s_i, the recurrence gives:

d_{i+1} = p*d_i mod r

Therefore:

r | d_{i+2}*d_i - d_{i+1}^2

Taking the GCD of n and two such determinants recovers r. Then:

p = d_1 * inverse(d_0, r) mod r
q = s_2 - p*s_1 mod r

The recovered pqr validates against n. From there, compute phi,

recover d, derive the AES key with SHA-256, and decrypt the ECB ciphertext.

Solve

Run:

python3 solve/solve.py --host <TARGET> --port 30340

The script writes:

• raw flag candidate: loot/flag-candidate.txt
• redacted plaintext: analysis/decrypt-redacted.txt
• live service output: analysis/remote-instance-output.txt

Flag

Raw flag is stored in loot/flag.txt and intentionally not reproduced here.

Lessons

• A small number of LCG-like outputs can be enough when the modulus is a hidden

factor of a known composite.

• Always use the source to derive the exact leakage relation before treating a

crypto challenge as a generic factoring problem.

• Keep public/RAG research advisory only; here the provided source was sufficient

to derive the full solve.

Source-Backed Dossier

The sections below are merged from companion Markdown notes for the same case. They are rendered after sanitization so the article stays precise without publishing raw flags, credentials, or target-specific secrets.

Notes

Scope

• Challenge: Embryonic-Plant
• Category: Crypto
• Difficulty: Easy
• Mode: hybrid
• Remote instance: <TARGET>:30340
• Start time: 2026-06-09T13:39:14Z
• Operator: harness
• State file: challenge-state.json

Harness Status

• Current phase: see challenge-state.json
• Next allowed actions: see next-action.json
• Raw flags and sensitive material stay in loot/ only. Do not paste them here.

Artifact Inventory

Evidence Ledger

Key Findings

• server.py defines n = pqr for 768-bit primes with p,q < r.
• The RNG recurrence is s_next = (s*p + q) mod r; five outputs leak the modulus r.
• Consecutive differences satisfy d_{i+1} = pd_i mod r, so r divides d_{i+2}d_i - d_{i+1}^2.
• gcd(n, determinant_0, determinant_1) recovers r.
• p = d_1 inverse(d_0, r) mod r, and q = s_2 - ps_1 mod r.
• Once p,q,r are known, compute d = inverse(0x10001, phi), derive the AES key as sha256(long_to_bytes(d)), and decrypt enc_flag.

RAG / Advisory Memory

RAG output is advisory only. Record evaluated retrievals with:

scripts/challenge_harness.py rag-record <workspace> --query "..." --tag MATCHED|PARTIAL|MISSING|<secret redacted>|GENERIC --validation "..."

Secrets/Flags

Raw flags and sensitive material stay in loot/ only. Use scripts/challenge_harness.py capture-flag to validate and record flag capture without printing the value.

Memory Summary

Metadata

• Platform: HackTheBox Challenges
• Category: Crypto
• Challenge: Embryonic-Plant
• Difficulty: Easy
• Source workspace: <local workspace>

Validated Solve Chain

Concepts only. Do not include raw flags, reusable credentials, tokens, cookies, private keys, or live secrets.

1.

Reusable Lessons

-

Dead Ends

-

Tool Quirks

-

Evidence Paths

-

Ingestion Decision

• Proposed for LightRAG: yes/no
• Requires user approval before ingestion: yes

Hypothesis Board

Keep no more than 3 active hypotheses on Easy/Medium and 5 on Hard unless the user explicitly asks for breadth.

Closed Branches

Memory Summary

approval_required: true

Sanitized Memory Summary

Metadata

• Platform: HackTheBox Challenges
• Category: Crypto
• Challenge: Embryonic-Plant
• Difficulty: Easy
• Source workspace: <local workspace>

Validated Solve Chain

Concepts only. Do not include raw flags, reusable credentials, tokens, cookies, private keys, or live secrets.

1.

Reusable Lessons

-

Dead Ends

-

Tool Quirks

-

Evidence Paths

-

Ingestion Decision

• Proposed for LightRAG: yes/no
• Requires user approval before ingestion: yes

Notes

Notes

Scope

• Challenge: Embryonic-Plant
• Category: Crypto
• Difficulty: Easy
• Mode: hybrid
• Remote instance: <TARGET>:30340
• Start time: 2026-06-09T13:39:14Z
• Operator: harness
• State file: challenge-state.json

Harness Status

• Current phase: see challenge-state.json
• Next allowed actions: see next-action.json
• Raw flags and sensitive material stay in loot/ only. Do not paste them here.

Artifact Inventory

Evidence Ledger

Key Findings

• server.py defines n = pqr for 768-bit primes with p,q < r.
• The RNG recurrence is s_next = (s*p + q) mod r; five outputs leak the modulus r.
• Consecutive differences satisfy d_{i+1} = pd_i mod r, so r divides d_{i+2}d_i - d_{i+1}^2.
• gcd(n, determinant_0, determinant_1) recovers r.
• p = d_1 inverse(d_0, r) mod r, and q = s_2 - ps_1 mod r.
• Once p,q,r are known, compute d = inverse(0x10001, phi), derive the AES key as sha256(long_to_bytes(d)), and decrypt enc_flag.

RAG / Advisory Memory

RAG output is advisory only. Record evaluated retrievals with:

scripts/challenge_harness.py rag-record <workspace> --query "..." --tag MATCHED|PARTIAL|MISSING|<secret redacted>|GENERIC --validation "..."

Secrets/Flags

Raw flags and sensitive material stay in loot/ only. Use scripts/challenge_harness.py capture-flag to validate and record flag capture without printing the value.