POPO

Technical Walkthrough

Writeup

Challenge

• Name: POPO
• Category: Crypto
• Difficulty: Medium
• Mode: hybrid

Summary

POPO is a Paillier-style service with two state bugs. The constructor computes

gm = (n + 1)^FLAG mod n^2 before replacing g with a random value, and the

encryption oracle reuses one fixed randomizer unless a caller provides another

one. The optimizer state also makes the second positive non-flag encryption use

the raw message as the local value. Querying encrypt(1), encrypt(1), and

encrypt(0) exposes r^n and gm * r^n, which is enough to recover gm and

decode the flag without factoring n.

Artifact Inventory

• files/a12c739b-3be6-4916-9a16-f366811566b2.zip: original challenge archive.
• files/extracted/crypto_popo/server.py: challenge service source.
• Remote service: <TARGET>:31338.
• Inventory details are recorded in analysis/artifact-inventory.json.

Analysis

The key source behavior is documented in analysis/source-audit.md.

The constructor starts with g = n + 1, computes gm = pow(g, FLAG, n2), and

only afterward enters the validation loop that randomizes g. For Paillier's

special generator n + 1, the binomial expansion gives:

(n + 1)^m mod n^2 = 1 + m*n mod n^2

So if gm can be isolated, the plaintext is simply:

FLAG = ((gm - 1) // n) mod n

The oracle normally masks the local value with r^n mod n^2. Because self.r

is fixed and reused, the same mask appears across default encryptions. The

optimizer bug makes the second positive non-flag encryption return m * r^n

instead of g^m * r^n; using m = 1 leaks the mask directly. Then m = 0

takes the flag branch and returns gm * r^n.

The private RAG query did not contain a POPO-specific memory match and was

recorded as missing in analysis/rag-records.md; the proceed decision is based

on direct source review, the local self-test, and the live remote transcript.

Solve

solve/solve.py performs the full recovery:

1. Run encrypt(1) once to set optim = 1.
2. Run encrypt(1) again to recover randomizer = r^n mod n^2.
3. Run encrypt(0) to recover masked_gm = gm * randomizer mod n^2.
4. Compute gm = masked_gm * inverse(randomizer, n^2) mod n^2.
5. Decode long_to_bytes(((gm - 1) // n) % n).

Local algebra validation:

python3 Crypto/POPO/solve/solve.py --self-test

Remote solve was run through the harness wrapper:

python3 scripts/challenge_exec.py Crypto/POPO -- python3 Crypto/POPO/solve/solve.py \
  --host <TARGET> \
  --port 31338 \
  --output Crypto/POPO/analysis/flag-candidate.txt \
  --transcript Crypto/POPO/analysis/remote-solve-transcript.txt

The flag candidate was captured with challenge_harness.py capture-flag and the

temporary analysis candidate was removed.

Flag

Raw flag is stored in loot/flag.txt and intentionally not reproduced here.

Lessons

• In Paillier, using g = n + 1 makes plaintext recovery trivial if g^m is

exposed in isolation.

• Precomputing a flag-dependent value before finalizing parameters can leak the

protected plaintext even if later parameters look randomized.

• Stateful optimizer shortcuts are dangerous in cryptographic code, especially

when combined with reused randomness.

Source-Backed Dossier

The sections below are merged from companion Markdown notes for the same case. They are rendered after sanitization so the article stays precise without publishing raw flags, credentials, or target-specific secrets.

Notes

Scope

• Challenge: POPO
• Category: Crypto
• Difficulty: Medium
• Mode: hybrid
• Remote instance: <TARGET>:31338
• Start time: 2026-06-12T15:18:50Z
• Operator: harness
• State file: challenge-state.json

Harness Status

• Current phase: see challenge-state.json
• Next allowed actions: see next-action.json
• Raw flags and sensitive material stay in loot/ only. Do not paste them here.

Artifact Inventory

Evidence Ledger

Key Findings

-

RAG / Advisory Memory

RAG output is advisory only. Record evaluated retrievals with:

scripts/challenge_harness.py rag-record <workspace> --query "..." --tag MATCHED|PARTIAL|MISSING|<secret redacted>|GENERIC --validation "..."

Secrets/Flags

Raw flags and sensitive material stay in loot/ only. Use scripts/challenge_harness.py capture-flag to validate and record flag capture without printing the value.

Memory Summary

Metadata

• Platform: HackTheBox Challenges
• Category: Crypto
• Challenge: POPO
• Difficulty: Medium
• Source workspace: <local workspace>

Validated Solve Chain

Concepts only. Do not include raw flags, reusable credentials, tokens, cookies, private keys, or live secrets.

1.

Reusable Lessons

-

Dead Ends

-

Tool Quirks

-

Evidence Paths

-

Ingestion Decision

• Proposed for LightRAG: yes/no
• Requires user approval before ingestion: yes

Hypothesis Board

Keep no more than 3 active hypotheses on Easy/Medium and 5 on Hard unless the user explicitly asks for breadth.

Closed Branches