Challenge

from Crypto.Util.number import getPrime, bytes_to_long

p = getPrime(512)
q = getPrime(512)
n = p * q

e = 88 

flag = bytes_to_long(open("flag.txt", "rb").read())

c = pow(flag, e, n)

print(f"n = {n}")
print(f"p = {p}")
print(f"q = {q}")
print(f"e = {e}")
print(f"c = {c}")


Solve


gcd(e, phi) = 8

inverse of e mod phi does not exist, so we take inverse of e/8 mod phi.

then take the modular 8th roots to get flag (by 3 repeated modular_sqrt).

from math import gcd
from sympy.ntheory.residue_ntheory import sqrt_mod
from Crypto.Util.number import *

n = 100730175368311633478971516550032530349548047538169668085371615323335993050104099450196588597255118857503982837564035479840164299648689097551903985734786810870973412764354972361685659545332423982337074709819705807204740343841119905746182935014914566332609661115911697020388848364957717731916021015186745684937
p = 7929784484601571438556962301091075858855221082408119915984427404222889089508123170481994187868730450486555622247851839792346424851012282168291892181358521
q = 12702763305095394050797091920448801436034799490575134387288377684776621453859015314357141487880257024105303175708994671153726639639927719205169291350500497
e = 88
c = 20105686147991941369013766839987314637794741418836048390207432144211428603343545341113483780787575674844374295850418357112562002976911845044695395223651780902249997312992203320108137212557982436701392702319743854706572541120465765715495541599418085021051751662008710898889028243528751455361486108662629587591

phi = (p-1)*(q-1)

_a = pow(e//gcd(e, phi), -1, phi)
_b = pow(c, _a, n)

for a in sqrt_mod(_b, p, all_roots=True):
    for b in sqrt_mod(a, p, all_roots=True):
        for c in sqrt_mod(b, p, all_roots=True): 
            print(long_to_bytes(c))
# HTB{1t_m34n5_th4t-th15_d4mn_th1ng_d035nt-w0rk_4t_4ll!!}