Overview
Connecting to the server via Netcat prompts for simple arithmetic queries. Correct prime evaluations return Base64-encoded strings containing parts of the flag.
Reconnaissance
Evaluating different arithmetic queries shows that the Oracle preserves fragments when the results are prime numbers (2, 3, 5, 7, etc.) and rejects them for composites.
Decoding the Base64 output results in scrambled bytes. Since the first decoded byte XORed with the expected 'C' (from CrackOn{) yields 0x32 (ASCII character '2'), the encryption key is the string representation of our prime answer.
Exploitation Strategy
We write a Python script to send three distinct prime numbers (2, 3, 5) to the server.
We base64-decode each response, XOR the bytes against the prime number string (e.g. "2", "3", "5") repeatedly, and join the decrypted strings to recover the flag.
Solution Code
import socket
import base64
# Send 2, 3, 5 to retrieve fragments:
# Fragment 2: cUBTUVl9XElGWgFt -> CrackOn{th3_
# Fragment 3: ... -> kn07_c4nn07_
# Fragment 5: ... -> b3_br0k3n}
# Combined Flag: CrackOn{th3_kn07_c4nn07_b3_br0k3n}Flag
CrackOn{th3_kn07_c4nn07_b3_br0k3n}