💌 Signed Messages – LoveNote TryHackMe Walkthrough

🧩 Room Details

• Platform: TryHackMe

• Room Name: Signed Messages (LoveNote)

• Category: Web + Crypto

• Difficulty: Medium

• Target URL: http://10.48.189.56:5000

---

📖 Scenario Overview

LoveNote is a secure messaging platform that claims:

“Every message is signed and verified using RSA-2048 digital signatures.”

According to the platform, no message can be forged and no identity can be faked.

However, an internal leak suggests the system may be trusting something it shouldn’t.

Your mission:
Analyze the digital signature mechanism and determine whether it can be bypassed.

---

🎯 Objective

• Investigate how LoveNote verifies signed messages

• Identify weaknesses in the cryptographic implementation

• Forge an admin-signed message

• Capture the flag

---

🔍 Initial Observation

When accessing the web application, you’ll see a verified message:

Sender: System Administrator (@admin)
Email: admin@lovenote.com
Message: Welcome to LoveNote!
Signature: <long hex string>

The application confirms:

“Signature Valid – This message was cryptographically verified and is authentic.”

At first glance, it appears secure and professionally implemented.

---

🔐 Understanding the Vulnerability

The application uses RSA-2048 digital signatures.

In a secure implementation:

• A private key signs messages.

• A public key verifies them.

• Keys are generated using strong randomness.

However…

The room title gives a clue:

LoveNote_fix_admin_signature

And the final flag hints at the real issue:

Predictable seeds

---

⚠ Root Cause: Predictable Random Seed

The vulnerability lies in how the cryptographic keys were generated.

If the random number generator uses a predictable seed (for example, timestamp-based or weak entropy), attackers can:

• Reproduce the same random values

• Regenerate the private key

• Forge valid digital signatures

Even though RSA-2048 is secure in theory, weak randomness completely breaks it.

This is not a flaw in RSA itself — it’s a flaw in implementation.

---

🛠 Exploitation Strategy (High-Level)

1. Analyze how the application generates or verifies signatures.

2. Identify that the randomness source is predictable.

3. Recreate the seed locally.

4. Regenerate the admin private key.

5. Sign a forged admin message.

6. Submit the forged signature.

7. Application verifies it as valid.

8. Capture the flag.

---

🏁 Final Flag

THM{PR3D1CT4BL3_S33D5_BR34K_H34RT5}

---

📚 Key Learning Points

• Cryptography is only as strong as its implementation.

• Weak randomness breaks even strong algorithms like RSA-2048.

• Predictable seeds can lead to private key recovery.

• Always use secure cryptographic libraries with proper entropy sources.

• Never implement custom crypto without understanding secure randomness.

---

🛡 Defensive Recommendations

If you’re building secure systems:

• Use cryptographically secure random number generators (CSPRNG).

• Avoid manual seeding unless absolutely necessary.

• Rely on well-established libraries.

• Regularly audit key generation mechanisms.

• Implement proper key rotation policies.

---

💡 Why This Room Is Valuable

This challenge teaches an important real-world lesson:

Strong encryption does not guarantee security if randomness is weak.

It’s a practical demonstration of how small mistakes in cryptographic design can completely undermine trust systems.

Perfect for learners preparing for:

• Web security roles

• Penetration testing

• Cryptography fundamentals

• Bug bounty hunting

• Security certifications