To find $p$:
You have $k_1m_1+k_2 \equiv k_1m_2+k_2 \equiv c_2 \pmod p$ so $k_1(m_1-m_2) \equiv 0 \pmod p$. This means that either $k_1$ or $m_1-m_2$ is a multiple of $p$ (this is where the fact that $p$ is prime comes in). $k_1$ can't be a multiple of $p$, because otherwise the encryption function is constant, which is absurd, so $m_1-m_2$ is a multiple of $p$.
You can now try to find $k_1,k_2$ using each prime divisor of $m_1-m_2$ as modulus until you find one which works for the two pairs $((m_1,c_2),(m_3,c_3))$ and $((m_2,c_2),(m_3,c_3))$.
$$
14^7 = 14^4\cdot 14^2\cdot 14^1,
$$
$$
14^1 \equiv 14 (\bmod 143), \\
14^2 \equiv 14^1\cdot 14^1 = 14\cdot 14 = 196 \equiv 53 (\bmod 143), \\
14^4 \equiv 14^2\cdot 14^2 \equiv 53\cdot 53 = 2809 \equiv 92 (\bmod 143);
$$
$$
14^7 \equiv 92\cdot 53 \cdot 14 = 92\cdot 742 \equiv 92 \cdot 27 = 2484 \equiv 53 (\bmod 143).
$$
$15^7 (\bmod 143)$ $-$ the same way.
Decryption.
Following Euler's theorem, we have
$$
x^{\varphi(n)} \equiv 1 (\bmod n),
$$
where $GCD(x,n)=1$.
Now,
- if $n=pq$, then $\varphi(n)=(p-1)(q-1)$;
- if $ed=1(\bmod \varphi(n))$, then $ed=k\varphi(n)+1$.
So, one can write
$$
(M^e)^d = M^{k\varphi(n)+1} =(M^{\varphi(n)})^k\cdot M^1 \equiv M (\bmod n)
$$
where $GCD(M,n)=1$. If $GCD(M,n)\ne 1$, then it must be considered more accurate.
Decrypting of $C_1=53$:
$$
M_1' \equiv C_1^d (\bmod n)
$$
$$
M_1' \equiv 53^{103} (\bmod 143).
$$
A few steps:
First, decompose $103$ as sum of powers of $2$: 103 = 64+32+4+2+1 = 2^6+2^5+2^2+2^1+2^0.
So, $53^{103} = 53^{64}\cdot 53^32\cdot 53^4\cdot 53^2\cdot 53^1$.
a) $53^1 \equiv 53 (\bmod 143)$;
b) $53^2 = 53^1\cdot 53^1 \equiv 53\cdot 53 = 2809 \equiv 92 (\bmod 143)$;
c) $53^4 = 53^2\cdot 53^2 \equiv 92\cdot 92 = 8464 \equiv 27 (\bmod 143)$;
d) $53^8= 53^4\cdot 53^4 \equiv 27\cdot 27 = 729 \equiv 14 (\bmod 143)$;
e) $53^{16}= 53^8\cdot 53^8 \equiv 14\cdot 14 = 196 \equiv 53 (\bmod 143)$; (see a) )
f) $53^{32}= 53^{16}\cdot 53^{16} \equiv 53\cdot 53 = 2809 \equiv 92 (\bmod 143)$; (see b) )
g) $53^{64}= 53^{32}\cdot 53^{32} \equiv 92\cdot 92 = 8464 \equiv 27 (\bmod 143)$.
Finally,
$M_1' = 53^{103} = 53^{64}\cdot 53^{32}\cdot 53^4\cdot 53^2\cdot 53^1
\equiv 27\cdot 92 \cdot 27 \cdot 92 \cdot 53 \equiv 14 (\bmod 143)$.
Note, that $M_1' = M_1 (\bmod n)$. $M_1$ $-$ original number; $M_1'$ $-$ decrypted number.
Best Answer
This is first studied when $e=3$
A more general case, where $e$ is not limited to 3 and the relation is linear is studied in
It is quite clear that these attacks are related to textbook RSA and it must not be used in practice.
For encryption, RSA has used either PKCS#1.5 padding or OAEP, the former is problematic and OAEP is preferred when one needs encryption with RSA. Actually, we don't use RSA for encryption. We prefer it in digital signatures and that requires PSS padding.