solved rainbow

week04/hard/solve.py

@@ -0,0 +1,76 @@
+import socket
+import json
+import base64
+
+# Fill in the right target here
+HOST = "netsec.net.in.tum.de"  # TODO
+# HOST = "localhost"
+PORT = 20204  # TODO
+
+
+def parse_list_string(string_list):
+    # Remove brackets and split
+    return [item.strip().strip("'\"") for item in string_list.strip("[]").split(",")]
+
+
+def decode_hash(hash_encode):
+    ddata = {}
+    for key, value in hash_encode.items():
+        ddata[key] = base64.b64decode(value).hex()
+    return ddata
+
+
+def search_password(target_pass, rainbow_dict):
+    for key, value in rainbow_dict.items():
+        if value == target_pass:
+            return key
+    return None
+
+
+def crack_hash(targets):
+    rainbow_dict = None
+    with open("rainbow_table.json", "r") as f:
+        rainbow_dict = json.load(f)
+    hash_dict = decode_hash(rainbow_dict)
+    password = ""
+    for target in targets:
+        password += search_password(target, hash_dict) + ";"
+    return password
+
+
+def get_flag():
+    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+
+    s.connect((HOST, PORT))
+    sf = s.makefile("rw")  # we use a file abstraction for the sockets
+    print(sf.readline().rstrip("\n"))
+    print("GET_SECRET Initiated")
+    sf.write("GET_SECRET\n")
+    sf.flush()
+    print(sf.readline().rstrip("\n"))
+    print("inserted Username admin")
+    sf.write("admin\n")
+    sf.flush()
+    print(sf.readline().rstrip("\n"))
+    print("inserted password 'rand123'")
+    sf.write("ran123\n")
+    sf.flush()
+    output = sf.readline().rstrip("\n").split("Passwords do not match hashes ")[1]
+    pos_pas = parse_list_string(output)
+    password = crack_hash(pos_pas)[:-1]
+    print(f"accumulated the password as '{password}'")
+    print(sf.readline().rstrip("\n"))
+    print("inserted Username admin")
+    sf.write("admin\n")
+    sf.flush()
+    print(sf.readline().rstrip("\n"))
+    print(f"inserted password '{password}")
+    sf.write(f"{password}\n")
+    sf.flush()
+    print(sf.readline().rstrip("\n"))
+    sf.close()
+    s.close()
+
+
+if __name__ == "__main__":
+    get_flag()