Skip to content

Instantly share code, notes, and snippets.

@HoLyVieR
Created Mar 22, 2016
Embed
What would you like to do?
from pwn import *
import struct
import md5
r = remote('127.0.0.1', 4321)
print(r.recvuntil("quit\n====================\n"))
r.sendline("1")
print(r.recvuntil("Please pick odds (as a power of 2 between 1 and 112): "))
r.send("112")
print(r.recvuntil("good luck!"))
# Retrieve HASH(nounce + "abc")
r.sendline("3")
print(r.recvuntil("Okay, send us a nonce for this round!"))
r.send("abc")
print(r.recvuntil("odds of 2^112"))
result = r.recvuntil("luck next time!")
result_100bits = int(result[23:-33])
print(result)
print(result_100bits)
# Retrieve HASH(nounce + pad("abc") + "1")
r.sendline("3")
print(r.recvuntil("Okay, send us a nonce for this round!"))
initial_length = 16 + 3
r.send("abc\x80" + ("\x00" * (64 - 9 - initial_length) + struct.pack("<Q", initial_length << 3) + "1"))
print(r.recvuntil("odds of 2^112"))
result = r.recvuntil("luck next time!")
result_test_100bits = int(result[23:-33])
print(result)
print(result_test_100bits)
for i in xrange(0, 2**16):
if i % 1000000 == 0:
print i
i_hash = hex(i * 2**(128 - 16) + result_100bits)[2:].replace("L", "")
i_hash = "0" * (32 - len(i_hash)) + i_hash
final_block = "1" + "\x80" + "\x00" * (64 - 9 - 1) + struct.pack("<Q", 65 << 3)
state = list(struct.unpack("<4I", i_hash.decode("hex")))
state = md5.md5_compress(state, final_block)
final_hash = "".join(struct.pack("<4I", state[0], state[1], state[2], state[3]))
if int(final_hash.encode("hex"), 16) % 2**112 == result_test_100bits:
print("Found %d" % i)
break
state = list(struct.unpack("<4I", i_hash.decode("hex")))
for j in range(2, 100000000):
m = str(j)
final_block = m + "\x80" + "\x00" * (64 - 9 - len(m)) + struct.pack("<Q", (64 + len(m)) << 3)
to_send = "abc\x80" + "\x00" * (64 - 9 - initial_length) + struct.pack("<Q", initial_length << 3) + m
final_state = md5.md5_compress(state, final_block)
final_hash = "".join(struct.pack("<4I", final_state[0], final_state[1], final_state[2], final_state[3]))
final_int = int(final_hash.encode("hex"), 16)
nb_bet = 0
while final_int % 2 == 0:
nb_bet += 1
final_int /= 2
if nb_bet == 0:
continue
r.sendline("4")
print(r.recvuntil("Your current balance is $"))
amount = int(r.recv(1024))
print("At %d$ ..." % amount)
r.sendline("1")
print(r.recvuntil("Please pick odds (as a power of 2 between 1 and 112): "))
r.sendline("%d" % nb_bet)
r.sendline("2")
r.recvuntil("Please pick your bet amount (between 0 and %d): " % amount)
r.send("%d" % amount)
r.sendline("3")
print(r.recvuntil("Okay, send us a nonce for this round!"))
r.send(to_send)
r.recvuntil("Wow! You won, congratulations!")
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment