Skip to content

Instantly share code, notes, and snippets.

@J4ckKn1ght
Created February 22, 2019 11:27
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save J4ckKn1ght/c86eee0252f8e4a08ec43f7a9dbb395f to your computer and use it in GitHub Desktop.
Save J4ckKn1ght/c86eee0252f8e4a08ec43f7a9dbb395f to your computer and use it in GitHub Desktop.
import math
rotate_amounts = [7, 12, 17, 22, 7, 12, 17, 22, 7, 12, 17, 22, 7, 12, 17, 22,
5, 9, 14, 20, 5, 9, 14, 20, 5, 9, 14, 20, 5, 9, 14, 20,
4, 11, 16, 23, 4, 11, 16, 23, 4, 11, 16, 23, 4, 11, 16, 23,
6, 10, 15, 21, 6, 10, 15, 21, 6, 10, 15, 21, 6, 10, 15, 21]
constants = [int(abs(math.sin(i+1)) * 2**32) & 0xFFFFFFFF for i in range(64)]
init_values = [0x67452301, 0xefcdab89, 0x0ABCDEF00, 0x12345678]
functions = 16*[lambda b, c, d: (b & c) | (~b & d)] + \
16*[lambda b, c, d: (d & b) | (~d & c)] + \
16*[lambda b, c, d: b ^ c ^ d] + \
16*[lambda b, c, d: c ^ (b | ~d)]
index_functions = 16*[lambda i: i] + \
16*[lambda i: (5*i + 1)%16] + \
16*[lambda i: (3*i + 5)%16] + \
16*[lambda i: (7*i)%16]
def left_rotate(x, amount):
x &= 0xFFFFFFFF
return ((x<<amount) | (x>>(32-amount))) & 0xFFFFFFFF
def md5(message):
message = bytearray(message) #copy our input into a mutable buffer
orig_len_in_bits = (8 * len(message)) & 0xffffffffffffffff
message.append(0x80)
while len(message)%64 != 56:
message.append(0)
message += orig_len_in_bits.to_bytes(8, byteorder='little')
hash_pieces = init_values[:]
for chunk_ofst in range(0, len(message), 64):
a, b, c, d = hash_pieces
chunk = message[chunk_ofst:chunk_ofst+64]
for i in range(64):
f = functions[i](b, c, d)
g = index_functions[i](i)
to_rotate = a + f + constants[i] + int.from_bytes(chunk[4*g:4*g+4], byteorder='little')
new_b = (b + left_rotate(to_rotate, rotate_amounts[i])) & 0xFFFFFFFF
a, b, c, d = d, new_b, b, c
for i, val in enumerate([a, b, c, d]):
hash_pieces[i] += val
hash_pieces[i] &= 0xFFFFFFFF
return sum(x<<(32*i) for i, x in enumerate(hash_pieces))
def md5_to_hex(digest):
raw = digest.to_bytes(16, byteorder='little')
return '{:032x}'.format(int.from_bytes(raw, byteorder='big'))
def check(mMD5, hMD5):
for i in range(0, len(mMD5), 2):
if ord(mMD5[i]) ^ ord(mMD5[i + 1]) ^ ord(hMD5[i]) ^ ord(hMD5[i + 1]) != 0:
return False
return True
def findMD5(hMD5):
for ch1 in range(32, 127):
for ch2 in range(32, 127):
message = chr(ch1) + chr(ch2)
mMD5 = md5_to_hex(md5(message.encode())).upper()
if check(hMD5, mMD5):
return message
return ""
if __name__=='__main__':
listMD5 = ['0', 'C', '1', '1', '9', 'B', 'D', '8', '1', '0', '2', '1', '5', 'E', 'D', '2', 'A', 'E', '4', '7', '8', '6', 'B', '8', 'D', 'B', '8', '1', 'A', 'A', 'C', 'A', '9', '1', '8', 'C', '0', 'D', 'E', '6', '6', '4', '4', '7', '0', 'B', '9', '4', '3', 'A', 'E', '6', '2', 'F', 'E', '4', 'E', '2', '3', '2', 'E', 'D', 'A', 'D', '9', '1', '5', 'F', '6', 'C', '0', 'A', '0', '1', '2', '6', '0', '1', 'A', 'A', 'E', 'C', '4', 'B', '2', 'D', 'B', '2', '3', '5', '1', 'F', 'A', '6', '9', 'A', '2', '1', '9', '7', 'E', 'A', '5', 'F', '7', '8', 'B', 'C', 'B', '2', 'C', '8', '9', 'D', '7', '4', 'C', '2', '4', '6', 'B', '4', '3', '1', '3', '4', 'F', '1', 'E', '3', '9', 'F', '6', 'B', 'C', '4', '4', '1', '1', '0', 'F', '5', 'D', '2', 'C', '7', '6', '0', '1', 'A', 'F', 'E', '7', '0', '8', 'B', '5', '0', '8', 'A', 'A', '8', 'F', 'C', '8', 'C', 'E', 'B', 'D', '5', '8', 'B', '6', '3', '9', '8', '8', '6', 'F', '8', '4', '3', '8', '9', 'E', '8', 'D', '9', '0', '1', '2', 'F', '9', 'D', '1', '9', '4', 'A', 'A', '1', '0', '0', 'D', '5', 'A', '7', '9', 'F', '5', 'F', '0', '3', '3', 'B', 'B', '2', '0', '0', '0', 'A', '0', '5', '6', '5', '9', '1', '8', '6', '0', '9', '3', 'C', '3', 'D', '3', '6', 'F', 'F', '0', '8', 'E', 'B', 'D', '0', '2', 'F', '0', '5', '9', '7', '5', '7', '2', '5', 'C', '8', '1', 'F', '7', 'F', 'B', '1', 'C', '5', '3', '2', 'D', 'F', '0', '0', '2', '2', '0', 'C', '4', 'A', 'F', '0', '5', '5', '8', 'F', '5', 'F', '1', 'E', '8', '9', '4', '0', '3', '1', '0', 'B', '2', '4', 'A', 'A', '2', 'B', 'F', 'E', 'B', 'A', '8', '1', 'D', 'D', '7', '2', '8', '0', '1', '1', '3', '5', '8', '1', 'B', '5', 'B', 'A', 'D', '2', 'C', '3', 'F', '3', 'A', 'C', '7', '9', '1', '4', '8', 'C', 'A', 'B', 'A', '5', 'A', '6', 'C', '3', 'D', '4', 'C', 'E', 'F', 'A', 'F', '1', '5', '5', '9', '2', '6', '1', '8', '2', '0', 'B', 'E', '8', '6', '7', '1', '8', '0', '2', '5', '4', 'D', 'C', 'B', 'B', 'A', '0', '6', 'F', '1', 'F', 'B', '7', 'A', 'C', 'B', '0', '5', '2', '5', '6', '5', 'D', '8', '3', 'A', 'B', '1', '4', '4', '4', '9', 'A', 'D', 'B', 'F', 'D', 'C', '8', '3', 'B', 'B', '7', 'B', '7', '9', '2', '7', '5', '2', '6', '8', 'A', 'A', 'B', 'A', '7', 'D', 'C', 'E', '4', '6', '0', 'D', '5', '8', 'D', 'F', '0', 'F', 'E', '9', 'A', '6', '7', 'B', 'E', '4', '4', '7', '7', '4', '6', '9', '8', 'D', '1', 'A', '1', 'B', '9', 'D', '2', 'F', 'A', 'D', '0', 'D', '7', 'F', '1', '8', 'C', '6', '8', 'F', '8', '3', '0', '2', '6', '2', '6', '9', '7', 'F', 'C', 'A', '0', 'A', '5', 'A', '0', '0', 'A', '3', 'D', '8', 'C', '4', '1', '8', 'D', '3', '8', 'D', 'E', '8', '9', 'E', 'C', 'F', 'D', '6', 'D', 'E', '3', '9', '8', 'F', '2', '1', 'B', '4', '9', 'E', '8', '4', 'C', '8', 'B', '0', '9', '8', '0', '1', 'F', 'F', '9', '0', '3', 'E', '2', 'D', 'C', 'F', '7', 'F', '7', '7', '7', 'B', 'E', '3', '8', '9', '6', 'E', '8', '9', '5', 'C', 'A', '1', '1', 'C', 'F', '0', '9', '0', '4', '0', '0', '6', '4', '6', '0', '3', '2', '5', '5', 'F', 'D', '7', 'B', '7', '5', '1', '4', 'A', 'F', '2', '2', '0', 'C', '9', '8', '5', '3', '3', '4', 'C', '8', 'B', 'D', '0', '9', '4', 'B', '6', 'A', '8', '7', 'C', '8', '9', '9', 'A', 'D', '6', '5', '6', '0', '4', '0', 'B', '4', 'A', '2', '6', '9', 'A', '9', '0', '3', 'C', '1', 'A', '9', 'A', '6', '9', '3', '3', 'D', '3', '7', '8', '0', 'A', '5', '8', '8', 'D', 'D', 'E', 'A', 'A', '2', '7', 'D', '3', '7', '4', 'E', '9', '5', '2', '2', 'E', '7']
flag = ''
for i in range(0, len(listMD5), 32):
hMD5 = ''.join(ch for ch in listMD5[i : i + 32])
flag += findMD5(hMD5)
print(flag)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment