The tasks by Virgil Security on HighLoad++ 2018 in Moscow. https://quest.virgilsecurity.com

a-virgil-security-tasks-highload2018.py

import subprocess
import time
from itertools import product
from string import ascii_lowercase


def brute_force(assumption):
    result = subprocess.run(['passw0rd',
                             '--cfg',
                             'passw0rd.yml',
                             'demo',
                             'verify',
                             assumption,
                             'MIHNAgEBBCDryTcLfyQIscYuP79oGQlB1bz69G2+0uVG1M3fS19zvwQgNU1shESVvOXNEXQ7aGfVu3gZ62MAj6SMkcW+sTw0rgIEQQTqqCxDjuwDS7sVQqlIqN2lAFNd2XTXDw/mqngd1njD2ljIYySBcj+ua7orrQAB32UrZJdKWD2cqPaQu/OsgUKEBEEEAtlu7sU/Ib46eJ3hvEuuaAPysIiT3bVx+5IL/UJaigUEUfVcdk9cyEs4n3q5vVHyBJW64uFNkqXLz2Ur/BarSg=='
                             ],
                            stdout=subprocess.PIPE, stderr=subprocess.PIPE)

    if (len(result.stderr) != 0):
        return result.stderr.decode('utf-8')

    if (len(result.stdout) != 0):
        return result.stdout.decode('utf-8')

    return 'no response'


if __name__ == '__main__':
    for combo in product(ascii_lowercase, repeat=3):
        password = ''.join(combo)
        response = brute_force(password)
        print(response, 'for', password)

        if not response.endswith('invalid password\n'):
            break

        time.sleep(1)

passw0rd.yml

access_token: 31tndH8ZnnbsM5K5-lY6xobAXTUwuR6k
app_id: 7ddccd56f6144cb5a760a247291c5c43
public_key: PK.1.BD0mBjdrQvC4Mi5jiHkc2ZFTh15M+pZj2VBg9VkubLi0V1bB06jtw2yHM67ADrc4urOWav/zWZ8GDVzTJmIgG68=
secret_key: SK.1.0tKY13Fe0AeQzGJBnYBzr34+NXaiyVc6BGpICNTdFXU=

tasks-1-4.bash

# TASK 1
# answer: scarface

# TASK 2
./hashcat64 -m 120 -a 3 --hex-salt -1 ?l?d 'a739fe82fcb03f93dc029dffab09dcf593ef56b6:e9ab7821f3c53a90' ?1?1?1?1?1?1
# answer: 6brkdo

# TASK 3
./hashcat64 -m 1410 -a 3 --hex-salt -1 ?h '73ac6c232b86eece5177648b3a3e058ce66048427827b21d26d4e51a84d0fd2b:c196311b2b96a2b5' ?1?1?1?1?1?1?1?1?1
# answer: 8545776b4

# TASK 4
./hashcat64 -m 3200 -a 3 -1 ?l '$2a$12$gNQbK67rm7Pf3Xgf12it9eoZc6qIeCVMgAn5yPBkOt1A1NN8gIL6a' ?1?1?1
# answer: iph

# TASK 5
# answer: gbg