hack you 2014 – Crypto200 – hashme (at katagaitai CTF勉強会 #5 - 関東|med)

hashme_solve.py

import socket
from math import sin

def xor(a, b):
        return ''.join(map(lambda x : chr(ord(x[0]) ^ ord(x[1])), zip(a, b * 100)))

def hashme_ext(s, digest, len_seed):
        #my secure hash function
        def F(X,Y,Z):
                return ((~X & Z) | (~X & Z)) & 0xFFFFFFFF
        def G(X,Y,Z):
                return ((X & Z) | (~Z & Y)) & 0xFFFFFFFF
        def H(X,Y,Z):
                return (X ^ Y ^ Y) & 0xFFFFFFFF
        def I(X,Y,Z):
                return (Y ^ (~Z | X)) & 0xFFFFFFFF
        def ROL(X,Y):
                return (X << Y | X >> (32 - Y)) & 0xFFFFFFFF
        #A = 0x67452301
        #B = 0xEFCDAB89
        #C = 0x98BADCFE
        #D = 0x10325476
        B = int(digest[:8], 16)
        A = int(digest[8:16], 16)
        D = int(digest[16:24], 16)
        C = int(digest[24:], 16)
        X = [int(0xFFFFFFFF * sin(i)) & 0xFFFFFFFF for i in xrange(256)]
        for i,ch in enumerate(s):
                #k, l = ord(ch), i & 0x1f
                k, l = ord(ch), (len_seed + i) & 0x1f
                A = (B + ROL(A + F(B,C,D) + X[k], l)) & 0xFFFFFFFF
                B = (C + ROL(B + G(C,D,A) + X[k], l)) & 0xFFFFFFFF
                C = (D + ROL(C + H(D,A,B) + X[k], l)) & 0xFFFFFFFF
                D = (A + ROL(D + I(A,B,C) + X[k], l)) & 0xFFFFFFFF
        return ''.join(map(lambda x : hex(x)[2:].strip('L').rjust(8, '0'), [B, A, D, C]))

s = socket.create_connection(('katagaitai.orz.hm', 7777))
data = s.recv(8192)
print data
data = s.recv(8192)
print data

"""
login = 'A' * 200

s.sendall('0\n')
data = s.recv(8192)
print data
s.sendall(login + '\n')
data = s.recv(8192)
print data

ss = "login=%s&role=anonymous" % login
cert = 'RK5yZMJaRRl8LVBk5mx9xmVfPhXWqPlNObWPakmd6mpMs0qh6p9KVhBr0hqGJCE9tKRpgFRM7SZFGXwtUGTmbH3GZV8+Fdao+U05tY9qSZ3qakyzSqHqn0pWEGvSGoYkIT20pGmAVEztJkUZfC1QZOZsfcZlXz4V1qj5TTm1j2pJnepqTLNKoeqfSlYQa9IahiQhPbSkaYBUTO0mRRl8LVBk5mx9xmVfPhXWqPlNObWPakmd6mpMs0qh6p9KVhBr0hqGJCE9tKRpgFRM7SYiKlIAdBjGQ1PpXXMQIeSI2z5JzKgSP+rJHzzBOtmT7movZBrwY6EEV0XN1k70dg=='
key = xor(ss, cert.decode('base64'))
print key.encode('hex')
"""

login = 'A' * 200
cert = 'RK5yZMJaRRl8LVBk5mx9xmVfPhXWqPlNObWPakmd6mpMs0qh6p9KVhBr0hqGJCE9tKRpgFRM7SZFGXwtUGTmbH3GZV8+Fdao+U05tY9qSZ3qakyzSqHqn0pWEGvSGoYkIT20pGmAVEztJkUZfC1QZOZsfcZlXz4V1qj5TTm1j2pJnepqTLNKoeqfSlYQa9IahiQhPbSkaYBUTO0mRRl8LVBk5mx9xmVfPhXWqPlNObWPakmd6mpMs0qh6p9KVhBr0hqGJCE9tKRpgFRM7SYiKlIAdBjGQ1PpXXMQIeSI2z5JzKgSP+rJHzzBOtmT7movZBrwY6EEV0XN1k70dg=='
key = '28c1150dac6704583d6c1125a72d3c87241e7f5497e9b80c78f4ce2b08dcab2b0df20be0abde0b17512a935bc765607cf5e528c1150dac6704583d6c1125a72d3c87241e7f5497e9b80c78f4ce2b08dcab2b0df20be0abde0b17512a935bc765607cf5e5'.decode('hex')

def verify(s, cert):
    s.sendall('1\n')
    print s.recv(8192)
    s.sendall(cert+'\n')
    data = s.recv(8192)
    print data
    if 'Auth failed' not in data:
        print s.recv(8192)
        return True
    print s.recv(8192)

digest = xor(cert.decode('base64'), key)[-32:]
for len_seed in xrange(32):
    digest_ext = hashme_ext('&role=administrator', digest, len_seed)
    ss = "login=%s&role=anonymous&role=administrator" % login
    cert = xor(ss + digest_ext, key).encode('base64').replace('\n', '')
    print "[+] len_seed = %d" % len_seed
    if verify(s, cert):
        break

result.txt

$ python hashme_solve.py
======================

[0] Register
[1] Login
======================

[+] len_seed = 0
Provide your certificate:

[-] Auth failed

======================
[0] Register
[1] Login
======================

[+] len_seed = 1
Provide your certificate:

[-] Auth failed

======================
[0] Register
[1] Login
======================

[+] len_seed = 2
Provide your certificate:

[-] Auth failed

======================
[0] Register
[1] Login
======================

[+] len_seed = 3
Provide your certificate:

[-] Auth failed

======================
[0] Register
[1] Login
======================

[+] len_seed = 4
Provide your certificate:

[-] Auth failed

======================
[0] Register
[1] Login
======================

[+] len_seed = 5
Provide your certificate:

[-] Auth failed

======================
[0] Register
[1] Login
======================

[+] len_seed = 6
Provide your certificate:

[-] Auth failed

======================
[0] Register
[1] Login
======================

[+] len_seed = 7
Provide your certificate:

[-] Auth failed

======================
[0] Register
[1] Login
======================

[+] len_seed = 8
Provide your certificate:

[-] Auth failed

======================
[0] Register
[1] Login
======================

[+] len_seed = 9
Provide your certificate:

[-] Auth failed

======================
[0] Register
[1] Login
======================

[+] len_seed = 10
Provide your certificate:

[-] Auth failed

======================
[0] Register
[1] Login
======================

[+] len_seed = 11
Provide your certificate:

[-] Auth failed

======================
[0] Register
[1] Login
======================

[+] len_seed = 12
Provide your certificate:

[-] Auth failed

======================
[0] Register
[1] Login
======================

[+] len_seed = 13
Provide your certificate:

[-] Auth failed

======================
[0] Register
[1] Login
======================

[+] len_seed = 14
Provide your certificate:

[-] Auth failed

======================
[0] Register
[1] Login
======================

[+] len_seed = 15
Provide your certificate:

[-] Auth failed

======================
[0] Register
[1] Login
======================

[+] len_seed = 16
Provide your certificate:

[-] Auth failed

======================
[0] Register
[1] Login
======================

[+] len_seed = 17
Provide your certificate:

[-] Auth failed

======================
[0] Register
[1] Login
======================

[+] len_seed = 18
Provide your certificate:

[+] Welcome, AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA!

FLAG{2016_is_5th_aniversary_of_katagaitai} ☆（ゝω・）v

======================
[0] Register
[1] Login
======================