Skip to content

Instantly share code, notes, and snippets.

@mrT4ntr4
Last active April 21, 2020 19:37
Show Gist options
  • Save mrT4ntr4/2ca9102bb6d0b3afd0b8732ff1e715f5 to your computer and use it in GitHub Desktop.
Save mrT4ntr4/2ca9102bb6d0b3afd0b8732ff1e715f5 to your computer and use it in GitHub Desktop.
Encrypt Fcn of Challenge SharpPasswd.dll from VolgaCTF 2020 (Unsolved)
def b64From24bit(a, b, c, n):
num = c << 16 | b << 8 | a
b64enc = ""
while (n):
b64enc += "./0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz"[num & 63]
num >>= 6;
n-=1
return b64enc
def crypt(key, salt, prefix):
hash1 = md5.new(key + salt + key)
#print hash1.hexdigest()
x = (hash1.digest())
hash2 = md5.new(key + prefix + salt + x[0:len(key)])
num = len(key)
num2 = 0
while (num2 < 31 and num != 0):
if ( (num & 1 << num2) != 0):
y = '\0'
else:
y = key[0]
#print "y : {}, num : {}, num2 : {}".format(y,num,num2)
hash2.update(str(y))
num &= ~(1 << num2)
num2+=1
#print hash2.hexdigest()
gaga = hash2.digest()
print "####### Enourmous function ######"
for j in range(1000):
dad = md5.new()
print "--------------"
if ((j & 1) != 0):
dad.update(key) # 1
else:
print "With GAGA : ", gaga.encode('hex')
dad.update(gaga) # 0
if (j % 3 != 0):
#print "With SALT : ", salt
dad.update(salt)
if (j % 7 != 0):
dad.update(key)
if ((j & 1) != 0):
print "With GAGA : ", gaga.encode('hex')
dad.update(gaga) # 1
else:
dad.update(key) # 0
gaga = dad.digest()
#print "\nhashed.... ",dad.hexdigest()
print dad.hexdigest()
return dad.hexdigest()
def gethash(salt, hash):
jojo = ''
jojo += '$1$'
jojo += salt
jojo += '$'
hash = [int(hash[i]+hash[i+1], 16) for i in range(0, len(hash), 2)]
jojo += b64From24bit(hash[0], hash[6], hash[12], 4)
jojo += b64From24bit(hash[1], hash[7], hash[13], 4)
jojo += b64From24bit(hash[2], hash[8], hash[14], 4)
jojo += b64From24bit(hash[3], hash[9], hash[15], 4)
jojo += b64From24bit(hash[4], hash[10], hash[5], 4)
jojo += b64From24bit(hash[11], 0, 0, 2)
print jojo
return jojo
if __name__ == "__main__":
import md5
salt = '.XnY46'
choice = 'hello'
res = crypt(choice, salt , '$1$')
gethash(salt, res)
# GOAL : $1$.XnY46$rgnJwTKW7jO0xqyqJkf9C1
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment