Solution for Chal9 UTPHAX'16

brute.php

<?php
error_reporting(0);
//Given $y = md5($x.strrev($x).$x*$x^$x.($x%$x)+9*4/$x)
//Find $x if $y = 43a87a86ea9aee0255325e2865d6b503
//Thanks to this code http://www.braindisorder.org/2008/10/md5-hacking-with-php/
function getmicrotime() {
   list($usec, $sec) = explode(" ",microtime());
   return ((float)$usec + (float)$sec);
} 
 
$time_start = getmicrotime();
 
// If no arguments given present usage info
if ($_SERVER["argc"] < 2) {
  print "Usage: dictattack.php <MD5 checksum> [ <Dictionary file> ]\n";
  exit;
}
 
// Get MD5 checksum from command line
$md5sum = $_SERVER["argv"][1];
 
// Open word list - either the one from the command line
// or use the default list
if (isset($_SERVER["argv"][2]) && is_file($_SERVER["argv"][2])) {
  $words = file($_SERVER["argv"][2]);
} else {
  $words = file("/home/r0x/rockyou.txt");
}
 
// Loop through all words
foreach ($words as $word) {
  $word = rtrim($word);
  if (md5($word.strrev($word).$word*$word^$word.($word%$word)+9*4/$word) == $md5sum) {
  //if (md5($word) == $md5sum) {
    print "Match found! $word = $md5sum\n";
    $time_end = getmicrotime();
    $time = $time_end - $time_start; 
    print "Found in " . $time . " seconds\n";
    exit;
  }
}
 
print "No matches found!\n";
?>