md5colliding - Cryptography - katagaitaiCTF#5 関西med

elf_md5colliding.c

/* for x86 linux */
#include <stdio.h>

int main(int argc, char** argv)
{
  char c = argv[0][2];

  if (c == '1') {
    puts("All Eindbazen are wearing wooden shoes");
  } else if (c == '2') {
    puts("All Eindbazen live in a windmill");
  } else if (c == '3') {
    puts("All Eindbazen grow their own tulips");
  } else if (c == '4') {
    puts("All Eindbazen smoke weed all day");
  } else if (c == '5') {
    puts("All Eindbazen are cheap bastards");
  }
  
  return 0;
}

fastcollSolve_md5colliding.py

# coding: utf-8
from os import system, execv

#                                          +-- step4.2 [*]
#                                          |
#                              +-- step3.2 +-- step4.1 [*]
#                              |                 |
#                  +-- step2.2 +-- step3.1 <-----+ [*]
#                  |                             |
#      +-- step1.2 +-- step2.1 <-----------------+ [*]
#      |                                         |
# main +-- step1.1 <-----------------------------+ [*]
#

N = 5    # 生成個数
base = "main"    # 最初のファイル名

# 生成していく
for i in range(1, N):
    system("./fastcoll {0} -o step{1}.1 step{1}.2".format(base, i))
    base = "step{0}.2".format(i)

# 各stepとstepN.1との差分を埋める
new = open("step{0}.1".format(N-1), "rb").read()
for i in range(1, N - 1):
    old = open("step{0}.1".format(i), "rb").read()
    old += new[len(old):]
    open("step{0}.1".format(i), "wb").write(old)

# gomiを消す
for i in range(1, N - 1):
    system("rm ./step{0}.2".format(i))

# 改名する
for i in range(1, N):
    system("mv ./step{0}.1 ./{0}.bin".format(i))
    system("chmod +x ./{0}.bin".format(i))
system("mv ./step{0}.2 ./{1}.bin".format(N-1, N))
system("chmod +x ./{0}.bin".format(N))