Skip to content

Instantly share code, notes, and snippets.

@rikaardhosein
Last active December 16, 2015 12:19
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save rikaardhosein/5433717 to your computer and use it in GitHub Desktop.
Save rikaardhosein/5433717 to your computer and use it in GitHub Desktop.
import socket
import itertools
import struct
import string
import sys
def send_data( rsocket, data ):
length = struct.pack('I',len(data))
rsocket.send(length)
return rsocket.send(data)
def recv_data( rsocket, data ):
length = struct.unpack('I',rsocket.recv(4))[0]
data = rsocket.recv(length)
return length
def purge_candidate_strings( candidate_strings, min_len ):
return filter( lambda x: len(x)>=min_len, candidate_strings)
candidate_strings = ['']
if len(sys.argv) >= 2:
candidate_strings = [sys.argv[1]]
charset = 'abcdefghijklmnopqrstuvwxyz_'
multiplier = 4
perm_len = 1
max_len = 0
rsocket = socket.create_connection(("127.0.0.1",4433))
nonce = rsocket.recv(8)
while max_len < 20:
num_candidates = len(candidate_strings)
for i in range(0,num_candidates):
min_ret_bytes = -1
possible_candidates = []
data = ''
for possible_candidate in map( lambda x : candidate_strings[i]+x ,charset):
send_data(rsocket, possible_candidate * (1 if max_len >= 4 else 4) )
possible_candidates.append((possible_candidate, recv_data(rsocket, data) ))
min_len = min( map( lambda x: x[1], possible_candidates) )
possible_candidates,_ = zip(*filter( lambda x: x[1] == min_len , possible_candidates ))
candidate_strings += possible_candidates
max_len = max(map(len,candidate_strings))
candidate_strings = purge_candidate_strings( candidate_strings, max_len )
print candidate_strings
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment