NDH2015 Quals weshgrow

weshgrow_exploit.py

import struct

class BHE(object):
    # state = [1336226589, 251977347, 716107527, 1774966033]
    state = [struct.unpack("<I", x.decode('hex'))[0] for x in ['ca8473d3', '5a80a5ca', '4e9f3555', 'c2869f71']]

    def to_hex(self, x):
        return struct.pack("<I", x).encode('hex')

    def round(self, byte):
        c = 162888806
        for i in range(3, 0, -1):
            self.state[i] = (self.state[0] * self.state[i] + self.state[0] * byte) % 4294967295
        self.state[0] = (self.state[0] * c + self.state[1] * byte) % 4294967295

    def hash(self, data):
        for char in data:
            self.round(ord(char))
            print "STATES =", self.state
        return "".join([self.to_hex(x) for x in self.state])


b = BHE()
print b.hash("flag")