Hackergame 2023 o1login 解题代码

Hackergame 2023 o1login 解题代码

Hackergame 2023 o1login 解题代码

solve_o1login.py

from hashlib import sha1
from pwn import *

# while 1:
#     admin_str = 'admin:' + ''.join(random.choices(string.printable.replace('\n', ''), k=5))
#     hash_admin = sha1(admin_str.encode()).digest()
#     if hash_admin.count(b':') == 0:
#         try:
#             hash_admin.decode()
#         except:
#             continue
#         break
# while 1:
#     random_str = 'user2:' + ''.join(random.choices(string.printable.replace('\n', ''), k=5))
#     hash_bytes = sha1(random_str.encode()).digest()
#     if hash_bytes.count(b':') == 1:
#         try:
#             hash_bytes.decode()
#         except:
#             continue
#         break
# idx = hash_bytes.index(b':')
# username = hash_admin + hash_bytes[:idx]
# password = hash_bytes[idx + 1:]

admin_str = 'admin:;]NV1'
hash_admin = b'Z\r)#cL\xe3\x8b\x84bqx\xc5\x96\xc8\xa1mh\x1eO'
hash_bytes = b'wAKq:D\x1djwb\x15\xc2\x84uoV>\xc2\x81='
username = b'Z\r)#cL\xe3\x8b\x84bqx\xc5\x96\xc8\xa1mh\x1eOwAKq'
password = b'D\x1djwb\x15\xc2\x84uoV>\xc2\x81='

r = remote('202.38.93.111', 10094)
r.sendafter(b'token: \n', b'YOUR_TOKEN_HERE')
print(r.recv().decode())
r.sendline(b'1')
print(r.recv().decode())
r.send(username + b':' + password + b'\nuser2:password2\nEOF\n')

ret = r.recvuntil(b'Choice: ').decode()
user_credit = ret.split('\n')[1].split(':')[2]
admin_proof = hash_bytes.hex() + user_credit
r.sendline(b'2')
print(r.recvuntil(b'Login credential: ').decode())
r.sendline((admin_str + ':' + admin_proof).encode())
print(r.recv().decode())