Hack Dat Kiwi 2015: Phone Lock (Web) Write-up

Description:

A friend of mine forgot her phone password. I told her you're the hacker! Go get 'em tiger.

Solution:

          It use Javascript to validate and I just write a python script to solve this below.

	#!/usr/bin/python
	# Author: Kitwipat Towattana (@icheernoom)
	import hashlib, sys
	salt = 'f074dc1fbaaf66163dfca8ad1079ceea' # random
	valid = 'a8178dee94945e518c90dad6bffcc657' # random
	'''
	if (md5(salt+result)==valid)
	flag = md5(salt+result+result)
	'''
	for result in range(0000,9999):
	md5 = hashlib.md5("{0}{1}".format(salt,result)).hexdigest()
	print "{0} : {1}".format(result,md5)
	if md5 == valid:
	md5flag = hashlib.md5("{0}{1}{2}".format(salt,result,result)).hexdigest()
	print "Password: {0}".format(result)
	print "Flag: {0}".format(md5flag)
	sys.exit()
	'''
	root@ubuntu:~# web50.py
	...[snip]...
	3396 : da54054da6a7cefa3204713b71669566
	3397 : bf918a33c530b497779200888e6eb582
	3398 : a8178dee94945e518c90dad6bffcc657
	Password: 3398
	Flag: 98635f80048b8abbd71e9bb55958a6c8
	root@ubuntu:~#
	'''

view raw web50.py hosted with ❤ by GitHub

Flag: 98635f80048b8abbd71e9bb55958a6c8