題目連結

https://learn.cylabacademy.org/library/475

題目解法

可以使用 python 腳本或是線上 hash cracking 工具來完成這題，以下示範使用 python 腳本加上 rockyou.txt 字典。

  1. 使用 nc 連線進去後，第一個 hash 值長度為 32，可以猜測是 MD5。

     1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

    import hashlib

target_hash = "482c811da5d5b4bc6d497ffa98491e38"
dict_path = "rockyou.txt"

with open(dict_path, 'rb') as f:
    for line in f:
        password = line.strip()
        if hashlib.md5(password).hexdigest() == target_hash:
            print(f"Found: {password.decode(errors='ignore')}")
            break

  2. 第二個 hash 長度為 40，可以推測是 SHA1。

     1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

    import hashlib

target_hash = "b7a875fc1ea228b9061041b7cec4bd3c52ab3ce3"
dict_path = "rockyou.txt"

with open(dict_path, 'rb') as f:
    for line in f:
        password = line.strip()
        if hashlib.md5(password).hexdigest() == target_hash:
            print(f"Found: {password.decode(errors='ignore')}")
            break

  3. 第三個 hash 長度為 64，可以推測是 SHA256。

     1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

    import hashlib

target_hash = "916e8c4f79b25028c9e467f1eb8eee6d6bbdff965f9928310ad30a8d88697745"
dict_path = "rockyou.txt"

with open(dict_path, 'rb') as f:
    for line in f:
        password = line.strip()
        if hashlib.md5(password).hexdigest() == target_hash:
            print(f"Found: {password.decode(errors='ignore')}")
            break

  4. 完整流程

    webshell:~$ nc verbal-sleep.picoctf.net 54917
Welcome!! Looking For the Secret?

We have identified a hash: 482c811da5d5b4bc6d497ffa98491e38
Enter the password for identified hash: password123
Correct! You've cracked the MD5 hash with no secret found!

Flag is yet to be revealed!! Crack this hash: b7a875fc1ea228b9061041b7cec4bd3c52ab3ce3
Enter the password for the identified hash: letmein
Correct! You've cracked the SHA-1 hash with no secret found!

Almost there!! Crack this hash: 916e8c4f79b25028c9e467f1eb8eee6d6bbdff965f9928310ad30a8d88697745
Enter the password for the identified hash: qwerty098
Correct! You've cracked the SHA-256 hash with a secret found. 
The flag is: picoCTF{Use-----------------------------2d7}