CyLab PW Crack 3 Solved

This challenge presented us with three artifacts: level3.flag.txt.enc, level3.hash.bin, and level3.py. All of these will be useful for our challenge.

The main code "level3.py" has some key functions that we can interpret; they are

• "level_3_pw_check()" function — It checks if user_pw_hash == correct_pw_hash,

if user_pw_hash == correct_pw_hash (then it will display our flag).

The system compares the MD5 binary output of the user-inputted password, which is "user_pw" to "correct_pw_hash". If they are the same, it will reveal our flag.

• "correct_pw_hash" — correct_pw_hash is as a result of the following operation.

This program takes in the "'level3.hash.bin" and performs the following function on it:

open('level3.hash.bin', 'rb').read()

If we perform the above function, we can also print out the bytes in hexadecimal form using the following:

open('level3.hash.bin', 'rb').read().hex()

Our MD5 output — '1b18e1316f9218cc5b053e1cea28e02e'. We can convert this MD5 digest into our correct password.

Converting '1b18e1316f9218cc5b053e1cea28e02e' produces "865e."

Passing 865e as the key into the str_xor() function decrypts level3.flag.txt.enc to produce the final flag: picoCTF{m45h_fl1ng1ng_2b072a90}.

The flag is picoCTF{m45h_fl1ng1ng_2b072a90}

Follow for more challenges like this.