1

I work on class exercice that involves on find a password on a remote server. The goal is to use the Python pwn library.

When I access to the server with a nc IP port I have :

[0000014075] Initializing the exercice...
[0001678255] Looking for a door...
[0001990325] Trying to unlock the door...
^ _ ^ Ready for the challenge ? ^_^
Answer :

I understand that it's kind of a side channel attack and I have to use the time of each iteration to get the write character. If I'm right at each iteration I should get the password.

I use the following code :

import time
from pwn import *

conn = remote('URL', port)

def determine_character(duration) -> str:

    chars = "0123456789ABCDEFGHIJKLMNOPQRSTWXYZabcdefghijklmnopqrstuvwyz"
    return chars[int(duration * 10 / 3)]

final_pass = ""
supposedLength = 50;
for i in range (supposedLength):
    conn.sendline("test")
    start = time.time()
    conn.sendline("a")
    conn.recvline()
    stop = time.time()
    print (current_time2)
    duration = (stop - start)
    
    real_pass = determine_character(duration)
    print (real_pass)
    final_pass += str(real_pass)
    
print ("final pass {} : ". format(final_pass))

print (conn.recvline())
for i in range (supposedLength):
    conn.sendline(final_pass[i])
    print(conn.recvline())

But this does not work. Indeed when I run the script I get a strange password and obviously it fails :

final pass 05010000000000000000000000000000000000000000000000

How should I do to have a good password ? Is there a problem with the duration ? Have you some ideas to debug the script ?

Any help would be greatly appreciated, thanks !

Julien
  • 699
  • 3
  • 14
  • 30

0 Answers0