西工大网络安全基础训练python-crack部分

Crack: 读python代码解题（提交报告）

1 实验目的

（1）理解Python代码

（2）了解密码校验的常见方式

2 实验内容

(1) 下载对应的压缩包（Crack-1、Crack-2、Crack-3、Crack-4、Crack-5），按要求分析得到Flag；

(2) Crack-1：下载密码检查器，同时还需要同一目录下的经过加密后的Flag文件。

    def level_1_pw_check():
    user_pw = input("Please enter correct password for flag: ")
    if( user_pw == "8713"):
        print("Welcome back... your flag, user:")
        decryption = str_xor(flag_enc.decode(), user_pw)
        print(decryption)
        return
    print("That password is incorrect")

阅读代码可知：当输入的字符串为’8713’时，获得通关资格

(3) Crack-2：下载密码检查器，同时还需要同一目录下的经过加密后的Flag文件。

def level_2_pw_check():
    user_pw = input("Please enter correct password for flag: ")
    if( user_pw == chr(0x34) + chr(0x65) + chr(0x63) + chr(0x39) ):
        print("Welcome back... your flag, user:")
        decryption = str_xor(flag_enc.decode(), user_pw)
        print(decryption)
        return
    print("That password is incorrect")

阅读代码得：当输入字符串为’chr(0x34) + chr(0x65) + chr(0x63) + chr(0x39)'时，通关，'chr(0x34) + chr(0x65) + chr(0x63) + chr(0x39)'为’4ec9’的ACSII码

(4) Crack-3：下载密码检查器，同时还需要同一目录下的经过加密后的Flag文件与哈希值。有 7 个可能的密码，其中 1 个是正确的。你可以通过分析密码检查器脚本找到这些密码。

def level_3_pw_check():
    user_pw = input("Please enter correct password for flag: ")
    user_pw_hash = hash_pw(user_pw)
    
    if( user_pw_hash == correct_pw_hash ):
        print("Welcome back... your flag, user:")
        decryption = str_xor(flag_enc.decode(), user_pw)
        print(decryption)
        return
    print("That password is incorrect")

level_3_pw_check()
# The strings below are 7 possibilities for the correct password. 
#   (Only 1 is correct)
pos_pw_list = ["8799", "d3ab", "1ea2", "acaf", "2295", "a9de", "6f3d"]

阅读代码可知正确的密码在列表’pos_pw_list’里面，可以通过一一测试试出密码为’2295’

(5) Crack-4：下载密码检查器，同时还需要同一目录下的经过加密后的Flag文件与哈希值。有 100 个可能的密码，其中只有 1 个是正确的。你可以通过分析密码检查器脚本找到这些密码。

def level_4_pw_check():
    pos_pw_list = ["158f", "1655", "d21e", "4966", "ed69", "1010", "dded", "844c", "40ab", "a948", "156c", "ab7f", "4a5f", "e38c", "ba12", "f7fd", "d780", "4f4d", "5ba1", "96c5", "55b9", "8a67", "d32b", "aa7a", "514b", "e4e1", "1230", "cd19", "d6dd", "b01f", "fd2f", "7587", "86c2", "d7b8", "55a2", "b77c", "7ffe", "4420", "e0ee", "d8fb", "d748", "b0fe", "2a37", "a638", "52db", "51b7", "5526", "40ed", "5356", "6ad4", "2ddd", "177d", "84ae", "cf88", "97a3", "17ad", "7124", "eff2", "e373", "c974", "7689", "b8b2", "e899", "d042", "47d9", "cca9", "ab2a", "de77", "4654", "9ecb", "ab6e", "bb8e", "b76b", "d661", "63f8", "7095", "567e", "b837", "2b80", "ad4f", "c514", "ffa4", "fc37", "7254", "b48b", "d38b", "a02b", "ec6c", "eacc", "8b70", "b03e", "1b36", "81ff", "77e4", "dbe6", "59d9", "fd6a", "5653", "8b95", "d0e5"]

    for i in range (0,100):
        user_pw = pos_pw_list[i]
        user_pw_hash = hash_pw(user_pw)
    
        if( user_pw_hash == correct_pw_hash ):
            print("Welcome back... your flag, user:")
            decryption = str_xor(flag_enc.decode(), user_pw)
            print(decryption)
            return
        print("That password is incorrect")

阅读代码可知：与第三题类似，但是list中的字符串过多不适合使用手动一一输入的方式进行遍历测试，然而我们可以使用循环语句，遍历列表，试出密码

(6) Crack-5：下载密码检查器，同时还需要同一目录下的经过加密后的Flag文件与哈希值。这里有一本字典，根据我们目前看到的密码惯例，收录了所有可能的密码。

def level_5_pw_check():
    dictionary = open('C:/Users/Administrator/Desktop/Python-Crack/Python-Crack/Crack5/dictionary.txt').read().split('\n')
    ##user_pw = input("Please enter correct password for flag: ")
    for user_pw in dictionary:
        user_pw_hash = hash_pw(user_pw)
    
        if( user_pw_hash == correct_pw_hash ):
            print("Welcome back... your flag, user:")
            decryption = str_xor(flag_enc.decode(), user_pw)
            print(decryption)
            return
        print("That password is incorrect")

可知所有密码范围在一个’dictionary.txt’的文件里面，我们可以将文件里面的字符串读取出来并存入一个列表里面，然后故技重施，使用遍历列表的方法试出密码