Programming 3

[iRath]

Hey,

Somehow I am unable to complete the Programming Mission 3. The only thing I actually was able to do is making a decrypt Function which requires the Password. Since the Password isnt given, I dont know how to do it.

I read other Threads about Programming 3, and noticed I should use "Smart Brute Forcing".
The only Problem, I dont exactly know how to. Since the CrossTotal can vary from 0 to 480, and the current Char of the MD5 of the Password, the offset can vary from -15 to 480 and I have no other Idea than just guessing it.

Could somebody please help me?

Thanks in Advance

[Gandalf2000]

Since the CrossTotal can vary from 0 to 480

That is not exactly true, you can estimate it.

edit: ok, i understood you after reading ur post twice

[fpwns]

A port of the php to python...a little note: php's strlen() counts the unix style newlines while python's len() does not so i removed them

Code: Select all

from hashlib import md5

def evalCrossTotal(strMD5):
  intTotal = 0
  arrMD5Chars = list(strMD5)
  for value in arrMD5Chars:
    hexval = '0x0'+ value
    intTotal += int(hexval, 16)
  return intTotal
 

def encryptString(strString, strPassword):
  strPasswordMD5 = md5(strPassword).hexdigest()
  intMD5Total = evalCrossTotal(strPasswordMD5)
  arrEncryptedValues = []
  intStrlen = len(strString)

  count = 0
  while count < intStrlen:
    substr1 = strString[count:count+1]
    substr2 = strPasswordMD5[count%32:count%32+1]
    substr3 = md5(strString[0:count+1]).hexdigest()[0:16]
    substr4 = md5(str(intMD5Total)).hexdigest()[0:16]
   
    arrEncryptedValues.append(ord(substr1) +  int(('0x0' + substr2), 16) -  intMD5Total)
    intMD5Total = evalCrossTotal(substr3 + substr4)
    count +=1

  return arrEncryptedValues
 
data = "99Z-KH5-OEM-240-1.1QGG-V33-OEM-0B1-1.1Z93-Z29-OEM-BNX-1.1IQ0-PZI-OEM-PK0-1.1UM4-VDL-OEM-B9O-1.1L0S-4R2-OEM-UQL-1.1JBL-EYQ-OEM-ABB-1.1NL1-3V3-OEM-L4C-1.17CQ-1ZR-OEM-U3I-1.1XX0-IHL-OEM-5XK-1.1KJQ-RXG-OEM-TW8-1.1 OZR-LW1-OEM-5EM-1.10B8-6K5-OEM-EFN-1.1OE2-20L-OEM-SSI-1.10ME-HAE-OEM-9XB-1.1"

print encryptString(data, "key")