16.md

Writeup for medium crackme

@cha5126568

from hashlib import *

i = 1000
while i < 10000:
	s = str(sha1("gD0Fbs"+str(i)).hexdigest())
	if s == "c5b55e1f6405b6c27800d7a3c80356d5c8f1b6b8":
		print "gD0Fbs"+str(i)
	i+=1

@Ga_ryo_

gdb.execute('file ./medium_crackme')
gdb.execute('b *0x8048283')
gdb.execute('b *0x80482a7')
f = open('log','w')
i = 1000
for i in range(1000,9999):
    gdb.execute('run < hoge.bin')
    num = gdb.execute('p $esp + 0xc', to_string=True)
    gdb.execute('set *0x'+num.split('0x')[1]+'='+str(i))
    gdb.execute('continue')
    esp_08 = gdb.execute('p $esp + 0x8', to_string=True)
    ret = gdb.execute('x/w 0x'+esp_08.split('0x')[1], to_string=True)
    ans = gdb.execute('x/w 0x'+ret.split(':')[1].split('0x')[1], to_string=True)
    f.write(str(i) + ':' + ans)
    if "0x1f5eb5c5" in ans:
        print '[*] found in ' + str(i)
        gdb.execute('quit')
f.close()