BKP2015 - Airport

airport_client.py

import hashlib
import gmpy
from time import time, sleep

s = socket()
s.connect(("52.1.245.61", 1025))

p = 27327395392065156535295708986786204851079528837723780510136102615658941290873291366333982291142196119880072569148310240613294525601423086385684539987530041685746722802143397156977196536022078345249162977312837555444840885304704497622243160036344118163834102383664729922544598824748665205987742128842266020644318535398158529231670365533130718559364239513376190580331938323739895791648429804489417000105677817248741446184689828512402512984453866089594767267742663452532505964888865617589849683809416805726974349474427978691740833753326962760114744967093652541808999389773346317294473742439510326811300031080582618145727L
captcha = s.recv(1024)
print "[+] captcha", repr(captcha)

i = 0
while True:
    sol = captcha + str(i) + '\n'
    if hashlib.sha1(sol).digest().endswith('\xFF\xFF\xFF'):
        break
    i += 1

s.send(sol)

sleep(0.1)

secret = "1"

while True:
    candidate = int(secret, 2)
    print "[+] Candidate", candidate
    to_send = pow(4, gmpy.invert(candidate, p-1), p)
    start_time = time()
    s.sendall(str(int(to_send)) + "\n")
    print repr(s.recv(1024))
    end_time = time()
    if end_time - start_time > 1:
        secret += '1'
    else:
        secret += '0'
    print end_time - start_time
    print "[+] Secret: ", secret