[CTF Writeup / OSINT] IrisCTF 2024 - A Harsh Reality of Passwords (after CTF)

A Harsh Reality of Passwords

Recently, Iris's company had a breach. Her password's hash has been exposed. This challenge is focused on understanding Iris as a person.

Hash: $2b$04$DkQOnBXHNLw2cnsmSEdM0uyN3NHLUb9I5IIUF3akpLwoy7dlhgyEC

The flag format is irisctf{plaintextPassword}

Note: Hi everyone, here are hints for the last osint challenge with the password hash.

Focus on Iris and what she finds important!
There are three words (not letters, but words), and a certain amount of numbers following it
There's no leet words, proper capitalization nothing like (ExAmPLE), no special characters as well like -,! etc.

If you find a specific date, do not include the month'a name into your word list. Just use the numbers!!

Hint! : Please, don't spend time looking for database breaches.

부가적인 설명이 무척 많았다. 그만큼 초반엔 게싱이 필요했던 문제.

앞서 풀이한 osint 문제들을 기반으로 돌아가기 때문에 다른 osint 문제를 모두 풀어야 해결할 수 있다. SNS를 통해 알 수 있는 각종 특징들을 wordlist로 제작하고, 이를 기반으로 제공된 hash를 bruteforce로 원문 패스워드를 찾아내면 된다.

처음엔 힌트도 없어서 오래걸렸는데, 힌트가 나온 뒤에는 아래와 같이 공격 코드를 작성했다.

import itertools

word_list = [

'SWANS', 'swans', 'swan', 'iris', 'stein', 'station', 'travel',

'food', 'italy', 'foods', 'travel', 'travling',

'mimosas', 'mimosa', 'tiramisu', 'portofino', 'sunny',

'manhattan', 'swarovski', 'netherland', 'berlin',

'mountain', 'peak', 'hiring'

]

number_list = [

'1996', '04', '27',

'1965', '09' , '9', '4',

'96', '65', '499', '1010', '2024', '24',

'1952', '11', '13'

]

def generator_bruteforce_word(word_list, number_list):

combinations = []

for words in itertools.permutations(word_list, 3):

for num_length in range(1, 4):

for numbers in itertools.permutations(number_list, num_length):

combinations.append(''.join(words) \

+ ''.join(numbers))

combinations.append(''.join([w[0].upper() + w[1:] for w in words]) \

+ ''.join(numbers))

combinations.append(''.join([words[0][0].upper() + words[0][1:]]) + ''.join(words[1:]) \

+ ''.join(numbers))

return combinations

with open('ex.lst', 'w') as f:

lst = generator_bruteforce_word(word_list, number_list)

f.write('\n'.join(lst))

대회 당시 위와 같이 코드를 작성했지만, numberlist에 숫자가 하나 빠져있는 것을 몰랐다. 결국 풀이하지 못했는데, 대회가 끝나고 그 사실을 알게되었다.

알게된 사실을 기반으로 익스코드를 수정해서 돌려봤다.

import itertools

word_list = [

'iris', 'stein',

'italy', 'netherland', 'berlin',

'tiramisu', 'portofino',

'manhattan', 'swarovski',

]

number_list = [

'1996', '1965', '96', '65',

'04', '27', '08', '8', '4',

]

def generator_bruteforce_word(word_list, number_list):

combinations = []

for words in itertools.permutations(word_list, 3):

for num_length in range(1, 4):

for numbers in itertools.permutations(number_list, num_length):

combinations.append(''.join([w[0].upper() + w[1:] for w in words]) \

+ ''.join(numbers))

combinations.append(''.join([words[0][0].upper() + words[0][1:]]) + ''.join(words[1:]) \

+ ''.join(numbers))

return combinations

with open('ex.lst', 'w') as f:

lst = generator_bruteforce_word(word_list, number_list)

print(len(lst))

f.write('\n'.join(lst))

비밀번호는 PortofinoItalyTiramisu0481965 였다.

irisctf{PortofinoItalyTiramisu0481965}