Лаборатория TJCTF 2016 - torrent [forensics 90]

delimitry
, 1 июня 2016

Help, someone's sharing flags.  

We have a torrent file.

I've extracted information from torrent file.
length = 28
piece length = 2
pieces = 280

Total flag file size is 28 bytes.
14 SHA1 pieces total. Each piece is 20-byte SHA1 hash value.
So we need to find all two-bytes pieces (with flag's parts) to restore full flag.

Final script: 

import hashlib

fn = 'flag_d542574c3e963792fe07321fd262fe28e6f5cf0ea126efe01148dd6890b63a4d.torrent'
with open(fn, 'rb') as f:
    data = f.read()
hashes = data[140:140+280]

two_letters_hashes = {}
for i in xrange(0, 256):
    for j in xrange(0, 256):
        two_letters = chr(i) + chr(j)
        two_letters_hashes[hashlib.sha1(two_letters).digest()] = two_letters

flag = ''
all_hashes = {}
for i in xrange(0, len(hashes) / 20):
    h = hashes[i * 20:i * 20 + 20]
    flag += two_letters_hashes.get(h, '?')
print flag

The flag is: tjctf{pls_2_n0t_fl4g_share}