ACECTF

import hashlib
import string
import time
import itertools
import re
import multiprocessing as mp
from tqdm import tqdm

def md5_hash(input_str):
    """Calculate MD5 hash of a string"""
    return hashlib.md5(input_str.encode('utf-8')).hexdigest()

def is_magic_hash(hash_str):
    """Check if a hash starts with '0e' or multiple zeros followed by 'e', then all digits"""
    return bool(re.match(r'^0+e\d+$', hash_str))

def find_magic_hashes(prefix, max_length=5, num_required=2):
    """Find strings that produce magic hashes when appended to the prefix"""
    results = []
    total_attempts = 0
    charset = string.ascii_letters + string.digits
    start_time = time.time()

    print(f"Searching for magic hashes with prefix '{prefix}'...")

    # Process characters in batches for each length
    for length in range(1, max_length + 1):
        if len(results) >= num_required:
            break

        print(f"Trying length {length}...")

        # Generate all possible combinations for this length
        for chars in tqdm(itertools.product(charset, repeat=length),
                          total=len(charset)**length,
                          desc=f"Length {length}",
                          unit="comb"):
            suffix = ''.join(chars)
            test_str = prefix + suffix
            hash_result = md5_hash(test_str)
            total_attempts += 1

            if is_magic_hash(hash_result):
                results.append((test_str, hash_result))
                print(f"\nFound magic hash #{len(results)}: {test_str} -> {hash_result}")

                if len(results) >= num_required:
                    break

        # Show progress after each length
        elapsed = time.time() - start_time
        rate = total_attempts / elapsed if elapsed > 0 else 0
        print(f"Progress: {total_attempts:,} attempts in {elapsed:.2f} seconds ({rate:.1f} hashes/sec)")

    # Show summary
    elapsed = time.time() - start_time
    print(f"\nSearch completed!")
    print(f"Total attempts: {total_attempts:,}")
    print(f"Total time: {elapsed:.2f} seconds")
    print(f"Average speed: {total_attempts / elapsed:.1f} hashes/sec")

    if results:
        print("\nFound magic hashes:")
        for i, (input_str, hash_str) in enumerate(results, 1):
            print(f"{i}. Input: {input_str}")
            print(f"   Hash: {hash_str}")

        if len(results) >= 2:
            print("\nDemonstrating PHP type juggling with these hashes:")
            print("In PHP, these would be considered equal with loose comparison (==)")
            print(f"'{results[0][1]}' == '{results[1][1]}' would return true")
    else:
        print("\nNo magic hashes found. Try increasing max_length.")

    return results

def process_chunk(args):
    """Process a chunk of combinations for parallel execution"""
    prefix, charset, length, chunk_start, chunk_size = args
    results = []
    total = 0

    # Get the specific combinations for this chunk
    combinations = itertools.islice(itertools.product(charset, repeat=length),
                                   chunk_start, chunk_start + chunk_size)

    for chars in combinations:
        suffix = ''.join(chars)
        test_str = prefix + suffix
        hash_result = md5_hash(test_str)
        total += 1

        if is_magic_hash(hash_result):
            results.append((test_str, hash_result))

    return results, total

def find_magic_hashes_parallel(prefix, max_length=5, num_required=2, num_processes=None):
    """Find magic hashes using parallel processing"""
    if num_processes is None:
        num_processes = mp.cpu_count()

    results = []
    total_attempts = 0
    charset = string.ascii_letters + string.digits
    start_time = time.time()

    print(f"Searching for magic hashes with prefix '{prefix}' using {num_processes} processes...")

    for length in range(1, max_length + 1):
        if len(results) >= num_required:
            break

        print(f"Trying length {length}...")

        # Calculate total combinations for this length
        total_combinations = len(charset) ** length

        # Divide work into chunks
        chunk_size = max(1000, total_combinations // (num_processes * 10))
        num_chunks = (total_combinations + chunk_size - 1) // chunk_size

        # Prepare arguments for each chunk
        args_list = [
            (prefix, charset, length, i * chunk_size, min(chunk_size, total_combinations - i * chunk_size))
            for i in range(num_chunks)
        ]

        # Process chunks in parallel
        with mp.Pool(processes=num_processes) as pool:
            with tqdm(total=total_combinations, desc=f"Length {length}", unit="comb") as pbar:
                for chunk_results, chunk_attempts in pool.imap_unordered(process_chunk, args_list):
                    total_attempts += chunk_attempts
                    pbar.update(chunk_attempts)

                    if chunk_results:
                        results.extend(chunk_results)
                        print(f"\nFound magic hash #{len(results)}: {chunk_results[0][0]} -> {chunk_results[0][1]}")

                    if len(results) >= num_required:
                        pool.terminate()
                        break

        # Show progress after each length
        elapsed = time.time() - start_time
        rate = total_attempts / elapsed if elapsed > 0 else 0
        print(f"Progress: {total_attempts:,} attempts in {elapsed:.2f} seconds ({rate:.1f} hashes/sec)")

        if len(results) >= num_required:
            break

    # Show summary
    elapsed = time.time() - start_time
    print(f"\nSearch completed!")
    print(f"Total attempts: {total_attempts:,}")
    print(f"Total time: {elapsed:.2f} seconds")
    print(f"Average speed: {total_attempts / elapsed:.1f} hashes/sec")

    if results:
        print("\nFound magic hashes:")
        for i, (input_str, hash_str) in enumerate(results, 1):
            print(f"{i}. Input: {input_str}")
            print(f"   Hash: {hash_str}")

        if len(results) >= 2:
            print("\nDemonstrating PHP type juggling with these hashes:")
            print("In PHP, these would be considered equal with loose comparison (==)")
            print(f"'{results[0][1]}' == '{results[1][1]}' would return true")
    else:
        print("\nNo magic hashes found. Try increasing max_length.")

    return results

if __name__ == "__main__":
    prefix = "ACECTF"
    # Choose between single-threaded or parallel version
    # For shorter combinations, single-threaded might be faster due to overhead
    # For longer combinations, parallel will be significantly faster

    # Uncomment only one of these:
    # results = find_magic_hashes(prefix, max_length=5, num_required=2)
    results = find_magic_hashes_parallel(prefix, max_length=5, num_required=2)

import binascii

# Known plaintext and ciphertexts
plaintext = b"This is just a test message and can totally be ignored."
test_ciphertext = "d71f4a2fd1f9362c21ad33c7735251d0a671185a1b90ecba27713d350611eb8179ec67ca7052aa8bad60466b83041e6c02dbfee738c2a3"
flag_ciphertext = "c234661fa5d63e627bef28823d052e95f65d59491580edfa1927364a5017be9445fa39986859a3"

# Convert to bytes
test_cipher_bytes = bytes.fromhex(test_ciphertext)
flag_cipher_bytes = bytes.fromhex(flag_ciphertext)

# Extract keystream: keystream = ciphertext XOR plaintext
keystream = b""
for i in range(len(plaintext)):
    keystream += bytes([test_cipher_bytes[i] ^ plaintext[i]])

# Decrypt flag using keystream
flag = b""
for i in range(len(flag_cipher_bytes)):
    flag += bytes([flag_cipher_bytes[i] ^ keystream[i]])

print("Recovered flag:", flag.decode())