### Chalenge PromptWe are doing an project for a school competition in which we need to use a Raspberry Pi to make an IOT prototype. We received SD cards from the professor, and because we lost ours we asked another group to give us a copy of their card, I know it’s been modified because the original hash doesn’t match. Could you please investigate and tell me if everything is ok? Here is some parts of the file system:
FLAG FORMAT: KLCTF{flag}### SolutionWe are given a compressed raspberry pi file system.
Notice the suspicous file "back".```backdoor_pi/bin]$ lsback          chvt           fgconsole   lesspipe     nc              rnano            umountbash          con2fbmap      fgrep       ln           nc.openbsd      run-parts        unamebunzip2       cp             findmnt     loadkeys     nc.traditional  sed              uncompress```
Running strings on the binary shows us we found the correct file.```backdoor_pi/bin]$ strings backFlask(request(abortc{}:{}t@34c05015de48ef10309963543b4a347b5d3d20bbe2ed462cf226b1cc8fff222es<Congr4ts, you found the b@ckd00r. The fl4g is simply : {}:{}i```
The binary is a compiled python 2.7 program.```backdoor_pi/bin]$ file backback: python 2.7 byte-compiled```
We use uncompyle2 to decompile the binary.```backdoor_pi/bin]$ uncompyle2 back # 2017.10.12 09:27:33 CDT# Embedded file name: back.pyimport sysimport osimport timefrom flask import Flaskfrom flask import requestfrom flask import abortimport hashlib
def check_creds(user, pincode):    if len(pincode) <= 8 and pincode.isdigit():        val = '{}:{}'.format(user, pincode)        key = hashlib.sha256(val).hexdigest()        if key == '34c05015de48ef10309963543b4a347b5d3d20bbe2ed462cf226b1cc8fff222e':            return 'Congr4ts, you found the b@ckd00r. The fl4g is simply : {}:{}'.format(user, pincode)    return abort(404)
app = Flask(__name__)
@app.route('/')def hello():    return '<h1>HOME</h1>'
@app.route('/backdoor')def backdoor():    user = request.args.get('user')    pincode = request.args.get('pincode')    return check_creds(user, pincode)
if __name__ == '__main__':    app.run(threaded=True, host='0.0.0.0', port=3333)# okay decompyling back # decompiled 1 files: 1 okay, 0 failed, 0 verify failed# 2017.10.12 09:27:33 CDT
```
Lets take the check creds function and make it executable on our system.I converted val to utf-8 before hashing so it will run with python3. Since python3 has a big performance boost with iterators, this will bebeneficial in later steps.```pyimport sysimport osimport timeimport hashlib
def check_creds(user, pincode):    if len(pincode) <= 8 and pincode.isdigit():        val = '{}:{}'.format(user, pincode)        key = hashlib.sha256(val.encode('utf-8').hexdigest()        if key == '34c05015de48ef10309963543b4a347b5d3d20bbe2ed462cf226b1cc8fff222e':            return 'Congr4ts, you found the b@ckd00r. The fl4g is simply : {}:{}'.format(user, pincode)    return 'false'
```The flag is the user and pincode that match the hash. The easiest way to find the user is cat /var/passwd.```$ cat backdoor_pi/etc/passwdroot:x:0:0:root:/root:/bin/bashdaemon:x:1:1:daemon:/usr/sbin:/bin/shbin:x:2:2:bin:/bin:/bin/shsys:x:3:3:sys:/dev:/bin/shsync:x:4:65534:sync:/bin:/bin/syncgames:x:5:60:games:/usr/games:/bin/shman:x:6:12:man:/var/cache/man:/bin/shlp:x:7:7:lp:/var/spool/lpd:/bin/shmail:x:8:8:mail:/var/mail:/bin/shnews:x:9:9:news:/var/spool/news:/bin/shuucp:x:10:10:uucp:/var/spool/uucp:/bin/shproxy:x:13:13:proxy:/bin:/bin/shwww-data:x:33:33:www-data:/var/www:/bin/shbackup:x:34:34:backup:/var/backups:/bin/shlist:x:38:38:Mailing List Manager:/var/list:/bin/shirc:x:39:39:ircd:/var/run/ircd:/bin/shgnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/bin/shnobody:x:65534:65534:nobody:/nonexistent:/bin/shlibuuid:x:100:101::/var/lib/libuuid:/bin/shpi:x:1000:1000:,,,:/home/pi:/bin/bashsshd:x:101:65534::/var/run/sshd:/usr/sbin/nologinntp:x:102:104::/home/ntp:/bin/falsestatd:x:103:65534::/var/lib/nfs:/bin/falsemessagebus:x:104:106::/var/run/dbus:/bin/falseusbmux:x:105:46:usbmux daemon,,,:/home/usbmux:/bin/falselightdm:x:106:109:Light Display Manager:/var/lib/lightdm:/bin/falseavahi:x:107:110:Avahi mDNS daemon,,,:/var/run/avahi-daemon:/bin/falseb4ckd00r_us3r:x:1001:1004::/home/b4ckd00r_us3r:/bin/bash```
The most likley user is b4ckd00r so lets try that. We know from check_creds the pin is <= 8 char long so lets just brute force it.
```pyuser = 'b4ckd00r_us3r'c = 0for pincode in range(99999999):	if((pincode%1000000) == 0):		c += 1		print(str(c) + '% done')	if(check_creds(user, str(pincode)) != 'false'):		print( check_creds(user, str(pincode)) )		quit()print('nope...')```
output:```backdoor_pi]$ python3 crack.py 1% done2% done3% done4% done5% done6% done7% done8% done9% done10% done11% done12% done13% doneCongr4ts, you found the b@ckd00r. The fl4g is simply : b4ckd00r_us3r:12171337```
