nn8ed CTF - Pokevault

bruteforce_md5.php

<?php
define('HASH_ALGO', 'md5');
define('PASSWORD_MAX_LENGTH', 8);
 
$charset = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789';
$str_length = strlen($charset);
$salt = 'some long string ... blah blah blah';
 
function check($payload)
{
    $salt = "some long string ... blah blah blah";
    #echo "Testing: " . $payload . "\n";
    $hash = md5(md5($payload.$salt));
    $pre = "0e";
 
    if (substr($hash, 0, 2) === $pre) {
        if (is_numeric($hash)) {
          exit("Collision found: $payload - $hash\n");
        }
      }
 
}
 
function recurse($width, $position, $base_string)
{
        global $charset, $str_length;
 
        for ($i = 0; $i < $str_length; ++$i) {
                if ($position  < $width - 1) {
                        recurse($width, $position + 1, $base_string . $charset[$i]);
                }
                check($base_string . $charset[$i]);
        }
}
 
for ($i = 1; $i < PASSWORD_MAX_LENGTH + 1; ++$i) {
        echo "Checking passwords with length: $i\n";
        recurse($i, 0, '');
}