-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy pathSolve.java
More file actions
89 lines (61 loc) · 1.93 KB
/
Solve.java
File metadata and controls
89 lines (61 loc) · 1.93 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
// h15h4m
import java.io.*;
public class Solve {
public static void main( String args[] ) {
if (args.length == 0)
{
System.out.println("Usage: java Solve evil.py");
System.exit(1);
}
File f = new File(args[0]);
long originalfileSize = f.length() - 1;
// EDIT THIS
long targetCksum = 2805500100L;
long currentCksum = 0L;
byte [] originalfileBytes = new byte[ (int)originalfileSize - 1 ];
byte [] evilfileBytes = new byte[ (int) originalfileSize + 4 ];
try
{
FileInputStream readingHandler = new FileInputStream(args[0]);
readingHandler.read(originalfileBytes);
readingHandler.close();
}
catch (IOException e) { System.out.println(e); }
System.out.println(args[0] + " was read!");
System.out.println("Copying the original file byte array to an evil one.......");
int i;
for (i = 0 ; i < originalfileBytes.length ; i++)
{
evilfileBytes[i] = originalfileBytes[i];
}
int evilfileSize = evilfileBytes.length;
System.out.println("Brute forcing........");
// from integers starting value till the ending value.
for (i = -2147483648 ; i < 2147483647 ; i++ )
{
// brute forcing the last 4 bytes until we find the correct combo.
evilfileBytes[evilfileSize - 4] = (byte) (i >>> 24 & 0xff);
evilfileBytes[evilfileSize - 3] = (byte) (i >>> 16 & 0xff);
evilfileBytes[evilfileSize - 2] = (byte) (i >>> 8 & 0xff);
evilfileBytes[evilfileSize - 1] = (byte) (i >>> 0 & 0xff);
Cksum cksumHandler = new Cksum();
cksumHandler.update(evilfileBytes);
currentCksum = cksumHandler.getValue();
if (currentCksum == targetCksum)
{
try
{
FileOutputStream writingHandler = new FileOutputStream("pwn.py");
writingHandler.write(evilfileBytes);
writingHandler.close();
}
catch (IOException e)
{
System.out.println(e);
}
System.out.println("Success! Check pwn.py!\n");
break;
}
}
}
}