exploit.py

# coding: UTF-8

import requests
import hashlib


def md5(s):
    return hashlib.md5(s).hexdigest()


for i in range(16):
    for c in range(256):
        if i in [0, 1, 2, 3]:
            prefix = "333"
        elif i in [4, 5, 6, 7]:
            prefix = "4444"
        elif i in [8, 9, 10, 11]:
            prefix = '55555'
        else:
            prefix = '666666'

        r = requests.get('http://52.196.144.8:8080/')
        cookies = r.cookies
        salt = r.content.split('md5( "')[1].split('" +')[0]

        x = 0
        while 1:
            if md5(salt + str(x)).startswith(prefix):
                captcha = x
                break
            else:
                x += 1

        data = {
            'line': str(i), 
            'captcha': str(captcha), 
            'guess': chr(c)
        }


        r = requests.post('http://52.196.144.8:8080/', data=data, cookies=cookies)
        if i == 15:
            if 'bad luck' not in r.content:
                print 'byte %02d = %02x' % (i+1, c)
                print r.content
                break
        else:
            if 'good' in r.content:
                print 'byte %02d = %02x' % (i+1, c)
                break