PW Crack 4 Beginner picoMini 2022 Solution

Description

1. Step 1Read the script structure

   Observation

   The description mentions a list of 100 candidate passwords and a stored MD5 hash. Understanding how level4.py is structured comes first, so you know where the loop logic needs to go.

   Open level4.py. There's a list of 100 candidate passwords and a target hash. The script checks one password at a time - modify it to loop through all of them.

   Learn more

   Scaling from 7 to 100 candidates makes manual testing impractical - at 100 entries, you might still manage it manually, but the pattern clearly demands automation. This is a deliberate pedagogical progression: each pw-crack level increases the candidate pool until manual approaches are clearly infeasible, pushing you toward writing code.

   Understanding the script's structure before modifying it is essential. Locate:

   • Where the candidate list is defined
   • Where the stored hash is defined
   • Where the password is compared to the hash
   • Where the decryption function is called with the correct password

   This structural reading skill - understanding how code flows before changing it - is called code comprehension and is fundamental to both software development and security analysis. Never modify code you do not understand.

2. Step 2Modify the script to loop through all candidates

   Observation

   The script already holds every variable it needs, pw_list, correct_pw_hash, and user_pw, but only checks one password. Adding a for loop over all 100 candidates, hashing each and setting user_pw on a match, is the whole change.

   Open level4.py in a text editor. Add a for loop that iterates over the candidate list (pw_list), hashes each entry with MD5, and when the hash matches the stored hash sets user_pw to that entry and breaks. Then run the script and enter anything at the prompt - the loop will have already found the correct password and set it.

   Learn more

   The key insight is to modify the existing script rather than writing a separate one. The script already has all the variables needed: pw_list (the 100 candidates), correct_pw_hash (the target), and user_pw / user_pw_hash (what gets passed to the decryption function). Add the loop before the password prompt so it pre-fills user_pw with the correct entry.

   The loop to add looks like:

   for pw in pw_list:
       if hash_pw(pw) == correct_pw_hash:
           user_pw = pw
           user_pw_hash = hash_pw(pw)
           break

   After running the modified script, you can type anything at the password prompt because the loop has already determined the correct password. The decryption proceeds with the pre-filled value and prints the flag.

   In real-world password auditing, this same loop logic is the core of tools like John the Ripper and hashcat. The difference is that those tools add GPU acceleration, rule-based mutations, and support for hundreds of hash algorithms. The fundamental algorithm is unchanged.

3. Step 3Run the modified script

   Observation

   Once the loop pre-fills user_pw with the matching candidate, the XOR decryption in level4.py runs on its own. So executing the modified script produces the flag.

   With the correct password found, the XOR decryption function unlocks and prints the flag.

   python

   python3 level4.py

   Copied!

   Expected output

   picoCTF{...}

   What didn't work first

   Tried: Running the original unmodified level4.py and guessing passwords manually from the list

   With 100 candidates there is no prompt that lets you iterate: the script checks one hardcoded entry, or waits for a single input and exits. Without the loop pre-filling user_pw, the hash comparison always fails and the decryption never runs, so you get a wrong-password message whatever you type.

   Tried: Using hashcat or john to crack the stored MD5 hash directly instead of modifying the script

   These tools crack hashes against large external wordlists, not the 100-entry pw_list embedded in level4.py. Even if hashcat recovers the plaintext, the flag comes from the script's XOR decryption function, which needs user_pw set correctly at runtime. Cracking the hash offline never runs that function, so you still have no flag.

   Learn more

   The XOR decryption used in these pw-crack challenges is a simple symmetric cipher: the flag bytes are XORed with a key derived from the password. XOR has the property that applying it twice with the same key returns the original value - (A XOR K) XOR K = A - making encryption and decryption the same operation.

   While XOR is not secure on its own for real encryption (it is trivially breakable with known-plaintext attacks), it appears frequently in CTF challenges and in obfuscated malware as a lightweight way to obscure data. Recognizing XOR-based encoding and knowing how to reverse it is a valuable skill for reverse engineering challenges.

   The progression from pw-crack-1 through pw-crack-5 mirrors the real evolution of password security practices: plaintext storage, light obfuscation, small hash lookups, larger hash lookups, and finally full dictionary attacks. Each level requires a slightly more sophisticated approach.

Flag

Testing 100 MD5 hashes takes milliseconds - the same loop logic scales to millions of entries for real dictionary attacks.