Salt Doesn't Save Weak Passwords
A leaked password table uses a home-made salted SHA-256 format. Replay a small wordlist against it and find the admin's password.
Statement
The leak
A small internal tool was breached and its password table, shadow.txt, ended up in your inbox. The developers knew passwords must be salted, so every account has its own random salt and nobody can use a ready-made rainbow table. The trouble is that people still pick passwords from a very short list of favourites. wordlist.txt is that list (106 candidates).
Entry format
Each line is user:$imb1$<salt>$<digest>:
<salt>is 8 lowercase hex characters, written in the line itself.<digest>is the lowercase hex SHA-256 of the text<salt>:<password>, that is the salt, a colon, then the password, all as UTF-8 text.
A made-up entry to test your code against:
demo:$imb1$a1b2c3d4$78ea1c9cb9370892c90770ba32e672a11ae51a041f25913996292e0e9c78edec
Its password is hello, which is not on the real list. Check your hashing on it first: salt a1b2c3d4 and hello must reproduce that digest.
Your task
Recover the password of the account named admin. Every password in the table appears in wordlist.txt, spelled exactly as listed (case and punctuation matter).
The flag
The flag is IMB{, then the first 16 hex characters of the SHA-256 of the admin password alone (no salt), then }.
Hint on tooling: Python's hashlib.sha256(...).hexdigest() is all you need, and the whole attack is a ten-line loop.
Flag format: IMB{...}
Files
Public puzzle material. Download it or read it right here.
The leaked table: one salted SHA-256 entry per account.
admin:$imb1$a3f24563$e06488d035467667e61215006aca7daad8dca680b26639cbb26d5a9af44085c1 mira:$imb1$cec0f476$92494400a89db8178854171dc4a4bedbe6037877f97a396455d02d972fde550e omar:$imb1$1fd1b8db$cc2af96e442a16d84942dd8791b466281d1de8851dd060478728b00f96b21f2b lina:$imb1$d9941cdb$99b91733118cc80ce207234697c60093ccc4e291b4efc02f3f5d8e6e6ee49a0b backup:$imb1$fbec8686$7e80ce1e9a3e42abe63516a6a580c076bfecb4d524e7a5dd4af5da46d94d0065
106 candidate passwords, one per line.
Summer2024 summer charlie tigger banana planet nutella kitten 123456 superman cookie lemon28 ashley Temp#123 pancake shadow abc12345 Admin@123 winter rocket iloveyou jaguar hello123 zebra123 password Autumn#2023 Changeme1 Baseball1 coffee Qwerty!23 victory batman qwerty123 pepper Harley123 passw0rd Gandalf7 thunder Arsenal14 jordan dragon Test1234 P@ssw0rd Liverpool9 Matrix01 ranger monkey Welcome2024 flower wizard hunter quality Chelsea1 lovely cheese Sunshine1 Hunter42 magic donald master ninja Winter2024! falcon guitar whatever bailey yellow welcome1 michael Backup#2024 hockey samurai Football! Company1 golden silver Pass1234 admin123 Monkey123 Letmein! Spring2025! trustno1 unicorn soccer Mustang1 Frodo123 oreo123 Passw0rd! rainbow princess letmein orange sunshine Maverick freedom starwars Barcelona10 football1 Trustno1! Dragon99 purple mango99 Secret99 pirate killer dolphin
Hints
Stuck? Hints are optional, and each one lowers the points you earn for solving this challenge.
- Hint 1Costs 8 points
- Hint 2Costs 12 points
Reveal the previous hint first
- Hint 3Costs 15 points
Reveal the previous hint first
Lessons that teach this
Stuck on the ideas rather than the puzzle? These lessons cover what you need.