Free.fr is playing with us on http://live.free.fr: they added a MD5 checksum on the side of the space shuffle.
It seems that the checksum value changed twice already, so I built a little script that will fetch the page in an infinite loop looking for a new value.
#!/usr/bin/python
from httplib2 import Http
from re import compile
from time import sleep
URL = "http://live.free.fr"
USER_AGENT = "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:7.0.1) Gecko/20100101 Firefox/7.0.12011-10-16 20:23:00"
REGEX = "^[\s]*.*([0-9a-f])[|\\\\].*$"
def fetch():
h = Http()
response, content = h.request(URL, headers = { 'User-Agent' : USER_AGENT })
return content
def parse(content, regex):
lines = content.split('\n')
ret = ""
for line in lines:
occurences = regex.findall(line)
ret += "".join(occurences)
return ret
if __name__ == "__main__":
latest_hash = ""
regex = compile(REGEX)
while 1:
current_page = fetch()
current_hash = parse(current_page, regex)
if (current_hash != "") and (current_hash != latest_hash):
print "New hash value!"
print current_hash
latest_hash = current_hash
sleep(60)
EDIT:
We are still trying to crack the first hash. We chosen to generate all dates matching the XX/XX/XXXX format and then use some rainbow tables. Any other idea ?
We are now really close to breaking the hash. Our hashing machines are running for 3 complete hours, and we can say the hash is at least 13 characters long.
Stay tuned!
If you wanna retrieve the md5 hash, here is the script (not from us, I found it on gist.github.com):
#!/bin/bash
# troll: If you don't have bash, go get a real OS.
curl -s "http://md5.noisette.ch/md5.php?hash=$(curl -s http://live.free.fr | gunzip | tail -n 36 | head -n 32 | grep '[a-f0-9]' -o | xargs echo -n | sed 's/ //g')" | grep '<string>' | sed 's/^.*\[CDATA\[\(.*\)\]\].*$/\1/'