from pwn import *
from pymd5 import md5

def int_to_hex_litte_endian(n):
    return str(n.to_bytes(8, byteorder='little').hex())

io=remote('how-are-you-mister.chall.srdnlen.it', 443, ssl=True)

def sign_message(message):
    io.recvuntil(b"> ")
    io.sendline(b'1')

    io.recvuntil(b"Insert your name (hex format)? ")
    io.sendline(message.hex())
    return bytearray.fromhex(io.recvline().decode().removesuffix('\n'))


hash=sign_message(b"")
print("hash:", hash)

h = md5(state=hash, count=512)
print("hash without admin: ", h.hexdigest())

h.update(b'admin')
new_hash_with_admin=h.hexdigest()
print("new_hash_with_admin:", new_hash_with_admin)

for i in range(20,1,-1):
    print("lunghezza corrente: ", i)

    #calcolo new_name_to_send
    new_name_to_send = b'\x80' + b'\x00' * 7 + b'\x00'*(48-i)+ bytes.fromhex(int_to_hex_litte_endian(8*i)) +b'admin'

    print("new_name_to_send: ", new_name_to_send)
    print("new hash with admin:", new_hash_with_admin)

    #invio new_name_to_send
    io.recvuntil(b"> ")
    io.sendline(b'2')

    io.recvuntil(b"Insert your name (hex format)? ")
    io.sendline(new_name_to_send)


    #invio relative_signature
    io.recvuntil(b"Insert relative signature ")
    io.sendline(new_hash_with_admin)

    #print what I received

io.close()