Welcome back, hackers! In this challenge we are getting into some cryptography, and it all turns on a word that fools a lot of people: “cracking” a hash.
It sounds like we are about to reverse some encryption, but that is not what happens here at all. The real trick is far simpler, and in the end it says a lot more about weak passwords than about clever math.
Let’s take a look.
Challenge Overview
- Event: picoCTF 2025
- Challenge Name: hashcrack
- Category: Cryptography
- Difficulty: Easy
Challenge Description
A company stored a secret message on a server which got breached due to the admin using weakly hashed passwords. Can you gain access to the secret stored within the server?
Hint 1: Understanding hashes is very crucial. Read more here.
Hint 2: Can you identify the hash algorithm? Look carefully at the length and structure of each hash identified.
Hint 3: Tried using any hash cracking tools?
Step 1: Connecting to the Server & First Foothold
I connected to the server, and this is what it came back with:
So it hands me a hash and wants the password behind it. My routine for every one of these is the same two moves: identify it, then crack it.
First I need to know which algorithm produced the hash. Rather than guess, I pasted it into an online hash identifier, which recognizes the format and tells me what it is.
The first hash came back as MD5.
Then comes the “cracking”. For this I searched for an MD5 cracker.
I pasted the hash into the online hash cracker, and because the password was weak, it gave me the plaintext straight back:
I sent that to the server:
The password was correct and it immediately threw the next hash at me.
Get SoBatista’s stories in your inbox
Join Medium for free to get updates from this writer.
So, I did the same thing again.
I dropped the second hash into the hash identifier:
And it came back as SHA1.
I pasted the hash into the cracker:
And it gave me back the password.
Then I inserted it into the terminal:
And it gave me back another hash.
So, I did the same. Inserted the hash in the identifier:
It told me this was a SHA256 hash.
Then I pasted the hash into the cracker:
And it gave me back the password.
I took it and pasted it into the terminal:
And it gave me the flag.
Final Thoughts
I like how this challenge quietly makes its own point. Three different algorithms, MD5, SHA1 and SHA256, and it did not matter in the slightest which one the admin had chosen. Every hash fell in seconds, because the passwords behind them were weak and the hashes were unsalted, which is exactly what lets those lookup databases work.
That is the real lesson, and the flag even spells it out for you: use strong hashes and strong passwords. A modern, salted, slow hash (something like bcrypt or argon2) of a long, unique password would not be sitting in any lookup database, and this whole challenge would hit a dead end on the very first step.
Happy hacking, and I’ll see you in the next write-up!
Cheers,
SoBatista
