Rating: 5.0
## Pt. 2
In this part, we still have the same email file from the first part but need to find out what the redacted word inside the email was. I informed myself and after 15 minutes of researching I found out that the `DKIM-Signature:` Header is important, specifically the body hash `bh=`. We need to correctly canonicalize and hash the body to be able to bruteforce the lost word. I sent myself another email and tried calculating it myself. It was hard to find out the correct way...
### Calculating the correct hash
```py
from Crypto.Hash import SHA256
data = open("data").read()
from base64 import b64encode
def hash_body(body: str) -> str:
canonicalized_body = body.strip().encode().replace(b"\n",b"\r\n") + b"\r\n"
bh = b64encode(SHA256.new(canonicalized_body).digest())
return bh.decode()
print(hash_body(data))
```
With:
```
--0000000000002b27b205dcc6879c
Content-Type: text/plain; charset="UTF-8"
af
--0000000000002b27b205dcc6879c
Content-Type: text/html; charset="UTF-8"
<div dir="ltr">af</div>
--0000000000002b27b205dcc6879c--
```
Inside the data file.
### The solution
Now that we are able to correctly calculate the body hash, we can finally brute force the lost word!
I imported the body into my program and wrote a little script that could find the correct word from the original body hash and the rest of the email.
Lets just hope that the word is not too long and only contains letters...
```
--000000000000c0332a05dcab29d2
Content-Type: text/plain; charset="UTF-8"
Hey, crushed kiwi I hate this loop of college, and I need your help. Can
you meet me at lost immediately?
--000000000000c0332a05dcab29d2
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
<div dir=3D"ltr"><span>Hey, crushed kiwi I hate this loop of colle=
ge, and I need your help. Can you meet me at=C2=A0</span>lost<span>=C2=A0immediately?</span>
</div>
--000000000000c0332a05dcab29d2--
```
```py
import sys
from Crypto.Hash import SHA256
target = "5AqaoLYxMopB/cECaLwYX3ZR0XSAPW38Fwpy5WHeO2M=" # Body hash from the eml file (bh=)
bod = open("data").read()
from base64 import b64encode
def hash_body(body: str) -> str:
canonicalized_body = body.strip().encode().replace(b"\n",b"\r\n") + b"\r\n"
bh = b64encode(SHA256.new(canonicalized_body).digest())
return bh.decode()
print(hash_body(bod))
a = list("abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ")
for i in a:
for ii in a:
for iii in a:
for iiii in a:
e = i+ii+iii+iiii
print(e)
if hash_body(bod.replace("lost", e)) == target:
print("Heureka!")
sys.exit()
```
That worked!
The lost word was `abay`.
