> For the complete documentation index, see [llms.txt](https://nickbhe.gitbook.io/shikata-ga-nai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://nickbhe.gitbook.io/shikata-ga-nai/pwnable.kr/02-col.md).

# 02 - col

## The Challenge

Daddy told me about cool MD5 hash collision today.

I wanna do something like that too!

ssh <col@pwnable.kr> -p2222 (pw:guest)

## The Solution

![](/files/-MFLdbobXidL5tY13t9b)

The program expects one argument with a length of 20.

![](/files/-MFMFhgEmqEQV66F3KfZ)

* The 20 byte string input is converted to 5 integers (4 byte int \* 5 = 20).
* The sum of these numbers should equal to 0x21DD09EC.

![](/files/-MFMGBVlKhlZxma98wAI)

Concatenate 0x01010101 four times and 0xE805D91D \[notice the input is little endianed] to gain access.