Web(CTF)中的密码学 (一)

#!/usr/bin/env python
import sys
import json
from Crypto.Cipher import AES
from Crypto import Random

def get_padding(rawstr):
    remainder = len(rawstr) % 16
    if remainder != 0:
        return '\x00' * (16 - remainder)
    return ''

def aes_encrypt(key, plaintext):
    plaintext += get_padding(plaintext)
    aes = AES.new(key, AES.MODE_ECB)
    cipher_text = aes.encrypt(plaintext).encode('hex')
    return cipher_text

def generate_hello(key, name, flag):
    message = "Connection for mission: {}, your mission's flag is: {}".format(name, flag)
    return aes_encrypt(key, message)

def get_input():
    return raw_input()

def print_output(message):
    print(message)
    sys.stdout.flush()

def handle():
    print_output("Please enter your Agent ID to secure communications:")
    agentid = get_input().rstrip()
    rnd = Random.new()
    session_key = rnd.read(16)

    flag = 'DDCTF{87fa2cd38a4259c29ab1af39995be81a}'
    print_output(generate_hello(session_key, agentid, flag))
    while True:
        print_output("Please send some messages to be encrypted, 'quit' to exit:")
        msg = get_input().rstrip()
        if msg == 'quit':
            print_output("Bye!")
            break
        enc = aes_encrypt(session_key, msg)
        print_output(enc)

if __name__ == "__main__":
    handle()

Please enter your Agent ID to secure communications:
1234567
52a3087da8ebda8b98f678fa325d9fd863aaa9be12cdf29458df5c6db7aea412bf47046149c94a03cb349cc0b763add7577c545aa291371626c900fbf85f56afc37de41da81528ca079872d23e1f5a6d96f78a38752d916fdf1884ebe043aadb

Please enter your Agent ID to secure communications:
12345678
02a44fd6291280a9703292edf03a20dfea822c8827a5b895873e61bb82f712c9abb72b8b4a2f36c153f69fda78fbe7e44adaf422a247e8b5ff81e28a4aff34cd72a00a16cbf5570ce8f25c0b6aa660068d60debaf3d066dc16ea2d1374d2745dfd58238da81647c87a75d13d8e33d3ce

+    16 Bytes    +    16 Bytes    +    16 Bytes    +    16 Bytes    +    16 Bytes    +    16 Bytes    +    16 Bytes    +
+----------------+----------------+----------------+----------------+----------------+----------------+
|Connection for m|ission: 1234567,| your mission's |flag is: DDCTF{.|................|...............}|
+----------------+----------------+----------------+----------------+----------------+----------------+----------------+
|Connection for m|ission: 12345678|, your mission's| flag is: DDCTF{|................|................|}               |
+----------------+----------------+----------------+----------------+----------------+----------------+----------------+

Please enter your Agent ID to secure communications:
123456789012345678901234567890123456789012345
441a90ff809cd834ac01ebc517e53cd9124a19778e5251394356bcc4bfc530c129db288c9fb7367737fc5de6061b9efb04cdfd6bce90d8e551e416fca04439f6d7d0209205014da5d4071b862e80fe9f5633dee51fef20b9c3c3a68236ac2fa3617e7dfee627248729c38b12557d8f80c3290b0f8ea9049823ad05d5030dd6cd78a96f92646e400ca6221f5a41af8aaf
Please send some messages to be encrypted, 'quit' to exit:
Connection for mission: 123456789012345678901234567890123456789012345, your mission's flag is: D
441a90ff809cd834ac01ebc517e53cd9124a19778e5251394356bcc4bfc530c129db288c9fb7367737fc5de6061b9efb04cdfd6bce90d8e551e416fca04439f6d7d0209205014da5d4071b862e80fe9f5633dee51fef20b9c3c3a68236ac2fa3

+    16 Bytes    +    16 Bytes    +    16 Bytes    +    16 Bytes    +    16 Bytes    +    16 Bytes    +    16 Bytes    +    16 Bytes    +    16 Bytes    +
+----------------+----------------+----------------+----------------+----------------+----------------+----------------+----------------+----------------+
|Connection for m|ission: 12345678|9012345678901234|5678901234567890|123456, your mis|sion's flag is: |DDCTF{..........|................|......}         |
+----------------+----------------+----------------+----------------+----------------+----------------+----------------+----------------+----------------+
|Connection for m|ission: 12345678|9012345678901234|5678901234567890|12345, your miss|ion's flag is: D|DCTF{...........|................|.....}          |
+----------------+----------------+----------------+----------------+----------------+----------------+----------------+----------------+----------------+

# coding: utf-8
import requests
import sys

# 预设置
apiUrl = 'http://c1n0h7ku1yw24husxkxxgn3pcbqu56zj.ddctf2019.com:5023/api/gen_token'
method = 'GET'
headers = {}
cookies = {}

length = 16  # bytes
checkStr = 'decrypt err~'
originCipher = 'UGFkT3JhY2xlOml2L2NiY8O+7uQmXKFqNVUuI9c7VBe42FqRvernmQhsxyPnvxaF'.decode('base64')
originPlain = '{"id":100,"roleAdmin":false}'
targetPlain = '{"id":100,"roleAdmin":true}'


# 自动 padding
def auto_padding(plain):
    return plain + (chr(length - len(plain) % length) * (length - len(plain) % length))


# 自动预处理
iv = originCipher[:length]
originPlain = auto_padding(originPlain)
targetPlain = auto_padding(targetPlain)
lenGroup = len(originCipher) / length
assert (lenGroup == len(originPlain) / length + 1 == len(targetPlain) / length + 1)


def output(msg):
    sys.stdout.write('\r' + '[' + str((1-float(msg.count(chr(0)))/length)*100) + '%]\t' + msg.encode('hex'))
    sys.stdout.flush()


# 字符串亦或
def xor_string(a, b):
    return ''.join([chr(ord(x) ^ ord(y)) for (x, y) in zip(a, b)])


#  需自行修改此函数 data 所在位置以及判断条件
def request_api(data):
    if method == 'GET':
        # rep = requests.get(apiUrl, params=data, headers=headers, cookies=cookies)
        rep = requests.get(apiUrl, headers=headers, cookies={'token': data.encode('base64')[:-1]})
    else:
        rep = requests.post(apiUrl, data=data, headers=headers, cookies=cookies)
    if checkStr not in rep.content:
        return True
    return False


# 推测中间值
# pre -> None 反向推密文；not None 正向推明文
def padding_oracle(cipher, CN, pre=None):
    tmpValue = ''
    pre = originCipher[:(CN-lenGroup)*length] if pre is None else pre
    for i in xrange(1, length+1):
        for v in xrange(0x1, 0x100):
            tmp = chr(0)*(length-i) + chr(v) + xor_string(tmpValue, chr(i)*(i-1))
            payload = pre + tmp + cipher
            output(payload)
            if request_api(data=payload):
                tmpValue = chr(i ^ v) + tmpValue
                print i, v
                break
    return tmpValue


def get_index(groupIndex):
    return groupIndex*length


def general_cipher():
    last_index = get_index(lenGroup-1)
    last_cipher = originCipher[last_index:]
    tmp = xor_string(originCipher[get_index(lenGroup-2):last_index], originPlain[get_index(lenGroup-2):])
    pre_cipher = xor_string(tmp, targetPlain[get_index(lenGroup-2):])
    new_cipher = pre_cipher + last_cipher

    if lenGroup >= 3:
        for i in reversed(xrange(0, lenGroup-2)):
            tmp = padding_oracle(pre_cipher, i)
            pre_cipher = xor_string(tmp, targetPlain[get_index(i):get_index(i+1)])
            new_cipher = pre_cipher + new_cipher
    return new_cipher


# 解密可以是并行的，这里为简便使用单线程
def crack_cipher():
    plain_text = ''
    for i in xrange(1, lenGroup):
        cipher = originCipher[get_index(i):get_index(i+1)]
        tmp = padding_oracle(cipher, i, originCipher[:get_index(i-1)])
        plain_text += xor_string(tmp, originCipher[get_index(i-1):get_index(i)])
    return plain_text


if __name__ == '__main__':
    try:
        # 正向解密
        # new_string = crack_cipher()
        # 反向加密
        new_string = general_cipher().encode('base64')[:-1]
        print '\n [+] New Cipher -> ' + new_string
    except KeyboardInterrupt:
        exit(0)