mirror of
https://github.com/bvanroll/odiseectf.git
synced 2025-08-29 03:42:41 +00:00
movement of a bunch of shit
This commit is contained in:
Binary file not shown.
Binary file not shown.
|
Before Width: | Height: | Size: 150 KiB |
@@ -1,112 +0,0 @@
|
||||
import sys
|
||||
import os
|
||||
import getpass
|
||||
import itertools
|
||||
from Crypto.Cipher import AES
|
||||
from Crypto.Hash import MD5, SHA256
|
||||
|
||||
|
||||
# generates key based on password
|
||||
def generatekey(pw):
|
||||
password = pw # getpass.getpass('Password for decryption: ')
|
||||
#print(password)
|
||||
h = MD5.new()
|
||||
h.update(password.encode())
|
||||
#h.update(password)
|
||||
return h.digest()
|
||||
|
||||
def generatePass():
|
||||
temp = []
|
||||
alpha = ["a", "z", "e", "r", "t", "y", "u", "i", "o", "p"]
|
||||
for i in itertools.product(alpha, repeat=6):
|
||||
temp.append(generatekey("".join(i)))
|
||||
return temp
|
||||
|
||||
# calculates and return hash for message
|
||||
def calculatehash(message):
|
||||
h = SHA256.new()
|
||||
h.update(message)
|
||||
# use hexdigest to prevent problems with control characters
|
||||
# e.g. \r in charcter 5, appends 4, then overwrites beginning of message with rest of digest
|
||||
return h.hexdigest()
|
||||
|
||||
|
||||
# check integrity and return cleartext or error message
|
||||
def checkintegrity(decryptedcontent):
|
||||
return calculatehash(decryptedcontent[0:-64]).encode() == decryptedcontent[-64:]
|
||||
|
||||
|
||||
# encrypts content in AES CBC mode
|
||||
def decrypt_AES_CBC(inputfilename, encryptedContent):
|
||||
# create encrypted filename, keep extension
|
||||
outputfilename = inputfilename[0:inputfilename.find('.', len(inputfilename) - 5)] \
|
||||
+ '_decrypted' + inputfilename[inputfilename.find('.'):len(inputfilename)]
|
||||
|
||||
i = 0
|
||||
keys = generatePass()
|
||||
print(len(keys))
|
||||
for key in keys:
|
||||
decipher = AES.new(key, AES.MODE_CBC)
|
||||
decryptedcontent = decipher.decrypt(encryptedContent)
|
||||
ivlength = 16
|
||||
# remove iv and padding
|
||||
decryptedcontent = decryptedcontent[ivlength:-decryptedcontent[-1]]
|
||||
# check Integrity and retain cleartext
|
||||
if checkintegrity(decryptedcontent):
|
||||
cleartext = decryptedcontent[0:-64]
|
||||
outputfile = open(outputfilename, 'wb')
|
||||
outputfile.write(cleartext)
|
||||
outputfile.close
|
||||
outputfilename = outputfilename+"EXTRA"
|
||||
else:
|
||||
cleartext = 'Integrity check error'.encode()
|
||||
print("error:{}".format(i))
|
||||
i = i+1
|
||||
print("done?")
|
||||
|
||||
return
|
||||
|
||||
#
|
||||
#
|
||||
# key = generatekey()
|
||||
# decipher = AES.new(key, AES.MODE_CBC)
|
||||
# decryptedcontent = decipher.decrypt(encryptedContent)
|
||||
#
|
||||
# ivlength = 16
|
||||
# # remove iv and padding
|
||||
# decryptedcontent = decryptedcontent[ivlength:-decryptedcontent[-1]]
|
||||
#
|
||||
# # check Integrity and retain cleartext
|
||||
# if checkintegrity(decryptedcontent):
|
||||
# cleartext = decryptedcontent[0:-64]
|
||||
# else:
|
||||
# cleartext = 'Integrity check error'.encode()
|
||||
#
|
||||
# # useful only for decrypted text files
|
||||
# # print(cleartext)
|
||||
#
|
||||
# # write to file
|
||||
# outputfile = open(outputfilename, 'wb')
|
||||
# outputfile.write(cleartext)
|
||||
# outputfile.close()
|
||||
|
||||
|
||||
for i in sys.argv[1:]:
|
||||
|
||||
inputfilename = i
|
||||
|
||||
print('decrypting ' + inputfilename)
|
||||
|
||||
try:
|
||||
inputfile = open(inputfilename, 'rb')
|
||||
except IOError:
|
||||
print("File " + inputfilename + " not found, working directory: " + os.getcwd())
|
||||
continue
|
||||
else:
|
||||
# if file opened, read content into variable
|
||||
content = inputfile.read()
|
||||
inputfile.close()
|
||||
|
||||
# apply symmetric encryption
|
||||
decrypt_AES_CBC(inputfilename, content)
|
||||
# encrypt_AES_ECB(inputfilename,content)
|
||||
Binary file not shown.
@@ -1,4 +0,0 @@
|
||||
Het png bestand bij deze opgave is symmetrisch versleuteld met AES in CBC mode. Voor integriteitscontrole werd het originele bericht aangevuld met een SHA256 hash alvorens dit geheel versleuteld werd.
|
||||
Het script voor decryptie is beschikbaar. Hieruit kan je afleiden dat het vertrekt van een paswoord. Van het paswoord is geweten dat het bestaat uit zes verschillende letters van de bovenste rij van een azerty-toetsenbord (azertyuiop). Het paswoord wordt dankzij een hash functie omgezet in een 128 bit sleutel, die dan gebruikt wordt voor AES.
|
||||
Je moet het script niet gebruiken of uitvoeren, maar als je dat toch wil doen is de pycryptodome library nodig (en niet pycrypto). Voor het testen van het decryptiemechanisme is er ook een bestand toegevoegd dat versleuteld werd met een gekende sleutel (<28>azerty<74>).
|
||||
Brute force is onmogelijk met een 128 bit sleutel.
|
||||
File diff suppressed because one or more lines are too long
File diff suppressed because one or more lines are too long
@@ -1,9 +0,0 @@
|
||||
ia
|
||||
b
|
||||
cat is cat
|
||||
euhm
|
||||
test
|
||||
test
|
||||
vier
|
||||
achtentwintig
|
||||
|
||||
@@ -1,8 +0,0 @@
|
||||
11/06/18 16:14:41 v1.34.3 @ arch-laptop,
|
||||
11/06/18 16:14:41 v1.34.3 @ arch-laptop, ****************************
|
||||
11/06/18 16:14:41 v1.34.3 @ arch-laptop, Starting factorization of 65537
|
||||
11/06/18 16:14:41 v1.34.3 @ arch-laptop, using pretesting plan: normal
|
||||
11/06/18 16:14:41 v1.34.3 @ arch-laptop, no tune info: using qs/gnfs crossover of 95 digits
|
||||
11/06/18 16:14:41 v1.34.3 @ arch-laptop, ****************************
|
||||
11/06/18 16:14:41 v1.34.3 @ arch-laptop, prp5 = 65537
|
||||
11/06/18 16:14:41 v1.34.3 @ arch-laptop, Total factoring time = 0.0002 seconds
|
||||
@@ -1 +0,0 @@
|
||||
k<EFBFBD>YRE<EFBFBD><EFBFBD>0_<EFBFBD>?<3F>߮o<DFAE>c<EFBFBD>f<EFBFBD><66><EFBFBD><EFBFBD> <20><>1<EFBFBD><31><EFBFBD>i@
|
||||
@@ -1,15 +0,0 @@
|
||||
-----BEGIN RSA PRIVATE KEY-----
|
||||
MIICXAIBAAKBgQDER6zsHqfA29V26kjajWUdmttverRAfdp159LuvsN7Zfk6pqPl
|
||||
4JpSaCsLviCLvQ5CzHYXsHhscSDlZ5VbzGzTN1XKzChhSm3ioixtsMaHqk8n+t7X
|
||||
wuWvBm1SoJBohO1GKP84eNhDVa/vntwirj8xM+kyuyVnYMG5wK5eDOoFQwIDAQAB
|
||||
AoGADrPDuygMrsCIu9COxngi49XOrAoH6HDE5WIJBcMaR2r7AS6sRjLNvHB7EPUb
|
||||
4Pu3Tr+b9OhODOloamaY5HhqikIMcK5b+d5a9chWl7LPT+4RjQ1qCcO8Az1rnuD3
|
||||
GPV8Pa2X6Nc/KGZNF51fuSsYPtpMMNaRVsUyhVfF1Bm2FoECQQDufZPntbhAMftv
|
||||
vmpkhrbVPzf9Sv5QAZQMCLvr9XuopvhwkIdqTqTIRi0+o21r+Y4gUuE8KQ/8SrOp
|
||||
PDcSkzBBAkEA0rDAa4gvnptu35juAAG4QAwSdoGxM5f4EViG0lTXPYW1WXAuakSX
|
||||
pRAr5r+kRIuFAqLubOF3ily2ZHYR7wNUgwJBAJWakuh8Vtt2PyrmwOjUlOaKZL3w
|
||||
iD157/vokrG+6VZvf1NlZnzqXnX/h6xOanqcLmracs4BWDTES5Vy3304dcECQB6L
|
||||
S0oLk0O+KuO1iwNrPGfkmCSgBq2BIZB6Mgl6DT45DSJrNf9n9EgUwRiRveHGDEFm
|
||||
l4QnZ6oiaLrFtzHcXLsCQF/1m2eZSCKqRKxYViZwtCG6YltvxrWYEv+5QEeH8TW5
|
||||
l9u4XTLA6SkVUKacIdy4saTTiNJ91Z+hChn0yL7wwkU=
|
||||
-----END RSA PRIVATE KEY-----
|
||||
@@ -1,4 +0,0 @@
|
||||
-----BEGIN PUBLIC KEY-----
|
||||
MDwwDQYJKoZIhvcNAQEBBQADKwAwKAIhANYKESYl+3ksLXaSDMyCvpvfV7VSnBCB
|
||||
HOx/vnFrI7yjAgMBAAE=
|
||||
-----END PUBLIC KEY-----
|
||||
@@ -1,3 +0,0 @@
|
||||
-----BEGIN RSA PUBLIC KEY-----
|
||||
MCgCIQDWChEmJft5LC12kgzMgr6b31e1UpwQgRzsf75xayO8owIDAQAB
|
||||
-----END RSA PUBLIC KEY-----
|
||||
@@ -1,48 +0,0 @@
|
||||
11/06/18 16:14:32 v1.34.3 @ arch-laptop, System/Build Info:
|
||||
Using GMP-ECM 7.0.4, Powered by GMP 6.1.2
|
||||
cached 78498 primes. pmax = 999983
|
||||
detected Intel(R) Core(TM) i5-5200U CPU @ 2.20GHz
|
||||
detected L1 = 32768 bytes, L2 = 3145728 bytes, CL = 64 bytes
|
||||
measured cpu frequency ~= 2194.884840
|
||||
using 20 random witnesses for Rabin-Miller PRP checks
|
||||
|
||||
11/06/18 16:14:32 v1.34.3 @ arch-laptop, New random seeds: 1627275890, 3413126897
|
||||
|
||||
11/06/18 16:14:32 v1.34.3 @ arch-laptop, Processing expression: factor(<0x10001>)
|
||||
|
||||
11/06/18 16:14:41 v1.34.3 @ arch-laptop, System/Build Info:
|
||||
Using GMP-ECM 7.0.4, Powered by GMP 6.1.2
|
||||
cached 78498 primes. pmax = 999983
|
||||
detected Intel(R) Core(TM) i5-5200U CPU @ 2.20GHz
|
||||
detected L1 = 32768 bytes, L2 = 3145728 bytes, CL = 64 bytes
|
||||
measured cpu frequency ~= 2194.898370
|
||||
using 20 random witnesses for Rabin-Miller PRP checks
|
||||
|
||||
11/06/18 16:14:41 v1.34.3 @ arch-laptop, New random seeds: 1051584989, 882356502
|
||||
|
||||
11/06/18 16:14:41 v1.34.3 @ arch-laptop, Processing expression: factor(0x10001)
|
||||
|
||||
11/06/18 16:24:16 v1.34.3 @ arch-laptop, System/Build Info:
|
||||
Using GMP-ECM 7.0.4, Powered by GMP 6.1.2
|
||||
cached 78498 primes. pmax = 999983
|
||||
detected Intel(R) Core(TM) i5-5200U CPU @ 2.20GHz
|
||||
detected L1 = 32768 bytes, L2 = 3145728 bytes, CL = 64 bytes
|
||||
measured cpu frequency ~= 2194.923100
|
||||
using 20 random witnesses for Rabin-Miller PRP checks
|
||||
|
||||
11/06/18 16:24:16 v1.34.3 @ arch-laptop, New random seeds: 4224413532, 2143373325
|
||||
|
||||
11/06/18 16:24:16 v1.34.3 @ arch-laptop, Processing expression: factor(00d60a112625fb792c2d76920ccc82be9bdf57b5529c10811cec7fbe716b23bca3)
|
||||
|
||||
11/06/18 16:24:36 v1.34.3 @ arch-laptop, System/Build Info:
|
||||
Using GMP-ECM 7.0.4, Powered by GMP 6.1.2
|
||||
cached 78498 primes. pmax = 999983
|
||||
detected Intel(R) Core(TM) i5-5200U CPU @ 2.20GHz
|
||||
detected L1 = 32768 bytes, L2 = 3145728 bytes, CL = 64 bytes
|
||||
measured cpu frequency ~= 2194.915970
|
||||
using 20 random witnesses for Rabin-Miller PRP checks
|
||||
|
||||
11/06/18 16:24:36 v1.34.3 @ arch-laptop, New random seeds: 2525150347, 3657121282
|
||||
|
||||
11/06/18 16:24:36 v1.34.3 @ arch-laptop, Processing expression: factor(00d60a112625fb792c2d76920ccc82be9bdf57b5529c10811cec7fbe716b23bca3)
|
||||
|
||||
@@ -1,2 +0,0 @@
|
||||
In een kort tekstdocument zit een vlag. Het tekstdocument werd versleuteld met RSA gebruik makend van een publieke sleutel.
|
||||
De publieke sleutel krijg je erbij in de vorm van een pem-bestand.
|
||||
@@ -1,80 +0,0 @@
|
||||
49ad630ee4cfbe679d4c1812585ecfd987560069
|
||||
286fb8f1a5d4dc144ca2b78e6461d90e87127cff
|
||||
4798dd76602345d6364542ae1e827b50073776f5
|
||||
a0a6696f377f04c24ae204820ca94d1f7b217a37
|
||||
1e8ee052ddc4357c9f9bcb213bb6019d4ab9a51a
|
||||
d7456801f116e2fdb94c362caaaa2da59823c87f
|
||||
2e343e2791d957d9e54905ca60b1070cf3afb2e1
|
||||
5c1e3a1c872cb6433dc5262e9230478dbac4572d
|
||||
9ed58a327da5f54cec39488e92f841ee50e74b34
|
||||
f5fe9ac0340f1328f295e93ee2f9fb5ae343c85d
|
||||
1b3f5b532c0f1376850e63162951b9f6b187bd8d
|
||||
0bf2bd9d6cc4f2a8dd1342a7639ed79134884257
|
||||
e18ae9d6f91823176296851d6cd8ddf4a6a7d2ee
|
||||
a7c463d3506da56b4a365bad2ddbaff6c4c698bb
|
||||
292721de93d4d5a6716ec489bf9872a2d7906aec
|
||||
31105f7f1c02a3ca70e886254b089ded985555ab
|
||||
6cb97f774b7f01e0920e688e95172c421373e0ee
|
||||
f4b50f1365aeb2f4fe5b8fb4df83077f4da910ba
|
||||
a0f11b27c950a40531f26fe36e85f59d9b8b7b54
|
||||
cf2fd0459224df00d518e9d1251692fbf391ffb6
|
||||
1bf6cda873aa3636ecafef0045693d0cc18f2cf0
|
||||
6c5762f08fd700248ec9a9a496a059bdc01b9115
|
||||
d4f05a94f53ec5f68676c3eab053ca11e0748699
|
||||
2fbd98019522481ed9e168aa07bb9d436cbe5c45
|
||||
82bf809f8e4c6c35e78808b9aef7438fc881bb69
|
||||
2382830edeb06335afb4020731590e67f62b608a
|
||||
070c027d1889dbe5ca0cd67627fe2bc40a7cc419
|
||||
06f0cb34f661d6689f9c8f1b77881e46e30e1593
|
||||
b2f1ed8f878c5b1f9f95df804d960aeddd88ef3d
|
||||
6f00a9867733a85b6455f5ec6cd69d9dc542b7fe
|
||||
63d56e380cc0932869e3ddddcfa516ed928263e3
|
||||
b8bb875de5f730d847a5e832d76e4e163d42e8a0
|
||||
d37625d46eced12752bf8f7f73a7ae5bb8800271
|
||||
2e474d2d089cbe5e292e0ceb7dcdcfdee52875dc
|
||||
c19440b5d671b3ac242c03f845a37b8a5a4ad1c2
|
||||
cafdb889e3f42b16a71a10a241be164e63ea5df0
|
||||
a6959809f24f40d7615f20c94d82036dce8583c3
|
||||
0c7a65dde77b2701467780220b70aeab6f96f1f3
|
||||
021a5927eae1f735356808c6c1442133332c48f2
|
||||
3dae67a299994cccb4cbad8602a7207cdc298252
|
||||
8871da33a071a2de3d1122a8212dca4251f53be5
|
||||
ad8dac9ad71d3a76f1d5cec8e87affca8b6f7bcd
|
||||
3e66666292c2e43f3b23471a9d2657b5088b296f
|
||||
92b240308b453b0490fb20ed1c63e580de72aa21
|
||||
969217de3bc9e84cc89c1d67d0787caf20d5f9e8
|
||||
bea5aca542fa09b98c8a3bf0e21c26f25836774d
|
||||
18e53b3ff5e63ca8a0d56b8d38bdc94324a4651c
|
||||
928093ad25300548fc27ca490c82f326d5f9ce72
|
||||
785138504a4dba1a3bce3adb19a7b0ea1211971f
|
||||
34d0667eaced8feaec5610f13e7c22c19bcef4e3
|
||||
363603eace13c7758125a25e0c31605f40c2e23b
|
||||
e76ff0252f4356bc0c0521f1a4e427d77cb90b57
|
||||
2532e98588de789ce9f898e5e2553e055465fb6a
|
||||
662f1b77ebb4a9c360737c800551f94f1789606d
|
||||
72e636b65eea3a6280807996033a9edc10bb9e9b
|
||||
75d6ed741ab970a56bc50d7a21d46285fbe03eb1
|
||||
d740f00dcb9d528c4eef7e8b7b944748b3e694dc
|
||||
50d65ee40561450a6428e487535677017a1f042d
|
||||
337a1ef69455340e7872c2ad2cd3210cb4a80a70
|
||||
ec554728b8b7c6a9a4d4f67dbebb895db414764c
|
||||
68133c9864a86c4dff54236636901a896abfa6f1
|
||||
957ba857016afe81a440488fdcd23b7408c7d445
|
||||
933c7eb1739faff81ababbeea86d7df6044a5421
|
||||
add1a9ee65bb76446386f76e4fcdac22094db33f
|
||||
3cb179a3552d765881d6d6a646e2ba9c352587a7
|
||||
c02e912d81d9870d2bf7e9a9114eca18b41700c0
|
||||
48f2cc03935c331fbe39f597c27ce469d541aaed
|
||||
34d3f6bf05193b12f44bcc547f9ed9164a5a92ab
|
||||
e70b5ebad37c5236b40cb157bd33660a6beed1ae
|
||||
c3fe2b01a4bae84c5d1237daf01a83d23e5d4748
|
||||
ef91a26d2bf810fca53867e93e878f7b6e4c3b78
|
||||
9027f9d6a2bf708b4621c28c3a2d169d7754e018
|
||||
6a89ae5a61aad21ed130871d6b91db71df625180
|
||||
b56770efc24e88294d002dcedf7bf17347689e2c
|
||||
afe3069207beada82457ac0f3c1fc76f5cd622a7
|
||||
dc97ca861f530ad255989c661dd48a141a002bbb
|
||||
3e9e0d430da6769b01eec05c25c1b04e957fb029
|
||||
118d9882264b4f3230a06a58f17aea16eb6d8e25
|
||||
2ae3023d28194c7e713f442e70ce4a6d7ff4568c
|
||||
7868fc2fbe2609f7d0255b0d5128941d489d0d8a
|
||||
@@ -1,2 +0,0 @@
|
||||
Bij de aanval op een organisatie worden een aantal <20>high value targets<74> ge<67>dentificeerd. Blijkt dat ze in 2012 een LinkedIn account hadden. De kans bestaat dat het toen gebruikte paswoord ook voor andere logins gebruikt werd en dat het paswoord niet is aangepast
|
||||
In het meegeleverde bestand staan de hashes van de interessante gebruikers die bij de LinkedIn password leak van 2012 beschikbaar werden. Als je een paswoord kan recupereren, is het bruikbaar als flag.
|
||||
@@ -1,40 +0,0 @@
|
||||
import os
|
||||
import sys
|
||||
|
||||
KEY_SIZE = 10
|
||||
|
||||
|
||||
def expand_key(key, length):
|
||||
return int(length / len(key)) * key + key[0:(length % len(key))]
|
||||
|
||||
|
||||
def xor(s1, s2):
|
||||
assert len(s1) == len(s2)
|
||||
return bytes([(a ^ b) for a, b in zip(s1, s2)])
|
||||
|
||||
|
||||
def main():
|
||||
if len(sys.argv) <= 2:
|
||||
key = os.urandom(KEY_SIZE)
|
||||
|
||||
filename = sys.argv[1]
|
||||
|
||||
f = open(filename,'rb')
|
||||
data = f.read()
|
||||
f.close()
|
||||
|
||||
expanded_key = expand_key(key, len(data))
|
||||
data_encrypted = xor(expanded_key, data)
|
||||
|
||||
print(data_encrypted)
|
||||
|
||||
f = open(filename + ".enc", "wb")
|
||||
f.write(data_encrypted)
|
||||
f.close()
|
||||
|
||||
print("File %s encrypted with key: %s" % (filename, key.hex()))
|
||||
else:
|
||||
print("Usage: %s <filename>" % (sys.argv[0]))
|
||||
|
||||
if __name__ == "__main__":
|
||||
main()
|
||||
@@ -1,57 +0,0 @@
|
||||
import os
|
||||
import sys
|
||||
|
||||
KEY_SIZE = 10
|
||||
|
||||
|
||||
def expand_key(key, length):
|
||||
return int(length / len(key)) * key + key[0:(length % len(key))]
|
||||
|
||||
|
||||
def xor(s1, s2):
|
||||
assert len(s1) == len(s2)
|
||||
return bytes([(a ^ b) for a, b in zip(s1, s2)])
|
||||
|
||||
|
||||
def main():
|
||||
if len(sys.argv) <= 2:
|
||||
key = os.urandom(KEY_SIZE)
|
||||
print(type(key))
|
||||
filename = sys.argv[1]
|
||||
|
||||
f = open(filename,'rb')
|
||||
data = f.read()
|
||||
f.close()
|
||||
#temp = bytes([0x47, 0x49, 0x46, 0x38, 0x39, 0x61, 0xc0, 0x03, 0x80, 0x02])
|
||||
#eerste 10 bytes van voorbeeld afbeelding
|
||||
#temp = bytes([0x49,0x47, 0x38, 0x46, 0x61, 0x39, 0x03, 0xc0, 0x02, 0x80])
|
||||
#en dan krijg je deze bytes list
|
||||
#solution = bytes([0x47, 0x3b, 0x57, 0x2b, 0x07, 0xd0, 0x29, 0xdb, 0x3b, 0x82])
|
||||
#dus blijkbaar was de eerste set van bytes verkerd van volgorde, dus dit is de key die we dan krijgen (met de tweede temp)
|
||||
#07a70ffe4f233ffbf9dd
|
||||
#solution = bytes([0xf7, 0xa3, 0x1b, 0x32, 0xb1, 0x56, 0x94, 0x38, 0x3c, 0x90])
|
||||
#solution = bytes.fromhex("07a70ffe4f233ffbf9dd")
|
||||
#4947 3846 6139 03c0 0280
|
||||
|
||||
#key = bytes("49473846613903c00280")
|
||||
#key = bytes.fromhex("0123456789")
|
||||
#4947 3846 6139 03c0 0280
|
||||
key = bytes(b'\x49\x47\x38\x46\x61\x39\x03\xc0\x02\x80')
|
||||
#key = bytes([0x49, 0x47, 0x38, 0x46, 0x61, 0x39, 0x03, 0xc0, 0x02, 0x80])
|
||||
#key = bytes([0x6e, 0x66, 0x4e, 0x7b, 0x94, 0xae, 0xd2, 0x15, 0xb4, 0xec])
|
||||
key = bytes(b'\x29\x2f\x08\x43\xad\xcf\x12\x16\x34\xee')
|
||||
expanded_key = expand_key(key, len(data))
|
||||
data_encrypted = xor(expanded_key, data)
|
||||
|
||||
print(data_encrypted)
|
||||
|
||||
f = open(filename + ".enc", "wb")
|
||||
f.write(data_encrypted)
|
||||
f.close()
|
||||
|
||||
print("File %s encrypted with key: %s" % (filename, key.hex()))
|
||||
else:
|
||||
print("Usage: %s <filename>" % (sys.argv[0]))
|
||||
|
||||
if __name__ == "__main__":
|
||||
main()
|
||||
@@ -1,86 +0,0 @@
|
||||
import os
|
||||
import sys
|
||||
|
||||
KEY_SIZE = 10
|
||||
|
||||
def xor(s1, s2):
|
||||
assert len(s1) == len(s2)
|
||||
return bytes([(a ^ b) for a, b in zip(s1, s2)])
|
||||
|
||||
def expand_key(key, length):
|
||||
return int(length / len(key)) * key + key[0:(length % len(key))]
|
||||
|
||||
|
||||
|
||||
def main():
|
||||
if len(sys.argv) <= 2:
|
||||
key = os.urandom(KEY_SIZE)
|
||||
|
||||
filename = sys.argv[1]
|
||||
|
||||
f = open(filename,'rb')
|
||||
data = f.read()
|
||||
f.close()
|
||||
|
||||
expanded_key = expand_key("0123456789", len(data))
|
||||
data_encrypted = xor(expanded_key, data)
|
||||
|
||||
print(data_encrypted)
|
||||
|
||||
f = open(filename + ".enc", "wb")
|
||||
f.write(data_encrypted)
|
||||
f.close()
|
||||
|
||||
print("File %s encrypted with key: %s" % (filename, key.hex()))
|
||||
else:
|
||||
print("Usage: %s <filename>" % (sys.argv[0]))
|
||||
|
||||
|
||||
|
||||
'''
|
||||
|
||||
16^10 mogelijkheden, nie plezant dus, mss zoeken naar een andere manier da we iets kunnen vinden.
|
||||
|
||||
wat doet de expand key eigenlijk? dat soort dingen
|
||||
|
||||
'''
|
||||
|
||||
def decrypt():
|
||||
|
||||
filename = "voorbeeld.gif.enc"
|
||||
with open("test.txt", "w") as outfile:
|
||||
for i in range(0,16**10):
|
||||
#print(bin(i).encode('ascii'))
|
||||
#print(bin(i).format('0<16'))
|
||||
#print(bin(i).format(16))
|
||||
#dus hier pak je de binaire versie van je iterator, en zet je die om naar een string, dit zal dus bv voor 1 0b1 geven, daarna wil je natuurlijk dat alle andere nullen erbij staan, anders krijg je geen 10 byte lange string, dus je haalt de 0b eraf en daarna gebruik je format en de string tussen de {} om de plaats links van onze input te vullen met 0
|
||||
temp = '{:0>80}'.format(str(bin(i))[2:]).encode('ascii')
|
||||
outfile.write(str(temp))
|
||||
#print(temp)
|
||||
#print(os.urandom(KEY_SIZE))
|
||||
if i > 10:
|
||||
break
|
||||
data = open(filename,'rb').read()
|
||||
print(expand_key("0123456789", len(data)))
|
||||
return True
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
# main()
|
||||
decrypt()
|
||||
|
||||
|
||||
@@ -1,2 +0,0 @@
|
||||
0000000 4947 3846 6139 03c0 0280
|
||||
000000a
|
||||
@@ -1 +0,0 @@
|
||||
b'00000000000000000000000000000000000000000000000000000000000000000000000000000000'b'00000000000000000000000000000000000000000000000000000000000000000000000000000001'b'00000000000000000000000000000000000000000000000000000000000000000000000000000010'b'00000000000000000000000000000000000000000000000000000000000000000000000000000011'b'00000000000000000000000000000000000000000000000000000000000000000000000000000100'b'00000000000000000000000000000000000000000000000000000000000000000000000000000101'b'00000000000000000000000000000000000000000000000000000000000000000000000000000110'b'00000000000000000000000000000000000000000000000000000000000000000000000000000111'b'00000000000000000000000000000000000000000000000000000000000000000000000000001000'b'00000000000000000000000000000000000000000000000000000000000000000000000000001001'b'00000000000000000000000000000000000000000000000000000000000000000000000000001010'b'00000000000000000000000000000000000000000000000000000000000000000000000000001011'
|
||||
Binary file not shown.
Binary file not shown.
|
Before Width: | Height: | Size: 136 KiB |
127
xor/temp/writeup
127
xor/temp/writeup
@@ -1,127 +0,0 @@
|
||||
|
||||
'''
|
||||
|
||||
16^10 mogelijkheden, nie plezant dus, mss zoeken naar een andere manier da we iets kunnen vinden.
|
||||
|
||||
wat doet de expand key eigenlijk? dat soort dingen
|
||||
|
||||
|
||||
expand key repeat gewoon de key die hij binnen krijgt (de 10 bytes) tot het de lengte heeft van het bestand dat geencrypt moet worden
|
||||
|
||||
nu is de vraag, is er een stuk in een gif dat elke keer hetzelfde is en lang genoeg is dat we zo de key terug kunnen vinden.
|
||||
'''
|
||||
dus, aangezien ons bestand een gif is betekend dit dat het begint met de letters GIF, dus de eerste 3 bytes kunnen ons al een stuk van onze key geven
|
||||
de volgende 3 bytes zijn 2 mogelijkheden 87a of 89a, dit kan ons ook al een voordeel geven, maar dan komen we inde problemen. meeste van de volgende bytes zijn afhankelijk van de afbeelding, daarna komen we in de volgende blok, nvm onze foto is 960 op 640, dit is een grote hulp want dat betekend dat we onze volledige string zullen hebben op 1 byte na: de eerste 3 bytes : GIF gevolgd door de volgende 3 bytes 87a/89a en dan gevolgd door 4 bytes die de grote van de afbeelding tonen,
|
||||
waarvan we weten dat deze 960 op 640 px is
|
||||
|
||||
bij onze voorbeeld foto was dit:
|
||||
4947 3846 6139 03c0 0280 00f7 0000 0000
|
||||
|
||||
0000 0033 6600 0000 0099 cc00 0000 00ff
|
||||
|
||||
002b 2b00 0033 662b
|
||||
|
||||
G I F 8 9 a 300 003 200 002
|
||||
|
||||
na een poging om onze afbeelding een key uit te krijgen kreeg ik deze terug:
|
||||
473b572b07d029db3b82
|
||||
blijkbaar verkeerd erges iets gedaan, dit is misschien de key?
|
||||
f7a31b32b15694383c90
|
||||
|
||||
daarboven op heeft ons voorbeeld dezelfde dimensies? demensies? een van die twee. heeft dezelfde hoeveelheden van breedte en hoogte als onze te cracken gif. het enige dat kan veranderen is de version, dat van 89a naar 87a kan gaan. dit betekend dat we dus de key veel gemakkelijker eruit kunnen halen door te kijken naar de binaire waarden van deze letters en zo een xor uit te voeren om onze key te krijgen. yay
|
||||
|
||||
temp:
|
||||
|
||||
2b00 0099 cc2b 2b00
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
hier is wat info over gifs:
|
||||
{
|
||||
GIF Header
|
||||
Offset Length Contents
|
||||
0 3 bytes "GIF"
|
||||
3 3 bytes "87a" or "89a"
|
||||
6 2 bytes <Logical Screen Width>
|
||||
8 2 bytes <Logical Screen Height>
|
||||
10 1 byte bit 0: Global Color Table Flag (GCTF)
|
||||
bit 1..3: Color Resolution
|
||||
bit 4: Sort Flag to Global Color Table
|
||||
bit 5..7: Size of Global Color Table: 2^(1+n)
|
||||
11 1 byte <Background Color Index>
|
||||
12 1 byte <Pixel Aspect Ratio>
|
||||
13 ? bytes <Global Color Table(0..255 x 3 bytes) if GCTF is one>
|
||||
? bytes <Blocks>
|
||||
1 bytes <Trailer> (0x3b)
|
||||
Image Block
|
||||
Offset Length Contents
|
||||
0 1 byte Image Separator (0x2c)
|
||||
1 2 bytes Image Left Position
|
||||
3 2 bytes Image Top Position
|
||||
5 2 bytes Image Width
|
||||
7 2 bytes Image Height
|
||||
8 1 byte bit 0: Local Color Table Flag (LCTF)
|
||||
bit 1: Interlace Flag
|
||||
bit 2: Sort Flag
|
||||
bit 2..3: Reserved
|
||||
bit 4..7: Size of Local Color Table: 2^(1+n)
|
||||
? bytes Local Color Table(0..255 x 3 bytes) if LCTF is one
|
||||
1 byte LZW Minimum Code Size
|
||||
[ // Blocks
|
||||
1 byte Block Size (s)
|
||||
(s)bytes Image Data
|
||||
]*
|
||||
1 byte Block Terminator(0x00)
|
||||
Graphic Control Extension Block
|
||||
Offset Length Contents
|
||||
0 1 byte Extension Introducer (0x21)
|
||||
1 1 byte Graphic Control Label (0xf9)
|
||||
2 1 byte Block Size (0x04)
|
||||
3 1 byte bit 0..2: Reserved
|
||||
bit 3..5: Disposal Method
|
||||
bit 6: User Input Flag
|
||||
bit 7: Transparent Color Flag
|
||||
4 2 bytes Delay Time (1/100ths of a second)
|
||||
6 1 byte Transparent Color Index
|
||||
7 1 byte Block Terminator(0x00)
|
||||
Comment Extension Block
|
||||
Offset Length Contents
|
||||
0 1 byte Extension Introducer (0x21)
|
||||
1 1 byte Comment Label (0xfe)
|
||||
[
|
||||
1 byte Block Size (s)
|
||||
(s)bytes Comment Data
|
||||
]*
|
||||
1 byte Block Terminator(0x00)
|
||||
Plain Text Extension Block
|
||||
Offset Length Contents
|
||||
0 1 byte Extension Introducer (0x21)
|
||||
1 1 byte Plain Text Label (0x01)
|
||||
2 1 byte Block Size (0x0c)
|
||||
3 2 bytes Text Grid Left Position
|
||||
5 2 bytes Text Grid Top Position
|
||||
7 2 bytes Text Grid Width
|
||||
9 2 bytes Text Grid Height
|
||||
10 1 byte Character Cell Width(
|
||||
11 1 byte Character Cell Height
|
||||
12 1 byte Text Foreground Color Index(
|
||||
13 1 byte Text Background Color Index(
|
||||
[
|
||||
1 byte Block Size (s)
|
||||
(s)bytes Plain Text Data
|
||||
]*
|
||||
1 byte Block Terminator(0x00)
|
||||
Application Extension Block
|
||||
Offset Length Contents
|
||||
0 1 byte Extension Introducer (0x21)
|
||||
1 1 byte Application Label (0xff)
|
||||
2 1 byte Block Size (0x0b)
|
||||
3 8 bytes Application Identifire
|
||||
[
|
||||
1 byte Block Size (s)
|
||||
(s)bytes Application Data
|
||||
]*
|
||||
1 byte Block Terminator(0x00)
|
||||
}
|
||||
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Reference in New Issue
Block a user