1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
| """
CBC Padding Oracle Demo
Author: hosch3n
Reference: https://hosch3n.github.io/2021/08/10/PaddingOracle%E6%94%BB%E5%87%BB/
Padding Oracle Attack POC(CBC-MODE)
Author: axis([email protected])
http://hi.baidu.com/aullik5
2011.9
This program is based on Juliano Rizzo and Thai Duong's talk on
Practical Padding Oracle Attack.(http://netifera.com/research/)
For Education Purpose Only!!!
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program. If not, see <http://www.gnu.org/licenses/>.
"""
from Crypto.Cipher import AES, ARC2, Blowfish, CAST, DES, DES3
# from base64 import b64encode
def padding_pkcs(plaintext, block_size):
# Calculate Padding Byte
# The Byte Value is Length
padding_byte = block_size - len(plaintext) % block_size
# Make Padding
for _ in range(padding_byte):
plaintext.append(padding_byte)
return plaintext
def cbc_encrypt(plaintext, IV, SMKEY, CIPHER):
# String to ByteArray
plaintext = bytearray(plaintext, "utf-8")
# SMKEY Length
key_len = len(SMKEY)
if CIPHER == "AES":
# AES SMKEY Length must be 16/24/32
# AES-128 / AES-192 / AES-256
if key_len != 16 and key_len != 24 and key_len != 32:
return False
cipher_object = AES.new(SMKEY, AES.MODE_CBC, IV)
elif CIPHER == "ARC2":
cipher_object = ARC2.new(SMKEY, ARC2.MODE_CBC, IV)
elif CIPHER == "Blowfish":
cipher_object = Blowfish.new(SMKEY, Blowfish.MODE_CBC, IV)
elif CIPHER == "CAST":
cipher_object = CAST.new(SMKEY, CAST.MODE_CBC, IV)
elif CIPHER == "DES" and key_len == 8:
cipher_object = DES.new(SMKEY, DES.MODE_CBC, IV)
elif CIPHER == "3DES" and key_len == 16:
cipher_object = DES3.new(SMKEY, DES3.MODE_CBC, IV)
else:
return False
# Make Padding
plaintext = padding_pkcs(plaintext, len(IV))
return cipher_object.encrypt(plaintext)
def cbc_decrypt(cipher_bytes, IV, SMKEY, CIPHER):
if (len(cipher_bytes) % 8 != 0) or (len(IV) % 8 != 0):
print("[-] cipher_bytes length != IV length")
return False
if CIPHER == "AES":
cipher_object = AES.new(SMKEY, AES.MODE_CBC, IV)
elif CIPHER == "ARC2":
cipher_object = ARC2.new(SMKEY, ARC2.MODE_CBC, IV)
elif CIPHER == "Blowfish":
cipher_object = Blowfish.new(SMKEY, Blowfish.MODE_CBC, IV)
elif CIPHER == "CAST":
cipher_object = CAST.new(SMKEY, CAST.MODE_CBC, IV)
elif CIPHER == "DES":
cipher_object = DES.new(SMKEY, DES.MODE_CBC, IV)
elif CIPHER == "3DES":
cipher_object = DES3.new(SMKEY, DES3.MODE_CBC, IV)
else:
return False
return cipher_object.decrypt(cipher_bytes)
def split_block(any_bytes, block_size=8):
any_len = len(any_bytes)
if any_len % block_size != 0:
return False
# Split any_bytes by block_size
return [any_bytes[offset:offset+block_size] for offset in range(0, any_len, block_size)]
def set_iv(block_iv_list, block_intermediary_list, padding_byte):
block_iv_list_len = len(block_iv_list)
for i in range(0, block_iv_list_len):
block_iv_list[i] = chr(ord(block_intermediary_list[i]) ^ padding_byte)
return block_iv_list
def check_pkcs(plain_bytes, padding_byte):
if len(plain_bytes) % 8 != 0:
return False
# Exact Block Number
points = 0
# Calculate Points
for i in range(1, padding_byte+1):
if plain_bytes[-i] == padding_byte:
points += 1
if points == padding_byte:
return True
else:
return False
def oracle_block(cipher_bytes, block_size, next_iv, SMKEY, CIPHER):
block_dict = {}
block_plaintext = ""
block_intermediary_list = []
block_iv_list = []
# Construct Padding Bytes
for padding_byte in range(1, block_size+1):
tmp_iv_list = []
block_iv_list = set_iv(block_iv_list, block_intermediary_list, padding_byte)
block_iv_list_len = len(block_iv_list)
# Initialize IV
for _ in range(0, block_size - padding_byte):
tmp_iv_list.append("\x00")
tmp_iv_list.append("\x00")
tmp_iv_list_len = len(tmp_iv_list)
# Brute Force
for iv_ascii in range(0, 256):
# Edit item by list
try_iv_list = tmp_iv_list
try_iv_list[tmp_iv_list_len-1] = chr(iv_ascii)
# list to string
try_iv_str = "".join(try_iv_list)
# Reverse Append
for i in range(0, block_iv_list_len):
try_iv_str += block_iv_list[block_iv_list_len-1-i]
# Trigger Decrypt[Rewrite]
plain_bytes = cbc_decrypt(cipher_bytes, try_iv_str.encode("latin1"), SMKEY, CIPHER)
# Check Error[Rewrite]
flag = check_pkcs(plain_bytes, padding_byte)
if flag == False:
continue
# Get the Silver Bullet
# Dynamic Array append O(1)
block_iv_list.append(chr(iv_ascii))
block_intermediary_list.append(chr(iv_ascii ^ padding_byte))
break
# Revert block_intermediary and block_plaintext
block_intermediary_list_len = len(block_intermediary_list)
block_dict["intermediary"] = "".join(block_intermediary_list[::-1])
if next_iv != "":
for i in range(0, block_intermediary_list_len):
block_plaintext += chr(next_iv[i] ^ ord(block_intermediary_list[block_intermediary_list_len-1-i]))
block_dict["plaintext"] = block_plaintext
return block_dict
def oracle_decrypt(cipher_bytes, block_size, IV, SMKEY, CIPHER):
next_iv = IV
# Split cipher_bytes by block_size
cipher_blocks = split_block(cipher_bytes, block_size)
if cipher_blocks == False:
print("[-] Split Error!")
return False
result_dict = {}
result_dict["intermediary"] = ""
result_dict["plaintext"] = ""
# Attack block by block
for cipher_block in cipher_blocks:
# Get This Block Intermediary and Plaintext
block_dict = oracle_block(cipher_block, block_size, next_iv, SMKEY, CIPHER)
# Add Block Result
result_dict["intermediary"] += block_dict["intermediary"]
result_dict["plaintext"] += block_dict["plaintext"]
# Set IV to next cipher_block
next_iv = cipher_block
return result_dict
def str_xor(x, y):
x_len = len(x)
y_len = len(y)
if x_len != y_len:
print("[-] str_xor Length Error!")
return False
# type(bytearray[i]) is int
z = ""
for i in range(0, x_len):
z += chr(ord(x[i]) ^ y[i])
return z
def oracle_encrypt(WPSTRING, cipher_bytes, block_size, SMKEY, CIPHER):
# String to ByteArray
plaintext = bytearray(WPSTRING, "utf-8")
# Make Padding
plaintext = padding_pkcs(plaintext, block_size)
# Split plaintext by block_size and Reverse
plaintext_blocks = split_block(plaintext, block_size)
plaintext_blocks.reverse()
# Split cipher_bytes by block_size
cipher_blocks = split_block(cipher_bytes, block_size)
cipher_blocks_num = len(cipher_blocks)
# Get the Last One Block
payload = cipher_blocks[-1]
prev_block_bytes = cipher_blocks[-1]
for plaintext_block in plaintext_blocks:
# Get the block_intermediary
block_dict = oracle_block(prev_block_bytes, block_size, "", SMKEY, CIPHER)
# Get the Cipher Block
prev_block_bytes = str_xor(block_dict["intermediary"], plaintext_block).encode("latin1")
payload = prev_block_bytes + payload
return payload
def main():
# Origin Plaintext
OPSTRING = "abcdefghabcdefghxxxxxx"
# Want Plaintext
WPSTRING = "aaaaaaaaaaaaaaaa\r\n\tzzz"
CIPHER = "AES"
# CIPHER = "ARC2"
# CIPHER = "Blowfish"
# CIPHER = "CAST"
# CIPHER = "DES"
# CIPHER = "3DES"
# Intermediary Value
if CIPHER == "AES":
IV = b"1234567812345678"
else:
IV = b"12345678"
# Symmetric Key
if CIPHER != "DES":
SMKEY = b"~!@#$%^&*()_+`-="
else:
SMKEY = b"~!@#$%^&"
# AES Per-Block Size is 16
if CIPHER == "AES":
block_size = 16
else:
block_size = 8
# IV must same as block_size
if len(IV) != block_size:
return False
# CBC Encrypt
cipher_bytes = cbc_encrypt(OPSTRING, IV, SMKEY, CIPHER)
if cipher_bytes == False:
print("[-] Encrypt Error!")
return False
# Padding Oracle Decrypt
result_dict = oracle_decrypt(cipher_bytes, block_size, IV, SMKEY, CIPHER)
if result_dict == False:
print("[-] Attack Error!")
return False
print(result_dict)
# Configuring Payload in Local
payload = oracle_encrypt(WPSTRING, cipher_bytes, block_size, SMKEY, CIPHER)
print(payload)
# CBC Decrypt
# plain_bytes = cbc_decrypt(cipher_bytes, IV, SMKEY, CIPHER)
plain_bytes = cbc_decrypt(payload[block_size:], payload[:block_size], SMKEY, CIPHER)
print(plain_bytes)
if __name__ == "__main__":
main()
|