warmup

知識點：代碼審計，AES加密

附件：

156129204983f46d45981f08ab9fa977a24d3c70ec.zip

步驟：

1.打開審計一下源碼，發現是 AES 加密。

#!/usr/bin/python
# -*- coding: utf-8 -*-

from Crypto.Cipher import AES
from Crypto.Util.strxor import strxor
from Crypto.Random import get_random_bytes
from FLAG import flag

class MAC:
    def __init__(self):
        self.key = get_random_bytes(16)
        self.iv = get_random_bytes(16)

    def pad(self, msg):
        pad_length = 16 - len(msg) % 16
        return msg + chr(pad_length) * pad_length

    def unpad(self, msg):
        return msg[:-ord(msg[-1])]

    def code(self, msg):
        res = chr(0)*16
        for i in range(len(msg)/16):
            res = strxor(msg[i*16:(i+1)*16], res)
        aes = AES.new(self.key, AES.MODE_CBC, self.iv)
        return aes.encrypt(res).encode('hex')

    def identity(self, msg, code):
        if self.code(msg) == code:
            msg = self.unpad(msg)
            if msg == 'please send me your flag':
                print 'remote: ok, here is your flag:%s' % flag
            else:
                print 'remote: I got it'
        else:
            print 'remote: hacker!'

if __name__ == '__main__':
    mac = MAC()
    message = 'see you at three o\'clock tomorrow'
    print 'you seem to have intercepted something:{\%s:\%s}' %(mac.pad(message).encode('hex'), mac.code(mac.pad(message)))
    print 'so send your message:'
    msg = raw_input()
    print 'and your code:'
    code = raw_input()
    mac.identity(msg.decode('hex'), code)
    exit()

很有意思的是這里

def code(self, msg):
    res = chr(0)*16
    for i in range(len(msg)/16):
        res = strxor(msg[i*16:(i+1)*16], res)
    aes = AES.new(self.key, AES.MODE_CBC, self.iv)
    return aes.encrypt(res).encode('hex')

對明文進行異或摘要到 16 位之后，才進行加密的。

那么既然我們已知一組明文和密文，而且可以推算出其異或摘要之后獲得的密鑰，那么只要讓我們傳上去的明文摘要之后和前一組明文一致，那么就可以用前一組的密文來通過驗證了。

2.對上面這個腳本進行改造，得到如下 POC 生成器，

#!/usr/bin/python
# -*- coding: utf-8 -*-

from Crypto.Cipher import AES
from Crypto.Util.strxor import strxor
from Crypto.Random import get_random_bytes
flag = "fuck"

class MAC:
    def __init__(self):
        self.key = get_random_bytes(16)
        self.iv = get_random_bytes(16)

    def pad(self, msg):
        pad_length = 16 - len(msg) % 16
        return msg + chr(pad_length) * pad_length

    def unpad(self, msg):
        return msg[:-ord(msg[-1])]

    def code(self, msg):
        res = chr(0)*16
        # 最終目的 res 相等 24054d4c1a0f19444e0f4016080f1805
        for i in range(len(msg)/16):
            res = strxor(msg[i*16:(i+1)*16], res)
        aes = AES.new(self.key, AES.MODE_CBC, self.iv)
        print(res.encode('hex'))
        return aes.encrypt(res).encode('hex')

    def identity(self, msg, code):
        if self.code(msg) == code:
            msg = self.unpad(msg)
            if msg == 'please send me your flag':
                print 'remote: ok, here is your flag:%s' % flag
            else:
                print 'remote: I got it'
        else:
            print 'remote: hacker!'

if __name__ == '__main__':
    mac = MAC()
    message = 'see you at three o\'clock tomorrow'
    print 'you seem to have intercepted something:{\%s:\%s}' %(mac.pad(message).encode('hex'), mac.code(mac.pad(message)))
    print 'so send your message:'
    msg = 'please send me your flag'
    print(msg)

    msg_o = msg + chr(63 - len(msg)) * (63 - len(msg))
    res = chr(0)*16
    for i in range(len(msg_o)/16 - 1):
        res = strxor(msg_o[i*16:(i+1)*16], res)

    msg_o = msg_o[:32] + strxor("24054d4c1a0f19444e0f4016080f1805".decode('hex'), res) + msg_o[48:]
    print(msg_o.encode('hex'))

    print 'and your code:'
    code = raw_input()
    mac.identity(msg.decode('hex'), code)
    exit()

解釋一下，可以看到 code 那里我加了個 print ，輸出第一組明文的十六位摘要和第二組明文的十六位摘要。

而后對第二組明文進行二次摘要，對其加上一段十六位文本，讓其異或之后與第一段明文的十六位摘要相等。再加上 1~15 個 pad，最后處理時利用 pad 保留下我們需要的文本 ‘please send me your flag’。

【前 32 位不用動】【32~48 位 拿來和前面異或，使得和前面已知密文的明文摘要一致】【48~（49~63） 位 拿來 padding，不是 64 位就是為了讓這一段不參與前面的摘要計算，保證最后一位可控】

運行，得到這段明文。

3.連接靶機，將明文和靶機返回的第一組明文提交，得到 flag。

Flag 到手~