HITCON CTF 2016 Quals | Hackpad (Crypto 150)

solver.py

secret = "3ed2e01c1d1248125c67ac637384a22d997d9369c74c82abba4cc3b1bfc65f026c957ff0feef61b161cfe3373c2d9b905639aa3688659566d9acc93bb72080f7e5ebd643808a0e50e1fc3d16246afcf688dfedf02ad4ae84fd92c5c53bbd98f08b21d838a3261874c4ee3ce8fbcb96628d5706499dd985ec0c13573eeee03766f7010a867edfed92c33233b17a9730eb4a82a6db51fa6124bfc48ef99d669e21740d12656f597e691bbcbaa67abe1a09f02afc37140b167533c7536ab2ecd4ed37572fc9154d23aa7d8c92b84b774702632ed2737a569e4dfbe01338fcbb2a77ddd6990ce169bb4f48e1ca96d30eced23b6fe5b875ca6481056848be0fbc26bcbffdfe966da4221103408f459ec1ef12c72068bc1b96df045d3fa12cc2a9dcd162ffdf876b3bc3a3ed2373559bcbe3f470a8c695bf54796bfe471cd34b463e9876212df912deef882b657954d7dada47"
secret = secret.decode("hex")

f = open("value_md5.txt", "r")
# head value_md5.txt
# 00000000000000000000000000000000997d9369c74c82abba4cc3b1bfc65f02,aa85a4e0adbd34c287af2d20da4453c9
# 0000000000000000000000000000d903997d9369c74c82abba4cc3b1bfc65f02,9f5b543c64d3e384078fdd8cf4b2ce6d
# 00000000000000000000000000efd802997d9369c74c82abba4cc3b1bfc65f02,c68dda2cc0d9907bc7252b53a447b2ce
# 00000000000000000000000007e8df05997d9369c74c82abba4cc3b1bfc65f02,650713f94eae0ecdfa4e527745dd2591
# 00000000000000000000000706e9de04997d9369c74c82abba4cc3b1bfc65f02,75d237c743d94001c251c722ab67a6de
# 00000000000000000000d80405eadd07997d9369c74c82abba4cc3b1bfc65f02,858612f5c4c666066ae1dfe8e28034aa
# 00000000000000000007d90504ebdc06997d9369c74c82abba4cc3b1bfc65f02,7ddf5849223e5b7940c514d1c917b5a9
# 00000000000000003b08d60a0be4d309997d9369c74c82abba4cc3b1bfc65f02,afdec75ab8bd284f549562be2378746c
# 000000000000006f3a09d70b0ae5d208997d9369c74c82abba4cc3b1bfc65f02,a1a8c878208895814537af005b056654
# 000000000000326c390ad40809e6d10b997d9369c74c82abba4cc3b1bfc65f02,c09afdc729bf5725b89cd3d90ab99745

attack = ""
i = 0
for line in f:
	i += 1
	if i%16 == 0:
		value = line.split(",")[0].decode("hex")
		attack += value[:16]

flag = ""
for i in range(len(attack)):
	flag += chr(ord(attack[i]) ^ ord(secret[i]) ^ 16)

print flag
f.close() 

# In cryptography, a padding oracle attack is an attack which is performed using the padding of a cryptographic message.
# hitcon{H4cked by a de1ici0us pudding '3'}
# In cryptography, variable-length plaintext messages often have to be padded (expanded) to be compatible with the underlying cryptographic primitive.

CBCモードに対するPadding Oracle Attackの通信ログが渡される。復号が成功したとき（ステータスコード200）の時の攻撃ブロックを取り出して攻撃を再現し平文を得る。