crack.py

# -*- coding: utf-8 -*-
from paddingoracle import BadPaddingException, PaddingOracle
from base64 import b64encode, b64decode
from urllib import quote, unquote
import requests
import socket
import time
import pexpect
import signal
import sys
from Crypto.Cipher import AES

class PadBuster(PaddingOracle):
    def __init__(self, **kwargs):
        super(PadBuster, self).__init__(**kwargs)
        self.wait = kwargs.get('wait', 2.0)
        self.spawn_child()
        self.count = 0

    def spawn_child(self):
        logging.debug("spawn")
        if hasattr(self, 'child'):
            self.child.send('\003')
            self.child.close()
        self.child = pexpect.spawnu('nc 35.197.255.108 1338', timeout=10)
        #self.child.logfile = sys.stdout

    def test_cipher(self, ciphertext):
        self.child.expect(u'> ')
        self.child.sendline('2')
        self.child.expect(u'.*Please input your ciphertext.*')
        self.child.sendline(ciphertext)
        return self.child.expect([u'.*error.*', u'.*transferred.*', u'.*format.*'])

    def oracle(self, data, **kwargs):
        msg = b64encode(data)
        self.count += 1

        while 1:
            try:
                response = self.test_cipher(msg)
                break
            except Exception as e:
                logging.debug(e)
                self.spawn_child()
                time.sleep(1.0)
                continue

        self.history.append(response)

        if response == 2:
            logging.debug('No padding exception raised on %r', msg)
            logging.debug('%s tries so far' % self.count)
            return

        raise BadPaddingException


if __name__ == '__main__':
    import logging
    import sys

    if not sys.argv[1:]:
        print 'Usage: %s <msg value>' % (sys.argv[0], )
        sys.exit(1)

    logging.basicConfig(level=logging.DEBUG)

    padbuster = PadBuster()

    msg = b64decode(sys.argv[1])

    iv = msg[:16]
    encrypted_msg = msg[16:]

    msg = padbuster.decrypt(encrypted_msg, block_size=AES.block_size, iv=iv)

    print('Decrypted msg: %s => %r' % (sys.argv[1], msg))