ctf-crypto-modern

Files (1)

• SKILL.md

SKILL.md (first lines)

# CTF Crypto — Modern Cipher Attacks

Padding oracle, CBC bitflip, ECB oracle, AES-GCM, LFSR, hash length extension.

---

## Phase 1: AES-ECB Detection & Oracle

```python
# ECB: same 16-byte plaintext block → same ciphertext
# Detect: submit 48 'A' bytes → 3 identical ciphertext blocks = ECB

import requests

TARGET = "https://TARGET/encrypt"

# Detect ECB:
ct = bytes.fromhex(requests.post(TARGET, data={"plaintext": "A"*48}).json()["ct"])
blocks = [ct[i:i+16] for i in range(0, len(ct), 16)]
if blocks[0] == blocks[1] == blocks[2]:
    print("ECB mode confirmed")

# ECB byte-at-a-time oracle:
def oracle(payload: bytes) -> bytes:
    ct = requests.post(TARGET, data={"plaintext": payload.hex()}).json()["ct"]
    return bytes.fromhex(ct)

# Recover secret: SECRET appended to payload → encrypt
def recover_secret():
    secret = b""
    for pos in range(256):
        pad_len = 15 - (pos % 16)
        block = pos // 16
        
        # Known block:
        known = b"A" * pad_len
        target = oracle(known)[block*16:(block+1)*16]
        
        # Try each byte:
        for b in range(256):
            test = b"A" * pad_len + secret + bytes([b])
            ct = oracle(test)[block*16:(block+1)*16]
            if ct == target:
                secret += bytes([b])
                break
    return secret
```

---

## Phase 2: CBC Padding Oracle

```python
from pwn import xor

def padding_oracle(ciphertext: bytes) -> bool:
    """Return True if padding is valid."""
    import requests
    r = requests.post("https://TARGET/decrypt", data={"ct": ciphertext.hex()})
    return "valid" in r.text.lower() or r.status_code == 200

def cbc_decrypt_block(prev_block: bytes, cipher_block: bytes) -> bytes:
    """Decrypt one 16-byte AES-CBC block using padding oracle."""
    intermediate = bytearray(16)
    
    for i in range(15, -1, -1):
        pad_byte = 16 - i
        # Craft previous block to produce desired padding:
        prev = bytearray(16)
        for j in range(i+1, 16):
            prev[j] = intermediate[j] ^ pad_byte
        
        # Brute-force current byte:
        for b in range(256):
            prev[i] = b
            test_iv = bytes(prev)
            if padding_oracle(test_iv + cipher_block):
                # Edge case: valid padding might be longer than expected
                if i == 15:
                    prev[i] = b ^ 1
                    if not padding_oracle(bytes(prev) + cipher_block):
                        continue
                intermediate[i] = b ^ pad_byte
                break
    
    return xor(intermediate, prev_block)
```

---

## Phase 3: CBC Bitflipping

```python
# Target: change specific byte in decrypted plaintext
# By XORing the previous ciphertext block at same position

def flip_byte(ciphertext: bytes, block_num: int, byte_pos: int, 
              from_byte: int, to_byte: int) -> bytes:
    """Flip byte in CBC decryption without key."""
    ct = bytearray(ciphertext)
    # Modify byte in PREVIOUS block (affects current block decryption):
    target_pos = (block_num - 1) * 16 + byte_pos
    ct[target_pos] ^= from_byte ^ to_byte
    return bytes(ct)

# Example: change 'user' to 'root' in cookie:
# cookie = IV + E("|role=user|name=bob|")
# position 6 in block 1 is 'u' in 'user'
# ct = flip_byte(ct, block_num=1, byte_pos=6, from_byte=ord('u'), to_byte=ord('r'))
# ... continue for all bytes of 'user' → 'admi' etc.
```

---

## Phase 4: Hash Length Extension

```python
# Vulnerability: HMAC-like but using H(secret || message)
# Extend message without knowing secret

From Yoraexe/ceobe, MIT.

More from Yoraexe/ceobe