Skip to content

Latest commit

 

History

History
336 lines (269 loc) · 14.5 KB

crypto.md

File metadata and controls

336 lines (269 loc) · 14.5 KB
Raw

+

import gmpy2
gmpy2.get_context().precision = 200000
m = gmpy2.root(c, 3)

gmpy2.isqrt(B * N // A)

hashlib.md5().update(b'foo').hexdigest()

# ~/code/guides/ctf/TFNS---writeups/2020-09-25-BalCCon/cryptosh/cryptsh.py
from Crypto.Cipher import AES
from Crypto.Util.strxor import strxor
from Crypto.Util.Padding import pad, unpad

# ~/code/guides/ctf/TFNS---writeups/2020-09-25-BalCCon/do_u_have_knowledge/server.py
from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes
from cryptography.hazmat.backends import default_backend
cipher = Cipher(algorithms.AES(b'1234567890123456'), modes.ECB(), backend = default_backend())

hashing

HMAC

similarity

ssdeep -s foo > fuzzy.db
ssdeep -s -a -m fuzzy.db foo bar
# foo matches fuzzy.db:foo (100)
# bar matches fuzzy.db:foo (0)

patterns

md5sum <() # d41d8cd98f00b204e9800998ecf8427e
sha1sum <() # da39a3ee5e6b4b0d3255bfef95601890afd80709
sha256sum <() # e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

bruteforcing search space estimation

// [GRC's \| Password Haystacks: How Well Hidden is Your Needle?](https://www.grc.com/haystack.htm)
function grc(len) {
  if(len < 1) {
    return 0;
  } else if (len == 1) {
    return window.charsetsize;
  }
  return Math.pow(window.charsetsize, len - 1) + grc(len - 1);
}
console.log(grc(64));
// 110
>>> len(list(permutations([i for i in range(0,10)], 2)))
90
>>> int(factorial(10)/factorial(10-2))
90
>>> int(factorial(36)/factorial(36-8))
1220096908800
# MAC address
>>> int(factorial(16)/factorial(16-12))
871782912000

checksums

rsa

from Crypto.Util.number import getStrongPrime

f = b"[REDACTED]"
m = int.from_bytes(f, "big")
p = getStrongPrime(512)
q = getStrongPrime(512)
n = p * q
e = 65537

# https://en.wikipedia.org/wiki/RSA_(cryptosystem)#Encryption
c = pow(m, e, n)

# https://en.wikipedia.org/wiki/RSA_(cryptosystem)#Decryption
d = pow(e, -1, (p - 1) * (q - 1))  # modinv(e, phi(modulus))
m = pow(c, d, n)

xor

  • https://wiremask.eu/tools/xor-cracker/

  • On length(known_prefix) >= length(key), full decryption is direct

    ~/code/snippets/ctf/crypto/xor_decrypt.py 'darkCTF{' <(printf '%s' '5552415c2b3525105a4657071b3e0b5f494b034515' | xxd -r -p)
# 1337hack>'%lXjM$-*q.V
~/code/snippets/ctf/crypto/xor_decrypt.py '1337hack' <(printf '%s' '5552415c2b3525105a4657071b3e0b5f494b034515' | xxd -r -p)
# darkCTF{kud0s_h4xx0r}
~/code/snippets/ctf/crypto/xor_decrypt.py 'darkCTF{kud0s_h4xx0r}' <(printf '%s' '5552415c2b3525105a4657071b3e0b5f494b034515' | xxd -r -p)
# 1337hack1337hack1337h

  • Split message into aligned sequences, count frequencies of chars foreach column, take most frequent char and xor with expected most frequent char (e.g. _) to obtain key

  • Guessing key length + values by decrypted output byte range

    • ~/code/guides/ctf/grayrepo/2017_flareon/flare10_shellphp/README.md

frequency analysis

pseudo random number generator (PRNG)

mersenne twister

LSFR

find polynomials

  • Lagrange Interpolation in finite field (i.e. Galois field) 
    F = GF(691)
points = [(0, 125), (1, 492), (2, 670), (3, 39), ... , (688, 130), (689, 487), (690, 18)]
R = F['x']
print(R.lagrange_polynomial(points))
  • Transformation Matrix 
    from sage.all import *

vals = vector(mod(enc(i), MOD) for i in range(FLAG_LEN))
coeffs = Matrix(
    [
        [mod(i ** (FLAG_LEN - j - 1), MOD) for j in range(FLAG_LEN)]
        for i in range(FLAG_LEN)
    ]
)
flag = coeffs.solve_right(points)

one-time pad

electronic color book (AES-ECB)

stream ciphers

mitigations

Language CSPRNG
.NET RNGCryptoServerProvider()
Java java.security.SecureRandom()
JavaScript (Node.js) crypto.RandomBytes()
PHP random_bytes()
Python random.SystemRandom()

Correlation Power Analysis (CPA) / Differential Fault Analysis (DFA) / White-Box Cryptography

case studies

hashing

  • identifying files in raw dumps - 1. hash the first k bytes of all known files; 2. take offsets matching a given sequence, hash the first k bytes at those offsets, then compare with known set
  • discovering bugs due to unexpected magic byte sequences

    Mostly just IDA, I managed to get a trace of lsass while CryptUnprotectData() was working and failing, then got a lucky break - I saw it derive a key from a byte sequence I knew (da 39 a3 ee...), that's the SHA-1 of the empty string! That led me to credentials being clobbered