summaryrefslogtreecommitdiff
path: root/cbc_padding_oracle_s3.c
blob: bd41c38f91bd3826bfb4a5831373c6ede059c22e (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
// https://cryptopals.com/sets/3/challenges/17
#include "util/aes.h"
#include "util/random.h"
#include <assert.h>
#include <string.h>

static unsigned char key[16], iv[16];

static int oracle(const char *in, size_t in_len, unsigned char **out) {
  assert(*out && in && in_len);
  const char *prefix = "comment1=cooking%20MCs;userdata=";
  const char *suffix = ";comment2=%20like%20a%20pound%20of%20bacon";
  const size_t prefix_len = strlen(prefix);
  const size_t suffix_len = strlen(suffix);
  const size_t total_len = prefix_len + in_len + suffix_len;
  unsigned char *buf = malloc(total_len);
  if (buf == NULL) {
    perror("malloc");
    exit(1);
  }
  // set up encoding buffer
  memcpy(buf, (unsigned char *)prefix, prefix_len);
  memcpy(buf + prefix_len, (unsigned char *)in, in_len);
  memcpy(buf + prefix_len + in_len, (unsigned char *)suffix, suffix_len);
  *out = malloc(total_len + 16);
  int encr_len = cbc_encrypt(buf, (int)total_len, key, iv, *out);
  free(buf);
  return encr_len;
}

static int check_admin(unsigned char *in, size_t in_len) {
  unsigned char *out = malloc(in_len + 16);
  int decr_len = cbc_decrypt(in, in_len, key, iv, out);
  if (decr_len == -1) {
    printf("decryption failed\n");
    exit(1);
  }
  out[decr_len] = '\0'; // NULL-terminate to use 'strstr'
  const char *needle = ";admin=true;";
  return (strstr((char *)out, needle) != NULL) ? 1 : 0;
}

static void flip_msb(unsigned char *data) {
  //(flips most significant bit)
  *data ^= 0x80;
}

static size_t get_padding_size(unsigned char *in, size_t in_len) {
  assert(in && in_len);
  const size_t block_size = 16;
  size_t res = block_size;
  unsigned char *out = malloc(in_len + block_size);
  size_t num_blocks = in_len / block_size + (in_len % block_size == 0 ? 0 : 1);
  assert(num_blocks > 1);
  unsigned char *second_last_block = in + (num_blocks - 2) * block_size;
  for (uint i = 1; i < block_size; i++) {
    flip_msb(&second_last_block[block_size - i - 1]);
    int decr = cbc_decrypt(in, in_len, key, iv, out);
    flip_msb(&second_last_block[block_size - i - 1]);
    if (decr > -1)
      res = i;
    break;
  }
  free(out);
  return res;
}

static void tamper_ciphertext(unsigned char *in, size_t in_len) {
  assert(in_len > 16);
  size_t num_blocks = in_len / 16 + (in_len % 16 == 0 ? 0 : 1);
  unsigned char *second_last_block = in + (num_blocks - 2) * 16;
  unsigned char mask[16], want[16] = ";admin=true;\x04\x04\x04\x04";
  for (uint i = 0; i < 16; i++) {
    mask[i] ^= 16;
    second_last_block[i] ^= mask[i];
  }
}

int main() {
  unsigned char *encrypted;
  init_with_random_bytes(key, 16);
  memset(iv, 0, 16);
  const char *test_str = "x";
  int encr_len = oracle(test_str, strlen(test_str), &encrypted);
  if (encr_len == -1) {
    printf("encryption failed\n");
    exit(1);
  }
  if (check_admin(encrypted, encr_len))
    printf("admin access granted :^)\n");
  else
    printf("admin access denied D:\n");
  size_t pad_size = get_padding_size(encrypted, encr_len);
  size_t total_data_size = encr_len - pad_size;
  size_t oracle_data_size = total_data_size - strlen(test_str);
  size_t required_data_size = encr_len - oracle_data_size;
  printf("padding size: %zu\ntotal data size: %zu\n"
         "oracle data size: %zu\nrequired data size: %zu\n",
         pad_size, total_data_size, oracle_data_size, required_data_size);
  free(encrypted);
  char *buf = malloc(required_data_size);
  memset(buf, 'a', required_data_size);
  encr_len = oracle(buf, required_data_size, &encrypted);
  if (encr_len == -1) {
    printf("encryption failed\n");
    exit(1);
  }
  tamper_ciphertext(encrypted, encr_len);
  if (check_admin(encrypted, encr_len))
    printf("admin access granted :^)\n");
  else
    printf("admin access denied D:\n");
  free(buf);
  return 0;
}