MythEclipse/attack-defense-platform
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

updated sheesh

Browse Source
This commit is contained in:
lightningitoid
2025-10-27 08:25:45 +07:00
parent fddf357524
commit bbeb22211e
1 changed files with 48 additions and 60 deletions
Download Patch File Download Diff File Expand all files Collapse all files
receiver/challenges/Sheesh.py
+47 -59
View File
@@ -5,7 +5,6 @@ import time
import re
import os
import binascii
import secrets
class Sheesh(Challenge):
flag_location = 'flags/sheesh.txt'
@@ -34,7 +33,7 @@ class Sheesh(Challenge):
bufsize=0,
)
def _read_exact_line(self, proc, timeout=6.0):
def _read_exact_line(self, proc, timeout=5.0):
start = time.time()
buf = []
r = proc.stdout.read
@@ -48,7 +47,7 @@ class Sheesh(Challenge):
if ch == "\n":
return "".join(buf)
def _read_until_prompt(self, proc, token: str, timeout=6.0):
def _read_until_prompt(self, proc, token: str, timeout=5.0):
start = time.time()
acc = []
r = proc.stdout.read
@@ -73,36 +72,6 @@ class Sheesh(Challenge):
assert self._HEX_RE.match(hx), f"{label} is not hex"
return hx
def test1(self, proc, b16_hex: str) -> str:
assert len(b16_hex) == 32
self._read_until_prompt(proc, "inp: ", timeout=6.0)
self._send_line(proc, b16_hex)
line = self._read_exact_line(proc, timeout=4.0)
assert line.startswith("blk:"), "Expected blk: for 16-byte input"
hx = self._expect_hex_field(line, "blk")
# chall prints an extra blank line after blk:
_ = self._read_exact_line(proc, timeout=4.0)
return hx.lower()
def test2(self, proc, iv_hex: str, ct_hex: str) -> str:
self._read_until_prompt(proc, "inp: ", timeout=6.0)
self._send_line(proc, iv_hex + ct_hex)
ans = self._read_exact_line(proc, timeout=4.0).strip().lower()
assert ans in ("ok", "zzz"), "Padding oracle did not return ok/zzz"
return ans
def test3(self, proc, iv_hex: str, ct_hex: str, trials=9) -> tuple[int, int, str]:
ok_cnt = 0
zzz_cnt = 0
for _ in range(trials):
ans = self.test2(proc, iv_hex, ct_hex)
if ans == "ok":
ok_cnt += 1
else:
zzz_cnt += 1
final = "ok" if ok_cnt > zzz_cnt else "zzz"
return ok_cnt, zzz_cnt, final
def distribute(self, flag):
try:
os.makedirs(os.path.dirname(self.flag_location), exist_ok=True)
@@ -121,6 +90,7 @@ class Sheesh(Challenge):
def check(self):
try:
# parity check: host vs container flag
with open(self.flag_location, 'r') as f:
host_flag = f.read().strip()
container_flag = self._read_container_flag()
@@ -129,9 +99,9 @@ class Sheesh(Challenge):
proc = self._spawn()
line1 = self._read_exact_line(proc, timeout=6.0)
line2 = self._read_exact_line(proc, timeout=6.0)
blank = self._read_exact_line(proc, timeout=6.0)
line1 = self._read_exact_line(proc, timeout=5.0)
line2 = self._read_exact_line(proc, timeout=5.0)
blank = self._read_exact_line(proc, timeout=5.0)
assert line1.startswith("iv:") and line2.startswith("ct:"), "Missing banner"
iv_hex = self._expect_hex_field(line1, "iv")
ct_hex = self._expect_hex_field(line2, "ct")
@@ -140,36 +110,54 @@ class Sheesh(Challenge):
assert len(iv0) == 16 and len(ct0) >= 16 and len(ct0) % 16 == 0, "Bad banner sizes"
self.logger.info("[ok] banner parsed")
block00 = "00" * 16
blk1 = self.test1(proc, block00)
blk2 = self.test1(proc, block00)
blk3 = self.test1(proc, block00)
assert blk1 == blk2 == blk3, "ECB-masked oracle not deterministic for same input"
self.logger.info("[ok] blk determinism (3x same input)")
self._read_until_prompt(proc, "blob: ", timeout=5.0)
block01 = "01" * 16
blk4 = self.test1(proc, block01)
assert blk4 != blk1, "ECB-masked oracle returned same block for different input"
qA = "00" * 16
self._send_line(proc, qA)
lA = self._read_exact_line(proc, timeout=3.0)
assert lA.startswith("blk:"), "Expected blk: for 16-byte blob"
blk1 = self._expect_hex_field(lA, "blk")
_ = self._read_exact_line(proc, timeout=3.0)
self._read_until_prompt(proc, "blob: ", timeout=5.0)
self._send_line(proc, qA)
lA2 = self._read_exact_line(proc, timeout=3.0)
blk2 = self._expect_hex_field(lA2, "blk")
_ = self._read_exact_line(proc, timeout=3.0)
assert blk1 == blk2, "ECB-masked oracle not deterministic for same input"
self.logger.info("[ok] blk determinism")
self._read_until_prompt(proc, "blob: ", timeout=5.0)
qB = "01" * 16
self._send_line(proc, qB)
lB = self._read_exact_line(proc, timeout=3.0)
blk3 = self._expect_hex_field(lB, "blk")
_ = self._read_exact_line(proc, timeout=3.0)
assert blk3 != blk1, "ECB-masked oracle returned same block for different input"
self.logger.info("[ok] blk diversity")
self._read_until_prompt(proc, "inp: ", timeout=6.0)
self._send_line(proc, "zzzz") # invalid hex
line_err = self._read_exact_line(proc, timeout=4.0)
self._read_until_prompt(proc, "blob: ", timeout=5.0)
self._send_line(proc, "zzzz") # invalid hex
line_err = self._read_exact_line(proc, timeout=3.0)
assert "err" in line_err.lower(), "Expected 'err' for non-hex input"
maybe_hmmm = self._read_exact_line(proc, timeout=4.0).strip().lower()
if "hmmm" not in maybe_hmmm:
self.logger.warning(f"[warn] expected 'hmmm' after err, got: {maybe_hmmm!r}")
self.logger.info("[ok] error handling on non-hex input")
self.logger.info("[ok] error handling on non-hex")
ok_cnt, zzz_cnt, final = self.test3(proc, iv_hex, ct_hex, trials=9)
self.logger.info(f"[ok] padding oracle responded on banner (ok={ok_cnt}, zzz={zzz_cnt}, final={final})")
self._read_until_prompt(proc, "blob: ", timeout=5.0)
self._send_line(proc, (iv_hex + ct_hex))
ans1 = self._read_exact_line(proc, timeout=3.0).strip().lower()
assert ans1 in ("ok", "no"), "Padding oracle did not return ok/no for iv||ct"
self.logger.info(f"[ok] padding oracle responds ({ans1}) on banner bundle")
iv_synth = secrets.token_hex(16)
ct_synth = "00" * (6 * 16) # 6 blocks
ok_cnt2, zzz_cnt2, final2 = self.test3(proc, iv_synth, ct_synth, trials=9)
self.logger.info(f"[ok] padding oracle responded on synthetic (ok={ok_cnt2}, zzz={zzz_cnt2}, final={final2})")
self._read_until_prompt(proc, "blob: ", timeout=5.0)
iv_synth = os.urandom(16).hex()
ct_synth = ("00" * (6 * 16))
self._send_line(proc, iv_synth + ct_synth)
ans2 = self._read_exact_line(proc, timeout=3.0).strip().lower()
assert ans2 in ("ok", "no"), "Padding oracle did not return ok/no on synthetic 6-block ct"
self.logger.info(f"[ok] padding oracle responds ({ans2}) on synthetic payload")
self._read_until_prompt(proc, "blob: ", timeout=5.0)
self._read_until_prompt(proc, "inp: ", timeout=6.0)
proc.kill()
self.logger.info('Check passed for sheesh')
return True