180 lines
7.1 KiB
Python
180 lines
7.1 KiB
Python
from .Challenge import Challenge
|
|
|
|
import subprocess
|
|
import time
|
|
import re
|
|
import os
|
|
import binascii
|
|
import secrets
|
|
|
|
class Sheesh(Challenge):
|
|
flag_location = 'flags/sheesh.txt'
|
|
history_location = 'history/sheesh.txt'
|
|
|
|
_CONTAINER = "sheesh_container"
|
|
_SERVICE_CMD = ["docker", "exec", "-i", _CONTAINER, "python3", "/home/ctfuser/chall/src/chall.py"]
|
|
_HEX_RE = re.compile(r'^[0-9a-fA-F]+$')
|
|
|
|
def _read_container_flag(self) -> str:
|
|
out = subprocess.run(
|
|
["docker", "exec", self._CONTAINER, "cat", "/flag.txt"],
|
|
capture_output=True, text=True
|
|
)
|
|
if out.returncode != 0 or not out.stdout.strip():
|
|
raise FileNotFoundError("Flag not found in container (/flag.txt)")
|
|
return out.stdout.strip()
|
|
|
|
def _spawn(self):
|
|
return subprocess.Popen(
|
|
self._SERVICE_CMD,
|
|
stdin=subprocess.PIPE,
|
|
stdout=subprocess.PIPE,
|
|
stderr=subprocess.STDOUT,
|
|
text=True,
|
|
bufsize=0,
|
|
)
|
|
|
|
def _read_exact_line(self, proc, timeout=6.0):
|
|
start = time.time()
|
|
buf = []
|
|
r = proc.stdout.read
|
|
while True:
|
|
if time.time() - start > timeout:
|
|
raise TimeoutError("Timeout waiting for a line")
|
|
ch = r(1)
|
|
if ch == "" and proc.poll() is not None:
|
|
raise RuntimeError("Process ended unexpectedly")
|
|
buf.append(ch)
|
|
if ch == "\n":
|
|
return "".join(buf)
|
|
|
|
def _read_until_prompt(self, proc, token: str, timeout=6.0):
|
|
start = time.time()
|
|
acc = []
|
|
r = proc.stdout.read
|
|
while True:
|
|
if time.time() - start > timeout:
|
|
raise TimeoutError(f"Timeout waiting for '{token}'")inp
|
|
ch = r(1)
|
|
if ch == "" and proc.poll() is not None:
|
|
raise RuntimeError("Process ended while waiting for prompt")
|
|
acc.append(ch)
|
|
if "".join(acc).endswith(token):
|
|
return "".join(acc)
|
|
|
|
def _send_line(self, proc, s: str):
|
|
proc.stdin.write(s + "\n")
|
|
proc.stdin.flush()
|
|
|
|
def _expect_hex_field(self, text: str, label: str) -> str:
|
|
m = re.search(rf"{re.escape(label)}\s*:\s*([0-9a-fA-F]+)", text)
|
|
assert m, f"Missing '{label}' in output. Tail:\n{text[-400:]}"
|
|
hx = m.group(1)
|
|
assert self._HEX_RE.match(hx), f"{label} is not hex"
|
|
return hx
|
|
|
|
def test1(self, proc, b16_hex: str) -> str:
|
|
assert len(b16_hex) == 32
|
|
self._read_until_prompt(proc, "inp: ", timeout=6.0)
|
|
self._send_line(proc, b16_hex)
|
|
line = self._read_exact_line(proc, timeout=4.0)
|
|
assert line.startswith("blk:"), "Expected blk: for 16-byte input"
|
|
hx = self._expect_hex_field(line, "blk")
|
|
# chall prints an extra blank line after blk:
|
|
_ = self._read_exact_line(proc, timeout=4.0)
|
|
return hx.lower()
|
|
|
|
def test2(self, proc, iv_hex: str, ct_hex: str) -> str:
|
|
self._read_until_prompt(proc, "inp: ", timeout=6.0)
|
|
self._send_line(proc, iv_hex + ct_hex)
|
|
ans = self._read_exact_line(proc, timeout=4.0).strip().lower()
|
|
assert ans in ("ok", "zzz"), "Padding oracle did not return ok/zzz"
|
|
return ans
|
|
|
|
def test3(self, proc, iv_hex: str, ct_hex: str, trials=9) -> tuple[int, int, str]:
|
|
ok_cnt = 0
|
|
zzz_cnt = 0
|
|
for _ in range(trials):
|
|
ans = self.test2(proc, iv_hex, ct_hex)
|
|
if ans == "ok":
|
|
ok_cnt += 1
|
|
else:
|
|
zzz_cnt += 1
|
|
final = "ok" if ok_cnt > zzz_cnt else "zzz"
|
|
return ok_cnt, zzz_cnt, final
|
|
|
|
def distribute(self, flag):
|
|
try:
|
|
os.makedirs(os.path.dirname(self.flag_location), exist_ok=True)
|
|
with open(self.flag_location, 'w') as f:
|
|
f.write(flag)
|
|
|
|
os.makedirs(os.path.dirname(self.history_location), exist_ok=True)
|
|
with open(self.history_location, 'a') as f:
|
|
f.write(flag + '\n')
|
|
|
|
self.logger.info(f'Flag {flag} written to {self.flag_location}')
|
|
return True
|
|
except Exception as e:
|
|
self.logger.error(f'Could not write flag to {self.flag_location}: {e}')
|
|
return False
|
|
|
|
def check(self):
|
|
try:
|
|
with open(self.flag_location, 'r') as f:
|
|
host_flag = f.read().strip()
|
|
container_flag = self._read_container_flag()
|
|
assert host_flag == container_flag, 'Flag mismatch between host and container'
|
|
self.logger.info('[ok] flag parity (sheesh)')
|
|
|
|
proc = self._spawn()
|
|
|
|
line1 = self._read_exact_line(proc, timeout=6.0)
|
|
line2 = self._read_exact_line(proc, timeout=6.0)
|
|
blank = self._read_exact_line(proc, timeout=6.0)
|
|
assert line1.startswith("iv:") and line2.startswith("ct:"), "Missing banner"
|
|
iv_hex = self._expect_hex_field(line1, "iv")
|
|
ct_hex = self._expect_hex_field(line2, "ct")
|
|
iv0 = bytes.fromhex(iv_hex)
|
|
ct0 = bytes.fromhex(ct_hex)
|
|
assert len(iv0) == 16 and len(ct0) >= 16 and len(ct0) % 16 == 0, "Bad banner sizes"
|
|
self.logger.info("[ok] banner parsed")
|
|
|
|
block00 = "00" * 16
|
|
blk1 = self.test1(proc, block00)
|
|
blk2 = self.test1(proc, block00)
|
|
blk3 = self.test1(proc, block00)
|
|
assert blk1 == blk2 == blk3, "ECB-masked oracle not deterministic for same input"
|
|
self.logger.info("[ok] blk determinism (3x same input)")
|
|
|
|
block01 = "01" * 16
|
|
blk4 = self.test1(proc, block01)
|
|
assert blk4 != blk1, "ECB-masked oracle returned same block for different input"
|
|
self.logger.info("[ok] blk diversity")
|
|
|
|
self._read_until_prompt(proc, "inp: ", timeout=6.0)
|
|
self._send_line(proc, "zzzz") # invalid hex
|
|
line_err = self._read_exact_line(proc, timeout=4.0)
|
|
assert "err" in line_err.lower(), "Expected 'err' for non-hex input"
|
|
maybe_hmmm = self._read_exact_line(proc, timeout=4.0).strip().lower()
|
|
if "hmmm" not in maybe_hmmm:
|
|
self.logger.warning(f"[warn] expected 'hmmm' after err, got: {maybe_hmmm!r}")
|
|
self.logger.info("[ok] error handling on non-hex input")
|
|
|
|
ok_cnt, zzz_cnt, final = self.test3(proc, iv_hex, ct_hex, trials=9)
|
|
self.logger.info(f"[ok] padding oracle responded on banner (ok={ok_cnt}, zzz={zzz_cnt}, final={final})")
|
|
|
|
iv_synth = secrets.token_hex(16)
|
|
ct_synth = "00" * (6 * 16) # 6 blocks
|
|
ok_cnt2, zzz_cnt2, final2 = self.test3(proc, iv_synth, ct_synth, trials=9)
|
|
self.logger.info(f"[ok] padding oracle responded on synthetic (ok={ok_cnt2}, zzz={zzz_cnt2}, final={final2})")
|
|
|
|
self._read_until_prompt(proc, "inp: ", timeout=6.0)
|
|
proc.kill()
|
|
self.logger.info('Check passed for sheesh')
|
|
return True
|
|
|
|
except Exception as e:
|
|
self.logger.error(f'Could not check sheesh: {e}')
|
|
return False
|