diff --git a/xiaosai/ecb_padding/crack.py b/xiaosai/ecb_padding/crack.py index da72a61..cd09a65 100644 --- a/xiaosai/ecb_padding/crack.py +++ b/xiaosai/ecb_padding/crack.py @@ -1,37 +1,34 @@ from pwn import * -from flag import flag -from Crypto.Cipher import AES -from hashlib import sha256 import base64 -flag = b'' first_flag = b'' -wordlist = b'123456789qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM{}_' +wordlist = b'0123456789qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM{}_' for i in range(16): for j in wordlist: - r = remote("127.0.0.1", 10002) + r = remote("172.20.14.117", 65311) payload = b'0'*(16-5) + b'0' * (15 - i)\ + first_flag + j.to_bytes() + \ b'0' * (15 - i) r.sendline(payload) cipher = r.recvline() + r.close() cipher = base64.b64decode(cipher) if cipher[16:32] == cipher[32:48]: first_flag = first_flag + j.to_bytes() break - + last_flag = b'' for i in range(21-16): for j in wordlist: - r = remote("127.0.0.1", 10002) + r = remote("172.20.14.117", 65311) payload = b'0' * 11 + j.to_bytes() + \ last_flag + b'0' * 27 r.sendline(payload) cipher = r.recvline() + r.close() cipher= base64.b64decode(cipher) if cipher[16:32] == cipher[64:80]: last_flag = j.to_bytes() + last_flag - break - + break print(first_flag + last_flag) \ No newline at end of file diff --git a/xiaosai/ecb_padding/dockerfile b/xiaosai/ecb_padding/dockerfile new file mode 100644 index 0000000..7475f2f --- /dev/null +++ b/xiaosai/ecb_padding/dockerfile @@ -0,0 +1,13 @@ +FROM python:latest + +RUN pip install pycryptodome -i https://pypi.tuna.tsinghua.edu.cn/simple + +COPY flag.py /app/ + +COPY main.py /app/ + +WORKDIR /app + +EXPOSE 10002 + +CMD [ "python", "main.py" ] \ No newline at end of file diff --git a/xiaosai/ecb_padding/flag.py b/xiaosai/ecb_padding/flag.py index abfa7cd..6cfcb0a 100644 --- a/xiaosai/ecb_padding/flag.py +++ b/xiaosai/ecb_padding/flag.py @@ -1 +1 @@ -flag = b'flag{eCb_is_not_SafE}' \ No newline at end of file +flag = b'0xFA{eCb_is_not_SafE}' \ No newline at end of file diff --git a/xiaosai/ecb_padding/main.py b/xiaosai/ecb_padding/main.py index 0869208..18f87a9 100644 --- a/xiaosai/ecb_padding/main.py +++ b/xiaosai/ecb_padding/main.py @@ -38,12 +38,11 @@ class Task(socketserver.BaseRequestHandler): data = self.recv(prompt=b'') data = b'cqupt'+ data + flag # len(flag) == 21 - # wordlist = b'123456789qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM{}_' + # wordlist = b'0123456789qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM{}_' if len(data)%16 != 0: pad = b'0' * (16 - len(data)%16) data = data + pad cipher = aes.encrypt(data) - print(aes.decrypt(cipher)) cipher = base64.b64encode(cipher) self.send(cipher)