Skip to content

Instantly share code, notes, and snippets.

@ducnhse130201
Created October 15, 2018 02:02
Show Gist options
  • Save ducnhse130201/824c0215e020beb1ffe221ba5c82de4c to your computer and use it in GitHub Desktop.
Save ducnhse130201/824c0215e020beb1ffe221ba5c82de4c to your computer and use it in GitHub Desktop.
solve_des FuSecAthon 2018
from telnetlib import *
from des import *
r = Telnet('localhost',34533)
print r.read_until('>>')
r.write('Data Encryption Standard' + '\n')
print r.read_until('>>')
r.write('8'+ '\n')
print r.read_until('>>')
r.write('B' + '\n')
r.read_until('key = ')
key = r.read_until(' and').strip(' and')
r.read_until('input_block = ')
input_block = r.read_until(', ').strip(', ')
r.read_until('output_block = ')
output_block = r.read_until('\n').strip('\n')
print 'key: '+ key
print 'input_block: ' + input_block
print 'output_block: ' + output_block
new_key = (key.decode('hex')[:7] + chr(ord(key.decode('hex')[-1]) ^ 1)).encode('hex')
print r.read_until('>>')
r.write(new_key + '\n')
def xor(s1,s2):
return ''.join(chr(ord(a) ^ ord(b)) for a,b in zip(s1,s2))
print r.read_until('>>')
com_input = xor(key.decode('hex'),'\xff'*len(key.decode('hex'))).encode('hex')
r.write(com_input + '\n')
#r.interact()
print r.read_until('>>')
r.write('9a7ce47e6d729c14'+'\n')
r.read_until('>>')
r.write('0101010101010101'+'\n')
r.interact()
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment