_index.php

<?php

define('MY_AES_IV', "e36dc751d0433f05");
define('MY_AES_KEY', "d2cb415e067c7b13");
define('MY_HMAC_KEY', "d6cfaad283353507");
define("FLAG","ebCTF{9245f8440aa7402672e2a735bc751e14}");

function aes($data, $encrypt) {
    echo "aes start:\n\r";
    $aes = mcrypt_module_open(MCRYPT_RIJNDAEL_128, '', MCRYPT_MODE_CBC, '');
    mcrypt_generic_init($aes, MY_AES_KEY, MY_AES_IV);
    return $encrypt ? mcrypt_generic($aes, $data) : mdecrypt_generic($aes, $data);
}

define('MY_MAC_LEN', 40);
       
function hmac($data) {
    return hash_hmac('sha1', data, MY_HMAC_KEY);
}

function encrypt($data) {
    return aes($data . hmac($data), true);
}

function decrypt($data) {
    $data = rtrim(aes($data, false), "\0");
    echo "decrypt data:",$data;
    $mac = substr($data, -MY_MAC_LEN);
    $data = substr($data, 0, -MY_MAC_LEN);
    return hmac($data) === $mac ? $data : null;
}
    
 $a = urldecode('%2FW8w%2BUpwN%2B2vh85b54XcyGM2wSNNFFcBqoGr%2BX5S7FOuJn%2FJBJwp1R1F5VpqsR9NkW82Ut8L5hPFKa%2BWIEs2W9DP9Qnq9zhmAJ5FwbNcY6viYT2kZd1Yz06lplcsnRuaFU8gj5TV9jHX8wps2%2BTaAO68TrHgF3Scvt56BrGAlZX%2Fp24qGKQf5m%2B15RdsgC6M%2BQ9Fl7KhwazU1F9yJ9rx7GH5HsCC4ztYeVVoiFYQQIDMPMHZkIeA7sbYrhH6L9Ej8DlEb2dErkHBVP98Wp5aAxm8jIXeqgBHfPF8s26o%2Bjs2T6XfWm3cv%2FN4yp93yGEpSja7dAr1Bdw3k1TVVPAqzGFBA2SbB6skHQhNiC5hfJ4TdymBfzzt8QLvGT3KKBlQP1sgNcLIpwhFCOGlGkN1Nq7%2Bb2GV5h%2FtyLH%2FTW2LGuVcBCTRXFY7mC0IPV2WCFSTyOddnX5t2sNeU9zBop9WeWQe199f50%2FRKRX4aA%2FLsSrGqv%2F2s4z96n9I0Zu4oGcpb9hGh3zvzGZQy6J4TAeKRKCRsIW3vDFacngSGcUAklS4nsRqXJBVEZ70WcBFQjVI7zMX8cjJS8RiyQLKgGpKirYotsetFk98xonYzbwBnyNLiNFEM0WSsPoDSW2UvQe3NfDEJKwT63l9uaAHTbfWXQ%3D%3D');
    
    $aa='aaaaaaaaaaaaaaaa';
    $test = array(
                      'name' => '11111',
                      'greeting' => $aa,
                      );
    echo "\n\r------------\n\r";
    $ss=base64_encode(@encrypt(($test)));
    $ss=base64_encode(@encrypt(serialize($test)));
    echo $ss;
    echo "\n\r------------\n\r";

echo "strlen:\n\r".strlen($a)."\n\r";

echo "base64_decode:\n\r".base64_decode($a)."\n\r---------\n\r";
    
echo "decrypt:".@decrypt(base64_decode($a));
$settings = array();

echo "\n\r111\n\r";
$settings = @unserialize(@decrypt(base64_decode($a)));
    
echo "setting:".$settings."\n\r";

      


?>

Cipher.java

public class Cipher {

public static void main(String[] args) throws Throwable
	{
		BASE64Decoder decoder = new BASE64Decoder();
		BASE64Encoder encoder = new BASE64Encoder();
		String message = "s_hostname:jonasnuts.blogs.sapo.pt OR s_hostname:jonasnuts.com;1350305502";

		// data

		// should be 16 byte len
		final byte[] aes_key = "d2cb415e067c7b13".getBytes();
		final byte[] iv = "e36dc751d0433f05".getBytes(); // should be random
		final byte[] hmac_key = "d6cfaad283353507".getBytes();

		// encrypt
		Cipher encrypt = Cipher.getInstance("AES/CBC/PKCS5Padding");
		encrypt.init(Cipher.ENCRYPT_MODE, new SecretKeySpec(aes_key, "AES"), new IvParameterSpec(iv));

		byte[] encMessage = encrypt.doFinal(message.getBytes("UTF-8"));
		String encrypted_message_b64 = encoder.encode(encMessage);
		System.out.printf("%s (%d chars)\n", encrypted_message_b64, encrypted_message_b64.length());

		byte[] encryptedData = decoder.decodeBuffer(encrypted_message_b64);
		Cipher decrypt = Cipher.getInstance("AES/CBC/PKCS5Padding");
		decrypt.init(Cipher.DECRYPT_MODE, new SecretKeySpec(aes_key, "AES"), new IvParameterSpec(iv));
		byte[] data = decrypt.doFinal(encryptedData);
		String decryptedData = new String(data, "UTF-8");

		// process data
		System.out.println(decryptedData);
		String[] dargs = decryptedData.split(";");

		String filter = dargs[0];
		Date ts = new Date(Long.parseLong(dargs[1]) * 1000);// ts comes in seconds?

		System.out.println("> " + filter);
		System.out.println("> " + ts);

		// hmac
		Mac hmac = Mac.getInstance("HmacSHA256");
		hmac.init(new SecretKeySpec(hmac_key, "HmacSHA256"));
		byte[] signature = hmac.doFinal(encryptedData);

		// ruby hexdigest is 59...
		System.out.println(Hex.encodeHexString(signature));

	}


}

cipher.perl

use Crypt::CBC;
use MIME::Base64::Perl;
use Digest::HMAC;
use Digest::SHA qw(hmac_sha256_hex);



my $cipher = Crypt::CBC->new(
        -key         => 'd2cb415e067c7b13',
        -iv          => 'e36dc751d0433f05', #random 16chars!!!!!! shold NOT repeat between requests
        -cipher      => 'OpenSSL::AES',     #this is same as Rijndael
        -literal_key => 1,        
        -header      => "none",
        -keysize     => 16
  );  


$encrypted = $cipher->encrypt( "s_hostname:jonasnuts.blogs.sapo.pt OR s_hostname:jonasnuts.com;1350305502");
$base64 = encode_base64($encrypted);
$digest = hmac_sha256_hex($encrypted, "d6cfaad283353507");

print("Ciphertext(b64): $base64\n");
print("Digest(hex)    : $digest\n" );

cipher.php

<?php


//PHP doesn't support PKCS5Padding
//http://us3.php.net/manual/en/ref.mcrypt.php#69782
function pkcs5_pad ($text, $blocksize) 
{ 
    $pad = $blocksize - (strlen($text) % $blocksize); 
    return $text . str_repeat(chr($pad), $pad); 
}

//requires 'mcrypt'
$cipher = mcrypt_module_open(MCRYPT_RIJNDAEL_128, '', MCRYPT_MODE_CBC, '');
$iv_size = mcrypt_enc_get_iv_size($cipher);

//		AES Key        : 'd2cb415e067c7b13'
//		AES IV         : 'e36dc751d0433f05'
//		HMAC KEY       : 'd6cfaad283353507'
//		Ciphertext(b64): 'Ru7RLA4o+iQZNJXBx0iXtgWSQuV8/uqj6R6M59egKfHhaBFuMTl9Mpsb4yx6\nkgokQAf1HUcLg32zGCPo8bH4Df5RUPXWSUfHNb3cR7Mf5I8=\n'
//		HMACb16        : '0f291f903f6abc951084bedb2210f48b30c4eb3e1bcce99b0967c5fda99d72a6'

// How do you do 256-bit AES encryption in PHP vs. 128-bit AES encryption???
// The answer is:  Give it a key that's 32 bytes long as opposed to 16 bytes long.
// We're using 16 bytes:
$key128   = "d2cb415e067c7b13";
$iv       = "e36dc751d0433f05";
$hmac_key = "d6cfaad283353507";

// This is the plain-text to be encrypted:
$cleartext = "s_hostname:jonasnuts.blogs.sapo.pt OR s_hostname:jonasnuts.com;1350305502";
$cleartext = pkcs5_pad($cleartext, mcrypt_get_block_size('des','cbc'));

printf("plainText: %s\n\n",$cleartext);
	
// The mcrypt_generic_init function initializes the cipher by specifying both
// the key and the IV.  The length of the key determines whether we're doing
// 128-bit, 192-bit, or 256-bit encryption.  
// Let's do 256-bit encryption here:
// Now let's do 128-bit encryption:
if (mcrypt_generic_init($cipher, $key128, $iv) != -1) {
	// PHP pads with NULL bytes if $cleartext is not a multiple of the block size..
	printf("len: %d", strlen($cleartext));
	$cipherText = mcrypt_generic($cipher, $cleartext );
	mcrypt_generic_deinit($cipher);
	
	// Display the result in hex.
	$b64ciphertext = base64_encode($cipherText);

	printf("Ciphertext(b64): %s (%d chars)\n", $b64ciphertext, strlen($b64ciphertext));
	printf("hmac (hex)     : %s\n\n", hash_hmac('sha256', $cipherText, $hmac_key));
}
?>

cipher.rb

require 'openssl'
require 'digest/sha2'
require 'base64'

def digest(str)	
	Digest::MD5.hexdigest(str)[0...16]
end

#set up message to be encrypted
message   = "s_hostname:jonasnuts.blogs.sapo.pt OR s_hostname:jonasnuts.com;1350305502"
cipher = OpenSSL::Cipher.new('aes-128-cbc')

# digest the key, iv and hmac_key so we have 16-byte length 
# also, it looks more of a funky password
aes_key = digest 'my passphrase'
aes_iv  = digest 'my random iv'
hmac_key= digest 'my hmac key'

# prepare cipher
cipher.encrypt
cipher.key = aes_key
cipher.iv = aes_iv

encrypted = cipher.update(message) << cipher.final()
#encrypted << cipher.final()
b64_encoded = Base64.strict_encode64(encrypted).encode('utf-8') #strict_encode64 guarantees no newlines, encode64 is default
hashb16  = OpenSSL::HMAC.hexdigest('sha256', hmac_key, encrypted)

puts "AES Key        : #{aes_key}"
puts "AES IV         : #{aes_iv}"
puts "HMAC KEY       : #{hmac_key}"
puts "Ciphertext(b64): #{b64_encoded} (#{b64_encoded.length} chars)"
puts "HMACb16        : #{hashb16}"

web400.php

<html>
<head>
    <title>Moo.</title>
</head>
<body>
<h1>Welcome!</h1>
<?php

define('MY_AES_IV', CENSORED);
define('MY_AES_KEY', CENSORED);
define('MY_HMAC_KEY', CENSORED);
define("FLAG","CENSORED");

function aes($data, $encrypt) {
    $aes = mcrypt_module_open(MCRYPT_RIJNDAEL_128, '', MCRYPT_MODE_CBC, '');
    mcrypt_generic_init($aes, MY_AES_KEY, MY_AES_IV);
    return $encrypt ? mcrypt_generic($aes, $data) : mdecrypt_generic($aes, $data);
}

define('MY_MAC_LEN', 40);

function hmac($data) {
    return hash_hmac('sha1', data, MY_HMAC_KEY);
}

function encrypt($data) {
    return aes($data . hmac($data), true);
}

function decrypt($data) {
    $data = rtrim(aes($data, false), "\0");
    $mac = substr($data, -MY_MAC_LEN);
    $data = substr($data, 0, -MY_MAC_LEN);
    return hmac($data) === $mac ? $data : null;
}

$settings = array();
if (@$_COOKIE['settings']) {
    $settings = @unserialize(@decrypt(base64_decode($_COOKIE['settings'])));
} 

if (@$_POST['name'] && is_string($_POST['name']) && strlen($_POST['name']) < 200) {
    
    $settings = array(
            'name' => $_POST['name'], 
            'greeting' => ('cowsay ' . escapeshellarg("Hello {$_POST['name']}!")),
    );

    setcookie('settings', base64_encode(@encrypt(serialize($settings))));
}

if (@$settings['greeting']) {
    echo "<pre>\n";
    passthru($settings['greeting']);
    echo "</pre>\n";
} else {
    echo "<form action=\"?\" method=\"POST\">\n";
    echo "<p>What is your name?</p>\n";
    echo "<input type=\"text\" name=\"name\" />\n";
    echo "<input type=\"submit\" name=\"submit\" value=\"Submit\" />\n";
    echo "</form>\n";
}

?>
</body>
</html>