pun1sher729

#include<stdio.h>       // For standard funtions
#include<stdlib.h>      // For exit function
#include<pthread.h>     // For thread functions
#include<ctype.h>
#include<string.h>

#define MAX 1000        // For RequestQueue Declaration

struct RQthread

pun1sher729

This is Zerologon attack.

Server side code:

#!/usr/bin/env python3

from Crypto.Cipher import AES
from Crypto.Util.number import bytes_to_long
from os import urandom

pun1sher729

It is CRIME sttack. https://shainer.github.io/crypto/2017/01/02/crime-attack.html

Code:

import requests
import json
import string

pun1sher729

This a weak key attack. (with a weak key encryption acts as decryption)

Tried mixing and matching the weak keys given on https://en.wikipedia.org/wiki/Weak_key

Code:

import requests
import json

pun1sher729

This is aes CBC encryption where the key and IV are same.

Code:

import requests
import json
from pwn import *

def encrypt(pt_hex):

pun1sher729

From the encryption code we can see that the counter will never increment, so the keystream will be constant since we are using ECB mode to get the keystream.

Decryption code:

import requests
import json

def get_encrypted():

pun1sher729

This is esentially a chosen plaintext attack

import requests
import json
from binascii import *
import string

def encrypted_flag():
 url = "http://aes.cryptohack.org/symmetry/encrypt_flag/"

pun1sher729

From cbc decryption: P0 = iv xor block_decryption(C0)

P0 --> "admin=False" P' --> "admin=True" (what we want)

"admin=True" = iv' xor block_decryption(C0)

pun1sher729

import requests
import json
from pwn import xor

def get_ciphertext():
    url = "http://aes.cryptohack.org/ecbcbcwtf/encrypt_flag/"
    r = requests.get(url)
    ct = (json.loads(r.text))['ciphertext']
 return ct

pun1sher729

Working Method:

from binascii import hexlify
import requests
import json
from string import printable

def encrypt(pt):
    p = hexlify(pt).decode()
    url = "http://aes.cryptohack.org/ecb_oracle/encrypt/"+p