Chosen-Plaintext Attacks

token = ECB("TryHackMe" + username + "TryHackMe")

Ciphertext: 92878b56ece593605c6108b7e62a08457d05ebd1dc98423dc6399c0bcd6903bb

from Crypto.Cipher import AES
from bs4 import BeautifulSoup
import binascii
import requests

### Variables ###

URL = "http://MACHINE_IP:5000/oracle"  #CAMBIA ESTO

BLOCK_SIZE = 0

### Oracle Interface ###

def chat_to_oracle(username):
    r = requests.post(URL, data = {'username' : username})
    #Parse the response
    soup = BeautifulSoup(r.text, 'html.parser')
    #Find the encrypted text
    value = str(soup.find(id='encrypted-result').find('strong'))
    #Extract the value
    value = value.replace('<strong>', '').replace('</strong>', '')

    return value

### Calculate Block Size ###

def calculate_block_size():
    #To calculate the block size, we need to keep sending a large username value until the ciphertext length grows twice

    #Get the initial ciphertext length
    username = "A"
    original_length = len(chat_to_oracle(username))

    #Now grow the username until the length becomes larger, keeping count
    first_change_len = 1
    while (len(chat_to_oracle(username)) == original_length):
        username += "A"
        first_change_len += 1

    print ("First growth was at position: " + str(first_change_len))

    #Get the new length
    new_length = len(chat_to_oracle(username))

    #Now grow the username a second time
    second_change_len = first_change_len
    while (len(chat_to_oracle(username)) == new_length):
         username += "A"
         second_change_len += 1

    print ("Second growth was at position: " + str(second_change_len))

    #With these two values, we can now determine the block size:
    BLOCK_SIZE = second_change_len - first_change_len

    print ("BLOCK_SIZE is: " + str(BLOCK_SIZE))

    return BLOCK_SIZE

def split_ciphertext(ciphertext, block_size):
    #This helper function will take the ciphertext and split it into blocks of the known block size
    #Times two since we have two hex for each char
    block_size = block_size * 2
    chunks = [ ciphertext[i:i+block_size] for i in range(0, len(ciphertext), block_size) ]
    return chunks

### Calculate the Offset ###

def calculate_offset(block_size):
    #To calculate the offset, we will send known text for double the block size and then gradually grow the text until we get two blocks that are the same

    #Create the initial double block size buffer
    initial_text = ""
    for x in range(block_size * 2):
        initial_text += "A"

    #Send this buffer to get the initial ciphertext
    ciphertext = chat_to_oracle(initial_text)

    chunks = split_ciphertext(ciphertext, block_size)

    #Ensure that there are no duplicates already, since this would indicate that there is no offet

    if (len(chunks) != len(set(chunks))):
        print ("No offset found!")
        offset = 0
        return offset

    #If we got here, there is an offet. We will slowly add more text to the start of the username until we get a duplicate
    offset = 0
    while (len(chunks) == len(set(chunks))):
        offset += 1
        #Increment the text by one
        initial_text = "B" + initial_text

        ciphertext = chat_to_oracle(initial_text)
        chunks = split_ciphertext(ciphertext, block_size)

    #Once we exit the loop, it means we have a duplicate chunk and have determined the offset

    print ("Offset is: " + str(offset))

    return offset

### Extract information from the Oracle ###
def brute_forcer(reference_chunk, initial_text, block_size, offset):
    #Character list can be adapted if we expect other characters as well. We could have done the full 0x00 - 0xFF range, but will stay with ASCII for this attack
    charlist = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ'

    actual_char = ''
    found = False

    for char in charlist:
        print ('Testing character: ' + str(char))
        test_text = initial_text + char

        ciphertext = chat_to_oracle(test_text)
        chunks = split_ciphertext(ciphertext, block_size)

        #Test to see if our chunk matches the reference chunk
        if (reference_chunk == chunks[1]):
            print ("Found the char: " + char)
            actual_char = char
            found = True
            break

    if found:
        return char
    else:
        return None

def extract_first_byte(block_size, offset):
    #Now that we have both the block_size and the offset, we are ready to stage our attack. We will showcase how to do this for a single bit. Then the process has to repeat.

    #To start, we will craft our initial text.
    initial_text = ""

    #First we need to take care of the offset
    for x in range(offset):
        initial_text += "B"

    #Now we want to populate the rest of the text up to the block size except for the last byte
    for x in range(block_size - 1):
        initial_text += "A"

    #Now let's chat to the oracle and get our reference chunk
    ciphertext = chat_to_oracle(initial_text)
    chunks = split_ciphertext(ciphertext, block_size)

    #Our reference chunk will be the second chunk since we have an offset
    reference_chunk = chunks[1]

    print ("Reference chunk is: " + str(reference_chunk))

    #Now we can start the brute force
    char = brute_forcer(reference_chunk, initial_text, block_size, offset)
    return char

if __name__ == '__main__':

    #Send a message to the oracle and print the ciphertest
    print ("Testing the oracle")
    ciphertext = chat_to_oracle("SuperUser")
    print("Ciphertext for the username of SuperUser is: " + ciphertext)

    #Calculate the block size from the oracle
    print ("Calculating the block size")
    size = calculate_block_size()
    print ("Block size is: " + str(size))

    #Calculate the offset from the oracle
    print ("Calculating the offset")
    offset = calculate_offset(size)
    print ("Offset is: " + str(offset))

    #Brute force the first char
    print ("Brute forcing a single character")
    char = extract_first_byte(size, offset)

def chat_to_oracle(username):
    r = requests.post(URL, data = {'username' : username})
    #Parse the response
    soup = BeautifulSoup(r.text, 'html.parser')
    #Find the encrypted text
    value = str(soup.find(id='encrypted-result').find('strong'))
    #Extract the value
    value = value.replace('', '').replace('', '')
    return value

def calculate_block_size():
    #Get the initial ciphertext length
    username = "A"
    original_length = len(chat_to_oracle(username))
    #Now grow the username until the length becomes larger, keeping count
    first_change_len = 1
    while (len(chat_to_oracle(username)) == original_length):
        username += "A"
        first_change_len += 1
    print ("First growth was at position: " + str(first_change_len))
    #Get the new length
    new_length = len(chat_to_oracle(username))
    #Now grow the username a second time
    second_change_len = first_change_len
    while (len(chat_to_oracle(username)) == new_length):
         username += "A"
         second_change_len += 1
    print ("Second growth was at position: " + str(second_change_len))
    #With these two values, we can now determine the block size:
    BLOCK_SIZE = second_change_len - first_change_len
    print ("BLOCK_SIZE is: " + str(BLOCK_SIZE))
    return BLOCK_SIZE

def split_ciphertext(ciphertext, block_size):
    #This helper function will take the ciphertext and split it into blocks of the known block size
    #Times two since we have two hex for each char
    block_size = block_size * 2
    chunks = [ ciphertext[i:i+block_size] for i in range(0, len(ciphertext), block_size) ]
    return chunks

def calculate_offset(block_size):
    #To calculate the offset, we will send known text for double the block size and then gradually grow the text until we get two blocks that are the same
    #Create the initial double block size buffer
    initial_text = ""
    for x in range(block_size * 2):
        initial_text += "A"
    #Send this buffer to get the initial ciphertext
    ciphertext = chat_to_oracle(initial_text)
    chunks = split_ciphertext(ciphertext, block_size)
    #Ensure that there are no duplicates already, since this would indicate that there is no offset
    if (len(chunks) != len(set(chunks))):
        print ("No offset found!")
        offset = 0
        return offset
    #If we got here, there is an offset. We will slowly add more text to the start of the username until we get a duplicate
    offset = 0
    while (len(chunks) == len(set(chunks))):
        offset += 1
        #Increment the text by one
        initial_text = "B" + initial_text
        ciphertext = chat_to_oracle(initial_text)
        chunks = split_ciphertext(ciphertext, block_size)
    #Once we exit the loop, it means we have a duplicate chunk and have determined the offset
    print ("Offset is: " + str(offset))
    return offset

def extract_first_byte(block_size, offset):
    #Now that we have both the block_size and the offset, we are ready to stage our attack. We will showcase how to do this for a single bit. Then the process has to repeat.
    #To start, we will craft our initial text.
    initial_text = ""
    #First we need to take care of the offset
    for x in range(offset):
        initial_text += "B"
    #Now we want to populate the rest of the text up to the block size except for the last byte
    for x in range(block_size - 1):
        initial_text += "A"
    #Now let's chat to the oracle and get our reference chunk
    ciphertext = chat_to_oracle(initial_text)
    chunks = split_ciphertext(ciphertext, block_size)
    #Our reference chunk will be the second chunk since we have an offset
    reference_chunk = chunks[1]
    print ("Reference chunk is: " + str(reference_chunk))
    #Now we can start the brute force
    char = brute_forcer(reference_chunk, initial_text, block_size, offset)
    return char

#!/usr/bin/env python3

import argparse
import requests
from bs4 import BeautifulSoup
import string
import sys

# =========================
# Argument parsing
# =========================
def parse_args():
    parser = argparse.ArgumentParser(
        description="ECB byte-at-a-time oracle attacker with unknown prefix support"
    )

    parser.add_argument(
        "-u", "--url",
        required=True,
        help="Oracle URL, e.g. http://127.0.0.1:5000/oracle"
    )

    parser.add_argument(
        "-p", "--param",
        default="username",
        help="POST parameter name to send controlled input (default: username)"
    )

    parser.add_argument(
        "-s", "--selector",
        default="#encrypted-result strong",
        help='CSS selector to extract ciphertext from HTML (default: "#encrypted-result strong")'
    )

    parser.add_argument(
        "-m", "--method",
        choices=["POST", "GET"],
        default="POST",
        help="HTTP method to use (default: POST)"
    )

    parser.add_argument(
        "--max-bytes",
        type=int,
        default=128,
        help="Maximum number of bytes/chars to recover (default: 128)"
    )

    parser.add_argument(
        "--charset",
        choices=["printable", "letters", "alnum", "all"],
        default="printable",
        help="Charset to use for brute force (default: printable)"
    )

    parser.add_argument(
        "--custom-charset",
        default=None,
        help="Custom charset string. Overrides --charset"
    )

    parser.add_argument(
        "--test-value",
        default="SuperUser",
        help='Value used for initial oracle test (default: "SuperUser")'
    )

    parser.add_argument(
        "--timeout",
        type=float,
        default=10.0,
        help="HTTP timeout in seconds (default: 10)"
    )

    parser.add_argument(
        "-v", "--verbose",
        action="store_true",
        help="Verbose mode"
    )

    return parser.parse_args()

# =========================
# Charset helper
# =========================
def get_charset(args):
    if args.custom_charset is not None:
        return args.custom_charset

    if args.charset == "letters":
        return string.ascii_letters
    elif args.charset == "alnum":
        return string.ascii_letters + string.digits
    elif args.charset == "all":
        return ''.join(chr(i) for i in range(256))
    else:
        return string.printable

# =========================
# Oracle client
# =========================
class OracleClient:
    def __init__(self, url, param, selector, method="POST", timeout=10.0, verbose=False):
        self.url = url
        self.param = param
        self.selector = selector
        self.method = method.upper()
        self.timeout = timeout
        self.verbose = verbose
        self.session = requests.Session()

    def query(self, controlled_value: str) -> str:
        data = {self.param: controlled_value}

        try:
            if self.method == "POST":
                r = self.session.post(self.url, data=data, timeout=self.timeout)
            else:
                r = self.session.get(self.url, params=data, timeout=self.timeout)

            r.raise_for_status()
        except requests.RequestException as e:
            print(f"[!] HTTP error: {e}", file=sys.stderr)
            sys.exit(1)

        soup = BeautifulSoup(r.text, "html.parser")
        element = soup.select_one(self.selector)

        if element is None:
            print(
                f'[!] Could not find ciphertext with selector: {self.selector}',
                file=sys.stderr
            )
            sys.exit(1)

        value = element.text.strip()

        if self.verbose:
            print(f"[DEBUG] Oracle input={controlled_value!r} output={value!r}")

        return value

# =========================
# Helpers
# =========================
def split_ciphertext(ciphertext: str, block_size: int):
    hex_block_size = block_size * 2
    return [ciphertext[i:i + hex_block_size] for i in range(0, len(ciphertext), hex_block_size)]

def find_duplicate_block_index(blocks):
    seen = {}
    for i, b in enumerate(blocks):
        if b in seen:
            return seen[b]
        seen[b] = i
    return None

# =========================
# Discovery functions
# =========================
def calculate_block_size(oracle: OracleClient):
    original_length = len(oracle.query("A"))

    username = "A"
    first_change_len = 1
    while len(oracle.query(username)) == original_length:
        username += "A"
        first_change_len += 1

    new_length = len(oracle.query(username))

    second_change_len = first_change_len
    while len(oracle.query(username)) == new_length:
        username += "A"
        second_change_len += 1

    block_size = second_change_len - first_change_len
    print(f"[+] First growth at: {first_change_len}")
    print(f"[+] Second growth at: {second_change_len}")
    print(f"[+] BLOCK_SIZE: {block_size}")
    return block_size

def calculate_prefix_info(oracle: OracleClient, block_size: int):
    marker = "A" * (block_size * 2)

    for pad_len in range(block_size):
        payload = "B" * pad_len + marker
        ciphertext = oracle.query(payload)
        blocks = split_ciphertext(ciphertext, block_size)

        dup_idx = find_duplicate_block_index(blocks)
        if dup_idx is not None:
            print(f"[+] Prefix alignment pad: {pad_len}")
            print(f"[+] First fully controlled block index: {dup_idx}")
            return pad_len, dup_idx

    raise RuntimeError("Could not determine prefix alignment")

# =========================
# Attack
# =========================
def decrypt_secret(oracle: OracleClient, block_size: int, prefix_pad_len: int,
                   controlled_block_index: int, max_bytes: int, charset: str):
    recovered = ""

    for _ in range(max_bytes):
        pad_to_end = block_size - 1 - (len(recovered) % block_size)

        alignment_prefix = "B" * prefix_pad_len
        attack_prefix = "A" * pad_to_end

        payload = alignment_prefix + attack_prefix
        ciphertext = oracle.query(payload)
        blocks = split_ciphertext(ciphertext, block_size)

        target_block_index = controlled_block_index + (len(recovered) // block_size)
        if target_block_index >= len(blocks):
            print("[*] Reached end of ciphertext blocks")
            break

        reference_block = blocks[target_block_index]
        found = False

        for ch in charset:
            guess = alignment_prefix + attack_prefix + recovered + ch
            guess_ct = oracle.query(guess)
            guess_blocks = split_ciphertext(guess_ct, block_size)

            if guess_blocks[target_block_index] == reference_block:
                recovered += ch
                print(f"[+] Recovered so far: {repr(recovered)}")
                found = True
                break

        if not found:
            print("[*] No matching character found. Probably reached padding/end or charset incomplete.")
            break

    return recovered

# =========================
# Main
# =========================
def main():
    args = parse_args()
    charset = get_charset(args)

    oracle = OracleClient(
        url=args.url,
        param=args.param,
        selector=args.selector,
        method=args.method,
        timeout=args.timeout,
        verbose=args.verbose
    )

    print("[*] Testing oracle...")
    test = oracle.query(args.test_value)
    print(f"[+] Ciphertext({args.test_value}): {test}")

    print("\n[*] Calculating block size...")
    block_size = calculate_block_size(oracle)

    print("\n[*] Calculating prefix alignment info...")
    prefix_pad_len, controlled_block_index = calculate_prefix_info(oracle, block_size)

    print("\n[*] Decrypting secret...")
    secret = decrypt_secret(
        oracle=oracle,
        block_size=block_size,
        prefix_pad_len=prefix_pad_len,
        controlled_block_index=controlled_block_index,
        max_bytes=args.max_bytes,
        charset=charset
    )

    print("\n[+] Final recovered secret:")
    print(repr(secret))

if __name__ == "__main__":
    main()