Kripto Hujumlar va CTF Toolbox

1 Kriptografik Hujum Turlari

2 Padding Oracle Hujumi

# Padding Oracle konseptual misol
def padding_oracle_attack(ciphertext, oracle):
    # oracle(c) → True agar padding to'g'ri
    blocks = [ciphertext[i:i+16]
              for i in range(0, len(ciphertext), 16)]
    plaintext = b""

    for block_idx in range(1, len(blocks)):
        C_prev = bytearray(blocks[block_idx - 1])
        C_curr = blocks[block_idx]
        intermediate = bytearray(16)
        plain_block = bytearray(16)

        for byte_idx in range(15, -1, -1):
            pad_val = 16 - byte_idx
            modified = bytearray(C_prev)

            # Avvalgi topilgan baytlarni to'g'rilash
            for k in range(byte_idx + 1, 16):
                modified[k] = intermediate[k] ^ pad_val

            # Joriy baytni qidirish
            for guess in range(256):
                modified[byte_idx] = guess
                if oracle(bytes(modified) + C_curr):
                    intermediate[byte_idx] = guess ^ pad_val
                    plain_block[byte_idx] = intermediate[byte_idx] ^ C_prev[byte_idx]
                    break

        plaintext += bytes(plain_block)

    return plaintext  # PKCS7 padding olib tashlanadi

# Himoya: AES-GCM ishlatish (AEAD)
# Yoki: Encrypt-then-MAC sxemasi

3 Birthday Attack (Tug'ilgan kun paradoksi)

import hashlib, random, string

# Kichik hash uchun birthday attack demo (CTF misol)
def small_hash(data: bytes, bits: int = 24) -> bytes:
    # Faqat n-bit ishlatadigan zaif hash
    h = hashlib.sha256(data).digest()
    mask = (1 << bits) - 1
    val = int.from_bytes(h[:4], 'big') & mask
    return val.to_bytes(4, 'big')

def birthday_attack(bits: int = 24):
    seen = {}
    attempts = 0
    while True:
        msg = ''.join(random.choices(string.ascii_letters, k=8)).encode()
        h = small_hash(msg, bits)
        if h in seen and seen[h] != msg:
            print(f"Koliziya! '{seen[h].decode()}' == '{msg.decode()}'")
            print(f"Hash: {h.hex()}, Urinishlar: {attempts}")
            return
        seen[h] = msg
        attempts += 1

# 24-bit hash uchun ~2^12 ≈ 4096 urinish kutiladi
birthday_attack(24)

# Himoya: Etarli uzunlikdagi hash (≥256-bit), SHA-256, SHA-3

4 Hash Length Extension Hujumi

mac = sha256(SECRET + data)
# Hujumchi: data + padding + "&admin=true"
# Yangi to'g'ri MAC hisoblanadi!

# hashpump yoki hlextend bilan
# pip install hashpumpy
import hashpumpy

original_data = b"user=alice&role=user"
original_mac = "known_hash_value"
secret_len = 16  # Taxminiy, brute force qilinadi
append_data = b"&role=admin"

new_mac, new_data = hashpumpy.hashpump(
    original_mac,
    original_data,
    append_data,
    secret_len
)
print(f"Yangi MAC: {new_mac}")
print(f"Yangi data: {new_data}")

# ============================================
# HIMOYA: HMAC ishlatish!
# ============================================
import hmac, hashlib

# To'g'ri: HMAC-SHA256
def safe_mac(secret, data):
    return hmac.new(secret, data, hashlib.sha256).hexdigest()

# HMAC length extension hujumiga chidamli!
# HMAC(K, M) = H(K⊕opad || H(K⊕ipad || M))
# Ichki hash holati hujumchi uchun yopiq

5 Known/Chosen Plaintext Hujumlari

# Agar: C = P XOR K
# Va P bitta bayt ma'lum:
key_byte = cipher[i] ^ known_plain[i]
# Takrorlanuvchi kalit uchun:
for key_len in range(1, 40):
    key = [c[i] ^ p[i]
           for i in range(key_len)]

# Server: AES-ECB(your_input + secret)
# 1. Blok o'lchamini topish
for i in range(1, 64):
    c = oracle('A' * i)
    if len(c) > prev_len:
        block_size = len(c) - prev_len
        break

# 2. Har bir baytni topish
# oracle('A'*15) == oracle('A'*15 + secret[0])?
for byte in range(256):
    if oracle(prefix + chr(byte)) == target:
        secret_byte = byte; break

6 CTF Kripto Toolbox

from pwn import *
n = number.getPrime(512)
log.info(hex(n))

import gmpy2
root, exact = gmpy2.iroot(C, 3)  # cube root

from sympy import factorint, mod_inverse
from sympy.ntheory.modular import crt

# ============================================
# CTF Kripto: Universal Starter Template
# ============================================
from Crypto.Cipher import AES
from Crypto.PublicKey import RSA
from Crypto.Util.number import long_to_bytes, bytes_to_long
from Crypto.Util.Padding import unpad
import gmpy2, hashlib, base64
from sympy import factorint, mod_inverse

# RSA kalitdan n, e, d, p, q olish
def rsa_from_pem(pem_str):
    key = RSA.import_key(pem_str)
    return key.n, key.e, key.d, key.p, key.q

# RSA: n ni faktorlashtirish (kichik n uchun)
def factor_n(n):
    factors = factorint(n)
    if len(factors) == 2:
        p, q = list(factors.keys())
        return p, q
    raise ValueError("n ikki omilga ajralmadi")

# RSA: d ni tiklash
def recover_d(e, p, q):
    phi = (p - 1) * (q - 1)
    return int(mod_inverse(e, phi))

# RSA: deshifrlash
def rsa_decrypt(c, d, n):
    return long_to_bytes(pow(c, d, n))

# AES-ECB deshifrlash
def aes_ecb_decrypt(ct_hex, key_hex):
    ct = bytes.fromhex(ct_hex)
    key = bytes.fromhex(key_hex)
    cipher = AES.new(key, AES.MODE_ECB)
    pt = cipher.decrypt(ct)
    try:
        return unpad(pt, 16).decode()
    except:
        return pt

# XOR brute force
def xor_brute(ciphertext: bytes):
    for key in range(256):
        pt = bytes(b ^ key for b in ciphertext)
        if b"CTF{" in pt or b"flag{" in pt:
            print(f"Key={key}: {pt}")

# Multi-byte XOR crack (chastota tahlili bilan)
def xor_multi_crack(ct: bytes, key_len: int):
    key = []
    for i in range(key_len):
        block = bytes(ct[j] for j in range(i, len(ct), key_len))
        # E harfi (0x65) eng ko'p → XOR key byte
        freq = sorted(range(256), key=lambda k: block.count(k), reverse=True)
        key.append(freq[0] ^ 0x65)
    return bytes(key)

7 CTF Kripto Masalasi Checklist

Bilimni Sinash