加密算法与随机数

from Crypto.Cipher import AES
import os
import sys

filename = "C:\\Users\\82375\\Desktop\\1.bmp"

with open(filename, "rb") as f:
    bmp_data = f.read()

# 获取像素数据偏移量（注意：这里不要加逗号！）
offset = int.from_bytes(bmp_data[10:14], 'little')  # 去掉末尾逗号

# 分离头部和像素数据
header = bmp_data[:offset]  # 头部（包含文件头+信息头+调色板）
body = bmp_data[offset:]    # 实际的像素数据

# 补齐到16字节倍数（AES要求）
if len(body) % 16 != 0:
    body += b"\x00" * (16 - len(body) % 16)

# 用ECB模式加密图像数据
key = bytes.fromhex("00112233445566778899aabbccddeeff")
cipher = AES.new(key, AES.MODE_ECB)
encrypted_body = cipher.encrypt(body)

# 组合并保存
ecb_bmp = header + encrypted_body
output = filename.replace(".bmp", "-ecb.bmp")
with open(output, "wb") as f:
    f.write(ecb_bmp)
    
print(f"已生成: {output}")

from Crypto.Cipher import AES
from Crypto.Util.Padding import pad,unpad
import base64

# pad自动填充到16的倍数PKCS#7
# 密文用Base64编码方便传输。
KEY = b"0123456789abcdef"

def encrypt_cookie(data):
    cipher = AES.new(KEY,AES.MODE_ECB)
    ct = cipher.encrypt(pad(data.encode(),16))
    return base64.b64encode(ct).decode()

def decrypt_cookie(cookie):
    ct = base64.b64decode(cookie)
    cipher = AES.new(KEY,AES.MODE_ECB)
    pt = unpad(cipher.decrypt(ct),16).decode()
    return pt

# 注册用户“admin”,得到其cookie
admin_cookie = encrypt_cookie("user=admin&role=user")
admin_ct = base64.b64decode(admin_cookie)

# 注册用户attacker
attacker_cookie = encrypt_cookie("user=attacker&role=user")
attacker_ct = base64.b64decode(attacker_cookie)

# 分析块结构（打印16进制块）
# 这段代码将密文按16字节（32个十六进制字符）打印，方便观察块边界。
# 明文块划分（关键）：user=admin&role=user

print("Admin密文块：")
for i in range(0,len(admin_ct),16):
    print(f"块{i//16}:{admin_ct[i:i+16].hex()}")

print("Attacker密文块：")
for i in range(0,len(attacker_ct),16):
    print(f"块{i//16}:{attacker_ct[i:i+16].hex()}")

# 识别重复块——ECB特征
blocks = [admin_ct[i:i+16] for i in range (0, len(admin_ct), 16)]
for i, b in enumerate(blocks):
    for j,b2 in enumerate(blocks):
        if i < j and b == b2:
            print(f"\n[!]发现重复块：块{i} == 块{j} ->确认时ECB")

# 构造越权cookie
# 把admin的第二块（包含role信息）换到attacker的第二块
crafted_ct = attacker_ct[:16] + admin_ct[16:32]
crafted_cookie = base64.b64encode(crafted_ct).decode()
print(f"构造的Cookie:{crafted_cookie}")
print(f"解密后：{decrypt_cookie(crafted_cookie)}")

from Crypto.Cipher import AES
from Crypto.Util.Padding import pad

key = b"0123456789abcdef"
data = b"A" * 32

# 错误：固定IV
bad_iv = b"\x00" * 16
cipher1 = AES.new(key,AES.MODE_CBC,iv=bad_iv)
ct1 = cipher1.encrypt(pad(data, 16))

cipher2 = AES.new(key,AES.MODE_CBC,iv=bad_iv)
ct2 = cipher2.encrypt(pad(data, 16))

print(f"两次加密结果相同：{ct1 == ct2}")

# 正确：随机IV
import os
good_iv1 = os.urandom(16)
good_iv2 = os.urandom(16)
cipher3 = AES.new(key,AES.MODE_CBC,iv=good_iv1)
ct3 = cipher3.encrypt(pad(data, 16))

cipher4 = AES.new(key,AES.MODE_CBC,iv=good_iv2)
ct4 = cipher4.encrypt(pad(data, 16))

print(f"两次加密结果相同：{ct3 == ct4}")

from Crypto.Cipher import AES
from Crypto.Util.Padding import pad,unpad
import os

key = b"0123456789abcdef"
data = b"Hello World! This is a secret."

# 加密方
iv = os.urandom(16)         # 随机生成IV
cipher = AES.new(key, AES.MODE_CBC, iv = iv)
ct = cipher.encrypt(pad(data,16))

# 发送给解密方： IV + 密文
message = iv + ct           # 把密文拼接在前面
print(f"发送的数据长度：{len(message)}字节")

# 解密方
# 从消息中拆出IV和密文
received_iv = message[:16]  # 取前16字节
received_ct = message[16:]  # 剩下的都是密文

# 用同一个IV解密
cipher2 = AES.new(key, AES.MODE_CBC, iv=received_iv)
decrypted = unpad(cipher2.decrypt(received_ct),16)

print(f"解密结果：{decrypted.decode()}")

"""
padding_oracle_server.py
存在Padding Oracle漏洞的服务端模拟
"""
from Crypto.Cipher import AES
from Crypto.Util.Padding import unpad
from flask import Flask, request

app = Flask(__name__)
SERVER_KEY = b"0123456789abcdef"  # 攻击者不知道的密钥

@app.route('/decrypt')
def decrypt():
    iv_hex = request.args.get('iv', '')
    ct_hex = request.args.get('ciphertext', '')
    
    try:
        iv = bytes.fromhex(iv_hex)
        ct = bytes.fromhex(ct_hex)
        cipher = AES.new(SERVER_KEY, AES.MODE_CBC, iv=iv)
        plaintext = cipher.decrypt(ct)
        unpad(plaintext, 16)
        return "解密成功", 200
    except ValueError:
        return "填充错误", 500
    except Exception as e:
        return f"其他错误: {str(e)}", 500

if __name__ == '__main__':
    app.run(port=5000)

"""
padding_oracle_attack.py
针对上述漏洞服务器的完整攻击脚本
"""
import requests
from Crypto.Cipher import AES
from Crypto.Util.Padding import pad
import os

# === 配置 ===
TARGET_URL = "http://localhost:5000/decrypt"
SERVER_KEY = b"0123456789abcdef"  # 实际攻击中不知道，这里用于生成合法密文

# === 正常加密一个消息（模拟服务器，攻击中我们只有密文和IV） ===
original_plaintext = b"password=secret!"  # 我们想解密的目标
iv = os.urandom(16)
cipher = AES.new(SERVER_KEY, AES.MODE_CBC, iv=iv)
ct = cipher.encrypt(pad(original_plaintext, 16))

print(f"目标密文: {ct.hex()}")
print(f"IV: {iv.hex()}")
print(f"原始明文: {original_plaintext}")

# === Padding Oracle函数 ===
def oracle(test_iv_hex, test_ct_hex):
    """向服务器查询，返回True表示填充正确"""
    resp = requests.get(TARGET_URL, params={
        'iv': test_iv_hex,
        'ciphertext': test_ct_hex
    })
    return "解密成功" in resp.text

# === 攻击：解密一个密文块 ===
def decrypt_block(prev_block, target_block):
    """
    prev_block: 前一个密文块（或IV），bytes，16字节
    target_block: 要解密的密文块，bytes，16字节
    返回解密后的明文，bytes，16字节
    """
    plaintext = bytearray(16)
    
    for byte_pos in range(15, -1, -1):
        padding_value = 16 - byte_pos
        
        # 构造测试块
        test_block = bytearray(16)
        # 后面的字节已经知道，设置它们使解密后等于padding_value
        for i in range(byte_pos + 1, 16):
            test_block[i] = prev_block[i] ^ plaintext[i] ^ padding_value
        
        found = False
        for guess in range(256):
            test_block[byte_pos] = prev_block[byte_pos] ^ guess ^ padding_value
            
            if oracle(test_block.hex(), target_block.hex()):
                plaintext[byte_pos] = guess
                char = chr(guess) if 32 <= guess < 127 else '?'
                print(f"  位置 {byte_pos}: 0x{guess:02x} ('{char}')")
                found = True
                break
        
        if not found:
            # 处理填充歧义
            if byte_pos < 15:
                test_block[byte_pos + 1] ^= 1
                for guess in range(256):
                    test_block[byte_pos] = prev_block[byte_pos] ^ guess ^ padding_value
                    if oracle(test_block.hex(), target_block.hex()):
                        plaintext[byte_pos] = guess
                        print(f"  位置 {byte_pos}: 0x{guess:02x} (调整后)")
                        found = True
                        break
        if not found:
            print(f"  位置 {byte_pos}: 未找到!")
    
    return bytes(plaintext)

# === 执行攻击 ===
print("\n开始Padding Oracle攻击...")
print("逐字节解密密文块:")

recovered = decrypt_block(iv, ct[:16])
print(f"\n恢复的明文块: {recovered}")

# 去掉填充
from Crypto.Util.Padding import unpad
final_plaintext = unpad(recovered, 16)
print(f"最终明文: {final_plaintext}")