diff --git a/receiver/challenges/Sheesh.py b/receiver/challenges/Sheesh.py index 5c67d62..903481f 100644 --- a/receiver/challenges/Sheesh.py +++ b/receiver/challenges/Sheesh.py @@ -5,7 +5,6 @@ import time import re import os import binascii -import secrets class Sheesh(Challenge): flag_location = 'flags/sheesh.txt' @@ -34,7 +33,7 @@ class Sheesh(Challenge): bufsize=0, ) - def _read_exact_line(self, proc, timeout=6.0): + def _read_exact_line(self, proc, timeout=5.0): start = time.time() buf = [] r = proc.stdout.read @@ -48,7 +47,7 @@ class Sheesh(Challenge): if ch == "\n": return "".join(buf) - def _read_until_prompt(self, proc, token: str, timeout=6.0): + def _read_until_prompt(self, proc, token: str, timeout=5.0): start = time.time() acc = [] r = proc.stdout.read @@ -73,36 +72,6 @@ class Sheesh(Challenge): assert self._HEX_RE.match(hx), f"{label} is not hex" return hx - def test1(self, proc, b16_hex: str) -> str: - assert len(b16_hex) == 32 - self._read_until_prompt(proc, "inp: ", timeout=6.0) - self._send_line(proc, b16_hex) - line = self._read_exact_line(proc, timeout=4.0) - assert line.startswith("blk:"), "Expected blk: for 16-byte input" - hx = self._expect_hex_field(line, "blk") - # chall prints an extra blank line after blk: - _ = self._read_exact_line(proc, timeout=4.0) - return hx.lower() - - def test2(self, proc, iv_hex: str, ct_hex: str) -> str: - self._read_until_prompt(proc, "inp: ", timeout=6.0) - self._send_line(proc, iv_hex + ct_hex) - ans = self._read_exact_line(proc, timeout=4.0).strip().lower() - assert ans in ("ok", "zzz"), "Padding oracle did not return ok/zzz" - return ans - - def test3(self, proc, iv_hex: str, ct_hex: str, trials=9) -> tuple[int, int, str]: - ok_cnt = 0 - zzz_cnt = 0 - for _ in range(trials): - ans = self.test2(proc, iv_hex, ct_hex) - if ans == "ok": - ok_cnt += 1 - else: - zzz_cnt += 1 - final = "ok" if ok_cnt > zzz_cnt else "zzz" - return ok_cnt, zzz_cnt, final - def distribute(self, flag): try: os.makedirs(os.path.dirname(self.flag_location), exist_ok=True) @@ -121,6 +90,7 @@ class Sheesh(Challenge): def check(self): try: + # parity check: host vs container flag with open(self.flag_location, 'r') as f: host_flag = f.read().strip() container_flag = self._read_container_flag() @@ -129,9 +99,9 @@ class Sheesh(Challenge): proc = self._spawn() - line1 = self._read_exact_line(proc, timeout=6.0) - line2 = self._read_exact_line(proc, timeout=6.0) - blank = self._read_exact_line(proc, timeout=6.0) + line1 = self._read_exact_line(proc, timeout=5.0) + line2 = self._read_exact_line(proc, timeout=5.0) + blank = self._read_exact_line(proc, timeout=5.0) assert line1.startswith("iv:") and line2.startswith("ct:"), "Missing banner" iv_hex = self._expect_hex_field(line1, "iv") ct_hex = self._expect_hex_field(line2, "ct") @@ -140,40 +110,58 @@ class Sheesh(Challenge): assert len(iv0) == 16 and len(ct0) >= 16 and len(ct0) % 16 == 0, "Bad banner sizes" self.logger.info("[ok] banner parsed") - block00 = "00" * 16 - blk1 = self.test1(proc, block00) - blk2 = self.test1(proc, block00) - blk3 = self.test1(proc, block00) - assert blk1 == blk2 == blk3, "ECB-masked oracle not deterministic for same input" - self.logger.info("[ok] blk determinism (3x same input)") + self._read_until_prompt(proc, "blob: ", timeout=5.0) - block01 = "01" * 16 - blk4 = self.test1(proc, block01) - assert blk4 != blk1, "ECB-masked oracle returned same block for different input" + qA = "00" * 16 + self._send_line(proc, qA) + lA = self._read_exact_line(proc, timeout=3.0) + assert lA.startswith("blk:"), "Expected blk: for 16-byte blob" + blk1 = self._expect_hex_field(lA, "blk") + _ = self._read_exact_line(proc, timeout=3.0) + + self._read_until_prompt(proc, "blob: ", timeout=5.0) + self._send_line(proc, qA) + lA2 = self._read_exact_line(proc, timeout=3.0) + blk2 = self._expect_hex_field(lA2, "blk") + _ = self._read_exact_line(proc, timeout=3.0) + assert blk1 == blk2, "ECB-masked oracle not deterministic for same input" + self.logger.info("[ok] blk determinism") + + self._read_until_prompt(proc, "blob: ", timeout=5.0) + qB = "01" * 16 + self._send_line(proc, qB) + lB = self._read_exact_line(proc, timeout=3.0) + blk3 = self._expect_hex_field(lB, "blk") + _ = self._read_exact_line(proc, timeout=3.0) + assert blk3 != blk1, "ECB-masked oracle returned same block for different input" self.logger.info("[ok] blk diversity") - self._read_until_prompt(proc, "inp: ", timeout=6.0) - self._send_line(proc, "zzzz") # invalid hex - line_err = self._read_exact_line(proc, timeout=4.0) + self._read_until_prompt(proc, "blob: ", timeout=5.0) + self._send_line(proc, "zzzz") # invalid hex + line_err = self._read_exact_line(proc, timeout=3.0) assert "err" in line_err.lower(), "Expected 'err' for non-hex input" - maybe_hmmm = self._read_exact_line(proc, timeout=4.0).strip().lower() - if "hmmm" not in maybe_hmmm: - self.logger.warning(f"[warn] expected 'hmmm' after err, got: {maybe_hmmm!r}") - self.logger.info("[ok] error handling on non-hex input") + self.logger.info("[ok] error handling on non-hex") - ok_cnt, zzz_cnt, final = self.test3(proc, iv_hex, ct_hex, trials=9) - self.logger.info(f"[ok] padding oracle responded on banner (ok={ok_cnt}, zzz={zzz_cnt}, final={final})") + self._read_until_prompt(proc, "blob: ", timeout=5.0) + self._send_line(proc, (iv_hex + ct_hex)) + ans1 = self._read_exact_line(proc, timeout=3.0).strip().lower() + assert ans1 in ("ok", "no"), "Padding oracle did not return ok/no for iv||ct" + self.logger.info(f"[ok] padding oracle responds ({ans1}) on banner bundle") - iv_synth = secrets.token_hex(16) - ct_synth = "00" * (6 * 16) # 6 blocks - ok_cnt2, zzz_cnt2, final2 = self.test3(proc, iv_synth, ct_synth, trials=9) - self.logger.info(f"[ok] padding oracle responded on synthetic (ok={ok_cnt2}, zzz={zzz_cnt2}, final={final2})") + self._read_until_prompt(proc, "blob: ", timeout=5.0) + iv_synth = os.urandom(16).hex() + ct_synth = ("00" * (6 * 16)) + self._send_line(proc, iv_synth + ct_synth) + ans2 = self._read_exact_line(proc, timeout=3.0).strip().lower() + assert ans2 in ("ok", "no"), "Padding oracle did not return ok/no on synthetic 6-block ct" + self.logger.info(f"[ok] padding oracle responds ({ans2}) on synthetic payload") + + self._read_until_prompt(proc, "blob: ", timeout=5.0) - self._read_until_prompt(proc, "inp: ", timeout=6.0) proc.kill() self.logger.info('Check passed for sheesh') return True except Exception as e: self.logger.error(f'Could not check sheesh: {e}') - return False + return False \ No newline at end of file