1
import re
2
import socket
3
from hashlib import sha256
4

5
from Crypto.Cipher import AES
6

7
HOST = "20.244.7.184"
8
PORT = 7331
9

10
def must_match(pattern: str, data: str, flags: int = 0) -> re.Match[str]:
11
    match = re.search(pattern, data, flags)
12
    if match is None:
13
        raise ValueError(f"pattern not found: {pattern}")
14
    return match
15

16
def recv_until(sock: socket.socket, marker: bytes) -> bytes:
17
    data = b""
18
    while marker not in data:
19
        chunk = sock.recv(4096)
20
        if not chunk:
21
            break
22
        data += chunk
23
    return data
24

25
def parse_public(blob: str):
26
    p = int(must_match(r"^\s*p\s*=\s*(\d+)\s*$", blob, re.M).group(1))
27
    v = int(must_match(r"^\s*v\s*=\s*(\d+)\s*$", blob, re.M).group(1))
28
    iv = bytes.fromhex(must_match(r"^\s*iv\s*=\s*([0-9a-f]+)\s*$", blob, re.M).group(1))
29
    ciphertext = bytes.fromhex(
30
        must_match(r"^\s*ciphertext\s*=\s*([0-9a-f]+)\s*$", blob, re.M).group(1)
31
    )
32
    return p, v, iv, ciphertext
33

34
def parse_oracle_reply(blob: str):
35
    pretty = int(must_match(r"pretty_cabinet\s*=\s*(\d+)", blob).group(1))
36
    moet = int(must_match(r"moet_chandon\s*=\s*(\d+)", blob).group(1))
37
    return pretty, moet
38

39
def pkcs7_unpad(data: bytes) -> bytes:
40
    pad = data[-1]
41
    if pad < 1 or pad > 16 or data[-pad:] != bytes([pad]) * pad:
42
        raise ValueError("invalid PKCS#7 padding")
43
    return data[:-pad]
44

45
def main() -> None:
46
    with socket.create_connection((HOST, PORT), timeout=10) as sock:
47
        sock.settimeout(5)
48
        banner = recv_until(sock, b"q> ").decode(errors="replace")
49
        p, v, iv, ciphertext = parse_public(banner)
50

51
        print(f"[+] p bits: {p.bit_length()}")
52
        print(f"[+] v: {v}")
53
        print(f"[+] iv: {iv.hex()}")
54
        print(f"[+] ciphertext bytes: {len(ciphertext)}")
55

56
        moet_values = {}
57
        for q in range(1, 21):
58
            sock.sendall(f"{q}\n".encode())
59
            reply = recv_until(sock, b"q> ").decode(errors="replace")
60
            if "yawns" in reply or "Goodbye" in reply:
61
                break
62
            _, moet = parse_oracle_reply(reply)
63
            moet_values[q] = moet
64

65
    outer_key = sha256(str(moet_values[1]).encode()).digest()[:16]
66
    inner = AES.new(outer_key, AES.MODE_CBC, iv).decrypt(ciphertext)
67
    inner = pkcs7_unpad(inner)
68

69
    block_count = (len(inner) + 15) // 16
70
    stream = b"".join(
71
        sha256(str(moet_values[i]).encode()).digest()[:16]
72
        for i in range(1, block_count + 1)
73
    )
74

75
    plaintext = bytes(a ^ b for a, b in zip(inner, stream)).decode(errors="replace")
76
    flag_match = re.search(r"EH4X\{[^}]+\}", plaintext)
77
    if flag_match is None:
78
        raise RuntimeError(f"flag not found in plaintext: {plaintext!r}")
79

80
    print(f"[+] plaintext: {plaintext}")
81
    print(f"[+] FLAG: {flag_match.group(0)}")
82

83
if __name__ == "__main__":
84
    main()