Task 5 Writeup

Task 5 - Putting it all together - (Cryptanalysis)

Description

NSA analysts confirm that there is solid evidence that this binary was at least part of what had been installed on the military development network. Unfortunately, we do not yet have enough information to update NSA senior leadership on this threat. We need to move forward with this investigation!

The team is stumped - they need to identify something about who was controlling this malware. They look to you. “Do you have any ideas?”

Prompt:

Submit the full URL to the adversary’s server

This time, we’ve given absolutely nothing to go off of. Of course, this means that the answer is somewhere inside the previous tasks. Looking back at the strings from Task 4, we don’t have a full URL, and the only IP address is in a private range, so it’s unlikely to be the answer.

1
str0: b'/opt/dafin/intel/ops_brief_redteam.pdf'
2
str1: b'DAFIN_SEC_PROFILE'
3
str2: b'/proc/cpuinfo'
4
str3: b'flags'
5
str4: b'hypervisor'
6
str5: b'systemd-detect-virt 2>/dev/null'
7
str6: b'r'
8
str7: b'none'
9
str8: b'203.0.113.42'
10
str9: b'GET /module HTTP/1.1'
11
str10: b'/tmp/'
12
str11: b'.'
13
str12: b'JoZ0To1QYoPN8y47'
14
str13: b'execute_module'

However, we haven’t exactly finished with the binary from Task 4. Looking at some of the other functions, we see a Comms class that seems to handle some form of encrypted communication, as well as tons of imports from OpenSSL used in these functions.

Comms class in binary

Comms class

Let’s start by looking at the constructor and modeling the appriopriate struct from the code.

1
int64_t Comms::Comms()
2
    int512_t zmm0
3
    zmm0.o = zx.o(0)
4
    int32_t* entry_rdi
5
    uint8_t* rbx = entry_rdi
6
    entry_rdi[0xe] = 0
7
    *(entry_rdi + 0x40) = 0
8
    *entry_rdi = 0xffffffff
9
    __builtin_memset(dest: &entry_rdi[5], ch: 0, count: 0x21)
10
    *(rbx + 0x48) = EVP_CIPHER_CTX_new(zmm0)
11
    *(rbx + 0x50) = EVP_CIPHER_CTX_new()
12
    *(rbx + 0x58) = EVP_CIPHER_CTX_new()
13
    *(rbx + 0x60) = EVP_CIPHER_CTX_new()
14
    Comms::gen_key(rbx, (&rbx[0x14]).d, 0x10)
15
    Comms::gen_key(rbx, (&rbx[0x24]).d, 0x10)
16
    rbx[0x34] = 1
17
    aes_init_enc(&rbx[0x14], *(rbx + 0x48))
18
    aes_init_enc(&rbx[0x24], *(rbx + 0x50))
19
    aes_init_dec(&rbx[0x14], *(rbx + 0x58))
20
    return aes_init_dec(&rbx[0x24], *(rbx + 0x60)) __tailcall

We can see 4 different EVP_CIPHER_CTX objects being created, likely for AES encryption and decryption. The gen_key function is called twice, which we can assume generates two different AES keys. Putting it all together, we get a struct like this:

1
int64_t Comms::Comms(struct Comms* this)
2
    this->__offset(0x38).d = 0
3
    this->__offset(0x40).q = 0
4
    this->__offset(0x0).d = 0xffffffff
5
    this->key_inited = false
6
    __builtin_memset(dest: &this->key1, ch: 0, count: 0x10)
7
    __builtin_memset(dest: &this->key2, ch: 0, count: 0x10)
8
    this->enc1 = EVP_CIPHER_CTX_new()
9
    this->enc2 = EVP_CIPHER_CTX_new()
10
    this->dec1 = EVP_CIPHER_CTX_new()
11
    this->dec2 = EVP_CIPHER_CTX_new()
12
    Comms::gen_key(this, &this->key1, 0x10)
13
    Comms::gen_key(this, &this->key2, 0x10)
14
    this->key_inited = true
15
    aes_init_enc(&this->key1, this->enc1)
16
    aes_init_enc(&this->key2, this->enc2)
17
    aes_init_dec(&this->key1, this->dec1)
18
    return aes_init_dec(&this->key2, this->dec2) __tailcall

The aes_init_enc and aes_init_dec functions simply initialize the AES contexts with the provided keys using AES-128-ECB mode.

1
int64_t aes_init_enc(int64_t arg1, int64_t arg2)
2
    int32_t result = EVP_EncryptInit_ex(arg2, EVP_aes_128_ecb(), 0, arg1, 0)
3
    if (result == 0)
4
        return puts(str: "error creating enc") __tailcall
5

6
    return result
7

8
int64_t aes_init_dec(int64_t arg1, int64_t arg2)
9
    int32_t result = EVP_DecryptInit_ex(arg2, EVP_aes_128_ecb(), 0, arg1, 0)
10
    if (result == 0)
11
        return puts(str: "error creating dec") __tailcall
12

13
    return result

Now let’s look at the gen_key function to see how the AES keys are generated.

1
uint64_t Comms::gen_key(struct Comms* comms, char* buf, uint32_t len)
2
    struct tcbhead_t* tcb
3
    uint64_t CANARY = tcb->stack_guard
4
    char dest[0x20]
5
    __builtin_memset(&dest, ch: 0, count: 0x20)
6
    generate_key(&dest, len: 0x20)
7
    uint32_t len_1 = 0x20
8

9
    if (len s<= 0x20)
10
        len_1 = len
11

12
    int64_t len_2 = sx.q(len_1)
13

14
    if (len_2 u>= 8)
15
        int64_t* rcx_2 = &buf[8] & 0xfffffffffffffff8
16
        *buf = dest[0].q
17
        void var_50
18
        *(buf + len_2 - 8) = *(&var_50 + len_2)
19
        void* rbp_1 = buf - rcx_2
20
        void* rdx_1 = (len_2 + rbp_1) & 0xfffffffffffffff8
21

22
        if (rdx_1 u>= 8)
23
            int64_t i = 0
24

25
            do
26
                *(rcx_2 + i) = *(&dest - rbp_1 + i)
27
                i += 8
28
            while (i u< (rdx_1 & 0xfffffffffffffff8))
10 collapsed lines
29
    else if ((len_2.b & 4) != 0)
30
        *buf = dest[0].d
31
        void var_4c
32
        *(buf + len_2 - 4) = *(&var_4c + len_2)
33
    else if (len_2 != 0)
34
        *buf = dest[0]
35
        void var_4a
36

37
        if ((len_2.b & 2) != 0)
38
            *(buf + len_2 - 2) = *(&var_4a + len_2)
39

40
    if (CANARY == tcb->stack_guard)
41
        return CANARY - tcb->stack_guard
42

43
    __stack_chk_fail()

Interestingly, even though the ciphers use AES-128, this function seems to generate 32 bytes of key material. However, only 16 bytes are copied out, as the len parameter passed in to this function is always 0x10.

This function calls generate_key, then everything below is essentially an inlined memcpy to copy the generated key into the provided buffer. Let’s look at generate_key.

1
uint64_t generate_key(uint128_t* buf, int32_t len)
2
    struct tcbhead_t* tcb
3
    uint64_t CANARY = tcb->stack_guard
4
    uint128_t tmp[0x2]
5
    tmp[0] = zx.o(0)
6
    tmp[1] = zx.o(0)
7
    int64_t var_63
8
    __builtin_strncpy(dest: &var_63, src: "ABCD123321", count: 0x2b)
9
    FILE* fp
10

11
    if (len == 0x20)
12
        fp = fopen(filename: "/dev/random", mode: "r")
13

14
    int32_t res
15

16
    if (len != 0x20 || fp == 0)
17
        res = -1
18
    else
19
        res = -1
20

21
        if (fread(buf, size: 1, count: 0x20, fp) == 0x20)
22
            res = 0
23
            int128_t hsh[0x2]
24
            HMAC(EVP_sha3_256(), &var_63, 0xb, buf, 0x20, &hsh, 0)
25
            int64_t zmm1_1 = (buf[1] ^ hsh[1]) u>> 64
26
            buf[1] = tmp[1]
27
            tmp[0].q = zmm1_1 u>> 38
28
            *buf = tmp[0]
29

30
        fclose(fp)
31

32
    if (CANARY == tcb->stack_guard)
33
        return zx.q(res)
34

35
    __stack_chk_fail()

The function first reads 32 bytes from /dev/random into the provided buffer, then computes an HMAC using SHA3-256 with the key “ABCD123321” and the random data as the message. The resulting hash is then modified and stored back into the buffer.

Interestingly, the final key clears the last 16 bytes buf[1] = tmp[1], and in the first 16 bytes, only stores the upper 26 bits of the HMAC result tmp[0].q = zmm1_1 u>> 38. This means that the effective key size is only 26 bits, with everything else being zeroed out. This is a very weak key, and we can brute-force it.

However, we don’t have any ciphertext to brute-force against yet. Let’s look at a few more of the Comms functions to see if we can find how the communication works.

After looking at several other Comms functions, we can follow their references up to a function that seems to handle full connections. The connect_to_server function sets up a connection to a server using a hostname and port.

1
uint64_t Comms::connect_to_server(struct Comms* comms, char* host, int32_t port)
2
    struct tcbhead_t* tcb
3
    uint64_t stack_guard = tcb->stack_guard
4
    comms->host = host
5
    comms->port = port
6
    int64_t var_26 = 0
7
    char** h_addr_list = gethostbyname(name: host)->h_addr_list
8
    int16_t addr = 2
9
    var_26:6.q = 0
10
    var_26:2.d = inet_addr(cp: inet_ntoa(in: **h_addr_list))
11
    var_26.w = rol.w(comms->port.w, 8)
12
    int32_t fd = socket(2, 1, 0)
13
    comms->__offset(0x0).d = fd
14

15
    if (connect(fd, &addr, len: 0x10) s< 0)
16
        comms->__offset(0x0).d = 0xffffffff
17

18
    if (Comms::full_handshake() == 1)
19
        exit(status: 1)
20

21
    if (stack_guard == tcb->stack_guard)
22
        return stack_guard - tcb->stack_guard
23

24
    __stack_chk_fail()

We also know now that the first element in the Comms struct is a file descriptor for the socket connection. The full_handshake function is called after connecting, so let’s look at that next.

1
int64_t Comms::full_handshake(struct Comms* comms)
2
    char* rsa_pubkey = Comms::recv_rsa_pubkey(comms)
3
    comms->__offset(0x40).q = rsa_pubkey
4

5
    if (rsa_pubkey != 0)
6
        int32_t rax = Comms::send_aes_keys(comms)
7
        free(ptr: comms->__offset(0x40).q)
8

9
        if (rax == 0)
10
            return Comms::application_handshake(comms) __tailcall
11

12
    return 1

The full_handshake function first receives an RSA public key from somewhere, then sends the AES keys, then finally does an application handshake. Given that the rsa_pubkey is immediately freed after sending the AES keys, it’s likely that this key is only used to encrypted the AES keys for secure transmission.

Let’s look at the first two functions:

1
char* Comms::recv_rsa_pubkey(struct Comms* comms)
13 collapsed lines
2
    int32_t* buf = calloc(nmemb: 1, size: 0x1000)
3
    int32_t recved = recv(comms->fd, buf, len: 0x1000, flags: 0)
4

5
    if (recved - 1 u> 0xffe || *buf != 0xc0dec0de || buf[1].w != 0xeeff)
6
        free(ptr: buf)
7
        return 0
8

9
    comms->__offset(0x38).d = recved - 6
10
    int64_t n = sx.q(recved - 6)
11
    char* result = malloc(n)
12
    __memcpy_chk(result, buf + 6, n, n)
13
    free(ptr: buf)
14
    return result
15

16
uint64_t Comms::send_aes_keys(struct Comms* comms)
50 collapsed lines
17
    char key2[0x10] = comms->key2
18
    struct tcbhead_t* tcb
19
    uint64_t CANARY = tcb->stack_guard
20
    uint64_t var_490 = 0
21
    char key1[0x10] = comms->key1
22
    char key2_1[0x10] = key2
23
    void buf
24
    __builtin_memset(dest: &buf, ch: 0, count: 0x400)
25
    int64_t var_488
26
    int64_t* var_4a0 = &var_488
27
    Comms::rsa_encrypt(&var_488, comms.d, &key1, 0x20)
28
    int64_t r14 = var_488
29
    int64_t var_480
30

31
    if (var_490 != var_480 - r14)
32
        class std::runtime_error* thrown_exception = __cxa_allocate_exception(thrown_size: 0x10)
33
        std::runtime_error::runtime_error(this: thrown_exception, __arg: "Error")
34
        tcb->stack_guard
35

36
        if (CANARY != tcb->stack_guard)
37
            __stack_chk_fail()
38
            noreturn
39

40
        __cxa_throw(thrown_exception, tinfo: _typeinfo_for_std::runtime_error,
41
            dest: std::runtime_error::~runtime_error)
42
        noreturn
43

44
    int64_t buf_1 = calloc(nmemb: 1, size: var_490 + 6)
45
    __memcpy_chk(buf_1, &data_40a141, 6, var_490 + 6)
46
    size_t rcx_2 = 6
47

48
    if (var_490 + 6 u>= 6)
49
        rcx_2 = var_490 + 6
50

51
    __memcpy_chk(buf_1 + 6, r14, var_490, rcx_2 - 6)
52
    send(comms->fd, buf: buf_1, len: var_490 + 6, flags: 0)
53
    free(ptr: buf_1)
54
    int32_t rax_3 = Comms::is_correct_response(comms, &buf,
55
        zx.q(recv(comms->fd, &buf, len: 0x400, flags: 0)), "KEY_RECEIVED")
56
    int64_t rdi_7 = var_488
57
    int32_t rbx_1
58
    rbx_1.b = rax_3 == 0
59

60
    if (rdi_7 != 0)
61
        operator delete(ptr: rdi_7)
62

63
    if (CANARY == tcb->stack_guard)
64
        return zx.q(rbx_1)
65

66
    __stack_chk_fail()

The recv_rsa_pubkey function receives data from the socket, checks for a magic value and some other conditions, then extracts the RSA public key from the received data. The send_aes_keys function encrypts the AES keys using RSA and sends them to the server, then waits for a confirmation response. We also see the first use of Comms::is_correct_response, which simply checks if the received response matches the expected string prepended with the same DEC0DEC0FFEE magic value.

1
bool Comms::is_correct_response(struct Comms* comms, char* buf, uint32_t buf_len, char* expected, int32_t expected_len)
2
    if (expected_len + 6 != buf_len)
3
        return 0
4

5
    if (*buf == 0xc0dec0de && *(buf + 4) == 0xeeff)
6
        return memcmp(&buf[6], expected, sx.q(expected_len)).d == 0
7

8
    return 0

Finally, we can look at the application_handshake function, which is called last in the full_handshake.

1
uint64_t Comms::application_handshake(struct Comms* comms)
2

3
    struct tcbhead_t* tcb
4
    uint64_t CANARY = tcb->stack_guard
5
    int32_t var_14 = 0
6
    int32_t rax_2
7
    rax_2.b = Comms::is_correct_response(comms, Comms::send_message(comms, "REQCONN", 7), 0,
8
        "REQCONN_OK", len: 0xa) == 0
9

10
    if (CANARY == tcb->stack_guard)
11
        return zx.q(rax_2.b)
12

13
    __stack_chk_fail()

This performs a very simple handshake by sending the message “REQCONN” and expecting “REQCONN_OK” in response. Let’s look at the send_message function to see how messages are sent.

1
char* Comms::send_message(struct Comms* comms, char* msg, int32_t len)
2
    int64_t len_1 = len
3
    struct tcbhead_t* tcb
4
    uint64_t CANARY = tcb->stack_guard
5
    struct vector vec
6
    vec.__offset(0x0).o = zx.o(0)
7
    vec.__offset(0x10).q = 0
8
    sub_406c20(&vec, nullptr, &data_40a141, &data_40a147)
9
    sub_406c20(&vec, vec.__offset(0x8).q, msg, &msg[len_1])
10
    int32_t sz_1 = (len_1 + 0x16).d
11
    int32_t var_490 = 0
12
    int64_t sz = sx.q(sz_1)
13

14
    if (sz_1 s< 0)
15

16
        if (CANARY == tcb->stack_guard)
17
            std::__throw_length_error(what: "cannot create std::vector larger than max_size()")
18
            noreturn
19
    else
19 collapsed lines
20
        int128_t var_460_1 = zx.o(0)
21
        char* buf_1
22

23
        if (sz == 0)
24
            int64_t var_468_1
25
            __builtin_memset(dest: &var_468_1, ch: 0, count: 0x18)
26
            buf_1 = nullptr
27
        else
28
            char* buf_2 = operator new(sz)
29
            void* rcx_1 = &buf_2[sz]
30
            char* buf_3 = buf_2
31
            buf_1 = buf_2
32
            var_460_1:8.q = rcx_1
33
            void* var_4a8_1 = rcx_1
34
            *buf_2 = 0
35

36
            if (sz != 1)
37
                memset(&buf_2[1], 0, sz - 1)
38

39
        int64_t r13_1 = vec.__offset(0x0).q
40
        custom_enc(comms->enc1, comms->enc2, r13_1, zx.q((len_1 + 6).d), buf_1, &var_490)
41
        send(comms->fd, buf: buf_1, len: sx.q(var_490), flags: 0)
42
        void buf
43
        int32_t flags = __builtin_memset(dest: &buf, ch: 0, count: 0x400)
44
        int32_t rax_1 = recv(comms->fd, &buf, len: 0x400, flags)
45
        int32_t var_48c = 0
46
        char* result = calloc(nmemb: 1, size: 0x400)
47
        custom_dec(comms->dec1, comms->dec2, &buf, zx.q(rax_1), result, &var_48c)
48
        int32_t* entry_rcx
49
        *entry_rcx = var_48c
50

51
        if (buf_1 != 0)
52
            operator delete(ptr: buf_1)
53

54
        if (r13_1 != 0)
55
            operator delete(ptr: r13_1)
56

57
        if (CANARY == tcb->stack_guard)
58
            return result
59

60
    __stack_chk_fail()

This is quite a bit more complicated, as it uses a std::vector to build the message, but essentially it prepends the magic value to the message, then calls custom_enc to encrypt the message using the two AES contexts, sends it over the socket, then waits for a response, decrypts it using custom_dec, and returns the decrypted response.

Let’s look at custom_enc and custom_dec to see how the encryption and decryption is done.

1
int64_t custom_enc(void* enc1, void* enc2, char* buf, int32_t len, char* out_buf, int32_t* out_len)
2
    struct tcbhead_t* tcb
3
    uint64_t CANARY = tcb->stack_guard
4
    int32_t enc1_len = len + 0x10
5
    char* ptr = malloc(n: sx.q(len + 0x10))
6
    aes_encrypt(enc1, buf, zx.q(len), ptr, &enc1_len)
7
    aes_encrypt(enc2, ptr, zx.q(enc1_len), out_buf, out_len)
8

9
    if (CANARY == tcb->stack_guard)
10
        return free(ptr) __tailcall
11

12
    __stack_chk_fail()
13

14
uint64_t aes_encrypt(void* enc_ctx, char* buf, int32_t buf_len, char* out_buf, int32_t* out_len)
20 collapsed lines
15
    struct tcbhead_t* tcb
16
    uint64_t CANARY = tcb->stack_guard
17

18
    if (EVP_EncryptInit_ex(enc_ctx, 0, 0, 0, 0) == 0)
19
        puts(str: "error using enc ctx")
20

21
    if (EVP_EncryptUpdate(enc_ctx, out_buf, out_len, buf, zx.q(buf_len)) == 0)
22
        puts(str: "error encrypting")
23

24
    int32_t padding
25

26
    if (EVP_EncryptFinal_ex(enc_ctx, &out_buf[sx.q(*out_len)], &padding) == 0)
27
        puts(str: "error finalizing encryption")
28

29
    *out_len += padding
30

31
    if (CANARY == tcb->stack_guard)
32
        return CANARY - tcb->stack_guard
33

34
    __stack_chk_fail()

1
int64_t custom_dec(void* dec1, void* dec2, char* enc, int32_t len, char* out_buf, int32_t* out_len)
2
    struct tcbhead_t* tcb
3
    uint64_t CANARY = tcb->stack_guard
4
    char* ptr = malloc(n: sx.q(len + 0x10))
5
    int32_t dec2_len = 0
6
    aes_decrypt(dec2, enc, zx.q(len), ptr, &dec2_len)
7
    aes_decrypt(dec1, ptr, zx.q(dec2_len), out_buf, out_len)
8

9
    if (CANARY == tcb->stack_guard)
10
        return free(ptr) __tailcall
11

12
    __stack_chk_fail()
13

14
uint64_t aes_decrypt(void* dec_ctx, char* buf, int32_t len, char* out_buf, int32_t* out_len)
20 collapsed lines
15
    struct tcbhead_t* tcb
16
    uint64_t CANARY = tcb->stack_guard
17

18
    if (EVP_DecryptInit_ex(dec_ctx, 0, 0, 0, 0) == 0)
19
        puts(str: "error using dec")
20

21
    if (EVP_DecryptUpdate(dec_ctx, out_buf, out_len, buf, zx.q(len)) == 0)
22
        puts(str: "error decrypting")
23

24
    int32_t padding
25

26
    if (EVP_DecryptFinal_ex(dec_ctx, &out_buf[sx.q(*out_len)], &padding) == 0)
27
        puts(str: "error finalizing decryption")
28

29
    *out_len += padding
30

31
    if (CANARY == tcb->stack_guard)
32
        return CANARY - tcb->stack_guard
33

34
    __stack_chk_fail()

The custom_enc function performs double AES encryption: it first encrypts the plaintext with enc1, then encrypts the result with enc2. The custom_dec function does the reverse: it first decrypts with dec2, then decrypts the result with dec1.

Great, so now we have the full communication flow:

First connect to the server.
Receive an RSA public key.
Generate two weak AES keys (26 bits of entropy each), encrypt them with the RSA key, and send them to the server.
Use the AES keys to perform a simple handshake by sending “REQCONN” and expecting “REQCONN_OK”.

After this, we can assume the later communication will also use the same AES encryption scheme, following the same Comms::send_message pattern.

Classic NSA Codebreaker moment

Okay, but we still don’t have any ciphertext to analyze, given the category for this task. However, we know this is supposed to be some sort of network communication, so where have we seen that before…?

That’s right! In Task 2, we had a PCAP file with network traffic. Let’s see if there’s anything interesting in there. Task 2 PCAP searching for "KEY" in TCP stream

Lo and behold, we find a TCP stream containing expected KEY_RECEIVED response from the server! Let’s extract the full TCP stream and analyze it. This is what the full comm looks like:

Full TCP communication from Task 2 PCAP

Unfortunately, the RSA public key is a 2048 bit key, and running it through a trivial factorization tool doesn’t yield any results. However, we don’t actually need to recover the RSA key, since we can still brute-force the AES keys.

Bruteforce to the rescue

Even though brute-forcing both keys at once would be too much ( $2^{52}$ ), we can still brute-force them one at a time due to the way the encryption is structured. If we brute force the second key first, we can see what candidates produce an entire empty padding block, since the first encryption is guaranteed to be a multiple of the block size (the plaintext is only 6 bytes plus padding). This reduces the number of candidates significantly, and we can then brute-force the first key on the remaining candidates.

1
from Crypto.Cipher import AES
2
from Crypto.Util.Padding import unpad
3
from tqdm import tqdm
4
import struct
5
import multiprocessing as mp
6
from functools import partial
7

8
total_keys = 1 << 26
9
# this should be Enc("REQCONN")
10
enc = b'\xea\x8e\xe1\xb4\n0_\xf5p\x17\x94\xdb?\x8e\x1dD\xe5\xd9\x9bo\xa7\xaf\x1c|\x06\x05\xf1\x82\xe4\xe6q\xa8'
11

12
key2_expected_padding = b'\x10' * AES.block_size
13

14
magic = b'\xde\xc0\xde\xc0\xff\xee'
15
key1_p_len = 16 - (len(magic) + len(b'REQCONN'))
16
key1_expected_padding = bytes([key1_p_len]) * key1_p_len
17

18
def find_key_cands(key, enc, expected_padding):
9 collapsed lines
19
    n = len(expected_padding)
20
    key = struct.pack('<I', key).ljust(16, b'\x00')
21
    cipher = AES.new(key, AES.MODE_ECB)
22
    dec = cipher.decrypt(enc)
23
    if dec[-n:] == expected_padding:
24
        try:
25
            return (key, unpad(dec, 16))
26
        except:
27
            pass
28

29
def run_phase(enc, expected_padding):
7 collapsed lines
30
    candidates = []
31
    with mp.Pool() as pool:
32
        f = partial(find_key_cands, enc=enc, expected_padding=expected_padding)
33
        for res in tqdm(pool.imap_unordered(f, range(total_keys), chunksize=10000), total=total_keys):
34
            if res:
35
                candidates.append(res)
36
    return candidates
37

38
if __name__ == '__main__':
39
    key2_candidates = run_phase(enc, key2_expected_padding)
40
    print(f"Key 2 candidates: {key2_candidates}")
41
    if not key2_candidates:
42
        print("No candidates found for Key 2")
43
        exit()
44
    key2, dec2 = key2_candidates[0]
45

46
    key1_candidates = run_phase(dec2, key1_expected_padding)
47
    print(f"Key 1 candidates: {key1_candidates}")

Running this and waiting about 5 minutes gives us the following output:

$ python3 writeup_brute.py
100%|███████████████████████████████████████████████████████████████████| 67108864/67108864 [01:39<00:00, 675507.51it/s]
Key 2 candidates: [(b'(E:\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', b'pF\xc7I\x99\x12#M@G\xaa\xcd"f\x9a\x8a')]
100%|███████████████████████████████████████████████████████████████████| 67108864/67108864 [01:31<00:00, 731712.43it/s]
Key 1 candidates: [(b'L\x89H\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', b'\xca\xe0\xb0\xa5\x83F\xf3g\xa3\xa6\xe7\xfc\x82'), (b'\xc4\xac\x9f\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', b'\xde\xc0\xde\xc0\xff\xeeREQCONN')]

We can see the successful decryption of the handshake message b'\xde\xc0\xde\xc0\xff\xeeREQCONN', confirming that we have found the correct keys:

Key 1: b'\xc4\xac\x9f\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
Key 2: b'(E:\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'

Now, we can simply decrypt the rest of the communication in the PCAP using these keys. After decrypting the full communication, we find the URL we were looking for:

1
from Crypto.Cipher import AES
2
from Crypto.Util.Padding import unpad
3

4
key1 = b'\xc4\xac\x9f\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
5
key2 = b'(E:\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
6
magic = b'\xde\xc0\xde\xc0\xff\xee'
7

8
def decrypt(data):
9
    cipher = AES.new(key2, AES.MODE_ECB)
10
    dec = cipher.decrypt(data)
11
    unpadded = unpad(dec, 16)
12

13
    cipher = AES.new(key1, AES.MODE_ECB)
14
    dec = cipher.decrypt(unpadded)
15
    unpadded = unpad(dec, 16)
16
    return unpadded
17

18
enc_msgs = [
8 collapsed lines
19
    # Enc("REQCONN")
20
    b'\xea\x8e\xe1\xb4\n0_\xf5p\x17\x94\xdb?\x8e\x1dD\xe5\xd9\x9bo\xa7\xaf\x1c|\x06\x05\xf1\x82\xe4\xe6q\xa8',
21
    # Enc("REQCONN_OK")
22
    b"\xc0<~\x00\xf0\xae\x80\x8c\x90BM\xb7\x85n\xcf\x8ek\xa6`\xe7\xac\xe4[\xa7\xb5n\xbf'\xd3\xf0BN\xe5\xd9\x9bo\xa7\xaf\x1c|\x06\x05\xf1\x82\xe4\xe6q\xa8",
23
    # Enc(Msg1)
24
    b'\xee\x9b\x17\xba\x13y\xe1%wD\x90\x87\x96\xf5\xac.\xc2A(]\xe1\xd4\x80\xb7i\xdc.l:\x9c<\x8db-5\xd4\x04\x03V\xcc\xe0\x1f\xf5k}\x1b&Z\xe5\xd9\x9bo\xa7\xaf\x1c|\x06\x05\xf1\x82\xe4\xe6q\xa8',
25
    # Enc(Msg2)
26
    b'A\x8c\xca\xa2}\xbd\xc0\x8e\x1d\xe3\x00\xe4\xa69J\x0f\xde\xbd\xb2\x7fjh9\xb6n\xdd\x80O\xb6u[\x02\xcek\xaa4\x1c\xce\x98n\x9c\xd23\xa6\x89%z\x9a\x9bR-\x9bG\xebG-\xccJ\xc1\xbe\x8b\xc1P\xb4\xe5\xd9\x9bo\xa7\xaf\x1c|\x06\x05\xf1\x82\xe4\xe6q\xa8'
27
]
28

29
for enc in enc_msgs:
30
    dec = decrypt(enc)
31
    header, dec = dec[:6], dec[6:]
32
    assert header == magic
33
    print(dec)

$ python3 writeup_decrypt.py
b'REQCONN'
b'REQCONN_OK'
b'DATA REQUEST mattermost_url'
b'https://198.51.100.166/mattermost/Xho9_BYdUiOyF'

We get a Mattermost URL: https://198.51.100.166/mattermost/Xho9_BYdUiOyF, the answer to this task.