IvanAndMen
commented
6 years ago Pasar clave simetrica de hex a texto, obtenemos lo siguiente...
salt--> uYg4E hashed--> 58d30b20d1a8c91d7636c656fc8edb80a7e30f44
Ejecutar codigo Python para probar todas posibilidades del diccionario con el salt obtenido... si el hash se corresponde, hemos encontrado la key. El codigo se puede modificar si la salt va antes o despues.
La key es cookie
Se encripta el mensaje con base64 haciendo... Esto es opcional, ninios!
base64 -d message.enc > mes.enc
Desencriptamos mensaje con...
openssl aes-256-cbc -d -S uYg4E -k cookie -a -in message.enc -out decryp_mess.txt
As others have said, AES is a symmetric algorithm (private-key cryptography). This involves a single key which is a shared secret between the sender and recipient. An analogy is a locked mailbox without a mail slot. Anybody who wants to leave or read a message needs to have a key to the mailbox.
If you really want to know the gory details of AES, there's a superb cartoon to guide you along the way.
Public-key cryptography involves two related keys for each recipient involved - a private key which is a secret known only by the recipient, and a related public key which is known by all senders.
The sender encrypts the message using the recipient's public key. That message can only be decrypted by a recipient with a private key matching the public key.
An analogy for public-key encryption is a locked mailbox with a mail slot. The mail slot is exposed and accessible to the public. Its location (the street address) is the public key. Anyone knowing the street address can go to the door and drop a written message through the slot. But only the person who possesses the private key can open the mailbox and read the message.
A public key is linked to a private key. The public key (RSA) is distributed to the 'wild' and anyone who wants to send an encrypted file (generically speaking here), they will request the public key and encode against it. The cypertext is unreadable to anyone who gains access to the file, even if they have the public key.
The private key is needed to decode the file. As long as the private key is kept private, it is statically improbable that anyone will guess or hack the the key. Improbable, not impossible.
The real issue is keeping the private key private. Most cracks are done with social hacking. Extortion, loggers and monkey-in-the-middle public key conversion are other ways more probable than brute forcing the password or key.
In your comment to Brawndo you asked
What you are describing is Symmetric-key algorithms, which AES is one. The reason for public-private keys are that with Symmetric-key algorithms how do you pass a Symmetric key over unsecured networks, mail, phone or what not without the key being intercepted. Perhaps encrypting the key, but then how do you pass that key? With a public-private key combo, that becomes LESS relevant.
Pàgines d’interès: https://rietta.com/blog/2012/01/27/openssl-generating-rsa-key-from-command/
Conectar-te al server si no et deixa amb ssh, fer-ho amb netcat: netcat 176.31.103.138 9090
Crear una clau privada i extreure la publica: openssl genrsa -des3 -out private.pem 2048 openssl rsa -in private.pem -outform PEM -pubout -out public.pem
Enviem la public.pem netcat 176.31.103.138 9090 < public.pem
Rebem dos missatges, el segon es la flag: MSG_1: SK+R1mpIDGLVdRSzPAqf71gLMsjwYGviFZMbzFuPTG/KIj6Oc31U9HU9Fg+WnX0huB9LCicpqO7PUIEZnxlf68Cqvg609HixU9/a8jKMfnN4HVU/ctXkhxgM3mGcJtc4NciQ5GrAqs12GSUPhtfgt/As+JZBzEn5RO35Nxz4JZtHR7gvUfURONvBTP7xP8sr9LCG0imReAbwewy9vkpkaO5vta7WFJDA8s5I0sJdwYMkSrFogQkwqjgtsyb5AgIXoNG1J64tsFbwlmah6yrWZYlkqnREqMf0Qh+Iwe2siORUclho0656mG1FNw6S6uk6qxz02OTMhmkGyaLPa8/VJw==
MSG_2: U2FsdGVkX1/aqyLVDndI1Q7ecYMfIPSEmeqRVe39Mar1loatmeFw2H1JCMz+q+J7 9iSDrPna05U8Zkf7MN2WPA==
Cal posar-ho en un arxiu .enc (message1base64.enc) i passar-lo a binari amb: base64 -d message1base64.enc > message1.enc
Desencriptem el message1.enc, ens demanarà la private key que hem posat abans: openssl rsautl -decrypt -inkey private.pem -in message1.enc -out message_decrypted.txt
“bulbasaur”
Desencriptem aes-256-cbc amb la clau del primer missatge: openssl enc -aes-256-cbc -d -in message256.enc -out file.txt
“Finally! The pizza was getting cold…”