# -*- coding: cp936 -*-
from Server import *
from re import findall
from Crypto.Util import strxor

# 将位于第 Block 个块中第 loc 个字符修改为 char
Block = 1
loc = 7
char = '0'
rawM = '''a:2:{s:4:"name";s:6:"sdsdsd";s:8:"greeting";s:20:"echo 'Hello sdsdsd!'";}'''
#-------------------------------------------------------------------------
print '[!]将 rawM 中的 s:4:"name"; 改为 s:0:"name";'

Blockn, b = divmod(len(rawM), 16)
if b: Blockn = Blockn + 1
rawM = rawM[::-1].zfill(Blockn * 16)[::-1]
C = CreateC(rawM)

print '[+]The rawM is:'
splitM = findall('.{16}', rawM)
for m in splitM: print '  [-]' + m

print '[+]The rawC is:'
splitC = findall('.{32}', C)
for c in splitC: print '  [-]' + c

changeBlock = findall('.{2}', splitC[Block - 1])

print '[!]Block', Block - 1, 'loc', loc, 'char had changed from', changeBlock[loc], 'to',
changeBlock[loc] = hex(int(changeBlock[loc], 16) ^ ord(rawM[(Block-1) * 16 + loc]) ^ ord(char))[2:].zfill(2)
print changeBlock[loc]

splitC[Block-1] = ''.join(changeBlock)

modifyC = ''.join(splitC)
print '[+]The attackedC is:'
for c in findall('.{32}', modifyC): print '  [-]' + c

CheckM = Check(modifyC.decode('hex'))
print '[+]The attacked M is:'
for c in findall('.{16}', CheckM[16:]): print '  [-]' + c

print '[!]All Done!'

# -*- coding: cp936 -*-
from Crypto.Cipher import AES
from Crypto import Random
import random
import string

cipher = None

def CreateC(M):
    '''使用随机的 key 与 iv 加密明文，返回密文'''

    global cipher
    K = list(string.ascii_letters + string.digits)
    iv = K[:]
    random.shuffle(K)
    iv = Random.new().read(AES.block_size)
    cipher = AES.new(''.join(K[:32]), AES.MODE_CBC, iv)

    return iv.encode('hex')+cipher.encrypt(M).encode('hex')



def Check(C):
    '''检查 CBC 字节翻转攻击是否成功'''

    global cipher
    M = cipher.decrypt(C)
    return M