Skip to content

Commit af834c5

Browse files
ic0nsic0ns
authored
Merge branch 'master' into raw_publickeys
2 parents 21f972e + 4ce7f49 commit af834c5

File tree

59 files changed

+1129
-140
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

59 files changed

+1129
-140
lines changed

‎.gitignore‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -42,3 +42,5 @@ Utils/.settings/org.eclipse.core.resources.prefs
4242
Utils/.settings/org.eclipse.jdt.core.prefs
4343
.project
4444
test.sh
45+
.settings/
46+
.classpath

‎Attacks/pom.xml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44
<parent>
55
<groupId>de.rub.nds.tlsattacker</groupId>
66
<artifactId>TLS-Attacker</artifactId>
7-
<version>3.0</version>
7+
<version>3.3.1</version>
88
</parent>
99
<artifactId>Attacks</artifactId>
1010
<packaging>jar</packaging>

‎Attacks/src/main/java/de/rub/nds/tlsattacker/attacks/constants/PaddingRecordGeneratorType.java‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -28,5 +28,7 @@ public enum PaddingRecordGeneratorType {
2828
/**
2929
*
3030
*/
31-
LONG
31+
LONG,
32+
33+
LONG_RECORD
3234
}

‎Attacks/src/main/java/de/rub/nds/tlsattacker/attacks/ec/oracles/RealDirectMessageECOracle.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -76,6 +76,7 @@ public boolean checkSecretCorrectnes(Point ecPoint, BigInteger secret) {
7676

7777
ECDHClientKeyExchangeMessage message = (ECDHClientKeyExchangeMessage) WorkflowTraceUtil.getFirstSendMessage(
7878
HandshakeMessageType.CLIENT_KEY_EXCHANGE, trace);
79+
message.prepareComputations();
7980

8081
// modify public point base X coordinate
8182
ModifiableBigInteger x = ModifiableVariableFactory.createBigIntegerModifiableVariable();
@@ -92,7 +93,6 @@ public boolean checkSecretCorrectnes(Point ecPoint, BigInteger secret) {
9293
ModifiableByteArray pms = ModifiableVariableFactory.createByteArrayModifiableVariable();
9394
byte[] explicitePMS = BigIntegers.asUnsignedByteArray(curve.getModulus().bitLength() / 8, secret);
9495
pms.setModification(ByteArrayModificationFactory.explicitValue(explicitePMS));
95-
message.prepareComputations();
9696
message.getComputations().setPremasterSecret(pms);
9797

9898
if (numberOfQueries % 100 == 0) {

Attacks/src/main/java/de/rub/nds/tlsattacker/attacks/exception/PaddingOracleUnstableException.java renamed to Attacks/src/main/java/de/rub/nds/tlsattacker/attacks/exception/OracleUnstableException.java

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -11,13 +11,13 @@
1111
/**
1212
*
1313
*/
14-
public class PaddingOracleUnstableException extends RuntimeException {
14+
public class OracleUnstableException extends RuntimeException {
1515

1616
/**
1717
*
1818
* @param string
1919
*/
20-
public PaddingOracleUnstableException(String string) {
20+
public OracleUnstableException(String string) {
2121
super(string);
2222
}
2323

‎Attacks/src/main/java/de/rub/nds/tlsattacker/attacks/impl/BleichenbacherAttacker.java‎

Lines changed: 19 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@
1010

1111
import de.rub.nds.modifiablevariable.util.ArrayConverter;
1212
import de.rub.nds.tlsattacker.attacks.config.BleichenbacherCommandConfig;
13+
import de.rub.nds.tlsattacker.attacks.exception.OracleUnstableException;
1314
import de.rub.nds.tlsattacker.attacks.pkcs1.Bleichenbacher;
1415
import de.rub.nds.tlsattacker.attacks.pkcs1.BleichenbacherVulnerabilityMap;
1516
import de.rub.nds.tlsattacker.attacks.pkcs1.BleichenbacherWorkflowGenerator;
@@ -128,12 +129,12 @@ public EqualityError getEqualityError() {
128129
CONSOLE.info("A server is considered vulnerable to this attack if it responds differently to the test vectors.");
129130
CONSOLE.info("A server is considered secure if it always responds the same way.");
130131
LOGGER.debug("Testing: " + config.getWorkflowType());
131-
errorType = isVulnerable(pkcs1Vectors);
132+
errorType = isVulnerable(pkcs1Vectors, publicKey);
132133
return errorType;
133134
}
134135

135-
public EqualityError isVulnerable(List<Pkcs1Vector> pkcs1Vectors) {
136-
fingerprintPairList = getBleichenbacherMap(config.getWorkflowType(), pkcs1Vectors);
136+
public EqualityError isVulnerable(List<Pkcs1Vector> pkcs1Vectors, RSAPublicKey publicKey) {
137+
fingerprintPairList = getBleichenbacherMap(config.getWorkflowType(), pkcs1Vectors, publicKey);
137138
if (fingerprintPairList.isEmpty()) {
138139
LOGGER.warn("Could not extract Fingerprints");
139140
return null;
@@ -146,14 +147,14 @@ public EqualityError isVulnerable(List<Pkcs1Vector> pkcs1Vectors) {
146147
// network. In this case we do a rescan
147148
// and check if we find the exact same answer behaviour (twice)
148149
List<VectorFingerprintPair> secondBleichenbacherVectorMap = getBleichenbacherMap(config.getWorkflowType(),
149-
pkcs1Vectors);
150+
pkcs1Vectors, publicKey);
150151
EqualityError error2 = getEqualityError(secondBleichenbacherVectorMap);
151152
BleichenbacherVulnerabilityMap mapOne = new BleichenbacherVulnerabilityMap(fingerprintPairList, error);
152153
BleichenbacherVulnerabilityMap mapTwo = new BleichenbacherVulnerabilityMap(secondBleichenbacherVectorMap,
153154
error2);
154155
if (mapOne.looksIdentical(mapTwo)) {
155156
List<VectorFingerprintPair> thirdBleichenbacherVectorMap = getBleichenbacherMap(
156-
config.getWorkflowType(), pkcs1Vectors);
157+
config.getWorkflowType(), pkcs1Vectors, publicKey);
157158
EqualityError error3 = getEqualityError(secondBleichenbacherVectorMap);
158159
BleichenbacherVulnerabilityMap mapThree = new BleichenbacherVulnerabilityMap(
159160
thirdBleichenbacherVectorMap, error3);
@@ -202,7 +203,7 @@ private void printBleichenbacherVectormap(List<VectorFingerprintPair> bleichenba
202203
}
203204

204205
private List<VectorFingerprintPair> getBleichenbacherMap(BleichenbacherWorkflowType bbWorkflowType,
205-
List<Pkcs1Vector> pkcs1Vectors) {
206+
List<Pkcs1Vector> pkcs1Vectors, RSAPublicKey publicKey) {
206207
Config tlsConfig = getTlsConfig();
207208
tlsConfig.setWorkflowExecutorShouldClose(false);
208209
List<VectorFingerprintPair> bleichenbacherVectorMap = new LinkedList<>();
@@ -226,6 +227,17 @@ private List<VectorFingerprintPair> getBleichenbacherMap(BleichenbacherWorkflowT
226227
processFinishedStateVectorPair(stateVectorPair, bleichenbacherVectorMap);
227228
}
228229
}
230+
// Check that the public key send by the server is actually the public
231+
// key used to generate
232+
// the vectors. This is currently a limitation of our script as the
233+
// attack vectors are
234+
// generated statically and not dynamically. We will adjust this in
235+
// future versions.
236+
for (StateVectorPair pair : stateVectorPairList) {
237+
if (!pair.getState().getTlsContext().getServerRsaModulus().equals(publicKey.getModulus())) {
238+
throw new OracleUnstableException("Server sent us a different publickey during the scan. Aborting test");
239+
}
240+
}
229241

230242
return bleichenbacherVectorMap;
231243
}
@@ -236,7 +248,7 @@ private void processFinishedStateVectorPair(StateVectorPair stateVectorPair,
236248
ResponseFingerprint fingerprint = ResponseExtractor.getFingerprint(stateVectorPair.getState());
237249
bleichenbacherVectorMap.add(new VectorFingerprintPair(fingerprint, stateVectorPair.getVector()));
238250
} else {
239-
LOGGER.error("Could not execute Workflow. Something went wrong... Check the debug output for more information");
251+
LOGGER.warn("Could not execute Workflow. Something went wrong... Check the debug output for more information");
240252
}
241253
clearConnections(stateVectorPair.getState());
242254

‎Attacks/src/main/java/de/rub/nds/tlsattacker/attacks/impl/HeartbleedAttacker.java‎

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,8 @@
1919
import de.rub.nds.tlsattacker.core.constants.ProtocolMessageType;
2020
import de.rub.nds.tlsattacker.core.constants.RunningModeType;
2121
import de.rub.nds.tlsattacker.core.exceptions.WorkflowExecutionException;
22+
import de.rub.nds.tlsattacker.core.protocol.message.ChangeCipherSpecMessage;
23+
import de.rub.nds.tlsattacker.core.protocol.message.FinishedMessage;
2224
import de.rub.nds.tlsattacker.core.protocol.message.HeartbeatMessage;
2325
import de.rub.nds.tlsattacker.core.state.State;
2426
import de.rub.nds.tlsattacker.core.workflow.WorkflowExecutor;
@@ -27,6 +29,7 @@
2729
import de.rub.nds.tlsattacker.core.workflow.WorkflowTraceUtil;
2830
import de.rub.nds.tlsattacker.core.workflow.action.ReceiveAction;
2931
import de.rub.nds.tlsattacker.core.workflow.action.SendAction;
32+
import de.rub.nds.tlsattacker.core.workflow.action.SendDynamicClientKeyExchangeAction;
3033
import de.rub.nds.tlsattacker.core.workflow.factory.WorkflowConfigurationFactory;
3134
import de.rub.nds.tlsattacker.core.workflow.factory.WorkflowTraceType;
3235
import org.apache.logging.log4j.LogManager;
@@ -61,8 +64,11 @@ public void executeAttack() {
6164
@Override
6265
public Boolean isVulnerable() {
6366
Config tlsConfig = getTlsConfig();
64-
WorkflowTrace trace = new WorkflowConfigurationFactory(tlsConfig).createWorkflowTrace(
65-
WorkflowTraceType.HANDSHAKE, RunningModeType.CLIENT);
67+
WorkflowTrace trace = new WorkflowConfigurationFactory(tlsConfig).createWorkflowTrace(WorkflowTraceType.HELLO,
68+
RunningModeType.CLIENT);
69+
trace.addTlsAction(new SendDynamicClientKeyExchangeAction());
70+
trace.addTlsAction(new SendAction(new ChangeCipherSpecMessage(), new FinishedMessage()));
71+
trace.addTlsAction(new ReceiveAction(new ChangeCipherSpecMessage(), new FinishedMessage()));
6672
HeartbeatMessage message = new HeartbeatMessage(tlsConfig);
6773
trace.addTlsAction(new SendAction(message));
6874
trace.addTlsAction(new ReceiveAction(new HeartbeatMessage()));

‎Attacks/src/main/java/de/rub/nds/tlsattacker/attacks/impl/InvalidCurveAttacker.java‎

Lines changed: 22 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -85,22 +85,18 @@ public Boolean isVulnerable() {
8585
EllipticCurve curve = CurveFactory.getCurve(config.getNamedGroup());
8686
Point point = Point.createPoint(config.getPublicPointBaseX(), config.getPublicPointBaseY(),
8787
config.getNamedGroup());
88-
for (int i = 0; i < getConfig().getProtocolFlows(); i++) {
89-
if (config.getPremasterSecret() != null) {
90-
premasterSecret = config.getPremasterSecret();
91-
} else {
92-
Point sharedPoint = curve.mult(new BigInteger("" + i + 1), point);
93-
premasterSecret = sharedPoint.getX().getData();
94-
if (premasterSecret == null) {
95-
premasterSecret = BigInteger.ZERO;
96-
}
97-
LOGGER.debug("PMS: " + premasterSecret.toString());
98-
}
88+
89+
int protocolFlows = getConfig().getProtocolFlows();
90+
if (config.getPremasterSecret() != null) {
91+
protocolFlows = 1;
92+
}
93+
94+
for (int i = 0; i < protocolFlows; i++) {
95+
setPremasterSecret(curve, i, point);
9996
try {
10097
WorkflowTrace trace = executeProtocolFlow();
10198
if (!WorkflowTraceUtil.didReceiveMessage(HandshakeMessageType.SERVER_HELLO, trace)) {
10299
LOGGER.info("Did not receive ServerHello. Check your config");
103-
104100
return null;
105101
}
106102
if (!WorkflowTraceUtil.didReceiveMessage(HandshakeMessageType.FINISHED, trace)) {
@@ -116,6 +112,20 @@ public Boolean isVulnerable() {
116112
return false;
117113
}
118114

115+
private void setPremasterSecret(EllipticCurve curve, int i, Point point) {
116+
if (config.getPremasterSecret() != null) {
117+
premasterSecret = config.getPremasterSecret();
118+
} else {
119+
Point sharedPoint = curve.mult(new BigInteger("" + (i + 1)), point);
120+
if (sharedPoint.getX() != null) {
121+
premasterSecret = sharedPoint.getX().getData();
122+
} else {
123+
premasterSecret = BigInteger.ZERO;
124+
}
125+
LOGGER.debug("PMS: " + premasterSecret.toString());
126+
}
127+
}
128+
119129
private WorkflowTrace executeProtocolFlow() {
120130
Config tlsConfig = getTlsConfig();
121131
WorkflowTrace trace = new WorkflowConfigurationFactory(tlsConfig).createWorkflowTrace(WorkflowTraceType.HELLO,

‎Attacks/src/main/java/de/rub/nds/tlsattacker/attacks/impl/PaddingOracleAttacker.java‎

Lines changed: 6 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@
1010

1111
import de.rub.nds.tlsattacker.attacks.config.PaddingOracleCommandConfig;
1212
import de.rub.nds.tlsattacker.attacks.exception.AttackFailedException;
13-
import de.rub.nds.tlsattacker.attacks.exception.PaddingOracleUnstableException;
13+
import de.rub.nds.tlsattacker.attacks.exception.OracleUnstableException;
1414
import de.rub.nds.tlsattacker.attacks.padding.PaddingTraceGenerator;
1515
import de.rub.nds.tlsattacker.attacks.padding.PaddingTraceGeneratorFactory;
1616
import de.rub.nds.tlsattacker.attacks.padding.PaddingVectorGenerator;
@@ -165,7 +165,7 @@ public Boolean isVulnerable() {
165165
public boolean lookEqual(List<VectorResponse> responseVectorListOne, List<VectorResponse> responseVectorListTwo) {
166166
boolean result = true;
167167
if (responseVectorListOne.size() != responseVectorListTwo.size()) {
168-
throw new PaddingOracleUnstableException(
168+
throw new OracleUnstableException(
169169
"The padding Oracle seems to be unstable - there is something going terrible wrong. We recommend manual analysis");
170170
}
171171

@@ -191,7 +191,7 @@ public boolean lookEqual(List<VectorResponse> responseVectorListOne, List<Vector
191191
continue;
192192
}
193193
if (equivalentVector.getFingerprint() == null) {
194-
LOGGER.error("Equivalent vector has no fingerprint:" + testedSuite + " - " + testedVersion);
194+
LOGGER.warn("Equivalent vector has no fingerprint:" + testedSuite + " - " + testedVersion);
195195
equivalentVector.setErrorDuringHandshake(true);
196196
result = false;
197197
continue;
@@ -200,7 +200,7 @@ public boolean lookEqual(List<VectorResponse> responseVectorListOne, List<Vector
200200
EqualityError error = FingerPrintChecker.checkEquality(vectorResponseOne.getFingerprint(),
201201
equivalentVector.getFingerprint(), true);
202202
if (error != EqualityError.NONE) {
203-
LOGGER.error("There is an error beween rescan:" + error + " - " + testedSuite + " - " + testedVersion);
203+
LOGGER.warn("There is an error beween rescan:" + error + " - " + testedSuite + " - " + testedVersion);
204204
result = false;
205205
vectorResponseOne.setShaky(true);
206206
}
@@ -231,19 +231,17 @@ public List<VectorResponse> createVectorResponseList() {
231231
ResponseFingerprint fingerprint = null;
232232
if (pair.getFingerPrintTask().isHasError()) {
233233
errornousScans = true;
234-
LOGGER.error("Could not extract fingerprint for " + pair.toString());
234+
LOGGER.warn("Could not extract fingerprint for " + pair.toString());
235235
VectorResponse vectorResponse = new VectorResponse(pair.getVector(), null, testedVersion, testedSuite,
236236
tlsConfig.getDefaultApplicationMessageData().getBytes().length);
237237
vectorResponse.setErrorDuringHandshake(true);
238238
tempResponseVectorList.add(vectorResponse);
239-
LOGGER.error("Could not execute whole workflow: " + testedSuite + " - " + testedVersion);
240-
241239
} else {
242240
testedSuite = pair.getFingerPrintTask().getState().getTlsContext().getSelectedCipherSuite();
243241
testedVersion = pair.getFingerPrintTask().getState().getTlsContext().getSelectedProtocolVersion();
244242
if (testedSuite == null || testedVersion == null) {
245243
LOGGER.fatal("Could not find ServerHello after successful extraction");
246-
throw new PaddingOracleUnstableException("Fatal Extraction error");
244+
throw new OracleUnstableException("Fatal Extraction error");
247245
}
248246
fingerprint = pair.getFingerPrintTask().getFingerprint();
249247
tempResponseVectorList.add(new VectorResponse(pair.getVector(), fingerprint, testedVersion,

‎Attacks/src/main/java/de/rub/nds/tlsattacker/attacks/padding/LongRecordPaddingGenerator.java‎

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
/**
2+
* TLS-Attacker - A Modular Penetration Testing Framework for TLS
3+
*
4+
* Copyright 2014-2017 Ruhr University Bochum / Hackmanit GmbH
5+
*
6+
* Licensed under Apache License 2.0
7+
* http://www.apache.org/licenses/LICENSE-2.0
8+
*/
9+
package de.rub.nds.tlsattacker.attacks.padding;
10+
11+
import de.rub.nds.modifiablevariable.bytearray.ByteArrayExplicitValueModification;
12+
import de.rub.nds.tlsattacker.attacks.padding.vector.PaddingVector;
13+
import de.rub.nds.tlsattacker.attacks.padding.vector.TrippleVector;
14+
import de.rub.nds.tlsattacker.core.constants.AlgorithmResolver;
15+
import de.rub.nds.tlsattacker.core.constants.CipherSuite;
16+
import de.rub.nds.tlsattacker.core.constants.ProtocolVersion;
17+
import java.util.LinkedList;
18+
import java.util.List;
19+
20+
public class LongRecordPaddingGenerator extends PaddingVectorGenerator {
21+
22+
/**
23+
*
24+
* @param suite
25+
* @param version
26+
* @return
27+
*/
28+
@Override
29+
public List<PaddingVector> getVectors(CipherSuite suite, ProtocolVersion version) {
30+
// Total plaintext size is not allowed to be bigger than 16384
31+
// MAC + Plaintext
32+
List<PaddingVector> vectorList = new LinkedList<>();
33+
int blockSize = AlgorithmResolver.getCipher(suite).getBlocksize();
34+
int macSize = AlgorithmResolver.getMacAlgorithm(version, suite).getSize();
35+
vectorList.add(new TrippleVector("ValidPlainData", "ValidPlainData", new ByteArrayExplicitValueModification(
36+
new byte[16384]), new ByteArrayExplicitValueModification(new byte[AlgorithmResolver.getMacAlgorithm(
37+
version, suite).getSize()]), new ByteArrayExplicitValueModification(
38+
createPaddingBytes(calculateValidPaddingSize(blockSize, macSize)))));
39+
vectorList.add(new TrippleVector("InvalidPlainData", "InvalidPlainData",
40+
new ByteArrayExplicitValueModification(new byte[16385]), new ByteArrayExplicitValueModification(
41+
new byte[AlgorithmResolver.getMacAlgorithm(version, suite).getSize()]),
42+
new ByteArrayExplicitValueModification(createPaddingBytes(calculateInvalidPaddingSize(blockSize,
43+
macSize)))));
44+
return vectorList;
45+
}
46+
47+
private int calculateValidPaddingSize(int blocksize, int macSize) {
48+
return blocksize - (macSize % blocksize);
49+
}
50+
51+
private int calculateInvalidPaddingSize(int blocksize, int macSize) {
52+
return (blocksize - (macSize % blocksize)) - 1;
53+
}
54+
55+
}

0 commit comments

Comments
 (0)