#!/usr/bin/python3

import socket
from cryptography.hazmat.backends import default_backend
from cryptography.hazmat.primitives.asymmetric import ec
from cryptography.hazmat.primitives.serialization import *
import hashlib
from Crypto.Cipher import AES

private_key1 = ec.generate_private_key(ec.SECP384R1, default_backend())
private_key2 = ec.generate_private_key(ec.SECP384R1, default_backend())


s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
host = "mitm.pwn.seccon.jp"
s.connect((host, 8000))

s.recv(len("[dev0 to dev1]:"))
data = s.recv(120)
## todo
k1 = load_der_public_key(data, backend=default_backend())
payload = private_key1.public_key().public_bytes(encoding=Encoding.DER, format=PublicFormat.SubjectPublicKeyInfo)
s.send(payload)

data = s.recv(len("\n[dev1 to dev0]: OK\n"))

data = s.recv(len("[dev1 to dev0]:"))
data = s.recv(120)
## todo
k2 = load_der_public_key(data, backend=default_backend())
payload = private_key2.public_key().public_bytes(encoding=Encoding.DER, format=PublicFormat.SubjectPublicKeyInfo)
s.send(payload)

s.recv(len("\n[dev0 to dev1]: OK\n"))

data = s.recv(len("[KBKDF: SHA256, Encryption: AES]\n"))
## derive keys
sk1 = private_key2.exchange(ec.ECDH(),k1)
sk2 = private_key1.exchange(ec.ECDH(),k2)

aesk1 = hashlib.sha256(sk1)
aesk2 = hashlib.sha256(sk2)

print ("key1: %s" % aesk1.hexdigest() )
print ("key2: %s" % aesk2.hexdigest() )

a1 = AES.new(aesk1.digest(),AES.MODE_CBC,"0000000000000000")
a2 = AES.new(aesk2.digest(),AES.MODE_CBC,"0000000000000000")


data = s.recv(len("[dev0 to dev1]:"))
data = s.recv(256)

nonce = a1.decrypt(data)
print("nonce: %s" % nonce.decode())

ct = a2.encrypt(nonce)

## todo
# mitm
s.send(ct)

data = s.recv(len("\n[dev1 to dev0]: OK\n"))
data = s.recv(len("[dev1 to dev0]:"))

data = s.recv(256)
## todo
# decrypt
a2 = AES.new(aesk2.digest(),AES.MODE_CBC,"0000000000000000")

print(a2.decrypt(data).decode())

488b4c572ee2b48feda208a11995a813054d2313
<mask token>

<mask token>
s.connect((host, 8000))
s.recv(len('[dev0 to dev1]:'))
<mask token>
s.send(payload)
<mask token>
s.send(payload)
s.recv(len("""
[dev0 to dev1]: OK
"""))
<mask token>
print('key1: %s' % aesk1.hexdigest())
print('key2: %s' % aesk2.hexdigest())
<mask token>
print('nonce: %s' % nonce.decode())
<mask token>
s.send(ct)
<mask token>
print(a2.decrypt(data).decode())

<mask token>
private_key1 = ec.generate_private_key(ec.SECP384R1, default_backend())
private_key2 = ec.generate_private_key(ec.SECP384R1, default_backend())
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
host = 'mitm.pwn.seccon.jp'
s.connect((host, 8000))
s.recv(len('[dev0 to dev1]:'))
data = s.recv(120)
k1 = load_der_public_key(data, backend=default_backend())
payload = private_key1.public_key().public_bytes(encoding=Encoding.DER,
    format=PublicFormat.SubjectPublicKeyInfo)
s.send(payload)
data = s.recv(len("""
[dev1 to dev0]: OK
"""))
data = s.recv(len('[dev1 to dev0]:'))
data = s.recv(120)
k2 = load_der_public_key(data, backend=default_backend())
payload = private_key2.public_key().public_bytes(encoding=Encoding.DER,
    format=PublicFormat.SubjectPublicKeyInfo)
s.send(payload)
s.recv(len("""
[dev0 to dev1]: OK
"""))
data = s.recv(len('[KBKDF: SHA256, Encryption: AES]\n'))
sk1 = private_key2.exchange(ec.ECDH(), k1)
sk2 = private_key1.exchange(ec.ECDH(), k2)
aesk1 = hashlib.sha256(sk1)
aesk2 = hashlib.sha256(sk2)
print('key1: %s' % aesk1.hexdigest())
print('key2: %s' % aesk2.hexdigest())
a1 = AES.new(aesk1.digest(), AES.MODE_CBC, '0000000000000000')
a2 = AES.new(aesk2.digest(), AES.MODE_CBC, '0000000000000000')
data = s.recv(len('[dev0 to dev1]:'))
data = s.recv(256)
nonce = a1.decrypt(data)
print('nonce: %s' % nonce.decode())
ct = a2.encrypt(nonce)
s.send(ct)
data = s.recv(len("""
[dev1 to dev0]: OK
"""))
data = s.recv(len('[dev1 to dev0]:'))
data = s.recv(256)
a2 = AES.new(aesk2.digest(), AES.MODE_CBC, '0000000000000000')
print(a2.decrypt(data).decode())

import socket
from cryptography.hazmat.backends import default_backend
from cryptography.hazmat.primitives.asymmetric import ec
from cryptography.hazmat.primitives.serialization import *
import hashlib
from Crypto.Cipher import AES
private_key1 = ec.generate_private_key(ec.SECP384R1, default_backend())
private_key2 = ec.generate_private_key(ec.SECP384R1, default_backend())
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
host = 'mitm.pwn.seccon.jp'
s.connect((host, 8000))
s.recv(len('[dev0 to dev1]:'))
data = s.recv(120)
k1 = load_der_public_key(data, backend=default_backend())
payload = private_key1.public_key().public_bytes(encoding=Encoding.DER,
    format=PublicFormat.SubjectPublicKeyInfo)
s.send(payload)
data = s.recv(len("""
[dev1 to dev0]: OK
"""))
data = s.recv(len('[dev1 to dev0]:'))
data = s.recv(120)
k2 = load_der_public_key(data, backend=default_backend())
payload = private_key2.public_key().public_bytes(encoding=Encoding.DER,
    format=PublicFormat.SubjectPublicKeyInfo)
s.send(payload)
s.recv(len("""
[dev0 to dev1]: OK
"""))
data = s.recv(len('[KBKDF: SHA256, Encryption: AES]\n'))
sk1 = private_key2.exchange(ec.ECDH(), k1)
sk2 = private_key1.exchange(ec.ECDH(), k2)
aesk1 = hashlib.sha256(sk1)
aesk2 = hashlib.sha256(sk2)
print('key1: %s' % aesk1.hexdigest())
print('key2: %s' % aesk2.hexdigest())
a1 = AES.new(aesk1.digest(), AES.MODE_CBC, '0000000000000000')
a2 = AES.new(aesk2.digest(), AES.MODE_CBC, '0000000000000000')
data = s.recv(len('[dev0 to dev1]:'))
data = s.recv(256)
nonce = a1.decrypt(data)
print('nonce: %s' % nonce.decode())
ct = a2.encrypt(nonce)
s.send(ct)
data = s.recv(len("""
[dev1 to dev0]: OK
"""))
data = s.recv(len('[dev1 to dev0]:'))
data = s.recv(256)
a2 = AES.new(aesk2.digest(), AES.MODE_CBC, '0000000000000000')
print(a2.decrypt(data).decode())

#!/usr/bin/python3

import socket
from cryptography.hazmat.backends import default_backend
from cryptography.hazmat.primitives.asymmetric import ec
from cryptography.hazmat.primitives.serialization import *
import hashlib
from Crypto.Cipher import AES

private_key1 = ec.generate_private_key(ec.SECP384R1, default_backend())
private_key2 = ec.generate_private_key(ec.SECP384R1, default_backend())


s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
host = "mitm.pwn.seccon.jp"
s.connect((host, 8000))

s.recv(len("[dev0 to dev1]:"))
data = s.recv(120)
## todo
k1 = load_der_public_key(data, backend=default_backend())
payload = private_key1.public_key().public_bytes(encoding=Encoding.DER, format=PublicFormat.SubjectPublicKeyInfo)
s.send(payload)

data = s.recv(len("\n[dev1 to dev0]: OK\n"))

data = s.recv(len("[dev1 to dev0]:"))
data = s.recv(120)
## todo
k2 = load_der_public_key(data, backend=default_backend())
payload = private_key2.public_key().public_bytes(encoding=Encoding.DER, format=PublicFormat.SubjectPublicKeyInfo)
s.send(payload)

s.recv(len("\n[dev0 to dev1]: OK\n"))

data = s.recv(len("[KBKDF: SHA256, Encryption: AES]\n"))
## derive keys
sk1 = private_key2.exchange(ec.ECDH(),k1)
sk2 = private_key1.exchange(ec.ECDH(),k2)

aesk1 = hashlib.sha256(sk1)
aesk2 = hashlib.sha256(sk2)

print ("key1: %s" % aesk1.hexdigest() )
print ("key2: %s" % aesk2.hexdigest() )

a1 = AES.new(aesk1.digest(),AES.MODE_CBC,"0000000000000000")
a2 = AES.new(aesk2.digest(),AES.MODE_CBC,"0000000000000000")


data = s.recv(len("[dev0 to dev1]:"))
data = s.recv(256)

nonce = a1.decrypt(data)
print("nonce: %s" % nonce.decode())

ct = a2.encrypt(nonce)

## todo
# mitm
s.send(ct)

data = s.recv(len("\n[dev1 to dev0]: OK\n"))
data = s.recv(len("[dev1 to dev0]:"))

data = s.recv(256)
## todo
# decrypt
a2 = AES.new(aesk2.digest(),AES.MODE_CBC,"0000000000000000")

print(a2.decrypt(data).decode())
