#!/usr/bin/env bash
# ─────────────────────────────────────────────────────────────────
# CryptoPals + CTF Lab — Auto-setup script
# Tested on Ubuntu 22.04 / Debian 12
# Run with: bash setup_crypto_lab.sh
# ─────────────────────────────────────────────────────────────────
set -e   # exit immediately if any command fails

echo "[1/7] Updating apt package lists..."
sudo apt-get update -q

echo "[2/7] Installing system tools..."
sudo apt-get install -y \
  python3 python3-pip \          # Python runtime + pip
  wireshark \                    # GUI packet capture (for PCAP analysis)
  tshark \                       # CLI version of Wireshark (scriptable)
  tcpdump \                      # Raw packet capture to .pcap files
  netcat-openbsd \               # nc — test TCP connections, simple clients
  tmux \                         # Split one terminal into multiple panes
  net-tools \                    # ifconfig, netstat (older but useful)
  curl wget                      # Download challenge input files

echo "[3/7] Allowing Wireshark capture without sudo..."
# Add current user to the 'wireshark' group so you don't need sudo for captures
sudo usermod -aG wireshark "$USER"

echo "[4/7] Installing Python crypto libraries..."
pip3 install --user \
  pycryptodome \                 # AES, RSA, SHA — used in chapters 6-10
  requests \                     # Download challenge files over HTTP
  scapy                          # Advanced packet crafting (optional, CTF bonus)

echo "[5/7] Creating project folder structure..."
mkdir -p ~/cryptopals/{set1,set2,ctf,pcaps,utils}
# set1/  → challenges 1-8   (XOR, frequency, ECB)
# set2/  → challenges 9-16  (PKCS7, CBC, bitflip)
# ctf/   → server.py, client.py, attacker.py
# pcaps/ → captured .pcap files from Wireshark/tcpdump
# utils/ → shared helpers (xor, padding, scoring)

echo "[6/7] Writing shared utility module..."
cat > ~/cryptopals/utils/crypto_helpers.py << 'PYEOF'
# ── crypto_helpers.py ──────────────────────────────────────────
# Import this in every challenge script:
#   import sys, os; sys.path.insert(0, os.path.expanduser("~/cryptopals/utils"))
#   from crypto_helpers import *

def xor_bytes(a: bytes, b: bytes) -> bytes:
    return bytes(x ^ y for x, y in zip(a, b))

def score_english(text: bytes) -> float:
    freq = {32:13,101:12.7,116:9.1,97:8.2,111:7.5,105:7,110:6.7,
            115:6.3,104:6.1,114:6,100:4.3,108:4,99:2.8,117:2.8}
    lower = text.lower()
    score = sum(lower.count(b) * w for b, w in freq.items())
    printable = sum(1 for b in text if 32 <= b < 127)
    score += printable * 0.5
    return score

def break_single_xor(ct: bytes):
    best = (-1, 0, b"")
    for k in range(256):
        plain = bytes(b ^ k for b in ct)
        s = score_english(plain)
        if s > best[0]:
            best = (s, k, plain)
    return best[1], best[2]

def pkcs7_pad(data: bytes, bs: int = 16) -> bytes:
    n = bs - (len(data) % bs)
    return data + bytes([n] * n)

def pkcs7_unpad(data: bytes) -> bytes:
    n = data[-1]
    if n == 0 or n > 16 or data[-n:] != bytes([n]*n):
        raise ValueError("Bad padding")
    return data[:-n]

def hamming_distance(a: bytes, b: bytes) -> int:
    return sum(bin(x ^ y).count("1") for x, y in zip(a, b))
PYEOF

echo "[7/7] Downloading Set 1 challenge data files..."
# Challenge 6 (break repeating-key XOR)
curl -s https://cryptopals.com/static/challenge-data/6.txt \
     -o ~/cryptopals/set1/challenge6.txt
# Challenge 7 (AES-128-ECB decrypt)
curl -s https://cryptopals.com/static/challenge-data/7.txt \
     -o ~/cryptopals/set1/challenge7.txt
# Challenge 8 (detect ECB mode)
curl -s https://cryptopals.com/static/challenge-data/8.txt \
     -o ~/cryptopals/set1/challenge8.txt
# Challenge 10 (CBC decryption)
curl -s https://cryptopals.com/static/challenge-data/10.txt \
     -o ~/cryptopals/set2/challenge10.txt

echo ""
echo "✓ Setup complete! Log out and back in for Wireshark group to take effect."
echo "  Project folder: ~/cryptopals/"
echo "  Start a tmux session: tmux new -s crypto"

# Step 1: Create the script file
nano setup_crypto_lab.sh
# Paste the script above, then Ctrl+O to save, Ctrl+X to exit

# Step 2: Make it executable
chmod +x setup_crypto_lab.sh

# Step 3: Run it
bash setup_crypto_lab.sh

# Step 4: Log out and back in (needed for Wireshark group permissions)
# Or apply group without logging out:
newgrp wireshark

tmux new -s crypto          # create a new session named "crypto"
Ctrl+B then %              # split vertically (left/right panes)
Ctrl+B then "              # split horizontally (top/bottom panes)
Ctrl+B then ← → ↑ ↓       # move between panes
Ctrl+B then z              # zoom current pane to full screen (toggle)
Ctrl+B then d              # detach session (keeps it running)
tmux attach -t crypto      # re-attach to the session later
exit                       # close a pane

# Find your LAN IP address (share with teammates)
ip a | grep "inet " | grep -v "127.0.0.1"
# or: hostname -I

# Check if a port is in use
ss -tlnp | grep 9999

# Test connectivity to a teammate's server
nc -zv 192.168.1.42 9999

# Kill a process holding a port
fuser -k 9999/tcp

# Capture all CTF traffic and save to file
sudo tcpdump -i eth0 -w ~/cryptopals/pcaps/capture.pcap port 9999

# Read a pcap in hex+ASCII (no Wireshark needed)
tcpdump -r ~/cryptopals/pcaps/capture.pcap -XX | head -60

~/cryptopals/ctf/
  server.py       # your team's encrypted server
  client.py       # your team's encrypted client
  attacker.py     # tools for breaking opponents (Chapter 10)
~/cryptopals/pcaps/
  capture.pcap    # traffic you capture from opponents

#!/usr/bin/env python3
"""
CTF AES-CBC Encrypted Chat Server
─────────────────────────────────
Run:  python3 server.py
Share your KEY (hex) with your teammate via a secure out-of-band channel
(e.g. whisper it in person — do NOT send it over the network!).

Port 9999 must be reachable from your teammate's machine.
If behind a firewall: sudo ufw allow 9999/tcp
"""
import socket, os, sys
from Crypto.Cipher import AES
from Crypto.Util.Padding import pad, unpad

# ── Configuration ──────────────────────────────────────────────────
PORT      = 9999
KEY       = os.urandom(16)    # 128-bit random key — share this secretly!
BLOCK     = 16
# ───────────────────────────────────────────────────────────────────

def encrypt_msg(plaintext: str) -> bytes:
    """Encrypt a string. Prepend the IV so the receiver can decrypt."""
    iv  = os.urandom(BLOCK)              # fresh random IV every message
    aes = AES.new(KEY, AES.MODE_CBC, iv)
    ct  = aes.encrypt(pad(plaintext.encode(), BLOCK))
    return iv + ct                        # IV || ciphertext

def decrypt_msg(data: bytes) -> str:
    """Decrypt IV || ciphertext received from client."""
    iv, ct = data[:BLOCK], data[BLOCK:]
    aes    = AES.new(KEY, AES.MODE_CBC, iv)
    return unpad(aes.decrypt(ct), BLOCK).decode()

def main():
    print(f"[SERVER] Started on port {PORT}")
    print(f"[SERVER] KEY (hex) = {KEY.hex()}")
    print(f"[SERVER] Share this key with your teammate IN PERSON.\n")

    with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as srv:
        srv.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
        srv.bind(("", PORT))
        srv.listen(1)
        print(f"[SERVER] Waiting for connection...")
        conn, addr = srv.accept()
        print(f"[SERVER] Connected: {addr}\n")

        with conn:
            while True:
                data = conn.recv(4096)
                if not data:
                    print("[SERVER] Connection closed.")
                    break
                try:
                    msg = decrypt_msg(data)
                    print(f"[CLIENT → SERVER] {msg}")
                    reply_text = input("[SERVER reply] ")
                    conn.sendall(encrypt_msg(reply_text))
                except Exception as e:
                    print(f"[SERVER] Decrypt error: {e}")
                    conn.sendall(encrypt_msg("ERROR: decryption failed"))

if __name__ == "__main__":
    main()

#!/usr/bin/env python3
"""
CTF AES-CBC Encrypted Chat Client
──────────────────────────────────
Run:  python3 client.py
Enter the server IP and the shared KEY (hex) when prompted.
"""
import socket, os
from Crypto.Cipher import AES
from Crypto.Util.Padding import pad, unpad

BLOCK = 16

KEY_HEX = input("Enter server KEY (hex): ").strip()
SERVER  = input("Enter server IP:        ").strip()
PORT    = 9999
KEY     = bytes.fromhex(KEY_HEX)

def encrypt_msg(plaintext: str) -> bytes:
    iv  = os.urandom(BLOCK)
    aes = AES.new(KEY, AES.MODE_CBC, iv)
    return iv + aes.encrypt(pad(plaintext.encode(), BLOCK))

def decrypt_msg(data: bytes) -> str:
    iv, ct = data[:BLOCK], data[BLOCK:]
    aes    = AES.new(KEY, AES.MODE_CBC, iv)
    return unpad(aes.decrypt(ct), BLOCK).decode()

print(f"\n[CLIENT] Connecting to {SERVER}:{PORT}...")
with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as s:
    s.connect((SERVER, PORT))
    print("[CLIENT] Connected. Type messages below.\n")
    while True:
        msg = input("[YOU] ")
        if msg.lower() in ("quit", "exit"): break
        s.sendall(encrypt_msg(msg))
        reply = s.recv(4096)
        print(f"[SERVER] {decrypt_msg(reply)}\n")

# ── Terminal 1 (or left tmux pane): Start the server ──
cd ~/cryptopals/ctf
python3 server.py
# Note the KEY (hex) printed — share it with your teammate in person.
# Note your IP: hostname -I

# ── Terminal 2 (or right tmux pane): Start the client ──
cd ~/cryptopals/ctf
python3 client.py
# Enter the KEY and server IP when prompted

# ── Terminal 3 (optional): Capture your own traffic to verify encryption ──
sudo tcpdump -i lo -w ~/cryptopals/pcaps/my_traffic.pcap port 9999
# Ctrl+C to stop, then inspect:
tcpdump -r ~/cryptopals/pcaps/my_traffic.pcap -XX | head -40
# You should see raw ciphertext — no plaintext visible

# Find the network interface connected to the lab LAN
ip a                          # look for eth0, ens33, wlan0 etc.

# Sniff all TCP on port 9999 across the LAN (replace eth0 with yours)
sudo tcpdump -i eth0 port 9999 -w ~/cryptopals/pcaps/opponents.pcap

# Let it run while opponents communicate, then Ctrl+C

# Quick analysis — show hex payload of each packet
tcpdump -r ~/cryptopals/pcaps/opponents.pcap -XX

# Or open in Wireshark for GUI analysis:
wireshark ~/cryptopals/pcaps/opponents.pcap &

#!/usr/bin/env python3
"""
CTF Attacker Toolkit
─────────────────────────────────────────────────────────────────
Usage:
  1. Capture opponent traffic:
       sudo tcpdump -i eth0 port 9999 -w opponents.pcap
  2. Extract raw TCP payloads with tshark:
       tshark -r opponents.pcap -T fields -e data -Y tcp.payload > payloads.txt
  3. Run this script:
       python3 attacker.py payloads.txt
─────────────────────────────────────────────────────────────────
import sys, os

# ── 1. DETECT ECB MODE ────────────────────────────────────────────
def detect_ecb(data: bytes, bs=16) -> bool:
    """True if any 16-byte block repeats — ECB signature."""
    blocks = [data[i:i+bs] for i in range(0, len(data), bs)]
    return len(blocks) != len(set(blocks))

# ── 2. CHECK IV REUSE ─────────────────────────────────────────────
def check_iv_reuse(payloads: list[bytes]) -> bool:
    """True if all messages share the same first 16 bytes (IV)."""
    ivs = [p[:16] for p in payloads if len(p) >= 16]
    return len(set(ivs)) == 1

# ── 3. REUSED IV ATTACK ───────────────────────────────────────────
def reused_iv_attack(
    ct1: bytes, ct2: bytes, known_pt1: bytes
) -> bytes:
    """
    If the IV is reused:
      ct1 = AES_enc(pt1 XOR IV)
      ct2 = AES_enc(pt2 XOR IV)
    XOR of blocks:  ct1_b0 XOR ct2_b0 = pt1_b0 XOR pt2_b0
    Therefore:      pt2_b0 = ct1_b0 XOR ct2_b0 XOR pt1_b0
    """
    def xb(a,b): return bytes(x^y for x,y in zip(a,b))
    # Strip IV prefix if present (first 16 bytes)
    c1, c2 = ct1[16:], ct2[16:]
    return xb(xb(c1[:16], c2[:16]), known_pt1[:16])

# ── 4. MAIN ANALYSIS LOOP ─────────────────────────────────────────
def main():
    if len(sys.argv) < 2:
        print("Usage: python3 attacker.py payloads.txt")
        print("       (each line = hex-encoded TCP payload from tshark)")
        sys.exit(1)

    lines    = open(sys.argv[1]).read().strip().splitlines()
    payloads = []
    for line in lines:
        line = line.strip()
        if line:
            try:
                payloads.append(bytes.fromhex(line))
            except ValueError:
                pass   # skip non-hex lines

    print(f"\n[*] Loaded {len(payloads)} payloads\n")
    print("═" * 50)

    # ── ECB detection ──
    print("\n[1] ECB Mode Detection")
    ecb_found = False
    for i, p in enumerate(payloads):
        if detect_ecb(p):
            print(f"    ✓ Payload {i}: ECB mode detected! (repeated 16-byte block)")
            ecb_found = True
    if not ecb_found:
        print("    – No ECB detected. Likely CBC or CTR.")

    # ── IV reuse check ──
    print("\n[2] IV Reuse Check")
    if check_iv_reuse(payloads):
        print(f"    ✓ ALL {len(payloads)} payloads share the same IV: {payloads[0][:16].hex()}")
        print("    ✓ IV REUSE CONFIRMED — known-plaintext attack possible!")

        # Attempt reused-IV attack if we have ≥2 payloads and know pt1
        if len(payloads) >= 2:
            print("\n[3] Reused-IV Attack (requires known plaintext of msg 1)")
            # Common CTF scenario: first message is a known greeting
            known_guesses = [
                b"Hello, this is a",
                b"comment1=cooking",
                b"GET / HTTP/1.1\r\n",
                b"user=admin&pass=p",
            ]
            for guess in known_guesses:
                recovered = reused_iv_attack(payloads[0], payloads[1], guess)
                printable  = all(32 <= b < 127 for b in recovered)
                if printable:
                    print(f"    Possible pt2 block 0: {recovered.decode(errors='replace')!r}")
    else:
        print("    – IVs differ between messages (correct behaviour).")

    # ── Payload summary ──
    print("\n[*] Raw payload hex dump (first 5):")
    for i, p in enumerate(payloads[:5]):
        print(f"    [{i}] len={len(p):4d}  {p[:32].hex()}…")

    print("\n[*] Done. See Chapter 10 of the workbook for next steps.\n")

if __name__ == "__main__":
    main()

# Extract raw TCP data bytes, one hex string per line
tshark -r ~/cryptopals/pcaps/opponents.pcap \
       -T fields \
       -e data \
       -Y "tcp.payload and tcp.dstport==9999" \
       > ~/cryptopals/pcaps/payloads.txt

# Run the attacker
python3 ~/cryptopals/ctf/attacker.py ~/cryptopals/pcaps/payloads.txt