Brief introduction into Padding Oracle attack vector
1 like470 views
Padding oracle attacks exploit vulnerabilities in systems that reveal whether padding is valid or invalid after decrypting encrypted data. An attacker can use this information to decrypt ciphertext by manipulating plaintext blocks and observing the oracle's responses. The document describes the Vaudenay padding oracle attack technique in detail, explaining how an attacker can use a padding oracle to decrypt individual blocks of ciphertext one byte at a time through a brute force approach.
![Get byte 7 𝑃2(cont)
• desired conditions of valid padding is syllabic byte 02-02
• 𝐶1[7]=86⊕02=84
• Again solving an equation with
Two unknown variables!!
Web appliation penetration testing worksop - Mohsen ahmadi _ 2014-2015](https://image.slidesharecdn.com/paddingoracleattacks-170709212627/85/Brief-introduction-into-Padding-Oracle-attack-vector-28-320.jpg)
![Get byte 7 𝑃2
• So 0A⊕02=08
• 𝑃2[6]=08⊕0B=03
Web appliation penetration testing worksop - Mohsen ahmadi _ 2014-2015](https://image.slidesharecdn.com/paddingoracleattacks-170709212627/85/Brief-introduction-into-Padding-Oracle-attack-vector-31-320.jpg)
![Get the 6th byte of P2
• So A9⊕03=AA
• 𝑃2[5]=AA⊕A9=03
Web appliation penetration testing worksop - Mohsen ahmadi _ 2014-2015](https://image.slidesharecdn.com/paddingoracleattacks-170709212627/85/Brief-introduction-into-Padding-Oracle-attack-vector-32-320.jpg)
![Get the 5th byte of P2
• So 0E⊕04=0A
• 𝑃2[4]=0A⊕47=4D
Web appliation penetration testing worksop - Mohsen ahmadi _ 2014-2015](https://image.slidesharecdn.com/paddingoracleattacks-170709212627/85/Brief-introduction-into-Padding-Oracle-attack-vector-33-320.jpg)
![Get the 4th byte of P2
• So BD⊕05=B8
• 𝑃2[3]=B8⊕F4=4C
Web appliation penetration testing worksop - Mohsen ahmadi _ 2014-2015](https://image.slidesharecdn.com/paddingoracleattacks-170709212627/85/Brief-introduction-into-Padding-Oracle-attack-vector-34-320.jpg)
![Get the 3th byte of P2
• So 1D⊕06=1B
• 𝑃2[2]=1B⊕50=4B
Web appliation penetration testing worksop - Mohsen ahmadi _ 2014-2015](https://image.slidesharecdn.com/paddingoracleattacks-170709212627/85/Brief-introduction-into-Padding-Oracle-attack-vector-35-320.jpg)
![Get the second byte of P2
• So 35⊕07=32
• 𝑃2[1]=32⊕78=4A
Web appliation penetration testing worksop - Mohsen ahmadi _ 2014-2015](https://image.slidesharecdn.com/paddingoracleattacks-170709212627/85/Brief-introduction-into-Padding-Oracle-attack-vector-36-320.jpg)
![Get the first byte of P2
• So 6C⊕08=64
• 𝑃2[0]=64⊕2D=49
Web appliation penetration testing worksop - Mohsen ahmadi _ 2014-2015](https://image.slidesharecdn.com/paddingoracleattacks-170709212627/85/Brief-introduction-into-Padding-Oracle-attack-vector-37-320.jpg)
Brief introduction into Padding Oracle attack vector
- 1. Padding oracle attacks Mohsen Ahmadi Web appliation penetration testing worksop - Mohsen ahmadi _ 2014-2015
- 2. Vaudenay attacks • originally published in 2002 by Serge Vaudenay • in 2010 it was used for code execution in ASP.net Web appliation penetration testing worksop - Mohsen ahmadi _ 2014-2015
- 3. Oracle?! Vs. padding oracle?! • In cryptography is a system that will perform given cryptographic operations on behalf of the user • A padding oracle is a specific type of oracle that will take encrypted data from the user, attempt to decrypt it privately, then reveal whether or not the padding is correct Web appliation penetration testing worksop - Mohsen ahmadi _ 2014-2015
- 4. Block Cipher vs. Stream Cipher • Block Cipher • Encryption and decryption of a block of plaintext and cipher text are specific • all block encrypt/decrypt with the same key • Examples of block-cipher encryption algorithms are DES and AES • Stream-cipher • The Data is regarded as a stream of bits/bytes, encrypt and decrypt process undertaken against a bit or a byte every time • every bit/byte encrypt/decrypt with a different key • Examples of stream-cipher encryption algorithm is RC4Web appliation penetration testing worksop - Mohsen ahmadi _ 2014-2015
- 5. Operation mode block ciphers • Block cipher encryption algorithm like AES/DES themselves actually only designed to perform encryption/decryption of a block or blocks of plaintext cipher text only • In the mode of operation described how the encryption decryption is done against a plaintext blocks/the cipher text, how the relationship between a block with another block Web appliation penetration testing worksop - Mohsen ahmadi _ 2014-2015
- 6. ECB (Electronic Code Book) • Encrypt/decrypt each block individually • Each block encrypt/decrypt apart, with no relation between each other • weakness of ECB mode is when any plaintext blocks are identical, then cipher text will be identical Web appliation penetration testing worksop - Mohsen ahmadi _ 2014-2015
- 7. CBC (Cipher Block Chaining) • blocks are intertwined (chained) together • Two plaintext blocks are identical does not produce Cipher text blocks are identical Web appliation penetration testing worksop - Mohsen ahmadi _ 2014-2015
- 8. Padding(cont) • In a block-cipher the plaintext and cipher text must be cut into pieces and arranged in blocks of data of the same size • Because the data must be entered in blocks of the same size, then required padding bytes as data to fulfill the mountings to fit the size of the block Web appliation penetration testing worksop - Mohsen ahmadi _ 2014-2015
- 9. Valid Padding e.g. • If the data already contains 8 bytes ' ABCDEFGH ' why still need padding? • In the PKCS standards are already set up that must be added the padding all data, even though such data is even the size of a block is necessary Web appliation penetration testing worksop - Mohsen ahmadi _ 2014-2015
- 10. Invalid Padding e.g. • When the last byte of value outside the range 01 – 08, then the padding definitely not valid • When the last byte is 01, then the padding value must be valid • When the last byte is 02, then padding value is valid when the previous byte is 02 • When the last byte is valuable 03, then valid if the padding 2 bytes before also 03 Web appliation penetration testing worksop - Mohsen ahmadi _ 2014-2015
- 11. Padding oracle attack • Padding oracle attack works by detecting the response from the server that tells the client whether padding is valid or not • Keep in mind that checking the padding is done after the decryption was completed • Detect whether the padding bytes are valid or not, begins by looking at the last byte the last block and then saw new byte-byte before the content of the final byte is dependent Web appliation penetration testing worksop - Mohsen ahmadi _ 2014-2015
- 12. Encryption process(cont) Web appliation penetration testing worksop - Mohsen ahmadi _ 2014-2015
- 13. Encryption process in depth Web appliation penetration testing worksop - Mohsen ahmadi _ 2014-2015
- 14. Decryption process Web appliation penetration testing worksop - Mohsen ahmadi _ 2014-2015
- 15. Padding validation(cont) • Decryption process will not stop • After decryption validation check done by oracle • Separate plaintext from padding values Web appliation penetration testing worksop - Mohsen ahmadi _ 2014-2015
- 16. Padding validation(cont) • What is padding error in this e.g. ? Padding value is always between 1 to 8 Web appliation penetration testing worksop - Mohsen ahmadi _ 2014-2015
- 17. Padding validation • What is padding error in this e.g. ? Padding is correct but garbled data! Web appliation penetration testing worksop - Mohsen ahmadi _ 2014-2015
- 18. Malleability trait Web appliation penetration testing worksop - Mohsen ahmadi _ 2014-2015
- 19. Oracle in depth!(cont) • Oracle is a validation which we can ask and give answer by true or false, yes or no and another conditions or even blind In a web application • usually responded with oracle html text "Error", "Stack trace", "Invalid Padding Exception" or similar error message or • distinguish between the status codes of HTTP Web appliation penetration testing worksop - Mohsen ahmadi _ 2014-2015
- 20. Padding oracle structure • Attacker send many requests to oracle server (kind of brute-force attack) and check which Request produce valid padding message “500 Interval Server Error” -> padding invalid “200 OK” -> padding valid Web appliation penetration testing worksop - Mohsen ahmadi _ 2014-2015
- 21. POC! • http://192.168.149.144/oracle.php?str=2D7850F447A90B87123B36A03 8A8682F • Block cipher algorithm is DES 64bits with mode operation CBC Which conditions padding is invalid? Is it make difference type of block cipher in padding oracle attack? Web appliation penetration testing worksop - Mohsen ahmadi _ 2014-2015
- 22. Getting last byte of 𝐶2(cont) • break cipher text into the blocks • Because the length of cipher text is 32 bytes string in hex • Strlen(“2D7850F447A90B87123B36A038A8682F”)=32 • Mean the real length is 16 bytes • It could be presumed that this is a block-cipher with a block of length is 8 bytes • 2D7850F447A90B87 123B36A038A8682F 𝐶1 𝐶2 8 bytes 8 bytes Web appliation penetration testing worksop - Mohsen ahmadi _ 2014-2015
- 23. Getting last byte of 𝐶2(cont) • Payload which we send to Oracle consists of 𝐶1 + 𝐶2 which • 𝐶1: malformed cipher text block which send by attacker • 𝐶2: target block which decrypts • First block could contains null or any bytes order, but last byte will effect on last byte of decrypted cipher text that should make valid padding 00 00 00 00 00 00 00 00-FF 12 3B 36 A0 38 A8 68 2F Web appliation penetration testing worksop - Mohsen ahmadi _ 2014-2015
- 24. Getting last byte of 𝐶2(cont) • We should find last byte of intermediate value block which when XORed with our malformed cipher text block produce correct padding value (‘x01’) • There is one equation but with two unknown variables this equation cannot be solved Mathematically but fortunately We’ve Oracle! A⊕B=01 Web appliation penetration testing worksop - Mohsen ahmadi _ 2014-2015
- 25. Getting last byte of 𝐶2(cont) • A⊕00=01 -> invalid • A⊕01=01 -> invalid • A⊕02=01-> invalid • … • Hey guys Web appliation penetration testing worksop - Mohsen ahmadi _ 2014-2015
- 26. Getting last byte of 𝐶2(cont) • A⊕85=01 -> invalid • A⊕86=01 -> invalid • A⊕87=01-> valid • So what’s A? Web appliation penetration testing worksop - Mohsen ahmadi _ 2014-2015
- 27. Getting last byte of 𝑃2 • 𝐷 𝑘(𝐶2) is not 𝑃2! • 𝐶1⊕𝐷 𝑘(𝐶2) =𝑃2 • So 86⊕85=03 Web appliation penetration testing worksop - Mohsen ahmadi _ 2014-2015
- 28. Get byte 7 𝑃2(cont) • desired conditions of valid padding is syllabic byte 02-02 • 𝐶1[7]=86⊕02=84 • Again solving an equation with Two unknown variables!! Web appliation penetration testing worksop - Mohsen ahmadi _ 2014-2015
- 29. Get byte 7 𝑃2(cont) • we'll interrogate the Oracle to help us solve the equation in the form of brute force as follows: • If the Oracle respond with a status of “Wrong padding” that means the answer to the above questions is “NO”, meaning that it should try with the next question • When the Oracle respond with a status of “200 OK” that means the answer to the above question is ”YES!” Web appliation penetration testing worksop - Mohsen ahmadi _ 2014-2015
- 30. Get byte 7 𝑃2(cont) • A⊕00=02 -> invalid • A⊕01=02 -> invalid • A⊕02=02-> invalid • … • A⊕09=02-> invalid • A⊕0A=02-> valid • So what’s A? Web appliation penetration testing worksop - Mohsen ahmadi _ 2014-2015
- 31. Get byte 7 𝑃2 • So 0A⊕02=08 • 𝑃2[6]=08⊕0B=03 Web appliation penetration testing worksop - Mohsen ahmadi _ 2014-2015
- 32. Get the 6th byte of P2 • So A9⊕03=AA • 𝑃2[5]=AA⊕A9=03 Web appliation penetration testing worksop - Mohsen ahmadi _ 2014-2015
- 33. Get the 5th byte of P2 • So 0E⊕04=0A • 𝑃2[4]=0A⊕47=4D Web appliation penetration testing worksop - Mohsen ahmadi _ 2014-2015
- 34. Get the 4th byte of P2 • So BD⊕05=B8 • 𝑃2[3]=B8⊕F4=4C Web appliation penetration testing worksop - Mohsen ahmadi _ 2014-2015
- 35. Get the 3th byte of P2 • So 1D⊕06=1B • 𝑃2[2]=1B⊕50=4B Web appliation penetration testing worksop - Mohsen ahmadi _ 2014-2015
- 36. Get the second byte of P2 • So 35⊕07=32 • 𝑃2[1]=32⊕78=4A Web appliation penetration testing worksop - Mohsen ahmadi _ 2014-2015
- 37. Get the first byte of P2 • So 6C⊕08=64 • 𝑃2[0]=64⊕2D=49 Web appliation penetration testing worksop - Mohsen ahmadi _ 2014-2015
- 38. C2 Decrypted! • 𝐷 𝑘 123B36A038A8682F =IJKLM+030303 • Decrypting 𝐶2 is on your own as a homework! Web appliation penetration testing worksop - Mohsen ahmadi _ 2014-2015
- 39. Q&A! Web appliation penetration testing worksop - Mohsen ahmadi _ 2014-2015
- 40. Thanks Web appliation penetration testing worksop - Mohsen ahmadi _ 2014-2015