streams = defaultdict(lambda: b"") cap = pyshark.FileCapture(f"C:\\Users\\23831\\Desktop\\so far so good\\dump.pcapng")
for p in cap: try: i = int(p.tcp.stream) streams[i] += bytes.fromhex(p.data.data) except: pass cap.close()
stream = streams[0]
kidxs = [i for i, x in enumerate(stream) if x == KEYSET] nidxs = [i for i, x in enumerate(stream) if x == NONCESET] print(f'{kidxs = }') print(f'{nidxs = }')
def read(): global stream s = stream[0] stream = stream[1:] return s
def read(self): self.code = read() self.param = read() self.len = read() self.data = [] for i in range(self.len): self.data.append(read())
def handle(self): global KEY, IV, cipher, keyset, nonceset, cipherset match self.code: case KEYSET: for i in range(32): KEY[i] = self.data[i] keyset = True cipherset = False case NONCESET: for i in range(8): IV[i] = self.data[i] nonceset = True cipherset = False case STORE: if not keyset or not nonceset: return if not cipherset: cipherset = True cipher = ChaCha20.new(key=bytes(KEY), nonce=bytes(IV)) dec = cipher.decrypt(bytes(self.data)) for i in range(self.len): FLAG[10 * self.param + i] = dec[i] if -1 not in FLAG: print(bytes(FLAG)) return True case RESET: KEY = [0] * 32 IV = [0] * 8 keyset = False nonceset = False cipherset = False
_stream = stream[:] for ki in kidxs: for ni in nidxs: if ki > ni: continue
try: stream = stream[ki:] m = Message() m.read() m.handle()
stream = stream[ni-ki-35:] m = Message() m.read() m.handle()
while len(stream)>0: ni = stream.index(NONCESET) if NONCESET in stream else 99999 si = stream.index(STORE) if STORE in stream else 99999 next_idx = min([ni, si]) stream = stream[next_idx:] m = Message() m.read() if m.handle(): break except: print('Exception') pass stream = _stream[:]
