BrunnerCTF 2025 문제풀이

# brunner.bin → recovered.bin 복구 스크립트

from pathlib import Path
import sys

# --- 표준 AES S-box ---
SBOX = [
    0x63,0x7C,0x77,0x7B,0xF2,0x6B,0x6F,0xC5,0x30,0x01,0x67,0x2B,0xFE,0xD7,0xAB,0x76,
    0xCA,0x82,0xC9,0x7D,0xFA,0x59,0x47,0xF0,0xAD,0xD4,0xA2,0xAF,0x9C,0xA4,0x72,0xC0,
    0xB7,0xFD,0x93,0x26,0x36,0x3F,0xF7,0xCC,0x34,0xA5,0xE5,0xF1,0x71,0xD8,0x31,0x15,
    0x04,0xC7,0x23,0xC3,0x18,0x96,0x05,0x9A,0x07,0x12,0x80,0xE2,0xEB,0x27,0xB2,0x75,
    0x09,0x83,0x2C,0x1A,0x1B,0x6E,0x5A,0xA0,0x52,0x3B,0xD6,0xB3,0x29,0xE3,0x2F,0x84,
    0x53,0xD1,0x00,0xED,0x20,0xFC,0xB1,0x5B,0x6A,0xCB,0xBE,0x39,0x4A,0x4C,0x58,0xCF,
    0xD0,0xEF,0xAA,0xFB,0x43,0x4D,0x33,0x85,0x45,0xF9,0x02,0x7F,0x50,0x3C,0x9F,0xA8,
    0x51,0xA3,0x40,0x8F,0x92,0x9D,0x38,0xF5,0xBC,0xB6,0xDA,0x21,0x10,0xFF,0xF3,0xD2,
    0xCD,0x0C,0x13,0xEC,0x5F,0x97,0x44,0x17,0xC4,0xA7,0x7E,0x3D,0x64,0x5D,0x19,0x73,
    0x60,0x81,0x4F,0xDC,0x22,0x2A,0x90,0x88,0x46,0xEE,0xB8,0x14,0xDE,0x5E,0x0B,0xDB,
    0xE0,0x32,0x3A,0x0A,0x49,0x06,0x24,0x5C,0xC2,0xD3,0xAC,0x62,0x91,0x95,0xE4,0x79,
    0xE7,0xC8,0x37,0x6D,0x8D,0xD5,0x4E,0xA9,0x6C,0x56,0xF4,0xEA,0x65,0x7A,0xAE,0x08,
    0xBA,0x78,0x25,0x2E,0x1C,0xA6,0xB4,0xC6,0xE8,0xDD,0x74,0x1F,0x4B,0xBD,0x8B,0x8A,
    0x70,0x3E,0xB5,0x66,0x48,0x03,0xF6,0x0E,0x61,0x35,0x57,0xB9,0x86,0xC1,0x1D,0x9E,
    0xE1,0xF8,0x98,0x11,0x69,0xD9,0x8E,0x94,0x9B,0x1E,0x87,0xE9,0xCE,0x55,0x28,0xDF,
    0x8C,0xA1,0x89,0x0D,0xBF,0xE6,0x42,0x68,0x41,0x99,0x2D,0x0F,0xB0,0x54,0xBB,0x16,
]
# InvSBox는 SBOX의 역함수
INV_SBOX = [0]*256
for i, v in enumerate(SBOX):
    INV_SBOX[v] = i

def add_round_key(s: bytes, k: bytes) -> bytes:
    return bytes(a ^ b for a, b in zip(s, k))

def sub_bytes(s: bytes) -> bytes:
    return bytes(SBOX[b] for b in s)

def inv_sub_bytes(s: bytes) -> bytes:
    return bytes(INV_SBOX[b] for b in s)

def shift_rows(s: bytes) -> bytes:
    # column-major: r0=[0,4,8,12], r1=[1,5,9,13], r2=[2,6,10,14], r3=[3,7,11,15]
    s = list(s)
    r0 = [s[0], s[4], s[8],  s[12]]
    r1 = [s[1], s[5], s[9],  s[13]]
    r2 = [s[2], s[6], s[10], s[14]]
    r3 = [s[3], s[7], s[11], s[15]]
    def rot_left(x,n): n%=4; return x[n:]+x[:n]
    r0, r1, r2, r3 = rot_left(r0,0), rot_left(r1,1), rot_left(r2,2), rot_left(r3,3)
    out = [0]*16
    out[0], out[4], out[8],  out[12] = r0
    out[1], out[5], out[9],  out[13] = r1
    out[2], out[6], out[10], out[14] = r2
    out[3], out[7], out[11], out[15] = r3
    return bytes(out)

def inv_shift_rows(s: bytes) -> bytes:
    # 오른쪽 순환(역방향)
    s = list(s)
    r0 = [s[0], s[4], s[8],  s[12]]
    r1 = [s[1], s[5], s[9],  s[13]]
    r2 = [s[2], s[6], s[10], s[14]]
    r3 = [s[3], s[7], s[11], s[15]]
    def rot_right(x,n): n%=4; return x[-n:]+x[:-n] if n else x
    r0, r1, r2, r3 = rot_right(r0,0), rot_right(r1,1), rot_right(r2,2), rot_right(r3,3)
    out = [0]*16
    out[0], out[4], out[8],  out[12] = r0
    out[1], out[5], out[9],  out[13] = r1
    out[2], out[6], out[10], out[14] = r2
    out[3], out[7], out[11], out[15] = r3
    return bytes(out)

def gf_mul(a: int, b: int) -> int:
    """GF(2^8), 모듈러스 x^8+x^4+x^3+x+1 (0x11B)"""
    res = 0
    for _ in range(8):
        if b & 1:
            res ^= a
        hi = a & 0x80
        a = ((a << 1) & 0xFF)
        if hi:
            a ^= 0x1B
        b >>= 1
    return res

def mix_columns(s: bytes) -> bytes:
    s = list(s)
    out = [0]*16
    for c in range(4):
        i = 4*c
        a0,a1,a2,a3 = s[i],s[i+1],s[i+2],s[i+3]
        out[i+0] = gf_mul(a0,2) ^ gf_mul(a1,3) ^ a2 ^ a3
        out[i+1] = a0 ^ gf_mul(a1,2) ^ gf_mul(a2,3) ^ a3
        out[i+2] = a0 ^ a1 ^ gf_mul(a2,2) ^ gf_mul(a3,3)
        out[i+3] = gf_mul(a0,3) ^ a1 ^ a2 ^ gf_mul(a3,2)
    return bytes(out)

def inv_mix_columns(s: bytes) -> bytes:
    s = list(s)
    out = [0]*16
    for c in range(4):
        i = 4*c
        a0,a1,a2,a3 = s[i],s[i+1],s[i+2],s[i+3]
        out[i+0] = gf_mul(a0,0x0e) ^ gf_mul(a1,0x0b) ^ gf_mul(a2,0x0d) ^ gf_mul(a3,0x09)
        out[i+1] = gf_mul(a0,0x09) ^ gf_mul(a1,0x0e) ^ gf_mul(a2,0x0b) ^ gf_mul(a3,0x0d)
        out[i+2] = gf_mul(a0,0x0d) ^ gf_mul(a1,0x09) ^ gf_mul(a2,0x0e) ^ gf_mul(a3,0x0b)
        out[i+3] = gf_mul(a0,0x0b) ^ gf_mul(a1,0x0d) ^ gf_mul(a2,0x09) ^ gf_mul(a3,0x0e)
    return bytes(out)

# --- 고정 라운드키 (ASCII 그대로 16바이트) ---
RK = [
    b"One_DoughLorean_",  # round 1
    b"MartyMcPie_With_",  # round 2
    b"Doc_Brown_Sugar!",  # round 3
]
assert all(len(k)==16 for k in RK)

def decrypt_block(ct: bytes) -> bytes:
    """한 블록(16B) 복구"""
    s = ct
    # round 3 → 2 → 1
    for rk in (RK[2], RK[1], RK[0]):
        s = inv_mix_columns(s)
        s = inv_shift_rows(s)
        s = inv_sub_bytes(s)
        s = add_round_key(s, rk)
    return s

def decrypt_file(in_path: Path, out_path: Path):
    data = in_path.read_bytes()
    if len(data) % 16 != 0:
        raise ValueError(f"입력 길이가 16의 배수가 아님: {len(data)} bytes")
    out = bytearray()
    for off in range(0, len(data), 16):
        out += decrypt_block(data[off:off+16])
    out_path.write_bytes(bytes(out))
    print(f"[+] 복구 완료: {out_path} ({len(out)} bytes)")
    # 보기 좋게 일부 출력
    try:
        txt = bytes(out).decode("utf-8")
        print("[*] UTF-8로 해석한 내용(일부):")
        print(txt if len(txt)<=200 else txt[:200]+"...")
    except Exception:
        pass

if __name__ == "__main__":
    in_file  = Path(sys.argv[1]) if len(sys.argv) > 1 else Path("brunner.bin")
    out_file = Path(sys.argv[2]) if len(sys.argv) > 2 else Path("recovered.bin")
    decrypt_file(in_file, out_file)

for index, i in enumerate(q):
    line = ""
    line += chr(int(i.tcp.srcport, 16) >> 8)
    line += chr(int(i.tcp.srcport, 16) & 0xFF)
    line += chr(int(i.tcp.checksum, 16) >> 8)
    line += chr(int(i.tcp.checksum, 16) & 0xFF)
    line += chr(int(i.tcp.window_size, 16) & 0xFF)
    line += chr(int(i.tcp.len))
    line += chr(int(i.tcp.seq_raw, 16) >> 8)
    line += chr(int(i.tcp.seq_raw, 16) & 0xFF)
    line += "".join(
        [
            chr(int(i.tcp.segment_data[x : x + 2], 16))
            for x in range(0, len(i.tcp.segment_data), 3)
        ]
    )
    if "{" in line:
        print(index)