diff --git a/wireguard-attacker/df25519bytes-0.1.0-cp38-cp38-manylinux_2_17_x86_64.manylinux2014_x86_64.whl b/wireguard-attacker/df25519bytes-0.1.0-cp38-cp38-manylinux_2_17_x86_64.manylinux2014_x86_64.whl deleted file mode 100644 index ad612a163b6bda5c3d6b3077923c826b9f09df82..0000000000000000000000000000000000000000 Binary files a/wireguard-attacker/df25519bytes-0.1.0-cp38-cp38-manylinux_2_17_x86_64.manylinux2014_x86_64.whl and /dev/null differ diff --git a/wireguard-attacker/precomutation b/wireguard-attacker/precomutation index 1ade6cb7f03af7374e341e1507c41ebd0d993d1b..7d18be9ac5c431a22e168042f54d6059ef505b11 100755 --- a/wireguard-attacker/precomutation +++ b/wireguard-attacker/precomutation @@ -1,16 +1,13 @@ #!/usr/bin/env python -import signal -import sys -import os - - from base64 import b64decode from binascii import hexlify -from scapy.all import sniff, IP, UDP, Raw +from scapy.all import sniff, UDP from hashlib import blake2s +from hmac import HMAC from cryptography.hazmat.primitives.ciphers.aead import ChaCha20Poly1305 -from df25519bytes import compute_dh, generate_keypair +from cryptography.hazmat.primitives.asymmetric.x25519 import X25519PrivateKey, X25519PublicKey + CONSTRUCTION = "Noise_IKpsk2_25519_ChaChaPoly_BLAKE2s".encode('utf-8') IDENTIFIER = "WireGuard v1 zx2c4 Jason@zx2c4.com".encode('utf-8') @@ -55,8 +52,8 @@ def split_packet(data): 'mac2': data[76:92] } -def listen(): +def listen(): interface = "eth1" packets = [] @@ -68,26 +65,30 @@ def listen(): return (initialization, response) - def kdf(n, key, in_put): print("KDF computing") t0 = hmac(key, in_put) - t1 = hmac(t0, b'1') - t2 = hmac(t0, t1 + b'2') + t1 = hmac(t0, b'\x01') + t2 = hmac(t0, t1 + b'\x02') if n == 1: return t1 if n == 2: return (t1, t2) + def hmac(key, in_put): - return blake2s(in_put, key=key, digest_size=32).digest() + return HMAC(key, in_put, "blake2s").digest() + def hash(in_put): - return blake2s(in_put, digest_size=32).digest() -# Diffie Helmann -def dh(privkey, pubkey): - return privkey * pubkey + return blake2s(in_put).digest() + + +def compute_dh(priv, pub): + x25519Epriv = X25519PrivateKey.from_private_bytes(priv) + x25519serverPub = X25519PublicKey.from_public_bytes(pub) + return x25519Epriv.exchange(x25519serverPub) # # Network listening for initialization and response packets @@ -107,41 +108,26 @@ Hi = hash(Hi + SERVER_PUBKEY) print("SERVER_PUBKEY : ", hexlify(SERVER_PUBKEY)) print("Hi : ", hexlify(Hi)) +ephemeral_privkey = bytes.fromhex('208a9149b5ab1864bc01c5105db8f832a99b2355c4ea6182f919c564000f1659') +ephemeral_pubkey = bytes.fromhex('c9b64a50e368003a054b3870b00464a7293148ae57ce6eb6d0df7d6b84ec4638') - -# Ephemeral keypair -(ephemeral_privkey, ephemeral_pubkey) = generate_keypair() - -ephemeral_privkey = bytes.fromhex('506e4efdf583942dca4a91dafc629f4df648e3ad1264878b9d54e65897b1707d') -ephemeral_pubkey = bytes.fromhex('e6d527bc4153911d95536060ada0109006f4bd1f80d3411d55fca40408499a19') - -# print("Generated keypair:") -# print("- Epriv: " + bytearray(ephemeral_privkey).hex()) -# print("- Epub: " + bytearray(ephemeral_pubkey).hex()) - -# print() -# print("Spub: ", SERVER_PUBKEY.hex()) - -# Diffie Helmann of ephemeral private key and server public key -result_dh = compute_dh(ephemeral_privkey, SERVER_PUBKEY) -# print() -# print("Result of DH(ephemeral_privkey, SERVER_PUBKEY):") -# print(bytearray(result_dh).hex()) - -print() -print(bytearray(ephemeral_pubkey).hex()) -print(bytes(ephemeral_pubkey).hex()) +print("Epriv : " + bytearray(ephemeral_privkey).hex()) +print("Epub : " + bytearray(ephemeral_pubkey).hex()) # Key derivation function (KDF) for ephemeral public key and Ci -Ci = kdf(1, bytes(ephemeral_pubkey), Ci) +Ci = kdf(1, Ci, bytes(ephemeral_pubkey)) print("Ci : ", hexlify(Ci)) # Hashing Hi = hash(Hi + bytes(ephemeral_pubkey)) print("Hi : ", hexlify(Hi)) +# DH Computation en X25519 +result_dh = compute_dh(ephemeral_privkey, SERVER_PUBKEY) +print("result_dh : ", hexlify(result_dh)) + # Key derivation function (KDF) for Diffie Helmann result and Ci -(Ci, k) = kdf(2, bytes(result_dh), Ci) +(Ci, k) = kdf(2, Ci, bytes(result_dh)) print("Ci : ", hexlify(Ci)) print("k : ", hexlify(k)) @@ -150,14 +136,13 @@ print("len(k) : ", len(k)) # ChaCha20Poly1305 encryption of k chacha = ChaCha20Poly1305(k) -msg_static = chacha.encrypt(b"0"*12, SERVER_PUBKEY, Hi) - +msg_static = chacha.encrypt(b"\x00"*12, CLIENT_1_PUBKEY, Hi) print("msg_static : ", hexlify(msg_static)) Hi = hash(Hi + msg_static) print("Hi : ", hexlify(Hi)) -(Ci, k) = kdf(2, bytes(compute_dh(CLIENT_1_PRIVKEY, SERVER_PUBKEY)), Ci) +(Ci, k) = kdf(2, Ci, compute_dh(CLIENT_1_PRIVKEY, SERVER_PUBKEY)) print("Ci : ", hexlify(Ci)) print("k : ", hexlify(k)) @@ -165,11 +150,9 @@ print("k : ", hexlify(k)) chacha = ChaCha20Poly1305(k) -msg_timestamp = chacha.encrypt(b"0"*12, b'4000000065b2ade617e6c640', Hi) +msg_timestamp = chacha.encrypt(b"\x00"*12, bytes.fromhex("4000000065b8d6ae18000000"), Hi) print("msg_timestamp : ", hexlify(msg_timestamp)) Hi = hash(Hi + msg_timestamp) print("Hi : ", hexlify(Hi)) - - diff --git a/wireguard-attacker/requirements.txt b/wireguard-attacker/requirements.txt index 8de72537827613b0d1290b18061384e318532140..51a06987453a7bc42651b19bca9df17cbee2c49e 100644 --- a/wireguard-attacker/requirements.txt +++ b/wireguard-attacker/requirements.txt @@ -2,4 +2,3 @@ scapy aead pycryptodome tai64n -df25519bytes-0.1.0-cp38-cp38-manylinux_2_17_x86_64.manylinux2014_x86_64.whl