diff --git a/.gitignore b/.gitignore index 997ca2f846554a247d3cc3f653e17dd1d5a15ffe..8000dd9db47c0b9dd34046ec17880dcbb27e5eb9 100644 --- a/.gitignore +++ b/.gitignore @@ -1 +1 @@ -.vagrant \ No newline at end of file +.vagrant diff --git a/wireguard-attacker/attack-precomutation b/wireguard-attacker/attack-precomutation deleted file mode 100755 index 39385b4550efaa2730a26ed06344617a27fe025b..0000000000000000000000000000000000000000 --- a/wireguard-attacker/attack-precomutation +++ /dev/null @@ -1,86 +0,0 @@ -#!/usr/bin/env python - -import signal -import sys -from base64 import b64decode -from binascii import hexlify -from scapy.all import sniff, IP, UDP, Raw -from hashlib import blake2s -from cryptography.hazmat.primitives.ciphers.aead import ChaCha20Poly1305 -from Crypto.PublicKey import ECC - -CONSTRUCTION = "Noise_IKpsk2_25519_ChaChaPoly_BLAKE2s".encode('utf-8') -IDENTIFIER = "WireGuard v1 zx2c4 Jason@zx2c4.com".encode('utf-8') - -CLIENT_1_PUBKEY = b64decode('85Ey6fLDcFadWd+MRPHAuBEAHJ6MIUbl2jNsCZJXmRI=') -CLIENT_2_PUBKEY = b64decode('gtPyxcaZzC7LkLq/QGzvVLEHaIOfdJ6nb79wx8C7YT8=') -SERVER_PUBKEY = b64decode('+O7mAJK0m7Ts62WuP1Et1/RanAq5yFPAgDxuyR9TtD4=') - - -def kdf(n, key, input): - t0 = hmac(key, input) - t1 = hmac(t0, b'0x01') - t2 = hmac(t0, t1 + b'0x02') - - if n == 1: - return t1 - if n == 2: - returns (t1, t2) - -def hmac(input, key): - return blake2s(input, key=key, digest_size=16).digest() - -def hash(input): - return blake2s(input, digest_size=32).digest() -# Diffie Helmann -def dh(): - pass - -# server_pubkey = decode_pubkey(SERVER_PUBKEY) -# client1_pubkey = decode_pubkey(CLIENT_1_PUBKEY) - -print("CONSTRUCTION : ", hexlify(CONSTRUCTION)) - -Ci = hash(CONSTRUCTION) -print("Ci : ", hexlify(Ci)) - -Hi = hash(Ci + IDENTIFIER) -print("Hi : ", hexlify(Hi)) - -Hi = hash(Hi + SERVER_PUBKEY) -print("SERVER_PUBKEY : ", hexlify(SERVER_PUBKEY)) -print("Hi : ", hexlify(Hi)) - -ephemeral_privkey = ECC.generate(curve='Ed25519') -ephemeral_pubkey = ephemeral_privkey.public_key() -ephemeral = ephemeral_pubkey.export_key(format='raw') - -# print(ephemeral_privkey.export_key(format='PEM')) -# print(ephemeral_pubkey.export_key(format='PEM')) - -# print(hexlify(ephemeral_privkey.export_key(format='raw'))) -print("PUBKEY : ", hexlify(ephemeral)) - -print('\nPoints de la courbe et Seed') -print(ephemeral_privkey) -print(ephemeral_pubkey) - -Ci = kdf(1, ephemeral, Ci) -print("Ci : ", hexlify(Ci)) - -# ephemeral = ephemeral - -Hi = hash(Hi + ephemeral) -print("Hi : ", hexlify(Hi)) - -(Ci, k) = kdf(2, dh(ephemeral_privkey, SERVER_PUBKEY), Ci) - -# msg_static = aead(k, 0, , Hi) - -# Hi = hash(Hi + msg_static) - -# (Ci, k) = kdf(2, dh(CLIENT_1_PUBKEY, SERVER_PUBKEY), Ci) - -# msg_timestamp = aead(k, 0, timestamp(TAI64N), Hi) - -# Hi = hash(Hi + msg_timestamp) \ No newline at end of file diff --git a/wireguard-attacker/df25519bytes-0.1.0-cp38-cp38-manylinux_2_17_x86_64.manylinux2014_x86_64.whl b/wireguard-attacker/df25519bytes-0.1.0-cp38-cp38-manylinux_2_17_x86_64.manylinux2014_x86_64.whl new file mode 100644 index 0000000000000000000000000000000000000000..ad612a163b6bda5c3d6b3077923c826b9f09df82 Binary files /dev/null and b/wireguard-attacker/df25519bytes-0.1.0-cp38-cp38-manylinux_2_17_x86_64.manylinux2014_x86_64.whl differ diff --git a/wireguard-attacker/attack-mac-anonymity b/wireguard-attacker/mac-anonymity similarity index 100% rename from wireguard-attacker/attack-mac-anonymity rename to wireguard-attacker/mac-anonymity diff --git a/wireguard-attacker/precomutation b/wireguard-attacker/precomutation new file mode 100755 index 0000000000000000000000000000000000000000..a186b9ddd964140d82e9ee995f91a2a91c43f8c6 --- /dev/null +++ b/wireguard-attacker/precomutation @@ -0,0 +1,172 @@ +#!/usr/bin/env python + +import signal +import sys +import os + + +from base64 import b64decode +from binascii import hexlify +from scapy.all import sniff, IP, UDP, Raw +from hashlib import blake2s +from cryptography.hazmat.primitives.ciphers.aead import ChaCha20Poly1305 +from df25519bytes import compute_dh, generate_keypair + +CONSTRUCTION = "Noise_IKpsk2_25519_ChaChaPoly_BLAKE2s".encode('utf-8') +IDENTIFIER = "WireGuard v1 zx2c4 Jason@zx2c4.com".encode('utf-8') + +CLIENT_1_PUBKEY = b64decode('85Ey6fLDcFadWd+MRPHAuBEAHJ6MIUbl2jNsCZJXmRI=') +CLIENT_2_PUBKEY = b64decode('gtPyxcaZzC7LkLq/QGzvVLEHaIOfdJ6nb79wx8C7YT8=') +CLIENT_1_PRIVKEY = b64decode('4K7psRloW4i1aH+gSVYQ4fVfJPEx0z7etmGrWnfb73Y=') +CLIENT_2_PRIVKEY = b64decode('iIRaIDb42qAGxij8Ig+XWyP0csRpIShWD36rTS+/Xn8=') +SERVER_PUBKEY = b64decode('+O7mAJK0m7Ts62WuP1Et1/RanAq5yFPAgDxuyR9TtD4=') + +# SERVER_PUBKEY_2 = """-----BEGIN EC PUBLIC KEY----- +# +O7mAJK0m7Ts62WuP1Et1/RanAq5yFPAgDxuyR9TtD4= +# -----END EC PUBLIC KEY-----""" + +SERVER_PUBKEY_2 = "+O7mAJK0m7Ts62WuP1Et1/RanAq5yFPAgDxuyR9TtD4=" + + +def split_packet(data): + # Initializinig packet + if data[0] == 1: + return { + 'type': data[0], + 'reserved': data[1:4], + 'sender': data[4:8], + 'ephemeral': data[8:40], + 'enc_static': data[40:88], + 'enc_ts': data[88:116], + 'mac1': data[116:132], + 'mac2': data[132:148], + } + # Response packet + if data[0] == 2: + return { + 'message': data[0:60], + 'type': data[0], + 'reserved': data[1:4], + 'sender': data[4:8], + 'receiver': data[8:12], + 'ephemeral': data[12:44], + 'enc_empty': data[44:60], + 'mac1': data[60:76], + 'mac2': data[76:92] + } + +def listen(): + + interface = "eth1" + + packets = [] + sniff(iface=interface, filter="udp and port 51820", lfilter=lambda packet: bytes(packet[UDP].payload)[0] == 1 or bytes(packet[UDP].payload)[0] == 2, prn=lambda packet: packets.append(bytes(packet[UDP].payload)), count=2) + + initialization = split_packet(packets[0]) + response = split_packet(packets[1]) + + return (initialization, response) + + + +def kdf(n, key, in_put): + print("KDF computing") + t0 = hmac(key, in_put) + t1 = hmac(t0, b'1') + t2 = hmac(t0, t1 + b'2') + + if n == 1: + return t1 + if n == 2: + return (t1, t2) + +def hmac(key, in_put): + return blake2s(in_put, key=key, digest_size=32).digest() + +def hash(in_put): + return blake2s(in_put, digest_size=32).digest() +# Diffie Helmann +def dh(privkey, pubkey): + return privkey * pubkey + + +# # Network listening for initialization and response packets +# (initialization, response) = listen() + +# print('ENC_STATIC:' + initialization['enc_static']) +# print('ENC_TS:' + initialization['enc_ts']) + +# Hashings +Ci = hash(CONSTRUCTION) +print("Ci : ", hexlify(Ci)) + +Hi = hash(Ci + IDENTIFIER) +print("Hi : ", hexlify(Hi)) + +Hi = hash(Hi + SERVER_PUBKEY) +print("SERVER_PUBKEY : ", hexlify(SERVER_PUBKEY)) +print("Hi : ", hexlify(Hi)) + + + +# Ephemeral keypair +(ephemeral_privkey, ephemeral_pubkey) = generate_keypair() + +# print("Generated keypair:") +# print("- Epriv: " + bytearray(ephemeral_privkey).hex()) +# print("- Epub: " + bytearray(ephemeral_pubkey).hex()) + +# print() +# print("Spub: ", SERVER_PUBKEY.hex()) + +# Diffie Helmann of ephemeral private key and server public key +result_dh = compute_dh(ephemeral_privkey, SERVER_PUBKEY) +# print() +# print("Result of DH(ephemeral_privkey, SERVER_PUBKEY):") +# print(bytearray(result_dh).hex()) + +print() +print(bytearray(ephemeral_pubkey).hex()) +print(bytes(ephemeral_pubkey).hex()) + +# Key derivation function (KDF) for ephemeral public key and Ci +Ci = kdf(1, bytes(ephemeral_pubkey), Ci) +print("Ci : ", hexlify(Ci)) + +# Hashing +Hi = hash(Hi + bytes(ephemeral_pubkey)) +print("Hi : ", hexlify(Hi)) + +# Key derivation function (KDF) for Diffie Helmann result and Ci +(Ci, k) = kdf(2, bytes(result_dh), Ci) + +print("Ci : ", hexlify(Ci)) +print("k : ", hexlify(k)) +print("len(k) : ", len(k)) + +# ChaCha20Poly1305 encryption of k +chacha = ChaCha20Poly1305(k) + +msg_static = chacha.encrypt(b"0"*12, SERVER_PUBKEY, Hi) + +print("msg_static : ", hexlify(msg_static)) + +Hi = hash(Hi + msg_static) +print("Hi : ", hexlify(Hi)) + +(Ci, k) = kdf(2, bytes(compute_dh(CLIENT_1_PRIVKEY, SERVER_PUBKEY)), Ci) + +print("Ci : ", hexlify(Ci)) +print("k : ", hexlify(k)) + +chacha = ChaCha20Poly1305(k) + + +msg_timestamp = chacha.encrypt(b"0"*12, b'4000000065b2ade617e6c640', Hi) +print("msg_timestamp : ", hexlify(msg_timestamp)) + +Hi = hash(Hi + msg_timestamp) + +print("Hi : ", hexlify(Hi)) + + diff --git a/wireguard-attacker/requirements.txt b/wireguard-attacker/requirements.txt index 7594a131095d06297dff331a629ac3baf12bd281..37537798cdf3d51864851a69075bf9d35e61b604 100644 --- a/wireguard-attacker/requirements.txt +++ b/wireguard-attacker/requirements.txt @@ -1,3 +1,5 @@ scapy aead -pycryptodome \ No newline at end of file +pycryptodome +tai64n +df25519bytes-0.1.0-cp38-cp38-manylinux_2_17_x86_64.manylinux2014_x86_64.whl \ No newline at end of file