Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%

CVE-2013-0169 PoC — 多个TLS/DTLS实现加密问题漏洞

Source
Associated Vulnerability
Title:多个TLS/DTLS实现加密问题漏洞 (CVE-2013-0169)
Description:OpenSSL是OpenSSL团队开发的一个开源的能够实现安全套接层(SSL v2/v3)和安全传输层(TLS v1)协议的通用加密库,它支持多种加密算法,包括对称密码、哈希算法、安全散列算法等。 OpenSSL,OpenJDK,PolarSSL和其它产品中所使用的TLS协议1.1以及1.2,DTLS协议1.0以及1.2中存在漏洞,该漏洞源于程序在处理畸形的CBC填充期间没有正确地研究针对固执的MAC地址检查操作所进行的计时边信道攻击。通过对特制报文的计时数据的统计分析,远程攻击者可利用该漏洞实施区分攻击
Description
Exploit for cve-2013-0169
Readme
# LUCKY13 Exploit

This repository contains a proof-of-concept (POC) exploit for the LUCKY13 vulnerability (CVE-2013-0169), which is a timing attack against certain implementations of the CBC (Cipher Block Chaining) mode of operation in cryptographic systems. The exploit aims to decrypt a target token by leveraging the timing differences in responses based on padding validation.

## Prerequisites

Before running the exploit, ensure you have the following:

- Python 3.x installed on your machine.
- The `requests` library. 

## How It Works

The exploit works by:

    Creating a Payload: It generates a payload that includes a prefix of known bytes and a guess for the byte being tested.
    Timing the Response: It sends the payload as a cookie to the target server and measures the time taken for the server to respond. A valid padding will typically result in a shorter response time.
    Decrypting the Token: By iterating through all possible byte values (0-255) and recording the response times, the script identifies the byte that results in the shortest response time, indicating a valid padding.
    Building the Known Bytes: The script builds the decrypted token byte by byte, starting from the last byte and working backwards
File Snapshot

[4.0K] /data/pocs/b6c2d7bbd4a5183a0123897fe2134ac4a1f1bd4a ├── [2.7K] exploit.py └── [1.2K] README.md 0 directories, 2 files
Shenlong Bot has cached this for you
Remarks
    1. It is advised to access via the original source first.
    2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).
    3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.