I'm trying something very simple and I can't figure out if the flaw is on me or on them.
1. Take a base64 encoded payload as Input: "AAAAI9Dw0qHYq9+61/XPtJS20bTAn+yV5o/hh+jK8J7rh+vLtpbr". I use the "From Base64" module.
2. The result is differential XOR crypt. The seed is 171. I select the XOR module and use 171 as the key. Then i pick "differential" option. Doesn't work.
1. Take a base64 encoded payload as Input: "AAAAI9Dw0qHYq9+61/XPtJS20bTAn+yV5o/hh+jK8J7rh+vLtpbr". I use the "From Base64" module. 2. The result is differential XOR crypt. The seed is 171. I select the XOR module and use 171 as the key. Then i pick "differential" option. Doesn't work.
Recipe: [{"op":"From Base64","args":["A-Za-z0-9+/=",false]}, {"op":"Drop bytes","args":["0","4",false]}, {"op":"XOR","args":[{"option":"Hex","string":"AB"},false,true]}]
Am I missing something? This is a very simple example.
The simple python code that decodes it is this:
def decrypt(string): key = 171 result = "" for i in string: a = key ^ ord(i) key = ord(i) result += chr(a) return result
string = "AAAAKtDygfiL/5r31e+UtsWg1Iv5nPCR6LfEsNGlwOLYo4HyhueT9tTu36Lfog=="
result = decrypt(base64.b64decode(string)[4:])
print "decoded: ", result print "Length: " , struct.unpack("I", string[0:4])