OpenClaw自动打CTF之HTTPS中间人攻击

OpenClaw自动打CTF之HTTPS中间人攻击

web4—e8df42d7-afdc-4a9b-9e86-dd379ecacdab.zip

HTTPS中间人攻击，只有这两个文件，请帮我再做一下，解出flag后告知一些思路

You2026年7月29日 13:54

Activity: 3 tools

Activity2026年7月29日 13:54

🦸

HTTPS中间人攻击，给了 sslkey.log（SSL密钥日志）和 target..pcap（抓包文件）。先看看内容：

超人

Activity: 12 tools

Tool outputexec

Exec# Check what tools are available Get-Command tshark, wiresh…n -ErrorAction SilentlyContinue | Select-Object Name, Source

Exec# Check if scapy is available python3 -c “import scapy; pri…p list 2>null | Select-String -Pattern “scapy|pyshark|dpkt”

Exec# Check if Wireshark/tshark is installed somewhere Get-Chil…ck PATH where.exe tshark 2>null where.exe wireshark 2>null

Exec# Install scapy for pcap analysis python3 -m pip install scapy 2>&1 | Select-Object -Last 5

Processkeen-sable

Exec# Check available Python packages python3 -m pip list 2>nu…String -Pattern “crypto|dpkt|scapy|tlslib|pyopenssl|tlslite”

Execpip install dpkt cryptography 2>&1

Processsalty-sage

Processsalty-sage

Exec# Try a lightweight install first – just dpkt without cryptography python3 -m pip install dpkt –quiet –timeout=30 2>&1

Execrun python3 inline script

Activity2026年7月29日 13:55

🦸

dpkt 装好了。先看看 pcap 里有什么：

超人

Activity: 3 tools

Tool outputexec

Writeto C:\Users\liyou.openclaw\workspace\mitm_challenge\analyze_pcap.py (2977 chars)

Execrun python3 C:Usersliyou.openclawworkspacemitm_challengeanalyze_pcap.py

Activity2026年7月29日 13:57

🦸

好的，分析得差不多了——本地回环抓的 TLS 1.3 流量，加密套件是 TLS_AES_256_GCM_SHA384。现在用 sslkey.log 解密：

超人

Activity: 2 tools

Tool outputwrite

Execrun python3 C:Usersliyou.openclawworkspacemitm_challengedecrypt_tls13.py

Activity2026年7月29日 13:58

🦸

解密失败了——TCP 段里可能有多条 TLS 记录，需要正确分段。重写解析器：

超人

Activity: 2 tools

Activity2026年7月29日 13:58

🦸

还是解密失败。让我检查 cryptography 库是否正确安装，并换个思路：

超人

Activity: 3 tools

Tool outputexec

Writeto C:\Users\liyou.openclaw\workspace\mitm_challenge\dump_packets.py (2908 chars)

Execrun python3 C:Usersliyou.openclawworkspacemitm_challengedump_packets.py

Activity2026年7月29日 13:59

🦸

数据包结构清楚了。让我用更精确的方式解密——先验证明文加密能对上：

超人

Activity: 5 tools

Tool outputwrite

Execrun python3 C:Usersliyou.openclawworkspacemitm_challengedecrypt_debug.py

Execrun python3 inline script

Exec# Check if openssl is available where.exe openssl 2>null #…ark via chocolatey choco list wireshark –local-only 2>null

Exec# Check if winget is available where.exe winget 2>$null # A….exe” -ErrorAction SilentlyContinue | Select-Object FullName

Activity2026年7月29日 14:00

🦸

我找到问题了！AAD 里的 length 应该是整个 encrypted_record 的长度（含认证标签），不只是密文长度：

超人

Activity: 3 tools

Activity2026年7月29日 14:01

cat decypt_fixed.py

import hmac, hashlib, struct
from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes
from cryptography.hazmat.backends import default_backend

def hkdf_expand(prk, info, length, h=hashlib.sha384):
    hl = h().digest_size
    n = (length + hl - 1) // hl
    t = b''
    for i in range(1, n+1):
        t = hmac.new(prk, t + info + bytes([i]), h).digest()
    return t[:length]

def hkdf_expand_label(secret, label, context, length, h=hashlib.sha384):
    fl = b'tls13 ' + label
    info = length.to_bytes(2,'big') + bytes([len(fl)]) + fl + bytes([len(context)]) + context
    return hkdf_expand(secret, info, length, h)

# Server handshake traffic keys
sh_sec = bytes.fromhex('f79308a69a3293440ee62b611d167382e7b8f612e5dd04b0be97b10a48b8e11b78db8381f8ae73ad5a25f40ef34ebaf6')
sh_key = hkdf_expand_label(sh_sec, b'key', b'', 32)
sh_iv  = hkdf_expand_label(sh_sec, b'iv', b'', 12)

# Client handshake traffic keys  
ch_sec = bytes.fromhex('3d7911046d45a4300710da97e4bb94c4fd7ebdbdce9b59f8682d28c94d52ba375d3922eef6c8b1812dc1d0186b884b9c')
ch_key = hkdf_expand_label(ch_sec, b'key', b'', 32)
ch_iv  = hkdf_expand_label(ch_sec, b'iv', b'', 12)

# Application data traffic keys
ca_sec = bytes.fromhex('3cbaac55ba741f8300190b0d847c784f646b90fbe605c8beb9a9e4e10d3c3379ed2ca4869e1a62d0f2786ba3c56fb781')
ca_key = hkdf_expand_label(ca_sec, b'key', b'', 32)
ca_iv  = hkdf_expand_label(ca_sec, b'iv', b'', 12)
sa_sec = bytes.fromhex('dabda0c0161c148b998b2755efa0ff97539afd98875f57315239609788724fc08920cbad123c09807e65212720e5649e')
sa_key = hkdf_expand_label(sa_sec, b'key', b'', 32)
sa_iv  = hkdf_expand_label(sa_sec, b'iv', b'', 12)

print("Keys derived successfully")
print(f"sh_key: {sh_key.hex()}")
print(f"ch_key: {ch_key.hex()}")
print(f"ca_key: {ca_key.hex()}")
print(f"sa_key: {sa_key.hex()}")

def try_decrypt(key, iv, seq, enc_data, rec_len, label):
    """Try decryption with the FIXED AAD formula using rec_len"""
    ct = enc_data[:-16]
    tag = enc_data[-16:]
    nonce = bytes(a^b for a,b in zip(iv, b'\x00\x00\x00\x00' + seq.to_bytes(8,'big')))
    # FIXED: AAD uses rec_len (the actual length from TLS record header)
    aad = struct.pack('!BHH', 0x17, 0x0303, rec_len)
    try:
        d = Cipher(algorithms.AES(key), modes.GCM(nonce, tag), backend=default_backend()).decryptor()
        d.authenticate_additional_data(aad)
        p = d.update(ct) + d.finalize()
        ascii_str = ''.join(chr(b) if 32<=b<127 else '.' for b in p)
        print(f"  [{label}] seq={seq} rec_len={rec_len}: OK -> inner_ct=0x{p[-1]:02x} plain={p.hex()}")
        print(f"    ASCII: {ascii_str}")
        return p
    except Exception as e:
        return None

def try_decrypt_all(key_iv_pairs, seq, enc_data, rec_len, label_prefix):
    for k, iv, lbl in key_iv_pairs:
        r = try_decrypt(k, iv, seq, enc_data, rec_len, f"{label_prefix}/{lbl}")
        if r: return r
    return None

# All key pairs to try
all_keys = [
    (sh_key, sh_iv, "S-HS"),
    (ch_key, ch_iv, "C-HS"),
    (sa_key, sa_iv, "S-App"),
    (ca_key, ca_iv, "C-App"),
]

# Test each encrypted record with each key and seq=0..10
records = [
    # (label, encrypted_hex, rec_len)
    ("Pkt5-R2 S-HS", "140d388679c058c9bd4f7c35db334cab97e86f4a6d8c9f", 23),
    ("Pkt5-R3 S-HS", "22c7fd72f53a4f14445a0dad938775417d27bc6dbd520b38abe71ab7440a69c0a543f515e6c21151f2fb269121e84d5dc409cb70e6ebcaa1bc5c8694fa6ad6e2d39f60f0f5dae46cf986ca17bfe85da8818cbd640893c618542282c586861c4feaa0e6942adc31e90ab59439198c21f44e7f8842265aa85cf1dc7f65a9cf6c6a7bd05583a251df3c92714e13a19cb308ca046d6ed65c3bc84ab2dc7a1cc08c6ed085bb2a96c0774d0ff5ff93d4e1b3e65c31213f40b60ce4c80b465702787800239e05f84ab1023b43a0ad000838a7f05f07734e242a959db080141153b038ab49ec84dc09f611315bc9150e436d3313aa91f64bc9528769046a136c7e7a06b86e0ee8ac0eea6ee0bc9757450a449bcfc0dd69f411cac339b4f6988e5e2cabaf4002f3af3fcf5fe2a14f123baea05ec70b2fe392ba1d7abde7f1e825bab8e54e752c90d01aa9001f169f19b051c3f404993c9aad03e6ea1f932b1a38efb352a40662f1460642062d5613052f8055e711fdfbda2080af2d7cee260a94f030f45381854196e99be26e4ace7228e073fd82dffdf5e1ecb0018a387f22d16dd9dc7792fe6ea86c8a071ffc8deca8fb04dbfac99141bb026c4a0f353178b15b58d5d37acf29943c2c59dbaf339e918cce8d48b02ccd44f9775ecb80f01760b9c879d35dabe9cbefd0a83909798d6add2f69965ef192055cb14f8028d58bd09efcf6e9a08ad90c14161b7f8df802e03558eccd23761b2411b3082e1f67d4f485233bc397f5529ddca24508e14b869bcd66cc4a9611d9094a8424184abac4589967ec31ef17831ce1e5668b25c0110d727251e486bf2e208506e39ae6a873c6352e6bcc80d73ab858c6cd27cdec762078b73a1e871f921a8179b255994b52ccccdbfaaa7304a104e039660da70410c7aa1162f8055c5c7b7a30f0a619d2aa93814e86d962c0a3221ee98776b89b97c0aa41fcec0cc1ae42ef1facb53985f3c8dcf7a9a68e3b45c038a07ccc074b4cea11246cd114664eaedfe7f2b17902e376cb6860da3c082566ecaf402857e5cfd3dc82791ab66e6abaf9234bed40ae11b55a6431b8c05224ecc6bf65333cfaf9d6113d80f7d8dc043eb7854eea95cfa360aa26a018a4759bc78524974ad32255ee09c06ae4a022db4729627b8abd26653fd1132b2b40a7bc4fd68883e33ae78a2bab36eb99ac9a3ac9edb7226a81466f60bcaeb8e61d260f61b879c4fc383e5df5d5b3234b54bb5100c13933d8749519f124078ca54b68b392ba28dff9341e193aa314212010db8676a412b10a3ae8c7b81e50e78b72e3791ce65c8c736a1e885ebddb3643903c0d883857c2d30f154b519d7275349d5730ff0a33b65446ca73b473ff2f0595113784ef9dd3972b9d63526fb05305db2a3df757809e9925c4ee148de1b9e8f9400d4caed74169d4b7a2696fd41c3616ad102f05e24fb2c7539e84e68c167eb6b69c723f48710b448e3452bcf36d482a02d3bdee109857575c038593b0cd766aa30ed2f2ececfc2ba238c4adf2b85aca83ea269b5fb858fb11b50ae9c7b2688c674704989bcc6e378d20a8ce1f093c21ca204a297d3458fad2142d87d5f0f97c4fb2cdb0bb819be5d36e121845835359c144b6d905a700f60a1fd7f44cc73aa7f1ed7029ebc8adb0b58405aaeb16c82f01ed5c1b4d33dcaf26b564f1127cc63830e786fe0e41f7162587b06a4bcc15be135bbceeb9cb8889e58edb262da1a1a2661fb75296e63dbb0f84f9a7cd7070a33bff521b0383d82e2294446ad2b8672532456a5ae88a48e0d6dd6614446313fea265bfa01ab63b52129a0249ff587b90006d4dd3c2cce61a385d78570d7465b67a5b61d19afb2ea807d129ffb30f086a", 1329),
    ("Pkt5-R4 S-HS", "3cd5cfc3cec77dae51354113bf28745555c9b7dafe68cd41902031e2147dbb1a45a2691b033582fb16ac18a8247a1b807562a1696e6d523d5292d47608495fbd4f5f6216321b75f681d73aaf31d82bb8433f2545534dda6ae6dd734cb9499ede83a138f71709cd361b49b0a3857be2e456d42dbe9ecfabe6df20d7416489f5b1c71dc5970b2f3b571615cb658dd5254db6b7151d3228fac08c9c27f973f2b4865bb87ac2dd8203d9457ef9ad6813b3240e848c2a4d55690f1c17b9ce8ccea8c9e2dfc5e0568e3ef16c87649abae3e2953387958033b2b00e36b4e82d2434c0bbedf1907ab3d009d26572e0fa6d5a66175317b8dcb29247919282ad608cbc9640b881cc1b71e46f7a3e4cc257be18e02d6feb5657cb6e5822a9c55fe061141429377032c342d9b545e2de69e4c5be3f2fd3f499162a055f8506296f316ddd65fb2b2a03704f66da67c52eb4121c4c99b54ad9985f0011865a941750f80efef26091f379bcb3311ab65491dcf7833ddc7ec9098bdb5f542fe9639c2fc88cad4c5bbe331b122290151612a1dd3be4cb32b52f5164e0b288b7e77d3ec1b41da02d933224816d8a6028618eb45f96db6a85d81c69d7d14f029cafa2c7d29535b08de6ba15e2d8b40d459471eacf17c44627e75d62fe25448a82f99e86627747f3bf992307f6534dae1bf52b3caf6ac4d553d6f5779072f3e034e068f60ae9854a951d5af7102f45e42e5eeff1df6107a12333e306d434c0f6e57668", 537),
    ("Pkt5-R5 S-HS", "d29315716213c284d748e9792e4b64e1a457fe136f5745853318e4dfbc662766678c96a16432514cc1344f0f833ac941dcc9977e2603bb4b797ddde70b019b93e5cee0c00b", 69),
    ("Pkt7-R1 C-HS", "0ace36040c452943bd52eef7609c55efe534a8e84a6b9fc28c9189d0497be9c98d49d32bd6232333a47191280b6c7abd516ffadaf6794d2de2fa1fefdfa6ccfabc00944d1b", 69),
    ("Pkt8-R0 C-App", "951f75f5d6063a53973e0632ca4edae51cb0cea216fbda27ff0a607a16d3d38c5c8be478ed7b77bbf7e616cf8568a04c41b5b7effd4efab21eec444f73e93110b0e60c7623e885ad5a1877aeaac5caeff081bd17ac353bb302f4efa44dc7a67b8dd2bf894cdeec3392ceccd9f4e8340875a3294a6a8a518bb024f2db382c9306b4ea5bdd67c4386fd605e892c9918c7663a6c484fd501015f218d836be08b3f4248624b96d8ba4d6e2149a1528340475dee6d2dcba22831e30412286ae", 189),
    ("Pkt9-R0 S-App", "eba54e667a23df9911ba1b37143a32bbd81ff8e630903bda30bd42c354a0d29ee82494b83cc97b66d9b4901cf14baec55009aadc1cbb9f1a1ce7887821f142b7e2fedf821b8336c7a4d94eae0830eed7159f5b698c840eaab820c44c088ec249e6ccc7e2db4dbb935831b5e931ed473d1b88eb881a4e701cba957b841f28a778354daefc065ab97ecdc274f6e513a1e1d7e2ac9b3448f2907425011de6868192ab4c88f1cf26bdb775bfbf1e75ab812940e8c20db2f453ab04575ffe54ec8dd7c4c2a340e88490e63c28d6c1aec0d68441b7b706561a7d9c52a72e635ca08bd98e474f292422861d7e381984380ec6f6c909808799f39de9147c", 250),
    ("Pkt10-R0 S-App", "3e63218a43041fc17b007a83048013b6cba8909e0f1c38fa406a349522f9b3de2e48b2033a9cc9492ac86307cf1c54cef6ae03216dca27e590deb58f18512d6db785b7772e83ac98045800298aae737864d09b0132d10616308d88e27999ef8c7c9e02cf996b862bd65b50aa298c4cddfdd341c9eb9b98d92797a238b428acdb3c8208358cc54038dae6afb0e74e127dae51e7df01a8faa5ee8a6dcbed737c27f63f1ba5df11bbd4969259c37c06a1dada8a95692d267ca3f2495bdf1107a93507abc00bb066da6ee1b20e69f8bdd715790c66151f42e08f16e1353e3f66b698d303eece111b53b1dccdf98e83dc7690962601f7dbbb9635e521", 250),
    ("Pkt10-R1 S-App", "16a83f2c686d9a687da833b3e7c578b7102e4fce5c32210ef6e7b7bb1d5f572cfbed3f00f7d9c74ed176527eb613305d7c8640ab7cb21663ac3b0464d1b0e73592fcd24255fd16a7a419826a741796d946012f8da7b196ccbe05e2345cd0138d92b59f32d246814cb9bab10f1c3f9a27ee134a4ba7cdc9226dc4d9bfd25f90063ee69fff6207835979ce800aec0b1494d4a9b70178eca39ca10911208f41c11a5dc6456fe050bbac002020abd4ebafdd30c346139f1d1b777439b54f4f80", 190),
    ("Pkt10-R2 S-App", "02befc9b54d76a4e3c117254be0f8d4e12b2fb123f66", 22),
    ("Pkt12-R0 C-App", "4b7797554a918a8c897b289d7c791209e79703", 19),
]

print("\n=== Attempting decryption with all keys ===")
for rec_label, enc_hex, rec_len in records:
    enc_data = bytes.fromhex(enc_hex)
    print(f"\n{rec_label} (len={rec_len})")
    found = False
    for k, iv, klbl in all_keys:
        for seq in range(10):
            r = try_decrypt(k, iv, seq, enc_data, rec_len, f"{klbl}")
            if r is not None:
                found = True
                break
        if found:
            break
    if not found:
        print(f"  All keys failed for seq 0-9")

output

C:\Users\liyou>python C:\Users\liyou\.openclaw\workspace\mitm_challenge\decrypt_fixed.py
Keys derived successfully
sh_key: fbfaefd2fef0387fb23e3655b67002199c558730159b4eceed0128a8c1d463e3
ch_key: cf84c95054f9dc8d76f96e1ad0bf208082aec94893500cd6b19304db102a218a
ca_key: d0841bc209cb06db9263c180c87923c2c6aafed50c3dc439a67e93992fa44fb8
sa_key: 392e48f36628288558a5a71d670fb576d34fee60d0e9e711792401f7da205f0a

=== Attempting decryption with all keys ===

Pkt5-R2 S-HS (len=23)
  [S-HS] seq=0 rec_len=23: OK -> inner_ct=0x16 plain=08000002000016
    ASCII: .......

Pkt5-R3 S-HS (len=1329)
  [S-HS] seq=1 rec_len=1329: OK -> inner_ct=0x16 plain=0b00051c000005180005133082050f308202f7a003020102021444696fd1fd6209d90618b61725a045010de173ce300d06092a864886f70d01010b050030163114301206035504030c0b63746673686f772e636f6d3020170d3235303730373036343930305a180f32313235303631333036343930305a30163114301206035504030c0b63746673686f772e636f6d30820222300d06092a864886f70d01010105000382020f003082020a0282020100ed0fcb799d61abad079139f87ca18e0f51417a376dbfae9fd82efd1fdcf71013ba3c21273873cc0cf58d3696d9f7a21941f5249a2c5903be1e4df356ed968441f2a8398bec1ee5aeae1ee2c6ece30acbc03e2d93d8990cb51375d95d0373e6b5f9bc1be4ded912758b2b5320d676a4f50b22bc8812f4a8ea4a363daefacb7251618de5f1484adb83e8f84eb323aa13415f21cd8f94fcf1945c4420f7ecf0a90d74b83d9d5d1c0e6dd1a35ef89c0a6015edc7de3d218bb10a665c7b3c13eaa0dc8736dfab0b189c1c086962ad0c8bcaa2ffbf1f152784ad2adce78041caadf756c852eb486e9ec94075fea69933517323f01a51a3f07a7469b2acea41a0a3afb06a44cd74ea554e9f7faf0df3fcf368472311cecbceca967fa0fdde568c3130d3219c783e5e920a03f943639140d83d0f8c13c7ea66c02453c8330556ccaf0c335ecd300246254d642c79ca2c65719af479501f1af762fb2c4061e1fb4c4c809bdc73972f1973e1a9e0646abed646045c02ca1e81362954c4da4ed80a776bde70689b437d9d54f277a68cd167dd714e3c45dc0dba03e69eec0c63203864258065b63da4ed3077e86a32334833f358672c1f0ab0df9520ac14dc2514b5b9969bc55e41e6b980a2c63a63fc9eb5b9051ee3ac3ab2e5462b5171b3b1ac74a5b2aa46a761332538ccad2f6cfbcfa8e3c9ee6fadb5d7b850ab83b950c723f5c0b06e990203010001a3533051301d0603551d0e041604148facbaf0dcf6f1671a92399960ca5e34b11b0534301f0603551d230418301680148facbaf0dcf6f1671a92399960ca5e34b11b0534300f0603551d130101ff040530030101ff300d06092a864886f70d01010b05000382020100c535a3638504f88b1212a6f0d91ff6071d54a3c5e70e786324446dc06db7066a9a102a7032bffd4a7e2de22122594f594381f188dbad8954cb84adc15b6119209661c4ddfb39e954834837d39be42820ccc02fa7407fd33ca6c06f44ae902e72fc3b45acd9a3512bbd79f83754807bb7507ca80ea2033fbdf6a5a1307df8be952a67f494bba30484bc74be670bce1f27a77de949b7f084c2bc6f4dc6e97785e1492d7d4554d7a3935d08981c0b0824a546013c7957144fe86c8296977973dfbf227a141c76691c1eef8c1dc606e7f6c65c41a09152f153835608878a85aca5783428882a1348ea8a5593c6c86793466eeabda7a3041ef5b84d0995b84eb3166b6387077d89c0af9e3f028032136fbdf23bf0c3b60dda7d34d5baed100641e1878da1f010d21599570695c28aeaa0bb7a7706b3d7a0160711fc22a4c274a75fddeb276ff9860894c85802d026cd88851c43ce09be3605d9e8e1f4b30cab65684da238b7c7aa7b5b50eefe13bf7af0431f1392dc0b9dd73bea68e542245f6483cc50740d5640bc5738e187af0c13764dd5851cf91f6e14612691ed898fce7e4e4f3c39ce0f70be91e5f5ee76da87ad9d3db7f9f001e269deea10e0c818fb8b15753ace5ec5ab86f0eae32a25e4b28c4d21cf0e5c2a5d7ce50f4a7cae1d6a91b5c4e4ba531b9f778e2ac289957c7bed2a64331c52e55c5914a05972047b219f9a52000016
    ASCII: ...........0...0..........Dio..b......%.E...s.0...*.H........0.1.0...U....ctfshow.com0 ..250707064900Z..21250613064900Z0.1.0...U....ctfshow.com0.."0...*.H.............0...........y.a....9.|...QAz7m............<!'8s....6.....A..,Y...M.V...A..9..............>-......u.].s.........u.+S .v..."......J6=...rQa...HJ....N.#..A_!......\D .....t.=.]..m..^...`....=!...f\{<.....6.......ib.........'..*...A...V.R.Hn..@u...3Qs#..Q..zti...A....jD.t.UN.......hG#..........V.10.!.x>^....Cc.@.=.....f.S.3.V...3^.0.F%Md,y.,eq..yP...b.,@a..LL...s./.s...dj..F.\....6)T..N..wk.ph.C}.T.w...g.qN<E........c 8d%.e.=..0w.j23H3.Xg,..... ...%......^A.....:c........:..F+Qq...t...F.a3%8../l......o....P...P.#...n.......S0Q0...U.............g..9.`.^4...40...U.#..0..........g..9.`.^4...40...U.......0....0...*.H..............5.c.............T....xcDm.m..j..*p2..J~-.!"YOYC......T....[a. .a...9.T.H7...( ../.@..<..oD...r.;E...Q+.y.7T.{.P|....?....0}...*g.......t.g...'.}.I.....oM..w..I-}ET...]......F.<yW.O.l...ys.."z..vi..........\A..R.S.V......x4(.*.H..U...g.Fn........M...N..kc..}....?..2.o..;.....}4.....A.........W.......zw........"..t._..'o.....X..&....C...6........ehM.8...{[P....z.C.......;.h.B_d..Pt.V@.W8.....vM.....n.a&.....~NO<9..p.....v....=.....i.........u:.^......*%...M!..\*]|..J|..j.....S..w.*...|{.*d3.R.\Y..Yr.{!..R...

Pkt5-R4 S-HS (len=537)
  [S-HS] seq=2 rec_len=537: OK -> inner_ct=0x16 plain=0f000204080402007064dd087d17cc1841d1c63be37bf7cb1edef2c07470c1c62088281b2bb1434ec42026d0253822e3ab1a6b6b1cea8e429f016f9ddecaacc9f00a5be5ac823076b5f7bbcc751ddde6faed508ba34a30ca26b2517c79b885d6d88e977042268e7c5abae00ee5a4673daa2b12f4aa8a4dcb598ab0190ca7856e06d000bdb8d48696b9cd8e9047451ed94f9d7a8e07950ced98ed4d188e377300bf75558df38af8653ca331936a19076bd1b62f79be6d11ff41aa173cf32c1722fa2ed14ff8a9f3c1489d65c6bf67d3ce52e63c0f038924980eaa70a2fe9f4fb9347748f0907b010973b23115eb05a30ea0d7b6b00fb6070180149e4c557b6a8991175ae7b62ed20a2692c4e86f44cd4e173267f5db821a22913be0cec89a0164f60b4a3c9eed3edb3e929eb83c261cef73d7e86b8944f7c09fc509cd97071a08efeb50b6a62a00d8e23645bf40a12fb9344715f4f46fcd301a084cbab1db2621cd6fe8c2478f51be572024d3c422069a182cd9d5a68bd0d615a1fee71e48d24a07af3ae6c0c59fa343a53829349d4b79de4ffece09aee758332c6e8a10484e4bac16b73d24153fdf339909777dc415e3ed9c56dff36e5830a092096e9df3d1c0aa662cdba2e9e18d366db4ca5ffe39e37cac81dbb24640adb40d4ee40e94261bcd21bcba1b8afccd240ab6a1c36e27b4e9aa137e4de65ef88e5bc5b7bb1635ff73b7a1d9700eed3716
    ASCII: ........pd..}...A..;.{......tp.. .(.+.CN. &.%8"...kk...B..o.......[...0v....u.....P..J0.&.Q|y......pB&.|Z.....g=.+....M.Y......n............GE..O.z.......M..7s..uU....e<.1.j..k../y.m..A..<.,."...O....H.e..g..R.<......p...O.4wH..{..s.1................LU{j...Z.....&...oD.N.2g....".;.....d..J<..>.>...<&..s..k.D............P..*...6E.@./.4G...o.0..L...&!.o..G.Q.W .."...,...........H.J..:.....C.8)4.Ky.O.....X3,n..HNK...=.?.3..w}.....V..nX0...n.....f,.....6m.._.9.|....F@...N...&..!..........n'....~M.^..[....5.s...p..7.

Pkt5-R5 S-HS (len=69)
  [S-HS] seq=3 rec_len=69: OK -> inner_ct=0x16 plain=14000030913e25c6a8617db73c29af8cbf217d98ee179f191997b1e1227faa9364db75fd399aa14c802157bc5a92b3b1d230b04216
    ASCII: ...0.>%..a}.<)...!}........."...d.u.9..L.!W.Z....0.B.

Pkt7-R1 C-HS (len=69)
  [C-HS] seq=0 rec_len=69: OK -> inner_ct=0x16 plain=1400003079ecf3861182739192979990623f3d44369aff8a3bc9c775efe8dbc6314bb73ea5e7bded27a892ad33fd1d2ad2429c7016
    ASCII: ...0y.....s.....b?=D6...;..u....1K.>....'...3..*.B.p.

Pkt8-R0 C-App (len=189)
  [C-App] seq=0 rec_len=189: OK -> inner_ct=0x17 plain=504f5354202f20485454502f312e310d0a486f73743a2063746673686f772e636f6d0d0a557365722d4167656e743a206375726c2f372e38312e300d0a4163636570743a202a2f2a0d0a436f6e74656e742d4c656e6774683a2032370d0a436f6e74656e742d547970653a206170706c69636174696f6e2f782d7777772d666f726d2d75726c656e636f6465640d0a0d0a666c61673d4354467b68747470735f7365637265745f646174617d17
    ASCII: POST / HTTP/1.1..Host: ctfshow.com..User-Agent: curl/7.81.0..Accept: */*..Content-Length: 27..Content-Type: application/x-www-form-urlencoded....flag=CTF{https_secret_data}.

Pkt9-R0 S-App (len=250)
  [S-App] seq=0 rec_len=250: OK -> inner_ct=0x16 plain=040000e500001c20303d8d6f08000000000000000000d0c9d2ed1d4f09cb4bf454200b0657b5f61c5c016f012e9b8b6a620de6a35e4521e08fca450d42bdcca4901bee7a07ff616db520fbc73bfb89d5d2d0e921251a0ba2cf5cc7a28b31fd8b342573153ad1247b76bf74c7df5aa0dd6a80a2e51934213d3613f33b4841fff37a965addab7c488df1dad738b729bb3df0a228cb98e00f96a678d94b21609d9b11362bf14c9f1fc1b90c68c384a74862601655bbe16e72085d84a017cf694152bdf731c224de37e325b5d1bbffdb51c78b3c91062d39f0c28a4d8bcbf921da73f62ac239f458b1000016
    ASCII: ....... 0=.o...............O..K.T ..W...\.o....jb...^E!...E.B......z..am. ..;......!%....\...1..4%s.:.{v.t..Z..j....4!=6..;HA..z.Z..|H....8.).=..(......x.K!`...6+.L.....h...Hb`.U..nr.]....iAR..1.$.7.%.....Q..<..-9...M...!.s.*.9.X....

Pkt10-R0 S-App (len=250)
  [S-App] seq=1 rec_len=250: OK -> inner_ct=0x16 plain=040000e500001c2099e60aa508000000000000000100d0c9d2ed1d4f09cb4bf454200b0657b5f673a888d9c83645d5cb293f342d60a3cec9be22a5fe10ddfdae09fa3dfdde7cfafee74a013fa954785e806d81188aee8bf82fa46a3e32fb55d50ee20ee25319e44798bebeb696d905f73b7ed93c0701a9a31adde5c32191918999c9fac439bc67312ca547155cb97d1dd67982acfd7f0977e700801dc406b3631b0ec094e2abfdedafefa93732b2ba975797251ef2a0f3f1a00c6be0c52c6a25b5c159ad51c33289df0389de254bd0dc61881bb614c9c805ae16d2c11ed006d06a79a3d18bb3e9000016
    ASCII: ....... ...................O..K.T ..W..s....6E..)?4-`...."........=..|...J.?.Tx^.m....../.j>2.U.....S..G........;~.<........!.......9.g1,.G.\.}..y.....w.......c...........72...W.%.......k..,j%..Y.Q.2.....%K..a...............jy........

Pkt10-R1 S-App (len=190)
  [S-App] seq=2 rec_len=190: OK -> inner_ct=0x17 plain=485454502f312e3120323030204f4b0d0a5365727665723a205765726b7a6575672f332e312e3320507974686f6e2f332e31302e31320d0a446174653a204d6f6e2c203037204a756c20323032352031363a34363a353420474d540d0a436f6e74656e742d547970653a20746578742f68746d6c3b20636861727365743d7574662d380d0a436f6e74656e742d4c656e6774683a20350d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a17
    ASCII: HTTP/1.1 200 OK..Server: Werkzeug/3.1.3 Python/3.10.12..Date: Mon, 07 Jul 2025 16:46:54 GMT..Content-Type: text/html; charset=utf-8..Content-Length: 5..Connection: close.....

Pkt10-R2 S-App (len=22)
  [S-App] seq=3 rec_len=22: OK -> inner_ct=0x17 plain=4f4b2e2e2e17
    ASCII: OK....

Pkt12-R0 C-App (len=19)
  [C-App] seq=1 rec_len=19: OK -> inner_ct=0x15 plain=023215
    ASCII: .2.

C:\Users\liyou>

🦸

解密成功了！🎉 问题出在 AAD 的 length 字段——之前我用了密文长度（不含 tag），实际上要用 TLS 记录头里的完整长度（含 16 字节 GCM tag）。

来看看解密结果：

客户端 HTTP 请求（Pkt8）——flag 就在这里面：

复制

POST / HTTP/1.1
Host: ctfshow.com
User-Agent: curl/7.81.0
Accept: */*
Content-Type: application/x-www-form-urlencoded
Content-Length: 27

flag=CTF{https_secret_data}

Flag: CTF{https_secret_data}

服务端响应（Pkt10）：

复制

HTTP/1.1 200 OK
Server: Werkzeug/3.1.3 Python/3.10.12
Date: Mon, 07 Jul 2025 16:46:54 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 5

OK...

解题思路复盘：

  1. 分析 pcap：14 个包，127.0.0.1:48908 ↔ 443，TLS 1.3 加密，加密套件 TLS_AES_256_GCM_SHA384
  2. 从 keylog 提取密钥：sslkey.log 给了 5 个 Traffic Secret（Client/Server Handshake + 0-RTT + Export）
  3. HKDF-Expand-Label 派生 key+iv：用 "tls13 key" / "tls13 iv" 标签和空 context 派生出 AES-256 的 32 字节密钥和 12 字节 IV
  4. 关键坑：AAD 里的 length 必须是 记录头的 length（含 GCM tag），而不是仅密文长度
  5. GCM nonce = IV XOR（4字节零 + 8字节大端序列号）
  6. 按顺序解出所有 AppData 记录，从 POST 请求体拿到 flag

HTTPS MITM 的典型套路：中间人抓到加密流量，但有 keylog 就能解密明文。这个挑战模拟的就是中间人获取到 SSL key log 后解密 HTTPS 流量的场景。

超人

发表评论