Python to decrypt RSA / ChaCha20 ransomware - encryptor [Flare-On 2022]
FlareOn 9 provides a piece of ransomware that uses ChaCha20 encryption to encrpyt a file with a random key, and then encrypts that key using RSA and attachs it to the file. The critical mistake is that it uses the private key to encrypt the file, and thus I'm able to decrypt the file using just the elements attached to it. In this video, I'll script that decrpytion and recover the flag.
Full Writeup: https://0xdf.gitlab.io/flare-on-2022/...
☕ Buy Me A Coffee: https://www.buymeacoffee.com/0xdf
[00:00] Introduction
[00:25] Symmetric key vs asymmetric key encrpytion in ransomware
[02:15] Looking at encrypted test file
[03:05] Strategy for script
[03:21] Start Python script, reading file
[04:52] Using rsplit to split four times from the back
[07:12] Fetching encrypted key/nonce, n, and cipher text
[08:20] Decrypting with RSA using pow
[10:08] ChaCha decryption to get plaintext and flag