AUTOPWN Réquiem Cipher - thehackerslabs

#!/usr/bin/env python3
# AUTOPWN Réquiem Cipher - thehackerslabs - https://labs.thehackerslabs.com/machine/197
import hashlib
import random
from mido import MidiFile
from PIL import Image
import cv2
from Crypto.Cipher import AES
from Crypto.Util.Padding import unpad

# 1. Extraer clave AES del canal 2
mid = MidiFile("requiem_cipher.mid")
nibbles = []

for track in mid.tracks:
    for msg in track:
        if msg.type == "note_on" and hasattr(msg, 'channel'):
            if msg.channel == 2 and msg.note in [73, 74]:
                nibbles.append((msg.note, msg.velocity - 40))

key_bytes = []
for i in range(0, len(nibbles), 2):
    if i+1 < len(nibbles):
        high_note, high_val = nibbles[i]
        low_note, low_val = nibbles[i+1]
        if high_note == 73 and low_note == 74:
            byte_val = ((high_val & 0xF) << 4) | (low_val & 0xF)
            key_bytes.append(byte_val ^ 0x55)

key = bytes(key_bytes[:16])
print(f"[+] Clave AES: {key.hex()}")

# 2. Extraer bits del canal 9
bits = []
for track in mid.tracks:
    for msg in track:
        if msg.type == "note_on" and hasattr(msg, 'channel'):
            if msg.channel == 9 and msg.note == 35:
                bits.append('1' if msg.velocity > 80 else '0')

print(f"[+] Bits extraídos: {len(bits)}")

# 3. Reordenar bits
seed = int.from_bytes(hashlib.sha256(key).digest()[:4], "big")
rng = random.Random(seed)
indices = list(range(len(bits)))
rng.shuffle(indices)

payload_bits = ['0'] * len(bits)
for real_pos, shuffled_pos in enumerate(indices):
    payload_bits[real_pos] = bits[shuffled_pos]
payload_bits = ''.join(payload_bits)

# 4. Reconstruir QR
size = int(payload_bits[:8], 2)
print(f"[+] Tamaño QR: {size}x{size}")

qr_bits = payload_bits[8:8 + size * size]
img = Image.new("1", (size, size), 1)
for i, bit in enumerate(qr_bits):
    x, y = i % size, i // size
    img.putpixel((x, y), 0 if bit == '1' else 1)

img_scaled = img.resize((size * 10, size * 10), Image.NEAREST)
img_scaled.save("qr_recuperado.png")
print("[+] QR guardado")

# 5. Leer QR y descifrar
qr_img = cv2.imread("qr_recuperado.png")
detector = cv2.QRCodeDetector()
qr_data, _, _ = detector.detectAndDecode(qr_img)

if qr_data:
    iv_hex, ct_hex = qr_data.split(":")
    iv = bytes.fromhex(iv_hex)
    ct = bytes.fromhex(ct_hex)

    cipher = AES.new(key, AES.MODE_CBC, iv)
    flag = unpad(cipher.decrypt(ct), 16)
    print(f"\n[+] FLAG: {flag.decode()}")
else:
    print("[-] No se pudo leer el QR")