A utility for playing with cryptography, geared towards ransomware analysis. CryptoTester is a powerful utility designed for in-depth cryptographic analysis, with a particular focus on ransomware investigation.
In this article, we’ll explore how CryptoTester provides a robust set of tools and features to aid in dissecting and understanding cryptographic elements, making it an invaluable asset for cybersecurity experts and researchers dealing with ransomware threats.
A utility for playing with cryptography, geared towards ransomware analysis.
Allows for selecting a cryptographic algorithm and its parameters, if supported.
Note: The IV Bytes (or Nonce, depending on algorithm) will automatically fill as 00 bytes of the appropriate length for the algorithm if it is left empty.
The input can be selected using two different modes: “Range” and “Chunks”.
A simple range starting at Offset, and taking Length bytes.
The Length will automatically update whenever Input is changed, unless the Lock Parameters checkbox is ticked.
If you have made some calculations in the Length field, and wish to revert to the actual length of the Input, you can simply press the Reset Length button.
If Splice Remaining Bytes is ticked, then any bytes before Offset are prepended to the Output, and any bytes after Offset+Length are appended.
Takes Take bytes, then skips Skip bytes, takes Take bytes, skips Skip bytes… until the end of Input. This can be used for ciphertext that is actually “interleaved” between chunks of plaintext.
The cryptographic algorithm is run on the resulting chunks as one sequential chunk, with no resetting of the key/IV/nonce etc.
If Splice Remaining Bytes is ticked, then any bytes in the Skip section are interleaved back into the Output.
This section displays simple information about the Input such as the filesize, detected MIME (if it is a file), total entropy, and whether it is divisible by 16 (a common block size).
The Input and Output views have synchronized scrolling; to disable this, uncheck the Syncronized scrolling checkbox between them.
The ???? button between the Input and Output can be used to move the Output to the Input view.
The Input or Output can be hashed using the respective dropdowns below their views. The Output can also have a verify algorithm ran on it (limited support for ECDSA currently).
This panel allows for comparing an encrypted file with its original. Both views support drag-and-drop, or File -> Open File can be used to open Original and Encrypted sequentially.
The Original view can also be filled using any of the File -> Input options; for example, comparing against a certain length of null bytes or the Windows sample picture Chrysanthemum.jpg.
The Original and Encrypted views have synchronized scrolling; to disable this, uncheck the Syncronized scrolling checkbox between them.
The ⇆ button between the Original and Encrypted views can be used to swap their contents.
Any bytes that differ between the two views will be displayed in dark red.
Displays basic information on the Original and Encrypted views respectively.
Once both views have been filled, a quick analysis is run against them.
Original is present in EncryptedEncryptedEncrypted (UTF-8 or UTF-16)Encrypted (in various forms and encodings)EncryptedThis panel allows for primitive use of a handful of compression algorithms, and has similiar functionality to the Encrypt/Decrypt panel.
A tool for analyzing CryptoAPI blobs and CNG blobs.
BLOBs can be imported/exported to/from binary, base64, PEM, XML, and ASN.1 formats, where supported.
Additional blob-related tools which are activated only for supported blob types as applicable.
Generates a CryptoAPI blob. The Bit Length is automatically updated with supported values for the selected aiKeyAlg. Note that some combinations of bType and aiKeyAlg are not valid, and will throw an error from the CryptoAPI provider.
Note: Keys are generated internally using CryptGenRandom, but I cannot guarantee the cryptographic security of using keys generated from this utility.
A tool for analyzing/calculating RSA keys. The seperate parameters of the key are displayed, and can be shown as decimal or hex. If enough parameters are present, the rest of the key can be calculated.
The key can be exported in various formats including a CryptoAPI blob, CNG blob, PEM, XML, and ASN.1, either to file, clipboard, or the Main Window (Encrypt/Decrypt). Additionally, if exporting to the Main Window, the raw integers can be exported for the Raw RSA algorithm.
A tool that searches a file for a cryptographic key in several formats.
Examples of supported formats:
A tool for testing various known PRNG algorithms.
Set the starting Seed for the PRNG.
Set the PRNG Algorithm, along with the Length of outputs to produce, and an optional Modulus to apply to each output. For example, a Modulus of xFF can be used to cast each output to a byte.
If Alpha is selected:
The entropy of the produced output is also displayed for Alpha output. This is a rough estimate of entropy (or number of possibilities) for blindly bruteforcing the output (without directly attacking the PRNG).
A tool for using different base encodings. Supports standard preset charsets, or supply your own custom charset.
With the exception of encoders that use a checksum (e.g. Bitcoin’s Base58Check), decoding is done without verifying the padding, so even partial or damaged encodings will be decoded raw.
A tool for viewing text or bytes as ASCII, UTF-8, and UTF-16 simultaneously.
A tool for validating elliptical curve points. Can import/export from/to an ECPoint (uncompressed or compressed forms), PEM, or CNG blob.
Various operations to be performed based on the current panel.
Takes the Original and Encrypted from the Compare panel, and applies the XOR or AND operation, and displays a stream.
Uses the algorithm information from the Encrypt/Decrypt panel and generates a keystream of given length to save to file.
Displays a graphical chart of difference between pixels in the Compare panel.
Uses the provided key material and Input from the Encrypt/Decrypt panel, and a given expected output, and enumerates all possible options in the Encryption Options section to try and find a match.
This tool can be used to test a list or folder of known keys against the Input using the specified cipher parameters.
Byte Count bytes of the file at a time.If a key is successfully matched, the Select button will be activated to allow passing the key and its parameters to the main window.
Using the blocksize of the selected cipher, enumerates over every possible block and attempts decryption using the specified key.
Example: You have an RSA-2048 private key, and a 0x1000 byte blob of possible ciphertext as Input. Using this operation will try decrypting Input[0x00:0x100], then Input[0x01:0x101], then Input[0x02:0x102] etc…
Note: This operation currently only supports the RSA algorithm. It is also limited to a max of 10000 input bytes.
Use little endian internally (if algorithm supports it).
Allows for setting custom parameters if selected algorithm supports any. For example, the Salsa20 family of algorithms support custom rounds, constant, position, or inputting a raw matrix.
Options for the IV, such as inputting from text or base64, and recovering an IV from known plaintext.
Presets for certain encryption schemes, e.g. OpenSSL.
Small tools for conversions.
Convert an integer to DWORD, or DWORD bytes to integer.
Convert hex bytes to a list of integers, or a list of integers to bytes. Spaces and commas for the output can be optionally set.
shadow-rs is a Windows kernel rootkit written in Rust, demonstrating advanced techniques for kernel manipulation…
Extract and execute a PE embedded within a PNG file using an LNK file. The…
Embark on the journey of becoming a certified Red Team professional with our definitive guide.…
This repository contains proof of concept exploits for CVE-2024-5836 and CVE-2024-6778, which are vulnerabilities within…
This took me like 4 days (+2 days for an update), but I got it…
MaLDAPtive is a framework for LDAP SearchFilter parsing, obfuscation, deobfuscation and detection. Its foundation is…