Skip to content
This repository has been archived by the owner on Jun 7, 2023. It is now read-only.

Rats modules using outdated crypto library #710

Open
botherder opened this issue Oct 14, 2018 · 2 comments
Open

Rats modules using outdated crypto library #710

botherder opened this issue Oct 14, 2018 · 2 comments
Labels
help wanted This is something we need some help with
Milestone

Comments

@botherder
Copy link
Member

There are several modules in the rats/ folder by @kevthehermit that are using a crypto library called pycrypto, mostly for AES and DES support. Unfortunately, this library hasn't been updated since 2014 and also has a vulnerable ElGamal implementation:
https://nvd.nist.gov/vuln/detail/CVE-2018-6594

We should update these modules to make use of cryptography instead and drop pycrypto all together from our dependencies.

@botherder botherder added the help wanted This is something we need some help with label Oct 14, 2018
@botherder botherder added this to the 2.0 milestone Oct 14, 2018
@ghost
Copy link

ghost commented Oct 17, 2018

It seems that cryptography doesn't support DES, which is being used by the following Rats modules:

  • nanocore
  • albertino
  • adwind

https://cryptography.io/en/latest/hazmat/primitives/symmetric-encryption/

Other than the lack of DES support, I can work on refactoring out as much of the pycrypto use. Might need another library (maybe M2Crypto?) for handling the DES stuff.

adwind.py:from Crypto.Cipher import ARC4, DES
albertino.py:from Crypto.Cipher import DES
arcom.py:from Crypto.Cipher import Blowfish
bluebanana.py:from Crypto.Cipher import AES
hawkeye.py-deprecated:from Crypto.Cipher import AES
jrat.py:from Crypto.Cipher import AES, DES3
lostdoor.py:from Crypto.Cipher import ARC4
nanocore.py:from Crypto.Cipher import DES, AES
predatorpain.py-deprecated:from Crypto.Cipher import AES
unrecom.py:from Crypto.Cipher import ARC4
xrat.py:from Crypto.Cipher import AES, XOR

@botherder
Copy link
Member Author

@SpaceYacht that would be great.

@viper-framework viper-framework deleted a comment from Dipsonmick Feb 9, 2022
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
help wanted This is something we need some help with
Projects
None yet
Development

No branches or pull requests

1 participant