finished second :wiltedrose:

2025/platypwn/forensics/forensics-keyconversation/decrypt.py

@@ -0,0 +1,50 @@
+#!/usr/bin/env python3
+import base64
+import sys
+from cryptography.hazmat.primitives.ciphers.aead import AESGCM
+import traceback
+
+CIPHERTEXT = "Cf7z9+sZxDpNX4XxtVqY3X1NH+s/WlE6hWdpwKgIVRr3SdLls1dmYF7TFS/s2vlUVLxFb47Qd0f5t7GcKacwwvao++I4pA1ZHv8="
+NONCE = "1hAHFOm7LXsF7SCj"
+
+def b64decode_str(s: str) -> bytes:
+    try:
+        return base64.b64decode(s, validate=True)
+    except Exception as e:
+        raise ValueError(f"Invalid base64 input: {e}")
+
+def decrypt_aes256gcm(key: bytes) -> bytes:
+    nonce = b64decode_str(NONCE)
+    ciphertext = b64decode_str(CIPHERTEXT)
+    if len(key) != 32:
+        raise ValueError(f"Invalid key length: {len(key)} bytes (expected 32 bytes for AES-256)")
+
+    aesgcm = AESGCM(key)
+    plaintext = aesgcm.decrypt(nonce, ciphertext, None)
+    return plaintext
+
+def encrypt_aes256gcm(key: bytes) -> bytes:
+    nonce = b64decode_str(NONCE)
+    ciphertext = b64decode_str(CIPHERTEXT)
+    aesgcm = AESGCM(key)
+    test = aesgcm.encrypt(nonce, ciphertext, None)
+    return base64.b64encode(test)
+
+def main():
+    if len(sys.argv) != 2:
+        print("Error: Enter the path to the key binary file as an argument")
+        exit(1)
+    path = sys.argv[1]
+    with open(path, "rb") as f:
+        key = f.read()
+    try:
+        plaintext = decrypt_aes256gcm(key)
+    except Exception as e:
+        print(f"Decryption failed: {e}", file=sys.stderr)
+        traceback.print_exc()
+        sys.exit(2)
+
+    print(plaintext)
+
+if __name__ == "__main__":
+    main()