cs-mitm.py

#20211117 Didier Stevens
# mitmproxy script to intercept, decrypt and inject commands into Cobalt Strike beacon network traffic

import binascii
import Crypto.PublicKey.RSA
import Crypto.Cipher.PKCS1_v1_5
import Crypto.Cipher.AES
import hashlib
import hmac
import struct
import time

CS_FIXED_IV = b'abcdefghijklmnop'

dKeys = {
    "30819f300d06092a864886f70d010101050003818d003081890281810080fa8dc59ec39b73d49523c640c1cdfabbb0f0b15e943f2429c0c360862c938fb474523a0116f2ea71877f24218fc85cd959017cd0f987ec443a731a4d29a7a8fe1312d2edace8a736515d120c8f7b5e0008b7403ee3511435367f223c474ec2c0913c1dede6c1124b5089dc2aec3ef37ce24009a590ef4b8398f52e75c1f2ed020301000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000": "30820275020100300d06092a864886f70d01010105000482025f3082025b0201000281810080fa8dc59ec39b73d49523c640c1cdfabbb0f0b15e943f2429c0c360862c938fb474523a0116f2ea71877f24218fc85cd959017cd0f987ec443a731a4d29a7a8fe1312d2edace8a736515d120c8f7b5e0008b7403ee3511435367f223c474ec2c0913c1dede6c1124b5089dc2aec3ef37ce24009a590ef4b8398f52e75c1f2ed02030100010281800d789de81f1df515930584b8073976c7126577ae3edfa2fca6f3c0344baf4a363f35cb04cdea54b2d1eac207c70d9a72c02cc0b005af9a57be0490d3156e1d59ac7837c74987a296671f4264781050d39ccc16f5f5024699fe6f3aad9b77e874117e213b369ef6c58c43a4423585db42eb022251914f3110b52532620fe82dad024100f6c00bf6a8e14566029cfdfef39a77c50511056f235a0dc71b46c5d5b17b6494c290496a3d76635d5ae21f615bc5e04e2a2a2001957fec6b3ce88c0ca9a36aaf02410085d04e59788f32150b4039fc0140fa06a66181cb463cdec2d573111e8904fd4aadffa63e8f2f2063c7e212bef5981c1ed2ff6f1163a04662d483067658ceb32302403b44035b9a528935a83906f4be9402626b061c95061bb2257992b51fcf8240b54e4a13a815dd229ea09ea144e42311ee14488be9757c054ff8902e5b383f8cf702407fcd78d74926f2bd58968a0adf23b0e8a30623d2028e666f8d2fae1d0cdec010106947dd1e21f37c794eb97abad4019f8b043d8f4d28a9b100a8f78616c1ac2302403e247b8970b1e457b2c82759d3427a24edfa7d309a4a619ebfcab16cb2593a67564fe7c4d68b73958f856831e9fe1d4ba2ec4281234a2a903b4b07a50084b3d5",
    "30819f300d06092a864886f70d010101050003818d003081890281810084a5630da30447225f084704e282f6bea8bbb0a7043c30d0a85a0ab530d500ab7eb4e76eb6625ff6d65aae874aec7d2e5d2328fec7facabbec4d7d95e90276e6067f35aff4eb50285dcfd9a507a72c7d2e1e759ad171e55cf1b54a65584fd6dff42cd225b75ce08a1eac05b73b8a908e83a5d4784059d41434be80a37909255b020301000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000": "30820275020100300d06092a864886f70d01010105000482025f3082025b0201000281810084a5630da30447225f084704e282f6bea8bbb0a7043c30d0a85a0ab530d500ab7eb4e76eb6625ff6d65aae874aec7d2e5d2328fec7facabbec4d7d95e90276e6067f35aff4eb50285dcfd9a507a72c7d2e1e759ad171e55cf1b54a65584fd6dff42cd225b75ce08a1eac05b73b8a908e83a5d4784059d41434be80a37909255b02030100010281805ee3fd874cde0b914010a8d58ac10b88fb2641ca4912520d82d1df251d88d310dbf4c837004c41c05039d0eec21f89b1b83925e395e60850054cae11a6fdf755abed6e9075ffecb741a2b08e111b330e4f0531432c7645e1901d203ee48659d5695ceb3491bd060db77909524f6137fc703ffc38bb770b6726990eba5aa89c71024100e0983b76c4750d60e3a6b03e011514eba3a102f32a0d415463e7f96ebc6465d687abe2f13da3494f2b3cb0e56f32100f871320d11fb6885f652e5c72bbf684a30241009731b07dff8a44f22cf4db024016ce65783bb132432075d6dd420d5e7099db11747c25e1fdb04f2786805075d1c3d72bbdd344b88adc3b67eadbc4225bf5afe902403d472bca3ed5d4fd9f7f464cd48cc4f579e29f646b0fccc852ade32f64755c17c9528b8bd88e699d1125f0f9d879e749e547c1c76d08a772a7af9b87ae63175302404dbc07711094679457d6e04f4ce22ce5f0a648197e77cefe54ade42fbd16ed9210e0cf9d5c906c71f6ee3bf0079478298e24743da96f47bfcaf988e2dd82f9190240010485538c262473c0220bdf626974992fc8936be653e02433cd288e87ca0d707ce5feccdded153b9db8933dc2551048611885cb276dfbafe92421df2245664b",
    "30819f300d06092a864886f70d010101050003818d003081890281810093fad989ca301e1c35ea388ed3e0f8d103d7a021ee7dfc75d7084c7bcdf6a799fb4f0f8f008202f7b2c529632bf63572d2dc5029b7857790c5d2006d480100679c29bbfef2a021ad88fb6a0e26d3cd5bd7f6ddd620390cd4748f95ca11b86b641973a1a9b6cde3fa10987911a9ff4a57e4af084f810d40cef98ceb8956e6eb23020301000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000": "30820276020100300d06092a864886f70d0101010500048202603082025c0201000281810093fad989ca301e1c35ea388ed3e0f8d103d7a021ee7dfc75d7084c7bcdf6a799fb4f0f8f008202f7b2c529632bf63572d2dc5029b7857790c5d2006d480100679c29bbfef2a021ad88fb6a0e26d3cd5bd7f6ddd620390cd4748f95ca11b86b641973a1a9b6cde3fa10987911a9ff4a57e4af084f810d40cef98ceb8956e6eb23020301000102818043b630fc5fcc0cbb13e08ce8ae02ef5794ce81b385119907c2d1454e113ca00c517627c463931a108578ba2b6ade4a2eb455a348b3751af4dfcfebea155c7ff633aadced7fb5e0a06d1e1b9bfdd0e619e2eb2913510b195f76f87eea9211b9ca52c6f6ae9fe97e46df01b7c795b69552f684a9e63e08549bdaadbdfc40e0df81024100eb1ecc1f525fc2784e7a7dfe9f247d2a4128afdce4d2234567c95f53cc4572e93eed600fad25e6cf41e718792abcbd25b24c4b901085a0a3db1260cc7e458353024100a11f02a6bb4d1b196243620e03f028baeb69a6a0bd354f6e7882244505dd68728d116d4bda6550b8c795d4c0ace55f644ab39803d629d5e14ca1bcad7d614ef1024069ed681d3c69741deb8d78323cd49da769cfc0db8e23b64c50a402d4a81529de37c18e23c1e86f8234b8bee7e7ff3c603d61ee312ba0686d2a07afa0b1caf38d02401fa036a5039edef2dc96dd6862dd81212f944d60bfc2f7147813138b78db3ce53f4b6c68b735abe2994a8fb84237c3c1abe814aeac1b0a206f2a501ebdbd9c01024100c09a42f14aca7b3ee139f78eaa24b77e173c23ec3aa1a9c2d081c12455f69d1e703ee8c70e834e5545dceb5b5917d2678b102da29873d28e8b16fe6e70cc153b",
    "30819f300d06092a864886f70d010101050003818d0030818902818100a0c19b6be56991586a976ba6f176a4035268fe5d4faf038ccad9becd7f3ab8ab2d78df8e7cb9fc5789d38c8e848b54fdc1ab226059a99dd0a618ed8b776c39856d66ac862edff8e61d5a90cd8b177902f70638ecd085284467fd14cfc086fe073df6cc32b2c9f1b3460183d1e46b85a1d2e7f13bcf4a480a6e2de80b1398b5fd020301000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000": "30820278020100300d06092a864886f70d0101010500048202623082025e02010002818100a0c19b6be56991586a976ba6f176a4035268fe5d4faf038ccad9becd7f3ab8ab2d78df8e7cb9fc5789d38c8e848b54fdc1ab226059a99dd0a618ed8b776c39856d66ac862edff8e61d5a90cd8b177902f70638ecd085284467fd14cfc086fe073df6cc32b2c9f1b3460183d1e46b85a1d2e7f13bcf4a480a6e2de80b1398b5fd020301000102818100878691942605990e745691e05d834b04adee6c3b989910a21ac5f5f0e3494b34ad12514e9be264561c9127d762f0e0474a860f66315129062571b09a3aa517dc09e2f06d9880e04590ea3aa9dd556778238b64b5512b4f7f6ff752c18f77c24f2002da73a0c15b5d0b2f2a2ad5a3c5538fbe881511dbad711d864a23033e6401024100ce7bf0fe9d175383ebd8a43bda2abacf7f9d0cad5cff56c29447c6ae83094a9b819daf7398d9ee924bc25d8cb503503af8ce739833641d93a73fcf34680c0cfd024100c74e6ebe0c9f4ed0d1d099e77821c71cf9d1eecf707af590bfbfa722248657db2ae3213f77fdb2e060497e86faf9030441eb7440f0e535c2db8f8b77aca41d010240791c69766e5dc8369097397d81b19e7126c0cf36c05d645e2ceb0cb63f55abd51a698b079a97f93f0600b32e5cdddca93a569da6a03e10bb1256730aa21caf610241009a5019e23ff7a09881bb174e666f10b158a3b8591867bb760560a85101229b27703f4760d2d0b50c90c0969c7ff908e2e4ff1e95a16e767f966bbfba3b0b1e01024100b24befa0618f4dd1c6a1ecd3fe2e153276749cef1fb3e13772a9a8bb117e46abb2fa19d707361f81ece7a413648f0032722992a83e909c8a9896458cb3534718",
    "30819f300d06092a864886f70d010101050003818d0030818902818100a2e105c86c51aa20f5acde04b49423b30951600b0741533cd4e31fb0e24cf86b88c4b0e6596663d2425dcfd37dfe743146b06396b2bad828e9461c03cb052b71e5bb7cb17d2afc459007870a5d445ee3dadb5d267a197451e79fd4159347128e9de84da54bb32981042cf637fae69bf71f48046c0f63f49f95cb9af96d7aa611020301000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000": "30820276020100300d06092a864886f70d0101010500048202603082025c02010002818100a2e105c86c51aa20f5acde04b49423b30951600b0741533cd4e31fb0e24cf86b88c4b0e6596663d2425dcfd37dfe743146b06396b2bad828e9461c03cb052b71e5bb7cb17d2afc459007870a5d445ee3dadb5d267a197451e79fd4159347128e9de84da54bb32981042cf637fae69bf71f48046c0f63f49f95cb9af96d7aa61102030100010281802559ff0e803096182adeb2a75795e53de8741dd74999a471fdcbfbf77f5df1560fae33770fa7585ade574f128c012f3a21a0cfa5be64f4af2517abd2fedab7a46f6d183d2b99400c0cc6edfaf848a0aa47bd7d37d15ad30d09896a1ae66a8a7f36a9c2bad29ff176ea059da23d296edfe1294c88d8c393c62ad1a0a3c3a472b1024100e9b2948230a1788bdaeb0d782694d10a50b1e63b123f696b13ad31b23560386b19cf498d9137ea394534042fd7791706919d27a333c19d18acc2baedb6b42af5024100b26c49989f0ef67e5d6c02705cf34c5293131539d1b8f4c6f6feda86a6dde4d2b48ac71162c75a36889bd84bd9d90065149f67671447f80193c010affb85152d024100a5bb54a083766fb3d71bece07194062f678cd236c039223ca2a6a7e0b703b6df155db0cee9d69a8fe4e8ffb321ff28fa2a9825fd127e5337a5852fe5d7352c6502403e9001ee663794ef124b013fed17d2b751a2eb5a6ed36fe1245290c58e55581b19fb5f7a152cd9d12d6d981660b8da8e97009dfd62fb2957443ba09e548f81b1024006a17a330302d8142084c6c28dce3c6b252af8b8291443d3be98c60ce7d2a2c45ffb5228201875f345b5bd1fc621f90ae63804908afc2b2a503a74ea27a5c5aa",
    "30819f300d06092a864886f70d010101050003818d0030818902818100a70991d69d816a601ffa80976473830f0d3b41276d2790401ddedb18e2d3cab3c315e3222325be42b65adb2878f33f5a03ff5010b23e842a510c1482ad6a42f1e7e5726eb31813e7437640ed7879955f401e172c34d3517241596dd41f8e48d3d1b1c288e6c8752ff65dc27acccba4ba9cd6d0e4de6196cea4da480d3b99d0ed020301000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000": "30820276020100300d06092a864886f70d0101010500048202603082025c02010002818100a70991d69d816a601ffa80976473830f0d3b41276d2790401ddedb18e2d3cab3c315e3222325be42b65adb2878f33f5a03ff5010b23e842a510c1482ad6a42f1e7e5726eb31813e7437640ed7879955f401e172c34d3517241596dd41f8e48d3d1b1c288e6c8752ff65dc27acccba4ba9cd6d0e4de6196cea4da480d3b99d0ed02030100010281807f61a2dfe1b9619ff0831e31559f6960bf1c62f1682275b50f9275cf229b94c7458c996bdd15d96412a072e50867a7f6437a1e5abd3343a2e9afa6ac8906b2097c61cf5b2bd95418bfc05b2a24405f1a18be182745e9e8669f8c97aa32ef0a13c2245ea7bb3556ea719963ccc01f1e19ec9e90204d5a3466e3b43b094e3d0999024100f56507e3fe143670ddce758e67687958f1747c4e92b7073dfb87d6a3c99634ca1f9e48f28adf26a17f53f931cd949d094f1087d883524435b62ec6aa17ca30db024100ae419e625e48545440bfc30a3ec134a3c961684578a27b265488a9f922a5e1a41c25a506065d3e4a11ed0095933531f4c29c548c64ec374a48e0995220a22bd7024039b361e19832c4825185645af1b1bd26cecfa7130aa882c96e458890c6abcd09e1d96429b3c1b8e1ac80e04d779b8439561ffaf14c1fa1ee47424470665ba295024026250310b166cfdee99590924b8e6b8176f1b5ab8f6eb1da8022b26270ed32e983a7d1e9f1b6b38def429c2021eb41163d0b8f8e740129513f86bac9398f865d024100cd1ce32d491348455d3ecd6462b7ed583d04ce74a8802142d36bb87e8e67ff86fb6d6b5a33ff183d987bf9ad787f5f0b468f74b3d210f10bd0266b504306e47c",
    "30819f300d06092a864886f70d010101050003818d0030818902818100a738cde75f1fbb1c18646c377e03016b162b12ba72bdf7dc36b4cd2e4e9bae12205a95c26170bf908105ad7fa4bbccfa798632261bed9870f975f20794e1fe499523d71f08a56cae0315bfde3d6c8a16386b03b7a6551aa1336d50325a3500db27d78ad8fd13b6a73b9fb7c3fb4d7a088e323f07618656ecd83595fa5f823613020301000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000": "30820276020100300d06092a864886f70d0101010500048202603082025c02010002818100a738cde75f1fbb1c18646c377e03016b162b12ba72bdf7dc36b4cd2e4e9bae12205a95c26170bf908105ad7fa4bbccfa798632261bed9870f975f20794e1fe499523d71f08a56cae0315bfde3d6c8a16386b03b7a6551aa1336d50325a3500db27d78ad8fd13b6a73b9fb7c3fb4d7a088e323f07618656ecd83595fa5f823613020301000102818059eb70c54ee078341665c1cf61426a7bd412db62491b1ff259b48574b62e7ebf1e88b7692c0e7de44d8ce90bef60514c0b16ff5680c415aa026acaf80ab62f8f30698c7132530ddd46a44b7777387037312e49c59dc5a00e20967435f74cac6703a201ec3431b86008e0d973fa775799bc7b8863037270a33829c081e6cbaa11024100e25d4778e0d1e1e5cb65be3836f5d64af06d054ec6e3b03f78f6bde89ef2d9e4b932b735fc264a5c7a3d2a7c66d00187c3dca51c3ef758fdfde70564c1c2e8e9024100bd1d5576d0e8569d711d5aca42fd808c1f7085c5ced215180360adabd6c553414fdf4ccd9b91d6995c35886636cb14e6f453bff341f56cbae67218c17077099b0240620f127514bf16e29af7da2d33f1cf00eba1ee98afa3d6a7c858eaefa85b7f748b9da2ac2a2cd42db76e63c73c2a835f32c3946ae603f47322d83f07e4bff07102402d2e19e1e5ecebec773ea51717440af6eef7e9eda50889a3900303dabed7ab9939e4c62b84d425a9c3dec2347138b948a7ec6e3a4672c4c42e13ea1824af3bab024100bd154581c5d399c838f476b75482886fcdf194d8419d6564a8dc8b9c074e044359519e3bf6868fc3b4a5f8dd120f5e53813db9fb83fa3ca1fc404ea1c02fe0e5",
    "30819f300d06092a864886f70d010101050003818d0030818902818100a8b144135b042b57a1ca2048f5e0c624b98352933d53ca67003f97e8c3639898674b74a4de9406e05f85678a2ac13b653e7ab4fadf94e771d97ba2ee0dbe5876be50255f00404e094aecbc3ed3b286ac81f9b26a1e26df2c0363d4859e63d4c178d00e3228785f87e48623e64baa0624b88f8c969fd0be4f0e009edc107de509020301000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000": "30820276020100300d06092a864886f70d0101010500048202603082025c02010002818100a8b144135b042b57a1ca2048f5e0c624b98352933d53ca67003f97e8c3639898674b74a4de9406e05f85678a2ac13b653e7ab4fadf94e771d97ba2ee0dbe5876be50255f00404e094aecbc3ed3b286ac81f9b26a1e26df2c0363d4859e63d4c178d00e3228785f87e48623e64baa0624b88f8c969fd0be4f0e009edc107de50902030100010281806090f9334b4adbb4d27cee7655aa5242fb9f5d49c4358f0bdf6c87fd4abc5cc2017f844a4ccfd80fe11e70e2fb0e9a7d9e8287cf84e5ac87d3c39ec53f40d34a578e4d83754c27cf1dfb128f3f6be73f2a62118a46d0558c9023129196320c27689f1f5d805f622b78ba72aa8777f249c7e9db10301f37d0728cc3672b515931024100e077b061144d5b1ec755d409edfa45fdd313d57da203c3b9c111dc526993efc20f7b33ee7671fadaba6324fb6315184817b6b386dc6b92cd442381a4c94d88fb024100c063ca70c9885ab25b1f91cd5396866d6fdd82e00935109aa4e98c306abfe23423e02a9de14440f47e77188a7ce9cdff2b353f9f5036d9c9b8d9c553907ff2cb024100c4e71938bf8770041ad5e64fe38ae474d9011008c9e345811fa4dc410ace33c666b02b88e62bebe28d17c56c23a97088650ce684c9bc2fa5923d174f872a559b02407835a207291566be2c8ba4396c32105a8edc146b51b573637d09648bd8177f0a5f2430dca7255384b1044f3430ea91c90f415d3879115cb15b2bceccf0ebd153024051dc4bc183d0828850189fb54a62b6f49c1c781cfbe4963356c7703c5825ba322eba5e2e1368b62ab414393d371c8f5df6b8966b621aed933fc469ff4ef3517d",
    "30819f300d06092a864886f70d010101050003818d0030818902818100b22ee1f895f1d872618c1090316c5f5be9488c11056503b8c77fc2969850fe63f6fcd32708e8a5e49095c04526d73a509a46c4351640ce94598a4005d9b0af3b454e0b572002f524f88c34b5d3fbe2ec6508b7dbd6528b340d7fa6bf9a4529635e97845e0329b343b3e6d290665cc3fe852ac135524e7c0a08ab6830a0b01057020301000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000": "30820277020100300d06092a864886f70d0101010500048202613082025d02010002818100b22ee1f895f1d872618c1090316c5f5be9488c11056503b8c77fc2969850fe63f6fcd32708e8a5e49095c04526d73a509a46c4351640ce94598a4005d9b0af3b454e0b572002f524f88c34b5d3fbe2ec6508b7dbd6528b340d7fa6bf9a4529635e97845e0329b343b3e6d290665cc3fe852ac135524e7c0a08ab6830a0b01057020301000102818100a664f3af21cf9c528c57b16c064b6eedb4f7839dad8cfca1c4e3c142c2f0f7ef404a2fa14747830be41d8454cf85b4366b2be4b4b2984891eee01513a18bc6c6a1c6d21895cc26039f6acbcaa985d2aa08cf5b2155bebf0f4305f960f0d2b123ac6827d932170b7651a26f618ec72b0fd246e9c8ff9528fa95533a3b168b74e9024100e6b53acbc441cbc411b8815c9d959971356e8088477519524e0bf3d77d6d8b71e86d765b72042acb0e590ee1c7ffddaa9c63ed69592e615067c89c72247ac925024100c5b78e39f3553142982f9b730ebc230a641ae2302bc2218e8c82da19e6bdddf0cd756f340c161aa6a11bbbb59ec3fe3aa7cccdf30b5ff9bb2dd6d4919a6b50cb024100e0888b439bab498c768eb26018026c0711308da9949a33ddb595ce68f06ab7e751858f466a8e01b4042fcadb1512418375978f8d133d9f7a68b7870353dba87d024002ec60dcf87d14fa6017ac1bba670bb9969b5326d52ecca237efa35be8ae7bfe987b1906d2faecaff407ddf1a4844f58fcac298b636aaadd9aa2e787b399cc9b02406a5e97f4947b15e3b7feb6160b85228686d0099f3e99938dfd9535b09951b97d35bb6870789ae31f67794be4e2f7919d104e0610346ee7f174580e0da81cf3db"
}

def RSADecrypt(key, data):
    oPrivateKey = Crypto.PublicKey.RSA.importKey(binascii.a2b_hex(key))
    oRSAPrivateKey = Crypto.Cipher.PKCS1_v1_5.new(oPrivateKey)
    ciphertext = data
    try:
        cleartext = oRSAPrivateKey.decrypt(ciphertext, None)
    except ValueError:
        return None
    if cleartext == b'':
        return None   
    return cleartext


class cCrypto(object):

    def __init__(self, rawkey='', hmacaeskeys=''):
        self.rawkey = rawkey
        self.hmacaeskeys = hmacaeskeys
        if self.rawkey != '' and self.rawkey != 'unknown':
            sha256digest = hashlib.sha256(binascii.a2b_hex(self.rawkey)).digest()
            self.hmackey = sha256digest[16:]
            self.aeskey = sha256digest[:16]
        elif self.hmacaeskeys != '' and self.hmacaeskeys != 'unknown':
            self.hmackey = binascii.a2b_hex(self.hmacaeskeys.split(':')[0])
            self.aeskey = binascii.a2b_hex(self.hmacaeskeys.split(':')[1])
        else:
            self.hmackey = None
            self.aeskey = None

    def Decrypt(self, data):
        if self.aeskey == None:
            return data
        encryptedData = data[:-16]
        hmacSignatureMessage = data[-16:]
        hmacsSgnatureCalculated = hmac.new(self.hmackey, encryptedData, hashlib.sha256).digest()[:16]
        if hmacSignatureMessage != hmacsSgnatureCalculated:
            raise Exception('HMAC signature invalid')
        cypher = Crypto.Cipher.AES.new(self.aeskey, Crypto.Cipher.AES.MODE_CBC, CS_FIXED_IV)
        decryptedData = cypher.decrypt(encryptedData)
        return decryptedData

    def Encrypt(self, data):
        cypher = Crypto.Cipher.AES.new(self.aeskey, Crypto.Cipher.AES.MODE_CBC, CS_FIXED_IV)
        encryptedData = cypher.encrypt(data)
        hmacsSgnatureCalculated = hmac.new(self.hmackey, encryptedData, hashlib.sha256).digest()[:16]
        return encryptedData + hmacsSgnatureCalculated

class cTask(object):
    def __init__(self):
        pass

    @staticmethod
    def PadToMultiple(data, modulo):
        remainder = len(data) % modulo
        if remainder == 0:
            return data
        return data + b'A' * (modulo - remainder)

    @staticmethod
    def Package(taskNumber, arguments=b''):
        command = struct.pack('>II', taskNumber, len(arguments)) + arguments
        data = struct.pack('>II', int(time.time()), len(command)) + command
        return __class__.PadToMultiple(data, 16)

    def Exit(self):
        return __class__.Package(3)

    def Sleep(self, milliseconds, jitter):
        return __class__.Package(4, struct.pack('>II', milliseconds, jitter))

dRawkeys = {}

class Addon:

    def __init__(self):
        self.exporter = None

    def response(self, flow):
        print('cs-mitm: %s' % flow.request.path)
        if flow.request.path == '/match':
            encryptedMetadata = binascii.a2b_base64(flow.request.headers['Cookie'])
            for publicKey, privateKey in dKeys.items():
                decryptedMetadata = RSADecrypt(privateKey, encryptedMetadata)
                if decryptedMetadata != None:
                    print('cs-mitm: %s' % 'Found and decrypted metadata')
                    rawkey = decryptedMetadata[8:8 + 16]
                    rawkeyHex = binascii.b2a_hex(rawkey)
                    print('cs-mitm: %s' % ('Raw key: %s' % rawkeyHex))
                    dRawkeys[rawkey] = dRawkeys.get(rawkey, 0) + 1
                    oCrypto = cCrypto(rawkey=rawkeyHex)
                    if dRawkeys[rawkey] == 1:
                        exitTask = oCrypto.Encrypt(cTask().Sleep(5000, 0)) # sleep 5 seconds
                        print('cs-mitm: %s' % 'Sending "sleep 5" command')
                    elif dRawkeys[rawkey] == 2:
                        exitTask = oCrypto.Encrypt(cTask().Exit()) # exit
                        print('cs-mitm: %s' % 'Sending "exit" command')
                    print('cs-mitm: %s' % flow.response.headers)
                    print('cs-mitm: %s' % flow.response.raw_content)
                    flow.response.headers['Content-Length'] = b'%d' % len(exitTask)
                    flow.response.raw_content = exitTask
                    print('cs-mitm: %s' % flow.response.headers)
                    print('cs-mitm: %s' % flow.response.raw_content)
                    break

addons = [Addon()]