sh4d0wup 0.11.0

Signing-key abuse and update exploitation framework
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22

use crate::errors::*;
use crate::keygen::openssl::OpensslEmbedded;
use openssl::hash::MessageDigest;
use openssl::pkey::PKey;
use openssl::sign::Signer;

pub fn sign(signer: &OpensslEmbedded, data: &[u8], digest: MessageDigest) -> Result<Vec<u8>> {
    let secret_key = PKey::private_key_from_pem(signer.secret_key.as_bytes())
        .context("Failed to load signing key")?;

    let mut signer = Signer::new(digest, &secret_key).context("Failed to setup signer")?;
    signer.update(data).context("Failed to hash data")?;
    let signature = signer.sign_to_vec().context("Failed to sign data")?;

    debug!(
        "Generated signature ({} bytes): {:?}",
        signature.len(),
        signature
    );

    Ok(signature)
}