rendered paste body<?php /* cryptbin 0.6 public release */ /* cryptbin is written by Nadim Kobeissi (http://nadim.cc) and released under the Creative Commons Attribution-NonCommercial-NoDerivs 3.0 Unported license available at http://creativecommons.org/licenses/by-nc-nd/3.0/: You are free: to Share - to copy, distribute and transmit the work Under the following conditions: Attribution - You must attribute the work in the manner specified by the author or licensor (but not in any way that suggests that they endorse you or your use of the work). Noncommercial - You may not use this work for commercial purposes. No Derivative Works - You may not alter, transform, or build upon this work. Cryptbin costs time to develop, and money to host and secure. Please return the favour by donating: https://www.paypal.com/cgi-bin/webscr?cmd=_s-xclick&hosted_button_id=QG82GQ9UEX5DJ Visit us at http://cryptbin.net */ /* RELEASE NOTES 0.6: NEW: Public key cryptography! NEW: Huge design improvements. NEW: Now requires the GMP PHP extension. 0.5: NEW: Insurance mode! Enabling insurance mode will allow you to decrypt your data permanently for everyone by entering the password just once. 0.4c: FIX: Huge speed improvements! Let me know if cryptbin's still running slow for you. 0.4b: NEW: Tiny improvements. 0.4a: NEW: Security improvements. Small additions. FIX: Fixed occurences of random characters at the end of some decrypted data. 0.4: FIX: Fixes an important security bug. Update heavily recommended. NEW: Automatic generation of randomized, random-length encryption padding for increased protection against certain types of cryptography attacks. NEW: Now actually tells you if the passkey is incorrect instead of showing garbled data. FIX: Large amount of bug fixes, aesthetic and otherwise. FIX: No more "BEGIN DATA" and "END DATA" bracketing decrypted data. 0.3a: NEW: Cosmetic changes. 0.3: NEW: Automatic passkey salting. This extremely enhances security. Data encrypted under previous versions of cryptbin cannot be decrypted with this version. 0.2a: FIX: Performance bug fixes. 0.2: NEW: Improved ID generation mechanism to handle larger loads. 0.1: NEW: Initial release! */ /* IMPORTANT INSTALLATION NOTES Requirements: 1- Any HTTPD that supports PHP-CGI 2- PHP-CGI 5.x 3- The mcrypt PHP library 4- php-gmp support To install cryptbin, simply copy this file to a webserver. CRYPTBIN'S SECURITY DEPENDS HEAVILY ON YOUR SERVER'S SECURITY. Installing cryptbin without using HTTPS is nothing short of silly. Make sure your server has complimentary security settings, HTTPS at the very least, and also things like hardened PHP settings and patches (suhosin recommended), no rogue daemons running (telnetd, exim, proftpd), and it always helps to store the encrypted files on an encrypted hard disk partition, even though they're already encrypted. Above all, restrict access to your server as much as possible. CRYPTBIN CAN MAKE YOUR DATA SECURE, BUT IT'S YOUR SERVER CONFIGURATION THAT HAS TO PREVENT IT FROM BEING INTERCEPTED. https://cryptbin.net is a good example of a secure cryptbin server. You then need to edit the settings below to your suiting: */ /* CRYPTBIN INSTALLATION SETTINGS YOU NEED TO EDIT */ /* This is the URL for your cryptbin installation. Don't forget the trailing slash! This setting assumes you are saving cryptbin as index.php */ $install = "https://yourcryptbin.net/"; /* This is where the encrypted data is stored. Pick something not web-accessible. Don't forget the trailing slash! The folder needs to be readable and writable by the HTTP server. */ $cdir = "/var/super/secret/"; /* This is the character limit for posts. */ $charlimit = 80000; /* How many characters should ID's have by default? This will increase automatically as available ID's run out. */ $count = 3; /* END INSTALLATION SETTINGS YOU NEED TO EDIT */?><?php error_reporting (E_ALL ^ E_NOTICE); ?><?php print("<?xml version=\"1.0\" encoding=\"UTF-8\"?>"); ?><!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xml:lang="en" ><head> <meta http-equiv="Content-Type" content="application/xhtml+xml" /> <meta name="keywords" content="cryptbin, encrypted pastebin, pastebin, encrypted, paste bin" /> <link rel="icon" type="image/png" href="favicon.png" /> <title>cryptbin</title> <style type="text/css"> body { background-color: #FFF; margin: 2% 0 0 12%; font-family: "Verdana", "Arial", "Lucida Console", "Courier New", "Courier"; font-size: 11px; color: #333; margin-bottom: 15px; } input,select { background-color: #FFF; color: #05A0EB; padding: 2px; text-align: left; margin-bottom: 5px; border: 1px solid #34BEED; } textarea { color: #000; margin-bottom: 10px; border: 1px solid #34BEED; width: 670px; height: 350px; } div.env { width: 674px; height: 354px; margin-bottom: 10px; float: left; } span.red, span.bigred { color: #f00; font-weight: bold; } span.cyan { color: #05A0EB; font-weight: bold; } span.bigred { font-size: 17px; } p { max-width: 650px; } a { color: #f00; text-decoration: none; font-weight: bold; } a:hover { text-decoration: underline; } div.present { margin: 0 auto; display: block; width: 220px; } input.hidden { display: none; } a.nav { font-size: 10px; color: #fff; background-color: #f00; } a.nav:hover { text-decoration: none; color: #f00; background-color: #fff; } p.welcome { font-family: "Helvetica"; font-size: 16px; font-weight: bold; margin-bottom: -5px; } input.bouton { background-color: #34BEED; color: #FFF; } div.key { font-weight: bold; width: 230px; margin: 20px 0px 0px 25px; float: left; } div.keys { background-color: #34BEED; color: #FFF; padding: 5px; height: 220px; } input.keys { background-color: #34BEED; border: 1px solid #FFF; color: #FFF; font-size: 10px; } input.text { font-size: 10px; } input.store { background-color: #FFF; color: #F00; border: none; height: 33px; text-align: center; border: 1px solid #34BEED; border-left: none; width: 240px; margin: 15px 0px 0px -29px; padding-left: 33px; } input.store:active { background-color: #F00; color: #FFF; } </style></head><body> <?php /* DEFINITIONS */ $countr = 0; $p = "6863"; $g = "5"; $unlocked = 0; $unlockneeded = 0; /* END DEFINITIONS */ /* FUNCTIONS */ function gen($size) { for ($i=0; $i<$size; $i++) { $c=mt_rand(1,3); if ($c==1) { $gen .= chr(mt_rand(65,90)); } else if ($c==2) { $gen .= chr(mt_rand(48,57)); } else if ($c==3) { $gen .= chr(mt_rand(97,122)); } } return $gen; } function megagen($size) { for ($i=0; $i<$size; $i++) { $c=mt_rand(1,9); if ($c<=5) { $gen .= gen(1); } else if ($c>=6 && $c<=8) { $gen .= chr(32); } else if ($c==9) { $gen .= chr(13); } } return $gen; } function numgen($size) { $gen = chr(mt_rand(49,57)); $size--; for ($i=0; $i<$size; $i++) { $gen .= chr(mt_rand(48,57)); } return $gen; } function getdelim($KEY, $which) { if ($which == 1) { $delim = md5(substr($KEY, 0, -16)); } if ($which == 2) { $delim = md5(substr($KEY, 15, -0)); } return $delim; } function gensecret() { $secret = numgen(7); $secret .= gen(29); return $secret; } function genpublic($secret) { global $p; global $g; $secret1 = substr($secret, 0, -29); $secret2 = substr($secret, 7, 29); $secret2 = md5($secret2); $public = gmp_pow($g, $secret1); $public = gmp_mod($public, $p); $public = gmp_strval($public); return $public.$secret2; } function pub2key($secret, $public) { global $p; $secret = substr($secret, 0, -29); $public1 = substr($public, 0, -32); if (strlen($public) == 35) { $public2 = substr($public, 3, 32); } else { $public2 = substr($public, 4, 32); } $secret = strval($secret); $public1 = strval($public1); $key = gmp_pow($public1, $secret); $key = gmp_mod($key, $p); $key = gmp_strval($key); $key .= $public2; $key = md5($key); return $key; } function key2pub($secret, $public) { global $p; $secret1 = substr($secret, 0, -29); $secret2 = substr($secret, 7, 29); $public1 = substr($public, 0, -32); $secret1 = strval($secret1); $public1 = strval($public1); $key = gmp_pow($public1, $secret1); $key = gmp_mod($key, $p); $key = gmp_strval($key); $genpublic = genpublic($secret); if (strlen($genpublic) == 36) { $x = 4; } else { $x = 3; } if (substr($genpublic, $x, 32) == md5($secret2)) { $key .= md5($secret2); $key = md5($key); return $key; } else { return 0; } } function getkey($KEY, $padlength) { $keypad1 = substr(md5($KEY.$padlength), 0, -24); $keypad2 = substr(md5($KEY.$padlength), 24, -0); $KEY = substr(md5($keypad1.$KEY.$padlength.$keypad2), 1, -1); return $KEY; } function extractunit($string, $delim1, $delim2) { $pos = stripos($string, $delim1); $str = substr($string, $pos); $str_two = substr($str, strlen($delim1)); $second_pos = stripos($str_two, $delim2); $unit = substr($str_two, 0, $second_pos); return $unit; } function encrypt($field, $KEY) { $iv = mcrypt_create_iv(mcrypt_get_block_size(MCRYPT_TWOFISH, MCRYPT_MODE_CBC), MCRYPT_DEV_RANDOM); $padlength = strlen($KEY) * 768; $KEY = getkey($KEY, $padlength); $enc .= megagen($padlength); $enc .= getdelim($KEY, 1); $enc .= $field; $field = 0; $enc .= getdelim($KEY, 2); $enc .= megagen($padlength); $enc = mcrypt_cbc(MCRYPT_TWOFISH, $KEY, $enc, MCRYPT_ENCRYPT, $iv); $KEY = 0; return $enc; } function decrypt($field, $KEY) { $iv = mcrypt_create_iv(mcrypt_get_block_size(MCRYPT_TWOFISH, MCRYPT_MODE_CBC), MCRYPT_DEV_RANDOM); $padlength = strlen($KEY) * 768; $field = trim($field); $KEY = getkey($KEY, $padlength); $dec = mcrypt_cbc(MCRYPT_TWOFISH, $KEY, $field, MCRYPT_DECRYPT, $iv); if (strstr($dec, getdelim($KEY, 1)) && strstr($dec, getdelim($KEY, 2))) { return htmlspecialchars(extractunit($dec, getdelim($KEY, 1), getdelim($KEY, 2))); } else { return "Invalid key."; } $KEY = 0; } /* END FUNCTIONS */ print("<div><span class=\"bigred\"><a href=\"https://cryptbin.net\">cryptbin</a></span><br /><br /></div> <form action=\"".$install."\" method=\"post\"> <div class=\"env\"><textarea name=\"field\" rows=\"\" cols=\"\">"); if (isset($_GET["id"])) { $file = $cdir; $file .= $_GET["id"]; if (!file_exists($file) || preg_match('/[^a-z0-9-]/i', $_GET["id"])) { $invalid = 1; } if ($invalid) { print("Invalid ID."); } else { $fh = fopen($file, 'r'); $data = fread($fh, filesize($file)); fclose($fh); if (strpos($data, "RYPTBIN INSURED DATA") == 1) { print(substr($data, 22)); } else { $unlockneeded = 1; } } } else if ($_POST['bouton'] == "LOAD") { if (isset($_POST['secret']) && $_POST['secret'] != "" && strlen($_POST['secret']) <= 36 && ((isset($_POST['public']) && $_POST['public'] != "" && strlen($_POST['public']) <= 36) || (strpos($_POST['ID'], "-")))) { $file = $cdir.$_POST['ID']; if (!file_exists($file) || preg_match('/[^a-z0-9-]/i', $_POST['ID'])) { print("Invalid ID."); } else { $fh = fopen($file, 'r'); $data = fread($fh, filesize($file)); fclose($fh); if (strpos($_POST['ID'], "-")) { $insured = decrypt($data, $_POST['secret']); if (strpos($insured, "RYPTBIN INSURED DATA") == 1) { if ($_POST["insurance"] == "unlink") { unlink($file); file_put_contents($file, $insured); } print(substr($insured, 22)); $unlocked = 1; $insured = 0; } else { print("Invalid key."); $unlockneeded = 1; } } else { $KEY = key2pub($_POST['secret'], $_POST['public']); $decrypto = decrypt($data, $KEY); if ($decrypto != "Invalid key.") { $unlocked = 1; } else { $unlockneeded = 1; } print($decrypto); $decrypto = 0; $KEY = 0; $_POST['secret'] = 0; } } } else { print("NO KEY."); } } else if ($_POST['bouton'] == "STORE") { if (isset($_POST['secret']) && $_POST['secret'] != "" && (isset($_POST['public']) && $_POST['public'] != "" || $_POST['insurance'] == "insurance")) { if (strlen($_POST['secret']) <= 36 && strlen($_POST['public']) <= 36) { if (strlen($_POST['field']) <= $charlimit) { if ($_POST['insurance'] == "insurance") { $field .= "CRYPTBIN INSURED DATA\n"; } $field .= $_POST['field']."\n"; $_POST['field'] = 0; if ($_POST['insurance'] == "insurance") { $crypto = encrypt($field, $_POST['secret']); } else { $KEY = pub2key($_POST['secret'], $_POST['public']); $crypto = encrypt($field, $KEY); $KEY = 0; } $_POST['secret'] = 0; $field = 0; $ID = gen($count); $file = $cdir.$ID; while (file_exists($file)) { $ID = gen($count); $file = $cdir.$ID; $countr++; if ($countr > 2) { $count++; $countr = 0; } } if ($_POST['insurance'] == "insurance") { $file .= "-"; $ID .= "-"; } file_put_contents($file, $crypto); print($install); print("?id=".$ID); } else { print("Text field is too large. Limit is "); print($charlimit); print(" characters.\n"); } } else { print("Your keys don't check out.\n"); } } else { print("Please enter valid keys."); } } print("</textarea></div>"); if (isset($_GET['gen'])) { $secret = gensecret(); $public = genpublic($secret); print("<div class=\"key\"> <p>Send your public key to your friends, keep your secret key safe!</p> <div class=\"keys\"> Secret key:<br /><input type=\"text\" name=\"batata\" size=\"36\" class=\"keys\" value=\"".$secret."\" /><br /> Public key:<br /><input type=\"text\" name=\"banadoura\" size=\"36\" class=\"keys\" value=\"".$public."\" /><br /> <input type=\"submit\" value=\"COOL\" class=\"store\" name=\"bouton\" /> </div></div></form>"); } else if (isset($_GET["id"]) && $unlockneeded) { print("<div class=\"key\"><p>This data is encrypted and needs to be unlocked.</p>"); print("<input type=\"text\" class=\"hidden\" name=\"ID\" size=\"0\" value=\""); print(htmlspecialchars($_GET["id"])); print("\" />"); print("<div class=\"keys\">Your secret key:<br /><input type=\"text\" name=\"secret\" size=\"36\" class=\"keys\" /><br />"); if (strpos($_GET["id"], "-") <= 0) { print("Sender's public key:<br /><input type=\"text\" name=\"public\" size=\"36\" class=\"keys\" /><br />"); } print("<input type=\"submit\" value=\"LOAD\" class=\"store\" name=\"bouton\" />"); if (strpos($_GET["id"], "-")) { print("<br /><br /><input type=\"checkbox\" name=\"insurance\" value=\"unlink\" class=\"checkbox\" />Decrypt permanently"); } print("</div></div></form>"); } else if ($unlocked) { print("<div class=\"key\"><p>You have unlocked data <a href=\"".$install."?id=".$_POST['ID']."\">".$_POST['ID']."</a><br /><br /></p>"); print("<input type=\"text\" class=\"hidden\" name=\"ID\" size=\"0\" value=\""); print(htmlspecialchars($_GET["id"])); print("\" />"); print("<div class=\"keys\">Permalink:<br /><input type=\"text\" name=\"secret\" size=\"36\" class=\"keys\" value=\"".$install.$_POST['ID']."\" /><br />"); print("<input type=\"submit\" value=\"NEW DATA\" class=\"store\" name=\"bouton\" />"); print("</div></div></form>"); } else { print("<div class=\"key\"> <p>You need a cryptbin key pair.<br /><a href=\"".$install."?gen\">Don't have one?</a></p> <div class=\"keys\"> Your secret key:<br /><input type=\"password\" name=\"secret\" size=\"36\" class=\"keys\" /><br /> Recipient's public key:<br /><input type=\"text\" name=\"public\" size=\"36\" class=\"keys\" /><br /> <input type=\"submit\" value=\"STORE\" class=\"store\" name=\"bouton\" /> <p><br /><br /> <input type=\"checkbox\" name=\"insurance\" value=\"insurance\" class=\"checkbox\" /><strong>Insurance mode</strong> (<a href=\"faq\">?</a>) </p></div></div></form>"); } ?></body></html>