Analysis and Evaluation of the Windows Event Log - Bill Buchanan

C:\Documents and Settings\Barrie\My ...-aes\simpletcpserver-aes\Program.cs
element = doc.SelectSingleNode("/AES/passwordIterations");
int passwordIterations = Convert.ToInt16(element.InnerText);
element = doc.SelectSingleNode("/AES/initVector");
string initVector = element.InnerText;
element = doc.SelectSingleNode("/AES/keySize");
int keySize = Convert.ToInt16(element.InnerText);
if(!(Directory.Exists("C:\\Logs\\" + clientep.Address)))
Directory.CreateDirectory("C:\\Logs\\" + clientep.Address);
2
string logFile = "C:\\Logs\\" + clientep.Address +"\\EvtLog2.log";
TextWriter tsw;
try
{
tsw = File.AppendText(logFile);
}
catch
{
tsw = new StreamWriter(@logFile);
}
tsw.WriteLine("Connected with {0} at port {1}",
clientep.Address, clientep.Port);
int myCount = 0;
recv = 0;
while (true)
{
data = new byte[10240];
recv = client.Receive(data);
if (recv == 0)
break;
string encryptedMessage = Encoding.ASCII.GetString(data, 0, recv);
string decryptedMessage = Decrypt(encryptedMessage, passPhrase, saltValue,
hashAlgorithm, passwordIterations, initVector, keySize);
decryptedMessage = "" + DateTime.Now + "" +
decryptedMessage;
myCount++;
Console.Write(myCount + " ");
tsw.WriteLine(decryptedMessage);
client.Send(data, recv, SocketFlags.None);
}
Console.WriteLine("Disconnected from {0}", clientep.Address);
tsw.WriteLine("Disconnected from {0}",
clientep.Address);
tsw.Close();
client.Close();
newsock.Close();
}
static void writekey(string publickey)
{
StreamWriter fs = new StreamWriter("public.xml");
fs.Write(publickey);
fs.Close();
}
public static string Decrypt(string cipherText,string passPhrase,string saltValue,
string hashAlgorithm,int passwordIterations,string initVector,int keySize)
{
byte[] initVectorBytes = Encoding.ASCII.GetBytes(initVector);
byte[] saltValueBytes = Encoding.ASCII.GetBytes(saltValue);
byte[] cipherTextBytes = Convert.FromBase64String(cipherText);
PasswordDeriveBytes password = new PasswordDeriveBytes(passPhrase,saltValueBytes,
hashAlgorithm,passwordIterations);
byte[] keyBytes = password.GetBytes(keySize / 8);
RijndaelManaged symmetricKey = new RijndaelManaged();
symmetricKey.Mode = CipherMode.CBC;
ICryptoTransform decryptor = symmetricKey.CreateDecryptor(keyBytes,initVectorBytes)
;
MemoryStream memoryStream = new MemoryStream(cipherTextBytes);
CryptoStream cryptoStream = new CryptoStream(memoryStream,decryptor,
CryptoStreamMode.Read);
byte[] plainTextBytes = new byte[cipherTextBytes.Length];
String plainText;
try