In this blog post.
I will summary what I've done wit Packet Tracer v7.2.1 Windows 32bit
Why I did this? I'm a lazy senior Networking student. My teacher give our class a lot homeworks, which is *.pka. These file format include answers, configuration validate, which I need to solve, called *Activity*. PT nowadays did not separate into Instructor (only version had Activity generator), and Student (did not have that feature, maybe only checking result is enough); just one leftover, Packet Tracer *universal*, has ability to generate *Activity*, also check result.
Activity can be setup with a password, only allow teacher, or anyone knew password to modify. :? If anyone, included me, can view, edit Activity, they can even view answer sheet :D If packet tracer can do the validation script, then I can.
Searching a little bit, in the past, someone did an analysis on PT, almost 9 years ago, https://b3nj1.blogspot.com/2010/05/packet-tracer-analysis.html.
That blog provide a script, but things changed, I have tried to compile, run, but fail due to "corrupted" data, turn out PT newer version introduce new way to *encrypt* file. But after *qUncompress*, they still use XML, let me see your hands, security researcher \m/
There are 2 ideas come up:
- Decrypt -> Get XML -> patch password to our password -> Encrypt -> redistribute -> profit
- Patch program -> skip validation -> Profit
So I cannot build an program to decrypt their file, unable to get password
Then I find out way 2 is promising, they checked the password I input with password in XML from input file, again, I repeat, *many* times. The algorithm is so simple, MD5 (or SHA1) of salt, concat with my input, must be equal to a value from XML decoded. Also, QScriptEngine has been involved in this situation, but no hiding, no encrypting, just plaintext.
But as I can count it on my fingers, it doesn't matter. Overload of functions just to check a single password :( SHIT, I will not invest my time into their password validation algorithm. Just *NOP-ed* their check :P
Anti debug made no sense :( Ppl use x64dbg nowaday, a lot :D
And the patch, that's mean I reverse the way how it work (74 -> 75), so in case you input the correct password, it won't work :D
No comments:
Post a Comment