Staring Into The Abyss, A Bit Before Cansec

Hacking 2009. 3. 10. 09:49

Staring Into The Abyss, A Bit Before Cansec

I’m just going to come out and say it: I miss packet craft. Sure, we can always pull out Scapy, and slap amusing packets together, but everything interesting is always at the other layers.

Or is it?

For CanSecWest this year, I thought it’d be interesting to take a look at the realm of Deep Packet Inspectors. It turns out we were doing a lot of this around 2000 through 2002, and then…well, sort of stopped. So, in this year’s CanSecWest paper, “Staring Into The Abyss: Revisiting Browser v. Middleware Attacks In The Era Of Deep Packet Inspection” (DOC, PDF), I’m taking another crack at the realm — and I’m seeing really interesting capabilities to fingerprint, bypass, and otherwise manipulate systems that watch from the middle of networks, using protocol emulation abilities that have been part of browsers and their plugin ecosystem from the very beginning.

Ah, but here’s where I need some help. I’ve worked pretty closely with Robert Auger from Paypal, who just published his own paper, “Socket Capable Browser Plugins Result In Transparent Proxy Abuse”. We independently discovered the HTTP component of this attack pattern, and as I describe in my paper, we’ve kind of forgotten just how much can be done against Active FTP Application Layer Gateways.

So, if I may ask, take a look, check out my paper, and if you have some thoughts, corrections, or interesting techniques, let me know so I can integrate them into my CanSecWest presentation. Here’s the full summary, to whet your appetite:

DPI — Deep Packet Inspection — technology is driving large amounts of intelligence into the infrastructure, parsing more and more context from data flows going past. Though this work may be necessary to support important business and even security requirements, we know from the history of security that to parse data is to potentially be vulnerable to that data – especially when the parser is designed to extract context as quickly as possible. Indeed, companies such as BreakingPoint and Codenomicon have made their names building test tools to expose potential faults with DPI engines. But could anyone actually trigger these vulnerabilities? In this paper, we restart an old line of research from several years ago: The use of in-browser technologies to “tweak” Deep Packet Inspection systems.

Essentially, by controlling both endpoints surrounding a DPI system, possibly using the TCP (and sometimes UDP) socket code that plugins add to browsers, what behavior can we extract? We find three lines of attack worth noting.

First, firewalls and NATs — the most widely deployed packet inspectors on the Internet today — can still be made to open firewall holes to the Internet by having the browser trigger the Application Layer Gateway (ALG) for protocols like Active FTP. We extend older work by integrating mechanisms for acquiring the correct internal IP address of a client, necessary for triggering many inspection engines, we survey other protocols such as SIP and H.323 that have their own inspection engines, and we explore better strategies for triggering these vulnerabilities without socket engines from browser plugins. We also explore a potentially new mechanism, “Window Dribbling”, that allows an HTTP POST from a browser to be converted into a full bidirectional conversation by only allowing a remote sender to “dribble” a fixed number of bytes per segment.

Second, we (along with Robert Auger at Paypal) find that transparent HTTP proxies, such as Squid, will “override” the intended destination of browser sockets, allowing a remote attacker to send and receive data from arbitrary web sites. This allows (at minimum) extensive and expensive click fraud attacks, and may expose internal connectivity as well (HTTP or even TCP).

Third, and most interestingly, we find that active DPI’s — those that actually alter the flow of traffic between a client and a server — all seem to expose subtly different parsers and handlers for the protocols they manipulate. These variations of behavior can be remotely fingerprinted, allowing an attacker to identify DPI platforms so as to correctly target his attacks. This capability, understood particularly in light of Felix Lindner’s recent work on generic attacks against Cisco infrastructure, underscores the need for both DPI vendors to test their platforms extensively, and for IT managers to deploy critical infrastructure patches with at least as much vigor as desktop support receives today.

For remediation purposes, we recommend two lines of defense – one policy, one technical. As a matter of policy, we find the most important recommendation of this paper that industry reconsiders patching policies as they apply to infrastructure, especially as that infrastructure starts inspecting traffic at ever higher speeds in ever deeper ways. We are actively concerned that administrators have internalized the need to patch endpoints, but aren’t closely tracking the equipment that binds endpoints together – despite their ever increasing intelligence. This is as much a recommendation to vendors – to build patches quickly, and to code audit and fuzz with software from companies like Breakingpoint and Codenomicon – as it is a plea to IT departments to deploy the patches that are generated. Also from a policy perspective, while this paper does recognize the need for judicious use of DPI technology, systems that are deployed across organizational boundaries have particular need for correctness. There have been incidents in the past that have led to security vulnerability across entire ISPs.

On the technical front, we defend the existence of socket functionality in the browser, recognizing that constraining all networking to that which existed in 2001 is not leading to more stable or more secure networks. We explore a solution that potentially allow firewalls to integrate socket policies into their ALG’s, encouraging plugin developers to eventually join in with browser manufacturers and build a single, coherent, cross-domain communication standard. We also discuss more advanced transparent proxy caching policies, which will prevent the Same Origin Policy bypasses discussed above. Finally, we remind home router developers that browsers are still able to access their web interfaces from the Internet, and that this exposure can be repaired by tying default password effectiveness to either a button on the device or a power cycle.

The firewall fingerprinter should be online shortly, with source code for you to play with as well. Thanks!

(Incidentally, yep, Source is this week, and I have something rather different in store for that event. The times, they are busy.)

'Hacking' 카테고리의 다른 글

Intel CPU Architecture (0)	2009.03.11
Socket Capable Browser Plugins Result In Transparent Proxy Abuse (0)	2009.03.10
Apple Airport Extreme / Time Capsule Multiple Vulnerabilities (0)	2009.03.07
DLL injection Wiki (0)	2009.03.04
DLL Injection (0)	2009.03.04

Posted by CEOinIRVINE

l

Apple Airport Extreme / Time Capsule Multiple Vulnerabilities

Hacking 2009. 3. 7. 02:53

TITLE:
Apple Airport Extreme / Time Capsule Multiple Vulnerabilities

SECUNIA ADVISORY ID:
SA34105

VERIFY ADVISORY:
http://secunia.com/advisories/34105/

DESCRIPTION:
Some vulnerabilities have been reported in Apple Airport Extreme and
Time Capsule, which can be exploited by malicious people to conduct
spoofing attacks, disclose potentially sensitive information, or to
cause a DoS (Denial of Service).

1) An error exists in the implementation of the Neighbor Discovery
protocol when processing Neighbor Discovery messages.

For more information:
SA32112

2) An unspecified error exists in the handling of PPPoE discovery
packets. which can be exploited to cause an out-of-bounds memory
access error by sending a specially crafted PPPoE discovery packet.

3) An error exists in the handling of incoming ICMPv6 "Packet Too
Big" messages, which can be exploited to shutdown the device.

This is related to:
SA31745

SOLUTION:
Update to firmware version 7.4.1.

PROVIDED AND/OR DISCOVERED BY:
Reported by vendor.

ORIGINAL ADVISORY:
HT3467:
http://support.apple.com/kb/HT3467

'Hacking' 카테고리의 다른 글

Socket Capable Browser Plugins Result In Transparent Proxy Abuse (0)	2009.03.10
Staring Into The Abyss, A Bit Before Cansec (0)	2009.03.10
DLL injection Wiki (0)	2009.03.04
DLL Injection (0)	2009.03.04
MS IE Internet Explorer Two Code Execution Vulnerabilities (0)	2009.02.11

Posted by CEOinIRVINE

l

DLL injection Wiki

Hacking 2009. 3. 4. 05:16

DLL injection

From Wikipedia, the free encyclopedia

Jump to: navigation, search

In computer programming, DLL injection is a technique used to run code within the address space of another process by forcing it to load a dynamic-link library.^[1] DLL injection is often used by third-party developers to influence the behavior of a program in a way its authors did not anticipate or intend.^[1]^[2]^[3] For example, the injected code could trap system function calls,^[4]^[5] or read the contents of password textboxes, which cannot be done the usual way.^[6]

Approaches on Microsoft Windows

There are at least four ways to force a program to load a DLL on Microsoft Windows:

DLLs listed under the registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs will be loaded into every process that links to User32.dll as that DLL attaches itself to the process.^[7]^[8]^[9]^[5]
Process manipulation functions such as CreateRemoteThread can be used to inject a DLL into a program after it has started.^[10]^[11]^[12]^[13]^[6]^[5]
1. A handle to the target process is obtained, this can be done by spawning the process^[14]^[15] or by keying off something created by that process that is known to exist – for instance, a window with a predictable title,^[16] or by obtaining a list of running processes^[17] and scanning for the target executable's filename.^[18]
2. Some memory is allocated in the target process,^[19] and the name of the DLL to be injected is written to it.^[20]^[10]
  
  This step can be skipped if a suitable DLL name is already available in the target process. For example, if a process links to ‘User32.dll’, ‘GDI32.dll’, ‘Kernel32.dll’ or any other library whose name ends in ‘32.dll’, it would be possible to load a library named ‘32.dll’. This technique has in the past been demonstrated to be effective against a method of guarding processes against DLL injection.^[21]
3. A new thread is created in the target process,^[22] with the thread's start address set to be the address of LoadLibrary and the argument set to the address of the string just uploaded into the target.^[23]^[10]
  
  Instead of writing the name of a DLL to load to the target and starting the new thread at LoadLibrary, one can of course also write the code to be executed itself to the target and start the thread at that code.^[6]
4. The operating system will now call DllMain in the injected DLL.^[24]^[10]
Note that without precautions, this approach can be detected by the target process due to the DLL_THREAD_ATTACH notifications sent to every loaded module as a thread starts.^[24]
Windows hooking calls such as SetWindowsHookEx.^[25]^[26]^[27]^[6]^[2]^[5]
Use the debugging functions to pause all threads, and then hijack an existing thread in the application to execute injected code, that in turn could load a DLL.^[28]^[29]^[4]

[edit] Approaches on Unix-like systems

On Unix-like operating systems with the dynamic linker based on ld.so (on BSD) and ld-linux.so on (Linux), arbitrary libraries can be linked to a new process by giving the library's pathname in the LD PRELOAD environment variable, that can be set globally or individually for a single process.^[30]

For example, this command launches the command "prog --help" with the shared library from file "test.so" linked into it at the launchtime:

LD_PRELOAD="./test.so" prog --help

Such a library can be created with GCC by compiling the source file containing the new globals to be linked, with the -fpic or -fPIC option,^[31] and linking with the -shared option.^[32] The library has access to external symbols declared in the program like any other library.

'Hacking' 카테고리의 다른 글

Staring Into The Abyss, A Bit Before Cansec (0)	2009.03.10
Apple Airport Extreme / Time Capsule Multiple Vulnerabilities (0)	2009.03.07
DLL Injection (0)	2009.03.04
MS IE Internet Explorer Two Code Execution Vulnerabilities (0)	2009.02.11
Technical Server Problem in Soldier Front By Mitch1490 (0)	2009.02.10

Posted by CEOinIRVINE

l

DLL Injection

Hacking 2009. 3. 4. 05:09

Introduction

The source files depend a lot on function pointers. Overview is recommended.

DLL Injection is similar to 'Injecting' code into an already running process. Many things have been taken from Matt Pietrek's book 'Secrets of Windows 95'.

Function interception means 'intercepting' an API function that was loaded by a statically linked DLL by modifying the address of the beginning of the function's code, resulting in the application to call your 'intercepting' function instead of the original 'intercepted' function. This is similar to the idea in "APIHijack - A Library for easy DLL function hooking" article posted by Wade Brainerd.

DLL Injection

"DLL Injection" is not an accurate name for what my content will actually be. My code will 'inject' a series of assembled assembly language instructions [Code] into some available space in the running process and alters the registers to point at the offset of the 'injected' [code]. The process will of course execute the instructions which will load a certain DLL, which is the DLL that is being injected. Note that this code 'Injects' [code]. The code can be anything, it doesn't necessarily have to load a DLL. Hence, the inaccurate title.

There are two ways to 'Inject' a series of bytes into an already running process. VirtualAllocEx() - which isn't supported in Win9x/ME - will allow a process to reserve or commit a region of memory within the virtual address space of a separate specified process. Use WriteProcessMemory() to write the data in the reserved/committed area of the target process' memory. The other way is to directly use ReadProcessMemory() and WriteProcessMemory() - which is supported in all versions of Windows - to search for some accessible area of the target process' memory and replace the bytes within the area size equal to the size of the code. Of course, you will be saving a backup of the replaced bytes in order to put them all back later on.

(Of course, you can use CreateRemoteThread() instead of all this, but it's not supported in all versions of Windows.)

One good yet slow method of injecting the code is using Windows' debugging functions. Suspend the threads of the running process (using the debugging functions) and use GetThreadContext() and SetThreadContext() to save a backup of all the registers and then modify the EIP register, which is the register that contains the offset of the current to-be-executed code, to point it to the 'Injected' code. The injected code block will have a breakpoint set at the end of it (Interrupt 3h -int 3h-). Again, use the debugging functions to resume the threads, which will then continue executing till the first breakpoint is reached. Once your application receives the notification, all you have to do is restore the modified bytes and/or un-allocate any allocated space in memory, and finally restore the registers (SetThreadContext()). That's all there is to it. The application has no idea of what has happened! The code was executed, and probably loaded a DLL. As you know, loaded DLLs are in an application's address space, therefore, the DLLs can access all memory and control the whole application. Very interesting.

Lookup the MSDN library for more information (MSDN).

Useful points to lookup:

Memory management...you need to know how Windows manages its memory.
How DLLs tick - MSDN - I suggest you read it. Might help in inspirations. Revising isn't bad.
PE/COFF Headers specifications... The most important thing if you're doing this in Win9x/ME - MSDN.
Basic debugging APIs...those are some APIs that allow you to debug certain applications. Lookup the section "Debugging and Error Handling" in MSDN.
Enough knowledge of ASM is required of course...and OPCODES of instructions.

Have a look at the accompanied files: Injector_src.zip.

---

Google Groups - A Message board thread on CreateRemoteThread()'s method.

Function Interception

Notice the DLL project in the zip file. This function is in HookApi.h.

Collapse

Copy Code

// Macro for adding pointers/DWORDs together without C arithmetic interfering 
// -- Taken from Matt Pietrek's book
// Thought it'd be great to use..
#define MakePtr( cast, ptr, addValue ) (cast)( (DWORD)(ptr)+(DWORD)(addValue))

Collapse

Copy Code

//This code is very similar to Matt Pietrek's, except that it is written 
//according to my understanding...
//And Matt Pietrek's also handles Win32s 
//--(Because they it has some sort of a problem)

Collapse

Copy Code

PROC WINAPI HookImportedFunction(HMODULE hModule,
			         //Module to intercept calls from
     PSTR FunctionModule, //The dll file that contains the function you want to 
			  //hook(ex: "USER32.dll")
     PSTR FunctionName,   //The function that you want to hook 
			  //(ex: "MessageBoxA")
     PROC pfnNewProc)     //New function, this gets called instead
{
    PROC pfnOriginalProc; //The intercepted function's original location
    IMAGE_DOS_HEADER *pDosHeader; 
    IMAGE_NT_HEADERS *pNTHeader;
    IMAGE_IMPORT_DESCRIPTOR *pImportDesc;
    IMAGE_THUNK_DATA *pThunk;

Collapse

Copy Code

    // Verify that a valid pfn was passed

    if ( IsBadCodePtr(pfnNewProc) ) return 0; 

    pfnOriginalProc = GetProcAddress(GetModuleHandle(FunctionModule), 
                                                         FunctionName);
    if(!pfnOriginalProc) return 0;

Collapse

Copy Code

    pDosHeader = (PIMAGE_DOS_HEADER)hModule; 
    //kindly read the ImgHelp function reference 
    //in the Image Help Library section in MSDN
    //hModule is the Process's Base address  (GetModuleHandle(0)) 
    //even if called in the dll, it still gets the hModule of the calling process
    //---That's you should save the hInstance of the DLL as a global variable, 
    //in DllMain(), because it's the only way to get it(I think)

Collapse

Copy Code

    // Tests to make sure we're looking at a module image (the 'MZ' header)
    if ( IsBadReadPtr(pDosHeader, sizeof(IMAGE_DOS_HEADER)) )
        return 0;
    if ( pDosHeader->e_magic != IMAGE_DOS_SIGNATURE ) 
	//Image_DOS_SIGNATURE is a WORD (2bytes, 'M', 'Z' 's values)
        return 0;

Collapse

Copy Code

    // The MZ header has a pointer to the PE header
    pNTHeader = MakePtr(PIMAGE_NT_HEADERS, pDosHeader, pDosHeader->e_lfanew); 
    //it's like doing pDosHeader + pDosHeader->e_lfanew
    // e_lfanew contains a RVA to the 'PE\0\0' Header...An rva means, offset,
    // relative to the BaseAddress of module 
    // -pDosHeader is the base address..and e_lfanew is the RVA, 
    // so summing them, will give you the Virtual Address..

Collapse

Copy Code

    // More tests to make sure we're looking at a "PE" image
    if ( IsBadReadPtr(pNTHeader, sizeof(IMAGE_NT_HEADERS)) )
        return 0;
    if ( pNTHeader->Signature != IMAGE_NT_SIGNATURE ) 
	//IMAGE_NT_SIGNATURE is a DWORD (4bytes, 'P', 'E', '\0', '\0' 's values)
        return 0;

Collapse

Copy Code

    // We now have a valid pointer to the module's PE header. 
    // Now get a pointer to its imports section
    pImportDesc = MakePtr(PIMAGE_IMPORT_DESCRIPTOR, 
      pDosHeader, //IMAGE_IMPORT_DESCRIPTOR *pImportDesc;
      pNTHeader->OptionalHeader.DataDirectory
       [IMAGE_DIRECTORY_ENTRY_IMPORT].VirtualAddress);

    //What i just did was get the imports section by getting the RVA of it
    //(like i did above), then adding the base addr to it.
    //// pNTHeader->OptionalHeader.DataDirectory
    ///     [IMAGE_DIRECTORY_ENTRY_IMPORT].VirtualAddress
    //// IMAGE_DIRECTORY_ENTRY_IMPORT==1 -- Look at that PE documentation. 
    //// Pietrek's articles in MSJ and MSDN Magazine will be real helpful!

Collapse

Copy Code

    //Go out if imports table doesn't exist
    if ( pImportDesc == (PIMAGE_IMPORT_DESCRIPTOR)pNTHeader )
        return 0; //pImportDesc will ==pNTHeader. 
	//if the RVA==0, cause pNTHeader+0==pNTHeader -> stored in pImportDesc
	//Therefore, pImportDesc==pNTHeader

Collapse

Copy Code

    // Iterate through the array of imported module descriptors, looking
    // for the module whose name matches the FunctionModule parameter
    while ( pImportDesc->Name ) //Name is a DWORD (RVA, to a DLL name)
    {
        PSTR pszModName = MakePtr(PSTR, pDosHeader, pImportDesc->Name);

        if ( stricmp(pszModName, FunctionModule) == 0 ) 
	    //str"i"cmp,,, suggest you to ignore cases when comparing,
            break; //or strcmpi() in some compilers

Collapse

Copy Code

        pImportDesc++;  // Advance to next imported module descriptor
    }

Collapse

Copy Code

    // Get out if we didn't find the Dll name. 
    // pImportDesc->Name will be non-zero if we found it.
    if ( pImportDesc->Name == 0 )
        return 0;

Collapse

Copy Code

 // Get a pointer to the found module's import address table (IAT)
 //           =====IMAGE_THUNK_DATA *pThunk;
    pThunk = MakePtr(PIMAGE_THUNK_DATA, pDosHeader, pImportDesc->FirstThunk);
 //This is what i was talkin about earlier...
 //In pThunk, if it was image loaded in memory, you'll get the address to 
 //entry point of functions
 //but in a disk file, It's a function name

 // Look through the table of import addresses, of the found 
 // DLL, looking for the function's entry point that matches 
 // the address we got back from GetProcAddress above.

Collapse

Copy Code

    while ( pThunk->u1.Function )
    {
       if ( (DWORD)pThunk->u1.Function == (DWORD)pfnOriginalProc )
        {
       // We found it!  Overwrite the original address with the
       // address of the interception function.  Return the original
       // address to the caller so that they can chain on to it.
            pThunk->u1.Function = (PDWORD)pfnNewProc; 
	    // pfnNewProc is in the parameters of the function
	    //pfnOriginalProc = (PROC)(DWORD)pdw1;
            return pfnOriginalProc;
        }

        pThunk++;   // Advance to next imported function address
    }

Collapse

Copy Code

    return 0; //function not found!!!!!
}

Also notice:

HANDLE OpenLog(char *Filename)
BOOL CloseLog(HANDLE h)
DWORD AppendLog(char *str, DWORD uSize, HANDLE h)

They are the functions to write to the LOG file. What the whole project does is inject a DLL into an already running process (mIRC.exe - mIRC chatting program (mIRC)) [in my case]. It then creates a Log file of all the intercepted Winsock functions. Have a look at Successlog.txt. It is highly recommended that you apply the program on mIRC only, since it has been created for it. Have fun coding your own :)

I think you got the idea. I hope this is useful.

Regards,

'Hacking' 카테고리의 다른 글

Apple Airport Extreme / Time Capsule Multiple Vulnerabilities (0)	2009.03.07
DLL injection Wiki (0)	2009.03.04
MS IE Internet Explorer Two Code Execution Vulnerabilities (0)	2009.02.11
Technical Server Problem in Soldier Front By Mitch1490 (0)	2009.02.10
SF Hacking (Purple Folder) (1)	2009.02.10

Posted by CEOinIRVINE

l

MS IE Internet Explorer Two Code Execution Vulnerabilities

Hacking 2009. 2. 11. 07:09

TITLE:
Microsoft Internet Explorer Two Code Execution Vulnerabilities

SECUNIA ADVISORY ID:
SA33845

VERIFY ADVISORY:
http://secunia.com/advisories/33845/

CRITICAL:
Highly critical

IMPACT:
System access

WHERE:
From remote

SOFTWARE:
Microsoft Internet Explorer 7.x
http://secunia.com/advisories/product/12366/

DESCRIPTION:
Two vulnerabilities have been reported in Microsoft Internet
Explorer, which can be exploited by malicious people to compromise a
user's system.

1) An unspecified error exists due to the use of a previously deleted
object. This can be exploited to corrupt memory and execute arbitrary
code when a user e.g. visits a malicious web site.

2) An unspecified error exists within the handling of Cascading Style
Sheets (CSS). This can be exploited to cause a memory corruption and
execute arbitrary code when a user e.g. visits a specially crafted
web site.

SOLUTION:
Apply patches.

Windows XP SP2/SP3:
http://www.microsoft.com/downloads/details.aspx?familyid=8cd902ec-e018-4b61-80f9-825d973f998e

Windows XP Professional x64 Edition (optionally with SP2):
http://www.microsoft.com/downloads/details.aspx?familyid=dd3e2236-9cc0-478e-a46c-981ef685c0e3

Windows Server 2003 SP1/SP2:
http://www.microsoft.com/downloads/details.aspx?familyid=e52aa1fd-e694-4322-b3ff-6abc1b4a16fe

Windows Server 2003 x64 Edition (optionally with SP2):
http://www.microsoft.com/downloads/details.aspx?familyid=edbf1566-b96b-4c7d-98fe-b15f8e766792

Windows Server 2003 with SP1/SP2 for Itanium-based systems:
http://www.microsoft.com/downloads/details.aspx?familyid=5ce78797-d1c0-40d4-84e1-1004389833be

Windows Vista (optionally with SP1):
http://www.microsoft.com/downloads/details.aspx?familyid=5f9fa4b6-85a4-43bc-b84f-6bd847799650

Windows Vista x64 Edition (optionally with SP1):
http://www.microsoft.com/downloads/details.aspx?familyid=e9a8c94b-b9d2-4d64-855f-b5f02ce3dfb5

Windows Server 2008 for 32-bit Systems:
http://www.microsoft.com/downloads/details.aspx?familyid=2491dbf2-7cd3-44f1-bfad-77e6f760a25c

Windows Server 2008 for x64-based Systems:
http://www.microsoft.com/downloads/details.aspx?familyid=794373cc-2dce-4ef5-af50-7804c622c230

Windows Server 2008 for Itanium-based systems:
http://www.microsoft.com/downloads/details.aspx?familyid=11985325-4b33-4077-82cf-6afc7a71c510

PROVIDED AND/OR DISCOVERED BY:
The vendor credits:
1) Zero Day Initiative
2) Sam Thomas via Zero Day Initiative.

ORIGINAL ADVISORY:
MS09-002 (KB961260):
http://www.microsoft.com/technet/security/bulletin/ms09-002.mspx

'Hacking' 카테고리의 다른 글

DLL injection Wiki (0)	2009.03.04
DLL Injection (0)	2009.03.04
Technical Server Problem in Soldier Front By Mitch1490 (0)	2009.02.10
SF Hacking (Purple Folder) (1)	2009.02.10
How to be penetration tester? (Computer Security Specialist?) (0)	2009.02.08

Posted by CEOinIRVINE

l

Technical Server Problem in Soldier Front By Mitch1490

Hacking 2009. 2. 10. 08:45

Technical Server Problem in Soldier Front By Mitch1490

After My Success EMU HUL method Of servering The GAme Soldier Front TO bypass For PRivate Freeself thoughts.

\\ CODERS PLEASE READ TO HAVE THE KNOWLEDGE OF THE GAMES CND AND FOR EXEMPLES I USED
// SOLDIER FRONT

TRUE this SF SErver Downer I PRobably Made IJJI server Down For All Games. Sorry~

LOOK AT THIS AND TELL ME WHO DID:
Purple Folder for GG server by Mitch1490

//-USED TO MAKE BYPASS PURPLEBEAN.EXE OF GAMEGUARD.
//-USED TO MAKE EMULATED SERVERS ABOUT IJJI <--- FROM THE PATH FOUND BY ME.

SERVER SHUT DOWN.
--------------------------
PEace,
Mitch1490 ^_^

I DID FOR WORLD GAME EMULATE IJJI FOR YOU'S.

OR SIMPLY CLICK ON THIS APOLOGIZE IJJI:

NOW THEY ARE IN THIS MOMENT CHANGING THIS:

cdn.ijjimax.com 2571 cdn.ijjimax.com:80 47 gamedown.ijjimax.com 0 gamedownload.ijjimax.com 0

OH WAIT NOW

cdn.ijjimax.com 53356 cdn.ijjimax.com:80 5221 gamedown.ijjimax.com 0 gamedownload.ijjimax.com 0

IJJI IS WORKING IN SAME TIME AS ME LOOK

cdn.ijjimax.com 70250 cdn.ijjimax.com:80 51095 gamedown.ijjimax.com 0 gamedownload.ijjimax.com 0

NOW I GOT 4 BOXES FROM THE CND ENTIERE SERVER INFORMATION STOP TRYING IJJI

cdn.ijjimax.com 74433 cdn.ijjimax.com:80 66292 gamedown.ijjimax.com 0 gamedownload.ijjimax.com 0

I GUESS THE SERVER IS PLAYING WITH ME IN SOMEHOW TO GENERATE THE OFFSET NUMBERS (VARIABLE)

cdn.ijjimax.com 92111 cdn.ijjimax.com:80 68522 gamedown.ijjimax.com 0 gamedownload.ijjimax.com 0

OK NOW AFTER PRESSING THE F5 BUTTON TO REFRESH THIS ADDRESS TO SERVER SERVIES
CLICK THIS LINK I'M DONE PLAYING ALONE PLAY UR SELF TO KNOW.

LINK: http://services.ijji.com/service/cdn/traffic

PRESS F5 TO REFRESH.

NOW.

cdn.ijjimax.com 86506 cdn.ijjimax.com:80 102493 gamedown.ijjimax.com 0 gamedownload.ijjimax.com 0

IF IJJI LOOKING HERE~

I'm Sincerely Sorry for the time lost to you.

IF ( NOT )
{
STD CALL_GivemeJob
}
Return NOT;

DONE NOW LET C THE NUMBERS YOU GOT ^_^

HERE I GOT THIS IN PRESENT

cdn.ijjimax.com 78905 cdn.ijjimax.com:80 128214 gamedown.ijjimax.com 0 gamedownload.ijjimax.com 0

NOW THAT I'VE WROTED THIS PART OF CODE IT WILL GENERATE NEW ONE TO SERVER MAINTENENTS.

THIS IS WHAT SERVER MAINTENENTS MEAN.

NOW LET's C ...
----------------------------
2 Mins::PAssed
THIS:: cdn.ijjimax.com 96366 cdn.ijjimax.com:80 133516 gamedown.ijjimax.com 0 gamedownload.ijjimax.com 0
WAITING::NEW RECT SERVER ADDRESS
WAIT::WAIT
SYSFAILED::FAIL(2mins)

NEW HOOK 4 MINS::PAssed
THIS GENERATED BY SOMEONE WORKING IN SAME TIME AS ME PLAYING AROUND
cdn.ijjimax.com 79954 cdn.ijjimax.com:80 109185 gamedown.ijjimax.com 0 gamedownload.ijjimax.com 0

TRY IT I PLAYED 1 HOUR !!!!~

#FOR REAL

{
NOW
}

RETURN INFINITLY;
_____________________
Peace,
Mitch1490 ^_^ Gooogle'it.

NOW FOR ALL THE SYSTEM RESTRICTION DU TO UR COMPUTER ADMINISTRATION.

This TOOL :: RRT

Attached Files

	ijjigamepluginremovetool.exe.zip (83.1 KB, 22 views)
	SERVER CHANGES.zip (332.7 KB, 17 views)
	SERVER CHANGES 2.zip (401.1 KB, 16 views)
	RRT.zip (42.3 KB, 21 views)

Last edited by Carbone14; 01-21-2009 at 04:02 PM. Reason: SERVER PATH CHANGES

'Hacking' 카테고리의 다른 글

DLL Injection (0)	2009.03.04
MS IE Internet Explorer Two Code Execution Vulnerabilities (0)	2009.02.11
SF Hacking (Purple Folder) (1)	2009.02.10
How to be penetration tester? (Computer Security Specialist?) (0)	2009.02.08
XSS Cheat Sheet (0)	2009.02.06

Posted by CEOinIRVINE

l

SF Hacking (Purple Folder)

Hacking 2009. 2. 10. 08:35

Purple Folder for GG server by Mitch1490

Hi to everyone,

After cleaning my pc From stupid System poop files of the Restriction of whatever...

I HAve Found The Server Emulated By IJJI to The Game.

The PurpleBean.exe is Checking This:

BE AWARE THIS IS THE ENTIERE GAME OF IJJI SERVER SF ( MAP, LOBBY, SOUNDs, ITEMs, ETCs.)

#PrePatch info.( FOR REAL SOLDIER FRONT)

On XP OR VISTA This is the PAth To it "C:\Documents and Settings\me\Application Data\ijjigame".

WARNING: I said REad.
----------------------------
Now I said Get up, IJJI's DOWN. LOOK PAGE 2.

Name files:

//SERVER SCAN NPROTECT & INSTALL XFIRE

u_sf.hul

Code:

PRJNAME U_SF_R
PUBDATE 081015-011258
TCHKSUM 2027549859
TFILENO 187
TZIPSIZE 389047119
DAYLIGHTSAVING 1
 
 
/
ijjiuninstall.exe,             28036552, 294912,   141412,   20080508-104503
ijjilauncher_postplugindll_01.dll,3981295,  53248,    24999,    20070718-190530
 
 
/u_sf
sf.ico,                        185810,   2998,     1097,     20081014-220929
hanpollforclient.dll,          13330850, 151552,   79915,    20071114-211302
cname.hdc,                     4290441,  33604,    33735,    20080826-220318
chat.hdc,                      3890504,  30724,    30848,    20080826-220318
soldierfront.exe,              193480878,1536512,  1523155,  20081014-123109
quietusvs.ini,                 7573,     93,       200,      20061220-173820
specialforceus.ini,            44293,    348,      487,      20080518-234418
hyperpeer.dll,                 13226245, 155648,   59507,    20070607-151450
dbghelp.dll,                   73921967, 665600,   315692,   20061207-121608
enet.dll,                      1582724,  32768,    10905,    20061016-201952
gameguard.des,                 34065372, 277185,   273456,   20080806-124813
hanauthforclient.dll,          16209233, 303104,   94287,    20070417-182840
hanreportforclient.dll,        13169883, 155648,   75304,    20070326-103100
iaf.dll,                       19667167, 225280,   106511,   20081007-094626
mss32.dll,                     34333188, 374272,   173123,   20041210-233530
msvcp60.dll,                   37374268, 401462,   116252,   20001121-150236
msvcp71.dll,                   47651898, 499712,   132586,   20060404-193134
msvcp71d.dll,                  79667358, 765952,   180968,   20060317-062802
msvcr71.dll,                   35175063, 348160,   181017,   20060404-192258
msvcr71d.dll,                  56033397, 544768,   230649,   20060317-062830
msvcrtd.dll,                   40344765, 385100,   160306,   19980617-010000
quietus.dll,                   2074272,  40960,    14365,    20050707-204146
 
 
/u_sf/data
default.cfg,                   143779,   1875,     707,      20080321-140010
 
 
/u_sf/data/area
area_015.sff,                  510394094,8427186,  2324971,  20080825-102310
area_014.sff,                  1714681771,24946018, 5590906,  20080624-105707
area_012.sff,                  2992223,  47740,    10766,    20080124-110718
area_010.sff,                  -1238837083,33945548, 13072739, 20071023-113306
area_009.sff,                  346273762,4220751,  895279,   20070409-160000
area_008.sff,                  -1978400990,32344143, 8352438,  20070404-181758
area_007.sff,                  270967417,4447834,  1105094,  20070301-185440
area_006.sff,                  50795408, 864790,   197190,   20070115-150228
area_005.sff,                  1736772,  19096,    9089,     20070103-201452
area_004.sff,                  270967417,4447834,  1105094,  20061205-183236
area_003.sff,                  5996935,  63458,    28901,    20061016-132246
area_002.sff,                  5471943,  59405,    25367,    20060904-165740
area_001.sff,                  1571834858,221534990,98447852, 20060403-163818
area_011.sff,                  377169895,6709437,  1788463,  20071211-152448
 
 
/u_sf/data/clan
clanmark_symbol.dfz,           117087997,898680,   891776,   20081015-011156
clanmark_frame.dfz,            47241435, 351987,   348642,   20081015-011156
clanmark_bg.dfz,               173871500,1282560,  1279451,  20081015-011156
clanmark3.dfz,                 1258836136,9194654,  9034194,  20061117-131306
clanmark2.dfz,                 1101375342,8033663,  7892874,  20061117-131256
clanmark1.dfz,                 1178585289,8611856,  8480590,  20080131-201348
 
 
/u_sf/data/effect
effect_002.sff,                267734830,2097490,  705203,   20080918-111057
effect_001.sff,                317286380,3220158,  1129414,  20060403-163908
 
 
/u_sf/data/force
force_010.sff,                 61497104, 818377,   304140,   20080424-225300
force_009.sff,                 1112537751,11394298, 7024817,  20080331-135242
force_008.sff,                 1435199637,15096954, 8442912,  20080325-135212
force_007.sff,                 1552052578,16138304, 9221610,  20080311-161122
force_006.sff,                 57392645, 640433,   353754,   20080201-110344
force_005.sff,                 22656488, 255855,   55224,    20080204-113610
force_004.sff,                 107382726,1262695,  651875,   20071211-152448
force_003.sff,                 151358472,1380541,  1023891,  20071008-102356
force_002.sff,                 22185361, 213795,   106549,   20070712-125220
force_001.sff,                 -181145931,41968009, 23988072, 20060628-135914
force_017.sff,                 10405098, 107079,   54509,    20081010-153432
force_012.sff,                 1000791991,9738970,  5904717,  20080624-105709
force_013.sff,                 890902,   9446,     1677,     20080709-104429
force_014.sff,                 146776134,1683329,  891532,   20080718-102321
force_015.sff,                 21620293, 237024,   107510,   20080825-102311
force_016.sff,                 57006727, 577913,   288534,   20080922-114056
force_018.sff,                 463521833,5020588,  2803425,  20081030-211807
force_020.sff,                 8531505,  120992,   18947,    20081002-183432
force_021.sff,                 7185400,  79952,    38348,    20081014-123109
force_019.sff,                 171949948,1784532,  1060547,  20081124-154954
force_011.sff,                 1058004375,10290717, 6542236,  20080527-233819
 
 
/u_sf/data/lobby
lobbydata33.mrg,               2016446447,16083552, 2759485,  20080124-110718
lobbydata23.mrg,               945314,   4879,     1211,     20070919-110102
lobbydata34.mrg,               743268192,5239571,  679553,   20080212-164704
lobbydata32.mrg,               675337549,5161732,  908191,   20080109-151252
lobbydata31.mrg,               290837148,2015812,  540804,   20080104-202458
lobbydata30.mrg,               767612555,5186244,  2596702,  20071218-144052
lobbydata17.mrg,               536006423,3159379,  1072839,  20070621-103500
lobbydata18.mrg,               9631021,  73540,    18777,    20070627-175658
lobbydata28.mrg,               299078031,2018082,  763110,   20071127-174122
lobbydata43.mrg,               771047287,5379638,  881142,   20080825-102308
lobbydata26.mrg,               38058529, 253818,   57783,    20071023-113306
lobbydata25.mrg,               296928285,2015812,  671318,   20071016-102308
lobbydata24.mrg,               29482028, 215120,   65372,    20071008-102356
lobbydata22.mrg,               262494426,2015812,  708823,   20070831-160452
lobbydata21.mrg,               7594902,  53440,    12675,    20070801-191330
lobbydata20.mrg,               372727,   1784,     821,      20070724-180928
lobbydata2.mrg,                376410421,3168166,  390027,   20061102-173734
lobbydata19.mrg,               2407222,  16580,    2005,     20070712-125724
lobbydata29.mrg,               360402845,2489745,  699169,   20071211-152450
lobbydata42.mrg,               436062428,2888870,  655502,   20080718-102320
lobbydata14.mrg,               759096975,5705673,  1115770,  20070521-170906
lobbydata45.mrg,               16185795, 116742,   58109,    20081010-153432
lobbydata44.mrg,               390561560,2689951,  941237,   20080922-235357
lobbydata27.mrg,               651819467,5169641,  1289698,  20071114-165336
lobbydata16.mrg,               416221766,3170436,  354756,   20070612-173730
lobbydata41.mrg,               802470296,5525970,  923110,   20080624-105702
lobbydata40.mrg,               976147441,6786738,  892461,   20080527-233817
lobbydata4.mrg,                809287,   4582,     1313,     20061115-120400
lobbydata39.mrg,               377743561,2620822,  864346,   20080424-225259
lobbydata35.mrg,               222832223,1582797,  181708,   20080201-110344
lobbydata38.mrg,               54813103, 442756,   278390,   20080331-135210
lobbydata37.mrg,               508844564,3599202,  441691,   20080325-135212
lobbydata1.mrg,                -1264129724,21233249, 4491247,  20061017-194750
lobbydata10.mrg,               413114057,3146944,  340270,   20070320-181442
lobbydata3.mrg,                658788772,5182637,  857525,   20061108-164638
lobbydata11.mrg,               229417753,1622404,  348502,   20070411-173658
lobbydata12.mrg,               280942,   1365,     719,      20070411-175534
lobbydata13.mrg,               71354648, 540758,   127607,   20070504-155950
lobbydata36.mrg,               289879671,2015812,  432304,   20080311-161122
lobbydata15.mrg,               3622036,  26141,    10550,    20070608-092610
lobbydata6.mrg,                6672578,  50271,    2188,     20070104-151804
lobbydata5.mrg,                717878850,5181283,  1019447,  20061220-170144
lobbydata48.mrg,               303578235,2117923,  673480,   20081014-123108
lobbydata47.mrg,               807338526,5646522,  2231844,  20081124-154951
lobbydata46.mrg,               1690312008,11276735, 3601398,  20081030-211806
lobbydata7.mrg,                207305,   1019,     620,      20070123-134458
lobbydata8.mrg,                340467,   1710,     993,      20070205-195056
patchlog.log,                  212,      6,        130,      20081002-181029
sf_curse.drk,                  825938,   11711,    2575,     20061103-165308
pure.drk,                      193682,   1416,     872,      20040630-174314
notice.txt,                    110820,   1273,     777,      20081009-140005
lobbydata9.mrg,                631355,   3526,     1146,     20070212-212422
 
 
/u_sf/data/menu
menu_016.sff,                  5554440,  98500,    8421,     20071211-152448
menu_027.sff,                  51839415, 361580,   58039,    20081124-154950
menu_026.sff,                  15266890, 337160,   74512,    20081030-211803
menu_025.sff,                  8580108,  180790,   38343,    20081010-153432
menu_024.sff,                  450964257,3472493,  2714573,  20080922-114055
menu_023.sff,                  295870066,2290232,  1197935,  20080825-102306
menu_008.sff,                  7467119,  103876,   7429,     20070307-113458
menu_021.sff,                  25823987, 180792,   22082,    20080624-105702
menu_020.sff,                  26008759, 197368,   25692,    20080424-225259
menu_019.sff,                  2209158,  33936,    11912,    20080201-110344
menu_018.sff,                  4222059,  191992,   14068,    20080204-113610
menu_017.sff,                  1620406052,12602120, 11886079, 20080124-110718
menu_028.sff,                  1770498283,15219325, 12850636, 20081014-123108
menu_022.sff,                  25692931, 180792,   28922,    20080718-102319
menu_002.sff,                  1273820467,10024564, 9482189,  20061102-152156
menu_014.sff,                  78926376, 630417,   609812,   20071023-113306
menu_013.sff,                  102135280,873192,   214732,   20071008-102356
menu_012.sff,                  25431987, 180792,   26348,    20070712-125316
menu_011.sff,                  64474075, 1060804,  24090,    20070621-103404
menu_009.sff,                  12295773, 66260,    9290,     20070328-110516
menu_007.sff,                  77121030, 492640,   74728,    20070213-122442
menu_006.sff,                  18951713, 164216,   27909,    20070205-160120
menu_005.sff,                  20244639, 98848,    3910,     20070108-194944
menu_004.sff,                  1272170947,10003071, 9607062,  20061227-182018
menu_003.sff,                  1242291073,9675547,  9441139,  20061116-210124
menu_015.sff,                  83227843, 652823,   631706,   20071114-165336
menu_001.sff,                  -2046088635,22684136, 15169697, 20061017-164920
 
 
/u_sf/data/save
savereadme.txt,                1856,     24,       152,      20060403-164502
 
 
/u_sf/data/scr
scr_001.sff,                   147945064,925523,   259663,   20081014-123108
 
 
/u_sf/data/screenshot
shotreadme.txt,                2266,     27,       155,      20060403-164522
 
 
/u_sf/data/sound
sound_010.sff,                 18140564, 143906,   99452,    20080624-105703
sound_016.sff,                 14586589, 111826,   89045,    20081014-123109
sound_005.sff,                 21292383, 176088,   170476,   20061212-161740
sound_006.sff,                 20612563, 182351,   163369,   20070328-110600
sound_007.sff,                 21290561, 176925,   137170,   20070712-125504
sound_004.sff,                 107385086,883501,   849260,   20061108-150556
sound_015.sff,                 14980831, 121336,   70809,    20081124-154953
sound_014.sff,                 25434910, 169124,   99281,    20081030-211806
sound_013.sff,                 38838015, 245256,   155448,   20080918-111056
sound_008.sff,                 39187553, 323109,   314204,   20071023-113306
sound_009.sff,                 9442456,  80342,    65082,    20080424-225259
sound_003.sff,                 92021964, 772707,   629663,   20061031-194520
sound_002.sff,                 225269683,1951937,  1733425,  20060906-154850
sound_001.sff,                 -2119502634,17655980, 15102608, 20060403-164254
sound_012.sff,                 36453582, 295966,   208893,   20080825-102311
sound_011.sff,                 43945887, 370783,   205354,   20080718-102320
 
 
/u_sf/data/weapon
weapon_007.sff,                302252859,2867816,  1745791,  20080922-114056
weapon_006.sff,                109226159,1078459,  623795,   20080820-121816
weapon_001.sff,                -2004935247,22128641, 13509239, 20060403-164348
weapon_002.sff,                80548881, 784772,   422009,   20070712-125552
weapon_005.sff,                56663656, 554351,   349914,   20080711-111437
weapon_003.sff,                53861086, 535052,   308134,   20080418-124838
weapon_004.sff,                52072675, 515669,   316501,   20080619-104829
weapon_011.sff,                58479264, 545049,   370186,   20081002-185458
weapon_010.sff,                194290321,1823110,  1218500,  20081124-154954
weapon_009.sff,                195424374,1623153,  1243438,  20081022-031542
weapon_008.sff,                122258503,1209344,  715331,   20081006-230647
 
 
/u_sf/redist
mssvoice.asi,                  23130939, 214528,   116863,   20041210-233742
msssoft.m3d,                   7613837,  79360,    45180,    20041210-233626
mssrsx.m3d,                    39669920, 372224,   221493,   20041210-233632
mssmp3.asi,                    13821001, 149504,   75538,    20041210-233624
msseax.m3d,                    13245737, 143872,   68195,    20041210-233628
mssdx7.m3d,                    6138108,  65536,    30863,    20041210-233630
mssdsp.flt,                    10707007, 113664,   58526,    20041210-233532
mssds3d.m3d,                   5215788,  56320,    28616,    20041210-233630
mssa3d.m3d,                    6529387,  72704,    38467,    20041210-233632
 
 
/xfire //HERE xfire
xfire_installer_24715.soldierfront.exe,306197609,2417720,  2391082,  20070612-115632
 
[uninstall]
 
<EOF>

//PROCESS::ALLPREPATCH HERE~

//Fonction To get Wnd (WINDOW) Find Purple Folder

[CPurpleMessenger::FindPurpleWnd]

Succeeded to get hwnd = 2359400

//Display PAtch Updates (IN MODE=0)

[WndProc]TID_DISPLAY_PREPATCH_PROC

[PrePatchProc]Mode = 0

//HUL SERVER EMULATION

[GET_GAME_INFO]Patch method is hul

[SET_ROOT_FOLDER]m_szRegKeyInstall = SOFTWARE\Dragonfly\soldierfront

[SET_ROOT_FOLDER]m_szRegValuePath = installPath

[SET_ROOT_FOLDER]Trim Right

[SET_ROOT_FOLDER]Succeeded to query value = installPath

[SET_ROOT_FOLDER]Install path = C:\ijji\ENGLISH

[DOWNLOAD_HUL]Start

[DOWNLOAD_HUL]Hul Directory = C:\Documents and Settings\me\Application Data\ijjigame\HUL

[DOWNLOAD_HUL]Succeeded to delete Hul = C:\Documents and Settings\me\Application Data\ijjigame\HUL\u_sf.hul
[Util::DownloadFile] [ http://cdn.ijjimax.com/nhnusa/games/...ewhul/u_sf.hul ]->[ C:\Documents and Settings\me\Application Data\ijjigame\HUL\u_sf.hul ]

[DOWNLOAD_HUL]End.

//PARSING FILES TO GET
[PARSING_HUL]Start.
[PARSING_HUL]End.

//CHECK IT
[CHECK_LOCAL_FILES]Start.
[CHECK_LOCAL_FILES]End.

//DO PATCH & INSTALL UTILITIES
[DO_PATCH]Start.

[DO_PATCH]Need to patch.

//IJJI SF UNINSTALL
[Util::DownloadFile] [ http://cdn.ijjimax.com/nhnusa/games/...nstall.exe.zip ]->[ C:\ijji\ENGLISH\ijjiuninstall.exe.zip ]

//LOBBY FILES
[Util::DownloadFile] [ http://cdn.ijjimax.com/nhnusa/games/...data39.mrg.zip ]->[ C:\ijji\ENGLISH\\u_sf\data\lobby\lobbydata39.mrg.z ip ]

//MENU FILES
[Util::DownloadFile] [ http://cdn.ijjimax.com/nhnusa/games/...nu_020.sff.zip ]->[ C:\ijji\ENGLISH\\u_sf\data\menu\menu_020.sff.zip ]

//SOUNDS FILES
[Util::DownloadFile] [ http://cdn.ijjimax.com/nhnusa/games/...nd_009.sff.zip ]->[ C:\ijji\ENGLISH\\u_sf\data\sound\sound_009.sff.zip ]

//XFIRE INSTALL FILES
[Util::DownloadFile] [ http://cdn.ijjimax.com/nhnusa/games/...rfront.exe.zip ]->[ C:\ijji\ENGLISH\\xfire\xfire_installer_24715.soldi erfront.exe.zip ]

[DO_PATCH]We don't need to patch.

[DO_PATCH]End.

//END PATCH & RESULT IN 1 ( BEcause Normaly it's start with 0 ) Duh./..

Result = 1

[CWorkerThread::WorkerThread]End

//{
bRet = 1
//}

//return;

[StartPatch] End

//////////////////////////END OUT BOUNDER///////////////////

ijjiPrePatch.txt

Code:

[17:34:07] START DoPrePatch
[17:34:07] [CWorkerThread::SetParam]Start
[17:34:07] [CWorkerThread::Start]Succeeded to create thread.
[17:34:07] [CPPImpl::DoPatching]Start!
[17:34:07] [CPPImpl::PARSE_GAMESTRING]Start
[17:34:07] [CPPImpl::REGISTER_PP_WNDCLASS]Start
[17:34:07] [CPPImpl::CREATE_PP_WINDOW]Start
[17:34:07] [CPPImpl::GET_GAME_INFO]Start.
[17:34:07] [CPPImpl::GET_GAME_INFO]_sLocPPInfoFileName = [C:\DOCUME~1\me\LOCALS~1\Temp\\u_sf_ppinfo.ini], _sSvrPPInfoFileName = [http://cdn.ijjimax.com/nhnusa/games/arcade/purple/plii/u_sf/u_sf_ppinfo.ini]
[17:34:07] [CPPImpl::GET_GAME_INFO]Succeeded to delete [C:\DOCUME~1\me\LOCALS~1\Temp\\u_sf_ppinfo.ini]
[17:34:08] [CPPImpl::GET_GAME_INFO]Download common cfg.
[17:34:08] [CPPImpl::GET_GAME_INFO]Download [http://cdn.ijjimax.com/nhnusa/games/arcade/purple/plii/common/cfg/pp_config.ini] to [C:\DOCUME~1\me\LOCALS~1\Temp\\pp_config.ini].
[17:34:08] [CPPImpl::GET_GAME_INFO]End.
[17:34:08] [CPPImpl::SET_ROOT_FOLDER]Start
[17:34:08] [CPPImpl::SET_ROOT_FOLDER]Trim Right
[17:34:08] [CPPImpl::SET_ROOT_FOLDER]Succeeded to get installpath [C:\ijji\ENGLISH]
[17:34:08] [CPPImpl::GET_PP_VERSION]Start
[17:34:08] [CPPImpl::GET_PP_VERSION]_sLocHgverFilename = [C:\DOCUME~1\me\LOCALS~1\Temp\\u_sf.pv], _sSvrHgverFilename = [http://cdn.ijjimax.com/nhnusa/games/arcade/U_SF/prepatch/u_sf.pv]
[17:34:08] [CPPImpl::GET_PP_VERSION]Succeeded to download prepatch version
[17:34:08] [CPPImpl::GET_PP_VERSION]Succeeded to read prepatch version [1003]
[17:34:08] [CPPImpl::GET_PP_VERSION]_sLocHgverFilename = [C:\DOCUME~1\me\LOCALS~1\Temp\\u_sf.cv], _sSvrHgverFilename = [http://cdn.ijjimax.com/nhnusa/games/arcade/U_SF/patch/u_sf.cv]
[17:34:08] [CPPImpl::GET_PP_VERSION]Succeeded to read current version [1003]
[17:34:08] [CPPImpl::GET_PP_VERSION]PrePatchVersion: 1003, CurrentVersion : 1003
[17:34:08] [CPPImpl::DO_PRE_PATCH]Start
[17:34:08] [CPPImpl::DO_PRE_PATCH]Local pre-patch file [C:\Documents and Settings\me\Application Data\ijjigame\u_sf_1003.pfile]
[17:34:08] [CPPImpl::DO_PRE_PATCH]The pre-patch version is same with current version.
[17:34:08] [CPPImpl::DO_PRE_PATCH]The pre-patch file is not downloaded. Do nothing.
[17:34:08] [CPPImpl::DoPatching]Complete Prepatch
[17:34:08] [CPPImpl::POST_COMPLETE_PREPATCH]Code = [0]

//PROCESSED PREPATCH

ijjiPurpleOutBounder.txt

Code:

[17:34:07] START Purple OutBound
[17:34:07] [SUCCESS]Mutex Check
[17:34:07] [SUCCESS]Get command line
[17:34:07] [SUCCESS]Parse command line
[17:34:07] [CPurpleMessenger::FindPurpleWnd]Succeeded to get hwnd = 2359400
[17:34:07] Start pre-patch proc
[17:34:07] [WndProc]TID_DISPLAY_PREPATCH_PROC
[17:34:07] [PrePatchProc]Mode = 0
[17:34:07] [WndProc]TID_DISPLAY_PREPATCH_PROC
[17:34:07] [PrePatchProc]Mode = 0
[17:34:08] [WndProc]TID_DISPLAY_PREPATCH_PROC
[17:34:08] [PrePatchProc]Mode = 0
[17:34:08] [WndProc]TID_DISPLAY_PREPATCH_PROC
[17:34:08] [PrePatchProc]Mode = 0
[17:34:08] [WndProc]TID_DISPLAY_PREPATCH_PROC
[17:34:08] [PrePatchProc]Mode = 0
[17:34:08] [WndProc]TID_DISPLAY_PREPATCH_PROC
[17:34:08] [PrePatchProc]Mode = 0
[17:34:08] [WndProc]TID_DISPLAY_PREPATCH_PROC
[17:34:08] [PrePatchProc]Mode = 0
[17:34:08] [WndProc]TID_DISPLAY_PREPATCH_PROC
[17:34:08] [PrePatchProc]Mode = 0
[17:34:08] [WndProc]UWM_PREPATCH_DONE
[17:34:08] [StartPatch]Start
[17:34:08] [CWorkerThread::Start]Start
[17:34:08] [CWorkerThread::Start]Succeeded to create thread
[17:34:08] [CWorkerThread::WorkerThread]Start
[17:34:08] [CPurpleMessenger::FindPurpleWnd]Succeeded to get hwnd = 2359400
[17:34:08] [GET_GAME_INFO]GameId = u_sf
[17:34:08] [GET_GAME_INFO]_sLocPPInfoFileName = C:\DOCUME~1\me\LOCALS~1\Temp\\u_sf_ppinfo.ini
[17:34:08] [GET_GAME_INFO]_sSvrPPInfoFileName = http://cdn.ijjimax.com/nhnusa/games/..._sf_ppinfo.ini
[17:34:08] [GET_GAME_INFO]Succeeded to delete C:\DOCUME~1\me\LOCALS~1\Temp\\u_sf_ppinfo.ini
[17:34:08] [Util::DownloadFile] [ http://cdn.ijjimax.com/nhnusa/games/..._sf_ppinfo.ini ]->[ C:\DOCUME~1\me\LOCALS~1\Temp\\u_sf_ppinfo.ini ]
[17:34:08] [GET_GAME_INFO]Succeeded to download http://cdn.ijjimax.com/nhnusa/games/..._sf_ppinfo.ini to C:\DOCUME~1\me\LOCALS~1\Temp\\u_sf_ppinfo.ini
[17:34:08] [GET_GAME_INFO]Patch method is hul   //METHOD HUL (SERVER EMU TO REGISTERY)
[17:34:08] [SET_ROOT_FOLDER]m_szRegKeyInstall = SOFTWARE\Dragonfly\soldierfront
[17:34:08] [SET_ROOT_FOLDER]m_szRegValuePath = installPath //INSTALL REG
[17:34:08] [SET_ROOT_FOLDER]Trim Right
[17:34:08] [SET_ROOT_FOLDER]Succeeded to query value = installPath
[17:34:08] [SET_ROOT_FOLDER]Install path = C:\ijji\ENGLISH
[17:34:08] [DOWNLOAD_HUL]Start
[17:34:08] [DOWNLOAD_HUL]Hul Directory = C:\Documents and Settings\me\Application Data\ijjigame\HUL //PATH TO HUL DIRECTORY 
[17:34:08] [DOWNLOAD_HUL]Succeeded to delete Hul = C:\Documents and Settings\me\Application Data\ijjigame\HUL\u_sf.hul
[17:34:08] [Util::DownloadFile] [ http://cdn.ijjimax.com/nhnusa/games/...ewhul/u_sf.hul ]->[ C:\Documents and Settings\me\Application Data\ijjigame\HUL\u_sf.hul ]
[17:34:09] [DOWNLOAD_HUL]End.
[17:34:09] [PARSING_HUL]Start.
[17:34:09] [PARSING_HUL]End.
[17:34:09] [CHECK_LOCAL_FILES]Start.
[17:34:10] [CHECK_LOCAL_FILES]End.
[17:34:10] [DO_PATCH]Start.
[17:34:10] [DO_PATCH]Need to patch.
[17:34:10] [Util::DownloadFile] [ http://cdn.ijjimax.com/nhnusa/games/...nstall.exe.zip ]->[ C:\ijji\ENGLISH\ijjiuninstall.exe.zip ]
[17:34:11] [Util::DownloadFile] [ http://cdn.ijjimax.com/nhnusa/games/...data39.mrg.zip ]->[ C:\ijji\ENGLISH\\u_sf\data\lobby\lobbydata39.mrg.zip ]
[17:34:19] [Util::DownloadFile] [ http://cdn.ijjimax.com/nhnusa/games/...nu_020.sff.zip ]->[ C:\ijji\ENGLISH\\u_sf\data\menu\menu_020.sff.zip ]
[17:34:19] [Util::DownloadFile] [ http://cdn.ijjimax.com/nhnusa/games/...nd_009.sff.zip ]->[ C:\ijji\ENGLISH\\u_sf\data\sound\sound_009.sff.zip ]
[17:34:20] [Util::DownloadFile] [ http://cdn.ijjimax.com/nhnusa/games/...rfront.exe.zip ]->[ C:\ijji\ENGLISH\\xfire\xfire_installer_24715.soldierfront.exe.zip ]
[17:34:41] [DO_PATCH]We don't need to patch.
[17:34:41] [DO_PATCH]End. Result = 1
[17:34:41] [CWorkerThread::WorkerThread]End bRet = 1
[17:34:41] [StartPatch]End
[17:34:41] End of ijjiPurpleOutBounder

//////////////////////Beanlog/////////////////////////////////
-----------------------Start--------------------------------------
The BEanlog tells To create the POinter Window 120284.
Using NB Mode.
///////////////////////////////////////
To this Fonction.
CPBUploadMgr::Work() start

Now After the game mode Placed.

try GETFILE::u_sf_1003.pfile

CPBUploadMgr::Work() End
//////////////////////////////////////
CPBUploadMgr thread Terminated
CPurpleBean thread Terminated

ReleaseSDK()

~CPBGameInfo()
--------------END---------------------

Beanlog.txt

Code:

[17:34:42] [DEBUG] Create Window... 120284
[17:34:42] [INFO] Use NB Mode
[17:34:44] [DEBUG] CPBUploadMgr::Work()... Begin
[17:34:44] [INFO] Try to find out process...
[17:36:14] [INFO] Success... find out process
[17:36:14] [INFO] AfterGame mode
[17:36:14] [INFO] Waitting for terminate process...
[17:37:55] [INFO] Process terminated in AfterGame mode, so start upload logic. 
[17:37:55] [INFO] Find out file in default path
[17:37:55] [INFO] Can't find out file in default path... C:\Documents and Settings\me\Application Data\ijjigame\u_sf_1003.pfile
[17:37:55] [INFO] Start Uploading.. : C:\Documents and Settings\me\Application Data\ijjigame\U_SFInstaller.exe
[17:37:55] [DEBUG] CPBUploadMgr::Work()... End
[17:38:10] [DEBUG] CPBUploadMgr thread Terminated..
[17:38:10] [INFO] CPurpleBean thread Terminated..
[17:38:13] [DEBUG] ReleaseSDK()..
[17:38:13] [DEBUG] ~CPBGameInfo()..

MyPurpleLog.c

Code:

[17:34:03] [WARNING] Fail to download cipher text. error code = -12147. Try to download plain text.
[17:34:03] [WARNING] There is no setting::ui tag. Default value "core" applied
[17:34:03] [INFORM] Analyze Param Ended
[17:34:04] [WARNING] There is no background filename in ui::background. Default image will be used.
[17:34:04] [INFORM] Create window Ended
[17:34:04] [INFORM] common module manager started
[17:34:04] [INFORM] full environment path = C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\system32\WBEM;C:\WINDOWS.000;C:\WINDOWS.000\COMMAND;C:\ijji\ENGLISH
[17:34:04] [INFORM] dll path = C:\ijji\ENGLISH
[17:34:04] [INFORM] RPC : OnInitialize
[17:34:05] [INFORM] RPC : interface calling is ended. result of CheckSFInstall is 3
[17:34:06] [INFORM] RPC : interface calling is ended. result of ijjiPurplePlugin_Execute is 1
[17:34:06] [INFORM] Show download Dialog
[17:34:07] [INFORM] Show html http://game.ijji.com/purplelauncher/...hn?gameId=u_sf
[17:34:07] [INFORM] Show update Dialog
[17:34:07] [INFORM] Updater Started
[17:34:07] [INFORM] RPC : OnMaintUIBefore
[17:34:41] [INFORM] Ready to Run Client
[17:34:41] [INFORM] Write Registry ended. Game update is finished
[17:34:41] [INFORM] RPC : interface calling is ended. result of LaunchBean is 3
[17:35:40] [INFORM] Execution has been succeeded!

ONLY FOR PRE-PATCH TO PATCH VERSION GAMES WDS
Like this fonction used in PurpleBean.exe:

[CPPImpl::GET_PP_VERSION]Start

-------->GET_PP_VERSION

_sLocHgverFilename
http://cdn.ijjimax.com/nhnusa/games/...epatch/u_sf.pv

-------->1004
*******************
All this upper GET this thing for c++ D3d_ASM emu

pp_config.ini

Code:

 
#FOR REAL
[CDN]
LIMIT = 420

_sLocHgverFilename
http://cdn.ijjimax.com/nhnusa/games/.../patch/u_sf.cv

-------->1003

All this upper GET this thing for c++ D3d_ASM emu

u_sf_ppinfo.ini

Code:

 
#PrePatch info.( FOR REAL SOLDIER FRONT)
[URLs]
PREPATCH  = http://cdn.ijjimax.com/nhnusa/games/.../U_SF/prepatch
PATCH   = http://cdn.ijjimax.com/nhnusa/games/arcade/U_SF/patch
CDNTRAFFIC = http://services.ijji.com/service/cdn/traffic
[Registry]
KEY_INSTALL = SOFTWARE\Dragonfly\soldierfront
VALUE_PATH  = installPath
[CDN]
#Unit - Megabits/sec
LIMIT  = 270
[Extend]
INSTALL_PATH_TRIM_RIGHT = 1
[Condition]
#0= none, 1 = File CheckSum, 2=Registry Check
OVERWRITECHECK = 0
#if OVERWRITECHECK 1 = File Name, 2=Registry Value Name
INFO = NULL
#if OVERWRITECHECK 1 = CheckSum Value, 2=Registry Value
VALUE = 0
[Patch]
# available values = hul, skip
METHOD = hul

[CPPImpl::DoPatching]Complete Prepatch

[CPPImpl::POST_COMPLETE_PREPATCH] Code = [0]
_______________________________
Succeeded to download prepatch version

//lobbydata39.mrg
File attached

/////////////////////////////////////////////////////////////////

--- CDN TRAFFIC BY MITCH1490 ---

////////////////////////////////////////////////////////////////

//ALL PRE-PATCH & PATCH & CDN TRAFFIC EMU

[URLs]
PREPATCH = http://cdn.ijjimax.com/nhnusa/games/.../U_SF/prepatch
PATCH = http://cdn.ijjimax.com/nhnusa/games/arcade/U_SF/patch
CDNTRAFFIC = http://services.ijji.com/service/cdn/traffic

//INSTALL REG PATH

[Registry]
KEY_INSTALL = SOFTWARE\Dragonfly\soldierfront
VALUE_PATH = installPath

//CDN MEAN THE NETWORK LIMIT PING

[CDN]
#Unit - Megabits/sec
LIMIT = 270

//TRIM PATH

[Extend]
INSTALL_PATH_TRIM_RIGHT = 1 //ONE MEANS ENABLED

//MANAGE UR REG

[Condition]
#0= none, 1 = File CheckSum, 2=Registry Check
OVERWRITECHECK = 0

#if OVERWRITECHECK 1 = File Name, 2=Registry Value Name
INFO = NULL

#if OVERWRITECHECK 1 = CheckSum Value, 2=Registry Value
VALUE = 0

//YOU HAVE CHOISES TO EMULATE SERVER HUL OR ONLY SKIP.

[Patch]
# available values = hul, skip
METHOD = hul

/////////////////////////////////////////////////////////END/////////////////////////////////////////////////////////////

After looking and searching in thoses folders You can simply know what The GameGuard Emulation is Searching and Checking that the Files are all the same Format as coming from the IJJI server.

You HAve Different WAys Of going in this To Bypass|Emulate" Enabled with knowledge.

Have a nice DAy.

If I helped you in somehow pleaze hit the thanks button.
_____________________________________________
Peace,
Mitch1490 ^_^

CReditz to Myself.

La PsyCadely Du Violet.

Attached Files

	purple.zip (3.2 KB, 75 views)
	lobbydata39.mrg.zip (844.1 KB, 75 views)
	EMU SERVER.zip (930.5 KB, 98 views)

Last edited by Carbone14; 01-21-2009 at 02:16 PM. Reason: Added Purple Folder to path includes.

'Hacking' 카테고리의 다른 글

MS IE Internet Explorer Two Code Execution Vulnerabilities (0)	2009.02.11
Technical Server Problem in Soldier Front By Mitch1490 (0)	2009.02.10
How to be penetration tester? (Computer Security Specialist?) (0)	2009.02.08
XSS Cheat Sheet (0)	2009.02.06
CIS benchmarks (0)	2009.02.06

Posted by CEOinIRVINE

l

How to be penetration tester? (Computer Security Specialist?)

Hacking 2009. 2. 8. 16:01

I have decided to keep my originality about all postings here. Internet is such a nice place to find information and share knowledge. I completely agree with that. However, sometimes I feel so bad that I don't write anything about my postings when I just copied and pasted somebody's useful information/postings.

At this posting, I would like to cover how to start as web penetration tester and how to be recognized by other professionals in same field.

First of all, I recommend you to visit OWASP web page.
(the free and open application security community)

http://www.owasp.org/index.php/Main_Page

And then, please visit following website for getting security basic information.

http://www.owasp.org/index.php/Category:OWASP_CAL9000_Project

Just download that project and unzip it.
You can find a lot of cheat sheets over there.
Those are very useful information for starter/beginner/wanna be security-professional.

After that, I would be SED/AWK guru who can analyze logs shortly.
That's the best way for you to get recognition from others.
They will respect you after noticing your fantastic analyzing and solving issues skills.

counterhacker@gmail.com

'Hacking' 카테고리의 다른 글

Technical Server Problem in Soldier Front By Mitch1490 (0)	2009.02.10
SF Hacking (Purple Folder) (1)	2009.02.10
XSS Cheat Sheet (0)	2009.02.06
CIS benchmarks (0)	2009.02.06
Below is a list of resources you've selected: (0)	2009.02.06

Posted by CEOinIRVINE

l

XSS Cheat Sheet

Hacking 2009. 2. 6. 09:41

XSS (Cross Site Scripting) Cheat Sheet
Esp: for filter evasion

By RSnake

Note from the author: XSS is Cross Site Scripting. If you don't know how XSS (Cross Site Scripting) works, this page probably won't help you. This page is for people who already understand the basics of XSS attacks but want a deep understanding of the nuances regarding filter evasion. This page will also not show you how to mitigate XSS vectors or how to write the actual cookie/credential stealing/replay/session riding portion of the attack. It will simply show the underlying methodology and you can infer the rest. Also, please note my XSS page has been replicated by the OWASP 2.0 Guide in the Appendix section with my permission. However, because this is a living document I suggest you continue to use this site to stay up to date.

Also, please note that most of these cross site scripting vectors have been tested in the browsers listed at the bottom of the page, however, if you have specific concerns about outdated or obscure versions please download them from Evolt. Please see the XML format of the XSS Cheat Sheet if you intend to use CAL9000 or other automated tools. If you have an RSS reader feel free to subscribe to the Web Application Security RSS feed below, or join the forum: