SoScore Mode 0 Password Extractor

-=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- (c) WidthPadding Industries 1987 0\|518\|0 -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=-
SoCoder -> Snippet Home -> Variables

flying_cucco	Created : 02 October 2008 Edited : 05 October 2008 Language : Cobra SoScore Mode 0 Password Extractor hack into the (old) scoreboards
As JnK has now posted the updated algorythm, and most games updated, this should be safe to reveal. So, here is a little program that takes a cyphertext message, and its plaintext, and outputs the password. Input: coded:string is the cyphertext, which you can get from packet capture or reading the savefile - the longer the better. plain:string is the plaintext, which must exactly match the contents of the cyphertext, which you can get by looking at the score page. Some real examples are included at the bottom. Output: passwords.csv is a list of possible passwords. 99.99% of the time it will be the first choice. rainbow.csv is a nice hash table; if you didn't get the plaintext right (so the analysis fails), or are analysing a partial block, the password can probably be guessed from here. program const BUFFER = 1000 var len :integer //length of string // index offset plain_asc :array [BUFFER, BUFFER] of integer //plain string with rotations coded_asc :array [BUFFER ] of integer //clean encrypted string delta :array [BUFFER, BUFFER] of integer //proposed password hash period :array [ BUFFER] of integer //number of characters in password function Hack(plain :string, coded :string) :string //simple K.P.A //make tables of possible passwords and return best one //password should be shorter than the cyphertext begin CreateRainbow(plain, coded) //populate table SaveRainbow("rainbow.csv") //save table result := SavePasswords("passwords.csv") //save passwords end procedure CreateRainbow(plain :string, coded :string) // fill in the data var index :integer offset :integer begin len := Length(plain) for index = 0 to len - 1 coded_asc[index] := WebDecode( Asc(Mid(coded, index + 1, 1)) ) next for index = 0 to len - 1 for offset = 0 to len - 1 plain_asc[index, offset] := Asc(Mid(plain, (index + offset) mod len + 1, 1)) delta[index, offset] := coded_asc[index] - plain_asc[index, offset] + 32 if delta[index, offset] < 32 then delta[index, offset] := delta[index, offset] + 95 next next for offset = 0 to len - 1 period[offset] := DeltaPeriod(offset) next end procedure SaveRainbow(filename :string = "rainbow.csv") // save csv data table, mostly for debugging var fout :element index :integer offset :integer begin fout := WriteFile(filename) Write(fout,'"","","period"') for offset = 0 to len -1 Write(fout,',"'+ period[offset] +'"') next Write(fout, Chr($d) + Chr($a)) Write(fout,'"plain","coded","index"') for offset = 0 to len -1 Write(fout,',"'+ offset +'"') next for index = 0 to len -1 Write(fout, Chr($d) + Chr($a)) Write(fout,'"'+ plain_asc[index, 0] +'","'+ coded_asc[index] +'","'+ index +'"') for offset = 0 to len -1 Write(fout,',"'+ delta[index, offset] +'"') next next Closefile(fout) end function SavePasswords(filename :string = "passwords.csv") :string // save csv sorted list of passwords var fout :element p, i :integer offset :integer password :string begin fout := WriteFile(filename) Write(fout,'"offset","length","password"') for p = 1 to len - 1 for offset = 0 to len - 1 if period[offset] = p then //build password from array password := chr(delta[p-1, offset]) for i = 0 to p - 2 password := password + chr(delta[i, offset]) next //return first password if result = "" then result := password //csv safe password password := replace(password, '"', '""', false) //Write to file Write(fout, Chr($d) + Chr($a)) Write(fout,'"'+ offset +'","'+ p +'","'+ password +'"') endif next next Closefile(fout) end function DeltaPeriod(offset :integer) :integer var index :integer p :integer begin //make the password the first p characters. //check each character matches the password, otherwise increase p and repeat for p = 1 to len - 1 for index = 1 to len - 1 if delta[index, offset] <> delta[index mod p, offset] then break if index = len - 1 then result := p exit endif next next end function WebDecode(ascii :integer) :integer // reverse websafe encoding begin case ascii of 129: result := Asc("&") 130: result := Asc("?") 131: result := Asc("+") 132: result := Asc("\") 133: result := Asc(":") 134: result := Asc("/") 135: result := Asc("#") 136: result := Asc("'") 137: result := 34 138: result := 32 139: result := Asc("<") 140: result := Asc(">") 141: result := Asc("%") default: result := ascii endcase end var plain :string coded :string begin //example 1 (Cobra Test 2) // plain := "cucco3F4E\|56160\|cucco99BD\|52627\|cucco1546\|48019\|cucco99AE\|35961\|cucco9DF0\|33405\|cucco3CC6\|32851\|cucco417C\|28449\|cucco0F73\|24499\|cuccoB490\|18873\|cucco5CDC\|17517\|" // coded := "iHJQ(u}%pv~u(}cEiHJQ$+}tpvzu-}cEiHJQ6x qpu~y+wcEiHJQ)(+%pu}v%{cEiHJQ'+z'py\|rtcEiHJQ-})&pyxw&{cEiHJQ%yzwpx~q%}cEiHJQ-}('pw{zucEiHJQ-)-qpwyu$ycEiHJQ'(wpwxy)ucE" //example 2 (Sheriff Munkey) // plain := "Nick\|2220\|Jayenkai\|490\|cucco\|360\|N/A\|0\|N/A\|0\|N/A\|0\|N/A\|0\|N/A\|0\|N/A\|0\|N/A\|0\|N/A\|0\|N/A\|0\|N/A\|0\|\|0\|\|0\|\|0\|\|0\|\|0\|\|0\|\|0\|\|0\|\|0\|\|0\|\|0\|\|0\|\|0\|\|0\|\|0\|\|0\|\|0\|\|0\|\|0\|\|0\|\|0\|\|0\|\|0\|\|0\|\|0\|\|0\|\|0\|\|0\|\|0\|\|0\|\|0\|\|0\|\|0\|\|0\|\|0\|\|0\|\|0\|" // coded := "r~hv~rq$jr~hv~rq$jr~hv~rq$jr~hv~rq$jr~hv~rq$jr~hv~rq$jr~hv~rq$jr~hv~rq$jr~hv~rq$jr~hv~rC]Qak},!&q>OoTZeP_q('&kOoRYdp!,~hH}7q$jD}-v~rC#/r~hH}7q$jD}-v~rC#/r~hH}7q$jD}-v~rC#/r~hH}7q$jr~hv~rq$jr~hv~rq$jr~hv~r" //example 3 (Harder H~S) plain := "cucco\|17988\|19\|12\|Pater-Alf\|8707\|12\|4\|Pax\|8266\|11\|8\|Pax\|7562\|10\|6\|Snappy\|5907\|8\|5\|olli\|5364\|8\|6\|Jayenkai\|4869\|8\|5\|DeanDemon\|4788\|10\|2\|Player\|4742\|10\|2\|Blanko\|4610\|9\|2\|Blanko\|4544\|9\|2\|Kango\|3564\|6\|3\|N/A\|0\|\|0\|N/A\|0\|\|0\|N/A\|0\|\|0\|N/A\|0\|\|0\|N/A\|0\|\|0\|N/A\|0\|\|0\|N/A\|0\|\|0\|N/A\|0\|\|0\|N/A\|0\|\|0\|N/A\|0\|\|0\|\|0\|\|0\|\|0\|\|0\|\|0\|\|0\|\|0\|\|0\|\|0\|\|0\|\|0\|\|0\|\|0\|\|0\|\|0\|\|0\|\|0\|\|0\|\|0\|\|0\|\|0\|\|0\|\|0\|\|0\|\|0\|\|0"+"\|"+"\|0\|\|0\|\|0\|\|0\|\|0\|\|0\|\|0\|\|0\|\|0\|\|0\|\|0\|\|0\|\|0\|\|0\|\|0\|\|0\|\|0\|\|0\|\|0\|\|0\|\|0\|\|0\|\|0\|\|0\|\|0\|\|0\|\|0\|\|0\|\|0\|\|0\|" coded := '?X/lUTX?U\21@F_(+f, kT?s~iX\w$&VT@CXl%f=\P1.3/\&$yw)kT?e~^^Yw$$VV@KE"o5\^V2?VG^$o w#kpQd/Xloyw>}c?S/E o81kR?@BE>"+w k?R@`W1oywl~?pRSE of+l=Qc@BEl#fI~0?R@/XlAx<l~??S/v~4f+lkR?@BEl#fw k?R@/Xloywl~??S/E of+lkR?@BEl#fw k?R@/Xloywl~??S/E of+lkR?@BEl#fw k?R@/Xloywl~??S/E of+lkR?@BEl#fw k?R@/Xloywl~??S/E of+lkR?@BEl#fw k?R@/Xloywl~??S/E of+lkR?@BEShM^_kSY\J`l$#w!!?r%'+"'"+'.b +gVkZYSIE!%f/l?$;@JZ&)f,!kZ?ssAl*~1"kSR@HECaKk`h?W\B_l+f0l^//-/]#)}w(kX?msBUaU\YkVZYKE(' hack(plain, coded) end --v

Comments
Thursday, 02 October 2008, 14:52
Jayenkai	Probably not quite yet, as some folk haven't yet tweaked their programs to fit. Remember, this isn't just something I did for myself. You've fucked up everyone elses stuff, too..
Thursday, 02 October 2008, 16:35
Afr0	Well, the thing about this is that to intercept packets going from any given machine to the Socoder server, you'd have to hack the machine first. Or the Socoder server, and packetsniff Apache. Which means you'd need to root the box. Good luck with that! Same thing goes for retrieving save files, really.
Thursday, 02 October 2008, 17:43
flying_cucco	You don't need to do any of that to give yourself a million points, or whatever. The first thing I did was let JnK know about the problem, he's not too happy about it though.

SoScore Mode 0 Password Extractor

Comments