The coolsport.tv challenge

[freez]

Originally Posted by oelk

I think it has been right, but it was changed again. Now we see the following message:

$lgonnakill%$wyou@#q1

(seems that they know that we can find it )

And: It is inside the swf

this token says " I gonna kill you " , that Koolsport admin got crazy

very good @oelk , but really it is hard to find it this time inside swf , how the hick did u find it?

[oelk]

The swf is obfuscated, so that simple 'reading' of the token won't work. It is calculated somehow everytime it has to be used. So there are some possible advances to get it:

• use a debugger to get inside the running swf and extract the token after calculation
• change the existing code and let the swf show the token for you, or
• write your own program and use the 'decryption' function

At least one of them works (but all should be possible using the right tools)

I don't know if that's a message for me or for you (I don't record anything.), but I really dislike to be killed. (Just to inform the man who wrote this token.)

[freez]

ok oelk , thanx for help , we need that token again till i can figure how i can use ur method it is changed (ff3.swf)

[evol]

Has anyone had any look getting the token or a working method of getting it ?

[LuzerMasken]

@lfrench%f1$w@#fkrbas

[jhb50]

OK. Changed again. I give up. They are going to keep changing this so its a fools errand to try and keep up. Try other sites like cricfree and igoal.

[hasomaso]

edit
edit
edit

[gorilla.maguila]

To continue with the disassembly frenzy that began with ilive.to http://stream-recorder.com/forum/dum...ve-t16652.html. I've managed to get the obfuscated token from the coolsport's swf file. BUT somehow it's not working.

This is the token I'm getting:

#atd%#$ZH

Although:

rtmpdump -r rtmp://rtmp.featve.com:1935/redirect -W "http://97ff0e7e610f20512dbe-483e6ce63d68aeb3d05af6c054efb801.r29.cf1.rackcdn.com/atdedead.swf" -p "http://featve.com/player3.php?id=20829&width=640&height=460" --live --debug -y 20829 --token "#atd%#$ZH"

It's not working.

Could it be that they have modified TEA.class inside the swf file so it's not an standard TEA decryption?

PS: I can provide more details on how I got the token so we can discuss this further

[gorilla.maguila]

Ok so I've found what is going on.

It seems that the current librtmp code fails to compute the operation:

sendSecureTokenResponse(TEA.decrypt("secureToken", "token"));

For example tampering the swf file:

TEA.decrypt("5b9389e825ebcca55cf84a71ddc5a13c6ae4f5ce19cd3fdbf91e1a53b3029f383461c800", "#atd%#$ZH")

Gives:

ed08d934-41ac-4b90-80a2-d0cacd923ae1

Where librtmp doing the same operation gives:


$]m.i.eo.I#...z._hB.`


Hence the server rejects the connection

[gorilla.maguila]

Ok so in the end it's not a problem with librtmp.

The problem seems to be that rtmpdump.c it's not parsing the correct token string length.

As a work around invoke the token option like this:

--token "#atd%#\$ZH"

with a backslash before the $