Key for Secure Token Response in RTMPE

[fedex1]

Thanks to everyone in this forum. It is truly appreciated.

Chap helped us with a particular public government website and gave us the key for the secure token response. Many thanks to chap! But we want to be able to find the key ourselves.

Can someone point us to a page where it describes how to derive the key for the secure token response?

For example, this works:

rtmpdump -r "rtmpe://nyc.pegcentral.com/councilnyc/" -a "councilnyc/?doConnect=12345&doPublish=54321" -f "WIN 11,8,800,94" -W "http://councilnyc.pegcentral.com/flash/media_player_798c.swf" -p "http://councilnyc.pegcentral.com/flash/media_player_798c.swf?server=nyc-rtmp.pegcentral.com&account=councilnyc&videoFilename=NYCC-PV-CH-Cha130822-153731.mp4&from=legistar&inTime=&startState=play" -y "mp4:NYCC-PV-CH-Cha130822-153731.mp4" -o "2013-08-26_11-53-22_mp4_NYCC-PV-CH-Cha130822-153731.flv" -T "2JNxehiz"

but how was the -T parameter found?

I suspect it may be different for different cases but what is the general strategy? And it probably is an evolving issue

[nullacht]

The key is stored inside the SWF file.

http://councilnyc.pegcentral.com/flash/media_player_798c.swf

nc.call("secureTokenResponse", null, TEA.decrypt(_loc_4.secureToken, secureTokenCode))

secureTokenCode = "2JNxehiz"

[fedex1]

Thank you nullacht!

For those using ubuntu, you can use swfmill to decompile the SWF file

For example,

Install:
sudo apt-get install swfmill

Run:
swfmill swf2xml media_player_798c.swf media_player_798c.xml

Then look for the token manually.

[makkie_65]

Originally Posted by nullacht

The key is stored inside the SWF file.

http://councilnyc.pegcentral.com/flash/media_player_798c.swf

nc.call("secureTokenResponse", null, TEA.decrypt(_loc_4.secureToken, secureTokenCode))

secureTokenCode = "2JNxehiz"

Hello,

Can you walk me through how you got from

nc.call("secureTokenResponse", null, TEA.decrypt(_loc_4.secureToken, secureTokenCode))

To

secureTokenCode = "2JNxehiz"

I got to the first part with an swf decompiler (showmycode.com), but for the life of me I have NO clue how you got to the second part. Please help????

[makkie_65]

Originally Posted by makkie_65

Hello,

Can you walk me through how you got from

nc.call("secureTokenResponse", null, TEA.decrypt(_loc_4.secureToken, secureTokenCode))

To

secureTokenCode = "2JNxehiz"

I got to the first part with an swf decompiler (showmycode.com), but for the life of me I have NO clue how you got to the second part. Please help????

Respectfully, bump

[peterpan]

Try this... http://bit.ly/1d5ndHy

[makkie_65]

Originally Posted by peterpan

Try this... http://bit.ly/1d5ndHy

Thank you for the response!
So now..... How do I get from

nc.call("secureTokenResponse", null, TEA.decrypt(_loc_4.secureToken, secureTokenCode))

To

secureTokenCode = "2JNxehiz"

Using JPEXS?

Thanks again!!!