Spoofing RTMP urls

[anrelou]

Hey, guys. I am trying to get RTMPE streaming urls from Flash on a site.

I examined the source of the swf file (attached!) and realized that the mechanism is as this:
1. SWF fetches the XML .../xmls/tiesraide/pirmais_baltijas_kanals.xml

<player>
<media>
<type>live</type>
<mode>full</mode>
<image/>
<server>
<origin>195.13.206.152</origin>
<origin>195.13.216.8</origin>
</server>
<language code="lv">
<stream quality="hq">mp4:pirmais_baltijas_kanals_ru_hq.stream</stream>
<stream quality="lq">mp4:pirmais_baltijas_kanals_ru_lq.stream</stream>
</language>
</media>
<security>
<resource_id>c-pirmais_baltijas_kanals</resource_id>
<auth_token>
S0fgGLrKHh8lyUbOu7CE5IYG+dyKk122iNXtOxnPycWcClJKHxUKNKC+bs0bbWY+fA8ZnHwLBOB39U4bY3OP0ptnSbhvqoOWm+F/v8VMMjiGFRROxanClKa0Bg+2NQ6i
</auth_token>
</security>
</player>

2. Then it goes to the balancing server: 195.13.206.152:80/loadbalancer?stream=pirmais_baltijas_kanals_ru_hq. stream, which returns another XML

<server>
<status>1</status>
<edge>195.13.206.155</edge>
<client>109.229.197.168</client>
</server>

3. Judging by the code, SWF establishes connection to "rtmpe://195.13.206.151/live/"

[img=http://s29.postimg.org/f4js22our/Screen_Clip_1.jpg]

Although I couldn't find the exact URLs in Wireshark (you may see the log pic attached), the rtmpe link was confirmed when I took a dump Flash Player page and searched in HxD. So, at this moment I already have this rtmpe link, but the live stream is not downloaded still (neither with VLC, nor with

rtmpdump.exe -r "rtmpe://195.13.206.151/live/" -W "https://www.<site url>/static/m_player.swf" --live -o downl.mp4

).

Both ffmpeg and rtmpdump say:

Trying different position for server digest!
RTMP_ReadPacket, failed to read RTMP packet header

I'm concerned that the RTMPE url is so simple. What did I do wrongly?

[surya987]

post video link...

[anrelou]

Originally Posted by surya987

post video link...

You might need to have Latvian IP for that, but I am not sure: https://www.lattelecom.tv/tiesraide/

[biezom]

hi
you can try to find m3u8 playlist with user agent switcher addon on firefox >>> switch iphone 3.0
if you don't find send login in PM

[anrelou]

Originally Posted by biezom

hi
you can try to find m3u8 playlist with user agent switcher addon on firefox >>> switch iphone 3.0
if you don't find send login in PM

There cannot be any playlist or something like this. It's not a playlist but it's a list of tv channels.

[biezom]

Originally Posted by anrelou

There cannot be any playlist or something like this. It's not a playlist but it's a list of tv channels.

no you do not understand what I meant.

if you change the user agent of your browser, it changes the protocol

rtmp for default user agent
often m3u8 for iphone user agent

[hasomaso]

for rtmp:// protocolling you need secureToken

-T "252789c27626cb86de1ddfdff61d75f0"

token=252789c27626cb86de1ddfdff61d75f0

[anrelou]

Originally Posted by hasomaso

for rtmp:// protocolling you need secureToken

-T "252789c27626cb86de1ddfdff61d75f0"

token=252789c27626cb86de1ddfdff61d75f0

Is this token an example or a real one? =D How do I get this token?

[hasomaso]

@anrelou

rtmpdump -v -r "rtmpe://195.13.206.150/live" -a "live/" -W "https://www.lattelecom.tv/static/m_player.swf?t=1426590732" -p "https://www.lattelecom.tv/tiesraide/" -y "mp4:lattelecom_lv_hq.stream" -T "252789c27626cb86de1ddfdff61d75f0" -o "output.flv"

Starting Live Stream
INFO: Metadata:
INFO:   videocodecid            avc1
INFO:   width                   853.00
INFO:   height                  480.00
INFO:   frameWidth              640.00
INFO:   frameHeight             480.00
INFO:   displayWidth            853.00
INFO:   displayHeight           480.00
INFO:   framerate               25.00
INFO:   audiochannels           2.00
INFO:   audiosamplerate         44100.00
INFO:   audiocodecid            mp4a
INFO: trackinfo:
INFO:   timescale               0.00
INFO:   language                eng
INFO: sampledescription:
INFO:   type                    video
INFO:   profile-level-id        4d401e
INFO:   sprop-parameter-sets    Z01AHpZSgUB7Yd6goKC+AAADAAIAAAMAZSg=,aP88gA==
INFO:   description             {H264CodecConfigInfo: codec:H264, profile:Main,
level:3.0, frameSize:640x480, displaySize:853x480, frameRate:25.0, PAR:4:3}
INFO:   timescale               0.00
INFO:   language                eng
INFO: sampledescription:
INFO:   type                    audio
INFO:   config                  1210
INFO:   description             {AACFrame: codec:AAC, channels:2, frequency:4410
0, samplesPerFrame:1024, objectType:LC}
INFO: rtpsessioninfo:
INFO:   protocolversion         0
INFO:   connectiondata          IN IP4 239.255.15.30
INFO:   timing                  0 0
INFO:   origin                  - -1115399521 -1115399521 IN IP4 127.0.0.1
INFO:   name                    WowzaMediaServer
INFO: attributes:
INFO:   range                   npt=now-
15693.220 kB / 63.23 sec

[anrelou]

@hasomaso

Originally Posted by hasomaso

@anrelou

rtmpdump -v -r "rtmpe://195.13.206.150/live" -a "live/" -W "https://www.lattelecom.tv/static/m_player.swf?t=1426590732" -p "https://www.lattelecom.tv/tiesraide/" -y "mp4:lattelecom_lv_hq.stream" -T "252789c27626cb86de1ddfdff61d75f0" -o "output.flv"

Starting Live Stream
INFO: Metadata:
INFO:   videocodecid            avc1
INFO:   width                   853.00
INFO:   height                  480.00
INFO:   frameWidth              640.00
INFO:   frameHeight             480.00
INFO:   displayWidth            853.00
INFO:   displayHeight           480.00
INFO:   framerate               25.00
INFO:   audiochannels           2.00
INFO:   audiosamplerate         44100.00
INFO:   audiocodecid            mp4a
INFO: trackinfo:
INFO:   timescale               0.00
INFO:   language                eng
INFO: sampledescription:
INFO:   type                    video
INFO:   profile-level-id        4d401e
INFO:   sprop-parameter-sets    Z01AHpZSgUB7Yd6goKC+AAADAAIAAAMAZSg=,aP88gA==
INFO:   description             {H264CodecConfigInfo: codec:H264, profile:Main,
level:3.0, frameSize:640x480, displaySize:853x480, frameRate:25.0, PAR:4:3}
INFO:   timescale               0.00
INFO:   language                eng
INFO: sampledescription:
INFO:   type                    audio
INFO:   config                  1210
INFO:   description             {AACFrame: codec:AAC, channels:2, frequency:4410
0, samplesPerFrame:1024, objectType:LC}
INFO: rtpsessioninfo:
INFO:   protocolversion         0
INFO:   connectiondata          IN IP4 239.255.15.30
INFO:   timing                  0 0
INFO:   origin                  - -1115399521 -1115399521 IN IP4 127.0.0.1
INFO:   name                    WowzaMediaServer
INFO: attributes:
INFO:   range                   npt=now-
15693.220 kB / 63.23 sec

Wow, that is an amazing result, thanks! I tried the same code with another channel, which is now seeable only when logged in and it didn't work.

Command was:

rtmpdump -v -r "rtmpe://195.13.206.155/live" -a "live/" -W "https://www.lattelecom.tv/static/m_player.swf" -p "https://www.lattelecom.tv/tiesraide/ltv1" -y "mp4:ltv1_lv_lq.stream" -T "fi+x3eigJ5Bm3+LX+sP8j52y4MPpb7Uq3H6tlVrqHaX9udn0paTgYHn3OOLqImu8b4/kxY/Y5YKPoRNXGItnvJqeXOvZ/Ns8" -o "output3.flv"

Output was:

RTMPDump v2.3
(c) 2010 Andrej Stepanchuk, Howard Chu, The Flvstreamer Team; license: GPL
ERROR: RTMP_HashSWF: connection lost while downloading swfurl https://www.lattelecom.tv/static/m_player.swf
Connecting ...
WARNING: Trying different position for server digest!
INFO: Connected...
ERROR: RTMP_ReadPacket, failed to read RTMP packet header

What did I miss out? I put the auth token from this xml: https://www.lattelecom.tv/xmls/tiesraide/ltv1.xml

UPD. Maybe, it might help, that for m3u8 link looks smth like:

http://195.13.216.2/mobile/mp4:ltv1_lv_lq.stream/playlist.m3u8?resource_id=c-ltv1&auth_token=<.....>