wmsauthsign patch

coolcar1 · #1 09-27-2014, 02:15 AM

Hi, If anyone has or manages to find a patch for WmsAuthSign, please Pm me.

Okay so wmsAuthSign is a Wowza Media Server plugin to protect streams. It changes every so minuets to make it impossible to rtmpdump.

Here is an example of a WmsAuthSign Rtmpdump code:

Code:

rtmpdump -r "rtmp://198.50.183.218:1935/liveedge" -a "liveedge?wmsAuthSign=c2VydmVyX3RpbWU9OS8yNy8yMDE0IDc6MDg6MTAgQU0maGFzaF92YWx1ZT1NUzVkenBJeU5xdHBZRForVVBRQmRRPT0mdmFsaWRtaW51dGVzPTgw/" -f "WIN 15,0,0,152" -W "http://p.jwpcdn.com/6/8/jwplayer.flash.swf" -p "http://xxx-xx/site/live-tv/" --live -y "synx_hbo.stream" -o "synx_hbo.stream.flv"

Please Pm me if you know how to patch this. Thank you

Elgero · #2 09-27-2014, 03:34 AM

Why is it impossible to rtmpdump? That link stays valid for 80 minutes. Isn't that enough to record the stream?

hasomaso · #3 09-27-2014, 04:18 AM

@Elgero

maybe he does not want recording!!!
maybe he wants to re-share the livestream or just simply play with vlc

Elgero · #4 09-27-2014, 04:36 AM

Re-sharing is going to be a problem, because wmsAuthSign was designed to prevent that.

This is a base64 encoded string.

Code:

c2VydmVyX3RpbWU9OS8yNy8yMDE0IDc6MDg6MTAgQU0maGFzaF92YWx1ZT1NUzVkenBJeU5xdHBZRForVVBRQmRRPT0mdmFsaWRtaW51dGVzPTgw

Decoded it results in this string.

Code:

server_time=9/27/2014 7:08:10 AM&hash_value=MS5dzpIyNqtpYDZ+UPQBdQ==&validminutes=80

This is a base64 encoded string too.

Code:

MS5dzpIyNqtpYDZ+UPQBdQ==

Decoded it results in this MD5 hash.

Code:

312E5DCE923236AB6960367E50F40175

The above MD5 hash is created from:

ip address of the viewer
password stored on the server
server_time
validminutes

Hashing is one-way, so it cannot be decrypted to get the password.