Page 1 of 2

Hacking Challenge

Posted: Fri Jan 06, 2006 5:32 pm
by Onetoomanysodas
Well I made a small little example of a program that protects a program with a password. The thing is, multiple passwords are possible. I dare anyone to break this security and ScreenShot the success screen. Just to show how confident I am of this matter, the first person (if anyone) who can break in before Friday Januaray 13th, 2006 will recieve $20.00 from me personally. Good Luck :o Oh yeah, and don't just guess a ***** password, if you randomnly guess and get in then i'll tell you to go ***** a *****. :P

This is the program in a zip file

Posted: Fri Jan 06, 2006 7:26 pm
by superaison
humumumumumumu, what form is it in?!

Posted: Fri Jan 06, 2006 11:35 pm
by Onetoomanysodas
superaison wrote:what form is it in?!
o_O ?

Posted: Sat Jan 07, 2006 1:35 am
by dos mes
you spelled access wrong

Posted: Sat Jan 07, 2006 9:39 am
by superaison
what form is the code in? form1,2? frmsuccess???

Posted: Sat Jan 07, 2006 10:28 am
by Patrickssj6
Omg i think he used that aehh "zor" thingy.I think it was calle "zor"

Posted: Sat Jan 07, 2006 12:12 pm
by Onetoomanysodas
superaison wrote:what form is the code in? form1,2? frmsuccess???
frmSuccess is the success screen you are shown once you enter the password correctly or in this case, if you get this form to show without problems, you win. And yes I'm sorry I did spell access wrong, I usually don't make teip0z that often :P The code for checking the password is in Form1.

EDIT:
Patrickssj6 wrote:Omg i think he used that aehh "zor" thingy.I think it was calle "zor"
Uhm, what?

Posted: Sat Jan 07, 2006 12:13 pm
by superaison
ok, gimme a hour

Posted: Sat Jan 07, 2006 1:31 pm
by modder4321
zor = decompiler basicly with it u can decompiler it to source edit so it works.

Posted: Sun Jan 08, 2006 1:47 am
by xbox7887
For all of those attempting to disassemble it and make the failure jump to the successful output, theres a check that makes sure there are some characters present in the box, that assembly line is located at offset 0x428984. Then you follow that jump which takes you to offset 428b9f. Right now I'm too tired to go much further but you can break it down and its fairly easy to read.

EDIT: other interesting strings, form2 contains "Thank you for logging in", ELEGANCE is probably printed....I searched for the frmsuccess, came across JFIF, which is indicative of a jpeg image, compared with another jpeg to rebuild the header and put together an image consisting of red and yellowish-orange "flames" which is most likely the background. For those who are curious to see the image themselves, it starts at offset 0x278D when looking at the exe in a hex editor. Just copy and paste into a separate file and save as .jpeg.

Point being, people don't need a password to look through protected material :P

Posted: Sun Jan 08, 2006 11:27 am
by Onetoomanysodas
:o Good work but the point is getting to use the program because it will be protecting an active program.

Posted: Sun Jan 08, 2006 9:11 pm
by kornman00
Heres a database file with a great deal of the exe documented (events, gui objects, etc)
download

Posted: Sun Jan 08, 2006 9:36 pm
by xbox7887
nice 8)

Posted: Sun Jan 08, 2006 10:21 pm
by Onetoomanysodas
:evil: You guys suck :(

:P

Posted: Thu Jan 12, 2006 11:43 am
by Onetoomanysodas
Contest ends tomorrow. The source code will be released for teaching/information purposes.

Posted: Thu Jan 12, 2006 1:28 pm
by xbox7887
lol the source can't teach you how to hack, in fact it makes the concept that much harder to grasp :P

Posted: Thu Jan 12, 2006 9:27 pm
by live2board
I think he means so that people can understand how passwords and things are encrypted.

Posted: Thu Jan 12, 2006 11:38 pm
by Onetoomanysodas
live2board wrote:I think he means so that people can understand how passwords and things are encrypted.
Lol yes exactly, you took the words from my mouth. Plagiarism! :-P

Posted: Sat Jan 14, 2006 5:21 am
by modder4321
its not hard.

1 way of encrypting which is my favorite is...

encode the pass into hex then simply strrev it.

then u got an encoded pass lmao

Posted: Sat Jan 14, 2006 5:21 pm
by Teh 1337z0rs
Ha, its funny how you put it on a site that is all about reverse engineering.