Lumeng Remote Security Assessment System-Aurora cracking ideas

From: http://www.linglin.org /? P = 437

For work reasons, we recently used the Remote Security Assessment System of lumeng. Later we studied and found that the system's anti-cracking function is still very powerful. I tried multiple methods and failed.

Now, let's write down two aspects that I think may be useful. If you see this article, I hope you can reinforce it from the two aspects I have considered.

Let's talk about how Aurora is verified:

1. We need to use it with Apsara's rc4nd dog. Although rc4nd is already very Nb-intensive, it has been decrypted. We can copy the dog freely and I will copy it myself.

2. It must be used together with the certificate in the import system. The certificate contains the hash calculated by Aurora (hash contains the computer's special needle and the dog's user number)

3. When the software is started, if the dog is not detected, the system prompts that the dongle is not found and the dog is not running. Of course, this restriction is very good.

4. Aurora also needs to verify that our dog does not exist on the Web UI after startup.

To crack the code, you can only get the program code of Aurora, But Aurora is encapsulated in the vmvm. Therefore, you must enter the VM system instead of directly modifying the program code.

Here are my methods:

1. Copy the Aurora vmdk file to an empty Linux vmvm that can be started. Grub requires a password and a root password for the system.

2, The VMDK-000 to the Linux virtual machine can be properly started, can only read a partition, that is, the system boot partition, you can give the GRUB Password to kill.

3. Grub after the password is killed cannot boot into single mode.

4. Hanging the Virtual Disk Under winpe cannot read the format and content of another partition with PQ.

5. Other software that can read the ext2 partition format cannot read the format of this disk.

6. I did not try to crack the root password. I think it should be futile. The password should be very weak.

So the above is my solution.

The idea is as follows:

The system has the automatic upgrade function. Can I start with a patch file and mount a webshell?

The study found that after reading the user code of a dog from the startup shell, the code is sent to the Aurora through the network. Can the attack be replayed here?

The above is my analysis. If you prefer to study this shoe, contact me.

From: http://www.linglin.org /? P = 437