1

Can anyone on here help me on decrypting the SSL encryption that protects this LUA script linked at the end of this topic ?

Basically they are encoded with Base64 then SSL, but I have no idea how to do the SSL portion. They are used with a program called 'Bot of Legends', and someone told me that it is possible to break the encryption by dumping the decryption function of said program and using that to get the SSL key. But, I have no clue where to even start on that.

Basically, these scripts work by connecting to an authentication server that is coded into the script, and I have gotten a few on my own by sniffing the traffic to their authentication server from network packets to get their server link and essentially created my own authentication server with Apache, then redirected the network traffic that goes to their server to my own from the script to get the script validated response.

For some scripts that have stronger encryption, its not that easy and I would have to get to the source code to remove the coding that runs the authentication server checks. Up until a few days ago I had no knowledge on how lua coding worked and how to even compute how authentication server checks could be even possible for coding in a simple text file due to lua obfuscation.

So, bear with me, I would like if someone can chime in and give me an idea on what I can do.

PasteBin to the script in question in raw format.

The Base64 section is first with the SSL section at the bottom.

  • 2
    _G.ScriptENV = _ENV SSL({121,244,...}) -- At the very least you'd need to find the SSL function. – Jason Geffner Aug 12 '15 at 21:14
  • these numbers are basically decimal ascii code , but even if i convert it - it still makes no sense ( the key ) i would like to find that but the script is obfusicated with the ssl encryption ... that is the problems – Saeed A Suleiman Aug 12 '15 at 21:39
  • 1
    Those numbers are not decimal ASCII codes. ASCII is a 7-bit character encoding scheme, and the decimal value 244 has its 8th bit set. Furthermore, aside from the function name "SSL", there's no evidence that actual SSL crypto is being used here. – Jason Geffner Aug 13 '15 at 0:01
  • Sorry for necroing, but how about SSL3 and SSL3 ? – LuaNoob Apr 14 at 14:24
2

Since it is not used anymore I'll show you :)

print("SSL Decoder version 2.0")
print("Copyright (C) 2015")
print("Decoding Started...")

local infilename = select(1,...)
local outfilename = select(2,...)

local infile = io.open(infilename, "r")

if not infile then
  error("Failed to open input file.")
end

local intext = infile:read("*a")

infile:close()

local ssltabletext = intext:match("SSL%s*%(%s*%{([%s,0-9]*)%}%s*%)")

if not ssltabletext then
  error("Could not find ssl table in source file.")
end

local ssltable = load("return {"..ssltabletext.."}")()

if #ssltable < 255 then
  error("SSL table is too short -- can't find table encryption key.")
end

-- find decryption key for the ssl table
local decrypt = {}

decrypt[0] = 0
for i = 1,255 do
  local dec = i
  local enc = ssltable[i]
  assert(decrypt[enc] == nil)
  decrypt[enc] = dec
end

-- decrypt ssl table
for i = 256, #ssltable - 256 do -- not sure what last 256 bytes are
  ssltable[i] = decrypt[ssltable[i] ]
end

-- If this does a stack overflow, easy to change to something dumb but more robust
local sslcode = string.char(table.unpack(ssltable, 256, #ssltable - 256))

-- This is interesting -- 
--print(sslcode)

local keyindex = sslcode:match("local Key%s*=%s*'()")
if not keyindex then
  error("Could not find key in decoded ssl table.")
end

local key = sslcode:sub(keyindex)

local length = 0
while true do
  local c = key:sub(length+1, length+1)
  if c == "" then
    error("Key string was not terminated.")
  elseif c == "'" then
    break
  elseif c == "\\" then
    local c2 = key:sub(length+2, length+2)
    if c2:match("%d") then
      local c3 = key:sub(length+3, length+3)
      if c3:match("%d") then
        local c4 = key:sub(length+4, length+4)
        if c4:match("%d") then
          length = length + 4
        else
          length = length + 3
        end
      else
        length = length + 2
      end
    elseif c2 == "x" then
      length = length + 4
    else
      length = length + 2
    end
  else
    length = length + 1
  end
end

key = key:sub(1, length)

if #key == 0 then
  error("Key is empty")
end

print("Key Found! > " .. key)
print("Decoding finished, outfile is at > " .. outfilename)

-- find base64
local b64 = intext:match("_G.ScriptCode%s*=%s*Base64Decode%s*%(%s*\"([a-zA-Z0-9/+]*=*)\"%s*%)")
if not b64 then
  error("Could not find Base-64 encrypted code in source file.")
end

-- base64 decode
local b64val = {}
for i = 0, 25 do
  do
    local letter = string.byte("A")
    b64val[string.char(letter+i)] = i
  end
  do
    local letter = string.byte("a")
    b64val[string.char(letter+i)] = i + 26
  end
end
for i = 0, 9 do
  local numeral = string.byte("0")
  b64val[string.char(numeral+i)] = i + 52
end
b64val["+"] = 62
b64val["/"] = 63
b64val["="] = 0

local encoded = b64:gsub("(.)(.)(.)(.)",function(a,b,c,d)
  local n = b64val[a] * (64 * 64 * 64) + b64val[b] * (64 * 64) + b64val[c] * 64 + b64val[d]
  local b1 = n % 256; n = (n - b1) / 256
  local b2 = n % 256; n = (n - b2) / 256
  local b3 = n
  if d == "=" then
    if c == "=" then
      assert(b1 == 0 and b2 == 0)
      return string.char(b3)
    else
      assert(b1 == 0)
      return string.char(b3, b2)
    end
  else
    return string.char(b3, b2, b1)
  end
end)

-- decode
local decoded = encoded:gsub("()(.)", function(i, c)
  local b = c:byte()
  local ki = ((i - 1) % #key) + 1
  local k = key:byte(ki,ki)
  b = b - k
  if b < 0 then b = b + 256 end
  return string.char(b)
end)

-- verify
local result, err = load(decoded)
if not result then
  error("Decoded file could not be loaded -- it may be corrupt... ("..tostring(err)..")")
end

-- output
local outfile = io.open(outfilename, "wb")

if not outfile then
  error("Failed to open output file.")
end

outfile:write(decoded)

outfile:close()
  • Wish I could talk to Extreme Coders irl :) – loveroflua Sep 14 '15 at 17:46
  • Thank you , they moved on to ssl 3.0 right ? – Saeed A Suleiman Nov 21 '15 at 13:25
  • yep its easy also – loveroflua Dec 3 '15 at 22:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.