0

I have a broken installation of Metalogix Archive Manager (MAM). Sometimes, I need to go and retrieve attachments that this has archived when it was previously working.

The original attachment name can be anything.pdf. The attachment name for an archived PDF looks like this - 2_000f834l.pdf.zip

The HTTP request for the PDF above - http://mam/exchangePAMWS/GetAttachment.aspx?PARAM=003D05g0mg1g04k0fg1204w09w1404Y0gM1904g0fg0N0480cg0M0380dg0Q0340cM0R03o0cM0Q04o0dg0M0480e01403w0dw0M03k0cw0Q03o0d00T03s0d00M04809w1304Y0jw1904g0fg0Q03c0cg0T03k0d00O03g0800w

I would like to know how I can extract the archived attachment name from that giant string.

I've uploaded the GetAttachment.cs file referenced by the GetAttachment.aspx file, as well as the original DLL it came from.

If anyone is interested, I can send over the DLLs.

Edit

Ok, I've found some things here using Visual Studio interactive mode.

The Decode6Bit function in EncodeUtils.cs is the key. I've ran that function using the PARAM value above -

> var txt = "003D05g0mg1g04k0fg1204w09w1404Y0gM1904g0fg0N0480cg0M0380dg0Q0340cM0R03o0cM0Q04o0dg0M0480e01403w0dw0M03k0cw0Q03o0d00T03s0d00M04809w1304Y0jw1904g0fg0Q03c0cg0T03k0d00O03g0800w";
> Console.WriteLine(Decode6bit(txt))
TYPE=BH&DOCID=1B10254135634F50B8D860524647740B&CONID=43175424

closed as off-topic by perror, Avery3R, Megabeets, usr2564301, julian Jul 7 '18 at 1:55

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions asking for help reverse-engineering a specific system are off-topic unless they demonstrate an understanding of the concepts involved and clearly identify a specific problem." – perror, Avery3R, Megabeets, usr2564301, julian
If this question can be reworded to fit the rules in the help center, please edit the question.

2

Open the Cryptography.dll file in dnSpy. The PARAM value can be decoded with this Decode6bit() function found in EncodeUtilscs:

public static string Decode6bit(string input) {
    string value = input.Substring(0, 4);
    ushort num = Convert.ToUInt16(value, 16);
    int length = input.Length;
    string text = "";
    ushort[] array = new ushort[8];
    for (int i = 4; i < length; i += 8) {
        for (int j = 0; j < 8; j++) {
            char c = input[i + j];
            ushort num2;
            if (c == '>') {
                num2 = 63;
            } else if (c == '<') {
                num2 = 62;
            } else if (c >= 'a') {
                num2 = (ushort)((byte)c - 97 + 10);
            } else if (c >= 'A') {
                num2 = (ushort)((byte)c - 65 + 36);
            } else {
                num2 = (ushort)((byte)c - 48);
            }
            array[j] = num2;
        }
        ushort num3 = (ushort)((int)array[0] << 10 | (int)array[1] << 4 | (array[2] & 60) >> 2);
        ushort num4 = (ushort)((int)(array[2] & 3) << 14 | (int)array[3] << 8 | (int)array[4] << 2 | (array[5] & 48) >> 4);
        ushort num5 = (ushort)((int)(array[5] & 15) << 12 | (int)array[6] << 6 | (int)array[7]);
        text += (char)num3;
        text += (char)num4;
        text += (char)num5;
    }
    if (text.Length > (int)num) {
        text = text.Substring(0, (int)num);
    }
    return text;
}

According to the question:

Input: "003D05g0mg1g04k0fg1204w09w1404Y0gM1904g0fg0N0480cg0M0380dg0Q0340cM0R03o0cM0Q04o0dg0M0480e01403w0dw0M03k0cw0Q03o0d00T03s0d00M04809w1304Y0jw1904g0fg0Q03c0cg0T03k0d00O03g0800w";
Output: "TYPE=BH&DOCID=1B10254135634F50B8D860524647740B&CONID=43175424"

The output string is mapped in server. After encoding/decoding the string, the output is appended to the URL and the required file is downloaded as follows. Open exchangePAMCommon.dll file in dnSpy. The URL is appended in MessageRetrieval.cs:

if (text != null) {
    str = "02BB015A_" + EncodeUtils.EncodeXOR(text2, text);
    requestUriString = protocol + downloadServer + "/exchangePAMWS/GetFile.aspx?" + str;
}
else {
    str = EncodeUtils.Encode6bit(text2);
    requestUriString = protocol + downloadServer + "/exchangePAMWS/GetFile.aspx?PARAM=" + str;
}
httpWebRequest = (HttpWebRequest)WebRequest.Create(requestUriString);

Not the answer you're looking for? Browse other questions tagged or ask your own question.