0

So, there is a PLC and a SoftMaster program to work with it. The PLC works according to the XGFenet protocol. When connecting to the PLC for the first time in SoftMaster, a password must be entered. And I caught this whole process using Wireshark.

At the very beginning, we send a message like this to the PLC:

enter image description here

where 41 44 is a request for a specific session key.

With the next package we get:

enter image description here

The PLC sent us a set of bytes. It is these bytes that are causing this question. More details further.

We enter the password qwerty and it will be converted to

enter image description here

Obviously, the bytes sent in the second packet encrypted our password in this form. And after that we get correct password

enter image description here

Question: how did the bytes sent in the second packet encrypt our password to this form?

I experimented and wrote a script to request this session key multiple times. All the bytes sent differed by about 1000 units, respectively, something like a time or a countdown is sent to us and the password is encrypted based on it.

If you do not know the answer, advise what other experiments can be done to understand what it is or in what direction to study. Thank you.

UPD

The password length is limited by SoftMaster and you cannot enter more than 8 characters. But, even if the password consists of one character, the encrypted password does not differ in length from eight characters. Similar to hashing.

Here are some examples:

Password A

enter image description here

Password AA

enter image description here

Password AAA

enter image description here

And here is the same password qwerty entered with a difference of a couple of seconds

enter image description here enter image description here

But there is nothing strange here. Before each entry, a new session key is requested and these two identical passwords are encrypted with different keys.

Using ProcessMonitor, I checked the services that are called during password entry and validation. Maybe there's a hint here

enter image description here

4
  • I think you need to poke around in the SoftMaster tool. the bytes sent look like a key thats used to encrypt the password with and the algorithm used sits somewhere in the software.
    – masterX244
    May 6 at 13:41
  • @masterX244 Thanks, I had the same thought. i will check that May 6 at 13:45
  • Can you provide some more (password, encrypted password) tuples? Also does the data length change if you change password length. Try A, AA, AAA, AAAA... etc and share those ? What happens if the password is same but sent at different times?
    – sudhackar
    May 6 at 14:14
  • @sudhackar updated my question May 11 at 9:00

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.