Monitor connections or decrypt exe

punkstar69 · Jun 30, 2016

We are using a tomcart.exe that our web designers have sent us in order to connect to our website's database and be able to alter products etc.

In our computers, we have set an odbc database and filled all necessary details ( ip port username etc ) but not a password. When tomcart.exe opens, it ''fills'' the password there, making the connection successful.

I was wondering if we could find this password somehow, either by monitoring active odbc connections, either by 'keylogging' method (is it a key logging actually?), either by decoding this exe.
We tried to go the ethical way with our web design company, however, the designer who included the password there gone AWOL, causing this password not able to be recovered.

Please advise.

RightFootFanatic · Jun 30, 2016

You could try and analyze the traffic during the connection with a tool like Wireshark (https://www.wireshark.org/).
If the password is send in plain text / unencrypted you should be able to fish it out the traffic.

Also check if the tool creates a folder under appdata. To open Appdata folder on Windows: Click Start button -> run -> %appdata% -> return
Check in the new Explorer window if there's a folder with a name related to the tool. If so check files in folder if something contains a password.

// edit
If you're managing the database server, you should be able to change that passwort. At least the company should be able to do that...

punkstar69 · Jun 30, 2016

Unfortunately it doesnt create anything in Appdata, nor WireShark can sniff its pwd..
Also, user cannot change the password, we tried so. Any other ways of capturing?

b1acky · Jun 30, 2016

You can often reverse engineer software using disassemblers and decompilers tho this usually requires really good programming knowledge (since the code is not even remotely as readable as the original source code). Keylogging wont work since the pass is most likely hardcoded in the exe file. There is also chance that the app you are using is just accessing your database so you should be able to reset your db password at your hosting provider (bear in mind that resetting password will most likely prevent your exe file from working as the passwords wont match anymore).

Gogol · Jun 30, 2016

You have a few options.
Easiest would be to sniff the packets using either fiddler or wireshark. I have found out that fiddler is better when listening to a particular software on your machine. It can bind to a certain app if needed. You could also connect through fiddler proxy server and see what is happening in the log.

The main problem with this conecpt however would be when the connection is secure. You will need to find another solution if the connection uses https, as you won't be able to install a fake certificate in the software itself.

Debugging an app can be a PITA if you are new to it. May be try running it through ollydbg and search for referenced strings. If you are lucky, you will get your stuff in there.

punkstar69 · Jun 30, 2016

Gogol said:
You have a few options.
Easiest would be to sniff the packets using either fiddler or wireshark. I have found out that fiddler is better when listening to a particular software on your machine. It can bind to a certain app if needed. You could also connect through fiddler proxy server and see what is happening in the log.

The main problem with this conecpt however would be when the connection is secure. You will need to find another solution if the connection uses https, as you won't be able to install a fake certificate in the software itself.

Debugging an app can be a PITA if you are new to it. May be try running it through ollydbg and search for referenced strings. If you are lucky, you will get your stuff in there.

I did so. Also had packets sniffed with wireshark, but no luck at all.
Im assuming the password is obstr, encoded etc

Gogol · Jun 30, 2016

punkstar69 said:
I did so. Also had packets sniffed with wireshark, but no luck at all.
Im assuming the password is obstr, encoded etc

Try using fiddler proxy. That has to work.

tutorial : https://blogs.esri.com/esri/support...pture-web-traffic-from-an-iphone-ipad-device/

punkstar69 · Jun 30, 2016

Gogol said:
Try using fiddler proxy. That has to work.

tutorial : https://blogs.esri.com/esri/support...pture-web-traffic-from-an-iphone-ipad-device/

I need to capture TCP, not http requests since the method this app works, is TCP requests.

Gogol · Jun 30, 2016

punkstar69 said:
I need to capture TCP, not http requests since the method this app works, is TCP requests.

ahh then your only option would be wireshark sorry.

DId you try ollydbg -> search -> all referenced strings?

punkstar69 · Jun 30, 2016

Gogol said:
ahh then your only option would be wireshark sorry.

DId you try ollydbg -> search -> all referenced strings?

Just did. Unfortunately, nothing.

Gogol · Jun 30, 2016

punkstar69 said:
Just did. Unfortunately, nothing.

if you pm me with the program I can have a look for free

punkstar69 · Jun 30, 2016

Gogol said:
if you pm me with the program I can have a look for free

Lots of thanks in advance. Just pmed ya.

Kabone · Jun 30, 2016

What about IDA Pro? I may also be able to help if you need it

punkstar69 · Jun 30, 2016

Kabone said:
What about IDA Pro? I may also be able to help if you need it

I had a close friend of mine test IDA pro with no luck.

Kabone · Jun 30, 2016

Ahh okay well if Gogol can't help shoot me a msg. I am confident I can get in.

TheVegan · Jun 30, 2016

punkstar69 said:
We are using a tomcart.exe that our web designers have sent us

I'm not sure what this tomcart.exe is, but anyway if you got it from the designers (which is weird, seems like a developer thing?) but anyway, they should be able to give you the source of the .exe file there you can find any hard-coded values.. If not that could be suspicious if they don't want to show you the source...

Kabone · Jun 30, 2016

TheVegan said:
I'm not sure what this tomcart.exe is, but anyway if you got it from the designers (which is weird, seems like a developer thing?) but anyway, they should be able to give you the source of the .exe file there you can find any hard-coded values.. If not that could be suspicious if they don't want to show you the source...

Did you see that they have went AWOL, hence why he can't get in..

punkstar69 · Jun 30, 2016

Kabone said:
Did you see that they have went AWOL, hence why he can't get in..

Exactly. Such an unprofessional move.. Anyway.
The good thing is that we can still work on the database via this tool.
The bad thing is that we have limited access. We cannot change passwords etc.

Thanks for your will Kabone. I've already pmed Gogol & 've been crossing my fingers hehe. Will let you know.

CakeLord · Jul 3, 2016

sometime it can be as simple as dumping the memory after the program has performed it's actions and inspecting it with something like HxD, in any case if it's just entering the password then you could post it here and hope someone takes a look at it.

Monitor connections or decrypt exe

Regular Member

Regular Member

Regular Member

Newbie

Administrator

Regular Member

Administrator

Regular Member

Administrator

Regular Member

Administrator

Regular Member

BANNED

Regular Member

BANNED

Junior Member

BANNED

Regular Member

Newbie

Main Menu

Marketplace

Making Money

BlackHat World