Cyberarmy – Sered Safe Lock

To beat the Safe @http://www.cyberarmy.net/sered/sered2/safe

You need to look at the source code and notice the java file is exposed.

<P><BR>
<center>
<applet code="net.cyberarmy.sered.SafeLockApplet.class" archive="/includes/sered/safelock2.jar" width=256 height=96>
<param name=background value="http://www.cyberarmy.net/includes/sered/background.jpg">
<param name=checksum value="efb5d7a5db4ff3e9f2882ebae41042b382c59073">
<param name=digits value="http://www.cyberarmy.net/includes/sered/digits.jpg">
<param name=url_base value="http://www.cyberarmy.net/sered/sered2/safe/">
<param name=click value="http://www.cyberarmy.net/includes/sered/click.au">
<./applet>
<./center>

Hence the .jar file is located on the servers here
http://www.cyberarmy.net/includes/sered/safelock2.jar

Download the Jar file and then rename the extension to .zip

This will allow you to see the directories of the jar file and let you extract them.

So go ahead and extract those with winrar and then use a

Then we will probably need to decompile the class file! So lets do it!

Continued August 2nd 2008

Ok so go download http://www.bysoft.se/sureshot/cavaj/index.html

Cavaj Java Decompiler V1.11

When you are done with that .. throw both class files into it.

package net.cyberarmy.sered;

import java.applet.AppletContext;
import java.applet.AudioClip;
import java.awt.*;
import java.awt.event.MouseAdapter;
import java.awt.event.MouseEvent;
import java.net.MalformedURLException;
import java.net.URL;
import java.security.MessageDigest;
import java.security.NoSuchAlgorithmException;
import javax.swing.JApplet;
import javax.swing.JRootPane;

public class SafeLockApplet extends JApplet
{

private final int NUM_BARRELS = 6;
private Image digits;
private Image bg;
private int barrel_values[];
private int offsets[];
private String checksum;
private String url_base;
private AudioClip ac;

public SafeLockApplet()
throws HeadlessException
{
}

public void init()
{
String digits_url = getParameter(“digits”);
String background_url = getParameter(“background”);
String click_url = getParameter(“click”);
checksum = getParameter(“checksum”);
url_base = getParameter(“url_base”);
if(digits_url == null)
{
throw new RuntimeException(“digits image not specified”);
}
if(background_url == null)
{
throw new RuntimeException(“background image not specified”);
}
if(click_url == null)
{
throw new RuntimeException(“click sound not specified”);
}
if(checksum == null)
{
throw new RuntimeException(“checksum not specified”);
}
if(url_base == null)
{
throw new RuntimeException(“url_base not specified”);
}
try
{
digits = getToolkit().getImage(new URL(digits_url));
}
catch(MalformedURLException mue)
{
throw new RuntimeException(“malformed digits url”);
}
prepareImage(digits, null);
barrel_values = new int[6];
offsets = new int[6];
for(int i = 0; i < 6; i++)
{
barrel_values[i] = 0;
offsets[i] = (int)(Math.random() * 5D – 2D);
}

try
{
bg = getToolkit().getImage(new URL(background_url));
}
catch(MalformedURLException mue)
{
throw new RuntimeException(“malformed background url”);
}
prepareImage(bg, null);
try
{
ac = JApplet.newAudioClip(new URL(click_url));
}
catch(MalformedURLException e)
{
throw new RuntimeException(“click URL malformed”);
}
}

public void paint(Graphics g)
{
while((checkImage(bg, null) & 0x20) != 32) ;
getRootPane().getContentPane().getGraphics().drawImage(bg, 0, 0, null);
while((checkImage(digits, null) & 0x20) != 32) ;
for(int i = 0; i < 6; i++)
{
getRootPane().getContentPane().getGraphics().drawImage(digits, 34 * i + 28, 25 + offsets[i], 32 + 34 * i + 28, 72 + offsets[i], barrel_values[i] * 32, 0, 32 + barrel_values[i] * 32, 47, null);
}

}

public void start()
{
getRootPane().addMouseListener(new MouseAdapter() {

public void mouseClicked(MouseEvent e)
{
handleClick(e.getX(), e.getY());
}

});
repaint();
}

public void handleClick(int x, int y)
{
int barrel = -1;
if(y >= 12 && y <= 22)
{
if(x >= 33 && x <= 52)
{
barrel = 0;
} else
if(x >= 67 && x <= 86)
{
barrel = 1;
} else
if(x >= 101 && x <= 121)
{
barrel = 2;
} else
if(x >= 136 && x <= 154)
{
barrel = 3;
} else
if(x >= 170 && x <= 190)
{
barrel = 4;
} else
if(x >= 204 && x <= 222)
{
barrel = 5;
}
if(barrel != -1)
{
barrel_values[barrel] = (barrel_values[barrel] + 1) % 10;
}
} else
if(y >= 75 && y <= 83)
{
if(x >= 33 && x <= 52)
{
barrel = 0;
} else
if(x >= 67 && x <= 86)
{
barrel = 1;
} else
if(x >= 101 && x <= 121)
{
barrel = 2;
} else
if(x >= 136 && x <= 154)
{
barrel = 3;
} else
if(x >= 170 && x <= 190)
{
barrel = 4;
} else
if(x >= 204 && x <= 222)
{
barrel = 5;
}
if(barrel != -1)
{
barrel_values[barrel] = (barrel_values[barrel] + 9) % 10;
}
}
if(barrel != -1)
{
ac.play();
offsets[barrel] = (int)(Math.random() * 5D – 2D);
repaint();
if(getChecksumWithPrefix(“LOCKED”).equals(checksum))
{
try
{
getAppletContext().showDocument(new URL(url_base + getChecksumWithPrefix(“OPEN”)));
}
catch(MalformedURLException e)
{
throw new RuntimeException(“could not access ” + url_base + getChecksumWithPrefix(“OPEN”));
}
}
}
}

private String getChecksumWithPrefix(String prefix)
{
MessageDigest md;
try
{
md = MessageDigest.getInstance(“SHA-1”);
}
catch(NoSuchAlgorithmException e)
{
throw new RuntimeException(“Could not find SHA-1 algorithm”);
}
md.update(prefix.getBytes());
for(int i = 0; i < 6; i++)
{
md.update((byte)(barrel_values[i] + 48));
}

byte b[] = md.digest();
StringBuffer hexString = new StringBuffer();
for(int i = 0; i < b.length; i++)
{
String o = Integer.toHexString(0xff & b[i]);
if(o.length() < 2)
{
o = “0” + o;
}
hexString.append(o);
}

String h = hexString.toString();
return hexString.toString();
}
}

Sexy right

2nd class file

package net.cyberarmy.sered;

import java.awt.event.MouseAdapter;
import java.awt.event.MouseEvent;

// Referenced classes of package net.cyberarmy.sered:
//            SafeLockApplet

private final class  extends MouseAdapter
{

public void mouseClicked(MouseEvent e)
{
handleClick(e.getX(), e.getY());
}

()
{
}
}