Jump to content

Recommended Posts

Hi all,

I am working on a GUI program to update Google's Dynamic DNS (API at https://support.google.com/domains/answer/6147083?authuser=1&hl=en if you scroll to bottom). I am not a programmer by any means - just a sysadmin who has picked up on some things along the way. I am sure that there's better ways to do a lot of things in this script; I'm just going with what I know.

My challenge right now is that I'd like a better way to store the credentials both in memory as well as in system registry or INI file (not sure which way I want to go for local storage). How should I convert the passwords to a secure string in a manner that can't be easily reversed, yet is still accessible to the script? Is that even an option in AutoIt?

Can anybody provide me with links to good reference posts, or coding suggestions for how best to achieve this in the script below? I am using the WinHTTP UDF (https://github.com/dragana-r/autoit-winhttp/releases) to make my API calls.

#include<WinHTTP.au3>
#include<GUIConstantsEx.au3>
#include<EditConstants.au3>
#include<iNet.au3>
#include<Array.au3>

DIM $aDomainList[1][4]
$aDomainList[0][0] = 0

$gMainGUI = GUICreate("Overkill's Google DNS Updater",800,800)

    $gDomainLabel = GUICtrlCreateLabel("FQDN",21,8)
    $gDomainInput = GUICtrlCreateInput("",60,5,300)

    $gUserLabel = GUICtrlCreateLabel("Username",5,36)
    $gUserInput = GUICtrlCreateInput("",60,32,130,Default,BitOR($GUI_SS_DEFAULT_INPUT,$ES_PASSWORD))

    $gPasswordLabel = GUICtrlCreateLabel("Password",6,64)
    $gPassInput = GUICtrlCreateInput("",60,60,130,Default,BitOR($GUI_SS_DEFAULT_INPUT,$ES_PASSWORD))

    $gAddButton = GUICtrlCreateButton("ADD DOMAIN",200,31,160,52)

    $gCurrentIP = GUICtrlCreateLabel("Current IP: " & _CheckIP(),5,780)

    $gDomainList = GUICtrlCreateListView("Domain | Resolved IP | Update Status",5,120,600,600)


GUISetState(@SW_SHOW,$gMainGUI)

while 1

    $m = GUIGetMsg()
    IF $M = $GUI_EVENT_CLOSE then Exit

    IF $M = $gAddButton Then
        $sAddDomain = GUICtrlRead($gDomainInput)
        $sAddUser = GUICtrlRead($gUserInput)
        $sAddPass = GUICtrlRead($gPassInput)
        $sResolveIP = _DNSCheck($sAddDomain)

        ;Google wants you to avoid sending updates when there are no changes
        If StringCompare($sResolveIP,_CheckIP()) = 0 Then
            $sStatus = "No change, not sending update"
        Else
            $sStatus = _DNSUpdate($sAddDomain,$sAddUser,$sAddPass)
        EndIf

        ;Check to make sure all fields are completed before continuing
        IF StringLen($sAddDomain) = 0 OR StringLen($sAddUser) = 0 OR StringLen($sAddPass) = 0 Then

            MsgBox(0,"","Please complete all fields")

        Else ; If the fields all have data, then continue

            ;Check to see if the entry exists in the array already
            $iSanity = _ArraySearch($aDomainList,$sAddDomain)

            IF $iSanity = 0 Then
                _ArrayAdd($aDomainList,$sAddDomain & "|" & $sAddUser & "|" & $sAddPass )
                    If @error = 0 Then
                        $aDomainList[0][0] += 1
                        $aDomainList[$aDomainList[0][0]][3] = GUICtrlCreateListViewItem($sAddDomain & "|" & $sResolveIP & "|" & $sStatus,$gDomainList)
                    Else
                        MsgBox(0,"","Error adding input to list")
                    EndIf
            Else ; If $iSanity <> 0
                    ; Update existing info in array and listviewitem
                    $aDomainList[$iSanity][0] = $sAddDomain
                    $aDomainList[$iSanity][1] = $sAddUser
                    $aDomainList[$iSanity][2] = $sAddPass
                    GUICtrlSetData($aDomainList[$iSanity][3],$sAddDomain & "|" & $sResolveIP & "|" & $sStatus)
            EndIf ; If $iSanity = 0

        EndIf ; If StringLen...


    EndIf ; If $m = $gaddbutton


WEnd

;----------------------------------------------------------------------------------------

Func _DNSCheck($sFQDN)
    $sJSON = _INetGetSource("https://dns.google.com/resolve?name=" & $sFQDN & "&cd=1")
    ConsoleWrite($sJSON & @CRLF)
    $sIPAddress = StringRegExpReplace($sJSON,'^.*data": "(.*?)".*?$',"\1")
    Return $sIPAddress
EndFunc

;----------------------------------------------------------------------------------------

Func _DNSUpdate($sFQDN,$sUser,$sPass)

    Local $sGoogleAPIURI = "https://domains.google.com"

    Local $hOpen = _WinHttpOpen()
    Local $hConnect = _WinHttpConnect($hOpen, $sGoogleAPIURI)
    Local $sHeader = _
        'Authorization: Basic ' & _Base64Encode($sUser & ":" & $sPass) & @CRLF & _
        'Accept: */*' & @CRLF & _
        'User-Agent: AutoITScript/' & @AutoItVersion & @CRLF & _
        'Content-Type: application/x-www-form-urlencoded'
    Local $aHTTPResponse = _WinHttpSimpleSSLRequest($hConnect, "POST", "/nic/update", Default, "hostname=" & $sFQDN, $sHeader, True, Default, Default, Default, True)

    _WinHttpCloseHandle($hConnect)
    _WinHttpCloseHandle($hOpen)

    If IsArray($aHTTPResponse) Then
        $sHTTPResponse = "Header:" & @CRLF & $aHTTPResponse[0] & @CRLF & "Data:" & @CRLF & $aHTTPResponse[1] & @CRLF & @CRLF & @CRLF
        Return $aHTTPResponse[1]
    Else
        $sHTTPResponse = "NO REPLY"
        Return "No reply from " & $sGoogleAPIURI
    EndIf

EndFunc

;----------------------------------------------------------------------------------------

Func _Base64Encode($sData)
    Local $oXml = ObjCreate("Msxml2.DOMDocument")
    If Not IsObj($oXml) Then
        SetError(1, 1, 0)
    EndIf

    Local $oElement = $oXml.createElement("b64")
    If Not IsObj($oElement) Then
        SetError(2, 2, 0)
    EndIf

    $oElement.dataType = "bin.base64"
    $oElement.nodeTypedValue = Binary($sData)
    Local $sReturn = $oElement.Text

    If StringLen($sReturn) = 0 Then
        SetError(3, 3, 0)
    EndIf

    Return $sReturn
EndFunc

;----------------------------------------------------------------------------------------

Func _CheckIP()
    Return _INetGetSource("https://domains.google.com/checkip")
EndFunc

;----------------------------------------------------------------------------------------

 

Share this post


Link to post
Share on other sites

Running back into this issue for a different script...same concept though. Anybody have input on this? Should I be looking at a full programming language that I can compile in instead?

Share this post


Link to post
Share on other sites

@Overkill unfortunately this has been asked and answered dozens if not hundreds of times on the forum. You are sadly never going to get 100% obfuscation/encryption/etc. from an AutoIt script; any determined person can either decompile the code or pull the contents out of memory fairly easily. If you need 100% security, you are going to have to go with a different language.

That said: if you accept a certain degree of risk, there are a number of threads in which people have talked about different methods they have employed - from storing in an encrypted file and including the file in the script to trying to link up to a remote server for authentication. You can do a forum search and come across these discussions pretty easily; it all boils down to the level of risk you are willing to accept.

Edit: On a Mod note, we typically lock threads that go around and around the subject of obfuscating or encrypting passwords, for the very reason I give above. I am happy at the moment to leave this topic open if others would like to offer suggestions on what they have done. If, however, the Moderation team senses the release of the Oozlum bird, the topic will die quickly.

Edited by JLogan3o13

"Profanity is the last vestige of the feeble mind. For the man who cannot express himself forcibly through intellect must do so through shock and awe" - Spencer W. Kimball

How to get your question answered on this forum!

Share this post


Link to post
Share on other sites

In theory you could save the password encrypted, then you program asks for the passcode at startup and the credentials are de-encrypted and used.


Spoiler

Renamer - Rename files and folders, remove portions of text from the filename etc.

GPO Tool - Export/Import Group policy settings.

MirrorDir - Synchronize/Backup/Mirror Folders

BeatsPlayer - Music player.

Params Tool - Right click an exe to see it's parameters or execute them.

String Trigger - Triggers pasting text or applications or internet links on specific strings.

Inconspicuous - Hide files in plain sight, not fully encrypted.

Regedit Control - Registry browsing history, quickly jump into any saved key.

Time4Shutdown - Write the time for shutdown in minutes.

Power Profiles Tool - Set a profile as active, delete, duplicate, export and import.

Finished Task Shutdown - Shuts down pc when specified window/Wndl/process closes.

NetworkSpeedShutdown - Shuts down pc if download speed goes under "X" Kb/s.

IUIAutomation - Topic with framework and examples

Au3Record.exe

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now

  • Similar Content

    • By Stormgrade
      Hello.
      I'm french, sorry for my english.
      I release my project, a password manager : Password Keeper
      First I would like to thanks Guinness and Melba23 for their help, and I'm very sorry for those I forget, please remind me to add you.
      Well my program manage and crypt passwords, first I understand if you don't trust me for this kind of sensible software, but I remember you that all the the source files are at your disposal, fell free to explore them.
      The login is : admin and you can change it later
      How it work ? see Methode de cryptage en BDD.pdf in french
      login

       
      The main interface
      You can obviously add,modify and delete your entry, also you can search with keywords

      A password generator is included

      I won't update it anymore.
      It's a BSD license.
      Autoit version : 3.3.14.5
      Have a good day.
      Methode de cryptage en BDD.pdf Passwordkeeper.7z
    • By TheXman
      Encryption / Decryption / Hashing
      Purpose
      Cryptography API: Next Generation (CNG) is Microsoft's long-term replacement for their CryptoAPI.  CNG is designed to be extensible at many levels and cryptography agnostic in behavior.  Although the Crypt.au3 UDF that is installed with AutoIt3 still works perfectly, the advapi32.dll functions that it uses have been deprecated.  This UDF was created to offer a replacement for the deprecated functions.  According to Microsoft, deprecated functions may be removed in future release.  Therefore, this UDF will be available when/if that happens.
      Description
      This UDF implements some of Microsoft's Cryptography API: Next Generation (CNG) Win32 API functions.  In its initial release, it implements functions to encrypt text & files, decrypt text and files, generate hashes, and the Password-Based Key Derivation Function 2 (PBKDF2) function.  The UDF can implement any the encryption/decryption algorithms or hashing algorithms that are installed on the PC in which it is running.  Most, if not all, of the values that you would commonly use to specify that desired algorithms, key bit lengths, and other magic number type values, are already defined as constants or enums in the UDF file.
      To flatten the learning curve, there is an example file that shows examples of all of the major functionality.  This example file is not created to be an exhaustive set of how to implement each feature and parameter.  It is designed to give you a template or guide to help you hit the ground running in terms of using the functions.  I have tried to fully document the headers of all of the functions as well as the code within the functions themselves.
      The UDF currently has all of the same functionality as the Crypt.au3 except for the random number generation function.  I left that out of the initial version because the functionality already exists in the Crypt.au3 UDF as well as the Random() function in AutoIt3 itself.
      Current UDF Functions
      _CryptoNG_DecryptData($sAlgorithmId, $xData, $vEncryptionKey, $sProvider = "Microsoft Primitve Provider") _CryptoNG_DecryptFile($sAlgorithmId, $sInputFile, $sOutputFile, $vEncryptionKey, $sProvider = "Microsoft Primitve Provider") _CryptoNG_EncryptData($sAlgorithmId, $sText, $vEncryptionKey, $sProvider = "Microsoft Primitve Provider") _CryptoNG_EncryptFile($sAlgorithmId, $sInputFile, $sOutputFile, $vEncryptionKe, $sProvider = "Microsoft Primitve Provider") _CryptoNG_EnumAlgorithms($iAlgorithmOperations) _CryptoNG_EnumRegisteredProviders() _CryptoNG_HashData($sAlgorithmId, $vData, $bHMAC = False, $vHMACSecret = "", $sProvider = "Microsoft Primitve Provider") _CryptoNG_HashFile($sAlgorithmId, $sFilePath, $bHMAC = False, $vHMACSecret = "", $sProvider = "Microsoft Primitve Provider") _CryptoNG_LastErrorMessage() _CryptoNG_PBKDF2($sPassword, $vSalt, $iIterations, $iDKeyBitLength, $sHashAlgorithmId = $CNG_BCRYPT_SHA1_ALGORITHM, $sProvider = "Microsoft Primitve Provider")  
       
      Related Links
      Cryptography API: Next Generation - Main Page
      Cryptography API: Next Generation - Reference
      Cryptography API: Next Generation - Primitives
      Cryptography API: Next Generation - Cryptographic Algorithm Providers
    • By Radix
      Hi.

      I would like to know if it is possible to implement an autoit script with GOST algorithm. I noticed that there are seven different algorithms in the standard UDF, but I urgently need a command line crypter with GOST algorithm. I just lack the algorithm part. Is it possible to adapt GPLib in the autoit script?

      http://www.delphipages.com/comp/gplib-14771.html

      Thx.
    • By RTFC
      CodeCrypter enables you to encrypt scripts without placing the key inside the script.
      This is because this key is extracted from the user environment at runtime by, for example:
      password user query any macro (e.g., @username) any AutoIt function call any UDF call some permanent environment variable on a specific machine (and not created by your script) a server response a device response anything else you can think of, as long as it's not stored in the script any combination of the above You need several scripts to get this to work, and they are scattered over several threads, so here's a single bundle that contains them all (including a patched version of Ward's AES.au3; with many thanks to Ward for allowing me to include this script here):
      Latest version: 2.4, (10 July 2019): CodeScannerCrypter.bundle.v2.4.7z
      Note: if you experience issues under Win8/8.1 (as some users have reported), please upgrade to Win10 (or use Win7) if you can; as far as I can tell, the scripts in the bundle all work under Win7 & Win10 (and XP). Moreover, I have no access to a Win8 box, so these issues will not be fixed, at least not by yours truly.
       
      How the bits and pieces fit together:
      CodeCrypter is a front-end for the MCF UDF library (you need version 1.3 or later). Its thread is here:
      '?do=embed' frameborder='0' data-embedContent>>
      The MCF package (also contained in the CodeScannerCrypter bundle) contains MCF.au3 (the library itself) plus a little include file called MCFinclude.au3. The latter you have to include in any script you wish to encrypt. Any code preceding it will not be encrypted, any code following it will be encrypted. You define the dynamic key inside MCFinclude.au3, in the UDF: _MCFCC_Init().
      From the same post you can download an MCF Tutorial which I heartily recommend, because encrypting a script requires a number of steps in the right order, namely:
      In MCFinclude.au3, define and/or choose your dynamic key(s) (skip this step = use default setting) include MCFinclude.au3 in your target script Run CodeScanner (version 2.3+) on your target script, with setting WriteMetaCode=True (see '?do=embed' frameborder='0' data-embedContent>>), then close CodeScanner. Start CodeCrypter press the Source button to load your target file enable Write MCF0 (tick the first option in Main Settings) Enable "Encrypt" (last option in the Main Settings) Go to the Tab Encrypt and set up the encryption the way you want (skip this = use default settings) Return to Main Tab and press "Run" if all goes well, a new script called MCF0test.au3 is created in the same directory as your target. It has no includes and no redundant parts. Please check that it works as normal. (see Remarks if not) It all sounds far more complicated than it is, really.
      Not convinced? Check out this updated and extended Q & A pdf (FAQ, also included in the bundle) to help you get started:
      CodeCrypterFAQ.pdf
       
      For additional explanations/examples in response to specific questions by forum members (how it works, what it can/cannot do), see elsewhere in this thread, notably:
      Simple analogy of how it works: post #53, second part General Explanation and HowTo: post #9, 51, 75, 185/187, 196, 207, 270, 280 (this gets a bit repetitive) BackTranslation: post #179 Obfuscation: post #36 (general), 49 (selective obfuscation) Specific features and fixes: post #3 (security), 84 (redefining the expected runtime response), 169 (Curl Enum fix), 185/187 (using license keys), 194 (replacing Ward's AES UDF with different encryption/decryption calls), 251 (AV detection issue), 262 (extract key contents to USB on different target machine prior to encryption) Limitations: post #26 (@error/@extended), 149 (FileInstall), 191 (AES.au3 on x64) Not recommended: post #46/249 (static encryption), 102 (programme logic error), 237 (parsing password via cmdline)  
      Technical notes:
      BackTranslation is a test to check that the MetaCode translation worked. Skip it at your peril. It also turns your multi-include composite script into a single portable file without redundant parts (you can opt to leave the redundant parts in, if you want).
      CodeCrypter can also obfuscate (vars and UDF names) and replace strings, variable names and UDF names with anything else you provide, for  example, for language translation). After CodeScanner separates your target's structure from its contents, CodeCrypter (actually MCF, under the hood) can change any part, and then generate a new script from whichever pieces you define. See the MCF Tutorial for more explanation and examples.
      Encryption currently relies on Ward excellent AES UDF, but you can replace this with any other algorithm you like; just edit MCFinclude.au3 UDF _MCFCC(), and MCF.au3 UDF _EncryptEntry(), see post #194 in this thread.
      AES.au3, by Ward is now also included in bundle (with thanks to Ward), see '?do=embed' frameborder='0' data-embedContent>>
      Going to lie down now...
      RT
      CodeCrypterFAQ.pdf
    • By RTFC
      MetaCode offers a way to:
      separate a script's structure from its content remove all redundant definitions (globals and UDFs) change any content (and some structure) combine (new) structure and (new) content into a new script The most useful applications implemented so far are:
      Fast language translation (not just text strings, also variable names and UDF names) Obfuscation (vars and/or UDFs) Script Encryption (conditionals, calls, and macros) Encryption is powerful because the key is not stored anywhere; you can define it to be a user password, macro, environment spec/variable, server response, something you define yourself, or a combination thereof; anything goes, as long as it's not a fixed string or fixed value. More info in the CodeCrypter thread: ?do=embed' frameborder='0' data-embedContent>'?do=embed' frameborder='0' data-embedContent>>
      ?do=embed' frameborder='0' data-embedContent>
      But MetaCode has more potential than that; it allows you to tinker with any type of content separately, then rebuild a new version. So for example, you can have a single script structure and numerous different language modules you just plug in to create a new version in a different language.
      A brief Tutorial is here:
      MetaCode Tutorial.pdf
      The MCF library itself can be found in the CodeScannerCrypter bundle: CodeScannerCrypter.bundle.v2.4.7z
       
       
      And a little example how to use it for translating your GUI into a different language:
       UI_Translator.7z (new version that should work with the new version of Google Translate, see post #13 below)
       
       
      MCF.au3 is just the library plus the MCFinclude.au3 file you need to include in any script you wish to encrypt.
      There is no GUI here. However, I did write a separate front-end for it called CodeCrypter, which you can find here:
      ?do=embed' frameborder='0' data-embedContent>'?do=embed' frameborder='0' data-embedContent>>
      ?do=embed' frameborder='0' data-embedContent>
      MCF uses output generated by my CodeScanner version 2.8+, which you can find here:
      '?do=embed' frameborder='0' data-embedContent>>
      CodeScanner also depends on MCF.au3 now, as it can now call a few of its functions.
      I should also mention Ward's excellent AES.au3 UDFs used for the encryption and decryption calls,  which is now included in the CodeScannerCrypter bundle (thanks to Ward for allowing to include it). You can find the original (unpatched) version here:
      '?do=embed' frameborder='0' data-embedContent>>
      Note: you can replace the encryption/decryption calls with whatever algorithm you like (hint: the native <Crypt.au3> library is too slow for most purposes, better stick to machine code routines)
      So just to be clear:
      CodeScanner (v2.8+) needs MCF (earlier versions won't work!) CodeCrypter needs MCF (plus anything that MCF needs) MCF itself needs MCFinclude (part of MCF zip) MCF also needs readCSdatadump (part of the CodeScanner package, you need the latest version packaged with CodeScanner v2.8; earlier versions won't work!) both MCF and MCFinclude currently rely on AES.au3 by Ward So you basically need to download the whole bundle for any of it to work.
       
      If you have any questions, please start by reading the MCF Tutorial and the CodeCrypter FAQ (you can download the latter separately from the CodeCrypter thread).
      Next, read the extensive Remarks sections in MCF.au3, MCFinclude.au3, and CodeCrypter.au3
      If still no joy, then please post. However, I'm not online that often, and logged in to the forum even less, so response may take a while).
      RT
×
×
  • Create New...