MSN Chat Authentication 2004

[Tewl]

Packet data for authenticating to msn w/ subscription

Directory Server Data
send: IRCVERS IRC8 MSN-OCX!9.02.0309.2602
send: AUTH GateKeeperPassport I :GKSSP\0^\0\0\0
\0\0\0
recv: AUTH GateKeeperPassport S :GKSSP\0¼\0\0\0\0\0\0\0Àõ”Ž¦r*ô
send: AUTH GateKeeperPassport S :GKSSP\0\0\0\0\0\0\0\0\0Áë븬m§ž=kriÃm\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0
recv: AUTH GateKeeperPassport S :OK
send: AUTH GateKeeperPassport S :0000005A<passportticket>000000C2<passportprofile>
recv: AUTH GateKeeperPassport * 3BB5058E1D79D7F0@GateKeeperPassport 0
send: NICK null
send: PROP $ SUBSCRIBERINFO :<subscriberinfo>
recv: :TK2CHATWBA05 001 null :Welcome to the MSN Chat Service Network
recv: :TK2CHATWBA05 002 null :Your host is TK2CHATWBA05 - running version 9.02.0310.0202
recv: :TK2CHATWBA05 003 null :This server was created Oct 2 2003 at 13:57:43 PDT
recv: :TK2CHATWBA05 004 null :TK2CHATWBA05 9.02.0310.0202 -adghmpswx
recv: :TK2CHATWBA05 375 null :- TK2CHATWBA05 Message of the Day -
recv: :TK2CHATWBA05 372 null :-
recv: :TK2CHATWBA05 372 null :- ** Welcome to the MSN.com Chat Service Network **
recv: :TK2CHATWBA05 372 null :-
recv: :TK2CHATWBA05 376 null :End of /MOTD command
send: CREATE UL %#atestroom test - en-us 1 password 0
recv: :TK2CHATWBA05 613 null :207.68.167.158 6667

Chat Server Data
send: NICK Tewl
send: IRCVERS IRC8 MSN-OCX!9.02.0309.2602 en-us
recv: :TK2CHATCHATA02 800 * 1 0 GateKeeper,NTLM 512 *
send: AUTH GateKeeperPassport I :GKSSP\0]\0\0\0
\0\0\0
recv: AUTH GateKeeperPassport S :GKSSP\0#\0\0\0\0\0\0\0×Þ[ïu
send: AUTH GateKeeperPassport S :GKSSP\0¥q\0\0\0\0\0\0GÅ»Å7Ð*°G!jz¼Ý`\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0
recv: AUTH GateKeeperPassport S :OK
send: AUTH GateKeeperPassport S :0000005A<ticket>000000C2<profile>
recv: AUTH GateKeeperPassport * 3BB5058E1D79D7F0@GateKeeperPassport 0
send: PROP $ MSNREGCOOKIE :<msnregcookie>
send: PROP $ MSNPROFILE :43
send: PROP $ SUBSCRIBERINFO :<subscriberinfo>
recv: :TK2CHATCHATA02 001 Tewl :Welcome to the MSN Chat Service, Tewl
recv: :TK2CHATCHATA02 002 Tewl :Your host is TK2CHATCHATA02, running version 2.106.4
recv: :TK2CHATCHATA02 003 Tewl :This server was created Oct 2 2003 at 13:57:35 PDT
recv: :TK2CHATCHATA02 004 Tewl TK2CHATCHATA02 2.106.4 aioxz abcdefhiklmnoprstuvxyz
recv: :TK2CHATCHATA02 251 Tewl :There are 1512 users and 68 invisible on 1 servers
recv: :TK2CHATCHATA02 252 Tewl 28 :operator(s) online
recv: :TK2CHATCHATA02 254 Tewl 279 :channels formed
recv: :TK2CHATCHATA02 255 Tewl :I have 1512 clients and 0 servers
recv: :TK2CHATCHATA02 265 Tewl :Current local users: 1512 Max: 1864
recv: :TK2CHATCHATA02 266 Tewl :Current global users: 1512 Max: 1864
recv: :TK2CHATCHATA02 422 Tewl :MOTD File is missing
send: JOIN %#atestroom
recv: :TK2CHATCHATA02 818 Tewl Tewl MSNPROFILE :0
recv: :Tewl!3BB5058E1D79D7F0@GateKeeperPassport JOIN H,U,MYB,. :%#atestroom#nosmileys#nosmileys#nosmileys#nosmileys#nosmileys#nosmileys#nosmileys#nosmileys

Heres a vb function for converting the ticket and profile data

Public Function PassForm(strProfile As String, strTicket As String) As String
 On Error Resume Next
 Dim ticketdata As String, profiledata As String
 
 ticketdata = Hex$(Len(strTicket))
 ticketdata = Space(8 - Len(ticketdata)) & ticketdata
 ticketdata = Replace(ticketdata, " ", "0") & strTicket
   
 profiledata = Hex$(Len(strProfile))
 profiledata = Space(8 - Len(profiledata)) & profiledata
 profiledata = Replace(profiledata, " ", "0") & strProfile
 PassForm = ticketdata & profiledata
End Function
#nosmileys#nosmileys#nosmileys

[Tewl]

I wanted to start this thread off fresh so in order to get things started I have decided to also explain the custom guest gatekeeper authentication. Okay let's get started.

As seen about you kno the ocx starts a connection by sending the IRCVERS and an AUTH GateKeeper I

Note that the GKSSP values are random an do not work this is only an example.


AUTH GateKeeper I :GKSSP\0]\0\0\0
\0\0\0


after you send that you will receive as AUTH GateKeeper S


AUTH GateKeeper S :GKSSP\0#\0\0\0\0\0\0\0× Þ[ïu


You will then send that data to the ocx for it to convert and the ocx will return something like this.


AUTH GateKeeper S :GKSSP\0¥q\0\0\0\0\0\0GÅ»Å7Ð*°G!jz¼Ý`\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0


which you will send to the finds to recieve ur gatekeeper

This is where our conversion comes in. First thing you have to understand is that every character represents 2 hex characters. So since a gatekeeper is 32 characters long the last 16 characters of the string that the ocx has returned will set your gatekeeper. Theres an exception to this tho, certain characters like tab, new line, carrage return, ect... cannot be displayed validly so they use escape characters to represent them. Here are the ones that I know of.

\t is tab (hex is: 07)
\n is new line (hex is: 0A)
\r is carrage return (hex is: 0D)
\0 is null (hex is: 00) *
\\ is back slash (hex is: 5C)
\c is comma (hex is: 2C)
\b is space (hex is: 20)

You need to keep track of how many characters u have to take off the end of the AUTH there should be a minimum of 16 and a max of 32 remember to keep count. If you remove a character that is escaped add 2 to count instead of 1. When u have finished remove that many characters from the end of the AUTH string.

What should be left for examplebr]

AUTH GateKeeper S :GKSSP\0¥q\0\0\0\0\0\0GÅ»Å7Ð*°G!jz¼Ý`


Now to use our own gatekeeper we must dehex it but theres one other trick msn has added to the mix msn rearranges the gatekeeper for example

If i want the gatekeeper

B8944C0CDB06DC5FD0F58C09749A44DD

and I didnt rearrange the characters I would get this

0C4C94B806DB5FDCD0F58C09749A44DD

This is pretty simple to remedy just rearrage the characters hers a code example.


Private Function ReArrange(ByVal gkpr As String) As String
 ReArrange = Mid$(gkpr, 7, 2) + Mid$(gkpr, 5, 2) + Mid$(gkpr, 3, 2) + Left$(gkpr, 2) + Mid$(gkpr, 11, 2) + Mid$(gkpr, 9, 2) + Mid$(gkpr, 15, 2) + Mid$(gkpr, 13, 2) + Right$(gkpr, 16)
End Function


Now that you have rearranged the characters you know will dehex that value. Heres a simple dehex function I wrote.


Private Function DeHexGkpr(Data As String) As String
 Dim iCount As Integer, Temp As String
 For iCount = 1 To 33 Step 2
   Temp = Mid$(Data, iCount, 2)
   If Temp = "0A" Then
     DeHexGkpr = DeHexGkpr & "\n"
   ElseIf Temp = "20" Then
     DeHexGkpr = DeHexGkpr & "\b"
   ElseIf Temp = "0D" Then
     DeHexGkpr = DeHexGkpr & "\r"
   ElseIf Temp = "2C" Then
     DeHexGkpr = DeHexGkpr & "\c"
   ElseIf Temp = "5C" Then
     DeHexGkpr = DeHexGkpr & "\\"
   ElseIf Temp = "00" Then
     DeHexGkpr = DeHexGkpr & "\0"
   ElseIf Temp = "07" Then
     DeHexGkpr = DeHexGkpr & "\t"
   Else
     DeHexGkpr = DeHexGkpr & Chr$(Val("&H" & Temp))
   End If
 Next iCount
End Function


Finally we will add the dehex value to the end of the remaining auth string.

The data for this example will now bebr]

AUTH GateKeeper S :GKSSP\0¥q\0\0\0\0\0\0GÅ»Å7Ð*°G!jz¼Ý`L”¸Û_ÜÐõŒ tšDÝ


Send the data to the server now an you should get the gatekeeper you specified. This code works 99.9% of the time if you have trouble post a comment an I'll be glad to help you if I can but remember I will not code for you.

[.•´¯`•þasђγ•._.•´]

can i book you in for a private lesson ?

cos i have NO idea what you are on about in this thread Tewl lol


[/i][/color]

[Dangermouse]

\0 is a null terminator or just null, i believe.

[anthrax]

nice info

[Lazer]

very well put together tewl

[Webagent]

Tewl said:

Packet data for authenticating to msn w/ subscription

Directory Server Data
send: AUTH GateKeeperPassport S :ticket&profiledatahere

[/code][/quote]

can it be its no longer ticket&profiledatahere? I dont see it correspondending with ticket no longer on the first server with IRCVERS 8, did something change?

[Webagent]

the ticket is between 0000005A and 000000C

so its 0000005Aticket000000C&profiledata

I never payed attention, was this always?

[Tewl]

0000005A<ticket>000000C2<profile>

Actually I do think its the same all the time but the method is just to show us how they are doing it in case things change

they take the length of the ticket ( 90 ) an get the hex value ( 5A) then take the length of the hex value ( 2 ) ans subtract that from 8 and add that many zeros to the front followed by the hex value of the length of the ticket ( 0000005A )

An the same method for the profile

I am sure you can do not have to do this tho

[Ziggy]

Is there any way to put this in the perspective of the server? In case a certian server developer wanted to experiment with GateKeeper authentication as an example for writing your own security provider.

Basically, does anyone know what the inital (GateKeeper I) is, and how it should be handled in the server's response (GateKeeper S), and what the client responds with in the final GateKeeper S (it's explained here, I believe)?

And \0 is NUL, the C string terminator.

[Tewl]

Well the gatekeeper ( or gatekeeperpassport ) I is sent from the ocx to the server in which the server will return a gatekeeper ( or gatekeeperpassport ) S if the I was valid then the ocx will convert the S recv'd

after that if you where guest u get auth gatekeeper * address if you are passport you get auth gatekeeperpassport S :OK in which you will send the passport data

I cant tell you how these things are generated but i wish i knew it.

ps. hawk claims to know the authentication but it would be a cold day in h3ll before he'd come off any code lol

[Ziggy]

Ah, well thanks anyways If Hawk would like to contribute to the open source community, I'll give him a cookie (maybe a dollar if I have the patience to count the pennies).

[Tewl]

not likely

[KingpinX]

what that dude like, anti open source of sum stuff? lol

[Dangermouse]

/me shakes his stick and shouts be gone with yer! Wandering round these parts, our parts, now buggar off!