0

I'm and out of practice programmer, so basically new to it again.

What I am doing is logging onto a a device over Telnet or TCP. Instead of controlling the device by type command I am using a custom forms application to send the type string commands by pre programmed push button. The device is an old Codec. The purpose of my software is to create a push button controller to be used from a PC.

The problem I am having is that some of my devices are password protected and some are not (different firmware). This cannot be changed. The Password protection is what has me stuck.

I am sending data to the device using ASCII

public void Write(string cmd)
        {
            if (!tcpSocket.Connected) return;
            byte[] buf = System.Text.ASCIIEncoding.ASCII.GetBytes(cmd.Replace("\0xFF", "\0xFF\0xFF"));
            tcpSocket.GetStream().Write(buf, 0, buf.Length);

I have been searching on MD5 and have become stuck. I have tried sending the password by plain text typing the password into a text box and initiating the write command. I have also tried sending the output of this code I found on the internet

public string EncodePassword(string originalPassword)
        {
            //Declarations
            Byte[] originalBytes;
            Byte[] encodedBytes;
            MD5 md5;

            //Instantiate MD5CryptoServiceProvider, get bytes for original password and compute hash (encoded password)
            md5 = new MD5CryptoServiceProvider();
            originalBytes = ASCIIEncoding.Default.GetBytes(originalPassword);
            encodedBytes = md5.ComputeHash(originalBytes);
            //Convert encoded bytes back to a 'readable' string
            return BitConverter.ToString(encodedBytes);                            

I even found another MD5 line that forced upper and lower case. I don't know if it wont work because it is still sending the encoded password in ASCII or what.

I do know that my password is right because I can load telnet in windows and log on fine there. Any help in getting this client to authenticate with the server would be most appreciated.


Forgive the length. Since I am unable to reply I had to edit. I think that I was confused on the MD5... After reading the replies I think my problem is the ASCII. I need plain text.

Ok, so this is where my beginner stripes shine brightly. This is my first attempt at programming that involves a network of any sort (if it wasn't already that obvious). From reading the replies I think my first problem is the ASCII. I assumed that being sent though that was plain text. Given that when I connect to a server with the same client that does not require password login... The ASCII works just fine.

So if I am to use plain text, then How would I go about sending in plain text and not a byte conversion? Assuming that my assumption that ASCII was the way to send plain text is wrong...Which I now think that it is.

I have added more code to help this along.

When using the Windows telnet client, the device prompts for password and when you type it into telnet no text is shown until after login. After login all typing is shown immediately.

The Class used for the socket is mostly a code I found on google with some small tweeks.

using System;
using System.Collections.Generic;
using System.Text;
using System.Net.Sockets;

namespace STC_Control
{
    enum Verbs
    {
        WILL = 251,
        WONT = 252,
        DO = 253,
        DONT = 254,
        IAC = 255
    }

    enum Options
    {
        SGA = 3
    }

    class TelnetConnection
    {
        TcpClient tcpSocket;

        int TimeOutMs = 100;

        public TelnetConnection(string Hostname, int Port)
        {
            tcpSocket = new TcpClient(Hostname, Port);

        }

        public void WriteLine(string cmd)
        {
            Write(cmd + "\n");
        }

        public void Write(string cmd)
        {
            if (!tcpSocket.Connected) return;
            byte[] buf = System.Text.ASCIIEncoding.ASCII.GetBytes(cmd.Replace("\0xFF", "\0xFF\0xFF"));
            tcpSocket.GetStream().Write(buf, 0, buf.Length);
        }

        public string Read()
        {

            if (!tcpSocket.Connected) return null;

                StringBuilder sb = new StringBuilder();

                do
                {
                    ParseTelnet(sb);
                    System.Threading.Thread.Sleep(TimeOutMs);
                } while (tcpSocket.Available > 0);
                return sb.ToString();

        }

        public bool IsConnected
        {
            get { return tcpSocket.Connected; }
        }

        void ParseTelnet(StringBuilder sb)
        {
            while (tcpSocket.Available > 0)
            {
                int input = tcpSocket.GetStream().ReadByte();
                switch (input)
                {
                    case -1:
                        break;
                    case (int)Verbs.IAC:
                        // interpret as command
                        int inputverb = tcpSocket.GetStream().ReadByte();
                        if (inputverb == -1) break;
                        switch (inputverb)
                        {
                            case (int)Verbs.IAC:
                                //literal IAC = 255 escaped, so append char 255 to string
                                sb.Append(inputverb);
                                break;
                            case (int)Verbs.DO:
                            case (int)Verbs.DONT:
                            case (int)Verbs.WILL:
                            case (int)Verbs.WONT:
                                // reply to all commands with "WONT", unless it is SGA (suppres go ahead)
                                int inputoption = tcpSocket.GetStream().ReadByte();
                                if (inputoption == -1) break;
                                tcpSocket.GetStream().WriteByte((byte)Verbs.IAC);
                                if (inputoption == (int)Options.SGA)
                                    tcpSocket.GetStream().WriteByte(inputverb == (int)Verbs.DO ? (byte)Verbs.WILL : (byte)Verbs.DO);
                                else
                                    tcpSocket.GetStream().WriteByte(inputverb == (int)Verbs.DO ? (byte)Verbs.WONT : (byte)Verbs.DONT);
                                tcpSocket.GetStream().WriteByte((byte)inputoption);
                                break;
                            default:
                                break;
                        }
                        break;
                    default:
                        sb.Append((char)input);
                        break;
                }
            }

        }
    }
}

Then the program

public Form1()
        {
            InitializeComponent();
        }
        //declorations
        TelnetConnection tc;
        Int16 vl = 13;


        private void connect_Click(object sender, EventArgs e)
        {
            if (string.IsNullOrEmpty(roomBox.Text))
            {
                MessageBox.Show("Please enter a selection before continuing");


            }
            else
            {
                {
                    try
                    {
                        //Connects to the server
                        tc = new TelnetConnection(roomBox.Text, 23);
                        //Enables controls
                        panelAll.Enabled = true;
                    }
                    catch
                    {
                        MessageBox.Show("Server Unreachable. ");
                        panelAll.Enabled = false;
                        cState.Text = "Disconnected";
                    }

                }
            }

// Button to send login password Temp created to test login
public void p_Click(object sender, EventArgs e)
        {
            try
            {
              //sends text to server  
              tc.WriteLine("PASSWORD");

              //enables Buttons
              panelAll.Enabled = true;

              //displays return to textbox to verify login or disconnect
              rx.Text = (tc.Read());
            }
            catch
            {
                panelAll.Enabled = false;
                MessageBox.Show("Communication with device was lost.");
                cState.Text = "Disconnected";
            }
        }

------------------------------------------------------------------------------------------

2
  • The text does not show because the device does not echo it back, not because there is encryption. If it's a purely telnet interface then this is undoubtedly the issue. Send the password as plain text. (Yay! can finally comment anywhere... what an annoying "badge" to have to wait for).
    – mr.stobbe
    Commented Oct 14, 2011 at 5:22
  • Issue Resolved. It was a problem with the negotiation protocol of the client.
    – eatumup
    Commented Nov 10, 2011 at 23:05

3 Answers 3

1

Your code seems a bit incomplete to give a full answer. If possible, supply a more complete flow of logic stripped out of your program. But from what I can gather, here's some immediate tips...

  1. Don't confuse MD5 with encryption. They're very, very different things (MD5 is a one-way hash while encryption is a two-way encoding). This is likely to be the source of your headaches. Encryption/hashing handshake methods must be agreed upon by both participants. If you're trying to login with an MD5 hash of a password, to a device that only accepts plain-text passwords, then it will not recognize it as a valid password. There is literally nothing you could do about this scenario... plain-text it would have to be.
  2. You assume passwords are ASCII? If not, the ASCII conversion is bad news. Probably not a root problem here, but something to think about.

EDIT: Actually... let me go more into depth because after further thought, I'm about 90% sure this is your problem (without more information of course).

The flow of logic when dealing with a device that only supports plain-text passwords is this (where C is client [you] and S is server [them])...

[C] Send password plain-text
[S] Got your password, thanks! I just checked it against what I know and it's good/bad

When using any kind of hashing.

[C] Hash password (MD5, SHA1, etc)
[C] Send password
[S] Receive hash of password. Check against hashed password stored (or worse, hash of plain-text password stored). Respond good/bad

When encrypting the connection (when client and server know what kind of encryption they both use)...

[C] Garble-garble-garble (password encrypted)
[S] Got it... and garble-garble-garble turns into whatever plain-text password. Checked it against local storage and .... garble-garble-garble (good/bad encrypted)

When encrypting the connection (and the client/server may not necessarily support the same methods but know how to negotiate which to use)...

[C] Which encryption methods do you support? Here's my list...
[S] Oh, well, we both support these methods. Which do you want to use?
[C] IDEA sounds good.
[S] Sounds good to me too. Start using it.
[C] Garble-garble-garble (password encrypted)
[S] Got it... and garble-garble-garble turns into whatever plain-text password. Checked it against local storage and .... garble-garble-garble (good/bad encrypted)

As you can see, very different methods. Those must be built into the communication device (server) for a successful negotiation.

2
  • Sorry but I can't yet comment directly on your changed post, but yes... I'm really quite sure that you should not be attempting to MD5 hash your passwords. Encryption or hashing is more than likely not supported by your target devices. Therefore, you must send the password as plain-text. There really doesn't seem to be anything wrong with your logic but the way communication is happening is not really available. Try not hashing your and let me know if it works.
    – mr.stobbe
    Commented Oct 13, 2011 at 5:13
  • Oh, and ASCII is not your problem. It is simply a 7-bit encoding standard (8-bit for the sloppy handler) and the class the is converting it for you is stripping down text to it's 7-bit equivalent, which, in your case, is probably not even noticeable (because most basic latin characters map to ASCII directly). I only pointed it out the first time because it presumes a lot about character encoding. It's indicative of potential issues with modern applications. Google character sets, unicode, etc. It was just a generic tip to remind you that the enthocentric world of a-z is not the real world.
    – mr.stobbe
    Commented Oct 13, 2011 at 5:22
0

I don't think this is a programming problem. I believe it's more of a problem of understanding how your device actually works. Does it accept password as plain text, or does it accept password in some hashed or encrypted form?

The fact that you can provide the password through telnet suggest that it is plain text, unless the telnet protocol has provision for some for of authentication.

It would be good if you could provide a screenshot of the telnet window. We might be able to get some hints from there.

I would recommend that you submit the plain text password followed by the \n new line character.

0

It sounds to me that your best solution here would be to download the OpenSSL package, install it on the device and your forms app, and then use the APIs to use a secure shell connection instead of telnet to send device commands.

That way the key management is outside your app and you can use prewritten APIs to do your encryption in a tested piece of code.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.