+- Hack Forums (https://hackforums.net)
+-- Forum: Tech (https://hackforums.net/forumdisplay.php?fid=444)
+--- Forum: Coding (https://hackforums.net/forumdisplay.php?fid=151)
+---- Forum: Software Development (https://hackforums.net/forumdisplay.php?fid=118)
+---- Thread: [.NET] How to secure your .NET applications with LiteCode (/showthread.php?tid=5077328)
Pages: Pages
1
2
How to secure your .NET applications with LiteCode - debug - Nov 30, 2015
Hey all!
Intro
- I have written up a basic client/server example of how to use LiteCode in order to protect your .NET applications. LiteCode allows you to remotely execute code from a server application, and use that data securely. I have used a combination of LiteCode + .NETSeal in my applications, and they have yet to be cracked.
Project Overview
Globals
- Public Key - key that users can view publicly (aka, store in project resources.)
- Private Key(s) - keys that must not be stored client side. You should download your private key(s) from your webserver (stored encrypted), after you have authenticated the user. Then decrypt them. You can store them in your litecode server's resources, so long as your web server is not compromised.
- ISharedClass - the shared class interface is just that - an interface that defines the functions that your shared client<->server class will contain. (It must be the same in both projects. Contains no actual code.)
- SharedClass - the actual shared class that contains the sensitive code. (Only in server for obvious reasons.
Client
- Client - your main application. It will connect to your server with a static username/password combination. I suggest not hardcoding these, rather, retrieve them from your webserver after a pre-authentication of your choosing (eg. Servatrix, NetSeal).
- ClientProps - class where you define your server's IP Address, among other properties.
Server
- Server - your server application. It will handle and authenticate connections from your client with your static username/password, as well as your private key(s).
- ServerProps - the same as ClientProps, but properties for your server.
Example Project (C#)
https://github.com/debug-hf/LiteCode-Example
https://github.com/AnguisCaptor/LiteCode
https://github.com/AnguisCaptor/SecureSocketProtocol
Project Explanation
Sorry the volume is a bit low.
I plan to update this with pictures and all later, but right now this is all I have time for. Paruse the source, it's pretty straight forward. If you have any questions let me know.
Hope this helps secure your applications.
Enjoy!
All credits to LiteCode and SecureSocketProtocol goes to DragonHunter
* - Ajumma - Nov 30, 2015
Thanks for the awesome tutorial. Would it be possible for you to convert this into a VB.NET project?
* - debug - Nov 30, 2015
(Nov 30, 2015 07:56 PM)Ajumma Wrote: Thanks for the awesome tutorial. Would it be possible for you to convert this into a VB.NET project?The libraries used are included as DLLs, so you would only have to convert ~ 6 classes, which can easily be done with an online converter. I may do it tomorrow if no one else posts it.
* - Tostig - Nov 30, 2015
Don't get me wrong OP, this is a great contribution. But I think Razor's and LaPanthere's Servatrix licensing system is a better way of doing this.
* - debug - Nov 30, 2015
(Nov 30, 2015 08:14 PM)Viktor Wrote: Don't get me wrong OP, this is a great contribution. But I think Razor's and LaPanthere's Servatrix licensing system is a better way of doing this.The only problem I have with using just one licensing technique is that it becomes easy to reverse over time. The more people that use the same technique, the simpler it becomes to crack. Take net seal for example. Over time, automated tools were created to crack it.
That being said, Servatrix does seem promising. But I myself, prefer to use a combination of LiteCode + NetSeal, as well as other authentication methods in relation to securely distributing the private keys, in order to protect my programs.
When you use a combination of great existing software(LiteCode + NetSeal for example) mixed with your own tweaks, it becomes much harder for your code to be reversed simply, since it is so unique.
Just my $0.02.
* - Tostig - Nov 30, 2015
(Nov 30, 2015 08:44 PM)debug Wrote: The only problem I have with using just one licensing technique is that it becomes easy to reverse over time. The more people that use the same technique, the simpler it becomes to crack. Take net seal for example. Over time, automated tools were created to crack it.
That being said, Servatrix does seem promising. But I myself, prefer to use a combination of LiteCode + NetSeal, as well as other authentication methods in relation to securely distributing the private keys, in order to protect my programs.
When you use a combination of great existing software(LiteCode + NetSeal for example) mixed with your own tweaks, it becomes much harder for your code to be reversed simply, since it is so unique.
Just my $0.02.
You make a good case. Crack protection isn't the easiest thing to do, and you seem to know what you're doing. š¤
* - CoderEX - Nov 30, 2015
If possible, can you please post the process of producing private/public keys, and how to specifically add functions to the server/client?
Those are the two areas I am having challenges with, and maybe others as well.
But thank you for starting a tutorial thread for LiteCode!
I appreciate it very much! (:
* - debug - Nov 30, 2015
(Nov 30, 2015 09:03 PM)AustinCoder Wrote: If possible, can you please post the process of producing private/public keys, and how to specifically add functions to the server/client?For public private keys, they can be anything. For instance, the ones I supplied are a few default windows 7 images, I just renamed them. Your keys could be random letters, pictures, or anything really.
Those are the two areas I am having challenges with, and maybe others as well.
But thank you for starting a tutorial thread for LiteCode!
I appreciate it very much! (:
As for adding functions to the server/client, you have to do a few things.
Server AND Client side:
-Modify the interface file(ISharedClass) to include your new function.
Server side:
-Modify the SharedClass to implement the new function you have created in the interface(ISharedClass).
Client side:
-Modify the client class to call the new method you have created.
If you review the code I have supplied, you should be able to simply copy the existing method I have created in order to fit your needs.
* - 6e756c6c - Dec 1, 2015
(Nov 30, 2015 08:14 PM)Viktor Wrote: Don't get me wrong OP, this is a great contribution. But I think Razor's and LaPanthere's Servatrix licensing system is a better way of doing this.
Servatrix has already been compromised, someone's created a tool to dump the remote vars.
* - Cecilia - Dec 1, 2015
(Nov 30, 2015 08:14 PM)Viktor Wrote: Don't get me wrong OP, this is a great contribution. But I think Razor's and LaPanthere's Servatrix licensing system is a better way of doing this.
Wardow has been a lovely fellow and created an app to emulate already :)
n0th!ng always wins :)
Wait for RCE, or use Litecode if need be :)
Thanks for posting Aeon.
* - Šµlixir - Dec 1, 2015
Good job debug! @Lakitty wish you guys the best with the project.
* - debug - Dec 1, 2015
(Dec 1, 2015 06:44 AM)LaPanthere Wrote: Wardow has been a lovely fellow and created an app to emulate already :)Ooh, I'd love to see how he did it. But lets keep this on topic ;)
n0th!ng always wins :)
Wait for RCE, or use Litecode if need be :)
Thanks for posting Aeon.
If I have time later today I will update this post with more information, possibly on how to securely integrate with NetSeal.
* - Wardow - Dec 1, 2015
(Dec 1, 2015 06:44 AM)LaPanthere Wrote: Wardow has been a lovely fellow and created an app to emulate already :)
n0th!ng always wins :)
Wait for RCE, or use Litecode if need be :)
Thanks for posting Aeon.
Here is how it looks:
[img]http://prntscr.com/996f68/direct[/img]
I'm not gonna release it though.
* - debug - Dec 1, 2015
(Dec 1, 2015 11:36 AM)Wardow Wrote: Here is how it looks:Looks nice. I challenge you to make one for Litecode ;)
[img]http://prntscr.com/996f68/direct[/img]
I'm not gonna release it though.
Updated OP with video explanation.
* - Corios - Dec 1, 2015
(Dec 1, 2015 11:36 AM)Wardow Wrote: Here is how it looks:
[img]http://prntscr.com/996f68/direct[/img]
I'm not gonna release it though.
You haven't made anything, that's why you're not releasing it. We've all seen the stupid ass code you've posted and you trying to "prove a point", there's no way in hell you made something like that even though it's not even that hard.