Jellyflower Wrote:I think Fiel, as well as myself, might be interested in other things such as if there's a PIC bypass. It's a nice experiment to weed out if there's an easy way to tackle PIC security, let it be bypass, bruteforce, database leak, keylog, or other intermediate methods. So don't think just in terms of bruteforce, think outside of the box. (Maybe there's a glitch to enter a character somewhere, like quick login or show characters option that didn't incorporate the verification of PIC) It might be easy to miss out on certain parts of coding when GMS transferred it over from KMS, and to adapt it to our database and system without conflict. If a security box is made of paper, how easy will it to access the content inside, if a very secured lock (PIC) is placed outside of it?
Pseudo-client, as I've documented in my previous post.
Write a client that logs in to your own account/character with your own PIC on the loginserver, but after transferring to the channelserver, instead of sending your character's characterID, send the characterID of bisubuild, which you can obtain from the charselect screen.
This does not work with the normal MapleStory client because it checks if the character is the same as the one it logged in to. If not, it disconnects.
This is where the pseudo client comes in. If the server does not have any form of checking (checking if the IP that logged into bisubuild in login is equal to the IP that logs into bisubuild in channel. If not, disconnect and possibly IPban), you should login to bisubuild as if you logged in using the normal login procedure. The pseudoclient should then automatically open a trade request with your character. It then waits for your character to enter the trade, then immediately puts in the 50 million mesos, and then locking the trade. It waits for the trade success packet, and then immediately logs off.
This is not completely unblockable.
Two ways:
1. Checking if the IP that logged into bisubuild at LoginServer is equal to the IP that logs into bisubuild at ChannelServer. If there is no IP that logged into bisubuild successfully at login, or the IP doesn't match, disconnect.
2. Checking that the characterid that your IP logged into at LoginServer is the same as the characterid sent at ChannelServer.
3. Requiring that the PIC (and to completely block this, password as well!) is sent to the ChannelServer on login, to verify.
Note that the first part is optional, you can just connect to the channelserver and send the packet if the server doesn't do appropriate checks.
Fiel Wrote:You still have to provide the correct PIC to progress from double-clicking on your character to going in game. That's when the PIC check occurs. I can see where you're coming from, but I cannot see how this would be a valid way to get into bisubuild.
I also see where you're coming from, but the PIC is normally checked at loginserver, and nothing of it is normally mentioned at the channelserver (which are completely seperate applications). That means you can just skip the loginserver entirely. But knowing Nexon's server team they probably thought of it. (Yes I did just praise them)
If you still don't get it, feel free to PM me on IRC or here.
---
Think of it like this: there's a huge open-ceiling passageway that is guarded in the middle. It leads to a room. The guard only looks at people coming in from the start of the passageway. You then use a helicopter and jump into the passageway (it is open-ceiling) AFTER where the guard(s) are placed. Since the guard doesn't look the other way, you have successfully circumvented their protections.
Now the way the IP checking works: There are now two guards instead of one. The first guard is positioned, again, at the middle of the open-ceiling passage. The second guard is placed at the entrance to the room. The first guard would give you a pass of some sort. The second guard, which is the channelserver, would check for that pass. If you don't have it, the guard kicks you out.