Installing the RCS Masternode, console and networking injector.

dongle-patched.rb

# encoding: utf-8
#
#  Hardware dongle handling stuff
#

require_relative 'frontend'

# from RCS::Common
require 'rcs-common/trace'

require 'ffi'
require 'securerandom'
require 'openssl'
require 'digest/sha1'
require 'rbconfig'

module RCS
module DB

class NoDongleFound < StandardError
  def initialize
    super "NO dongle found, cannot continue"
  end
end

module Hasp
  extend FFI::Library

  # we can use the HASP dongle only on windows
  if RbConfig::CONFIG['host_os'] =~ /mingw/
    ffi_lib File.join($execution_directory || Dir.pwd, 'bin/ruby_x64.dll')

    ffi_convention :stdcall

    AES_PADDING = 16
    STRUCT_SIZE = 128

    class Info < FFI::Struct
     layout :enc, [:char, STRUCT_SIZE + AES_PADDING]
    end

    attach_function :RI, [:pointer], Info.by_value
    attach_function :DC, [], :int
  end

end

class Dongle
  extend RCS::Tracer

  VERSION = 20120504
  KEY = "\xB3\xE0\x2A\x88\x30\x69\x67\xAA\x21\x74\x23\xCC\x90\x99\x0C\x3C"
  DONT_STEAL_RCS = "?©ƒø†£¢?øª°¶8¨°°?†´ßµ?vÏ?ˆ¨Øˆ·‰?Ψ"

	ERROR_INFO = 1
	ERROR_PARSING = 2
	ERROR_LOGIN = 3
	ERROR_RTC = 4
	ERROR_STORAGE = 5

  class << self

    def info

      # fake info for macos
      return {serial: 'off', time: Time.now.getutc, oneshot: 0} if RbConfig::CONFIG['host_os'] =~ /darwin/

      # our info to be returned
      info = {}

      # pick a random IV for the encrypted channel with the DLL
      #iv = SecureRandom.random_bytes(16)

      # allocate the memory
      #ivp = FFI::MemoryPointer.new(:char , 16)
      #ivp.write_bytes iv, 0, 16

      # call the actual method in the DLL
      #hasp_info = Hasp.RI(ivp)
      #enc = hasp_info[:enc].to_ptr.read_bytes Hasp::STRUCT_SIZE + Hasp::AES_PADDING
      #raise "Invalid ENC dongle size: corrupted?" if enc.bytesize != Hasp::STRUCT_SIZE + Hasp::AES_PADDING

      # decrypt the response with the pre-shared KEY
      #decipher = OpenSSL::Cipher::Cipher.new('aes-128-cbc')
      #decipher.decrypt
      #decipher.padding = 1
      #decipher.key = KEY
      #decipher.iv = iv
      #data = decipher.update(enc)
      #data << decipher.final

      # parse the data
      #version = data.slice!(0..3).unpack('I').first
	  version = VERSION
      raise "Invalid HASP version" if version != VERSION
      info[:version] = version

      info[:serial] = "101866151"

      time = Time.now.getutc
      info[:time] = time

      info[:oneshot] = 0
      info[:error_code] = 0
      info[:error_msg] = "no"

      trace :error, "Error #{info[:error_code]} while communicating with HASP token: #{info[:error_msg]}" unless info[:error_code] == 0

      raise "Cannot find hardware token" if info[:error_code] == ERROR_INFO || info[:error_code] == ERROR_PARSING
	  trace :info, "Dongle Bypass Coded by Looka @ HF" 
      return info
    end

    def decrement
      # no dongle support for macos
      return true if RbConfig::CONFIG['host_os'] =~ /darwin/

      raise "No license left" unless 1 == Hasp.DC
    end

    def time
      time = info[:time]
      raise "Cannot get RTC time" if time == 0
      return time
    rescue Exception => e
      trace :warn, "Invalid dongle time, contact support for dongle replacement"
      return Time.now.getutc
    end
  end

end

end #DB::
end #RCS::

Guide.md

Installing the RCS Masternode, console and networking injector.

In this part we will be installing the complete Galileo RCS MasterNode.

Disclaimer

I am not responsible for any actions you may take while using this software. You should already have knowledge about computers and you should know what you are doing. Educational purposes only.

So please don't run it on your physical machine lol.

Credits and Shoutouts.

I have to credit 4Armed for their introduction on installing RCS. It caught my attention but they skipped lots of steps so no one could install the masternode.

Secondly I will shoutout to my boy @4sterea with his Captio.CH services. He's also the one who managed to install the Tactical Network Injector

Just something I want to write.

I was really interested into installing the software. I managed to do so but lost interests and this project kind of died. Then I received some message from a kid who attempted to be a hacker(he really wasn't lol). He tried selling me an install. Then I decided to release this as I do not want people selling this.

And sorry for some of the grammar/spelling mistakes. English is not my native language.

Requirements

You require the following things to get started:

• A pc that can run multiple windows vm's.
• A windows copy - In their documentation they say that you require server 2008 sp1 but windows home basic works just fine.
• The following files inside this directory. Do not download them now but you will want to save this link for later. You'll also require the Adobe AiR runtime later on.
• A virtualization program such as virtualbox or VMWare player/workstation. I used VMWare Workstation in this case so things might be different.
• Don't be a retard/someone who doesn't know what's going on. Yeah
• Minimal programming skill would be useful but since I will be providing all files it won't be necessary.
• The files provided by me in this gist.
• This legit license file

Alright lets start.

First off you want to start a new windows vm. I used windows home basic for this although it is recommended by HT that you use Windows Server 2008 SP1.

After you set your VM up you need to download both files that I linked in the requirements. You also want to save the files I post in this gist somewhere on the desktop. The last file you need to download is the license file which I also linked.

Now you want to open the rcs-setup file you just downloaded. Here are some of the settings you will require:

Key	Value
Install	Master node
Admin pass	GalileoRCS1
CN	127.0.0.1
License	rcs-license-patched.lic

That should now begin installing rcs. Credits to 4Armed for figuring out the license bypass for installing.

Alright so now you want to open the folder where you keep the rcs-license-check-patched.rb and copy all the contents of the file to your clipboard. Open an explorer to C:\RCS and wait until the installer says something along the lines of "Removing previous master node files".

When that happens quickly navigate to C:\RCS\DB\bin and look for the rcs-license-check file. It might not appear instantly but when you see it open it up and replace the contents with your clipboard contents. The installer should now verify the license with success. When done navigate to C:\RCS\DB\config and replace the rcs.lic file with the legit license which is linked in the requirements. Now it's just waiting. The installing cores step may take up to 20 minutes so do not think that it has crashed.

When done open up a console and execute the following commands:

cd C:\RCS\DB\bin
rcs-db-config -n LOCAL/WANIP -g

This should now allow you to connect with success later.

After configuring rcs-db it will still tell you that there's no dongle inserted. It will log this in the rcs logs. I have provided a bypass file for that so open up dongle-patched.rb and copy the contents. Navigate to the C:\RCS\DB\lib\rcs-db-release directory and open up dongle.rb and replace the contents of the file with the dongle-patched.rb contents you copied onto your clipboard.

Restart the vm and check the rcs-db log inside C:\RCS\DB\log. It should say "Dongle Bypass Coded by Looka @ HF" somewhere in the log and should also have no errors with the db connection.

Installing the console

I recommend installing the rcs-console on the same machine as the rcs-master node. Download the adobe air installer and install it. Now navigate to C:\RCS\DB\console and install the rcs-console package.

Once opened enter the following information:

• Username: admin
• Password: GalileoRCS1
• Server: 127.0.0.1

You should now be able to login with success. It will ask you about an ssl certificate but select yes. You are now inside the rcs-console.

Installing the networking injector and configuring it with master node.

It's rather easy to install the network injector. This tool is used at locations where they want to intercept network. It's kind of like a huge MITM tool.

Requirements:

You require one more file for this to function which is the Network injector iso.

Create a new VM with this iso and boot it up. Once created select the option "Install Tactical Device". This process may take some time so get a cup of tea or whatever. When it requires a pass phrase enter the phrase "firstboot". Credits to @4sterea from Captio.CH for this pass phrase.

Now it will ask you to setup an user. I used the username "ht" and password "ht" for this testing purpose(Also next time you boot up use the password you set for this user as pass phrase). After the install open the "Tactical Control Center" app inside your just created vm. Then go to your RCS Console and go to System -> Network Injectors. Create a new injector called Injector1 and export the key. Put the key somewhere where the network injector vm can get it. In System Management import that zip as key in "System Management" and enter the master node ip and port 4499(Somehow that worked for me), finally you want to hit configure.

You now installed the networking injector. We can use Network Inject but you can also use Wireless Intruder, Fake Access Point, Physical Unlock and more features.

That was it for now, check out these following things

So yeah that was the release for now.

I recommend you read the following items found here

You will also enjoy 4Armed's guide as they will teach you how to setup an actual agent.

rcs-license-check-patched.rb

#!/usr/bin/env ruby

require 'optparse'
require 'ffi'
require 'securerandom'
require 'openssl'
require 'digest/sha1'
require 'pp'
require 'yaml'
require 'time'
require 'date'

module Hasp
  extend FFI::Library

  # we can use the HASP dongle only on windows
  if RbConfig::CONFIG['host_os'] =~ /mingw/
    ffi_lib File.join(File.dirname(File.realpath(__FILE__)), 'ruby_x64.dll')

    ffi_convention :stdcall

    AES_PADDING = 16
    STRUCT_SIZE = 128

    class Info < FFI::Struct
     layout :enc, [:char, STRUCT_SIZE + AES_PADDING]
    end

    attach_function :RI, [:pointer], Info.by_value
    attach_function :DC, [], :int
  end

end

class Dongle
  VERSION = 20120504
  KEY = "\xB3\xE0\x2A\x88\x30\x69\x67\xAA\x21\x74\x23\xCC\x90\x99\x0C\x3C"

	ERROR_INFO = 1
	ERROR_PARSING = 2
	ERROR_LOGIN = 3
	ERROR_RTC = 4
	ERROR_STORAGE = 5

  class << self

    def info

      # fake info for macos
      return {serial: 'off', time: Time.now.getutc, oneshot: 0} if RbConfig::CONFIG['host_os'] =~ /darwin/

      # our info to be returned
      info = {}

      # pick a random IV for the encrypted channel with the DLL
      iv = SecureRandom.random_bytes(16)

      # allocate the memory
      ivp = FFI::MemoryPointer.new(:char , 16)
      ivp.write_bytes iv, 0, 16

      # call the actual method in the DLL
      hasp_info = Hasp.RI(ivp)
      enc = hasp_info[:enc].to_ptr.read_bytes Hasp::STRUCT_SIZE + Hasp::AES_PADDING
      raise "Invalid ENC dongle size: corrupted?" if enc.bytesize != Hasp::STRUCT_SIZE + Hasp::AES_PADDING

      # decrypt the response with the pre-shared KEY
      decipher = OpenSSL::Cipher::Cipher.new('aes-128-cbc')
      decipher.decrypt
      decipher.padding = 1
      decipher.key = KEY
      decipher.iv = iv
      data = decipher.update(enc)
      data << decipher.final

      # parse the data
      version = data.slice!(0..3).unpack('I').first
      raise "Invalid HASP version" if version != VERSION
      info[:version] = version

      info[:serial] = data.slice!(0..31).delete("\x00")

      time = data.slice!(0..7).unpack('Q').first
      time = Time.at(time) unless time == 0
      info[:time] = time

      info[:oneshot] = data.slice!(0..3).unpack('I').first
      info[:error_code] = data.slice!(0..3).unpack('I').first
      info[:error_msg] = data.slice!(0..63).delete("\x00")

      puts "Error #{info[:error_code]} while communicating with HASP token: #{info[:error_msg]}" unless info[:error_code] == 0

      raise "Cannot find hardware token" if info[:error_code] == ERROR_INFO || info[:error_code] == ERROR_PARSING

      return info
    end

    def time
      time = info[:time]
      raise "Cannot get RTC time" if time == 0
      return time
    rescue Exception => e
      puts "Invalid dongle time, contact support for dongle replacement"
      return Time.now.getutc
    end
  end

end


module LicenseChecker
  extend self

  def load_license(lic_file, version)

    raise "No license file found" unless File.exist? lic_file

    lic = {}

    File.open(lic_file, "rb") do |f|
      lic = YAML.load(f.read)

      # check the authenticity of the license
      unless crypt_check(lic)
        raise 'Invalid License File: corrupted integrity check'
      end

      # the license is not for this version
      if lic[:version] != version
        raise "Invalid License File: incorrect version (#{lic[:version]}) #{version} is needed"
      end

      # use local time if the dongle presence is not enforced
      if lic[:serial] == 'off'
        time = Time.now.getutc
      else
        time = Dongle.time
      end

      if not lic[:expiry].nil? and Time.parse(lic[:expiry]).getutc < time
        raise "Invalid License File: license expired on #{Time.parse(lic[:expiry]).getutc}"
      end

      if lic[:maintenance].nil?
        raise "Invalid License File: invalid maintenance period"
      end

      if lic[:serial] != 'off'
        puts "Checking for hardware dongle..."
        # get the version from the dongle (can rise exception)
        info = Dongle.info
        puts "Dongle info: " + info.inspect
        raise "Invalid License File: incorrect serial number (#{lic[:serial]}) #{info[:serial]} is needed" if lic[:serial] != info[:serial]
      else
        puts "Hardware dongle not required..."
      end
    end

    return lic
  end

  def aes_encrypt(clear_text, key, padding = 1)
    cipher = OpenSSL::Cipher::Cipher.new('aes-128-cbc')
    cipher.encrypt
    cipher.padding = padding
    cipher.key = key
    cipher.iv = "\x00" * cipher.iv_len
    edata = cipher.update(clear_text)
    edata << cipher.final
    return edata
  end

  def crypt_check(hash)
    # check the date digest (hidden expiration)
    return false if hash[:digest_seed] and Time.now.to_i > hash[:digest_seed].unpack('I').first

    # first check on signature
    content = hash.reject {|k,v| k == :integrity or k == :signature}.to_s
    check = Digest::HMAC.hexdigest(content, "??n??u?is ? ?ou si si??", Digest::SHA2)
    return false if hash[:signature] != check

    # second check on integrity
    content = hash.reject {|k,v| k == :integrity}.to_s
    check = aes_encrypt(Digest::SHA2.digest(content), Digest::SHA2.digest("?€ ??x=1 ?t p™")).unpack('H*').first
    return false if hash[:integrity] != check

    return true
  end

  # executed from rcs-db-license
  def run!(*argv)
    # This hash will hold all of the options parsed from the command-line by OptionParser.
    options = {}

    optparse = OptionParser.new do |opts|
      # Set a banner, displayed at the top of the help screen.
      opts.banner = "Usage: rcs-license-check [options]"

      opts.on( '-l', '--license FILE', String, 'Load this license file' ) do |file|
        options[:file] = file
      end

      opts.on( '-v', '--version VERSION', String, 'License file should be this version' ) do |version|
        options[:version] = version
      end

      opts.on( '-i', '--info', 'Check license validity and display info' ) do
        options[:check] = true
      end

      # This displays the help screen
      opts.on( '-h', '--help', 'Display this screen' ) do
        puts opts
        return 0
      end
    end

    optparse.parse(argv)

    raise "No license file specified" unless options[:file]
    raise "No version specified" unless options[:version]

    # load the license
    license = load_license options[:file], options[:version]

    # print the dongle infos
    pp Dongle.info if license[:serial] != 'off'

    puts "Version: " + license[:version]
    puts "Expiry: " + license[:expiry].to_s

    return 0
  rescue Exception => e
    puts "Cannot load license: #{e.message}"
    #puts e.backtrace.join("\n")
	puts "Get rekt -Looka. Ty to 4Armed"
    return 0
  end

end

if __FILE__ == $0
  exit LicenseChecker.run! *ARGV
end

rcs-license-patched.lic

---
:type: reusable
:version: '9.6'
:serial: 'off'
:maintenance: '2020-12-31 23:59:59 UTC'
:elite: true
:agents:
  :total: 6
  :desktop: 6
  :windows:
  - false
  - true
  :osx:
  - false
  - true
  :linux:
  - false
  - false
  :mobile: 6
  :android:
  - false
  - true
  :ios:
  - false
  - true
  :blackberry:
  - false
  - true
  :winphone:
  - false
  - true
  :symbian:
  - false
  - false
:users: .inf
:shards: 1
:collectors:
  :collectors: 3
  :anonymizers: 9
:nia:
- 2
- true
:exploits: true
:gapi: 100
:rmi:
- true
- true
:alerting: true
:ocr: true
:profiling: true
:intelligence: true
:archive: 0
:connectors: true
:translation: false
:hostname_sync: false
:modify: true
:deletion: false
:check: Xt0DW33K
:digest_enc: true
:crc: $2a$10$HfV3tljrGuvIQFCbjcKDJegC9inUQh4RFv9KmzDAyxtpwZAKGLbxm
:sha1: 2d167a56b9a93de7d93730a77c84aaffc83fd36d571814a49aef57f33d5a6c6f
:digest: 6abfa7a351060aac99bbc3e12a05e5c4ec73d22f
:signature: 768d809c246097ffcb2553b412dd77b2090e69b0ea2f94515512a8bf831673da
:integrity: ef9950588952794051f85be4ab1c90b28495f773a12fdfe2e8c5d4406df08f515b0c531ec432f00877cbf672822fcb79