PJLink Authentication and Security

I've already wrote one article about PJLink protocol https://g33ksblog.blogspot.com/2017/03/pjlink-network-control-for-projector.html

PJLink is a protocol developed by JBMIA for controlling projectors (and presentation displays for example from NEC) via LAN connections

It use get and set commands. You can get or set several thinks, Power on/off or get the status. Input for video and audio source. Volume and if it's projector you can work also with lens and apertur.
More documentation can be find here: http://pjlink.jbmia.or.jp/english/

Detail protocol specification: http://pjlink.jbmia.or.jp/english/data/5-1_PJLink_eng_20131210.pdf

Here we will concentrate in Authentication and Security.

There are two possibilities

1. there is no authentication and PJLink device start the communication with: PJLINK 0
2. there is authentication and PJLink device start communication with PJLINK 1 4bytes random number

The authentication process is as follows(schematics below):

1. PJLink device send PJLINK 1 4bytes random number
2. PJLink clinet will concatenate this 4bytes random number and password and do MD5 hash
3. PJLink client will send MD5 Hash and command to PJLink device
4. PJLink device do same MD5 Hash generation and compare the result with client response to verify password and either respond with command result or error message

To obtain access to PJLink device with authentication there two ways.

1. as per point 4 above PJLink device is doing MD5(random number + password) => which means it have a password plain text (or symetricaly encrypted) somewhere localy, hence if you have other access to device you might be able to get it.
2. we can simply do brute force attack and guess password (here  are scripts to do word list based brute force attack) the problem is that every login using random salt, which means you need to find really correct password (collision is no help)

CiscoSecure ACS Password recovery

Long time ago I was trying to search how to get in to Cisco ACS when I forgot my password.
When I searched on google I didn't find anything usefull, after all I find the way my self and to my suprise it's nothing secret or hard to find you just need to know what to search to be able to find it.
But because "CiscoSecure ACS Password recovery" is not working here is howto and from now on it maybe possible to find it ;-)
By default it's possible to access the CiscoSecure ACS admin page without login from localhost, but sometimes this is changed and even when accessing from localhost you need to use login and password. There is ofcourse way how to put default behavior back.
You need to have rights to change the registry if you have then do folloving
1)Open regedit
2) Go to [HKEY_LOCAL_MACHINE\SOFTWARE\Cisco\CiscoAAAv3.3\CSAdmin\Security]
3) Change "allowAutoLocalLogin" to 0
Now you will be able to access ACS admin page from localhost without login.
P.S.: Even you can find this HOWTO on more side I was not able to find it asking google for "ACS Password recovery" I hope everybody will be possible to do so.