Request for Assistance: How to Decrypt This Code in PHP

[brossmee]

I need help decrypting the following code:

Bg4VB0MdWlwWExcNERUPQhYOD1cvKD44LWRaXRcQFxRXGVUZVkgBFwUfD0pKCkEBGEFDDkpBUw5cQRBMCB5QFRoAEwcdRUpUS0VXDkNaHR0PHgQFCg8ARxwGXw0eEQgYUwJHSF4

I am looking for a PHP code that can decrypt similar codes like this one. The result of this code is:

http://hogeahai.xyz/AR_OTV/index.m3u8?token=3845a51b355b26e4fd1bc2f3d188211b

Is there any expert who knows the decryption key?

The encrypted code and the link were obtained from the elAhmad app.

https://www.mediafire.com/file/axc9zt6sgt77ldl/Elahmad_v3.0.apk/file

[Attachment 82600 - Click to enlarge]

[Attachment 82601 - Click to enlarge]

[Attachment 82602 - Click to enlarge]

[Attachment 82603 - Click to enlarge]

[Attachment 82604 - Click to enlarge]

Thank you!

[aqzs]

You have to give us the page url so we can take a look at the source code. We can't guess how this url was encoded/encrypted without more information..

[brossmee]

Hi,
You can extract the encrypted code from the app by following the steps shown in the screenshots to access the specific channel.

[larley]

For the website:

from Crypto.Cipher import AES
from Crypto.Util.Padding import unpad
import base64


def my_crypt(
        data: str,
        key: bytes,
        iv: bytes
) -> str:
    encrypted_data = base64.b64decode(data)

    cipher = AES.new(
        key=key,
        mode=AES.MODE_CBC,
        iv=iv
    )

    decrypted_data = unpad(
        padded_data=cipher.decrypt(encrypted_data),
        block_size=AES.block_size
    )

    return decrypted_data.decode('utf-8')


if __name__ == '__main__':
    print(my_crypt(
        "wLflWLnjQtvqkFGnx4Jmc1hakJmiRdXMpSLnV5xZc3viU4zHpRC/k2WSDGrh96wmJN11yPXZgCA4CJJr1P+b1A==",
        '139323cde60cb1cabab94bfe1a8818d7'.encode(),
        'fb2ebeb90bb35816'.encode()
    ))

[brossmee]

Thank you, brother, but it’s not working for me; it doesn't return any results.

[larley]

Did you try it on the website?
It turns out that the AES key and IV change per video / php file. You can find the key and iv at the end of the php file

[brossmee]

I tried, but it didn't work. I want to extract the stream link from this URL:

https://www.elahmad.net/app_108/dh_2.php?id=840

. The link returns in an encrypted format, and I need to decrypt it. This link works in the application I attached, and the key does not change because the application connects to the link. The generated stream link returns as an encrypted code, which the application then decrypts and plays

<?php
// Initialize cURL session
$curl = curl_init();

// Set the URL
$url = "https://www.elahmad.net/app_108/dh_2.php?id=840";

// Set cURL options
curl_setopt_array($curl, [
    CURLOPT_URL => $url,
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_2_0,
    CURLOPT_HTTPHEADER => [
        "Host: www.elahmad.net",
        "encrypted: yes",
        "user-agent: elahmad-tv.com",
        
    ],
]);

// Execute the request
$response = curl_exec($curl);

// Check for errors
if (curl_errno($curl)) {
    echo 'Error:' . curl_error($curl);
} else {
    // Print the response
    echo $response;
}

// Close cURL session
curl_close($curl);


?>

[larley]

Did you even read my message? I said that it only works for the website.
I don't have time to disassemble an android app.

Why are you even trying to get the response from the app? The website offers the same channels