{"id":18829448,"url":"https://github.com/adeadfed/net-framework-prng-oracle","last_synced_at":"2025-07-23T00:04:23.682Z","repository":{"id":204174708,"uuid":"711258977","full_name":"adeadfed/net-framework-prng-oracle","owner":"adeadfed","description":"PoC code for predicting the output a default PRNG constructor in .NET Framework based on a known output.","archived":false,"fork":false,"pushed_at":"2023-10-28T18:41:14.000Z","size":7,"stargazers_count":1,"open_issues_count":0,"forks_count":0,"subscribers_count":1,"default_branch":"main","last_synced_at":"2025-05-29T15:41:47.398Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"C#","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/adeadfed.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2023-10-28T17:29:26.000Z","updated_at":"2025-05-11T01:33:27.000Z","dependencies_parsed_at":null,"dependency_job_id":"562b9be0-f37d-4389-87e2-0128d5a85b92","html_url":"https://github.com/adeadfed/net-framework-prng-oracle","commit_stats":null,"previous_names":["adeadfed/net-framework-prng-oracle"],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/adeadfed/net-framework-prng-oracle","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/adeadfed%2Fnet-framework-prng-oracle","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/adeadfed%2Fnet-framework-prng-oracle/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/adeadfed%2Fnet-framework-prng-oracle/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/adeadfed%2Fnet-framework-prng-oracle/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/adeadfed","download_url":"https://codeload.github.com/adeadfed/net-framework-prng-oracle/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/adeadfed%2Fnet-framework-prng-oracle/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":266592179,"owners_count":23953109,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-07-22T02:00:09.085Z","response_time":66,"last_error":null,"robots_txt_status":null,"robots_txt_updated_at":null,"robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-11-08T01:44:50.619Z","updated_at":"2025-07-23T00:04:23.655Z","avatar_url":"https://github.com/adeadfed.png","language":"C#","funding_links":[],"categories":[],"sub_categories":[],"readme":"# net-framework-prng-oracle\nThe default `Random()` constructor in .NET Framework applications is [seeded](https://learn.microsoft.com/en-us/dotnet/api/system.random.-ctor?view=net-7.0) with machine's `TickCount` value -- milliseconds since boot.\n`TickCount` is an unsigned 32-bit integer and can only have `4,294,967,295` possible values.\n\nIf you know the source code of the algorithm, it is possible to predict its result at any given point of time by obtaining the\noutput at point `X`, brute-forcing the associated `TickCount` seed value `A`, and then computing seed value `B` like so:\n\n```\nB = A + (Y - X)\n```\nKnowing seed value `B`, we can run the algorithm normally to obtain the desired result, e.g. a newly generated \"random\" password.\n\nSince the default seed is bound to the milliseconds since the server's boot, this value is bound to be low if the machine is restarted often.\n\nThe provided code serves as an example attack on a password reset code that uses weak `Random()` function to generate its output. \nYou can see full article describing this attack [here](TODO: edit me). Nonetheless, this type of attack is applicable to any algorithm that uses\nPRNG `Random()` to generate its output.\n\n### PoC\n```\n[!] Parsed PRNG results: [\n        \"Timestamp: \"4/21/2022 8:59:12 PM\"; Result: \"!CJ.4nFHmYZ*\"; Seed: -1\"\n]\n[!] Parsed victim PRNG result timestamp: \"4/21/2022 11:11:35 PM\"\n[!] Brute-forcing Random() seeds for the results\n[*] [20:21:55] Result: \"!CJ.4nFHmYZ*\"; 0.00% done. 0 values processed\n[*] [20:22:15] Result: \"!CJ.4nFHmYZ*\"; 0.39% done. 16,777,216 values processed\n[+] [20:22:30] Result: \"!CJ.4nFHmYZ*\"; Found! Seed: 29774936\n[!] Generating possible results in a 2 second window\n[*] Attacker's timestamp: \"4/21/2022 8:59:12 PM\"; Victim's timestamp: \"4/21/2022 11:11:35 PM\"; Offset in milliseconds: 7943000\n[*] Computed victim's seed value: 37717936 +- 2000 milliseconds\n[+] Possible results saved to C:\\Users\\Administrator\\Desktop\\projects\\net-framework-prng-oracle\\PrngOracle\\PrngOracle\\bin\\Debug\\net6.0\\results.txt\n[+] Done! Happy hacking!\n```","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fadeadfed%2Fnet-framework-prng-oracle","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fadeadfed%2Fnet-framework-prng-oracle","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fadeadfed%2Fnet-framework-prng-oracle/lists"}