DigiExaminator

Summary

DigiExam is a tool for teachers to give students a secure environment to write tests in. DigiExam tries to close all non-essential programs on exam start, and if it detects any suspicious user activity it locks the exam and informs the teacher. The program is made in electron, and is therefore available for linux, mac and windows. As I use a windows machine these methods might only work on that platform.

Tools used

Node.js as the primary programming language
Asar addon for 7zip for unzipping the source code

Exploits

"External" method

As I wrote earlier DigiExam closes non-essential programs during exams. However, when a new program is started during the test it is able to run for ~1s before being closed again, and after DigiExam detects this it never locks down the exam. This leaves us with two sub-problems:

Find a way to execute a custom script even with DigiExam running
Make the script that can interact with DigiExam

The first problem can be solved either by using a service (as services are not killed by DigiExam) that starts your script through Windows Task Scheduler, or by replacing utilman.exe with your script and have it activated when shift is pressed 5 times in a row. I prefer the second method as it is fully controlled by the user.

The second problem can be solved by injecting characters using the window APIs emulated keystrokes. Basically it looks like the user is writing the text, while it is in fact the script. The script writes about 20 characters per second, so it is not ideal for longer texts as the user will have to spam the shift key to restart the script again, but it works as a proof of concept.

This method is limited to copy/pasting functionality, which might not be so useful unless you had the ability to write the text beforehand.

"Internal" method

This method involves editing the source code of the application itself. By extracting "app.asar" in "C:\Users\[username]\AppData\Local\DigiExam\app-[version_number]\recourses\" you can find the source code. Fortunately electron looks in the newly extracted "\app" folder before the "\app.asar" file, meaning that we can edit the source code and see the results directly, instead of having to convert it back to ".asar". As all javascript files were heavily obfuscated I was unable to edit the code, but it was still possible to inject new code into the script.

By connecting a keyboard-shortcut to the visibility of a webview element displaying google.com, it was possible to go to any website from DigiExam. This continued to work even within the exam, or at least I thought so until I tried to start an online exam, when I was greeted with a message correctly claiming that the program was modified. As it turns out DigiExam does a file signature comparison to verify that the code has not been modified.

This check is only made when the exam is started, and NOT when DigiExam is launched. This meant that I could have a modified version of DigiExam loaded at startup, and quickly replaced with the real DigiExam script shortly after. This is all done automatically by my modified version of DigiExam.

Result

Here are the files:

File size: 88.2MB

digiexaminator.zip

Back to top