yazigegeda Expert Cheater
Reputation: 0
Joined: 22 Jan 2019 Posts: 183
|
Posted: Tue Jun 18, 2024 1:50 am Post subject: |
|
|
| yazigegeda wrote: | | Dark Byte wrote: | | try getURL instead of postURL |
But I want to request the website needs to use post mode, so really can? I don't know the getURL way to fill in the postURL parameters |
Okay, so now I've got a hook and his tests are working :lol:
function:
| Code: |
local PAGE_NOACCESS , PAGE_WRITECOPY , PAGE_READONLY , PAGE_READWRITE , PAGE_EXECUTE , PAGE_EXECUTE_WRITECOPY , PAGE_EXECUTE_READ , PAGE_EXECUTE_READWRITE = 0x01 , 0x08 , 0x2 , 0x4 , 0x10, 0x80 , 0x20 , 0x40
function NtProtectVirtualMemory(p1,p2,p3,p4,p5) -- ,{0,p1},{0,p2}
return executeCodeLocalEx('ntdll.NtProtectVirtualMemory',{0,p1},{0,p2},{0,p3} ,{0,p4},{0,p5})
end
function setHookRequestHeaders( p1 , p2 )
MS_codes = createMemoryStream()
MS_codes.Size = 255
local MS = createMemoryStream()
MS.Size = 0x40
local pBaseAddress , pSize , poldpro = MS.Memory , MS.Memory+8 , MS.Memory+0x18
WriteQwordLocal( pBaseAddress , MS_codes.Memory )
WriteQwordLocal( pSize , 255 )
NtProtectVirtualMemory( -1 , pBaseAddress , pSize , 0x40 , poldpro )
MS.destroy()
local HttpSendRequestA_addr = getAddress( 'wininet.HttpSendRequestA' , true )
copyMemory( HttpSendRequestA_addr , 0xF , MS_codes.Memory , 3 )
local ops , temp , temp2 = { 0x48 , 0xBA } , qwordToByteTable( p1 ) , dwordToByteTable( p2 )
for i = 1 , #temp do
table.insert( ops , temp[i] )
end
table.insert( ops , 0x41 )
table.insert( ops , 0xB8 )
for i = 1 , #temp2 do
table.insert( ops , temp2[i] )
end
table.insert( ops , 0xFF )
table.insert( ops , 0x25)
table.insert( ops , 0x00 )
table.insert( ops , 0x00 )
table.insert( ops , 0x00 )
table.insert( ops , 0x00 )
taroffset = qwordToByteTable( HttpSendRequestA_addr + 0xF )
for i = 1 , #taroffset do
table.insert( ops , taroffset[i] )
end
WriteBytesLocal( MS_codes.Memory + 0xF , ops )
-- print( string.format("HttpSendRequestA_addr %X", HttpSendRequestA_addr ))
--print( string.format("MS_codes.Memory %X", MS_codes.Memory ))
ops = {}
table.insert( ops , 0xFF )
table.insert( ops , 0x25 )
table.insert( ops , 0x00 )
table.insert( ops , 0x00 )
table.insert( ops , 0x00 )
table.insert( ops , 0x00 )
taroffset = qwordToByteTable( MS_codes.Memory )
for i = 1 , #taroffset do
table.insert( ops , taroffset[i] )
end
WriteBytesLocal( HttpSendRequestA_addr, ops )
end
function delHookRequestHeaders()
local ori = readBytesLocal( MS_codes.Memory , 0xF , true)
WriteBytesLocal( 'wininet.HttpSendRequestA' , ori )
MS_codes.destroy()
end
|
demo:
| Code: |
local MS = createMemoryStream()
MS.Size = 0x1000
local pheaders = MS.Memory
local Headers = 'Content-Type: application/x-www-form-urlencoded\r\n'..
'Referer: https://.....\r\n'
WriteStringLocal( pheaders , Headers )
setHookRequestHeaders( pheaders , #Headers )
dom = int.postURL( url , json... )
delHookRequestHeaders()
MS.destroy()
|
|
|