yml2213
b06a768eb2
- hook_ssl_magic.js: SSL_write明文扫魔数, 命中即全量dump+杀进程 - 捕获: 3798B POST (hyudbwebuif/dfpReport, tReq tag1=[10B魔数]+3531B密文) - 触发: 清turing状态重注册 (备份tar零副作用) - 动态插件定位: libturingmfa.so(v87)/libturingga.so(v2.92.2) - evidence/dfp_live/ 存档; docs §11.47
40 lines
1.4 KiB
JavaScript
40 lines
1.4 KiB
JavaScript
'use strict';
|
|
function emit(row) { try { send(row); } catch (e) {} }
|
|
function btOk() {
|
|
try {
|
|
return Thread.backtrace(this.context, Backtracer.ACCURATE).slice(0, 10).map(a => {
|
|
const m = Process.findModuleByAddress(a);
|
|
return m ? m.name + '!' + a.sub(m.base) : a.toString();
|
|
}).join(' <- ');
|
|
} catch (e) { return ''; }
|
|
}
|
|
const PREF = [0x57, 0x18, 0x82, 0xcf];
|
|
let fired = false;
|
|
for (const mod of Process.enumerateModules()) {
|
|
let addr = null;
|
|
try { addr = mod.getExportByName('SSL_write'); } catch (e) {}
|
|
if (addr === null) continue;
|
|
Interceptor.attach(addr, {
|
|
onEnter(args) {
|
|
if (fired) return;
|
|
const buf = args[1];
|
|
const num = args[2].toInt32();
|
|
if (num < 40) return;
|
|
try {
|
|
const b = buf.readByteArray(1 << 20 > num ? num : num); // 尽量读
|
|
const u = new Uint8Array(b);
|
|
for (let i = 0; i + 4 < u.length; i++) {
|
|
if (u[i] === PREF[0] && u[i+1] === PREF[1] && u[i+2] === PREF[2] && u[i+3] === PREF[3]) {
|
|
fired = true;
|
|
const n = Math.min(num, 12000);
|
|
const hex = Array.from((new Uint8Array(buf.readByteArray(n)))).map(x => x.toString(16).padStart(2, '0')).join('');
|
|
emit({ event: 'ssl-magic', module: mod.name, num, off: i, full: hex, bt: btOk() });
|
|
return;
|
|
}
|
|
}
|
|
} catch (e) {}
|
|
},
|
|
});
|
|
emit({ event: 'ssl-hook', module: mod.name });
|
|
}
|