{ "version": "https://jsonfeed.org/version/1", "title": "Hack", "description": null, "home_page_url": "go/hack", "feed_url": "feed/hack.json", "items": [ { "author": { "url": "member/harry890829", "name": "harry890829", "avatar": "https://cdn.v2ex.com/avatar/c381/a98b/103528_large.png?m=1672838369" }, "url": "t/972883", "date_modified": "2023-09-12T00:17:28+00:00", "content_html": "\u4e00\u4e2a\u8001\u6e38\u620f\u7684\u79c1\u670d\uff0c\u4f46\u662f\u6211\u4e00\u4e2a\u624b\u673a\u73a9\u5bb6\uff0c\u5e73\u65f6\u53c8\u662f\u7528\u7684 mac \uff0c\u6240\u4ee5\u5bfc\u81f4\u6302\u673a\u975e\u5e38\u9ebb\u70e6\uff0c\u4e8e\u662f\u6709\u4e86\u60f3\u8981\u81ea\u5df1\u5199\u4e00\u4e2a\u7b80\u5355\u7684 client

\u76ee\u524d\u8fdb\u5ea6\u662f\u5df2\u7ecf\u4ece GameAssembly.dll \u4e2d\uff0c\u5df2\u7ecf\u89e3\u51fa\u6765\u4e86 Assembly-CSharp.dll
\u4ece\u9879\u76ee\u4e2d\uff0c\u5df2\u7ecf\u63d0\u53d6\u51fa\u52a0\u5bc6\u7684 lua \u811a\u672c\uff0c\u53d1\u73b0\u4e86\u4f7f\u7528\u5f02\u6216\u52a0\u5bc6\uff0c\u5e76\u4e14\u8fdb\u884c\u4e86\u89e3\u5bc6
\u901a\u8fc7\u9605\u8bfb lua \u91cc\u9762\u7684\u5185\u5bb9\u53d1\u73b0\uff0clua \u662f\u6e38\u620f\u5185\u5bb9\u7684\u6838\u5fc3\uff0c\u4f7f\u7528\u4e86 protobuf \uff0c\u4e0d\u8fc7\u5e76\u4e0d\u590d\u6742
\u53d1\u73b0 lua \u7ec4\u5305\u540e\uff0c\u5e76\u4e0d\u662f\u6700\u7ec8\u53d1\u9001\u7684\u8282\u70b9\uff0c\u8c03\u7528\u4e86 XNetMgr:SendBytes \u51fd\u6570
\u901a\u8fc7 Assembly-CSharp.dll \u4e2d\u7684\u504f\u79fb\u91cf\uff0c\u7528 idapro \u52a0\u8f7d GameAssembly.dll \uff0c\u627e\u5230\u5bf9\u5e94\u7684\u51fd\u6570

\u7b80\u5355\u4ee3\u7801\u5982\u4e0b\uff1a
//XNetMgr:SendBytes
__int64 __fastcall sub_1802EE980(__int64 a1, __int64 a2)
{
__int64 v4; // rbx
__int64 v5; // rcx

if ( !byte_18198A8A4 )
{
sub_1800AD520(20235i64);
byte_18198A8A4 = 1;
}
if ( !*(_QWORD *)(a1 + 16) )
{
v4 = ((__int64 (__fastcall *)(__int64))sub_1800F8640)(qword_1819C2058);
sub_18025EDB0(v4, 0i64);
*(_QWORD *)(a1 + 16) = v4;
}
v5 = *(_QWORD *)(a1 + 16);
if ( !v5 )
sub_1800E5F10();
return sub_18025EB90(v5, a2, 0i64);
}


__int64 __fastcall sub_18025EB90(__int64 a1, __int64 a2)
{
__int64 v4; // rax
__int64 v5; // r14
__int64 v6; // rcx
__int64 v7; // r15
__int64 v8; // r12
int v10; // [rsp+30h] [rbp-10h] BYREF
__int64 v11; // [rsp+40h] [rbp+0h]
__int64 v12; // [rsp+50h] [rbp+10h]
int *v13; // [rsp+60h] [rbp+20h]
int v14; // [rsp+68h] [rbp+28h]
char v15; // [rsp+B8h] [rbp+78h] BYREF

v12 = -2i64;
if ( !byte_181989FC6 )
{
sub_1800AD520(23908i64);
byte_181989FC6 = 1;
}
v15 = 0;
v13 = &v10;
v14 = -1;
v4 = qword_1819C2058;
if ( (*(_BYTE *)(qword_1819C2058 + 295) & 2) != 0 && !*(_DWORD *)(qword_1819C2058 + 216) )
{
il2cpp_runtime_class_init_0(qword_1819C2058);
v4 = qword_1819C2058;
}
v11 = **(_QWORD **)(v4 + 184);
v5 = v11;
v15 = 0;
sub_18099E060(v11, &v15, 0i64);
v6 = *(_QWORD *)(a1 + 16);
if ( v6 && (unsigned __int8)sub_18056C4B0(v6, 0i64) )
{
v7 = *(_QWORD *)(a1 + 24);
if ( !a2 )
sub_1800E5F10(0i64);
v8 = sub_1800F8640(qword_1819AA028);
sub_180E242C0(v8, a1, qword_1819BC580, 0i64);
if ( !v7 )
sub_1800E5F10(0i64);
(*(void (__fastcall **)(__int64, __int64, _QWORD, _QWORD, __int64, _QWORD, _QWORD))(*(_QWORD *)v7 + 600i64))(
v7,
a2,
0i64,
*(unsigned int *)(a2 + 24),
v8,
0i64,
*(_QWORD *)(*(_QWORD *)v7 + 608i64));
v14 = 0;
v10 = 94;
}
else
{
sub_18025E000(a1, 104i64, qword_1819DC270);
v14 = 0;
v10 = 94;
}
if ( v15 )
sub_18099E080(v5, 0i64);
return 0i64;
}



\u731c\u6d4b\u8fd9\u90e8\u5206\u4ee3\u7801\u4e3a\u53d1\u9001\u6838\u5fc3\uff0c\u4e0d\u8fc7\u8fd9\u79cd\u4f2a\u4ee3\u7801\u4e0d\u77e5\u9053\u8be5\u600e\u4e48\u770b\uff0c\u6216\u8005\u8bf4\uff0c\u600e\u4e48\u901a\u8fc7 idapro \u628a\u8fd9\u4e2a\u8fd0\u884c\u8d77\u6765\uff0c\u6211\u81ea\u5df1\u5355\u6b65\u5206\u6790\u4e00\u4e0b\uff0c\u5e94\u8be5\u80fd\u591f\u77e5\u9053\u8fd9\u4e2a\u4e1c\u897f\u662f\u600e\u4e48\u56de\u4e8b\u4e86

\u6c42\u6559\u4e00\u4e0b\u540e\u7eed\u5982\u4f55\u8fdb\u884c", "date_published": "2023-09-11T16:33:47+00:00", "title": "\u9006\u5411 u3d \u6e38\u620f", "id": "t/972883" }, { "author": { "url": "member/dongfanggege", "name": "dongfanggege", "avatar": "https://cdn.v2ex.com/avatar/34ce/c55e/539109_large.png?m=1617958322" }, "url": "t/922667", "title": "\u60f3\u5f97\u5230\u4e00\u4e2a\u8bba\u575b\u8d26\u53f7\uff0c\u5b98\u65b9\u4ef7\u683c\u592a\u8d35\u4e86", "id": "t/922667", "date_published": "2023-03-09T10:38:27+00:00", "content_html": "

https://xss.is/\nhttps://exploit.in/\n\u6c42\u4e2a ID \uff0c\u8c22\u8c22\uff0c\u8bf7\u81ea\u5df1\u5e26\u4ef7

\n
• https://www.appieid.unreos.xyz/app
\n
• https://www.apple.com.eosra.top
\n
• https://iphone.oresa.top
\n
• https://appleid.eosra.top/app
\n

\u9a97\u5b50\u53d1\u6765\u4ee5\u4e0a\u94fe\u63a5\uff0c\u5206\u6790\u7f51\u7ad9 server \u662f IIS \uff0casp \u9875\u9762

\n
• \u57df\u540d\uff1awhois \u67e5\u8be2\u4f7f\u7528\u7684\u4e09\u65b9\u673a\u6784\u6ce8\u518c\u7684\uff0c\u57df\u540d\u662f 1 \u6708 7 \u65e5\u6ce8\u518c\u7684\uff0c1 \u6708 8 \u53f7\u53d1\u7684\u77ed\u4fe1\uff0c\u52a8\u4f5c\u633a\u9ebb\u5229\u7684
\n
• \u5b50\u57df\u540d\uff1a\u626b\u63cf\u51fa\u6765\u4e00\u5927\u5806\uff0c\u6ca1\u4ec0\u4e48\u7528\uff0c\u4f1a\u91cd\u5b9a\u5411\u5230 IIS \u9ed8\u8ba4\u9875
\n
• IP\uff1a45.207.49.2
\n
• \u7aef\u53e3\uff1a88 \u3001443
\n

\u767b\u5f55\u6210\u529f\u4e4b\u540e\uff0c\u518d\u6b21\u8bbf\u95ee\u5176\u4e2d\u4efb\u610f\u4e00\u4e2a\u5730\u5740\uff0c\u5747\u91cd\u5b9a\u5411\u5230 qq.com \uff0c\u8fc7\u6bb5\u65f6\u95f4\u624d\u80fd\u8bbf\u95ee\uff0c\u731c\u6d4b\u6709\u7528\u6237\u767b\u5f55\u4e4b\u540e\uff0c\u4f1a\u9501\u5b9a\u5730\u5740\uff0c\u7b49\u5f85\u4ed6\u4eec\u5904\u7406\u9a8c\u8bc1\u6b63\u786e\u4e4b\u540e\u518d\u91ca\u653e\u94fe\u63a5\u3002

\u770b\u4e86\u4e24\u4e2a\u5e16\u5b50

\n
• https://knightyun.github.io/2021/09/04/exploit-take-down-swindle-website
\n
• https://zhuanlan.zhihu.com/p/26219701
\n

\u5361\u5728\u83b7\u53d6\u7ba1\u7406\u540e\u53f0\u754c\u9762\uff0c\u8be5\u7f51\u7ad9\u4f7f\u7528\u4e86 nginx \u4ee3\u7406\uff0c\u5730\u5740\u4e00\u76f4\u88ab\u91cd\u5b9a\u5411\uff0c\u7ad9\u70b9\u76ee\u5f55\u679a\u4e3e\u4e0d\u51fa\u6765\uff0c\u4e0d\u77e5\u9053\u8be5\u600e\u4e48\u83b7\u53d6\u540e\u53f0\u7ba1\u7406\u5730\u5740\uff0c\u6c42\u5927\u795e\u6307\u5bfc

\n