-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy pathapi_finder
More file actions
8 lines (5 loc) · 7.16 KB
/
Copy pathapi_finder
File metadata and controls
8 lines (5 loc) · 7.16 KB
1
2
3
4
5
6
7
8
$PName="olk"; $p=Get-Process -Name $PName -ErrorAction SilentlyContinue; if($p){ $tPid=$p[0].Id; $cls="MemScan_$(Get-Random)"; $cs="using System; using System.Diagnostics; using System.Runtime.InteropServices; using System.Text; using System.Text.RegularExpressions; using System.Collections.Generic; public class $cls { static HashSet<string> f = new HashSet<string>(); [DllImport(`"kernel32.dll`")] public static extern IntPtr OpenProcess(uint a, bool b, int c); [DllImport(`"kernel32.dll`")] public static extern bool ReadProcessMemory(IntPtr a, IntPtr b, byte[] c, int d, out int e); [DllImport(`"kernel32.dll`")] public static extern bool CloseHandle(IntPtr a); public static void Scan(int id) { IntPtr h=OpenProcess(0x0010|0x0400, false, id); if(h==IntPtr.Zero) return; long max=Process.GetProcessById(id).VirtualMemorySize64; int size=5242880; byte[] buf=new byte[size]; Regex r=new Regex(@`"https?://[a-zA-Z0-9\-.]+?:8443/[a-zA-Z0-9/\-?=_]+`", RegexOptions.IgnoreCase); Regex hr=new Regex(@`"(Authorization|X-[a-zA-Z0-9\-]+|Token|Cookie)\s*:\s*[a-zA-Z0-9\-._=+]{5,}`", RegexOptions.IgnoreCase); for(long i=0; i<max; i+=size) { int read=0; if(ReadProcessMemory(h, (IntPtr)i, buf, size, out read) && read>0) { string a=Encoding.ASCII.GetString(buf, 0, read); string u=Encoding.Unicode.GetString(buf, 0, read); if(a.Contains(`":8443`")) { foreach(Match m in r.Matches(a)) if(f.Add(m.Value)) Console.WriteLine(`"[`"+DateTime.Now.ToString(`"HH:mm:ss`")+`"] [URL] `"+m.Value); } if(u.Contains(`":8443`")) { foreach(Match m in r.Matches(u)) if(f.Add(m.Value)) Console.WriteLine(`"[`"+DateTime.Now.ToString(`"HH:mm:ss`")+`"] [URL] `"+m.Value); } if(a.Contains(`"Authorization`") || a.Contains(`"X-`") || a.Contains(`"Token`") || a.Contains(`"Cookie`")) { foreach(Match m in hr.Matches(a)) if(f.Add(m.Value)) Console.WriteLine(`"[`"+DateTime.Now.ToString(`"HH:mm:ss`")+`"] [Header] `"+m.Value); } if(u.Contains(`"Authorization`") || u.Contains(`"X-`") || u.Contains(`"Token`") || u.Contains(`"Cookie`")) { foreach(Match m in hr.Matches(u)) if(f.Add(m.Value)) Console.WriteLine(`"[`"+DateTime.Now.ToString(`"HH:mm:ss`")+`"] [Header] `"+m.Value); } } } CloseHandle(h); } }"; Add-Type -TypeDefinition $cs -Language CSharp; Write-Host "[*] 실시간 URL 및 헤더 감시 시작... (종료: Ctrl+C)" -ForegroundColor Cyan; while($true) { Invoke-Expression "[$cls]::Scan($tPid)"; Start-Sleep -Milliseconds 500 } } else { Write-Host "[-] $PName 프로세스를 찾을 수 없습니다." -ForegroundColor Red }
#전체 패킷 덤프
$PName="OUTLOOK"; $p=Get-Process -Name $PName -ErrorAction SilentlyContinue; if($p){ $tPid=$p[0].Id; $cls="MemDump_$(Get-Random)"; $cs="using System; using System.Diagnostics; using System.Runtime.InteropServices; using System.Text; using System.Text.RegularExpressions; using System.Collections.Generic; public class $cls { static HashSet<int> f = new HashSet<int>(); [DllImport(`"kernel32.dll`")] public static extern IntPtr OpenProcess(uint a, bool b, int c); [DllImport(`"kernel32.dll`")] public static extern bool ReadProcessMemory(IntPtr a, IntPtr b, byte[] c, int d, out int e); [DllImport(`"kernel32.dll`")] public static extern bool CloseHandle(IntPtr a); public static void Scan(int id) { IntPtr h=OpenProcess(0x0010|0x0400, false, id); if(h==IntPtr.Zero) return; long max=Process.GetProcessById(id).VirtualMemorySize64; int size=5242880; byte[] buf=new byte[size]; for(long i=0; i<max; i+=size) { int read=0; if(ReadProcessMemory(h, (IntPtr)i, buf, size, out read) && read>0) { string a=Encoding.ASCII.GetString(buf, 0, read); string u=Encoding.Unicode.GetString(buf, 0, read); Dump(a); Dump(u); } } CloseHandle(h); } static void Dump(string s) { int idx=0; while((idx=s.IndexOf(`":8443`", idx, StringComparison.OrdinalIgnoreCase)) != -1) { int start = Math.Max(0, idx - 200); int len = Math.Min(s.Length - start, 1200); string chunk = s.Substring(start, len); if(f.Add(chunk.GetHashCode())) { string clean = Regex.Replace(chunk, @`"[^\x20-\x7E\r\n]`", `".`"); Console.WriteLine(`"\n[====== Raw Memory Block ======]\n`" + clean.Trim() + `"\n[===============================]`"); } idx += 5; } } }"; Add-Type -TypeDefinition $cs -Language CSharp; Write-Host "[*] Raw 패킷 메모리 블록 감시 시작... (종료: Ctrl+C)" -ForegroundColor Cyan; while($true) { Invoke-Expression "[$cls]::Scan($tPid)"; Start-Sleep -Milliseconds 500 } } else { Write-Host "[-] $PName 프로세스를 찾을 수 없습니다." -ForegroundColor Red }
#API 단일 스캔 방식
$PName="olk"; $p=Get-Process -Name $PName -ErrorAction SilentlyContinue; if($p){ $tPid=$p[0].Id; $cls="MemScan_$(Get-Random)"; $cs="using System; using System.Diagnostics; using System.Runtime.InteropServices; using System.Text; using System.Text.RegularExpressions; using System.Collections.Generic; public class $cls { static HashSet<int> f = new HashSet<int>(); [DllImport(`"kernel32.dll`")] public static extern IntPtr OpenProcess(uint a, bool b, int c); [DllImport(`"kernel32.dll`")] public static extern bool ReadProcessMemory(IntPtr a, IntPtr b, byte[] c, int d, out int e); [DllImport(`"kernel32.dll`")] public static extern bool CloseHandle(IntPtr a); public static void Scan(int id) { IntPtr h=OpenProcess(0x0010|0x0400, false, id); if(h==IntPtr.Zero) { Console.WriteLine(`"[-] OpenProcess Error`"); return; } long max=Process.GetProcessById(id).VirtualMemorySize64; int size=5242880; byte[] buf=new byte[size]; Console.WriteLine(`"[*] Outlook (PID: `"+id+`") 메모리 스캔 중... (API Request 정밀 추출)`"); for(long i=0; i<max; i+=size) { int read=0; if(ReadProcessMemory(h, (IntPtr)i, buf, size, out read) && read>0) { string a=Encoding.ASCII.GetString(buf, 0, read); string u=Encoding.Unicode.GetString(buf, 0, read); Dump(a, `":8443`"); Dump(u, `":8443`"); Dump(a, `":8444`"); Dump(u, `":8444`"); } } CloseHandle(h); Console.WriteLine(`"[*] 스캔 완료.`"); } static void Dump(string s, string port) { int idx=0; while((idx=s.IndexOf(port, idx, StringComparison.OrdinalIgnoreCase)) != -1) { int start = Math.Max(0, idx - 600); string before = s.Substring(start, idx - start); int reqStart = -1; string[] mths = { `"POST `", `"GET `", `"PUT `", `"DELETE `", `"PATCH `", `"OPTIONS `" }; foreach(string m in mths) { int mIdx = before.LastIndexOf(m); if(mIdx > reqStart) reqStart = mIdx; } if(reqStart != -1) { int ast = start + reqStart; string req = s.Substring(ast, Math.Min(s.Length - ast, 3000)); Match match = Regex.Match(req, @`"^[^\x00-\x08\x0B-\x0C\x0E-\x1F\x7F]+`"); if(match.Success) { string fReq = match.Value.Trim(); if(fReq.Length > 10 && f.Add(fReq.GetHashCode())) { Console.WriteLine(`"\n---\n`" + fReq + `"\n---`"); } } } else { int httpIdx = before.LastIndexOf(`"http`", StringComparison.OrdinalIgnoreCase); if(httpIdx != -1) { int ast = start + httpIdx; string req = s.Substring(ast, Math.Min(s.Length - ast, 1000)); Match match = Regex.Match(req, @`"^[^\x00-\x08\x0B-\x0C\x0E-\x1F\x7F]+`"); if(match.Success) { string fReq = match.Value.Trim(); if(fReq.Length > 10 && f.Add(fReq.GetHashCode())) { Console.WriteLine(`"\n---\nhttps://www.only.com/ `" + fReq + `"\n---`"); } } } } idx += port.Length; } } }"; Add-Type -TypeDefinition $cs -Language CSharp; Invoke-Expression "[$cls]::Scan($tPid)" } else { Write-Host "[-] $PName 프로세스를 찾을 수 없습니다." -ForegroundColor Red }