Leak Society - The Home Of Nulled Resources.
Forum Beta v1 Now Live!
[Discussion] How do I calculate what a function in the backend of a web-service doing
Thead Owner : OroGlutik, Category : Tutorials & Information, 0 Comment, 787 Read
Viewers: 1 Guest(s)
Junior Member
**
1
Messages
1
Threads
0
Rep
4 Years of Service
11-17-2019, 06:06 PM
#1
Hey guys, I hope your day is going well. 
This is my first post here and I am not very well versed in asking technical questions, so please go easy on me.

I am trying to crack this bot for the android game 'Lords Mobile'. The bot can be found and downloaded from lordsbot.com

It's a very good bot. Instead of running the gui of the game, it just gets the data and sends the commands to get shit done, automating the whole game and opening some earning opportunity.
The Problem: The bot is paid and the owner does not reply on the email address given on website. The website asks to pay via btc but I aint doing that.

The exe file of the bot has been obfuscated using .netreactor [4.8-4.9] AND DNGuard (according do DetectItEasy). I tried tried tried and I tried even more, but my skill level aint high enough to deobfuscate that shit.

So I turned to one of my favorite tools: FIDDLER. Basically it works as a transparent reverse proxy, monitors all the traffic (like wireshark) and can also automatically change the url or the request/response body based on rules you set. It's pretty fucking awesome.

Turns out, the bot is accessing a webservice located at http://service1.lordsbot.com/MyBotServicesEn20181102. It's a soap based service (which I know nothing about). It seems to send a soap request with my computer's uuid and calls a function named 'ctct' with some content. The content is encoded in Base64 using UTF-16 and upon decoding, turns out to be a chinese string that google can't translate.

THE PROBLEM: The request and response is unique every time. I can't feed the application same response every time, it doesn't work. I can't read the source code of the client because it's been obfuscated using 2 obfuscators too good for me to decode and the function it calls every 2 minutes is hiding behind a cloudflare security. 

Here is a sample request and response packet.

REQUEST:
POST http://service1.lordsbot.com/MyBotServicesEn20181102 HTTP/1.1
Content-Type: application/soap+xml; charset=utf-8
Host: service1.lordsbot.com
Content-Length: 1452
Expect: 100-continue
Accept-Encoding: gzip, deflate
Connection: Keep-Alive

<s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:a="http://www.w3.org/2005/08/addressing"><s:Header><a:Action s:mustUnderstand="1">http://tempuri.org/IService/cgcg</a:Action><a:MessageID>urn:uuid:d0d3607c-4a61-4532-88f6-6324fbe14cb8</a:MessageID><a:ReplyTo><a:Address>http://www.w3.org/2005/08/addressing/anonymous</a:Address></a:ReplyTo><a:To s:mustUnderstand="1">http://service1.lordsbot.com/MyBotServicesEn20181102</a:To></s:Header><s:Body><cgcg xmlns="http://tempuri.org/"><content>NzkxMDI0ZWNiZDlkZGYxOTM5MDQwMDNiYmI3MjNiYmM0MDM3ZWEwMTc0MDRjYTEyOWUyYWI5MTNhMDM2NzNmOTY2NTZjYzkwOTFlM2UwMWU5Yjc2ZjAyZDljZDUyMTdhYTBjZDc5YjFmOTcwMTE4N2ZmYmI3MmFmMTg1MjhjNzUzN2QwNGY1ODUxYjQ0ZmZmNDc0ZDhhZmE1N2VhMGMyNzZkNWEyNmU3YzdiMWJmMmQzNzY4ZjFmYjJhYTE3YWM4OTJmOGNlMjdjMTJlMDczZGIzNWVjMjE4ODA2OTU5NWMyMzI3OTVlOTczNWRkYTEyOGM0YjQ4N2E3ZDY0ODQwOGI1MjM5NjQ4ZmI0Yjk5NTdwVXM0NDRNNVpnWG1KVFdpYzY3aWVxandJQjZvUGVhTzZZbC81alEyYjdUS2VULzhrWmprdHFUQUZPVlUxSDFBUzBjQjBaUkxISWM4b2RwMko0WWYxYWpReWE5MmY4VVhlNVlqbzFycWppaW92bGE5MG9GSHM3T0JzODlQcWlNRHhxVlJRcytZancrSk01RTlwNEFlV1ZxNTI4ZS9kdE9iWHp5RGFPM3RkUXZXT0tUbTVieTBaK29JRldKcWtXVHNNRXllN2V6RUozQStQMVpmZlVFVG9DODBrRm9tUUsvT1FySkVZVWxmYWJROUpGZ1pMbjd4d0REN1BOcmV6a1hGS3YwS1VRNUhhR0Y1SitWU1pqNUk2TjFqeDhsd0t1cDJPdWRDMVZPSnRrV3M0VEVWajdKZWN6OGxQNytTVnc2Y1NHUDVKbVNydG9VMW5LSEczQ0dSYkIwdW5jU1czWEdGVXlwY1Z4U2U4dU9xSkVEQzF5NXVQRjNTYTJDQ0F6Tlo1cmE4TVdla05JR3VvVVZGVVJDRXV3PT0=</content></cgcg></s:Body></s:Envelope>



RESPONSE:

HTTP/1.1 200 OK
Date: Sun, 17 Nov 2019 18:04:11 GMT
Content-Type: application/soap+xml; charset=utf-8
Content-Length: 1244
Connection: keep-alive
Set-Cookie: __cfduid=d562d19718314e6ac9e9f278931d915f41574013850; expires=Mon, 16-Nov-20 18:04:10 GMT; path=/; domain=.lordsbot.com; HttpOnly
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 5373a026e8b3c615-KHI

<s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:a="http://www.w3.org/2005/08/addressing"><s:Header><a:Action s:mustUnderstand="1">http://tempuri.org/IService/cgcgResponse</a:Action><a:RelatesTo>urn:uuid:d0d3607c-4a61-4532-88f6-6324fbe14cb8</a:RelatesTo></s:Header><s:Body><cgcgResponse xmlns="http://tempuri.org/"><cgcgResult>NzQ0MDYwMzdlZWU3MDBCZDExODU0NjU0ODZCMWVmOGQ0QmUxNTExQjg2QjJBQjBBZEEwMjY1ZjllNWUwM0E4NDk3MDhmMTNmN0IxOTk3ZEE5NUIyZkI3ZGY3NzEwOEFmN2Q1N2QwQTg1QjQxNkIzMkNDQTkwMjg2NUM4QTMxQjQ3MzE2ZmRmMmVCQjZlZGQ0QzgzRTZkNTYzODM0RUU1ZGQ5ZUFmZjhCODVBMWVDZjk5NDIzNTNkZWRBZEFmZmYyN2QyQjkwNWQ1OTA1NEE0QTQxMzU0Mzc1NjRkOUNCNzExQzQ3OGQyQUFDQkFBQ0M4ZDUwMkVkNkI2QmY0NjhlMjdBQ2RDM0E0QjBkNzhDODNlMEpER1lYa0xHL2tBNW9KNFVPZnVXUFlqL3h2V2FuVHg5ZllxbHlWMmJ3VkRWSDNwdGlSVGtBVmFCUm94NUtlWnljUW1QcFUxM0hWSyszWHRZQXVmRE1zcVQyRHc5MHpGMjBORmhRalUwNjV5TmQ3RnVwLzFwZmhpeDdmR21Qa3ZyNVRxc01JT1ZXN1ZocFR3S1IvelBlZDgzSlVPRUJIMmFWbStZc016YzlGbHR3bXB2Z0ZGVjZ3aEcrM0tSRXpzcVVJN1dLU3Z0UE9rbStkOTlkSkVJS24ycTRIWG1qTlEyYnRVNEdueUtWbGZoQ0ZxVVhoVXlUWXRZWUhsZXQ3MFM2bE5uekp1ZzFkUWl0ek1JRjZOQWFlemVKRldpN0s4OTdQQnlMd3k3YjJxbFJrV1JxMkovempHL0RZWWtDR0w3SEczVk9JdEp4aXM2dzB0d2p2QS9qVVlxUFE2UEpueGlHNXQ4dVJoU0k9</cgcgResult></cgcgResponse></s:Body></s:Envelope>

Any help would be appreciated. Please let me know if you need any more information.


Messages In This Thread
[Discussion] How do I calculate what a function in the backend of a web-service doing - by OroGlutik - 11-17-2019, 06:06 PM

Forum Jump: