要使用本教程的方案,你需要一些基础知识:

1、web服务器搭建
2、ngix/apache静态页面
3、基础的linux知识
4、ssl证书签发
需要的条件:
1.一台基于linux的主机或者云服务器
2、开放80端口的公网ip(非必须)
3、一台基于openwrt或其他开放系统ssh的路由器

那么现在开始教程:
先说下实现的原理,为了研究思路,博主花了800多块买了终身会员,通过在虚拟机里面安装emby并网卡抓包以及f12查看源码发现:
当我们使用、注册会员功能时,我们的客户端会向mb3admin.com发送带有设备id和激活码的请求,服务器返回设备已激活的信息,客户端收到信息后启用会员功能,这也就是我们在没有网络的情况下无法使用离线转码等会员功能的原因。
通过抓包发现,主要会从以下几个地方发送请求:

1、mb3admin.com/admin/service/registration/getStatus

这个连接主要用于获取会员状态:

因为我是终身会员,所以输出:

2、mb3admin.com/admin/service/registration/validate

这个用于获取会员过期日

3、mb3admin.com/admin/service/registration/validateDevice

这个是验证设备

因为服务器端返回的信息都是明文,所以我们有两种思路:

1是重放攻击,原理是将服务端返回的信息截取收集,然后需要验证的时候广播给客户端
2是直接搭建一个假的mb3admin.com网站,把原本向mb3admin.com的流量导向我们的假网站

然后你会发现第一种思路基本行不通,因为连接使用了https,在https,每个socket连接都会验证证书,交换密钥。攻击者截获请求,重新发送,因为socket不同,密钥也不同,要用这种发送估计就需要中间人攻击?

那么我们现在做的就是搭建一个假的mb3admin.com

可以搭建在本地,也可以搭建在服务器端
服务器需要安装apache/ngix,openssl,配置静态
搭建web和配置静态自行寻找教程,比如我的博客就不是html静态页,因为没必要弄

弄成静态页面你就看不到那个php了

由于服务器太贵了,博主的服务器昨天宕机,今天下午才修好,并且国内服务器绑域名还要备案(我们这不需要绑),所以本教程主要讲如何在本地建服务器并实现https访问

首先在本地一台linux主机上搭建好web,并安装openssl签发根证书,使用根证书签发好mb3admin.com证书,如果不会就百度线上证书签发,签发后把证书安装到你的电脑上的受信任的根证书签发机构。

nginx的配置参考:http://nginx.org/en/docs/http/configuring_https_servers.html

在路由器上使用dns工具或者直接把客户端的那台机器的hosts里面添加web主机的ip mb3admin.com
比如我这里web主机的ip是192.168.1.123,在hosts里面添加:
192.168.1.123 mb3admin.com

伪静态写法(其实就是照抄抓包返回的值):mb3admin.com/admin/service/registration/validateDevice返回值:{“cacheExpirationDays”: 7,”message”: “Device Valid”,”resultCode”: “GOOD”}
默认是7天一个轮回,可以把这个值改高点,免得回回验证
mb3admin.com/admin/service/registration/getStatus返回:{“deviceStatus”:””,”planType”:””,”subscriptions”:{}}

mb3admin.com/admin/service/registration/validate返回:{“featId”:””,”registered”:true,”expDate”:”2020-07-07″,”key”:”abcdefg29achijklmn0c598opqrst1e7″}

json写法参考:https://www.runoob.com/js/js-json.html

博主原本想直接在路由器openwrt上搞个web页,但由于博主使用lede的源码编译了openwrt,由于源码问题,反正搞了好久都装不上ssl和apache,于是放弃了

后续补充,博主已经靠自己签发根证书,然后用根证书签发mb3admin.com证书实现emby crack,并且重新编译openwrt,在路由器搭建了假站
配置如下:

location /admin/service/registration/validateDevice
  return 200 '{"cacheExpirationDays": 3650,"message": "Device Valid (limit not checked)","resultCode": "GOOD"}';

location /admin/service/registration/validate 
  return 200 '{"featId": "","registered": true,"expDate": "2099-01-01","key": ""}';

location /admin/service/registration/getStatus 
  return 200 '{planType: "Lifetime", deviceStatus: 0, subscriptions: []}';

location /admin/service/appstore/register 
  return 200 '{"featId": "","registered": true,"expDate": "2099-01-01","key": ""}';

location /emby/Plugins/SecurityInfo 
  return 200 '{SupporterKey: "", IsMBSupporter: true}';

注意跨域访问的问题:

    add_header Access-Control-Allow-Origin *;
    add_header Access-Control-Allow-Headers *;
    add_header Access-Control-Allow-Method *;
    add_header Access-Control-Allow-Credentials true;

所有评论(3)

  1. admin说道:

    This message is used to verify that this feed (feedId:72854100118189056) belongs to me (userId:72849683151441920). Join me in enjoying the next generation information browser https://follow.is.

  2. BrutalForce is a one hundred pc secure, legal steroid various, with no injections or unwanted effects.
    We do not endorse supraphysiological dosages or the utilization of testosterone with no prescription.
    Sure, on this instance, we are going to progressively decrease a affected person’s dose
    to attenuate opposed effects upon discontinuation. The worth of testosterone alternative therapy can range, depending
    on the kind of ester prescribed and if a patient has insurance coverage.

    On common, our patients pay $100 per 30 days for testosterone cypionate.
    As An Alternative, a SERM like Nolvadex can be utilized, serving to to dam estrogenic exercise directly
    within the breast tissue (8).
    I didn’t feel much totally different other than a little stronger in the fitness center.
    Now, for the third week on D-Bal, there are significant will increase in energy across the board and more
    mass achieve. I have two weeks left on it,
    and I do not know how far more I can acquire. This is the place
    a post-cycle remedy plan is crucial, with SERM drugs like Nolvadex and Clomid being essential to
    have on hand, able to go. These medication speed up your testosterone
    restoration and efficiency while ranges are starting to get again to normal naturally.
    Dianabol’s aromatase activity is average compared
    to many other steroids.
    This makes Masteron a compound that fits this technique perfectly, perhaps more than some
    other compound, particularly if retaining the libido is
    essential to you. The starting of the taper stage is when you must
    use a SERM if you’ve determined to use one.
    Nonetheless, this is not a crucial requirement, so it comes down to your needs and preferences.
    Research either means have found that there’s no suppression of the HPTA
    when utilizing a SERM with testosterone at low doses or with out utilizing
    a SERM at low testosterone doses23. Therefore, tapering can be profitable whether you utilize
    a SERM or not.
    Nonetheless, it’s nonetheless infamous for causing fluid retention, which supplies you a bloated look
    – not solely in your physique but usually across the
    face. This bloating can come on very suddenly –
    usually in a single day – and supplies a telltale signal to other folks that you’re utilizing steroids.

    The suppression of testosterone makes it too high risk, and this is why, at a bare
    minimal, Dbol should at all times be cycled with a minimum of a testosterone compound
    like testosterone enanthate. Cycle size, regardless of whether it’s Dbol only or a stack, I always restrict use to six weeks.
    I’ve heard of guys using Dianabol for longer cycles, however you
    better watch out for your liver values closely. Dianabol is considered one of
    the only AAS males who can run as a sole compound and not
    using a testosterone base if you do things properly.
    EQ has relatively gentle aspect effect risks compared to the
    extra highly effective steroids on the market. This means it is well tolerated by most women and men when used at lower doses.

    The greater your dose of EQ, the upper the risk of unwanted effects and the more
    extreme they can be. There are many more highly suppressive steroids out there
    than this one.
    If you’re contemplating a first bodybuilding cycle, it’s essential to prioritise your well
    being and select steroids that may provide noticeable outcomes whereas
    minimising potential hurt to your physique. It will increase free testosterone levels,
    making muscle achieve extra noticeable, rising power, and burning fat.
    For a beginner, it is a wonderful approach to begin an efficient
    first steroid cycle. With this blog, you must now understand what the most effective first
    time steroid cycles are and what novices should start their steroid cycles with.

    Equipoise can crash your estrogen (relevant to males) if you’re not cautious.

    Utilizing a high EQ dose and solely a low testosterone dose may
    cause havoc with estrogen ranges as a result of EQ having AI-like effects.
    You won’t necessarily feel horrible, and getting blood
    is needed to substantiate low estrogen. Left unchecked, signs like fatigue/lethargy, low
    libido, and melancholy can develop. This can be began as quickly as your cycle ends with dosing based on your preference, but I often goal for 1000iu per week (two injections).

    This is the opposite of what we ought to be feeling – higher psychological readability
    and more rest. Individual response, HGH quality, dosage, and onerous weight-reduction plan are
    all potential culprits of elevated tiredness and different surprising unwanted facet effects.
    Low doses of HGH could be very effective for the brand new
    consumer or those just eager to expertise some benefits
    (like better pores and skin, hair, recovery, and sleep) without going overboard.
    2iu is a wonderful introduction to HGH and can let you consider the benefits and disadvantages.
    The healing, restore, and progress of connective tissue is a side of HGH that makes it interesting
    to those without an interest in bodybuilding. These potential anti-aging results
    have led many where to Order steroids online
    suppose HGH might be useful in slowing down some inevitable declines in collagen manufacturing as we age.

  3. By understanding secure utilization tips and integrating Anavar right into a complete health routine, people can harness its full
    potential to achieve their health and efficiency aspirations.
    Bear In Mind, responsible usage and knowledgeable decision-making are paramount to reaping the benefits of Anavar with
    out compromising overall health and well-being.
    The testosterone impression tale for anabolic steroids, together with Anavar, is a bit topsy-turvy.

    Power, endurance, stamina, and recovery are
    all enhanced with Anavar. Anavar just isn’t in high provide on the black market, and prescription Oxandrolone could be hard to get and quite
    costly. Even black market versions will price excess of most oral
    steroids. It isn’t uncommon for a 5-10mg Oxandrolone tab to price $1-$4 per tab,
    the place steroids like Dianabol can simply be discovered for a couple of
    cents on the dollar per 10mg tab. Girls ought to tell their
    health care supplier immediately if they’ve adjustments
    whereas taking oxandrolone, such as a deeper voice or more physique hair.
    Your well being care supplier can help decide if you ought
    to stop taking oxandrolone or proceed therapy.
    Anavar just isn’t the most suppressive steroid, however your pure testosterone manufacturing is more probably
    to have taken successful. This can cause signs of low testosterone when your cycle ends, together with loss of muscle and fat achieve.
    If you haven’t any present kidney issues,
    using low doses and short cycles of Anavar is unlikely
    to trigger kidney injury. Still, if you use excessive doses and long cycles, you’ll be placing your kidneys –
    and other organs – at nice danger of hurt.
    It is likely these attainable impacts solely affect people who use HGH at very excessive inappropriate doses and shouldn’t affect the average user.

    HGH is legally used in medicine to treat some situations regarding progress.

    Still, in terms of efficiency enhancement or bodybuilding, it is not authorized
    to acquire or use without a prescription. In the US, HGH just isn’t listed in the identical means that anabolic steroids are,
    but it’s still banned to be used exterior medical settings and in competition. Most customers, particularly males, will be stacking
    HGH with anabolic steroids that come with a a lot larger well being and security risk.

    The best steroid Company steroids for ladies are basically the compounds that do not produce virilization effects.

    During the recovery period, customers might experience fatigue, low mood, and decreased libido
    post-cycle. Whereas earlier research has mentioned potential liver-related unwanted effects with oxandrolone use, there are significant issues with
    the present information obtainable. These issues make it
    exhausting for doctors to understand how common or extreme these unwanted effects really are.
    One drawback is that different research outline
    liver problems and elevated liver enzymes in several ways.
    Additionally, many studies have only looked at a small variety of sufferers, and just
    one research has focused particularly on liver issues as the
    main level of study.
    Anavar’s low androgenic index makes these side
    effects far much less frequent and is particularly beneficial
    for people sensitive to androgens, including girls. This
    profile makes Anavar one of the few anabolic steroids safely tolerated by female athletes when used responsibly (Basaria, Journal of Gerontology).
    Bodybuilders, weightlifters, and athletes typically use Anavar without medical approval to increase muscle mass,
    bodily energy, and stamina. Anavar is a mild anabolic steroid that’s used for bulking and slicing functions.
    Males customers usually stack Anavar with different anabolic steroids to get more practical results.

    Should immunoassay outcomes return positive, confirmatory
    testing is employed. Strategies like Gas Chromatography/Mass
    Spectrometry (GC-MS) and Liquid Chromatography/Mass Spectrometry (LC-MS/MS) are used for
    their specificity and sensitivity. Confirmatory
    tests search for particular steroid metabolites, which helps to get rid of the chance of false
    positives. Anavar’s recognition is the outcome of its mild properties,
    making it tolerable amongst women and men. If you don’t think unwanted effects are attainable from taking Anavar they are.

    The extent and severity of these unwanted side effects range from individual to individual and rely upon components similar to dosage,
    length of use, and individual susceptibility. As the curtain falls on this discussion, the takeaway message is that Oxandrolone can certainly be a big addition to your health regime.

    But, its affect heavily relies in your private commitment to staying energetic and leading a healthy
    life-style.
    Thus, when Anavar is taken in average dosages in a reasonable cycle, we report a mild reduction in testosterone.
    Measuring fats loss through scales may not be wise because of
    simultaneous muscle gain. Thus, although users might observe a notable discount in body
    fats within the mirror, the scales can still go up as an alternative of down on both of these steroids.

发表回复

您的邮箱地址不会被公开。 必填项已用 * 标注