Kurium ghost client cracked [0.7]
Leaking this garbo client today, cracked this in pretty much less than 1 hour, didn't really have any protection at all, the developer of this client also has no knowledge of C/C++. Basically he advertised this client as a c++ client when in reality all the c++ executable does is run the dll, which then runs the auth. If registered it downloads a zip file that's encrypted which contains the class files and it then proceeds to inject those class files into the jvm. I suppose he used the open source injector that the guy who cracked vape made.
This client is pretty much completly java except for the injection method which I mentioned above. When you run the executable it gets your MachineGuid from the registry. If it fails to get the MachineGuid, it opens a MessageBox that will display "HWID failed". However, if it does succeed to get your MachineGuid, it then sends a POST request to http://dg82fo.pw/auth.php with a key (being your HWID). If you do not pass the auth, the page will return "Not Whitelisted". If you do pass it, it will return a zip file containing the modules. This zip file is encrypted. After getting the zip file the dll will decrypt it and then injects the classes from that into the JVM. So what I did was, after dumping the contents of the zip file, I simply made a webserver that emulates the client's authentication page; it returns the zip file no matter what type of request it's sent. Then it proceeds to load it into the JVM. Funny part about this is the developer allatori demo(http://prnt.sc/cxli62).
Virustotal:
injector exe file: https://www.virustotal.com/en/file/a4...
dll file(has 1 out of 56 most likely a false positive): https://www.virustotal.com/en/file/9a...
The download link includes the encrypted zip file if you ever wanna make your own injector for it.
download: [hide]https://www.mediafire.com/?box70j375t...[hide][/hide]