search

aeerso / mcfux

PoC for abusing McDonald's deals system
GNU General Public License v3.0
19 stars 0 forks source link

You do not permission to view this directory or page #5

Open DevFil opened 5 years ago

DevFil commented 5 years ago

McDonalds update systems

ngschaider commented 5 years ago

I already investigated a bit further.

Before the System updated I sniffed a couple of requests from my Android phone. Decrypting the x-vmob-uid header I know the UID that was used to generate the plexure key. Theoretically I should be able to decrypt the Plexure Key because I know the password (the uid) and the salt (last 8 bytes of plexure key), but I can't.

My code works because I generated a plexure key with McFux.java and also decrypted it successfully.

I really don't know if this is a problem or not.

DevFil commented 5 years ago

Can you teach me? Because i don't know how fix it.

aeerso commented 5 years ago

Seems that McD updated the deviceRegistration and token generation methods. Now they involve safetyNet on Android (I don't have a device to check if the methods have been updated as well on iOS) and they seems bound with other types of checks.

I will look into this maybe later, but I'm leaving this issue open for anyone to share infos.

ngschaider commented 5 years ago

@0xf77

Was there an update for the Android App itself? Until now i have no clue what to Look at but If you give me some starting point i can investigate this further.

EDIT: Okay, I was wrong in my first comment. The app did receive an update. In fact it is quite a huge update (version 2.0.1) is out. Will do some reversing and report back.

DevFil commented 5 years ago

I confirm that McDonald's has updated token generation methods and implemented SafetyNet, in this time there aren't new update in ios; i have a demostration video of the new bypass,if anyone wants to see it write me

aeerso commented 5 years ago

UPDATE: Since I have no hardware (moving house rn) for decompiling and search for new methods to exploit this new update, I'm tagging @ddekus and @giacomoferretti which they may have found a solution/working on it.

Still leaving this issue open for updates.

giacomoferretti commented 5 years ago

@0xf77 Actually I have already written a working PoC to bypass the new check using SafetyNet, but I can't publish it right now. I will leave a GIF demonstrating how it works.

EDIT: Here's the video/GIF: https://imgur.com/a/hx8FCwT (Direct)

ngschaider commented 5 years ago

If you can point me to the right class which implements the safetynet and token Generation i can Reverse it and make a Pull request for this repo

agostinofiscale commented 5 years ago

Am i the only one getting 401.2 error? I tried on a lot of physical devices and it worked on 1/3. And on emulators it doesn't work.

giacomoferretti commented 5 years ago

@ddekus you can't pass SafetyNet on emulators.

agostinofiscale commented 5 years ago

@ddekus you can't pass SafetyNet on emulators.

Thank you for this information. I used my old phone with Magisk with patcheD SafetyNet and SSLUnpinning from Xposed to intercept request. I found that they are similiar with two new headers: X-Dif-Authorization and Digest that seems to be just a way to check other sent information. If someone else is working on this we can cooperate :)

Lameness commented 5 years ago

Hello guys. I need help with Doing McDonalds sweden config. I need capture and working config that crack accs. Im paying. Discord is sqreway#0442, telegram is sqreway and my mail is sweeliaz@gmail.com

Lameness commented 5 years ago

@giacomoferretti and the other guys. Btw i never use mail so please contact om The other stuff or send me ur guys contact details

AceOfWands commented 5 years ago

@ddekus you can't pass SafetyNet on emulators.

Thank you for this information. I used my old phone with Magisk with patcheD SafetyNet and SSLUnpinning from Xposed to intercept request. I found that they are similiar with two new headers: X-Dif-Authorization and Digest that seems to be just a way to check other sent information. If someone else is working on this we can cooperate :)

(Hi guys) @ddekus can you share with me your dump of requests to android antiabuse and devicecheck?

kaaetech commented 5 years ago

If a campaign occurs in Denmark again I will update and release code to generate headers

giacomoferretti commented 5 years ago

Did you guys find something?

I can give you some help if you want.

agostinofiscale commented 5 years ago

@ddekus you can't pass SafetyNet on emulators.

Thank you for this information. I used my old phone with Magisk with patcheD SafetyNet and SSLUnpinning from Xposed to intercept request. I found that they are similiar with two new headers: X-Dif-Authorization and Digest that seems to be just a way to check other sent information. If someone else is working on this we can cooperate :)

(Hi guys) @ddekus can you share with me your dump of requests to android antiabuse and devicecheck?

Sorry, i haven't dump at moment, but if you need it i can try to get it again!

Did you guys find something?

I can give you some help if you want.

I would like some help, after reversed the app i don't fully understand where digest come from .

giacomoferretti commented 5 years ago

Sorry for the late response!

The digest header is simply the SHA256 of the body.

AceOfWands commented 5 years ago

@ddekus you can't pass SafetyNet on emulators.

Thank you for this information. I used my old phone with Magisk with patcheD SafetyNet and SSLUnpinning from Xposed to intercept request. I found that they are similiar with two new headers: X-Dif-Authorization and Digest that seems to be just a way to check other sent information. If someone else is working on this we can cooperate :)

(Hi guys) @ddekus can you share with me your dump of requests to android antiabuse and devicecheck?

Sorry, i haven't dump at moment, but if you need it i can try to get it again!

Did you guys find something? I can give you some help if you want.

I would like some help, after reversed the app i don't fully understand where digest come from .

I'd be really grateful if you did

coolnickname commented 5 years ago

Wow, I didn't know there were other people reverse engineering mcdonalds. Does anyone know how to generate the X-Dif-Authorization header?

giacomoferretti commented 5 years ago

To generate a token for the X-Dif-Authorization header you'll need:

coolnickname commented 5 years ago

So for every call that I want to make that contains the dif-auth header I need to run some code on an android device that passes safetynet? Or just once to get some type of token?

Also do you have an example to generate the nonce?

giacomoferretti commented 5 years ago

There are some tricks that allow you to generate only one token that you can utilize on all requests.

I will publish my code soon.

giacomoferretti commented 4 years ago

You can read more here: https://github.com/giacomoferretti/ffapi-project/tree/master/mcmod-poc

I'm sorry if the code is difficult to read, especially in the important part where it generates the SafetyNet token.

EDIT: I don't think it's possible to generate coupons without having a real device "farming" tokens.

coolnickname commented 4 years ago

@giacomoferretti Could you point me to the code that generates the dif-auth?

giacomoferretti commented 4 years ago

@coolnickname SafetyNet token: CouponFragment.java#L256 McDonald's request: CouponFragment.java#L95