MacOS绕过SSL Pining问题

1
const tls = require('tls')
2
const https = require('https')
3

4
// 保存原始函数
5
const originalConnect = tls.connect
6
const originalRequest = https.request
7
const originalGet = https.get
8

9
// Hook tls.connect
10
tls.connect = function(...args) {
11
  let options = args[0]
12

13
  if (typeof options === 'object') {
14
    options.rejectUnauthorized = false
15
    options.checkServerIdentity = () => undefined
16
  }
17

18
  console.log('🔓 TLS connect intercepted:', options?.host || options?.servername)
19
  return originalConnect.apply(this, args)
20
}
21

22
// Hook https.request
23
https.request = function(url, options, callback) {
24
  if (typeof url === 'string') {
25
    if (typeof options === 'object') {
26
      options.rejectUnauthorized = false
27
    } else {
28
      options = { rejectUnauthorized: false }
29
    }
30
  } else if (typeof url === 'object') {
31
    url.rejectUnauthorized = false
32
  }
33

34
  console.log('🔓 HTTPS request intercepted')
35
  return originalRequest.apply(this, arguments)
36
}
37

38
// Hook https.get
39
https.get = function(url, options, callback) {
40
  if (typeof url === 'string') {
41
    if (typeof options === 'object') {
42
      options.rejectUnauthorized = false
43
    } else {
44
      options = { rejectUnauthorized: false }
45
    }
46
  } else if (typeof url === 'object') {
47
    url.rejectUnauthorized = false
48
  }
49

50
  console.log('🔓 HTTPS get intercepted')
51
  return originalGet.apply(this, arguments)
52
}
53

54
console.log('✅ All TLS/HTTPS hooks installed - SSL verification disabled')

1
Process.enumerateModules()
2
  .filter(m => m.name.toLowerCase().includes("ssl"))
3
  .forEach(m => console.log("ssl module:", m.name, m.base));
4

5
function findSymbol(name) {
6
  // 先全局搜（如果你的 Frida 支持的话）
7
  if (Module.findExportByName && typeof Module.findExportByName === "function") {
8
    const p = Module.findExportByName(null, name);
9
    if (p) return p;
10
  }
11

12
  // 再在可能的 libssl 名字里搜（macOS 上名字经常不是 libssl.dylib）
13
  const candidates = ["libssl.dylib", "libssl.1.1.dylib", "libssl.3.dylib"];
14
  for (const m of candidates) {
15
    const mod = Process.findModuleByName(m);
16
    if (!mod) continue;
17
    const p = mod.findExportByName(name);
18
    if (p) return p;
19
  }
20
  return null;
21
}
22

23
var SSL_get_verify_result = findSymbol("SSL_get_verify_result");
24
var SSL_set_verify = findSymbol("SSL_set_verify");
25
var SSL_CTX_set_verify = findSymbol("SSL_CTX_set_verify");
26

27
console.log(">>> 开始注入 SSL Bypass...");
28

29
// 1. Hook SSL_get_verify_result
30
// 这个函数通常在握手完成后被调用，返回值 0 表示验证成功 (X509_V_OK)
31
if (SSL_get_verify_result) {
32
    Interceptor.attach(SSL_get_verify_result, {
33
        onLeave: function(retval) {
34
            // 无论原来验证结果如何，强行篡改为 0 (成功)
35
            retval.replace(ptr(0));
36
        }
37
    });
38
    console.log("[+] Hooked SSL_get_verify_result (强制返回验证成功)");
39
} else {
40
    console.log("[-] 未找到 SSL_get_verify_result (可能被剥离或改名)");
41
}
42

43
// 2. Hook SSL_set_verify
44
// 这个函数用来设置验证模式。我们将模式强制设为 0 (SSL_VERIFY_NONE)
45
if (SSL_set_verify) {
46
    Interceptor.attach(SSL_set_verify, {
47
        onEnter: function(args) {
48
            // args[1] 是 mode 参数，强制设为 0
49
            args[1] = ptr(0);
50
        }
51
    });
52
    console.log("[+] Hooked SSL_set_verify (强制禁用验证模式)");
53
} else {
54
    console.log("[-] 未找到 SSL_set_verify");
55
}
56

57
// 3. Hook SSL_CTX_set_verify
58
// 上下文级别的设置，同样强制设为 0
59
if (SSL_CTX_set_verify) {
60
    Interceptor.attach(SSL_CTX_set_verify, {
61
        onEnter: function(args) {
62
            // args[1] 是 mode 参数
63
            args[1] = ptr(0);
64
        }
65
    });
66
    console.log("[+] Hooked SSL_CTX_set_verify (强制禁用上下文验证)");
67
} else {
68
    console.log("[-] 未找到 SSL_CTX_set_verify");
69
}
70

71
console.log(">>> 注入完成，请检查 Proxyman 是否出现明文数据。");