Information update, about getgrass desktop version (script) 📢❗🚨

[cmalf]

🌎 at Everyone

🎯 Points

• grass dev, trying to trick script-loving users into thinking that websocket connections are still used in the desktop version.
• Maybe the "grass" devs will chuckle at me for assuming their desktop version still uses websockets after seeing this trace. because they continue to let me to use a script to access Websocket on the desktop version.
• In the desktop version of Getgrass, websocket is no longer used.

🦈 I attempted to record it using "Wireshark" as my standard sniffer program is unable to identify the network traffic of the "grass desktop version."

---

---

🔗 I'll research "netsocket" to find a solution, but I'm not an experts in it.

👨🏻‍🏫 If any of you are knowledgeable (expert) about this, please share your thoughts and ideas so that I can expand my horizons and better comprehend and start addressing this (so that I don't go astray in the opposite direction).

Here I try to make a small part of the script with the netsocket module (I still have minimal knowledge about netsocket).

• Note : feel free to laugh at this code if you want, I'm still learning about new things (especially about netsockets)
• HAHA 😂

---

const net = require('net');
const axios = require('axios');
const { createConnection } = require('net');
const pino = require('pino');
const { SocksProxyAgent } = require('socks-proxy-agent');

const logger = pino({ 
    level: 'info', 
    transport: { 
        target: 'pino-pretty' 
    } 
});

const CONFIG = {
    proxy: {
        host: 'isp.proxies.fo',
        port: 10808,
        username: 'xxxx',
        password: 'xxxx'
    },
    server: {
        host: 'proxy2.wynd.network',
        ports: ['4444', '4650']
    },
    api: {
        url: 'https://api.getgrass.io'
    },
    reconnect: {
        maxAttempts: 5,
        delay: 5000
    }
};

const CLIENT_INFO = {
    userAgent: 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15',
    origin: 'tauri://localhost',
    osInfo: {
        name: 'Mac OS',
        version: '10.15.7'
    },
    browser: {
        engine: 'WebKit',
        engineVersion: '605.1.15',
        version: '4.30.0'
    }
};

let dataBuffer = Buffer.from('');
let reconnectAttempts = 0;
let currentConnection = null;

// Function to reassemble data chunks into complete messages
function reassembleData(chunk) {
    dataBuffer = Buffer.concat([dataBuffer, chunk]);
    
    const messages = [];
    let newlineIndex;
    
    while ((newlineIndex = dataBuffer.indexOf('\n')) !== -1) {
        const message = dataBuffer.slice(0, newlineIndex).toString().trim();
        if (message) messages.push(message);
        dataBuffer = dataBuffer.slice(newlineIndex + 1);
    }
    
    return messages;
}

// Function to process and parse incoming messages
function processMessage(message) {
    try {
        if (typeof message === 'string' && message.startsWith('{')) {
            return JSON.parse(message);
        }
        return message;
    } catch (error) {
        logger.warn('Failed to parse message:', error.message);
        return message;
    }
}

// Function to modify data by adding timestamp and processed flag
function modifyData(data) {
    if (typeof data === 'object') {
        return {
            ...data,
            timestamp: new Date().toISOString(),
            processed: true
        };
    }
    return data;
}

// Function to get a random port from the configured ports array
function getRandomPort(ports) {
    return ports[Math.floor(Math.random() * ports.length)];
}

// Function to create a SOCKS proxy agent with the given configuration
function createProxyAgent(proxyConfig) {
    const { host, port, username, password } = proxyConfig;
    const proxyUrl = `socks://${username}:${password}@${host}:${port}`;
    return new SocksProxyAgent(proxyUrl);
}

// Function to make HTTP requests through the proxy
async function makeHttpRequest(data) {
    try {
        const proxyAgent = createProxyAgent(CONFIG.proxy);
        const response = await axios.get(CONFIG.api.url, {
            httpsAgent: proxyAgent,
            headers: {
                'Content-Type': 'application/json'
            },
            params: data
        });
        return JSON.stringify(response.data);
    } catch (error) {
        throw new Error(`HTTP request failed: ${error.message}`);
    }
}

// Function to set up the socket connection
function setupConnection() {
    if (currentConnection) {
        currentConnection.destroy();
    }

    try {
        const proxyAgent = createProxyAgent(CONFIG.proxy);
        const socket = createConnection({
            host: CONFIG.server.host,
            port: getRandomPort(CONFIG.server.ports),
            agent: proxyAgent
        });

        socket.on('connect', () => {
            logger.info('Socket connected successfully');
            reconnectAttempts = 0;
            currentConnection = socket;
            
            // Send Client Fuck message upon connection
            const clientHello = {
                type: 'hello motherfucker',
                clientInfo: CLIENT_INFO,
                timestamp: new Date().toISOString()
            };
            socket.write(JSON.stringify(clientHello) + '\n');
            logger.info('Sent Client Fuck message');
        });

        socket.on('data', async (chunk) => {
            const messages = reassembleData(chunk);

            for (const message of messages) {
                try {
                    const processedData = processMessage(message);
                    const modifiedData = modifyData(processedData);

                    logger.info('Processing message:', { original: message, processed: modifiedData });

                    try {
                        const response = await makeHttpRequest(modifiedData);
                        socket.write(Buffer.from(response));
                        logger.info('Successfully processed and sent response');
                    } catch (error) {
                        logger.error('API request failed:', error.message);
                        if (error.response?.status === 429 || error.response?.status === 500) {
                            logger.warn(`Rate limit or server error (${error.response.status}). Waiting before retry...`);
                            await new Promise(resolve => setTimeout(resolve, 5000));
                        }
                        logger.error(`Tunnel request error: ${error.message}`);
                    }
                } catch (error) {
                    logger.error('Message processing failed:', error.message);
                }
            }
        });

        socket.on('error', (error) => {
            logger.error('Socket error:', error);
            handleReconnection();
        });

        socket.on('close', () => {
            logger.info('Socket connection closed');
            handleReconnection();
        });

        return socket;
    } catch (error) {
        logger.error('Setup error:', error);
        handleReconnection();
        return null;
    }
}

// Function to handle reconnection attempts
function handleReconnection() {
    if (reconnectAttempts >= CONFIG.reconnect.maxAttempts) {
        logger.error('Max reconnection attempts reached. Giving up.');
        process.exit(1);
    }

    reconnectAttempts++;
    logger.info(`Attempting to reconnect (${reconnectAttempts}/${CONFIG.reconnect.maxAttempts})...`);
    
    setTimeout(() => {
        setupConnection();
    }, CONFIG.reconnect.delay);
}

// Initialize the connection
let connection = setupConnection();

// Handle process termination
process.on('SIGINT', () => {
    logger.info('Gracefully shutting down...');
    if (currentConnection) {
        currentConnection.destroy();
    }
    process.exit(0);
});

// Handle uncaught exceptions
process.on('uncaughtException', (error) => {
    logger.error('Uncaught Exception:', error);
    if (currentConnection) {
        currentConnection.destroy();
    }
    process.exit(1);
});

[cmalf]

Off on Christmas break! See you when I get back.

• Wishing you a Merry Christmas! ‧₊˚🎄✩ ₊˚🦌⊹♡

[robinzjan]

thanks bro

[xingxing-dd]

You can analyze the communication information of WSS through SunnyNet, but this is currently encrypted and may require reverse engineering and other methods to analyze the exe client program. This is indeed difficult, and I am looking for ways to handle it.

[cmalf]

can you give me some core data, if there is any possibility that "grass dev" uses two types of connections for the desktop version.
to my Tg : @furqonflynn

[xingxing-dd]

can you give me some core data, if there is any possibility that "grass dev" uses two types of connections for the desktop version. to my Tg : @furqonflynn

Okay, I'll send you some communication data later. Please wait, I'm currently working.

[CHNRoyWang]

I've analyzed the data. The Grass desktop application uses WSS for communication and has implemented a set of TLS handshake protocols. Then it encrypts the communication of data. The data in the "data" field is the data for the TLS handshake.

Then, in the TLS data, the client's certificate will be passed to the server. If the data is captured by means of a man-in-the-middle approach, it will result in the client passing the man-in-the-middle's certificate to the server, and then the WSS connection will be disconnected.

I also found that at the end of the Grass.exe file, there is a string of data similar to a certificate.

[masia-ma]

请问桌面端破解加密有进展吗？可否加个联系方式一起交流学习

[xingxing-dd]

SunnyNet github repository is https://github.com/qtgolang/SunnyNet,it's a great tool.

[20dec]

this new thing work from version 4.30 ? how about if we use older version? or they force update 4.30 from original Grass Desktop App?

[20dec]

info from grass desktop, but not work if just send using normal method using nodejs or python by change extensionId and deviceType to "desktop"

{ "clientConfig": { "method": "POST", "url": "https://director.getgrass.io/checkin", "headers": [ ["Content-Type", "application/json"] ], "data": { "browserId": "hidden", "userId": "hidden", "version": "5.1.1", "extensionId": "desktop", "userAgent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Edg/134.0.0.0", "deviceType": "desktop" } } }

[cmalf]

won't work, you need pem key certificate, for https stream authentication

[20dec]

It's just POST request as extension methods, and using websocket after that

[20dec]

{"urls":["wss://54.226.27.105?token=eyJhbGciOiJSUz...EBQNPCEEQ"],"version":"5.2.2","deviceId":"#############","userId":"#################","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Edg/134.0.0.0"}