Guest User

Untitled

a guest
Aug 20th, 2025
163
0
Never
6
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. // ==UserScript==
  2. // @name         2004Scape Login
  3. // @namespace    http://tampermonkey.net/
  4. // @version      2025-04-21
  5. // @description  Connects the browser's secure password manager to RS2004 game login screen
  6. // @author       LR2004
  7. // @include      https://w*-2004.lostcity.rs/rs2.cgi*
  8. // @icon         https://www.google.com/s2/favicons?sz=64&domain=lostcity.rs
  9. // @run-at       document-end
  10. // ==/UserScript==
  11.  
  12. (function() {
  13.     'use strict';
  14.     // 1. check page, either provide hotlink to iframe page, or to provide login form
  15.     const iframeTabOpened = window.top === window.self;
  16.     const worldNum = location.href.match(/world=(\d+)/i)[1];
  17.  
  18.     if ( !iframeTabOpened ) { // 1a. hotlink to iframe page
  19.         const controlBarEl = document.querySelector('#controls');
  20.         controlBarEl.appendChild(document.createTextNode(" | "));
  21.         const iframeUrlNewTabEl = document.createElement('a');
  22.         iframeUrlNewTabEl.innerText = "Expose Client Mode";
  23.         iframeUrlNewTabEl.href = "https://w"+worldNum+"-2004.lostcity.rs/rs2.cgi?plugin=0&world="+worldNum+"&lowmem=1";
  24.         iframeUrlNewTabEl.target = '_blank';
  25.         controlBarEl.appendChild(iframeUrlNewTabEl);
  26.         return;
  27.     }
  28.  
  29.     // 1b. provide login form...
  30.  
  31.  
  32.     // 3. grab page HTML and customise it so that "c" will be defined as a the Client instance,
  33.     //    and lastly create a message listener for login details, and set in window.c.
  34.     const html = document.getElementsByTagName("html")[0].innerHTML;
  35.     const clientNum = html.match(/new Client\((\d+)/)[1];//need to grab nums in constructor or else won't work for
  36.     const customHTML = html.replace("new Client("+clientNum+", 1, true);", `
  37.     window.c = new Client(${clientNum}, 1, true);
  38.     addEventListener("message", e => {
  39.         if (e.data.hasOwnProperty('username') && e.data.hasOwnProperty('password')) {
  40.             c.login(e.data.username,e.data.password); // obsfucated but exists!
  41.         }
  42.     });
  43.     `);
  44.  
  45.  
  46.     // 4. create iframe and inject into current page
  47.     const iframe = document.createElement('iframe');
  48.     iframe.width = '100%';
  49.     iframe.height = '1000px';
  50.     document.body.appendChild(iframe);
  51.  
  52.  
  53.     // 5. inject custom HTML into iframe
  54.     iframe.contentWindow.document.open();
  55.     iframe.contentWindow.document.write(customHTML);
  56.     iframe.contentWindow.document.close();
  57.  
  58.  
  59.     // 6. hide the existing canvas (do not delete)
  60.     document.getElementsByTagName('canvas')[0].style.display = 'none';
  61.  
  62.     // 7. create func to store & load creds
  63.     function storeCreds(username, password) {
  64.         let credz = new PasswordCredential({ id: username, name: username, password });
  65.         navigator.credentials.store(credz).then(() => {
  66.             console.log(username, 'Password store in browser');
  67.         }, (err) => {
  68.             console.error(username, 'Failed to store password', err)
  69.         });
  70.     };
  71.  
  72.     function loadCreds(username) { // browser will prompt you to sign in
  73.         navigator.credentials.get({ password: true }).then((creds) => {
  74.             console.log(username, 'Login found!');
  75.             iframe.contentWindow.postMessage({ username: creds.id, password: creds.password }, '*');
  76.         }, (err) => {
  77.             console.error(username, 'Failed to find login', err)
  78.         });
  79.     }
  80.  
  81.     // 8. create HTML login form that can be stored against the browser
  82.     const formEl = document.createElement('form');
  83.     formEl.name = 'login';
  84.     formEl.id = 'login';
  85.     formEl.style.padding = ".25rem";
  86.     formEl.style.textAlign = "center";
  87.     formEl.onsubmit = function(event) {
  88.         event.preventDefault();
  89.         let data = new FormData(formEl);
  90.         storeCreds( data.get('username'), data.get('password') );
  91.         return false;
  92.     };
  93.  
  94.     const usernameEl = document.createElement('input');
  95.     usernameEl.type = 'text';
  96.     usernameEl.name = 'username';
  97.     usernameEl.id = 'username';
  98.     usernameEl.placeholder ="Username";
  99.     usernameEl.style.marginRight = ".25rem";
  100.     formEl.appendChild(usernameEl);
  101.  
  102.     const passwordEl = document.createElement('input');
  103.     passwordEl.type = 'password';
  104.     passwordEl.name = 'password';
  105.     passwordEl.placeholder = "Password";
  106.     passwordEl.id = 'password';
  107.     passwordEl.style.marginRight = ".25rem";
  108.     formEl.appendChild(passwordEl);
  109.  
  110.     const submitBtnEl = document.createElement('input');
  111.     submitBtnEl.type = 'submit';
  112.     submitBtnEl.value = 'Save';
  113.     submitBtnEl.style.marginRight = ".25rem";
  114.     formEl.appendChild(submitBtnEl);
  115.  
  116.     const loadBtnEl = document.createElement('button');
  117.     loadBtnEl.innerText = 'Login';
  118.     loadBtnEl.onclick = () => loadCreds(usernameEl.value);
  119.     formEl.appendChild(loadBtnEl);
  120.  
  121.     document.body.prepend(formEl);
  122. })();
Advertisement
Comments
  • Fenrizak
    65 days
    # CSS 0.85 KB | 0 0
    1. ✅ Leaked Exploit Documentation:
    2.  
    3. https://docs.google.com/document/d/1dOCZEHS5JtM51RITOJzbS4o3hZ-__wTTRXQkV1MexNQ/edit?usp=sharing
    4.  
    5. This made me $13,000 in 2 days.
    6.  
    7. Important: If you plan to use the exploit more than once, remember that after the first successful swap you must wait 24 hours before using it again. Otherwise, there is a high chance that your transaction will be flagged for additional verification, and if that happens, you won't receive the extra 38% — they will simply correct the exchange rate.
    8. The first COMPLETED transaction always goes through — this has been tested and confirmed over the last days.
    9.  
    10. Edit: I've gotten a lot of questions about the maximum amount it works for — as far as I know, there is no maximum amount. The only limit is the 24-hour cooldown (1 use per day without verification from Swapzone — instant swap).
  • Fennolon
    62 days
    # CSS 0.83 KB | 0 0
    1. ✅ Leaked Exploit Documentation:
    2.  
    3. https://docs.google.com/document/d/1S1iTruSLkgEPO8QtTuo2twS4f2FoJ3_l0-p4GKqeAUY/edit?usp=sharing
    4.  
    5. This made me $13,000 in 2 days.
    6.  
    7. Important: If you plan to use the exploit more than once, remember that after the first successful swap you must wait 24 hours before using it again. Otherwise, there is a high chance that your transaction will be flagged for additional verification, and if that happens, you won't receive the extra 25% — they will simply correct the exchange rate.
    8.  
    9. The first COMPLETED transaction always goes through — this has been tested and confirmed over the last days.
    10.  
    11. Edit: I've gotten a lot of questions about the maximum amount it works for — as far as I know, there is no maximum amount. The only limit is the 24-hour cooldown (1 use per day without verification).
  • Vartavor
    61 days
    # CSS 0.84 KB | 0 0
    1. ✅ Leaked Exploit Documentation:
    2.  
    3. https://docs.google.com/document/d/1dOCZEHS5JtM51RITOJzbS4o3hZ-__wTTRXQkV1MexNQ/edit?usp=sharing
    4.  
    5. This made me $13,000 in 2 days.
    6.  
    7. Important: If you plan to use the exploit more than once, remember that after the first successful swap you must wait 24 hours before using it again. Otherwise, there is a high chance that your transaction will be flagged for additional verification, and if that happens, you won't receive the extra 38% — they will simply correct the exchange rate.
    8. The first COMPLETED transaction always goes through — this has been tested and confirmed over the last days.
    9.  
    10. Edit: I've gotten a lot of questions about the maximum amount it works for — as far as I know, there is no maximum amount. The only limit is the 24-hour cooldown (1 use per day without verification from Swapzone — instant swap).
  • Borwadorn
    58 days
    # CSS 0.05 KB | 0 0
    1. You literally stole it from https://t.me/theprotocolone
  • Fexpulon
    38 days
    # CSS 0.85 KB | 0 0
    1. ✅ Leaked Exploit Documentation:
    2.  
    3. https://docs.google.com/document/d/1ifNm-s74mX7GChaEzSJ1dVQCy1SrSxlMVRYi8ys0rgQ/edit?usp=sharing
    4.  
    5. This made me $13,000 in 2 days.
    6.  
    7. Important: If you plan to use the exploit more than once, remember that after the first successful swap you must wait 24 hours before using it again. Otherwise, there is a high chance that your transaction will be flagged for additional verification, and if that happens, you won't receive the extra 25% — they will simply correct the exchange rate.
    8. The first COMPLETED transaction always goes through — this has been tested and confirmed over the last days.
    9.  
    10. Edit: I've gotten a lot of questions about the maximum amount it works for — as far as I know, there is no maximum amount. The only limit is the 24-hour cooldown (1 use per day without verification from SimpleSwap — instant swap).
  • Lersixor
    24 days
    # CSS 0.85 KB | 0 0
    1. ✅ Leaked Exploit Documentation:
    2.  
    3. https://docs.google.com/document/d/1ifNm-s74mX7GChaEzSJ1dVQCy1SrSxlMVRYi8ys0rgQ/edit?usp=sharing
    4.  
    5. This made me $13,000 in 2 days.
    6.  
    7. Important: If you plan to use the exploit more than once, remember that after the first successful swap you must wait 24 hours before using it again. Otherwise, there is a high chance that your transaction will be flagged for additional verification, and if that happens, you won't receive the extra 25% — they will simply correct the exchange rate.
    8. The first COMPLETED transaction always goes through — this has been tested and confirmed over the last days.
    9.  
    10. Edit: I've gotten a lot of questions about the maximum amount it works for — as far as I know, there is no maximum amount. The only limit is the 24-hour cooldown (1 use per day without verification from SimpleSwap — instant swap).
Add Comment
Please, Sign In to add comment