亲宝软件园·资讯

展开

JS逆向-抠代码的第四天【手把手学会抠代码】

疏楼龙宿^ 人气:0

  今天是md5巩固项目,该项目比昨天的复杂一些,但方法思路是一样的。

  今天的目标:https://www.webportal.top/

  打开网站,填入账号密码(密码项目以123456做测试)。点击登录抓包后,发现该登录包为ajax请求,其中加密参数只有pwd。

  

  接下来,就是解析pwd的加密方式,通过全局所搜,可以出如下结果:

  

  第二个很明显不是加密。那么是不是在第一个js文件里面呢,点进去,简单搜索发现了这样的情况:

  

  这么友好的吗?果断打下断点,调试,发现到这里后,i.pwd就是我们的密码123456,而$.md5整体是一个加密函数,处理之后,也确实是加密数据。直接跳入函数,会发现该函数时这样的:

  

  这里明显是该函数调用了其他函数,而且没有什么加密算法会只有两行!先不用管,把前面的加密动作和这里复制出来进行简单的改写:

  

  接下来,对MD5这个改写后的函数简单分析,返回的这个玩意首先我是看不懂的,但是我猜测,字母后面跟括号,那么这个字母肯定是某函数!只有函数才需要传参。通过调试工具进行调试,发现函数u不存在,断点跳进来,查看函数,直接复制过来。看了下格式,改都不需要改。来都来了,我们把这一行的几个函数都先看下,比如,f c u,其中u已经找到了,找下f和c,然后也复制过来,接着就重复上述操作,根据调试工具的提示,缺啥补啥。当我们补完就发现,没问题了,运行也直接出结果了。

  

  至此该加密数据解密结束。

  下附代码:

  python部分:

 1 import execjs
 2 
 3 
 4 def read_js(file):
 5     with open(file, 'r', encoding='utf8') as f:
 6         data = f.read()
 7         return data
 8 
 9 
10 if __name__ == '__main__':
11     js_str = read_js('webportal.js')
12     js_o = execjs.compile(js_str)
13     md5_password = js_o.call('getpwd', '123456')
14     print(md5_password)

 

  JS代码部分

  1 function a(e, t, n, o, a, r, s) {
  2 return i(t ^ n ^ o, e, t, a, r, s)
  3 }
  4 
  5 function r(e, t, n, o, a, r, s) {
  6 return i(n ^ (t | ~o), e, t, a, r, s)
  7 }
  8 
  9 function o(e, t, n, o, a, r, s) {
 10 return i(t & o | n & ~o, e, t, a, r, s)
 11 }
 12 
 13 function t(e, t) {
 14 var i = (65535 & e) + (65535 & t);
 15 return (e >> 16) + (t >> 16) + (i >> 16) << 16 | 65535 & i
 16 }
 17 
 18 function i(e, i, n, o, a, r) {
 19 return t((s = t(t(i, e), t(o, r))) << (l = a) | s >>> 32 - l, n);
 20 var s, l
 21 }
 22 
 23 function n(e, t, n, o, a, r, s) {
 24 return i(t & n | ~t & o, e, t, a, r, s)
 25 }
 26 
 27 function d(e) {
 28 var t, i = [];
 29 for (i[(e.length >> 2) - 1] = void 0, t = 0; t < i.length; t += 1) i[t] = 0;
 30 for (t = 0; t < 8 * e.length; t += 8) i[t >> 5] |= (255 & e.charCodeAt(t / 8)) << t % 32;
 31 return i
 32 }
 33 
 34 function s(e, i) {
 35 e[i >> 5] |= 128 << i % 32,
 36 e[14 + (i + 64 >>> 9 << 4)] = i;
 37 var s, l, d, c, p, u = 1732584193,
 38 f = -271733879,
 39 h = -1732584194,
 40 g = 271733878;
 41 for (s = 0; s < e.length; s += 16) l = u,
 42 d = f,
 43 c = h,
 44 p = g,
 45 u = n(u, f, h, g, e[s], 7, -680876936),
 46 g = n(g, u, f, h, e[s + 1], 12, -389564586),
 47 h = n(h, g, u, f, e[s + 2], 17, 606105819),
 48 f = n(f, h, g, u, e[s + 3], 22, -1044525330),
 49 u = n(u, f, h, g, e[s + 4], 7, -176418897),
 50 g = n(g, u, f, h, e[s + 5], 12, 1200080426),
 51 h = n(h, g, u, f, e[s + 6], 17, -1473231341),
 52 f = n(f, h, g, u, e[s + 7], 22, -45705983),
 53 u = n(u, f, h, g, e[s + 8], 7, 1770035416),
 54 g = n(g, u, f, h, e[s + 9], 12, -1958414417),
 55 h = n(h, g, u, f, e[s + 10], 17, -42063),
 56 f = n(f, h, g, u, e[s + 11], 22, -1990404162),
 57 u = n(u, f, h, g, e[s + 12], 7, 1804603682),
 58 g = n(g, u, f, h, e[s + 13], 12, -40341101),
 59 h = n(h, g, u, f, e[s + 14], 17, -1502002290),
 60 u = o(u, f = n(f, h, g, u, e[s + 15], 22, 1236535329), h, g, e[s + 1], 5, -165796510),
 61 g = o(g, u, f, h, e[s + 6], 9, -1069501632),
 62 h = o(h, g, u, f, e[s + 11], 14, 643717713),
 63 f = o(f, h, g, u, e[s], 20, -373897302),
 64 u = o(u, f, h, g, e[s + 5], 5, -701558691),
 65 g = o(g, u, f, h, e[s + 10], 9, 38016083),
 66 h = o(h, g, u, f, e[s + 15], 14, -660478335),
 67 f = o(f, h, g, u, e[s + 4], 20, -405537848),
 68 u = o(u, f, h, g, e[s + 9], 5, 568446438),
 69 g = o(g, u, f, h, e[s + 14], 9, -1019803690),
 70 h = o(h, g, u, f, e[s + 3], 14, -187363961),
 71 f = o(f, h, g, u, e[s + 8], 20, 1163531501),
 72 u = o(u, f, h, g, e[s + 13], 5, -1444681467),
 73 g = o(g, u, f, h, e[s + 2], 9, -51403784),
 74 h = o(h, g, u, f, e[s + 7], 14, 1735328473),
 75 u = a(u, f = o(f, h, g, u, e[s + 12], 20, -1926607734), h, g, e[s + 5], 4, -378558),
 76 g = a(g, u, f, h, e[s + 8], 11, -2022574463),
 77 h = a(h, g, u, f, e[s + 11], 16, 1839030562),
 78 f = a(f, h, g, u, e[s + 14], 23, -35309556),
 79 u = a(u, f, h, g, e[s + 1], 4, -1530992060),
 80 g = a(g, u, f, h, e[s + 4], 11, 1272893353),
 81 h = a(h, g, u, f, e[s + 7], 16, -155497632),
 82 f = a(f, h, g, u, e[s + 10], 23, -1094730640),
 83 u = a(u, f, h, g, e[s + 13], 4, 681279174),
 84 g = a(g, u, f, h, e[s], 11, -358537222),
 85 h = a(h, g, u, f, e[s + 3], 16, -722521979),
 86 f = a(f, h, g, u, e[s + 6], 23, 76029189),
 87 u = a(u, f, h, g, e[s + 9], 4, -640364487),
 88 g = a(g, u, f, h, e[s + 12], 11, -421815835),
 89 h = a(h, g, u, f, e[s + 15], 16, 530742520),
 90 u = r(u, f = a(f, h, g, u, e[s + 2], 23, -995338651), h, g, e[s], 6, -198630844),
 91 g = r(g, u, f, h, e[s + 7], 10, 1126891415),
 92 h = r(h, g, u, f, e[s + 14], 15, -1416354905),
 93 f = r(f, h, g, u, e[s + 5], 21, -57434055),
 94 u = r(u, f, h, g, e[s + 12], 6, 1700485571),
 95 g = r(g, u, f, h, e[s + 3], 10, -1894986606),
 96 h = r(h, g, u, f, e[s + 10], 15, -1051523),
 97 f = r(f, h, g, u, e[s + 1], 21, -2054922799),
 98 u = r(u, f, h, g, e[s + 8], 6, 1873313359),
 99 g = r(g, u, f, h, e[s + 15], 10, -30611744),
100 h = r(h, g, u, f, e[s + 6], 15, -1560198380),
101 f = r(f, h, g, u, e[s + 13], 21, 1309151649),
102 u = r(u, f, h, g, e[s + 4], 6, -145523070),
103 g = r(g, u, f, h, e[s + 11], 10, -1120210379),
104 h = r(h, g, u, f, e[s + 2], 15, 718787259),
105 f = r(f, h, g, u, e[s + 9], 21, -343485551),
106 u = t(u, l),
107 f = t(f, d),
108 h = t(h, c),
109 g = t(g, p);
110 return [u, f, h, g]
111 }
112 
113 function p(e) {
114 return unescape(encodeURIComponent(e))
115 }
116 function l(e) {
117 var t, i = "";
118 for (t = 0; t < 32 * e.length; t += 8) i += String.fromCharCode(e[t >> 5] >>> t % 32 & 255);
119 return i
120 }
121 function c(e) {
122 var t, i, n = "";
123 for (i = 0; i < e.length; i += 1) t = e.charCodeAt(i),
124 n += "0123456789abcdef".charAt(t >>> 4 & 15) + "0123456789abcdef".charAt(15 & t);
125 return n
126 }
127 
128 function u(e) {
129 return function(e) {
130     return l(s(d(e), 8 * e.length))
131 } (p(e))
132 }
133 
134 MD5 = function(e, t, i) {
135 return t ? i ? f(t, e) : c(f(t, e)) : i ? u(e) : c(u(e))
136 }
137 
138 function getpwd(pwd) {
139 var password = MD5(pwd);
140 return password
141 }
JS代码部分

 

  

加载全部内容

相关教程
猜你喜欢
用户评论