逆向22-阿儿法编程

网址

本次是对登陆的一个逆向

1. 分析

image

2. 定位

image

搜索s: 找到12个，然后断点，在点登陆，会定住

image

分析上面的代码可知：s是调用了Sha1.hash(r)

首先看看谁调用

image

由于上面的图片，可以得到


n--->"/WebApi/Users/Login"          # 固定值
w--->"username=xxxx&password=11111" # 姓名密码拼接
x--->"DUE$DEHFYE(YRUEHD*&"          # 固定值

3. 调度器分析

 k = (0, c.default)(n + "?" + w + x);
c.default(n + "?" + w + x)
// 其实就得找到 c 是谁，，，再调用c.default

image

image

就看到了-----> 调度器

image

然后就是扣js了

第一步：先将调度器所在的文件的所有的代码copy走

// loader.js
!function (e) {
    function t(t) {
        for (var r, i, l = t[0], s = t[1], u = t[2], f = 0, p = []; f < l.length; f++)
            i = l[f],
            Object.prototype.hasOwnProperty.call(o, i) && o[i] && p.push(o[i][0]),
                o[i] = 0;
        for (r in s)
            Object.prototype.hasOwnProperty.call(s, r) && (e[r] = s[r]);
        for (c && c(t); p.length;)
            p.shift()();
        return a.push.apply(a, u || []),
            n()
    }
  ...... //大约几万行

第二步

//env.js
window = global;

第三步

// rukou.js
require("./22env.js")
require("./22loader.js")
console.log(window.loader)

会运行出下面的就说明OK了

[Function: i] {
  e: [Function (anonymous)],
  m: [
    [Function (anonymous)], [Function (anonymous)], [Function (anonymous)],
    [Function (anonymous)], [Function (anonymous)], [Function (anonymous)],
    [Function (anonymous)], [Function (anonymous)], [Function (anonymous)],
    [Function (anonymous)], [Function (anonymous)], [Function (anonymous)],
    [Function (anonymous)], [Function (anonymous)], [Function (anonymous)],
    [Function (anonymous)], [Function (anonymous)], [Function (anonymous)],
    [Function (anonymous)], [Function (anonymous)], [Function (anonymous)],
    [Function (anonymous)], [Function (anonymous)], [Function (anonymous)],
    [Function (anonymous)], [Function (anonymous)], [Function (anonymous)],
    [Function (anonymous)], [Function (anonymous)], [Function (anonymous)],
    [Function (anonymous)], [Function (anonymous)], [Function (anonymous)],
    [Function (anonymous)], [Function (anonymous)], [Function (anonymous)],
    [Function (anonymous)], [Function (anonymous)], [Function (anonymous)],
    [Function (anonymous)], [Function (anonymous)], [Function (anonymous)],
    [Function (anonymous)], [Function (anonymous)], [Function (anonymous)],
    [Function (anonymous)], [Function (anonymous)], [Function (anonymous)],
    [Function (anonymous)], [Function (anonymous)], [Function (anonymous)],
    [Function (anonymous)], [Function (anonymous)], [Function (anonymous)],
    [Function (anonymous)], [Function (anonymous)], <1 empty item>,
    [Function (anonymous)], [Function (anonymous)], [Function (anonymous)],
    [Function (anonymous)], [Function (anonymous)], [Function (anonymous)],
    [Function (anonymous)], [Function (anonymous)], [Function (anonymous)],
    [Function (anonymous)], [Function (anonymous)], [Function (anonymous)],
    [Function (anonymous)], [Function (anonymous)], [Function (anonymous)],
    [Function (anonymous)], [Function (anonymous)], [Function (anonymous)],
    <1 empty item>,         [Function (anonymous)], [Function (anonymous)],
    [Function (anonymous)], [Function (anonymous)], [Function (anonymous)],
    [Function (anonymous)], [Function (anonymous)], [Function (anonymous)],
    [Function (anonymous)], [Function (anonymous)], [Function (anonymous)],
    [Function (anonymous)], [Function (anonymous)], [Function (anonymous)],
    [Function (anonymous)], [Function (anonymous)], [Function (anonymous)],
    [Function (anonymous)], [Function (anonymous)], [Function (anonymous)],
    <1 empty item>,         [Function (anonymous)], [Function (anonymous)],
    [Function (anonymous)],
    ... 866 more items
  ],
  c: {},
  d: [Function (anonymous)],
  r: [Function (anonymous)],
  t: [Function (anonymous)],
  n: [Function (anonymous)],
  o: [Function (anonymous)],
  p: 'https://cdn.gitblock.cn/static/',
  oe: [Function (anonymous)]
}

那么接下来就是我们使用webpack的时候了

4. 使用webpack

image

// rukou.js 到目前所有的代码
require("./22env.js")
require("./22loader.js")
// console.log(window.loader)

function p(e) {
    return e && e.__esModule ? e : {
        default: e
    }
}

c = p(window.loader(141))

sign = c.default("/WebApi/Users/Login?username=sss&password=111DUE$DEHFYE(YRUEHD*&")
console.log(sign)

运行报错

image

全部拿走，放在env.js

image

// env.js所有的代码

window = global;

// 因为我们拿到是Sha1.hash，Sha1.f等，，我们需要声明一个对象
Sha1 = {} 
Sha1.hash = function(n, t) {
    var w = Object.assign({
        msgFormat: "string",
        outFormat: "hex"
    }, t), b, i, f, u, e, r, p, k, h, d;
    switch (w.msgFormat) {
    default:
    case "string":
        n = Sha1.utf8Encode(n);
        break;
    case "hex-bytes":
        n = Sha1.hexBytesToString(n)
    }
    b = [1518500249, 1859775393, 2400959708, 3395469782];
    i = [1732584193, 4023233417, 2562383102, 271733878, 3285377520];
    n += String.fromCharCode(128);
    var g = n.length / 4 + 2
      , o = Math.ceil(g / 16)
      , s = new Array(o);
    for (u = 0; u < o; u++)
        for (s[u] = new Array(16),
        f = 0; f < 16; f++)
            s[u][f] = n.charCodeAt(u * 64 + f * 4) << 24 | n.charCodeAt(u * 64 + f * 4 + 1) << 16 | n.charCodeAt(u * 64 + f * 4 + 2) << 8 | n.charCodeAt(u * 64 + f * 4 + 3);
    for (s[o - 1][14] = (n.length - 1) * 8 / Math.pow(2, 32),
    s[o - 1][14] = Math.floor(s[o - 1][14]),
    s[o - 1][15] = (n.length - 1) * 8 & 4294967295,
    u = 0; u < o; u++) {
        for (e = new Array(80),
        r = 0; r < 16; r++)
            e[r] = s[u][r];
        for (r = 16; r < 80; r++)
            e[r] = Sha1.ROTL(e[r - 3] ^ e[r - 8] ^ e[r - 14] ^ e[r - 16], 1);
        var c = i[0]
          , l = i[1]
          , a = i[2]
          , v = i[3]
          , y = i[4];
        for (r = 0; r < 80; r++)
            p = Math.floor(r / 20),
            k = Sha1.ROTL(c, 5) + Sha1.f(p, l, a, v) + y + b[p] + e[r] >>> 0,
            y = v,
            v = a,
            a = Sha1.ROTL(l, 30) >>> 0,
            l = c,
            c = k;
        i[0] = i[0] + c >>> 0;
        i[1] = i[1] + l >>> 0;
        i[2] = i[2] + a >>> 0;
        i[3] = i[3] + v >>> 0;
        i[4] = i[4] + y >>> 0
    }
    for (h = 0; h < i.length; h++)
        i[h] = ("00000000" + i[h].toString(16)).slice(-8);
    return d = w.outFormat == "hex-w" ? " " : "",
    i.join(d)
}
Sha1.f = function(n, t, i, r) {
    switch (n) {
    case 0:
        return t & i ^ ~t & r;
    case 1:
        return t ^ i ^ r;
    case 2:
        return t & i ^ t & r ^ i & r;
    case 3:
        return t ^ i ^ r
    }
}
​
Sha1.ROTL = function(n, t) {
    return n << t | n >>> 32 - t
}
​
Sha1.utf8Encode = function(n) {
    return unescape(encodeURIComponent(n))
}
​
Sha1.hexBytesToString = function(n) {
    var i, t;
    for (n = n.replace(" ", ""),
    i = "",
    t = 0; t < n.length; t += 2)
        i += String.fromCharCode(parseInt(n.slice(t, t + 2), 16));
    return i
}

运行rukou.js

image

对rukou.js修改

require("./22env.js")
require("./22loader.js")
// console.log(window.loader)


function p(e) {
    return e && e.__esModule ? e : {
        default: e
    }
}
// 自建一个函数
function get_sign(user, pwd){

    c = p(window.loader(141))
    s = `/WebApi/Users/Login?username=${user}&password=${pwd}DUE$DEHFYE(YRUEHD*&`
    sign = c.default(s)
    return sign
}

python总代码


import requests
​
headers = {
    'Accept': 'application/json, text/javascript, */*; q=0.01',
    'Accept-Language': 'zh-CN,zh;q=0.9',
    'Cache-Control': 'no-cache',
    'Connection': 'keep-alive',
    'Content-Type': 'application/x-www-form-urlencoded; charset=UTF-8',
    'Origin': 'https://aerfaying.com',
    'Pragma': 'no-cache',
    'Referer': 'https://aerfaying.com/',
    'Sec-Fetch-Dest': 'empty',
    'Sec-Fetch-Mode': 'cors',
    'Sec-Fetch-Site': 'same-origin',
    'User-Agent': 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36',
    'X-Requested-With': 'XMLHttpRequest',
    'sec-ch-ua': '"Not/A)Brand";v="8", "Chromium";v="126", "Google Chrome";v="126"',
    'sec-ch-ua-mobile': '?0',
    'sec-ch-ua-platform': '"macOS"',
}
​
data = {
    'username': 'asdas',
    'password': '123456',
    # 't': '1731741580325',
    # 's': '23ba09f69549a1be5d050675762e90367eda328e',
}
​
import execjs
t_sign_dict = execjs.compile(open("rukou.js").read()).call("get_sign", data['username'], data['password'])
data.update(t_sign_dict)
response = requests.post('https://aerfaying.com/WebApi/Users/Login', headers=headers, data=data)
​
print(response.text)
posted @ 2024-10-17 17:35  流年中渲染了微笑  阅读(0)  评论(0)    收藏  举报