逆向案例二十八——红某点集登录接口逆向序

网址：aHR0cHM6Ly93d3cuaHJkanl1bi5jb20vIy9sb2dpbj9yZWRpcmVjdD0lMkZyZWFsVGltZUxpdmluZw==

登录接口，发现两个参数加密，分别是pwd和sig,t很明显是时间戳。

观察pwd,发现很像md5加密，我输入的密码是123456，在在线加密网站加密，发现果然如此。

但是这次采用扣代码来解决，不用标准库。

 

参数没有特点，搜索是很难搜的，采用跟栈方法。

 还是跟之前一样，点击第一个，在send处打断点，点击登录，前三个是发包，一般不在里面吗加密。

现在就是判断是不是在异步里面加密的，如何判断呢， 进入异步s.requests处，在常见位置打上断点。在控制台打印e,进入第一个函数在return处打上断点，看加密了吗？若是加密了，则并不是在异步中加密的。

 

发现进入异步的第一个函数接受的参数已经是经过加密的数据，因此跳过异步。 

 

进入下一个栈，G栈，在u处打上断点，释放其他断点，点击登录

看l = l = Object(g["a"])(H(S(e)))就是sig的加密位置，Object(g["a"])代码的意思就是调用g中的a方法。相当于g["a"](H(S(e)），但是这里存在变量污染，传入的参数s不应该含有加密后的sig,所以在前面打上断点，可以更好确定传入的参数是什么形式的。

 

在这里打上断定，var t = n.split("/") ，再点击跳过下一个函数执行，一步步执行到sig的加密位置。

这时候的传入的参数为e

 

t由s赋值，s由函数 s = (new Date).getTime();赋值

那么现在还是要先破解pwd是怎么加密的。

先找到pwd的加密位置。由于传入function G(n,e)中的e已经有加密后的pwd了，所以继续往前跟栈。

pwd由pwd: Object(E["a"])(t.loginForm.password)赋值，相当于E["a"](t.loginForm.password)，其中t.loginForm.password是密码'123456'

 

进入E['a']发现是它，复制到pycharm中，传入的n就是密码，运行会发现缺少c,就在前面找c,然后复制

 

 

c在哪里，就在这个函数附近。然后运行发现没有o,接着复制一步一步来，最后直到成功。

 

完整代码：

var a=0;
function i(n) {return c(o(s(n)))
};
function c(n) {for (var e, t = a ? "0123456789ABCDEF" : "0123456789abcdef", i = "", o = 0; o < n.length; o++)e = n.charCodeAt(o),i += t.charAt(e >>> 4 & 15) + t.charAt(15 & e);return i};
function o(n) {return r(d(l(n), 8 * n.length))};
function s(n) {var e, t, a = "", i = -1;while (++i < n.length)e = n.charCodeAt(i),t = i + 1 < n.length ? n.charCodeAt(i + 1) : 0,55296 <= e && e <= 56319 && 56320 <= t && t <= 57343 && (e = 65536 + ((1023 & e) << 10) + (1023 & t),i++),e <= 127 ? a += String.fromCharCode(e) : e <= 2047 ? a += String.fromCharCode(192 | e >>> 6 & 31, 128 | 63 & e) : e <= 65535 ? a += String.fromCharCode(224 | e >>> 12 & 15, 128 | e >>> 6 & 63, 128 | 63 & e) : e <= 2097151 && (a += String.fromCharCode(240 | e >>> 18 & 7, 128 | e >>> 12 & 63, 128 | e >>> 6 & 63, 128 | 63 & e));return a};
function r(n) {for (var e = "", t = 0; t < 32 * n.length; t += 8)e += String.fromCharCode(n[t >> 5] >>> t % 32 & 255);return e};
function d(n, e) {n[e >> 5] |= 128 << e % 32,n[14 + (e + 64 >>> 9 << 4)] = e;for (var t = 1732584193, a = -271733879, i = -1732584194, o = 271733878, c = 0; c < n.length; c += 16) {var s = t, l = a, r = i, d = o;t = h(t, a, i, o, n[c + 0], 7, -680876936),o = h(o, t, a, i, n[c + 1], 12, -389564586),i = h(i, o, t, a, n[c + 2], 17, 606105819),a = h(a, i, o, t, n[c + 3], 22, -1044525330),t = h(t, a, i, o, n[c + 4], 7, -176418897),o = h(o, t, a, i, n[c + 5], 12, 1200080426),i = h(i, o, t, a, n[c + 6], 17, -1473231341),a = h(a, i, o, t, n[c + 7], 22, -45705983),t = h(t, a, i, o, n[c + 8], 7, 1770035416),o = h(o, t, a, i, n[c + 9], 12, -1958414417),i = h(i, o, t, a, n[c + 10], 17, -42063),a = h(a, i, o, t, n[c + 11], 22, -1990404162),t = h(t, a, i, o, n[c + 12], 7, 1804603682),o = h(o, t, a, i, n[c + 13], 12, -40341101),i = h(i, o, t, a, n[c + 14], 17, -1502002290),a = h(a, i, o, t, n[c + 15], 22, 1236535329),t = m(t, a, i, o, n[c + 1], 5, -165796510),o = m(o, t, a, i, n[c + 6], 9, -1069501632),i = m(i, o, t, a, n[c + 11], 14, 643717713),a = m(a, i, o, t, n[c + 0], 20, -373897302),t = m(t, a, i, o, n[c + 5], 5, -701558691),o = m(o, t, a, i, n[c + 10], 9, 38016083),i = m(i, o, t, a, n[c + 15], 14, -660478335),a = m(a, i, o, t, n[c + 4], 20, -405537848),t = m(t, a, i, o, n[c + 9], 5, 568446438),o = m(o, t, a, i, n[c + 14], 9, -1019803690),i = m(i, o, t, a, n[c + 3], 14, -187363961),a = m(a, i, o, t, n[c + 8], 20, 1163531501),t = m(t, a, i, o, n[c + 13], 5, -1444681467),o = m(o, t, a, i, n[c + 2], 9, -51403784),i = m(i, o, t, a, n[c + 7], 14, 1735328473),a = m(a, i, o, t, n[c + 12], 20, -1926607734),t = A(t, a, i, o, n[c + 5], 4, -378558),o = A(o, t, a, i, n[c + 8], 11, -2022574463),i = A(i, o, t, a, n[c + 11], 16, 1839030562),a = A(a, i, o, t, n[c + 14], 23, -35309556),t = A(t, a, i, o, n[c + 1], 4, -1530992060),o = A(o, t, a, i, n[c + 4], 11, 1272893353),i = A(i, o, t, a, n[c + 7], 16, -155497632),a = A(a, i, o, t, n[c + 10], 23, -1094730640),t = A(t, a, i, o, n[c + 13], 4, 681279174),o = A(o, t, a, i, n[c + 0], 11, -358537222),i = A(i, o, t, a, n[c + 3], 16, -722521979),a = A(a, i, o, t, n[c + 6], 23, 76029189),t = A(t, a, i, o, n[c + 9], 4, -640364487),o = A(o, t, a, i, n[c + 12], 11, -421815835),i = A(i, o, t, a, n[c + 15], 16, 530742520),a = A(a, i, o, t, n[c + 2], 23, -995338651),t = p(t, a, i, o, n[c + 0], 6, -198630844),o = p(o, t, a, i, n[c + 7], 10, 1126891415),i = p(i, o, t, a, n[c + 14], 15, -1416354905),a = p(a, i, o, t, n[c + 5], 21, -57434055),t = p(t, a, i, o, n[c + 12], 6, 1700485571),o = p(o, t, a, i, n[c + 3], 10, -1894986606),i = p(i, o, t, a, n[c + 10], 15, -1051523),a = p(a, i, o, t, n[c + 1], 21, -2054922799),t = p(t, a, i, o, n[c + 8], 6, 1873313359),o = p(o, t, a, i, n[c + 15], 10, -30611744),i = p(i, o, t, a, n[c + 6], 15, -1560198380),a = p(a, i, o, t, n[c + 13], 21, 1309151649),t = p(t, a, i, o, n[c + 4], 6, -145523070),o = p(o, t, a, i, n[c + 11], 10, -1120210379),i = p(i, o, t, a, n[c + 2], 15, 718787259),a = p(a, i, o, t, n[c + 9], 21, -343485551),t = f(t, s),a = f(a, l),i = f(i, r),o = f(o, d)}return Array(t, a, i, o)};
function l(n) {for (var e = Array(n.length >> 2), t = 0; t < e.length; t++)e[t] = 0;for (t = 0; t < 8 * n.length; t += 8)e[t >> 5] |= (255 & n.charCodeAt(t / 8)) << t % 32;return e};
function h(n, e, t, a, i, o, c) {return u(e & t | ~e & a, n, e, i, o, c)};
function f(n, e) {var t = (65535 & n) + (65535 & e), a = (n >> 16) + (e >> 16) + (t >> 16);return a << 16 | 65535 & t};
function g(n, e) {return n << e | n >>> 32 - e};
function m(n, e, t, a, i, o, c) {return u(e & a | t & ~a, n, e, i, o, c)};
function A(n, e, t, a, i, o, c) {return u(e ^ t ^ a, n, e, i, o, c)};
function p(n, e, t, a, i, o, c) {return u(t ^ (e | ~a), n, e, i, o, c)};function u(n, e, t, a, i, o) {return f(g(f(f(e, n), f(a, o)), i), t)}console.log(i('123456'))

运行结果

 

看复制的代码的位置，其实就是'87ff'中的绝大部分代码块，之所以不用webpack是因为'87ff'没有调用其他的模块，所以直接扣就可以。

 

现在处理sig怎么加密的，先生成e,跟上面的步骤一样来。

然后开始写 

 g["a"](H(S(e)），回到G栈，找到S函数，H函数，g['a']函数。并复制

它们分别为

 

 

g.a其实就是i函数。最后结果。

 

最终代码：

var a = 0;function p(n, e, t, a, i, o, c) {return u(t ^ (e | ~a), n, e, i, o, c)
};function A(n, e, t, a, i, o, c) {return u(e ^ t ^ a, n, e, i, o, c)
};function m(n, e, t, a, i, o, c) {return u(e & a | t & ~a, n, e, i, o, c)
};function g(n, e) {return n << e | n >>> 32 - e
};function f(n, e) {var t = (65535 & n) + (65535 & e), a = (n >> 16) + (e >> 16) + (t >> 16);return a << 16 | 65535 & t
};function u(n, e, t, a, i, o) {return f(g(f(f(e, n), f(a, o)), i), t)
};function h(n, e, t, a, i, o, c) {return u(e & t | ~e & a, n, e, i, o, c)
};function l(n) {for (var e = Array(n.length >> 2), t = 0; t < e.length; t++)e[t] = 0;for (t = 0; t < 8 * n.length; t += 8)e[t >> 5] |= (255 & n.charCodeAt(t / 8)) << t % 32;return e
};function d(n, e) {n[e >> 5] |= 128 << e % 32,n[14 + (e + 64 >>> 9 << 4)] = e;for (var t = 1732584193, a = -271733879, i = -1732584194, o = 271733878, c = 0; c < n.length; c += 16) {var s = t, l = a, r = i, d = o;t = h(t, a, i, o, n[c + 0], 7, -680876936),o = h(o, t, a, i, n[c + 1], 12, -389564586),i = h(i, o, t, a, n[c + 2], 17, 606105819),a = h(a, i, o, t, n[c + 3], 22, -1044525330),t = h(t, a, i, o, n[c + 4], 7, -176418897),o = h(o, t, a, i, n[c + 5], 12, 1200080426),i = h(i, o, t, a, n[c + 6], 17, -1473231341),a = h(a, i, o, t, n[c + 7], 22, -45705983),t = h(t, a, i, o, n[c + 8], 7, 1770035416),o = h(o, t, a, i, n[c + 9], 12, -1958414417),i = h(i, o, t, a, n[c + 10], 17, -42063),a = h(a, i, o, t, n[c + 11], 22, -1990404162),t = h(t, a, i, o, n[c + 12], 7, 1804603682),o = h(o, t, a, i, n[c + 13], 12, -40341101),i = h(i, o, t, a, n[c + 14], 17, -1502002290),a = h(a, i, o, t, n[c + 15], 22, 1236535329),t = m(t, a, i, o, n[c + 1], 5, -165796510),o = m(o, t, a, i, n[c + 6], 9, -1069501632),i = m(i, o, t, a, n[c + 11], 14, 643717713),a = m(a, i, o, t, n[c + 0], 20, -373897302),t = m(t, a, i, o, n[c + 5], 5, -701558691),o = m(o, t, a, i, n[c + 10], 9, 38016083),i = m(i, o, t, a, n[c + 15], 14, -660478335),a = m(a, i, o, t, n[c + 4], 20, -405537848),t = m(t, a, i, o, n[c + 9], 5, 568446438),o = m(o, t, a, i, n[c + 14], 9, -1019803690),i = m(i, o, t, a, n[c + 3], 14, -187363961),a = m(a, i, o, t, n[c + 8], 20, 1163531501),t = m(t, a, i, o, n[c + 13], 5, -1444681467),o = m(o, t, a, i, n[c + 2], 9, -51403784),i = m(i, o, t, a, n[c + 7], 14, 1735328473),a = m(a, i, o, t, n[c + 12], 20, -1926607734),t = A(t, a, i, o, n[c + 5], 4, -378558),o = A(o, t, a, i, n[c + 8], 11, -2022574463),i = A(i, o, t, a, n[c + 11], 16, 1839030562),a = A(a, i, o, t, n[c + 14], 23, -35309556),t = A(t, a, i, o, n[c + 1], 4, -1530992060),o = A(o, t, a, i, n[c + 4], 11, 1272893353),i = A(i, o, t, a, n[c + 7], 16, -155497632),a = A(a, i, o, t, n[c + 10], 23, -1094730640),t = A(t, a, i, o, n[c + 13], 4, 681279174),o = A(o, t, a, i, n[c + 0], 11, -358537222),i = A(i, o, t, a, n[c + 3], 16, -722521979),a = A(a, i, o, t, n[c + 6], 23, 76029189),t = A(t, a, i, o, n[c + 9], 4, -640364487),o = A(o, t, a, i, n[c + 12], 11, -421815835),i = A(i, o, t, a, n[c + 15], 16, 530742520),a = A(a, i, o, t, n[c + 2], 23, -995338651),t = p(t, a, i, o, n[c + 0], 6, -198630844),o = p(o, t, a, i, n[c + 7], 10, 1126891415),i = p(i, o, t, a, n[c + 14], 15, -1416354905),a = p(a, i, o, t, n[c + 5], 21, -57434055),t = p(t, a, i, o, n[c + 12], 6, 1700485571),o = p(o, t, a, i, n[c + 3], 10, -1894986606),i = p(i, o, t, a, n[c + 10], 15, -1051523),a = p(a, i, o, t, n[c + 1], 21, -2054922799),t = p(t, a, i, o, n[c + 8], 6, 1873313359),o = p(o, t, a, i, n[c + 15], 10, -30611744),i = p(i, o, t, a, n[c + 6], 15, -1560198380),a = p(a, i, o, t, n[c + 13], 21, 1309151649),t = p(t, a, i, o, n[c + 4], 6, -145523070),o = p(o, t, a, i, n[c + 11], 10, -1120210379),i = p(i, o, t, a, n[c + 2], 15, 718787259),a = p(a, i, o, t, n[c + 9], 21, -343485551),t = f(t, s),a = f(a, l),i = f(i, r),o = f(o, d)}return Array(t, a, i, o)
};function r(n) {for (var e = "", t = 0; t < 32 * n.length; t += 8)e += String.fromCharCode(n[t >> 5] >>> t % 32 & 255);return e
};function c(n) {for (var e, t = a ? "0123456789ABCDEF" : "0123456789abcdef", i = "", o = 0; o < n.length; o++)e = n.charCodeAt(o),i += t.charAt(e >>> 4 & 15) + t.charAt(15 & e);return i
};function o(n) {return r(d(l(n), 8 * n.length))
};function i(n) {return c(o(s(n)))
};function s(n) {var e, t, a = "", i = -1;while (++i < n.length)e = n.charCodeAt(i),t = i + 1 < n.length ? n.charCodeAt(i + 1) : 0,55296 <= e && e <= 56319 && 56320 <= t && t <= 57343 && (e = 65536 + ((1023 & e) << 10) + (1023 & t),i++),e <= 127 ? a += String.fromCharCode(e) : e <= 2047 ? a += String.fromCharCode(192 | e >>> 6 & 31, 128 | 63 & e) : e <= 65535 ? a += String.fromCharCode(224 | e >>> 12 & 15, 128 | e >>> 6 & 63, 128 | 63 & e) : e <= 2097151 && (a += String.fromCharCode(240 | e >>> 18 & 7, 128 | e >>> 12 & 63, 128 | e >>> 6 & 63, 128 | 63 & e));return a
};function H(n) {var e = [], t = "";for (var a in n)e.push(n[a]);for (var i = 0; i < e.length; i++)t += e[i] + "";return t += "JzyqgcoojMiQNuQoTlbR5EBT8TsqzJ",t
};function S(n) {for (var e = Object.keys(n).sort(), t = {}, a = 0; a < e.length; a++)t[e[a]] = n[e[a]];return t
};password = '123456'
phoneNum = "18720180853"
function get_info(phoneNum,password){pwd = i(password)e = {"phoneNum": phoneNum,"pwd": pwd,"t": (new Date).getTime(),"tenant": 1,}// console.log(i(password))sig = i(H(S(e)))return [pwd,sig,e.t]
}
console.log(get_info(phoneNum,password))

用python调用访问代码： 

import requests
import execjs
f = open('红人点集.js','r',encoding='utf-8').read()
json_code = execjs.compile(f)
data = json_code.call('get_info','18720180853','123456')
print(data)
headers = {'Accept': 'application/json, text/plain, */*','Accept-Language': 'zh-CN,zh;q=0.9','Cache-Control': 'no-cache','Connection': 'keep-alive','Content-Type': 'application/json','Origin': 'https://www.hrdjyun.com','Pragma': 'no-cache','Sec-Fetch-Dest': 'empty','Sec-Fetch-Mode': 'cors','Sec-Fetch-Site': 'same-site','User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36','sec-ch-ua': '"Not_A Brand";v="8", "Chromium";v="120", "Google Chrome";v="120"','sec-ch-ua-mobile': '?0','sec-ch-ua-platform': '"Windows"',
}json_data = {'phoneNum': '18720180853','pwd': data[0],'t': data[2],'tenant': 1,'sig': data[1],
}response = requests.post('https://user.hrdjyun.com/wechat/phonePwdLogin', headers=headers, json=json_data)
print(response.json())