JS逆向-抠代码的第四天【手把手学会抠代码】

　　今天是md5巩固项目，该项目比昨天的复杂一些，但方法思路是一样的。

　　今天的目标：https://www.webportal.top/

　　打开网站，填入账号密码（密码项目以123456做测试）。点击登录抓包后，发现该登录包为ajax请求，其中加密参数只有pwd。

　　接下来，就是解析pwd的加密方式，通过全局所搜，可以出如下结果：

　　第二个很明显不是加密。那么是不是在第一个js文件里面呢，点进去，简单搜索发现了这样的情况：

　　这么友好的吗？果断打下断点，调试，发现到这里后，i.pwd就是我们的密码123456，而$.md5整体是一个加密函数，处理之后，也确实是加密数据。直接跳入函数，会发现该函数时这样的：

　　这里明显是该函数调用了其他函数，而且没有什么加密算法会只有两行！先不用管，把前面的加密动作和这里复制出来进行简单的改写：

　　接下来，对MD5这个改写后的函数简单分析，返回的这个玩意首先我是看不懂的，但是我猜测，字母后面跟括号，那么这个字母肯定是某函数！只有函数才需要传参。通过调试工具进行调试，发现函数u不存在，断点跳进来，查看函数，直接复制过来。看了下格式，改都不需要改。来都来了，我们把这一行的几个函数都先看下，比如，f c u，其中u已经找到了，找下f和c，然后也复制过来，接着就重复上述操作，根据调试工具的提示，缺啥补啥。当我们补完就发现，没问题了，运行也直接出结果了。

　　至此该加密数据解密结束。

　　下附代码：

　　python部分：

 1 import execjs

 2

 3

 4 def read_js(file):

 5     with open(file, 'r', encoding='utf8') as f:

 6         data = f.read()

 7         return data

 8

 9

10 if __name__ == '__main__':

11     js_str = read_js('webportal.js')

12     js_o = execjs.compile(js_str)

13     md5_password = js_o.call('getpwd', '123456')

14     print(md5_password)

　　JS代码部分

  1 function a(e, t, n, o, a, r, s) {

  2 return i(t ^ n ^ o, e, t, a, r, s)

  3 }

  4

  5 function r(e, t, n, o, a, r, s) {

  6 return i(n ^ (t | ~o), e, t, a, r, s)

  7 }

  8

  9 function o(e, t, n, o, a, r, s) {

 10 return i(t & o | n & ~o, e, t, a, r, s)

 11 }

 12

 13 function t(e, t) {

 14 var i = (65535 & e) + (65535 & t);

 15 return (e >> 16) + (t >> 16) + (i >> 16) << 16 | 65535 & i

 16 }

 17

 18 function i(e, i, n, o, a, r) {

 19 return t((s = t(t(i, e), t(o, r))) << (l = a) | s >>> 32 - l, n);

 20 var s, l

 21 }

 22

 23 function n(e, t, n, o, a, r, s) {

 24 return i(t & n | ~t & o, e, t, a, r, s)

 25 }

 26

 27 function d(e) {

 28 var t, i = [];

 29 for (i[(e.length >> 2) - 1] = void 0, t = 0; t < i.length; t += 1) i[t] = 0;

 30 for (t = 0; t < 8 * e.length; t += 8) i[t >> 5] |= (255 & e.charCodeAt(t / 8)) << t % 32;

 31 return i

 32 }

 33

 34 function s(e, i) {

 35 e[i >> 5] |= 128 << i % 32,

 36 e[14 + (i + 64 >>> 9 << 4)] = i;

 37 var s, l, d, c, p, u = 1732584193,

 38 f = -271733879,

 39 h = -1732584194,

 40 g = 271733878;

 41 for (s = 0; s < e.length; s += 16) l = u,

 42 d = f,

 43 c = h,

 44 p = g,

 45 u = n(u, f, h, g, e[s], 7, -680876936),

 46 g = n(g, u, f, h, e[s + 1], 12, -389564586),

 47 h = n(h, g, u, f, e[s + 2], 17, 606105819),

 48 f = n(f, h, g, u, e[s + 3], 22, -1044525330),

 49 u = n(u, f, h, g, e[s + 4], 7, -176418897),

 50 g = n(g, u, f, h, e[s + 5], 12, 1200080426),

 51 h = n(h, g, u, f, e[s + 6], 17, -1473231341),

 52 f = n(f, h, g, u, e[s + 7], 22, -45705983),

 53 u = n(u, f, h, g, e[s + 8], 7, 1770035416),

 54 g = n(g, u, f, h, e[s + 9], 12, -1958414417),

 55 h = n(h, g, u, f, e[s + 10], 17, -42063),

 56 f = n(f, h, g, u, e[s + 11], 22, -1990404162),

 57 u = n(u, f, h, g, e[s + 12], 7, 1804603682),

 58 g = n(g, u, f, h, e[s + 13], 12, -40341101),

 59 h = n(h, g, u, f, e[s + 14], 17, -1502002290),

 60 u = o(u, f = n(f, h, g, u, e[s + 15], 22, 1236535329), h, g, e[s + 1], 5, -165796510),

 61 g = o(g, u, f, h, e[s + 6], 9, -1069501632),

 62 h = o(h, g, u, f, e[s + 11], 14, 643717713),

 63 f = o(f, h, g, u, e[s], 20, -373897302),

 64 u = o(u, f, h, g, e[s + 5], 5, -701558691),

 65 g = o(g, u, f, h, e[s + 10], 9, 38016083),

 66 h = o(h, g, u, f, e[s + 15], 14, -660478335),

 67 f = o(f, h, g, u, e[s + 4], 20, -405537848),

 68 u = o(u, f, h, g, e[s + 9], 5, 568446438),

 69 g = o(g, u, f, h, e[s + 14], 9, -1019803690),

 70 h = o(h, g, u, f, e[s + 3], 14, -187363961),

 71 f = o(f, h, g, u, e[s + 8], 20, 1163531501),

 72 u = o(u, f, h, g, e[s + 13], 5, -1444681467),

 73 g = o(g, u, f, h, e[s + 2], 9, -51403784),

 74 h = o(h, g, u, f, e[s + 7], 14, 1735328473),

 75 u = a(u, f = o(f, h, g, u, e[s + 12], 20, -1926607734), h, g, e[s + 5], 4, -378558),

 76 g = a(g, u, f, h, e[s + 8], 11, -2022574463),

 77 h = a(h, g, u, f, e[s + 11], 16, 1839030562),

 78 f = a(f, h, g, u, e[s + 14], 23, -35309556),

 79 u = a(u, f, h, g, e[s + 1], 4, -1530992060),

 80 g = a(g, u, f, h, e[s + 4], 11, 1272893353),

 81 h = a(h, g, u, f, e[s + 7], 16, -155497632),

 82 f = a(f, h, g, u, e[s + 10], 23, -1094730640),

 83 u = a(u, f, h, g, e[s + 13], 4, 681279174),

 84 g = a(g, u, f, h, e[s], 11, -358537222),

 85 h = a(h, g, u, f, e[s + 3], 16, -722521979),

 86 f = a(f, h, g, u, e[s + 6], 23, 76029189),

 87 u = a(u, f, h, g, e[s + 9], 4, -640364487),

 88 g = a(g, u, f, h, e[s + 12], 11, -421815835),

 89 h = a(h, g, u, f, e[s + 15], 16, 530742520),

 90 u = r(u, f = a(f, h, g, u, e[s + 2], 23, -995338651), h, g, e[s], 6, -198630844),

 91 g = r(g, u, f, h, e[s + 7], 10, 1126891415),

 92 h = r(h, g, u, f, e[s + 14], 15, -1416354905),

 93 f = r(f, h, g, u, e[s + 5], 21, -57434055),

 94 u = r(u, f, h, g, e[s + 12], 6, 1700485571),

 95 g = r(g, u, f, h, e[s + 3], 10, -1894986606),

 96 h = r(h, g, u, f, e[s + 10], 15, -1051523),

 97 f = r(f, h, g, u, e[s + 1], 21, -2054922799),

 98 u = r(u, f, h, g, e[s + 8], 6, 1873313359),

 99 g = r(g, u, f, h, e[s + 15], 10, -30611744),

100 h = r(h, g, u, f, e[s + 6], 15, -1560198380),

101 f = r(f, h, g, u, e[s + 13], 21, 1309151649),

102 u = r(u, f, h, g, e[s + 4], 6, -145523070),

103 g = r(g, u, f, h, e[s + 11], 10, -1120210379),

104 h = r(h, g, u, f, e[s + 2], 15, 718787259),

105 f = r(f, h, g, u, e[s + 9], 21, -343485551),

106 u = t(u, l),

107 f = t(f, d),

108 h = t(h, c),

109 g = t(g, p);

110 return [u, f, h, g]

111 }

112

113 function p(e) {

114 return unescape(encodeURIComponent(e))

115 }

116 function l(e) {

117 var t, i = "";

118 for (t = 0; t < 32 * e.length; t += 8) i += String.fromCharCode(e[t >> 5] >>> t % 32 & 255);

119 return i

120 }

121 function c(e) {

122 var t, i, n = "";

123 for (i = 0; i < e.length; i += 1) t = e.charCodeAt(i),

124 n += "0123456789abcdef".charAt(t >>> 4 & 15) + "0123456789abcdef".charAt(15 & t);

125 return n

126 }

127

128 function u(e) {

129 return function(e) {

130     return l(s(d(e), 8 * e.length))

131 } (p(e))

132 }

133

134 MD5 = function(e, t, i) {

135 return t ? i ? f(t, e) : c(f(t, e)) : i ? u(e) : c(u(e))

136 }

137

138 function getpwd(pwd) {

139 var password = MD5(pwd);

140 return password

141 }

JS代码部分

巴特西

JS逆向-抠代码的第四天【手把手学会抠代码】

最新文章

热门文章