请注意，本文编写于 105 天前，最后修改于 98 天前，其中某些信息可能已经过时。

本篇文章作者ius，本文属i春秋原创奖励计划，未经许可禁止转载
原文地址：https://bbs.ichunqiu.com/thread-63786-1-1.html

某安信登录机制逆向分析

我们先随意输入账号密码进行测试

点击登录后出现极验滑块

极验三代水平不高，直接秒。

滑块请求成功之后，会向该链接请求公钥https://user.skyeye.qianxin.com/api/v1/encrypt/public-key

查看我们的登录请求

发现请求是XHR，先用XHR断个点

断住之后逐步跟栈

找到key_iv的位置

f是请求来的公钥

r=s(),进入s函数，随机生成的

s = function() {
            for (var e = "", a = 0; a < 32; a++)
                e += Math.floor(16 * Math.random()).toString(16);
            return e
        }

然后进入l函数查看,简单的加密，把f替换成crypto即可

b是个 RSA 对象，原型链存放着加密方法此处使用的是JSEncrypt

直接用nodejs实现

密码加密

把代码抠出来，运行，一模一样

参数都解决完了，整理一下代码

运行测试看看

登录成功

总体来说，该网站登录流程比较简单，水平不高。

下面附上代码：

const crypto = require("crypto-js");
window = global
const NodeRSA = require('jsencrypt');

function short() {
    for (var e = "", a = 0; a < 32; a++)
        e += Math.floor(16 * Math.random()).toString(16);
    return e
}

function password(e, a) {
    var c = a.substring(0, 16);
    a = crypto.enc.Utf8.parse(a),
        c = crypto.enc.Utf8.parse(c),
        e = "string" === typeof e ? e : JSON.stringify(e);
    var t = crypto.AES.encrypt(e, a, {
        iv: c,
        mode: crypto.mode.CBC,
        padding: crypto.pad.Pkcs7
    });
    return t.toString()
}

function key_iv(e, a) {
    var c = a.substring(0, 16);
    a = crypto.enc.Utf8.parse(a),
        c = crypto.enc.Utf8.parse(c);
    var t = {
        key: crypto.enc.Base64.stringify(a),
        iv: crypto.enc.Base64.stringify(c)
    };
    t = JSON.stringify(t)
    var aa = new NodeRSA()
    aa.setPublicKey(e);
    return aa.encrypt(t)
}

import json
import execjs
import requests

account="11111111111"
password="111111"

headers = {
  'Accept': 'application/json, text/plain, */*',
  'Accept-Language': 'zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7',
  'Cache-Control': 'no-cache',
  'Connection': 'keep-alive',
  'Cookie': 'next=http%3A//forum.***.net/btlogin%3FredirectPath%3Dhttps%3A//forum.***.net/; wzws_sessionid=gjA1NjM4N6Bll33vgTljMWNlMoAyNDA4OjgyMTU6NzIxOToxZTUwOjk1ZDpkYjhlOjhlYzk6ODgzZA==; User-Center=3e7f3775-4f57-46d8-91ec-91adcb46b0bd; User-Center=3e7f3775-4f57-46d8-91ec-91adcb46b0bd',
  'Pragma': 'no-cache',
  'Referer': 'https://user.skyeye.***.com/user/sign-in?next=http://forum.***.net/btlogin?redirectPath=https://forum.butian.net/',
  'Sec-Fetch-Dest': 'empty',
  'Sec-Fetch-Mode': 'cors',
  'Sec-Fetch-Site': 'same-origin',
  'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36',
  'sec-ch-ua': '"Not_A Brand";v="8", "Chromium";v="120", "Google Chrome";v="120"',
  'sec-ch-ua-mobile': '?0',
  'sec-ch-ua-platform': '"Windows"'
}
def get_pem():
    url = "https://user.skyeye.***.com/api/v1/encrypt/public-key"
    response = requests.request("GET", url, headers=headers)
    return response.json()["public_key"]

yzm = eval(requests.get("https://www.illusory.cn/api/qianxin.php").text)

with open("1.js","r",encoding="utf-8") as f:
    file_data = f.read()
cxk = execjs.compile(file_data)
short = cxk.call("short")

pwd = cxk.call("password",password,short)
key = cxk.call("key_iv",get_pem(),short)
# exit()
url = "https://user.skyeye.***.com/api/v1/sign-in"

payload = json.dumps({
  "account": account,
  "password": pwd,
  "geetest_challenge": yzm[1],
  "geetest_validate": json.loads(yzm[0])["validate"],
  "geetest_seccode": json.loads(yzm[0])["validate"]+"|jordan",
  "next": "http://forum.***.net/btlogin?redirectPath=https://forum.***.net/",
  "custom_callback_params": {
    "redirectPath": "https://forum.***.net/"
  },
  "key_iv": key,
  "csrf_token": "1704457269##ffcf2ba524ba000e09ef4decc5bd632b7720f622"
})
headers = {
  'Accept': 'application/json',
  'Accept-Language': 'zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7',
  'Cache-Control': 'no-cache',
  'Connection': 'keep-alive',
  'Content-Type': 'application/json',
  'Cookie': 'next=http%3A//forum.***.net/btlogin%3FredirectPath%3Dhttps%3A//forum.butian.net/; wzws_sessionid=gjA1NjM4N6Bll33vgTljMWNlMoAyNDA4OjgyMTU6NzIxOToxZTUwOjk1ZDpkYjhlOjhlYzk6ODgzZA==; User-Center=3e7f3775-4f57-46d8-91ec-91adcb46b0bd; User-Center=3e7f3775-4f57-46d8-91ec-91adcb46b0bd;csrf_token=1704457269##ffcf2ba524ba000e09ef4decc5bd632b7720f622',
  'Origin': 'https://user.skyeye.***.com',
  'Pragma': 'no-cache',
  'Referer': 'https://user.skyeye.***.com/user/sign-in?next=http://forum.***.net/btlogin?redirectPath=https://forum.butian.net/',
  'Sec-Fetch-Dest': 'empty',
  'Sec-Fetch-Mode': 'cors',
  'Sec-Fetch-Site': 'same-origin',
  'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36',
  'sec-ch-ua': '"Not_A Brand";v="8", "Chromium";v="120", "Google Chrome";v="120"',
  'sec-ch-ua-mobile': '?0',
  'sec-ch-ua-platform': '"Windows"'
}

response = requests.request("POST", url, headers=headers, data=payload)
res = response.json()
if res["status"]==200:
  result=requests.get(res["redirect"], headers=headers)
  print(result.cookies)
  with open('cookies.json', 'w') as cookie_file:
    json.dump(result.cookies.get_dict(), cookie_file)

自动登录都有了，顺便写个签到脚本吧

import json

import requests
from lxml import etree

session = requests.Session()
url = "https://forum.***.net/"
headers = {
    'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7',
    'Accept-Language': 'zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7',
    'Content-Type': 'application/x-www-form-urlencoded',
    'Cache-Control': 'no-cache',
    'Connection': 'keep-alive',
    'Pragma': 'no-cache',
    'Sec-Fetch-Dest': 'document',
    'Sec-Fetch-Mode': 'navigate',
    'Sec-Fetch-Site': 'none',
    'Sec-Fetch-User': '?1',
    'referer': 'https://forum.***.net/sign',
    'Upgrade-Insecure-Requests': '1',
    'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36',
    'sec-ch-ua': '"Not_A Brand";v="8", "Chromium";v="120", "Google Chrome";v="120"',
    'sec-ch-ua-mobile': '?0',
    'sec-ch-ua-platform': '"Windows"'
}
with open('cookies.json', 'r') as cookie_file:
    cookies = json.load(cookie_file)
    session.cookies.update(cookies)
response = session.request("GET", url, headers=headers)

xx = etree.HTML(response.text)
xxx = xx.xpath('/html/head/meta[@name="csrf-token"]/@content')[0]
url = "https://forum.***.net/sign"
response = session.request("POST", url, headers=headers, data='_token='+xxx)
print(response)

完整代码请从github获取->https://github.com/xvhuan/qianxin

js逆向

某安信登录机制逆向分析

某安信登录机制逆向分析

添加新评论

评论列表

某安信登录机制逆向分析

某安信登录机制逆向分析

微博访客系统逆向分析

某易云音乐加密参数逆向分析

添加新评论

评论列表