JS逆向-抠代码的第四天【手把手学会抠代码】

　　今天是md5巩固项目，该项目比昨天的复杂一些，但方法思路是一样的。

　　今天的目标：https://www.webportal.top/

　　打开网站，填入账号密码（密码项目以123456做测试）。点击登录抓包后，发现该登录包为ajax请求，其中加密参数只有pwd。

　　

　　接下来，就是解析pwd的加密方式，通过全局所搜，可以出如下结果：

　　

　　第二个很明显不是加密。那么是不是在第一个js文件里面呢，点进去，简单搜索发现了这样的情况：

　　

　　这么友好的吗？果断打下断点，调试，发现到这里后，i.pwd就是我们的密码123456，而$.md5整体是一个加密函数，处理之后，也确实是加密数据。直接跳入函数，会发现该函数时这样的：

　　

　　这里明显是该函数调用了其他函数，而且没有什么加密算法会只有两行！先不用管，把前面的加密动作和这里复制出来进行简单的改写：

　　

　　接下来，对MD5这个改写后的函数简单分析，返回的这个玩意首先我是看不懂的，但是我猜测，字母后面跟括号，那么这个字母肯定是某函数！只有函数才需要传参。通过调试工具进行调试，发现函数u不存在，断点跳进来，查看函数，直接复制过来。看了下格式，改都不需要改。来都来了，我们把这一行的几个函数都先看下，比如，f c u，其中u已经找到了，找下f和c，然后也复制过来，接着就重复上述操作，根据调试工具的提示，缺啥补啥。当我们补完就发现，没问题了，运行也直接出结果了。

　　

　　至此该加密数据解密结束。

　　下附代码：

　　python部分：

 1 import execjs
 2
 3
 4 def read_js(file):
 5     with open(file, 'r', encoding='utf8') as f:
 6         data = f.read()
 7         return data
 8
 9
10 if __name__ == '__main__':
11     js_str = read_js('webportal.js')
12     js_o = execjs.compile(js_str)
13     md5_password = js_o.call('getpwd', '123456')
14     print(md5_password)

　　JS代码部分

  1 function a(e, t, n, o, a, r, s) {
  2 return i(t ^ n ^ o, e, t, a, r, s)
  3 }
  4
  5 function r(e, t, n, o, a, r, s) {
  6 return i(n ^ (t | ~o), e, t, a, r, s)
  7 }
  8
  9 function o(e, t, n, o, a, r, s) {
 10 return i(t & o | n & ~o, e, t, a, r, s)
 11 }
 12
 13 function t(e, t) {
 14 var i = (65535 & e) + (65535 & t);
 15 return (e >> 16) + (t >> 16) + (i >> 16) << 16 | 65535 & i
 16 }
 17
 18 function i(e, i, n, o, a, r) {
 19 return t((s = t(t(i, e), t(o, r))) << (l = a) | s >>> 32 - l, n);
 20 var s, l
 21 }
 22
 23 function n(e, t, n, o, a, r, s) {
 24 return i(t & n | ~t & o, e, t, a, r, s)
 25 }
 26
 27 function d(e) {
 28 var t, i = [];
 29 for (i[(e.length >> 2) - 1] = void 0, t = 0; t < i.length; t += 1) i[t] = 0;
 30 for (t = 0; t < 8 * e.length; t += 8) i[t >> 5] |= (255 & e.charCodeAt(t / 8)) << t % 32;
 31 return i
 32 }
 33
 34 function s(e, i) {
 35 e[i >> 5] |= 128 << i % 32,
 36 e[14 + (i + 64 >>> 9 << 4)] = i;
 37 var s, l, d, c, p, u = 1732584193,
 38 f = -271733879,
 39 h = -1732584194,
 40 g = 271733878;
 41 for (s = 0; s < e.length; s += 16) l = u,
 42 d = f,
 43 c = h,
 44 p = g,
 45 u = n(u, f, h, g, e[s], 7, -680876936),
 46 g = n(g, u, f, h, e[s + 1], 12, -389564586),
 47 h = n(h, g, u, f, e[s + 2], 17, 606105819),
 48 f = n(f, h, g, u, e[s + 3], 22, -1044525330),
 49 u = n(u, f, h, g, e[s + 4], 7, -176418897),
 50 g = n(g, u, f, h, e[s + 5], 12, 1200080426),
 51 h = n(h, g, u, f, e[s + 6], 17, -1473231341),
 52 f = n(f, h, g, u, e[s + 7], 22, -45705983),
 53 u = n(u, f, h, g, e[s + 8], 7, 1770035416),
 54 g = n(g, u, f, h, e[s + 9], 12, -1958414417),
 55 h = n(h, g, u, f, e[s + 10], 17, -42063),
 56 f = n(f, h, g, u, e[s + 11], 22, -1990404162),
 57 u = n(u, f, h, g, e[s + 12], 7, 1804603682),
 58 g = n(g, u, f, h, e[s + 13], 12, -40341101),
 59 h = n(h, g, u, f, e[s + 14], 17, -1502002290),
 60 u = o(u, f = n(f, h, g, u, e[s + 15], 22, 1236535329), h, g, e[s + 1], 5, -165796510),
 61 g = o(g, u, f, h, e[s + 6], 9, -1069501632),
 62 h = o(h, g, u, f, e[s + 11], 14, 643717713),
 63 f = o(f, h, g, u, e[s], 20, -373897302),
 64 u = o(u, f, h, g, e[s + 5], 5, -701558691),
 65 g = o(g, u, f, h, e[s + 10], 9, 38016083),
 66 h = o(h, g, u, f, e[s + 15], 14, -660478335),
 67 f = o(f, h, g, u, e[s + 4], 20, -405537848),
 68 u = o(u, f, h, g, e[s + 9], 5, 568446438),
 69 g = o(g, u, f, h, e[s + 14], 9, -1019803690),
 70 h = o(h, g, u, f, e[s + 3], 14, -187363961),
 71 f = o(f, h, g, u, e[s + 8], 20, 1163531501),
 72 u = o(u, f, h, g, e[s + 13], 5, -1444681467),
 73 g = o(g, u, f, h, e[s + 2], 9, -51403784),
 74 h = o(h, g, u, f, e[s + 7], 14, 1735328473),
 75 u = a(u, f = o(f, h, g, u, e[s + 12], 20, -1926607734), h, g, e[s + 5], 4, -378558),
 76 g = a(g, u, f, h, e[s + 8], 11, -2022574463),
 77 h = a(h, g, u, f, e[s + 11], 16, 1839030562),
 78 f = a(f, h, g, u, e[s + 14], 23, -35309556),
 79 u = a(u, f, h, g, e[s + 1], 4, -1530992060),
 80 g = a(g, u, f, h, e[s + 4], 11, 1272893353),
 81 h = a(h, g, u, f, e[s + 7], 16, -155497632),
 82 f = a(f, h, g, u, e[s + 10], 23, -1094730640),
 83 u = a(u, f, h, g, e[s + 13], 4, 681279174),
 84 g = a(g, u, f, h, e[s], 11, -358537222),
 85 h = a(h, g, u, f, e[s + 3], 16, -722521979),
 86 f = a(f, h, g, u, e[s + 6], 23, 76029189),
 87 u = a(u, f, h, g, e[s + 9], 4, -640364487),
 88 g = a(g, u, f, h, e[s + 12], 11, -421815835),
 89 h = a(h, g, u, f, e[s + 15], 16, 530742520),
 90 u = r(u, f = a(f, h, g, u, e[s + 2], 23, -995338651), h, g, e[s], 6, -198630844),
 91 g = r(g, u, f, h, e[s + 7], 10, 1126891415),
 92 h = r(h, g, u, f, e[s + 14], 15, -1416354905),
 93 f = r(f, h, g, u, e[s + 5], 21, -57434055),
 94 u = r(u, f, h, g, e[s + 12], 6, 1700485571),
 95 g = r(g, u, f, h, e[s + 3], 10, -1894986606),
 96 h = r(h, g, u, f, e[s + 10], 15, -1051523),
 97 f = r(f, h, g, u, e[s + 1], 21, -2054922799),
 98 u = r(u, f, h, g, e[s + 8], 6, 1873313359),
 99 g = r(g, u, f, h, e[s + 15], 10, -30611744),
100 h = r(h, g, u, f, e[s + 6], 15, -1560198380),
101 f = r(f, h, g, u, e[s + 13], 21, 1309151649),
102 u = r(u, f, h, g, e[s + 4], 6, -145523070),
103 g = r(g, u, f, h, e[s + 11], 10, -1120210379),
104 h = r(h, g, u, f, e[s + 2], 15, 718787259),
105 f = r(f, h, g, u, e[s + 9], 21, -343485551),
106 u = t(u, l),
107 f = t(f, d),
108 h = t(h, c),
109 g = t(g, p);
110 return [u, f, h, g]
111 }
112
113 function p(e) {
114 return unescape(encodeURIComponent(e))
115 }
116 function l(e) {
117 var t, i = "";
118 for (t = 0; t < 32 * e.length; t += 8) i += String.fromCharCode(e[t >> 5] >>> t % 32 & 255);
119 return i
120 }
121 function c(e) {
122 var t, i, n = "";
123 for (i = 0; i < e.length; i += 1) t = e.charCodeAt(i),
124 n += "0123456789abcdef".charAt(t >>> 4 & 15) + "0123456789abcdef".charAt(15 & t);
125 return n
126 }
127
128 function u(e) {
129 return function(e) {
130     return l(s(d(e), 8 * e.length))
131 } (p(e))
132 }
133
134 MD5 = function(e, t, i) {
135 return t ? i ? f(t, e) : c(f(t, e)) : i ? u(e) : c(u(e))
136 }
137
138 function getpwd(pwd) {
139 var password = MD5(pwd);
140 return password
141 }

JS代码部分