小米账号逆向登录 | 逆向分析 | AES加密 | MD5

加密了账号返回结果

{
    "EUI": "D3OFsU/N8jeiGa6M7XVSEQ8HOSataXZQSHM7olxQ8JuB+TiGU1WT0DJQ7og7HpLN061BMBcMqQbKjZJ54rHH68ZAJ1ONat+2zFM59TZAs5aOLtFewE+gPCmHkJQn9M8vcdS9RjugRRg2oJ0SjprkE6DY3NEYmZhq7MEQK1EPZ/c=.dXNlcg==",
    "encryptedParams": {
        "user": "zcvCT/NPu3J4Vz1GASASbQ=="
    }
}

进入加密方法yt 全部扣下来


导入库，修改一下

window = global;
const JSEncrypt = require('jsencrypt');
const CryptoJS = require('crypto-js');

function encryptAes(t) {
    t = t || {};
    var e = function(t) {
        for (var e = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789!@#$%^&*", i = "", r = 0; r < t; r++) {
            var n = Math.floor(Math.random() * e.length);
            i += e.substring(n, n + 1)
        }
        return i
    }(16)
      , i = new JSEncrypt({});
    i.setPublicKey("MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCYEVrK/4Mahiv0pUJgTybx4J9P5dUT/Y0PuwMbk+gMU+jrZnBiXGv6/hCH1avIhoBcE535F8nJQQN3UavZdFkYidsoXuEnat3+eVTp3FslyhRwIBDF09v4vDhRtxFOT+R7uH7h/mzmyA2/+lfIMWGIrffXprYizbV76+YQKhoqFQIDAQAB");
    var r = i.encrypt(window.btoa(e))
      , s = CryptoJS.enc.Utf8.parse("0102030405060708")
      , h = CryptoJS.enc.Utf8.parse(e)
      , u = window.btoa(Object.keys(t).join(","))
      , c = {};
    return Object.keys(t).forEach((function(e) {
        var i = t[e]
          , r = CryptoJS.AES.encrypt(i, h, {
            iv: s,
            padding: CryptoJS.pad.Pkcs7
        });
        r = r.toString(),
        c[e] = r
    }
    )),
    {
        EUI: "".concat(r, ".").concat(u),
        encryptedParams: c
    }
}

密码加密为MD5加密然后再转大写

然后替换掉请求头里面的EUI和账号密码即可