JS逆向入门案例-XX期刊服务平台登录(含RS6)-01

JS逆向入门案例-XX期刊服务平台登录(含RS6)-01

提示：XX期刊服务平台登录,本站也是一个瑞树6网站，文章最后会讲一下补环境的检测点。

---

---

前言

提示：仅供学习，不得用做商业交易，如有侵权请及时联系！

URL：aHR0cHM6Ly9xaWthbi5jcXZpcC5jb20vUWlrYW4vU2VhcmNoL0luZGV4

---

提示：以下是本篇文章需要逆向的参数
DATA: LoginUserName、LoginUserPassword、va

一、逆向分析

1. 找到加密参数的位置

• 搜索
  

• 堆栈
  

• 事件
  

• XHR
  

2. 找到加密参数的位置-分析加密方式

提示：spdier网站：https://spidertools.cn/#/crypto

环境需要nodeJs--下载三方库jsencrypt和crypto-js
cmd:npm install xxx

const JSEncrypt = require('jsencrypt');
const CryptJs = require("crypto-js");

function encrypt_data(user,pwd){
    var encrypt = new JSEncrypt();
    encrypt.setPublicKey("-----BEGIN PUBLIC KEY-----MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDesz3GocmDJaF4HZD4xgAMstc0cKz6gSZgEeqQASfoEbx2YY/I0ZTiKhI1BfrStAqAknrqj30jRUenf0HePaS1NrKfrYHBazRwbQnpru2wOuS+N34wlqL16TcQAU6dt/CnIRPb3LSA6kfqVHL/dStH5R0NsuAAnt9sMqJMTs8eVQIDAQAB-----END PUBLIC KEY-----");
    var LoginUserName =  encrypt.encrypt(user),
        va = encrypt.encrypt(pwd),
        LoginUserPassword = encrypt.encrypt(CryptJs.MD5(pwd).toString());
    return {
        "LoginUserName": LoginUserName,
        "LoginUserPassword": LoginUserPassword,
        "va": va
    }
}

二、python代码

代码如下（示例）：

import execjs
import requests

user,pwd = 'xxx','xxx'
headers = {
    "authority": "qikan.cqvip.com",
    "pragma": "no-cache",
    "cache-control": "no-cache",
    "accept": "application/json, text/javascript, */*; q=0.01",
    "x-requested-with": "XMLHttpRequest",
    "user-agent": "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.198 Safari/537.36",
    "content-type": "application/x-www-form-urlencoded; charset=UTF-8",
    "origin": "xxx",
    "sec-fetch-site": "same-origin",
    "sec-fetch-mode": "cors",
    "sec-fetch-dest": "empty",
    "referer": "xxx",
    "accept-language": "zh-CN,zh;q=0.9"
}
url = "https://xxx"
data = {
    "LoginType": "normallogin",
    "IsWeakPassword": "1"
}
data = dict(data,**execjs.compile(open('./encryptLogin.js','r',encoding='utf-8').read()).call('encrypt_data',user,pwd))
response = requests.post(url, headers=headers, data=data)

print(response.text)

最后运行结果

三、首页瑞树6-补环境的检测点

1. 文件位置和浏览器版本检测

   ActiveXObject=undefined;
   window.ActivteXObject=undefined;
   delete __filename;
   delete __dirname;
   

2. dom树

   meta = [
               {
                   'http-equiv':"Content-Type",
                   content:"text/html; charset=utf-8",
                   parentNode:{
                       removeChild:function (){}
                   },
                   getAttribute: function(res){
                       console.log('meta[getAttribute]:', arguments)
                       if(res === 'r'){
                           return "m"
                       }
                   },
               },
               {
                   content:content,
                   parentNode:{
                       removeChild:function (){}
                   },
                   getAttribute: function(res){
                       console.log('meta[getAttribute]:', arguments)
                       if(res === 'r'){
                           return "m"
                       }
                   },
               }
           ]
    script = [
       {
           getAttribute: function(res){
               console.log('script[getAttribute]:', arguments)
               if(res === 'r'){
                   return "m"
               }
           },
           parentElement:{
               removeChild:function (res){
                   console.log('script[removeChild]:', arguments)
               }
           },
           innerText:ts所在的js文件内容，require('./jscq_ts.js')
       }
   ]
   document = {
   	getElementById: function (arg) {
   		if(arg === 'FbkwzLN5XOx0'){
           return meta[1]
      		}
   	},
   	getElementsByTagName:function (arg){
   		if(arg === 'script'){
           	return script
       	}
   	}
   }
   

3. bom方法

   window.webkitRequestFileSystem = function(){
       return undefined
   }
   window.open = function(){}
   window.badboy = function(){}
   window.XMLHttpRequest = function(){}
   window.Navigator = function (){}
   window.CanvasRenderingContext2D = function (){
       console.log('CanvasRenderingContext2D',arguments)
   }
   window.HTMLCanvasElement = function (){
       console.log('HTMLCanvasElement',arguments)
   }
   

4. 环境
   

5. 运行结果
   

其它环境需自行补充，如补过其它RS6的可以讲当前这些环境参数添加进去即可。

总结

提示：有需要可加v:wzwzwz0613