JS逆向-某招标网站des分析

埃菲尔没有塔尖

已于 2024-02-05 00:03:49 修改

阅读量699

点赞数

分类专栏： JS逆向文章标签： javascript 前端 html

于 2023-05-03 23:05:36 首次发布

本文链接：https://blog.csdn.net/weixin_38819889/article/details/127537034

版权

JS逆向专栏收录该内容

12 篇文章 13 订阅

订阅专栏

看函数命令方式，大胆的测试的用的是DES加解密算法。
在这里插入图片描述

然后往上继续找decryptByDES方法。

在这里插入图片描述
把js代码抠出来，跑一下：

js里面调用CryptoJS实现AES/DES加解密，所以还需要导入这个模块。

var CryptoJS = require('crypto-js')

var CryptoJS = require('crypto-js')
function decryptByDES(_0x3282ec, _0x3dcce1) {
    var _0x456351 = CryptoJS['enc'][_0x18ac('0x4a', 'iLY[')][_0x18ac('0x4b', '3p8G')](_0x3dcce1);
    var _0x3c5437 = CryptoJS[_0x18ac('0x4c', 'uyw)')][_0x18ac('0x4d', 'E%Rr')]({
        'ciphertext': CryptoJS[_0x18ac('0x4e', 'bCC&')][_0x18ac('0x4f', 'O))T')][_0x18ac('0x50', '[MHn')](_0x3282ec)
    }, _0x456351, {
        'mode': CryptoJS[_0x18ac('0x51', '*UPX')][_0x18ac('0x52', '0)^d')],
        'padding': CryptoJS[_0x18ac('0x53', 'Tv0C')]['Pkcs7']
    });
    return _0x3c5437['toString'](CryptoJS[_0x18ac('0xd', 'SIkZ')][_0x18ac('0x54', '6iOW')]);
}

var des_secret = "L0j+JvbeVM0svSpjIwXdE7yTu78wiEszrmb+M9iS8yad8pD3zsjrP1EXPc8D4B3kuNoTYLtXYX+ESOkGU1YwM8ddEuuoTg5uPsqQ9/SuNds="
var des_key = "Ctpsp@884*"
var des_descrypt_str = decryptByDES(des_secret, des_key)
console.log("数据解密成功!:", des_descrypt_str)

运行一下：

在这里插入图片描述
报错，提示：_0x18ac is not defined ，_0x18ac未定义

然后搜索_0x18ac，继续网上找。

在这里插入图片描述
把上面的代码抠出来，再跑一次。

在这里插入图片描述
提示 __0xaada2 is not defined ，__0xaada2也没有定义。

继续搜索__0xaada2 ，往上找。

在这里插入图片描述
然后再把这段代码抠出来，再跑一次。

在这里插入图片描述
然后这次成功的跑出来了。

完整的js代码如下（zhaobiao_des.js）：

var CryptoJS = require('crypto-js')

var __0xaada2 = ['wrrCicKWbQ==', 'w7bCszxQZg==', 'YcOOXQ==', 'w6R7FA==', 'w5hew7nDulA=', 'w4U8cgc=', 'wpzCg2w=', 'wqrCoMKy', 'wo0ROnrDj8KAWxs=', 'w6wjNQ==', 'wo3DmVfCug==', 'd8OfTVvCohk6fwzDqF7DnsOmPAPCqh0=', 'UQJ5wp0zw4MZw4EyfUM/YcKywpXDkcOew7vDpcOH', 'dcOZFsKcw6PDrMKePMO8CBzDnMKzDMK9w4dyZMOFwphaKjo=', 'AsKcwpHCk3vDpSfDqMKVwqzDkMKOw7Y=', 'OMKcwoU4OxrCnsKLYRLCmnHDkUpCw5Zr', 'wrTCr1QYwo1jwp5nw6h+FsKKwq/CvzrDmMK6w7c+Ww==', 'w6dVw7g=', 'woXDuz7CgMKf', 'w64fTDYA', 'E8OMOlPClQ==', 'DMKmwoTDqBA=', 'wrXDjEXDocKw', 'SsOlZ2jCoh8pUgfDr1TDmsOxLQ==', 'wozCnMKeMXQmw4XCiMK7', 'wpvClMOmwpxSXVPCjDM=', 'w5AtXw==', 'wr/Cs8KZDHE=', 'JsOlFEvCosOVwoRBE8KteH3DqsO8UmbDi8K+w4U=', 'csOrw7s/Kg==', 'wonDvBs=', 'wqLDiXjDjcKc', 'wqLCjMKEFE8=', 'w5Brw75WwrQ=', 'B8KpwrILNg==', 'wpfDpMKrw73DhA==', 'wpfDtGA=', 'wojDm1/DrXU=', 'wqLCrsKnA18=', 'w4t6eQ==', 'FcOcw7rCrsOiw4p3', 'wpgCCsKgeA==', 'V8OWGsOrwrFswq5rw4pswoTDucKPPxnDvQ==', 'wqvDiUE=', 'JMOWwptfGQ==', 'wp8RG0vDnMKKXQ==', 'w7Jzw73Dk2M=', 'w71nCQ7CjQ==', 'wrbCrsK1wrosBsKpNA==', 'IMOMACPClMKzbsK+', 'GSNgccK7', 'wrHCtFo6wqoaw6Et', 'NcOQDA==', 'acKUTQ==', 'ecOSw4gJOsOxAA==', 'wrXDglXDpw==', 'wp/CgsKU', 'acO/woE=', 'w6LCkQ3Dqic=', 'wrHDgzDDjy3DoFDCvw==', 'JCNyOQ==', 'wrbDocKpw5bDhg==', 'a8OrwqA=', 'WAhgwr0ew7A9', 'BMKdwpw=', 'w597w7lyw5DCtw==', 'wojClMO6wote', 'woLCksKUMA==', 'wo0qKw==', 'wo8HJQ==', 'SMOpwpt0', 'WcKjd24=', 'OGknRMOv', 'wpvCpcKc', '5YiN6Zq154mW5pyv5Y+q77+7CMKl5L2a5a+85p2T5b+L56m4', 'wrDCkcOawpdc', 'acOgwqY=', 'ZsKncndM', 'w5guYMOgHw==', 'Ohks', 'w4vCozhTZA==', 'w6ArWT8MV8K/AcKG', 'VMOYw7kUJA==', 'wpUVK8OFYcKNSQHCl8K3HsKiasKA', 'T8ONAsKHw60=', 'wpvCnsOZwpZu', 'w5/CmxrDung=', 'ZcOBwpLCn8Kp', 'OAwRUcOb', 'OTtHSsON', 'wqsAGQ==', 'w7XCvzo=', 'e2sRHA==', 'w7QvXCI=', 'w4zCsS9AQA==', 'HXIla8Oy', 'a8OuahPDiA==', 'worDqSU=', 'w6pkAzfClw==', 'w6ETa8OyFQ==', 'UsOYwrs=', 'fMOwwoY='];
(function(_0x491488, _0x2904a9) {
    var _0x54e388 = function(_0x4f0d63) {
        while (--_0x4f0d63) {
            _0x491488['push'](_0x491488['shift']());
        }
    };
    _0x54e388(++_0x2904a9);
}(__0xaada2, 0x1f0));


var _0x18ac = function(_0x4fadf8, _0x47a697) {
    _0x4fadf8 = _0x4fadf8 - 0x0;
    var _0x38d2cc = __0xaada2[_0x4fadf8];
    if (_0x18ac['initialized'] === undefined) {
        (function() {
            var _0x38ee16 = typeof window !== 'undefined' ? window : typeof process === 'object' && typeof require === 'function' && typeof global === 'object' ? global : this;
            var _0x3120aa = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=';
            _0x38ee16['atob'] || (_0x38ee16['atob'] = function(_0x4da23e) {
                    var _0x2d14ac = String(_0x4da23e)['replace'](/=+$/, '');
                    for (var _0x473eb4 = 0x0, _0x2231f7, _0x5211b2, _0x13e435 = 0x0, _0x21e5bb = ''; _0x5211b2 = _0x2d14ac['charAt'](_0x13e435++); ~_0x5211b2 && (_0x2231f7 = _0x473eb4 % 0x4 ? _0x2231f7 * 0x40 + _0x5211b2 : _0x5211b2,
                    _0x473eb4++ % 0x4) ? _0x21e5bb += String['fromCharCode'](0xff & _0x2231f7 >> (-0x2 * _0x473eb4 & 0x6)) : 0x0) {
                        _0x5211b2 = _0x3120aa['indexOf'](_0x5211b2);
                    }
                    return _0x21e5bb;
                }
            );
        }());
        var _0x8653ca = function(_0x5a8829, _0x58aade) {
            var _0x586456 = [], _0x28f5e9 = 0x0, _0xc4a39d, _0x4ebc96 = '', _0x58f954 = '';
            _0x5a8829 = atob(_0x5a8829);
            for (var _0x5c0bfc = 0x0, _0x406c6a = _0x5a8829['length']; _0x5c0bfc < _0x406c6a; _0x5c0bfc++) {
                _0x58f954 += '%' + ('00' + _0x5a8829['charCodeAt'](_0x5c0bfc)['toString'](0x10))['slice'](-0x2);
            }
            _0x5a8829 = decodeURIComponent(_0x58f954);
            for (var _0x3d96e0 = 0x0; _0x3d96e0 < 0x100; _0x3d96e0++) {
                _0x586456[_0x3d96e0] = _0x3d96e0;
            }
            for (_0x3d96e0 = 0x0; _0x3d96e0 < 0x100; _0x3d96e0++) {
                _0x28f5e9 = (_0x28f5e9 + _0x586456[_0x3d96e0] + _0x58aade['charCodeAt'](_0x3d96e0 % _0x58aade['length'])) % 0x100;
                _0xc4a39d = _0x586456[_0x3d96e0];
                _0x586456[_0x3d96e0] = _0x586456[_0x28f5e9];
                _0x586456[_0x28f5e9] = _0xc4a39d;
            }
            _0x3d96e0 = 0x0;
            _0x28f5e9 = 0x0;
            for (var _0x2624a6 = 0x0; _0x2624a6 < _0x5a8829['length']; _0x2624a6++) {
                _0x3d96e0 = (_0x3d96e0 + 0x1) % 0x100;
                _0x28f5e9 = (_0x28f5e9 + _0x586456[_0x3d96e0]) % 0x100;
                _0xc4a39d = _0x586456[_0x3d96e0];
                _0x586456[_0x3d96e0] = _0x586456[_0x28f5e9];
                _0x586456[_0x28f5e9] = _0xc4a39d;
                _0x4ebc96 += String['fromCharCode'](_0x5a8829['charCodeAt'](_0x2624a6) ^ _0x586456[(_0x586456[_0x3d96e0] + _0x586456[_0x28f5e9]) % 0x100]);
            }
            return _0x4ebc96;
        };
        _0x18ac['rc4'] = _0x8653ca;
        _0x18ac['data'] = {};
        _0x18ac['initialized'] = !![];
    }
    var _0xc2c2ce = _0x18ac['data'][_0x4fadf8];
    if (_0xc2c2ce === undefined) {
        if (_0x18ac['once'] === undefined) {
            _0x18ac['once'] = !![];
        }
        _0x38d2cc = _0x18ac['rc4'](_0x38d2cc, _0x47a697);
        _0x18ac['data'][_0x4fadf8] = _0x38d2cc;
    } else {
        _0x38d2cc = _0xc2c2ce;
    }
    return _0x38d2cc;
};

function decryptByDES(_0x3282ec, _0x3dcce1) {
    var _0x456351 = CryptoJS['enc'][_0x18ac('0x4a', 'iLY[')][_0x18ac('0x4b', '3p8G')](_0x3dcce1);
    var _0x3c5437 = CryptoJS[_0x18ac('0x4c', 'uyw)')][_0x18ac('0x4d', 'E%Rr')]({
        'ciphertext': CryptoJS[_0x18ac('0x4e', 'bCC&')][_0x18ac('0x4f', 'O))T')][_0x18ac('0x50', '[MHn')](_0x3282ec)
    }, _0x456351, {
        'mode': CryptoJS[_0x18ac('0x51', '*UPX')][_0x18ac('0x52', '0)^d')],
        'padding': CryptoJS[_0x18ac('0x53', 'Tv0C')]['Pkcs7']
    });
    return _0x3c5437['toString'](CryptoJS[_0x18ac('0xd', 'SIkZ')][_0x18ac('0x54', '6iOW')]);
}

var des_secret = "L0j+JvbeVM0svSpjIwXdE7yTu78wiEszrmb+M9iS8yad8pD3zsjrP1EXPc8D4B3kuNoTYLtXYX+ESOkGU1YwM8ddEuuoTg5uPsqQ9/SuNds="
var des_key = "Ctpsp@884*"
var des_descrypt_str = decryptByDES(des_secret, des_key)
console.log("数据解密成功!:", des_descrypt_str)