JS逆向分析案例-01

登陆分析

网址:aHR0cHM6Ly9wYXNzcG9ydC5taWd1LmNuL2xvZ2luP3NvdXJjZWlkPTIwODAwMyZhcHB0eXBlPTAmZm9yY2VBdXRobj1mYWxzZSZpc1Bhc3NpdmU9ZmFsc2UmYXV0aFR5cGU9TWlndVBhc3Nwb3J0JnBhc3N3b3JkQ29udHJvbD0wJmRpc3BsYXk9d2ViJnJlZmVyZXI9aHR0cHM6Ly93d3cubWlndS5jbi9pbmRleC5odG1sJmxvZ2ludHlwZT0xJnFxPW51bGwmd2VpYm89bnVsbCZhbGlwYXk9bnVsbCZ3ZWl4aW49bnVsbCZhbmRQYXNzPW51bGwmcGhvbmVOdW1iZXI9JmNhbGxiYWNrVVJMPWh0dHBzJTNBJTJGJTJGd3d3Lm1pZ3UuY24lMkZpbmRleC5odG1sJnJlbGF5U3RhdGU9Jm9wZW5QYWdlPSZoaWRlUmVnaXN0ZXI9JmhpZGVGb3JnZXRQYXNzPSZzaW09Jm5lZWRPbmVLZXk9MCZoaWRlcHM9MA==

点击登陆,抓个包看看,这里可以看到有很多参数,
第一个包返回的就是pubKey 先不用管这个
看第二个包~我们搜索enpassword

通过搜索看到有一个位置,点进去看下

根据H5的常识, 想要定位一个元素需要ByID ByName ByClass
接着搜索J_RsaPwd 看到这个名字有没有想到什么…

通过搜索发现有一个js文件存在这样的关键字,在js文件内部搜索,发现有3个位置
我们分别下断,点击登陆,发现断在下图的位置,是rsa加密
b.val是我们的明文密码

扣代码…
这里使用的工具是发条JS调试工具

window = this;
navigator = {}
function GetRSA() {
function d(a, b, c) {
    null != a && ("number" == typeof a ? this.fromNumber(a, b, c) : null == b && "string" != typeof a ? this.fromString(a, 256) : this.fromString(a, b))
}
function e() {
    return new d(null)
}
function f(a, b, c, d, e, f) {
    for (; --f >= 0;) {
        var g = b * this[a++] + c[d] + e;
        e = Math.floor(g / 67108864),
        c[d++] = 67108863 & g
    }
    return e
}
function g(a, b, c, d, e, f) {
    for (var g = 32767 & b,
    h = b >> 15; --f >= 0;) {
        var i = 32767 & this[a],
        j = this[a++] >> 15,
        k = h * i + j * g;
        i = g * i + ((32767 & k) << 15) + c[d] + (1073741823 & e),
        e = (i >>> 30) + (k >>> 15) + h * j + (e >>> 30),
        c[d++] = 1073741823 & i
    }
    return e
}
function h(a, b, c, d, e, f) {
    for (var g = 16383 & b,
    h = b >> 14; --f >= 0;) {
        var i = 16383 & this[a],
        j = this[a++] >> 14,
        k = h * i + j * g;
        i = g * i + ((16383 & k) << 14) + c[d] + e,
        e = (i >> 28) + (k >> 14) + h * j,
        c[d++] = 268435455 & i
    }
    return e
}
function i(a) {
    return nb.charAt(a)
}
function j(a, b) {
    var c = ob[a.charCodeAt(b)];
    return null == c ? -1 : c
}
function k(a) {
    for (var b = this.t - 1; b >= 0; --b) a[b] = this[b];
    a.t = this.t,
    a.s = this.s
}
function l(a) {
    this.t = 1,
    this.s = 0 > a ? -1 : 0,
    a > 0 ? this[0] = a: -1 > a ? this[0] = a + this.DV: this.t = 0
}
function m(a) {
    var b = e();
    return b.fromInt(a),
    b
}
function n(a, b) {
    var c;
    if (16 == b) c = 4;
    else if (8 == b) c = 3;
    else if (256 == b) c = 8;
    else if (2 == b) c = 1;
    else if (32 == b) c = 5;
    else {
        if (4 != b) return void this.fromRadix(a, b);
        c = 2
    }
    this.t = 0,
    this.s = 0;
    for (var e = a.length,
    f = !1,
    g = 0; --e >= 0;) {
        var h = 8 == c ? 255 & a[e] : j(a, e);
        0 > h ? "-" == a.charAt(e) && (f = !0) : (f = !1, 0 == g ? this[this.t++] = h: g + c > this.DB ? (this[this.t - 1] |= (h & (1 << this.DB - g) - 1) << g, this[this.t++] = h >> this.DB - g) : this[this.t - 1] |= h << g, g += c, g >= this.DB && (g -= this.DB))
    }
    8 == c && 0 != (128 & a[0]) && (this.s = -1, g > 0 && (this[this.t - 1] |= (1 << this.DB - g) - 1 << g)),
    this.clamp(),
    f && d.ZERO.subTo(this, this)
}
function o() {
    for (var a = this.s & this.DM; this.t > 0 && this[this.t - 1] == a;)--this.t
}
function p(a) {
    if (this.s < 0) return "-" + this.negate().toString(a);
    var b;
    if (16 == a) b = 4;
    else if (8 == a) b = 3;
    else if (2 == a) b = 1;
    else if (32 == a) b = 5;
    else {
        if (4 != a) return this.toRadix(a);
        b = 2
    }
    var c, d = (1 << b) - 1,
    e = !1,
    f = "",
    g = this.t,
    h = this.DB - g * this.DB % b;
    if (g-->0) for (h < this.DB && (c = this[g] >> h) > 0 && (e = !0, f = i(c)); g >= 0;) b > h ? (c = (this[g] & (1 << h) - 1) << b - h, c |= this[--g] >> (h += this.DB - b)) : (c = this[g] >> (h -= b) & d, 0 >= h && (h += this.DB, --g)),
    c > 0 && (e = !0),
    e && (f += i(c));
    return e ? f: "0"
}
function q() {
    var a = e();
    return d.ZERO.subTo(this, a),
    a
}
function r() {
    return this.s < 0 ? this.negate() : this
}
function s(a) {
    var b = this.s - a.s;
    if (0 != b) return b;
    var c = this.t;
    if (b = c - a.t, 0 != b) return this.s < 0 ? -b: b;
    for (; --c >= 0;) if (0 != (b = this[c] - a[c])) return b;
    return 0
}
function t(a) {
    var b, c = 1;
    return 0 != (b = a >>> 16) && (a = b, c += 16),
    0 != (b = a >> 8) && (a = b, c += 8),
    0 != (b = a >> 4) && (a = b, c += 4),
    0 != (b = a >> 2) && (a = b, c += 2),
    0 != (b = a >> 1) && (a = b, c += 1),
    c
}
function u() {
    return this.t <= 0 ? 0 : this.DB * (this.t - 1) + t(this[this.t - 1] ^ this.s & this.DM)
}
function v(a, b) {
    var c;
    for (c = this.t - 1; c >= 0; --c) b[c + a] = this[c];
    for (c = a - 1; c >= 0; --c) b[c] = 0;
    b.t = this.t + a,
    b.s = this.s
}
function w(a, b) {
    for (var c = a; c < this.t; ++c) b[c - a] = this[c];
    b.t = Math.max(this.t - a, 0),
    b.s = this.s
}
function x(a, b) {
    var c, d = a % this.DB,
    e = this.DB - d,
    f = (1 << e) - 1,
    g = Math.floor(a / this.DB),
    h = this.s << d & this.DM;
    for (c = this.t - 1; c >= 0; --c) b[c + g + 1] = this[c] >> e | h,
    h = (this[c] & f) << d;
    for (c = g - 1; c >= 0; --c) b[c] = 0;
    b[g] = h,
    b.t = this.t + g + 1,
    b.s = this.s,
    b.clamp()
}
function y(a, b) {
    b.s = this.s;
    var c = Math.floor(a / this.DB);
    if (c >= this.t) return void(b.t = 0);
    var d = a % this.DB,
    e = this.DB - d,
    f = (1 << d) - 1;
    b[0] = this[c] >> d;
    for (var g = c + 1; g < this.t; ++g) b[g - c - 1] |= (this[g] & f) << e,
    b[g - c] = this[g] >> d;
    d > 0 && (b[this.t - c - 1] |= (this.s & f) << e),
    b.t = this.t - c,
    b.clamp()
}
function z(a, b) {
    for (var c = 0,
    d = 0,
    e = Math.min(a.t, this.t); e > c;) d += this[c] - a[c],
    b[c++] = d & this.DM,
    d >>= this.DB;
    if (a.t < this.t) {
        for (d -= a.s; c < this.t;) d += this[c],
        b[c++] = d & this.DM,
        d >>= this.DB;
        d += this.s
    } else {
        for (d += this.s; c < a.t;) d -= a[c],
        b[c++] = d & this.DM,
        d >>= this.DB;
        d -= a.s
    }
    b.s = 0 > d ? -1 : 0,
    -1 > d ? b[c++] = this.DV + d: d > 0 && (b[c++] = d),
    b.t = c,
    b.clamp()
}
function A(a, b) {
    var c = this.abs(),
    e = a.abs(),
    f = c.t;
    for (b.t = f + e.t; --f >= 0;) b[f] = 0;
    for (f = 0; f < e.t; ++f) b[f + c.t] = c.am(0, e[f], b, f, 0, c.t);
    b.s = 0,
    b.clamp(),
    this.s != a.s && d.ZERO.subTo(b, b)
}
function B(a) {
    for (var b = this.abs(), c = a.t = 2 * b.t; --c >= 0;) a[c] = 0;
    for (c = 0; c < b.t - 1; ++c) {
        var d = b.am(c, b[c], a, 2 * c, 0, 1); (a[c + b.t] += b.am(c + 1, 2 * b[c], a, 2 * c + 1, d, b.t - c - 1)) >= b.DV && (a[c + b.t] -= b.DV, a[c + b.t + 1] = 1)
    }
    a.t > 0 && (a[a.t - 1] += b.am(c, b[c], a, 2 * c, 0, 1)),
    a.s = 0,
    a.clamp()
}
function C(a, b, c) {
    var f = a.abs();
    if (! (f.t <= 0)) {
        var g = this.abs();
        if (g.t < f.t) return null != b && b.fromInt(0),
        void(null != c && this.copyTo(c));
        null == c && (c = e());
        var h = e(),
        i = this.s,
        j = a.s,
        k = this.DB - t(f[f.t - 1]);
        k > 0 ? (f.lShiftTo(k, h), g.lShiftTo(k, c)) : (f.copyTo(h), g.copyTo(c));
        var l = h.t,
        m = h[l - 1];
        if (0 != m) {
            var n = m * (1 << this.F1) + (l > 1 ? h[l - 2] >> this.F2: 0),
            o = this.FV / n,
            p = (1 << this.F1) / n,
            q = 1 << this.F2,
            r = c.t,
            s = r - l,
            u = null == b ? e() : b;
            for (h.dlShiftTo(s, u), c.compareTo(u) >= 0 && (c[c.t++] = 1, c.subTo(u, c)), d.ONE.dlShiftTo(l, u), u.subTo(h, h); h.t < l;) h[h.t++] = 0;
            for (; --s >= 0;) {
                var v = c[--r] == m ? this.DM: Math.floor(c[r] * o + (c[r - 1] + q) * p);
                if ((c[r] += h.am(0, v, c, s, 0, l)) < v) for (h.dlShiftTo(s, u), c.subTo(u, c); c[r] < --v;) c.subTo(u, c)
            }
            null != b && (c.drShiftTo(l, b), i != j && d.ZERO.subTo(b, b)),
            c.t = l,
            c.clamp(),
            k > 0 && c.rShiftTo(k, c),
            0 > i && d.ZERO.subTo(c, c)
        }
    }
}
function D(a) {
    var b = e();
    return this.abs().divRemTo(a, null, b),
    this.s < 0 && b.compareTo(d.ZERO) > 0 && a.subTo(b, b),
    b
}
function E(a) {
    this.m = a
}
function F(a) {
    return a.s < 0 || a.compareTo(this.m) >= 0 ? a.mod(this.m) : a
}
function G(a) {
    return a
}
function H(a) {
    a.divRemTo(this.m, null, a)
}
function I(a, b, c) {
    a.multiplyTo(b, c),
    this.reduce(c)
}
function J(a, b) {
    a.squareTo(b),
    this.reduce(b)
}
function K() {
    if (this.t < 1) return 0;
    var a = this[0];
    if (0 == (1 & a)) return 0;
    var b = 3 & a;
    return b = b * (2 - (15 & a) * b) & 15,
    b = b * (2 - (255 & a) * b) & 255,
    b = b * (2 - ((65535 & a) * b & 65535)) & 65535,
    b = b * (2 - a * b % this.DV) % this.DV,
    b > 0 ? this.DV - b: -b
}
function L(a) {
    this.m = a,
    this.mp = a.invDigit(),
    this.mpl = 32767 & this.mp,
    this.mph = this.mp >> 15,
    this.um = (1 << a.DB - 15) - 1,
    this.mt2 = 2 * a.t
}
function M(a) {
    var b = e();
    return a.abs().dlShiftTo(this.m.t, b),
    b.divRemTo(this.m, null, b),
    a.s < 0 && b.compareTo(d.ZERO) > 0 && this.m.subTo(b, b),
    b
}
function N(a) {
    var b = e();
    return a.copyTo(b),
    this.reduce(b),
    b
}
function O(a) {
    for (; a.t <= this.mt2;) a[a.t++] = 0;
    for (var b = 0; b < this.m.t; ++b) {
        var c = 32767 & a[b],
        d = c * this.mpl + ((c * this.mph + (a[b] >> 15) * this.mpl & this.um) << 15) & a.DM;
        for (c = b + this.m.t, a[c] += this.m.am(0, d, a, b, 0, this.m.t); a[c] >= a.DV;) a[c] -= a.DV,
        a[++c]++
    }
    a.clamp(),
    a.drShiftTo(this.m.t, a),
    a.compareTo(this.m) >= 0 && a.subTo(this.m, a)
}
function P(a, b) {
    a.squareTo(b),
    this.reduce(b)
}
function Q(a, b, c) {
    a.multiplyTo(b, c),
    this.reduce(c)
}
function R() {
    return 0 == (this.t > 0 ? 1 & this[0] : this.s)
}
function S(a, b) {
    if (a > 4294967295 || 1 > a) return d.ONE;
    var c = e(),
    f = e(),
    g = b.convert(this),
    h = t(a) - 1;
    for (g.copyTo(c); --h >= 0;) if (b.sqrTo(c, f), (a & 1 << h) > 0) b.mulTo(f, g, c);
    else {
        var i = c;
        c = f,
        f = i
    }
    return b.revert(c)
}
function T(a, b) {
    var c;
    return c = 256 > a || b.isEven() ? new E(b) : new L(b),
    this.exp(a, c)
}
function U() {
    this.i = 0,
    this.j = 0,
    this.S = new Array
}
function V(a) {
    var b, c, d;
    for (b = 0; 256 > b; ++b) this.S[b] = b;
    for (c = 0, b = 0; 256 > b; ++b) c = c + this.S[b] + a[b % a.length] & 255,
    d = this.S[b],
    this.S[b] = this.S[c],
    this.S[c] = d;
    this.i = 0,
    this.j = 0
}
function W() {
    var a;
    return this.i = this.i + 1 & 255,
    this.j = this.j + this.S[this.i] & 255,
    a = this.S[this.i],
    this.S[this.i] = this.S[this.j],
    this.S[this.j] = a,
    this.S[a + this.S[this.i] & 255]
}
function X() {
    return new U
}
function Y(a) {
    qb[rb++] ^= 255 & a,
    qb[rb++] ^= a >> 8 & 255,
    qb[rb++] ^= a >> 16 & 255,
    qb[rb++] ^= a >> 24 & 255,
    rb >= sb && (rb -= sb)
}
function Z() {
    Y((new Date).getTime())
}
function $() {
    if (null == pb) {
        for (Z(), pb = X(), pb.init(qb), rb = 0; rb < qb.length; ++rb) qb[rb] = 0;
        rb = 0
    }
    return pb.next()
}
function _(a) {
    var b;
    for (b = 0; b < a.length; ++b) a[b] = $()
}
function ab() {}
function bb(a, b) {
    return new d(a, b)
}
function cb(a, b) {
    if (b < a.length + 11) return alert("Message too long for RSA"),
    null;
    for (var c = new Array,
    e = a.length - 1; e >= 0 && b > 0;) {
        var f = a.charCodeAt(e--);
        128 > f ? c[--b] = f: f > 127 && 2048 > f ? (c[--b] = 63 & f | 128, c[--b] = f >> 6 | 192) : (c[--b] = 63 & f | 128, c[--b] = f >> 6 & 63 | 128, c[--b] = f >> 12 | 224)
    }
    c[--b] = 0;
    for (var g = new ab,
    h = new Array; b > 2;) {
        for (h[0] = 0; 0 == h[0];) g.nextBytes(h);
        c[--b] = h[0]
    }
    return c[--b] = 2,
    c[--b] = 0,
    new d(c)
}
function db() {
    this.n = null,
    this.e = 0,
    this.d = null,
    this.p = null,
    this.q = null,
    this.dmp1 = null,
    this.dmq1 = null,
    this.coeff = null
}
function eb(a, b) {
    null != a && null != b && a.length > 0 && b.length > 0 ? (this.n = bb(a, 16), this.e = parseInt(b, 16)) : alert("网络异常，请点击登录重试")
}
function fb(a) {
    return a.modPowInt(this.e, this.n)
}
function gb(a) {
    var b = cb(a, this.n.bitLength() + 7 >> 3);
    if (null == b) return null;
    var c = this.doPublic(b);
    if (null == c) return null;
    var d = c.toString(16);
    return 0 == (1 & d.length) ? d: "0" + d
}
var hb, ib = 0xdeadbeefcafe,
jb = 15715070 == (16777215 & ib);
jb && "Microsoft Internet Explorer" == navigator.appName ? (d.prototype.am = g, hb = 30) : jb && "Netscape" != navigator.appName ? (d.prototype.am = f, hb = 26) : (d.prototype.am = h, hb = 28),
d.prototype.DB = hb,
d.prototype.DM = (1 << hb) - 1,
d.prototype.DV = 1 << hb;
var kb = 52;
d.prototype.FV = Math.pow(2, kb),
d.prototype.F1 = kb - hb,
d.prototype.F2 = 2 * hb - kb;
var lb, mb, nb = "0123456789abcdefghijklmnopqrstuvwxyz",
ob = new Array;
for (lb = "0".charCodeAt(0), mb = 0; 9 >= mb; ++mb) ob[lb++] = mb;
for (lb = "a".charCodeAt(0), mb = 10; 36 > mb; ++mb) ob[lb++] = mb;
for (lb = "A".charCodeAt(0), mb = 10; 36 > mb; ++mb) ob[lb++] = mb;
E.prototype.convert = F,
E.prototype.revert = G,
E.prototype.reduce = H,
E.prototype.mulTo = I,
E.prototype.sqrTo = J,
L.prototype.convert = M,
L.prototype.revert = N,
L.prototype.reduce = O,
L.prototype.mulTo = Q,
L.prototype.sqrTo = P,
d.prototype.copyTo = k,
d.prototype.fromInt = l,
d.prototype.fromString = n,
d.prototype.clamp = o,
d.prototype.dlShiftTo = v,
d.prototype.drShiftTo = w,
d.prototype.lShiftTo = x,
d.prototype.rShiftTo = y,
d.prototype.subTo = z,
d.prototype.multiplyTo = A,
d.prototype.squareTo = B,
d.prototype.divRemTo = C,
d.prototype.invDigit = K,
d.prototype.isEven = R,
d.prototype.exp = S,
d.prototype.toString = p,
d.prototype.negate = q,
d.prototype.abs = r,
d.prototype.compareTo = s,
d.prototype.bitLength = u,
d.prototype.mod = D,
d.prototype.modPowInt = T,
d.ZERO = m(0),
d.ONE = m(1),
U.prototype.init = V,
U.prototype.next = W;
var pb, qb, rb, sb = 256;
if (null == qb) {
    qb = new Array,
    rb = 0;
    var tb;
    if (window.crypto && window.crypto.getRandomValues) {
        var ub = new Uint8Array(32);
        for (window.crypto.getRandomValues(ub), tb = 0; 32 > tb; ++tb) qb[rb++] = ub[tb]
    }
    if ("Netscape" == navigator.appName && navigator.appVersion < "5" && window.crypto) {
        var vb = window.crypto.random(32);
        for (tb = 0; tb < vb.length; ++tb) qb[rb++] = 255 & vb.charCodeAt(tb)
    }
    for (; sb > rb;) tb = Math.floor(65536 * Math.random()),
    qb[rb++] = tb >>> 8,
    qb[rb++] = 255 & tb;
    rb = 0,
    Z()
}
ab.prototype.nextBytes = _,
db.prototype.doPublic = fb,
db.prototype.setPublic = eb,
db.prototype.encrypt = gb,
RSAKey = db
return new RSAKey
}
// enpassword
function get_pwd(pwd) {
var a = {
    "result": {
        "publicExponent": "010001",
        "modulus": "00833c4af965ff7a8409f8b5d5a83d87f2f19d7c1eb40dc59a98d2346cbb145046b2c6facc25b5cc363443f0f7ebd9524b7c1e1917bf7d849212339f6c1d3711b115ecb20f0c89fc2182a985ea28cbb4adf6a321ff7e715ba9b8d7261d1c140485df3b705247a70c28c9068caabbedbf9510dada6d13d99e57642b853a73406817"
    }
}
c = GetRSA();
c.setPublic(a.result.modulus, a.result.publicExponent);
var d = c.encrypt(pwd);
return d;
}
//loginid 账号
function get_loginid(loginid){
	var a = {
	    "result": {
		"publicExponent": "010001",
		"modulus": "00833c4af965ff7a8409f8b5d5a83d87f2f19d7c1eb40dc59a98d2346cbb145046b2c6facc25b5cc363443f0f7ebd9524b7c1e1917bf7d849212339f6c1d3711b115ecb20f0c89fc2182a985ea28cbb4adf6a321ff7e715ba9b8d7261d1c140485df3b705247a70c28c9068caabbedbf9510dada6d13d99e57642b853a73406817"
	    }
	}
	c = GetRSA();
	c.setPublic(a.result.modulus, a.result.publicExponent);
	var d = c.encrypt(loginid);
	return d;
}
// 浏览器指纹
rsaFingerprint = function() {
a="00833c4af965ff7a8409f8b5d5a83d87f2f19d7c1eb40dc59a98d2346cbb145046b2c6facc25b5cc363443f0f7ebd9524b7c1e1917bf7d849212339f6c1d3711b115ecb20f0c89fc2182a985ea28cbb4adf6a321ff7e715ba9b8d7261d1c140485df3b705247a70c28c9068caabbedbf9510dada6d13d99e57642b853a73406817"
b="010001"
var c ='{"user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.6","language":"zh-CN","color_depth":"24","pixel_ratio":"1","hardware_concurrency":"8","resolution":"2560,1080","available_resolution":"2560,1040","timezone_offset":"-480","session_storage":"1","local_storage":"1","indexed_db":"1","open_database":"1","cpu_class":"unknown","navigator_platform":"Win32","do_not_track":"unknown","regular_plugins":"PDF Viewer::Portable Document Format::application/pdf~pdf,text/pdf~pdf,Chrome PDF Viewer::Portable D","webgl_vendor":"Google Inc. (NVIDIA)~ANGLE (NVIDIA, NVIDIA GeForce GTX 1060 3GB Direct3D11 vs_5_0 ps_5_0, D3D11)","adblock":"false","has_lied_languages":"false","has_lied_resolution":"false","has_lied_os":"false","has_lied_browser":"false","touch_support":"0,false,false","js_fonts":"Arial,Arial Black,Arial Narrow,Book Antiqua,Bookman Old Style,Calibri,Cambria,Cambria Math,Century,C"}'
d = "dc7d1be19f3dedb380995a5ba8cc8180", //这里是sha128
e = c.length,
f = "",
g = GetRSA();
g.setPublic(a, b);
for (var h = g.encrypt(d), i = 0; e > i; i += 117) f += g.encrypt(c.substr(i, 117));
return {
    details: f,
    result: h
}
}