天翼云登录参数JavaSrcipt逆向

天翼云登录参数 password 、comParam_curTime、comParam_seqCode、comParam_signature JavaSrcipt逆向

目标网站

https://m.ctyun.cn/wap/main/auth/login?redirect=/my

目标参数

要逆向的有 password、comParam_curTime、comParam_seqCode、comParam_signature 四个参数
在这里插入图片描述

逆向分析

在这里插入图片描述
打开搜索工具栏，根据经验搜索**password:**得到

猜测password大概在此处加密

 userName: Object(w["g"])(r.value),
 password: encodeURI(Object(w["c"])(a.value, Object(w["f"])(Object(w["g"])(r.value))))

此处添加断点，输入账号、密码，从新登录，断点断住，分析得出密码在此处加密。
只要解出 Object(u[“c”])、Object(u[“f”])、Object(u[“g”])、a.value、s.value 即可
在控制台输入 **a.value、s.value，**其值分别为账号、密码
在这里插入图片描述
Object(w[“c”]) 方法是一个 M 函数：

M = function(e) {
    var n = arguments.length > 1 && void 0 !== arguments[1] ? arguments[1] : "",
        t = arguments.length > 2 && void 0 !== arguments[2] ? arguments[2] : {}, r = t.enc,
        a = void 0 === r ? "Utf8" : r,
        o = t.mode,
        c = void 0 === o ? "ECB" : o,
        i = t.padding,
        u = void 0 === i ? "Pkcs7" : i,
        d = p.a.enc[a].parse(n),
        s = {
            mode: p.a.mode[c],
            padding: p.a.pad[u]
        }, l = p.a.TripleDES.encrypt(e, d, s);
    return l.toString()
}

p.a 属性不用扣代码，使用 crypto-js 第三方模块就可以

Object(w[“f”]) 方法是一个 _ 函数：

_ = function(e) {
    var n = arguments.length > 1 && void 0 !== arguments[1] ? arguments[1] : {};
    if (e && "string" === typeof e) {
        var t = n.text || "0",
            r = n.length || 24;
        if (e.length < r) for (var a = e.length; a < r; a++)
        e += t;
        else e = e.substring(0, r);
        return e
    }
}

Object(w[“g”]) 方法是一个 K 函数：

Q = function() {
    var e = arguments.length > 0 && void 0 !== arguments[0] ? arguments[0] : "";
    return e.replace(/\s+/g, "")
};

代码：

// crypto-js 模块安装命令：npm i crypto-js --save
const CryptoJS = require('crypto-js')

const T = function (e) {
    var n = arguments.length > 1 && void 0 !== arguments[1] ? arguments[1] : ""
        , t = arguments.length > 2 && void 0 !== arguments[2] ? arguments[2] : {}
        , a = t.enc
        , r = void 0 === a ? "Utf8" : a
        , c = t.mode
        , i = void 0 === c ? "ECB" : c
        , o = t.padding
        , u = void 0 === o ? "Pkcs7" : o
        , d = CryptoJS.enc[r].parse(n)
        , l = {
            mode: CryptoJS.mode[i],
            padding: CryptoJS.pad[u]
        }
        , s = CryptoJS.TripleDES.encrypt(e, d, l);
    return s.toString()
}

const F = function (e) {
    var n = arguments.length > 1 && void 0 !== arguments[1] ? arguments[1] : {};
    if (e && "string" === typeof e) {
        var t = n.text || "0"
            , a = n.length || 24;
        if (e.length < a)
            for (var r = e.length; r < a; r++)
                e += t;
        else
            e = e.substring(0, a);
        return e
    }
}

const K = function () {
    var e = arguments.length > 0 && void 0 !== arguments[0] ? arguments[0] : "";
    return e.replace(/\s+/g, "")
}

const password = encodeURI(T('abc123', F(K('123@163.com'))))
console.log(password)

运行结果与浏览器一致：

mY7jlZItWJ8=

comParam_curTime

全局搜索 comParam_curTime
在这里插入图片描述发现与 comParam_seqCode、comParam_signature 是放在一起的
在 return 处打上断点重新登录
comParam_curTime 值是变量 n：

n = (new Date).getTime() - h.getTimestampOffset()

h.getTimestampOffset() 是一个函数：

h.getTimestampOffset = function() {
    return localStorage.getItem("timestampOffset") || f
}

它返回一个整数形式的字符串，如果页面关闭后再打开，那么该字符串也随之改变。可以把它写成一个固定值
代码：

const n = (new Date).getTime() - '512'
console.log(n)

运行结果：

1663060561792

comParam_seqCode
comParam_seqCode 值是变量 r

r = Object(u["k"])()

Object(u[“k”]) 是一个 H 函数

H = function() {
    var e, n, t = arguments.length > 0 && void 0 !== arguments[0] ? arguments[0] : 32,
        r = arguments.length > 1 && void 0 !== arguments[1] ? arguments[1] : 16,
        a = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz".split(""),
        o = [];
    if (r = r || a.length,
    t) for (e = 0; e < t; e++)
    o[e] = a[0 | Math.random() * r];
    else for (o[8] = o[13] = o[18] = o[23] = "-",
    o[14] = "4",
    e = 0; e < 36; e++)
    o[e] || (n = 0 | 16 * Math.random(),
    o[e] = a[19 === e ? 3 & n | 8 : n]);
    return o.join("")
}

运行结果：

C1255B5F897C5C4F6EC0379ED98A3890

comParam_signature

comParam_signature 值是变量 a：

a = i()(n + r + i()(r + t + n));

n 是 comParam_curTime

r 是 comParam_seqCode

t 是 s54zv9bm1vd5czfujy6nnuxj1l4g2ny6 固定值
i() 是 S 函数

function S(t, e, n) {
    return e ? n ? w(e, t) : x(e, t) : n ? m(t) : _(t)
}
r = function() {
    return S
}

代码：

function i(t, e) {
    var n = (65535 & t) + (65535 & e),
        r = (t >> 16) + (e >> 16) + (n >> 16);
    return r << 16 | 65535 & n
}

function a(t, e) {
    return t << e | t >>> 32 - e
}

function c(t, e, n, r, o, c) {
    return i(a(i(i(e, t), i(r, c)), o), n)
}

function u(t, e, n, r, o, i, a) {
    return c(e & n | ~e & r, t, e, o, i, a)
}

function s(t, e, n, r, o, i, a) {
    return c(e & r | n & ~r, t, e, o, i, a)
}

function f(t, e, n, r, o, i, a) {
    return c(e ^ n ^ r, t, e, o, i, a)
}

function l(t, e, n, r, o, i, a) {
    return c(n ^ (e | ~r), t, e, o, i, a)
}

function p(t, e) {
    var n, r, o, a, c;
    t[e >> 5] |= 128 << e % 32,
    t[14 + (e + 64 >>> 9 << 4)] = e;
    var p = 1732584193,
        h = -271733879,
        d = -1732584194,
        v = 271733878;
    for (n = 0; n < t.length; n += 16)
    r = p,
    o = h,
    a = d,
    c = v,
    p = u(p, h, d, v, t[n], 7, -680876936),
    v = u(v, p, h, d, t[n + 1], 12, -389564586),
    d = u(d, v, p, h, t[n + 2], 17, 606105819),
    h = u(h, d, v, p, t[n + 3], 22, -1044525330),
    p = u(p, h, d, v, t[n + 4], 7, -176418897),
    v = u(v, p, h, d, t[n + 5], 12, 1200080426),
    d = u(d, v, p, h, t[n + 6], 17, -1473231341),
    h = u(h, d, v, p, t[n + 7], 22, -45705983),
    p = u(p, h, d, v, t[n + 8], 7, 1770035416),
    v = u(v, p, h, d, t[n + 9], 12, -1958414417),
    d = u(d, v, p, h, t[n + 10], 17, -42063),
    h = u(h, d, v, p, t[n + 11], 22, -1990404162),
    p = u(p, h, d, v, t[n + 12], 7, 1804603682),
    v = u(v, p, h, d, t[n + 13], 12, -40341101),
    d = u(d, v, p, h, t[n + 14], 17, -1502002290),
    h = u(h, d, v, p, t[n + 15], 22, 1236535329),
    p = s(p, h, d, v, t[n + 1], 5, -165796510),
    v = s(v, p, h, d, t[n + 6], 9, -1069501632),
    d = s(d, v, p, h, t[n + 11], 14, 643717713),
    h = s(h, d, v, p, t[n], 20, -373897302),
    p = s(p, h, d, v, t[n + 5], 5, -701558691),
    v = s(v, p, h, d, t[n + 10], 9, 38016083),
    d = s(d, v, p, h, t[n + 15], 14, -660478335),
    h = s(h, d, v, p, t[n + 4], 20, -405537848),
    p = s(p, h, d, v, t[n + 9], 5, 568446438),
    v = s(v, p, h, d, t[n + 14], 9, -1019803690),
    d = s(d, v, p, h, t[n + 3], 14, -187363961),
    h = s(h, d, v, p, t[n + 8], 20, 1163531501),
    p = s(p, h, d, v, t[n + 13], 5, -1444681467),
    v = s(v, p, h, d, t[n + 2], 9, -51403784),
    d = s(d, v, p, h, t[n + 7], 14, 1735328473),
    h = s(h, d, v, p, t[n + 12], 20, -1926607734),
    p = f(p, h, d, v, t[n + 5], 4, -378558),
    v = f(v, p, h, d, t[n + 8], 11, -2022574463),
    d = f(d, v, p, h, t[n + 11], 16, 1839030562),
    h = f(h, d, v, p, t[n + 14], 23, -35309556),
    p = f(p, h, d, v, t[n + 1], 4, -1530992060),
    v = f(v, p, h, d, t[n + 4], 11, 1272893353),
    d = f(d, v, p, h, t[n + 7], 16, -155497632),
    h = f(h, d, v, p, t[n + 10], 23, -1094730640),
    p = f(p, h, d, v, t[n + 13], 4, 681279174),
    v = f(v, p, h, d, t[n], 11, -358537222),
    d = f(d, v, p, h, t[n + 3], 16, -722521979),
    h = f(h, d, v, p, t[n + 6], 23, 76029189),
    p = f(p, h, d, v, t[n + 9], 4, -640364487),
    v = f(v, p, h, d, t[n + 12], 11, -421815835),
    d = f(d, v, p, h, t[n + 15], 16, 530742520),
    h = f(h, d, v, p, t[n + 2], 23, -995338651),
    p = l(p, h, d, v, t[n], 6, -198630844),
    v = l(v, p, h, d, t[n + 7], 10, 1126891415),
    d = l(d, v, p, h, t[n + 14], 15, -1416354905),
    h = l(h, d, v, p, t[n + 5], 21, -57434055),
    p = l(p, h, d, v, t[n + 12], 6, 1700485571),
    v = l(v, p, h, d, t[n + 3], 10, -1894986606),
    d = l(d, v, p, h, t[n + 10], 15, -1051523),
    h = l(h, d, v, p, t[n + 1], 21, -2054922799),
    p = l(p, h, d, v, t[n + 8], 6, 1873313359),
    v = l(v, p, h, d, t[n + 15], 10, -30611744),
    d = l(d, v, p, h, t[n + 6], 15, -1560198380),
    h = l(h, d, v, p, t[n + 13], 21, 1309151649),
    p = l(p, h, d, v, t[n + 4], 6, -145523070),
    v = l(v, p, h, d, t[n + 11], 10, -1120210379),
    d = l(d, v, p, h, t[n + 2], 15, 718787259),
    h = l(h, d, v, p, t[n + 9], 21, -343485551),
    p = i(p, r),
    h = i(h, o),
    d = i(d, a),
    v = i(v, c);
    return [p, h, d, v]
}

function h(t) {
    var e, n = "",
        r = 32 * t.length;
    for (e = 0; e < r; e += 8)
    n += String.fromCharCode(t[e >> 5] >>> e % 32 & 255);
    return n
}

function d(t) {
    var e, n = [];
    for (n[(t.length >> 2) - 1] = void 0,
    e = 0; e < n.length; e += 1)
    n[e] = 0;
    var r = 8 * t.length;
    for (e = 0; e < r; e += 8)
    n[e >> 5] |= (255 & t.charCodeAt(e / 8)) << e % 32;
    return n
}

function v(t) {
    return h(p(d(t), 8 * t.length))
}

function y(t, e) {
    var n, r, o = d(t),
        i = [],
        a = [];
    for (i[15] = a[15] = void 0,
    o.length > 16 && (o = p(o, 8 * t.length)),
    n = 0; n < 16; n += 1)
    i[n] = 909522486 ^ o[n],
    a[n] = 1549556828 ^ o[n];
    return r = p(i.concat(d(e)), 512 + 8 * e.length),
    h(p(a.concat(r), 640))
}

function g(t) {
    var e, n, r = "0123456789abcdef",
        o = "";
    for (n = 0; n < t.length; n += 1)
    e = t.charCodeAt(n),
    o += r.charAt(e >>> 4 & 15) + r.charAt(15 & e);
    return o
}

function b(t) {
    return unescape(encodeURIComponent(t))
}

function m(t) {
    return v(b(t))
}

function _(t) {
    return g(m(t))
}

function w(t, e) {
    return y(b(t), b(e))
}

function x(t, e) {
    return g(w(t, e))
}

function S(t, e, n) {
    return e ? n ? w(e, t) : x(e, t) : n ? m(t) : _(t)
}

function aaa(){
    n = (new Date).getTime() - "512"
    t = "s54zv9bm1vd5czfujy6nnuxj1l4g2ny6"
    r = "D10FE9733A3314D7DD777734F5476ACA"
    return S(n + r + S(r + t + n));
}