（rs系列）rs6之补环境

news2024/9/24 13:13:37

网址：aHR0cHM6Ly93d3cubm1wYS5nb3YuY24vZGF0YXNlYXJjaC9ob21lLWluZGV4Lmh0bWw=
rs6同样是两次html请求，第一次是412，cookie的差异性跟4、5同理，需要注意的是rs6无限debugger有三个，并且第三个需要注入hook代码才能过掉。

另外一个不同点就是rs5的ts代码是在html中的，而原本的自执行则跑到了外链js文件中，但处理流程是一样的。
首先打上script断点，打开网页》首先进入的就是ts代码在这里插入图片描述
整个复制到本地，继续往下走，遇到无限debugger就右键过掉，遇到外链js：
if($_ts.cd)。。

我们一样整个复制到本地。第三次无限debugger的hook代码如下：

let _constructor=constructor;
Function.prototype.constructor=function(s){
    if(s =="debugger"){
      return null;
    }
    return _constructor(s);
}

拿到所需代码之后就是熟悉的补环境流程，套路其实都差不多，rs6多检测了一些东西而已（并且检测了格式化，所以代码记得压缩）
环境代码奉上：

delete __dirname
delete __filename



window = global;
window.top = window;
window.DOMParser = function () {

}
window.addEventListener = function () {}
window.indexedDB = function () {}

document = {
    createElement: function (args) {
        console.log('createElement传参：', args)
        return {
            getElementsByTagName: function (args) {
                console.log('createElement.getElementsByTagName传参：', args)
                return []
            }
        }
    },
    getElementsByTagName: function (args) {
        console.log('getElementsByTagName传参', args)
        if (args == 'meta') {
            return [
                {},
                {
                     content: 'JI3zu3xVL1avehhJ5aTvF_MkN_wU01.XebcdKh5nGDdgWg1iEYJZSsvSI9nEQhlx',
                    parentNode:{
                        removeChild:function(){}
                    },
                    getAttribute:function(args){
                        if (args == 'r'){
                            return 'm'
                        }
                    }
                }
            ]
        };
        if (args == "script"){
            return [
                {
                     getAttribute:function(args){

                    }
                },
                {
                    getAttribute:function(args){
                        if (args == 'r'){
                            return 'm'
                        }
                    },
                                        parentElement: {
                        removeChild: function () {
                            console.log('document的getElementsByTagName的removeChild接受的参数:', args)
                        }
                    }
                }
            ]
        };
        if (args == 'base'){
            return []
        }

    },
    addEventListener:function (){

    },
    charset:'UTF-8',
    getElementById:function(){

    },
    documentElement:{
                addEventListener: function (args) {
        }
    },
    appendChild: function(){},
    removeChild: function(){},
    visibilityState: 'hidden'
}
document.cookie = 'enable_ihkYnttrQXfV=true; Secure; expires=Tue, 20 Aug 2024 03:45:50 GMT'


window.localStorage = {
    "$_YVTX": "Wq",
    "_$rc": "mzkVnTbxS2sfPzxwqv4KN.BLaIS2Eq49851LFDUzI04DDlS3KFZW3ZU_sPVc1bzZRA9kpce4zaNA5I14.uTmpSBrZZTe33H.wKFR2RxXSZb2Kg1xVODXpzVWq7NvJIeJWMyWhQFV_RgeNN2aSw246J.fxdawQNxZlSaqtgos5d61NQcpipDIXX.59irsMxEzjX1Kl4j2riifvJ6mWJNiYY84BkzlcyC26KxOZgd5wlZ93QxvNhJRTrewVz9CjwzrXUFRsBkRFsQAfUQUvvx9Qp0.AeZp7lMv5XRZmJaDC4KiqqPi.gUO0vE5.KNqglQlN1vqHh8iWNyw.t.QDAT2HZwa8o3CQNl5pRzKJNooWA7w_t4bMA8kL4vrTv.XrzaGysO36U0XmQEydCZnQD.Thx.CGabn1ClQ0mbdCTe3FHmupS6SIZflbAEjjPbe1p941ks_W1MM0myz_UPCM98fY1Jk.iwl6qDZcvz9ELZBfvLgBOB5gbV.gz6JjEExt.eqVTKYyDtbz2GMT71KW8u7543f2R1B3qpo_0_Njtu9iYqJY3ShyEPX8kGsizWY4vImw3ZLWoSQbZp6.CIZOzWBjdw_v5ZcTzDHqXCv04NmQ7C89VN1fs_qZTNTxObqpnziFSEJ3M7JwusEgvCgQ_xoJ5XexTRT3zr5ytEeCqnonOr_tA4i8f2uBq_m2wrbauAn7HhHQ_HXG1RpALI86uvTzW5NdQcFYK7G0N2EYPoPp3Myv_t_1EEVjV7nBxcgcvh2lMIZ.UV6CJtQ2Rdq",
    "__#classType": "localStorage",
    "$_YWTU": "66CR0jCNYmieUBLVuRp5dAL9rZ1T46ds8BMzRLi.f29"
}
window.name = ''
window.sessionStorage = {
    "$_YVTX": "Wq",
    "$_YWTU": "66CR0jCNYmieUBLVuRp5dAL9rZ1T46ds8BMzRLi.f29"
}
setTimeout = function (){};
setInterval = function (){};
location = {
    脱敏处理。。。
}

navigator = {
    userAgent: 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36'
}