-
-
[原创]1xx86(iOS)登录分析
-
发表于: 1天前
-
本文章中所有内容仅供学习交流使用，不用于其他任何目的，严禁用于商业用途和非法用途，否则由此产生的一切后果均与作者无关！
用Charles抓包，可以看到xs、x-sign、x-token和body都需要计算
直接把数据包往豆包老师脸上一丢，你看，你分析，你总结。结果它还真争气
Frida老师登场！既然陈佬已经把坑都填好了，那我就不客气了。站在陈佬的肩膀上，直接从他的帖子里借来 MD5 和 AES 的命令。
效果好到怀疑人生，想要的全有了。（不想要的也顺便送了）
所有代码由千问老师友情赞助，测试通过
本次分析难度适中，经发际线监测仪确认，暂无头发阵亡。
frida-trace -UF -i "CC_MD5" -i CCCryptfrida-trace -UF -i "CC_MD5" -i CCCryptdef encrypt_body(body: str) -> str: key = "V0dSUFZtS1NWRnJa" iv = "UkdWMVpWTVVWaGVq".encode('utf-8') body_bytes = body.encode('utf-8') cipher = AES.new(key.encode('utf-8'), AES.MODE_CBC, iv) padded = pad(body_bytes, AES.block_size, style='pkcs7') encrypted = cipher.encrypt(padded) return base64.b64encode(encrypted).decode('utf-8')def decrypt_body(body: str) -> str: key = "ZUV0alZswS05HRnJ" iv = "UkdWMVpWTVVWaGVq".encode('utf-8') encrypted_bytes = base64.b64decode(body) cipher = AES.new(key.encode('utf-8'), AES.MODE_CBC, iv) decrypted_padded = cipher.decrypt(encrypted_bytes) decrypted = unpad(decrypted_padded, AES.block_size, style='pkcs7') return decrypted.decode('utf-8')def md5_hex(data: bytes) -> str: return hashlib.md5(data).hexdigest().lower()def get_xs(url: str, body: str) -> str: data = f"{url}_{body}_Leadeon/SecurityOrganization" return md5_hex(data.encode('utf-8'))def get_xsign(xtoken: str, xtime: str, xnonce: str) -> str: data = f"{xtoken}_{xtime}_{xnonce}_null" return md5_hex(data.encode('utf-8'))def get_xtoken(xk: str, path: str, xtime: str, xnonce: str) -> str: body = f"{xk}_{path}_{xtime}_{xnonce}" key = "bAIgvwAuA4tbDr9d" iv = "9791027341711819".encode('utf-8') body_bytes = body.encode('utf-8') cipher = AES.new(key.encode('utf-8'), AES.MODE_CBC, iv) padded = pad(body_bytes, AES.block_size, style='pkcs7') encrypted = cipher.encrypt(padded) return base64.b64encode(encrypted).decode('utf-8')def encrypt_body(body: str) -> str: key = "V0dSUFZtS1NWRnJa" iv = "UkdWMVpWTVVWaGVq".encode('utf-8') body_bytes = body.encode('utf-8') cipher = AES.new(key.encode('utf-8'), AES.MODE_CBC, iv) padded = pad(body_bytes, AES.block_size, style='pkcs7') encrypted = cipher.encrypt(padded) return base64.b64encode(encrypted).decode('utf-8')def decrypt_body(body: str) -> str: key = "ZUV0alZswS05HRnJ" iv = "UkdWMVpWTVVWaGVq".encode('utf-8') encrypted_bytes = base64.b64decode(body) cipher = AES.new(key.encode('utf-8'), AES.MODE_CBC, iv) decrypted_padded = cipher.decrypt(encrypted_bytes) decrypted = unpad(decrypted_padded, AES.block_size, style='pkcs7') return decrypted.decode('utf-8')
|
|
|---|---|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
