对Xz师傅的js加密靶场的通关记录，本人纯web菜鸡，写出来的东西仅供参考，谢谢师傅们了！
01
—
AES固定key
抓包发现数据传输被加密了，直接搜索加密字段定位到算法位置
简单的分析，就是一个固定key 和iv 的aes加密，直接还原明文数据
{"username":"admin","password":"1234"}autodecoder
02
—
AES服务端获取key
来看第二关，发起了两个请求，分别获取aes_key和aes_iv，然后利用算法对数据进行加密传输
定位到算法部分我们可以注意到，只要服务器的session不过期，那么我们获取到的key 和 iv就是固定的
{"aes_key":"t3giDeeWT99XilzCslD9EQ==","aes_iv":"+jVQ1xurlO1dvxYRk9TvRA=="}还原明文数据
{"username":"admin","password":"1234"}autodecoder
03
—
RSA加密
来到第三关，
{"username":"admin","password":"1234"}
04
—
AES+RSA加密
{"username":"admin","password":"1234"}
05
—
DES规律key
{"username":"admin","password":"1234"}
06
—
明文加签
{"username":"admin","password":"123456","nonce":"q3az51nhwqq","timestamp":1700000000,"signature":"a2f50e7b7829f2cef59e346b538f5755ed6b1c066801bf0e0624b1e28c7d5417"}from flask import Flask, requestimport jsonimport reimport base64from Crypto.Cipher import AESfrom Crypto.Util.Padding import padfrom Crypto.Util.Padding import unpadfrom urllib.parse import quotefrom urllib.parse import unquotefrom Crypto.Cipher import DESimport hashlibimport hmacfrom binascii import hexlifyfrom binascii import unhexlifyapp = Flask(__name__)username = "admin"nonce = "q3az51nhwqq"timestamp=1700000000secret_key = "be56e057f20f883e"@app.route('/encode',methods=["POST"]) # base64加密def encrypt():param = request.form.get('dataBody')re_pass = r'"password":"(.*?)",'re_sign = r'"signature":"(.*?)"'re_nonce = r'"nonce":"(.*?)",'re_timestamp = r'"timestamp":(.*?),'password = re.search(re_pass, param).group(1)new_nonce = re.search(re_nonce, param).group(1)new_timestamp = re.search(re_timestamp, param).group(1)data_to_sign = f"{username}{password}{nonce}{timestamp}"new_signature = hmac.new(secret_key.encode('utf-8'), data_to_sign.encode('utf-8'), hashlib.sha256).hexdigest()new_param = re.sub(re_sign, f'"signature":"{new_signature}"', param)new_param = re.sub(re_nonce, f'"nonce":"{nonce}",', new_param)new_param = re.sub(re_timestamp, f'"timestamp":"{timestamp}",', new_param)return new_param@app.route('/decode',methods=["POST"])def decrypt():param = request.form.get('dataBody')return paramif __name__ =='__main__':app.run(host="0.0.0.0",port="5000")
07
—
防重放
No Repeater ,md 什么样的开发会提示No Repeater，实锤Xz师傅真黑客！
{"username":"admin","password":"1234","random":"1700000000000"}rsa = func(random){public_key = `-----BEGIN PUBLIC KEY-----MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDRvA7giwinEkaTYllDYCkzujviNH+up0XAKXQot8RixKGpB7nr8AdidEvuo+wVCxZwDK3hlcRGrrqt0Gxqwc11btlMDSj92Mr3xSaJcshZU8kfj325L8DRh9jpruphHBfh955ihvbednGAvOHOrz3Qy3CbocDbsNeCwNpRxwjIdQIDAQAB-----END PUBLIC KEY-----`return codec.EncodeBase64(codec.RSAEncryptWithPKCS1v15(public_key, f'${random}')~)}req = result => {r1=time.Now().Unix()returnrsa(r1*1000)}
08
—
加签key在服务端（安全无解）
09
—
参考文章
https://github.com/SwagXz/encrypt-labs原文始发于微信公众号（安全的黑魔法）：加密对抗靶场enctypt-labs通关
免责声明:文章中涉及的程序(方法)可能带有攻击性，仅供安全研究与教学之用，读者将其信息做其他用途，由读者承担全部法律及连带责任，本站不承担任何法律及连带责任；如有问题可邮件联系(建议使用企业邮箱或有效邮箱,避免邮件被拦截，联系方式见首页)，望知悉。
- 左青龙
- 微信扫一扫
-
- 右白虎
- 微信扫一扫
-
评论