• 微信公众号密码转换的密钥

    微信公众平台(md5)：https://mp.weixin.qq.com/

     

    发现问题：密码给转换为密钥了

    探索如何生成的

    解决步骤：

    是通过查看请求调用栈 找到加密代码的
    • 抓包 确定加密字段
    • 定位到了加密的大致位置
    • 打断点分析 确定加密的具体位置
    • 拷贝js加密部分的代码 进行调试(vscode中进行的)
    • 调试到js代码没有任何问题之后 我们使用python执行了js代码 生成了加密字段

     找到加密和没加密的地方分界线，复制js代码到上面去调试

     

    JS代码

    1.  
    2. function p(e, t) {
    3.     var n = (65535 & e) + (65535 & t);
    4.     return (e >> 16) + (t >> 16) + (n >> 16) << 16 | 65535 & n
    5. }
    6. function a(e, t, n, o, r, i) {
    7.     return p((t = p(p(t, e), p(o, i))) << r | t >>> 32 - r, n)
    8. }
    9. function l(e, t, n, o, r, i, s) {
    10.     return a(t & n | ~t & o, e, t, r, i, s)
    11. }
    12. function f(e, t, n, o, r, i, s) {
    13.     return a(t & o | n & ~o, e, t, r, i, s)
    14. }
    15. function m(e, t, n, o, r, i, s) {
    16.     return a(t ^ n ^ o, e, t, r, i, s)
    17. }
    18. function g(e, t, n, o, r, i, s) {
    19.     return a(n ^ (t | ~o), e, t, r, i, s)
    20. }
    21. function s(e, t) {
    22.     e[t >> 5] |= 128 << t % 32,
    23.     e[14 + (t + 64 >>> 9 << 4)] = t;
    24.     for (var n, o, r, d, i = 1732584193, s = -271733879, a = -1732584194, c = 271733878, u = 0; u < e.length; u += 16)
    25.         i = l(n = i, o = s, r = a, d = c, e[u], 7, -680876936),
    26.         c = l(c, i, s, a, e[u + 1], 12, -389564586),
    27.         a = l(a, c, i, s, e[u + 2], 17, 606105819),
    28.         s = l(s, a, c, i, e[u + 3], 22, -1044525330),
    29.         i = l(i, s, a, c, e[u + 4], 7, -176418897),
    30.         c = l(c, i, s, a, e[u + 5], 12, 1200080426),
    31.         a = l(a, c, i, s, e[u + 6], 17, -1473231341),
    32.         s = l(s, a, c, i, e[u + 7], 22, -45705983),
    33.         i = l(i, s, a, c, e[u + 8], 7, 1770035416),
    34.         c = l(c, i, s, a, e[u + 9], 12, -1958414417),
    35.         a = l(a, c, i, s, e[u + 10], 17, -42063),
    36.         s = l(s, a, c, i, e[u + 11], 22, -1990404162),
    37.         i = l(i, s, a, c, e[u + 12], 7, 1804603682),
    38.         c = l(c, i, s, a, e[u + 13], 12, -40341101),
    39.         a = l(a, c, i, s, e[u + 14], 17, -1502002290),
    40.         i = f(i, s = l(s, a, c, i, e[u + 15], 22, 1236535329), a, c, e[u + 1], 5, -165796510),
    41.         c = f(c, i, s, a, e[u + 6], 9, -1069501632),
    42.         a = f(a, c, i, s, e[u + 11], 14, 643717713),
    43.         s = f(s, a, c, i, e[u], 20, -373897302),
    44.         i = f(i, s, a, c, e[u + 5], 5, -701558691),
    45.         c = f(c, i, s, a, e[u + 10], 9, 38016083),
    46.         a = f(a, c, i, s, e[u + 15], 14, -660478335),
    47.         s = f(s, a, c, i, e[u + 4], 20, -405537848),
    48.         i = f(i, s, a, c, e[u + 9], 5, 568446438),
    49.         c = f(c, i, s, a, e[u + 14], 9, -1019803690),
    50.         a = f(a, c, i, s, e[u + 3], 14, -187363961),
    51.         s = f(s, a, c, i, e[u + 8], 20, 1163531501),
    52.         i = f(i, s, a, c, e[u + 13], 5, -1444681467),
    53.         c = f(c, i, s, a, e[u + 2], 9, -51403784),
    54.         a = f(a, c, i, s, e[u + 7], 14, 1735328473),
    55.         i = m(i, s = f(s, a, c, i, e[u + 12], 20, -1926607734), a, c, e[u + 5], 4, -378558),
    56.         c = m(c, i, s, a, e[u + 8], 11, -2022574463),
    57.         a = m(a, c, i, s, e[u + 11], 16, 1839030562),
    58.         s = m(s, a, c, i, e[u + 14], 23, -35309556),
    59.         i = m(i, s, a, c, e[u + 1], 4, -1530992060),
    60.         c = m(c, i, s, a, e[u + 4], 11, 1272893353),
    61.         a = m(a, c, i, s, e[u + 7], 16, -155497632),
    62.         s = m(s, a, c, i, e[u + 10], 23, -1094730640),
    63.         i = m(i, s, a, c, e[u + 13], 4, 681279174),
    64.         c = m(c, i, s, a, e[u], 11, -358537222),
    65.         a = m(a, c, i, s, e[u + 3], 16, -722521979),
    66.         s = m(s, a, c, i, e[u + 6], 23, 76029189),
    67.         i = m(i, s, a, c, e[u + 9], 4, -640364487),
    68.         c = m(c, i, s, a, e[u + 12], 11, -421815835),
    69.         a = m(a, c, i, s, e[u + 15], 16, 530742520),
    70.         i = g(i, s = m(s, a, c, i, e[u + 2], 23, -995338651), a, c, e[u], 6, -198630844),
    71.         c = g(c, i, s, a, e[u + 7], 10, 1126891415),
    72.         a = g(a, c, i, s, e[u + 14], 15, -1416354905),
    73.         s = g(s, a, c, i, e[u + 5], 21, -57434055),
    74.         i = g(i, s, a, c, e[u + 12], 6, 1700485571),
    75.         c = g(c, i, s, a, e[u + 3], 10, -1894986606),
    76.         a = g(a, c, i, s, e[u + 10], 15, -1051523),
    77.         s = g(s, a, c, i, e[u + 1], 21, -2054922799),
    78.         i = g(i, s, a, c, e[u + 8], 6, 1873313359),
    79.         c = g(c, i, s, a, e[u + 15], 10, -30611744),
    80.         a = g(a, c, i, s, e[u + 6], 15, -1560198380),
    81.         s = g(s, a, c, i, e[u + 13], 21, 1309151649),
    82.         i = g(i, s, a, c, e[u + 4], 6, -145523070),
    83.         c = g(c, i, s, a, e[u + 11], 10, -1120210379),
    84.         a = g(a, c, i, s, e[u + 2], 15, 718787259),
    85.         s = g(s, a, c, i, e[u + 9], 21, -343485551),
    86.         i = p(i, n),
    87.         s = p(s, o),
    88.         a = p(a, r),
    89.         c = p(c, d);
    90.     return [i, s, a, c]
    91. }
    92. function c(e) {
    93.     for (var t = "", n = 0; n < 32 * e.length; n += 8)
    94.         t += String.fromCharCode(e[n >> 5] >>> n % 32 & 255);
    95.     return t
    96. }
    97. function u(e) {
    98.     var t, n = [];
    99.     for (n[(e.length >> 2) - 1] = void 0,
    100.     t = 0; t < n.length; t += 1)
    101.         n[t] = 0;
    102.     for (t = 0; t < 8 * e.length; t += 8)
    103.         n[t >> 5] |= (255 & e.charCodeAt(t / 8)) << t % 32;
    104.     return n
    105. }
    106. function o(e) {
    107.     for (var t, n = "0123456789abcdef", o = "", r = 0; r < e.length; r += 1)
    108.         t = e.charCodeAt(r),
    109.         o += n.charAt(t >>> 4 & 15) + n.charAt(15 & t);
    110.     return o
    111. }
    112. function d(e) {
    113.     return unescape(encodeURIComponent(e))
    114. }
    115. function r(e) {
    116.     return c(s(u(e = d(e)), 8 * e.length))
    117. }
    118. function i(e, t) {
    119.     var n, e = d(e), t = d(t), o = u(e), r = [], i = [];
    120.     for (r[15] = i[15] = void 0,
    121.     16 < o.length && (o = s(o, 8 * e.length)),
    122.     n = 0; n < 16; n += 1)
    123.         r[n] = 909522486 ^ o[n],
    124.         i[n] = 1549556828 ^ o[n];
    125.     return e = s(r.concat(u(t)), 512 + 8 * t.length),
    126.     c(s(i.concat(e), 640))
    127. }
    128.  
    129. function wx(e, t, n) {
    130.     return t ? n ? i(t, e) : o(i(t, e)) : n ? r(e) : o(r(e))
    131. }
    132.  
    133. console.log(wx('123456'));
    134.

    调试没有报错且成功后，利用python运行

    tool.py

    1. import execjs
    2.  
    3.  
    4. def get_js(file_name, func_name, func_arges=None):
    5.     """
    6.     通过python来执行js代码的方法
    7.     :param file_name:js文件的名字
    8.     :param func_name:要执行的函数名字
    9.     :param func_arges:方法传参
    10.     :return:js运行的内容
    11.     """
    12.     with open(file_name, 'r', encoding='utf-8') as f:
    13.         js_code = f.read()
    14.  
    15.     # 1、编译JS文件
    16.     cjs = execjs.compile(js_code)
    17.  
    18.     # 2、执行js代码
    19.     # print(cjs.call('demo', 'world'))
    20.     return cjs.call(func_name, func_arges)

    wx.login.py

    1. from tool import get_js
    2.  
    3.  
    4. # 密码生成的密钥
    5. new_pwd = get_js('wechat_public.js','wx','123456')
    6. print(new_pwd)

    成功运行： 

     

    对比，是一样的，就成功了  

  • 相关阅读:
    “ApproachingTheTarget“ app Tech Support（URL）“ app Tech Support（URL）
    Cell 重磅丨不依赖泛素蛋白酶降解途径的新型 PROTAC - MCE
    SciencePlot-科研绘图
    集合深度学习07—Set、HashSet、LinkedHashSet、TreeSet、 底层原理 & 源码解析
    Mysql基础
    哈工大操作系统实验环境安装
    Mac打开应用提示已损坏怎么办
    算法通关村第十八关：白银挑战-回溯热门问题
    CRM系统中的工作流管理及其重要性
    数据资产为王，如何解析企业数字化转型与数据资产管理的关系？
  • 原文地址：https://blog.csdn.net/qq_51179608/article/details/126533924