WX20211021-142103@2x.png

在登錄頁(yè)面輸入賬密, 會(huì)提示是否注冊(cè)


抓包有一個(gè)加密參數(shù): text,

headers = {
    'Host': 'app.360kad.com',
    'User-Agent': 'okhttp/3.6.0',
}

params = (
    ('text', 'ZUbOnx1MmPkqWm1KGitxfSBum2ZJWvyg%2FbLc1nwssZEs0xNEW1wS3NaFZQ00bWY6Ma9umsigB4SSrsdJUlOpEA%3D%3D'),
    ('kclientid', '217f0fa6bda578f671e511c1bd89fa90'),
    ('gtclientid', '7af664c82b15b9f44a6515948fee795d'),
    ('utm_medium', 'Android'),
    ('utm_source', 'yingyongbao'),
    ('versionno', '164'),
    ('versionname', '3.21.5'),
)

response = requests.get('https://app.360kad.com/Login/SCYLoginV2', headers=headers, params=params)
response.json()

jadx打開看看, 一頓搜索, 找到如下位置:

WX20211021-142559.png

在這個(gè)class里找到了這個(gè)login()調(diào)用位置:

WX20211021-142818.png

a: 152xxxx2266
b: kkk123456
c: 

就是我們的賬密嘛, 第3個(gè)參數(shù)是null, 再看看623行的toEncryptLogin:

WX20211021-143756.png

IDA打開com.unique.app.zip/lib/armeabi-v7a/libutil.so, 找到toEncryptLogin():

WX20211021-144230@2x.png

看到了31行顯眼的'IV', 猜測(cè)是AES(CBC)加密, 還有LOGIN_KEYS,八成是了

QQ20211022-0.png

toLoginJson:

WX20211021-144451@2x.png

分別雙擊key和iv:

WX20211021-144703@2x.png

iv='W+\~f4,Kr)b$=adr' # VytcfmY0LEtyKWIkPWFkcg==
key = '660EC328EC500D9DC03F8FEB1409648D' # NjYwRUMzMjhFQzUwMEQ5REMwM0Y4RkVCMTQwOTY0OEQ=

雙擊至此大概清晰了, 但是還不能確定字符串, 所以用iv和key解密一下:

WX20211021-145120@2x.png

和預(yù)想的差不多, 附上代碼:

def add_to_16(text):
    if len(text.encode('utf-8')) % 16:add = 16 - (len(text.encode('utf-8')) % 16)
    else:add = 0
    text = text + ('\0' * add)
    return text.encode('utf-8')

def encryt_cbc(text, key, iv):
    '''CBC '''
    cipher = AES.new(key, AES.MODE_CBC,iv)
    x = AES.block_size - (len(text) % AES.block_size)
    if x != 0:text = text + chr(x)*x
    msg = cipher.encrypt(text)
    # msg = base64.urlsafe_b64encode(msg).replace('=', '')
    msg = base64.b64encode(msg)
    return msg.decode()

iv='W+\~f4,Kr)b$=adr'.encode()
phone='152xxxxx66'
# 注意不要有空格, 不過這個(gè)案例有空格也能返回正確信息
text='{"userName":"'+phone+'","userPwd":"kkk123456","vcode":""}'
key = '660EC328EC500D9DC03F8FEB1409648D'.encode('utf-8')
text=encryt_cbc(text,key,iv)

headers = {
    'Host': 'app.360kad.com',
    'User-Agent': 'okhttp/3.6.0',
}

params = (
    ('text', text),
    ('kclientid', '217f0fa6bda578f671e511c1bd89fa90'),
    ('gtclientid', '7af664c82b15b9f44a6515948fee795d'),
    ('utm_medium', 'Android'),
    ('utm_source', 'yingyongbao'),
    ('versionno', '164'),
    ('versionname', '3.21.5'),
)

response = requests.get('https://app.360kad.com/Login/SCYLoginV2', headers=headers, params=params)
response.json()
#{'Result': False, 'Code': 4, 'Message': '賬戶名不存在', 'Key': None, 'ThirdMobile': '', 'KadMobile': ''}