JS逆向-某招标网站des分析

看函数命令方式大胆的测试的用的是DES加解密算法。然后往上继续找decryptByDES方法。把js代码抠出来跑一下js里面调用CryptoJS实现AES/DES加解密所以还需要导入这个模块。var CryptoJSrequire(crypto-js)var CryptoJSrequire(crypto-js)function decryptByDES(_0x3282ec,_0x3dcce1){var _0x456351CryptoJS[enc][_0x18ac(0x4a,iLY[)][_0x18ac(0x4b,3p8G)](_0x3dcce1);var _0x3c5437CryptoJS[_0x18ac(0x4c,uyw))][_0x18ac(0x4d,E%Rr)]({ciphertext:CryptoJS[_0x18ac(0x4e,bCC)][_0x18ac(0x4f,O))T)][_0x18ac(0x50,[MHn)](_0x3282ec)},_0x456351,{mode:CryptoJS[_0x18ac(0x51,*UPX)][_0x18ac(0x52,0)^d)],padding:CryptoJS[_0x18ac(0x53,Tv0C)][Pkcs7]});return_0x3c5437[toString](CryptoJS[_0x18ac(0xd,SIkZ)][_0x18ac(0x54,6iOW)]);}var des_secretL0jJvbeVM0svSpjIwXdE7yTu78wiEszrmbM9iS8yad8pD3zsjrP1EXPc8D4B3kuNoTYLtXYXESOkGU1YwM8ddEuuoTg5uPsqQ9/SuNdsvar des_keyCtpsp884*var des_descrypt_strdecryptByDES(des_secret,des_key)console.log(数据解密成功!:,des_descrypt_str)运行一下报错提示_0x18ac is not defined_0x18ac未定义然后搜索_0x18ac继续网上找。把上面的代码抠出来再跑一次。提示__0xaada2 is not defined__0xaada2也没有定义。继续搜索__0xaada2往上找。然后再把这段代码抠出来再跑一次。然后这次成功的跑出来了。完整的js代码如下zhaobiao_des.jsvarCryptoJSrequire(crypto-js)var__0xaada2[wrrCicKWbQ,w7bCszxQZg,YcOOXQ,w6R7FA,w5hew7nDulA,w4U8cgc,wpzCg2w,wqrCoMKy,wo0ROnrDj8KAWxs,w6wjNQ,wo3DmVfCug,d8OfTVvCohk6fwzDqF7DnsOmPAPCqh0,UQJ5wp0zw4MZw4EyfUM/YcKywpXDkcOew7vDpcOH,dcOZFsKcw6PDrMKePMO8CBzDnMKzDMK9w4dyZMOFwphaKjo,AsKcwpHCk3vDpSfDqMKVwqzDkMKOw7Y,OMKcwoU4OxrCnsKLYRLCmnHDkUpCw5Zr,wrTCr1QYwo1jwp5nw6hFsKKwq/CvzrDmMK6w7cWw,w6dVw7g,woXDuz7CgMKf,w64fTDYA,E8OMOlPClQ,DMKmwoTDqBA,wrXDjEXDocKw,SsOlZ2jCoh8pUgfDr1TDmsOxLQ,wozCnMKeMXQmw4XCiMK7,wpvClMOmwpxSXVPCjDM,w5AtXw,wr/Cs8KZDHE,JsOlFEvCosOVwoRBE8KteH3DqsO8UmbDi8Kw4U,csOrw7s/Kg,wonDvBs,wqLDiXjDjcKc,wqLCjMKEFE8,w5Brw75WwrQ,B8KpwrILNg,wpfDpMKrw73DhA,wpfDtGA,wojDm1/DrXU,wqLCrsKnA18,w4t6eQ,FcOcw7rCrsOiw4p3,wpgCCsKgeA,V8OWGsOrwrFswq5rw4pswoTDucKPPxnDvQ,wqvDiUE,JMOWwptfGQ,wp8RG0vDnMKKXQ,w7Jzw73Dk2M,w71nCQ7CjQ,wrbCrsK1wrosBsKpNA,IMOMACPClMKzbsK,GSNgccK7,wrHCtFo6wqoaw6Et,NcOQDA,acKUTQ,ecOSw4gJOsOxAA,wrXDglXDpw,wp/CgsKU,acO/woE,w6LCkQ3Dqic,wrHDgzDDjy3DoFDCvw,JCNyOQ,wrbDocKpw5bDhg,a8OrwqA,WAhgwr0ew7A9,BMKdwpw,w597w7lyw5DCtw,wojClMO6wote,woLCksKUMA,wo0qKw,wo8HJQ,SMOpwpt0,WcKjd24,OGknRMOv,wpvCpcKc,5YiN6Zq154mW5pyv5Yq777CMKl5L2a5a85p2T5bL56m4,wrDCkcOawpdc,acOgwqY,ZsKncndM,w5guYMOgHw,Ohks,w4vCozhTZA,w6ArWT8MV8K/AcKG,VMOYw7kUJA,wpUVK8OFYcKNSQHCl8K3HsKiasKA,T8ONAsKHw60,wpvCnsOZwpZu,w5/CmxrDung,ZcOBwpLCn8Kp,OAwRUcOb,OTtHSsON,wqsAGQ,w7XCvzo,e2sRHA,w7QvXCI,w4zCsS9AQA,HXIla8Oy,a8OuahPDiA,worDqSU,w6pkAzfClw,w6ETa8OyFQ,UsOYwrs,fMOwwoY];(function(_0x491488,_0x2904a9){var_0x54e388function(_0x4f0d63){while(--_0x4f0d63){_0x491488[push](_0x491488[shift]());}};_0x54e388(_0x2904a9);}(__0xaada2,0x1f0));var_0x18acfunction(_0x4fadf8,_0x47a697){_0x4fadf8_0x4fadf8-0x0;var_0x38d2cc__0xaada2[_0x4fadf8];if(_0x18ac[initialized]undefined){(function(){var_0x38ee16typeofwindow!undefined?window:typeofprocessobjecttypeofrequirefunctiontypeofglobalobject?global:this;var_0x3120aaABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789/;_0x38ee16[atob]||(_0x38ee16[atob]function(_0x4da23e){var_0x2d14acString(_0x4da23e)[replace](/$/,);for(var_0x473eb40x0,_0x2231f7,_0x5211b2,_0x13e4350x0,_0x21e5bb;_0x5211b2_0x2d14ac[charAt](_0x13e435);~_0x5211b2(_0x2231f7_0x473eb4%0x4?_0x2231f7*0x40_0x5211b2:_0x5211b2,_0x473eb4%0x4)?_0x21e5bbString[fromCharCode](0xff_0x2231f7(-0x2*_0x473eb40x6)):0x0){_0x5211b2_0x3120aa[indexOf](_0x5211b2);}return_0x21e5bb;});}());var_0x8653cafunction(_0x5a8829,_0x58aade){var_0x586456[],_0x28f5e90x0,_0xc4a39d,_0x4ebc96,_0x58f954;_0x5a8829atob(_0x5a8829);for(var_0x5c0bfc0x0,_0x406c6a_0x5a8829[length];_0x5c0bfc_0x406c6a;_0x5c0bfc){_0x58f954%(00_0x5a8829[charCodeAt](_0x5c0bfc)[toString](0x10))[slice](-0x2);}_0x5a8829decodeURIComponent(_0x58f954);for(var_0x3d96e00x0;_0x3d96e00x100;_0x3d96e0){_0x586456[_0x3d96e0]_0x3d96e0;}for(_0x3d96e00x0;_0x3d96e00x100;_0x3d96e0){_0x28f5e9(_0x28f5e9_0x586456[_0x3d96e0]_0x58aade[charCodeAt](_0x3d96e0%_0x58aade[length]))%0x100;_0xc4a39d_0x586456[_0x3d96e0];_0x586456[_0x3d96e0]_0x586456[_0x28f5e9];_0x586456[_0x28f5e9]_0xc4a39d;}_0x3d96e00x0;_0x28f5e90x0;for(var_0x2624a60x0;_0x2624a6_0x5a8829[length];_0x2624a6){_0x3d96e0(_0x3d96e00x1)%0x100;_0x28f5e9(_0x28f5e9_0x586456[_0x3d96e0])%0x100;_0xc4a39d_0x586456[_0x3d96e0];_0x586456[_0x3d96e0]_0x586456[_0x28f5e9];_0x586456[_0x28f5e9]_0xc4a39d;_0x4ebc96String[fromCharCode](_0x5a8829[charCodeAt](_0x2624a6)^_0x586456[(_0x586456[_0x3d96e0]_0x586456[_0x28f5e9])%0x100]);}return_0x4ebc96;};_0x18ac[rc4]_0x8653ca;_0x18ac[data]{};_0x18ac[initialized]!![];}var_0xc2c2ce_0x18ac[data][_0x4fadf8];if(_0xc2c2ceundefined){if(_0x18ac[once]undefined){_0x18ac[once]!![];}_0x38d2cc_0x18ac[rc4](_0x38d2cc,_0x47a697);_0x18ac[data][_0x4fadf8]_0x38d2cc;}else{_0x38d2cc_0xc2c2ce;}return_0x38d2cc;};functiondecryptByDES(_0x3282ec,_0x3dcce1){var_0x456351CryptoJS[enc][_0x18ac(0x4a,iLY[)][_0x18ac(0x4b,3p8G)](_0x3dcce1);var_0x3c5437CryptoJS[_0x18ac(0x4c,uyw))][_0x18ac(0x4d,E%Rr)]({ciphertext:CryptoJS[_0x18ac(0x4e,bCC)][_0x18ac(0x4f,O))T)][_0x18ac(0x50,[MHn)](_0x3282ec)},_0x456351,{mode:CryptoJS[_0x18ac(0x51,*UPX)][_0x18ac(0x52,0)^d)],padding:CryptoJS[_0x18ac(0x53,Tv0C)][Pkcs7]});return_0x3c5437[toString](CryptoJS[_0x18ac(0xd,SIkZ)][_0x18ac(0x54,6iOW)]);}vardes_secretL0jJvbeVM0svSpjIwXdE7yTu78wiEszrmbM9iS8yad8pD3zsjrP1EXPc8D4B3kuNoTYLtXYXESOkGU1YwM8ddEuuoTg5uPsqQ9/SuNdsvardes_keyCtpsp884*vardes_descrypt_strdecryptByDES(des_secret,des_key)console.log(数据解密成功!:,des_descrypt_str)使用deepseek还原成python代码importbase64fromCrypto.CipherimportDESfromCrypto.Util.Paddingimportunpaddefdecrypt_by_des(ciphertext_b64:str,key:str)-str:# CryptoJS 的 DES 实际只使用前 8 字节作为 DES keykey_byteskey.encode(utf-8)[:8]ciphertextbase64.b64decode(ciphertext_b64)cipherDES.new(key_bytes,DES.MODE_ECB)plaintextcipher.decrypt(ciphertext)plaintextunpad(plaintext,DES.block_size)returnplaintext.decode(utf-8)des_secretL0jJvbeVM0svSpjIwXdE7yTu78wiEszrmbM9iS8yad8pD3zsjrP1EXPc8D4B3kuNoTYLtXYXESOkGU1YwM8ddEuuoTg5uPsqQ9/SuNdsdes_keyCtpsp884*des_decrypt_strdecrypt_by_des(des_secret,des_key)print(数据解密成功!:,des_decrypt_str)安装依赖pip install pycryptodome关键点算法DES模式ECB填充PKCS7密文编码Base64明文编码UTF-8