【A9】请求加密后的渗透测试方法

项目地址：https://github.com/c0ny1/jsEncrypter

from Crypto.Cipher import AESfrom Crypto.Util.Padding import padfrom Crypto.Util.Padding import unpadimport base64import binascii

def AES_encrypt(plain_text, key, mode, iv="", output_type="base64"):    """    AES 加密    :param output_type: 密文输出方式 - base64 / hex    :param plain_text: 明文    :param key: 密钥    :param mode: 加密模式    :param iv: 偏移量    :return: 密文    """    # 填充字符    data = pad(data_to_pad=plain_text.encode(), block_size=AES.block_size)
    # 字符串补位    if mode is AES.MODE_ECB:        cipher = AES.new(key.encode(), mode)    else:        cipher = AES.new(key.encode(), mode, iv.encode())    encrypted_bytes = cipher.encrypt(data)    # # 加密后得到的是 bytes 类型的数据，使用 Base64 进行编码, 返回 byte 字符串, 对 byte 字符串按 utf-8 进行解码    if output_type.lower() == "base64":        crypto_text = str(base64.b64encode(encrypted_bytes), encoding='utf-8')    elif output_type.lower() == "hex":        crypto_text = binascii.b2a_hex(encrypted_bytes).decode()    else:        crypto_text = encrypted_bytes.decode()    return crypto_text

def AES_decrypt(crypto_text, key, mode, iv="", input_type="base64"):    """    AES 解密    :param input_type: 密文输出方式 - base64 / hex, 默认 base64    :param crypto_text: 密文    :param key: 密钥    :param mode: 解密模式    :param iv: 偏移量    :return: 明文    """    if mode is AES.MODE_ECB:        cipher = AES.new(key.encode(), mode)    else:        cipher = AES.new(key.encode(), mode, iv.encode())    try:        if input_type.lower() == "hex":            data_byte = binascii.a2b_hex(crypto_text)        else:            data_byte = base64.b64decode(crypto_text)        padded_data = cipher.decrypt(data_byte)        plain_text = unpad(padded_data=padded_data, block_size=AES.block_size).decode()
        return plain_text    except Exception:        return None

#!/usr/bin/env python# -*- coding: utf-8 -*-# @Author : Fa11en丶R0ck# @File : jsEncrypter.py# @Description: jsEncrypter
from flask import Flask, request, make_responsefrom Crypto.Cipher import AESfrom Crypto.Util.Padding import padfrom Crypto.Util.Padding import unpadimport base64import binasciiimport sysimport logging
app = Flask(__name__)log = logging.getLogger('werkzeug')log.disabled = True
@app.route('/', methods=['POST', 'GET'])def get_connect():    if request.method == 'POST':        # 加密        payload = request.form['payload']        plain_text = payload
        crypt_text = do_encrypt(plain_text)        print(str(plain_text) + "::" + crypt_text, file=sys.stderr)        response = make_response(crypt_text, 200)        return response    else:        response = make_response('hello', 200)        return response

def do_encrypt(plain_text):    return AES_encrypt(plain_text=plain_text, key="MpWsyseHtJywNON8", iv="", mode=AES.MODE_ECB, output_type="hex")

def AES_encrypt(plain_text, key, mode, iv="", output_type="base64"):    """    AES 加密    :param output_type: 密文输出方式 - base64 / hex    :param plain_text: 明文    :param key: 密钥    :param mode: 加密模式    :param iv: 偏移量    :return: 密文    """    # 填充字符    data = pad(data_to_pad=plain_text.encode(), block_size=AES.block_size)
    # 字符串补位    if mode is AES.MODE_ECB:        cipher = AES.new(key.encode(), mode)    else:        cipher = AES.new(key.encode(), mode, iv.encode())    encrypted_bytes = cipher.encrypt(data)    # 加密后得到的是 bytes 类型的数据，需要进行编码    if output_type.lower() == "base64":        crypto_text = str(base64.b64encode(encrypted_bytes), encoding='utf-8')    elif output_type.lower() == "hex":        crypto_text = binascii.b2a_hex(encrypted_bytes).decode()    else:        crypto_text = encrypted_bytes.decode()    return crypto_text

def AES_decrypt(crypto_text, key, mode, iv="", input_type="base64"):    """    AES 解密    :param input_type: 密文输出方式 - base64 / hex, 默认 base64    :param crypto_text: 密文    :param key: 密钥    :param mode: 解密模式    :param iv: 偏移量    :return: 明文    """    if mode is AES.MODE_ECB:        cipher = AES.new(key.encode(), mode)    else:        cipher = AES.new(key.encode(), mode, iv.encode())    try:        if input_type.lower() == "hex":            data_byte = binascii.a2b_hex(crypto_text)        else:            data_byte = base64.b64decode(crypto_text)        padded_data = cipher.decrypt(data_byte)        plain_text = unpad(padded_data=padded_data, block_size=AES.block_size).decode()
        return plain_text    except Exception:        return None

if __name__ == '__main__':    app.run(debug=False, host='0.0.0.0', port=1664)

@app.route('/encode', methods=["POST"])def encrypt():    param = request.form.get('dataBody').strip("\n")  # 获取  post 参数    encryptData = json.loads(param)['encryptData']    # print("[*] encrypt : " + param)    encrypt_param = AES_encrypt(plain_text=encryptData, key="j**************2", iv="0**************8", mode=AES.MODE_CBC, padding=pkcs7_padding, output_type='hex').upper()    if encrypt_param is not None:        encrypt_param = quote(encrypt_param)        # print("{} : {}".format(param, encrypt_param))        return {'encryptData': encrypt_param}    else:        return "Encrypt Warning !!!"

@app.route('/decode', methods=["POST"])def decrypt():    param = request.form.get('dataBody').strip("\n")  # 获取  post 参数    if "encryptData" in param:        encryptData = json.loads(param)['encryptData']        # print("[*] decrypt : " + param)        decryptData = AES_decrypt(crypto_text=encryptData, key="j**************2", iv="0**************8", mode=AES.MODE_CBC, padding=pkcs7_unpadding, input_type='hex')        if decryptData is not None:            # print("{} : {}".format(encryptData, decryptData))            return {'encryptData': decryptData}        else:            return "Decrypt Warning !!!"    else:        return param

if (!window._pwd_Encrypt) window._pwd_Encrypt = Object(f.h);if (!window._postdata_Encrypt) window._postdata_Encrypt = Object(f.c);

import loggingimport asyncioimport threadingimport websocketsfrom flask import Flask, request, jsonify
app = Flask(__name__)log = logging.getLogger('werkzeug')log.disabled = Trueclients = set()message_queue = asyncio.Queue()loop = asyncio.get_event_loop()

async def handler(websocket, path):    # 添加新连接到客户端集合    clients.add(websocket)    try:        # 处理消息        async for message in websocket:            # print(f"Received message: {message}")            await message_queue.put(message)        print("end")    finally:        # 从客户端集合中移除断开的连接        clients.remove(websocket)

def start_server(host, port):    start_server = websockets.serve(handler, host, port)    print(f"WebSocket server started at ws://{host}:{port}")    loop.run_until_complete(start_server)    loop.run_forever()

async def send_data_to_clients(message):    response_text = ""    # 发送消息给所有连接的客户端    if len(clients) > 0:        for client in clients:            if client.open:                await client.send(message)                # response_text = await client.recv()                response_text = await message_queue.get()                # print("加密结果：", response_text)                print(f"[Enc] {message} : {response_text}")            else:                print("连接已经关闭")    else:        response_text = "请先建立 Websocket 连接！"    return response_text

def start_web():    # 启动 Flask 应用    print("Http server started at http://0.0.0.0:1664")    app.run(debug=False, host='0.0.0.0', port=1664)

@app.route('/send', methods=['GET'])def send_message():    global loop    asyncio.set_event_loop(loop)    payload = request.values.get('payload')    # print("[send_message] " + payload)    result = asyncio.run_coroutine_threadsafe(send_data_to_clients(payload), loop).result(timeout=10)    # print("[send_message] " + result)    return jsonify({"response": result})

# 示例用法if __name__ == "__main__":    web_thread = threading.Thread(target=start_web, args=())    web_thread.start()    start_server("localhost", 5678)    web_thread.join()

var ws = new WebSocket("ws://127.0.0.1:5678");    ws.onmessage = function (msg) {    console.log("[+] 收到消息：" + msg.data);    if (msg.data == "exit") {        console.log("[+] WebSocket closed!");        ws.send("exit")        ws.close();    } else {        ws.send(window._pwd_Encrypt(msg.data));    }}

$ bash bin/sekiro.sh

// ==UserScript==// @name         SekiroClient for JSRPC// @version      0.1// @description  注入 SekiroClient// @author       Anonymous ( I Don't want to tell you:) )// @match        *://*/*// @icon         https://sekiro.iinti.cn/favicon.ico// @grant        unsafewindow// @run-at       document-start// ==/UserScript==
(function () {    "use strict";    console.log("[*] SekiroClient for JSRPC loaded...");
    unsafeWindow.SekiroClient = function (e) {        if (((this.wsURL = e), (this.handlers = {}), (this.socket = {}), !e)) throw new Error("wsURL can not be empty!!");        (this.webSocketFactory = this.resolveWebSocketFactory()), this.connect();    };    (unsafeWindow.SekiroClient.prototype.resolveWebSocketFactory = function () {        if ("object" == typeof window) {            var e = window.WebSocket ? window.WebSocket : window.MozWebSocket;            return function (o) {                function t(o) {                    this.mSocket = new e(o);                }                return (                    (t.prototype.close = function () {                        this.mSocket.close();                    }),                    (t.prototype.onmessage = function (e) {                        this.mSocket.onmessage = e;                    }),                    (t.prototype.onopen = function (e) {                        this.mSocket.onopen = e;                    }),                    (t.prototype.onclose = function (e) {                        this.mSocket.onclose = e;                    }),                    (t.prototype.send = function (e) {                        this.mSocket.send(e);                    }),                    new t(o)                );            };        }        if ("object" == typeof weex)            try {                console.log("test webSocket for weex");                var o = weex.requireModule("webSocket");                return (                    console.log("find webSocket for weex:" + o),                    function (e) {                        try {                            o.close();                        } catch (e) {}                        return o.WebSocket(e, ""), o;                    }                );            } catch (e) {                console.log(e);            }        if ("object" == typeof WebSocket)            return function (o) {                return new e(o);            };        throw new Error("the js environment do not support websocket");    }),        (unsafeWindow.SekiroClient.prototype.connect = function () {            console.log("sekiro: begin of connect to wsURL: " + this.wsURL);            var e = this;            try {                this.socket = this.webSocketFactory(this.wsURL);            } catch (o) {                return (                    console.log("sekiro: create connection failed,reconnect after 2s:" + o),                    void setTimeout(function () {                        e.connect();                    }, 2e3)                );            }            this.socket.onmessage(function (o) {                e.handleSekiroRequest(o.data);            }),                this.socket.onopen(function (e) {                    console.log("sekiro: open a sekiro client connection");                }),                this.socket.onclose(function (o) {                    console.log("sekiro: disconnected ,reconnection after 2s"),                        setTimeout(function () {                            e.connect();                        }, 2e3);                });        }),        (unsafeWindow.SekiroClient.prototype.handleSekiroRequest = function (e) {            console.log("receive sekiro request: " + e);            var o = JSON.parse(e),                t = o.__sekiro_seq__;            if (o.action) {                var n = o.action;                if (this.handlers[n]) {                    var s = this.handlers[n],                        i = this;                    try {                        s(                            o,                            function (e) {                                try {                                    i.sendSuccess(t, e);                                } catch (e) {                                    i.sendFailed(t, "e:" + e);                                }                            },                            function (e) {                                i.sendFailed(t, e);                            }                        );                    } catch (e) {                        console.log("error: " + e), i.sendFailed(t, ":" + e);                    }                } else this.sendFailed(t, "no action handler: " + n + " defined");            } else this.sendFailed(t, "need request param {action}");        }),        (unsafeWindow.SekiroClient.prototype.sendSuccess = function (e, o) {            var t;            if ("string" == typeof o)                try {                    t = JSON.parse(o);                } catch (e) {                    (t = {}).data = o;                }            else "object" == typeof o ? (t = o) : ((t = {}).data = o);            (Array.isArray(t) || "string" == typeof t) && (t = { data: t, code: 0 }), t.code ? (t.code = 0) : (t.status, (t.status = 0)), (t.__sekiro_seq__ = e);            var n = JSON.stringify(t);            console.log("response :" + n), this.socket.send(n);        }),        (unsafeWindow.SekiroClient.prototype.sendFailed = function (e, o) {            "string" != typeof o && (o = JSON.stringify(o));            var t = {};            (t.message = o), (t.status = -1), (t.__sekiro_seq__ = e);            var n = JSON.stringify(t);            console.log("sekiro: response :" + n), this.socket.send(n);        }),        (unsafeWindow.SekiroClient.prototype.registerAction = function (e, o) {            if ("string" != typeof e) throw new Error("an action must be string");            if ("function" != typeof o) throw new Error("a handler must be function");            return console.log("sekiro: register action: " + e), (this.handlers[e] = o), this;        });})();

var client = new SekiroClient("ws://127.0.0.1:5612/business/register?group=test&clientId=" + Math.random());client.registerAction("encrypt", function (request, resolve, reject) {    try {        var data = request["data"];        resolve(window._pwd_Encrypt(data)); // 这里修改自己的加密方法，这里演示用 window._pwd_Encrypt    } catch (e) {        reject("[encrypt] error: " + e);    }});

http://127.0.0.1:5612/business-demo/invoke?group=test&action=encrypt&data=admin123