看函数命令方式,大胆的测试的用的是DES加解密算法。
然后往上继续找decryptByDES方法。
把js代码抠出来,跑一下:
js里面调用CryptoJS实现AES/DES加解密,所以还需要导入这个模块。
var CryptoJS=require('crypto-js')var CryptoJS=require('crypto-js')function decryptByDES(_0x3282ec,_0x3dcce1){var _0x456351=CryptoJS['enc'][_0x18ac('0x4a','iLY[')][_0x18ac('0x4b','3p8G')](_0x3dcce1);var _0x3c5437=CryptoJS[_0x18ac('0x4c','uyw)')][_0x18ac('0x4d','E%Rr')]({'ciphertext':CryptoJS[_0x18ac('0x4e','bCC&')][_0x18ac('0x4f','O))T')][_0x18ac('0x50','[MHn')](_0x3282ec)},_0x456351,{'mode':CryptoJS[_0x18ac('0x51','*UPX')][_0x18ac('0x52','0)^d')],'padding':CryptoJS[_0x18ac('0x53','Tv0C')]['Pkcs7']});return_0x3c5437['toString'](CryptoJS[_0x18ac('0xd','SIkZ')][_0x18ac('0x54','6iOW')]);}var des_secret="L0j+JvbeVM0svSpjIwXdE7yTu78wiEszrmb+M9iS8yad8pD3zsjrP1EXPc8D4B3kuNoTYLtXYX+ESOkGU1YwM8ddEuuoTg5uPsqQ9/SuNds="var des_key="Ctpsp@884*"var des_descrypt_str=decryptByDES(des_secret,des_key)console.log("数据解密成功!:",des_descrypt_str)运行一下:
报错,提示:_0x18ac is not defined,_0x18ac未定义
然后搜索_0x18ac,继续网上找。
把上面的代码抠出来,再跑一次。
提示__0xaada2 is not defined,__0xaada2也没有定义。
继续搜索__0xaada2,往上找。
然后再把这段代码抠出来,再跑一次。
然后这次成功的跑出来了。
完整的js代码如下(zhaobiao_des.js):
varCryptoJS=require('crypto-js')var__0xaada2=['wrrCicKWbQ==','w7bCszxQZg==','YcOOXQ==','w6R7FA==','w5hew7nDulA=','w4U8cgc=','wpzCg2w=','wqrCoMKy','wo0ROnrDj8KAWxs=','w6wjNQ==','wo3DmVfCug==','d8OfTVvCohk6fwzDqF7DnsOmPAPCqh0=','UQJ5wp0zw4MZw4EyfUM/YcKywpXDkcOew7vDpcOH','dcOZFsKcw6PDrMKePMO8CBzDnMKzDMK9w4dyZMOFwphaKjo=','AsKcwpHCk3vDpSfDqMKVwqzDkMKOw7Y=','OMKcwoU4OxrCnsKLYRLCmnHDkUpCw5Zr','wrTCr1QYwo1jwp5nw6h+FsKKwq/CvzrDmMK6w7c+Ww==','w6dVw7g=','woXDuz7CgMKf','w64fTDYA','E8OMOlPClQ==','DMKmwoTDqBA=','wrXDjEXDocKw','SsOlZ2jCoh8pUgfDr1TDmsOxLQ==','wozCnMKeMXQmw4XCiMK7','wpvClMOmwpxSXVPCjDM=','w5AtXw==','wr/Cs8KZDHE=','JsOlFEvCosOVwoRBE8KteH3DqsO8UmbDi8K+w4U=','csOrw7s/Kg==','wonDvBs=','wqLDiXjDjcKc','wqLCjMKEFE8=','w5Brw75WwrQ=','B8KpwrILNg==','wpfDpMKrw73DhA==','wpfDtGA=','wojDm1/DrXU=','wqLCrsKnA18=','w4t6eQ==','FcOcw7rCrsOiw4p3','wpgCCsKgeA==','V8OWGsOrwrFswq5rw4pswoTDucKPPxnDvQ==','wqvDiUE=','JMOWwptfGQ==','wp8RG0vDnMKKXQ==','w7Jzw73Dk2M=','w71nCQ7CjQ==','wrbCrsK1wrosBsKpNA==','IMOMACPClMKzbsK+','GSNgccK7','wrHCtFo6wqoaw6Et','NcOQDA==','acKUTQ==','ecOSw4gJOsOxAA==','wrXDglXDpw==','wp/CgsKU','acO/woE=','w6LCkQ3Dqic=','wrHDgzDDjy3DoFDCvw==','JCNyOQ==','wrbDocKpw5bDhg==','a8OrwqA=','WAhgwr0ew7A9','BMKdwpw=','w597w7lyw5DCtw==','wojClMO6wote','woLCksKUMA==','wo0qKw==','wo8HJQ==','SMOpwpt0','WcKjd24=','OGknRMOv','wpvCpcKc','5YiN6Zq154mW5pyv5Y+q77+7CMKl5L2a5a+85p2T5b+L56m4','wrDCkcOawpdc','acOgwqY=','ZsKncndM','w5guYMOgHw==','Ohks','w4vCozhTZA==','w6ArWT8MV8K/AcKG','VMOYw7kUJA==','wpUVK8OFYcKNSQHCl8K3HsKiasKA','T8ONAsKHw60=','wpvCnsOZwpZu','w5/CmxrDung=','ZcOBwpLCn8Kp','OAwRUcOb','OTtHSsON','wqsAGQ==','w7XCvzo=','e2sRHA==','w7QvXCI=','w4zCsS9AQA==','HXIla8Oy','a8OuahPDiA==','worDqSU=','w6pkAzfClw==','w6ETa8OyFQ==','UsOYwrs=','fMOwwoY='];(function(_0x491488,_0x2904a9){var_0x54e388=function(_0x4f0d63){while(--_0x4f0d63){_0x491488['push'](_0x491488['shift']());}};_0x54e388(++_0x2904a9);}(__0xaada2,0x1f0));var_0x18ac=function(_0x4fadf8,_0x47a697){_0x4fadf8=_0x4fadf8-0x0;var_0x38d2cc=__0xaada2[_0x4fadf8];if(_0x18ac['initialized']===undefined){(function(){var_0x38ee16=typeofwindow!=='undefined'?window:typeofprocess==='object'&&typeofrequire==='function'&&typeofglobal==='object'?global:this;var_0x3120aa='ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=';_0x38ee16['atob']||(_0x38ee16['atob']=function(_0x4da23e){var_0x2d14ac=String(_0x4da23e)['replace'](/=+$/,'');for(var_0x473eb4=0x0,_0x2231f7,_0x5211b2,_0x13e435=0x0,_0x21e5bb='';_0x5211b2=_0x2d14ac['charAt'](_0x13e435++);~_0x5211b2&&(_0x2231f7=_0x473eb4%0x4?_0x2231f7*0x40+_0x5211b2:_0x5211b2,_0x473eb4++%0x4)?_0x21e5bb+=String['fromCharCode'](0xff&_0x2231f7>>(-0x2*_0x473eb4&0x6)):0x0){_0x5211b2=_0x3120aa['indexOf'](_0x5211b2);}return_0x21e5bb;});}());var_0x8653ca=function(_0x5a8829,_0x58aade){var_0x586456=[],_0x28f5e9=0x0,_0xc4a39d,_0x4ebc96='',_0x58f954='';_0x5a8829=atob(_0x5a8829);for(var_0x5c0bfc=0x0,_0x406c6a=_0x5a8829['length'];_0x5c0bfc<_0x406c6a;_0x5c0bfc++){_0x58f954+='%'+('00'+_0x5a8829['charCodeAt'](_0x5c0bfc)['toString'](0x10))['slice'](-0x2);}_0x5a8829=decodeURIComponent(_0x58f954);for(var_0x3d96e0=0x0;_0x3d96e0<0x100;_0x3d96e0++){_0x586456[_0x3d96e0]=_0x3d96e0;}for(_0x3d96e0=0x0;_0x3d96e0<0x100;_0x3d96e0++){_0x28f5e9=(_0x28f5e9+_0x586456[_0x3d96e0]+_0x58aade['charCodeAt'](_0x3d96e0%_0x58aade['length']))%0x100;_0xc4a39d=_0x586456[_0x3d96e0];_0x586456[_0x3d96e0]=_0x586456[_0x28f5e9];_0x586456[_0x28f5e9]=_0xc4a39d;}_0x3d96e0=0x0;_0x28f5e9=0x0;for(var_0x2624a6=0x0;_0x2624a6<_0x5a8829['length'];_0x2624a6++){_0x3d96e0=(_0x3d96e0+0x1)%0x100;_0x28f5e9=(_0x28f5e9+_0x586456[_0x3d96e0])%0x100;_0xc4a39d=_0x586456[_0x3d96e0];_0x586456[_0x3d96e0]=_0x586456[_0x28f5e9];_0x586456[_0x28f5e9]=_0xc4a39d;_0x4ebc96+=String['fromCharCode'](_0x5a8829['charCodeAt'](_0x2624a6)^_0x586456[(_0x586456[_0x3d96e0]+_0x586456[_0x28f5e9])%0x100]);}return_0x4ebc96;};_0x18ac['rc4']=_0x8653ca;_0x18ac['data']={};_0x18ac['initialized']=!![];}var_0xc2c2ce=_0x18ac['data'][_0x4fadf8];if(_0xc2c2ce===undefined){if(_0x18ac['once']===undefined){_0x18ac['once']=!![];}_0x38d2cc=_0x18ac['rc4'](_0x38d2cc,_0x47a697);_0x18ac['data'][_0x4fadf8]=_0x38d2cc;}else{_0x38d2cc=_0xc2c2ce;}return_0x38d2cc;};functiondecryptByDES(_0x3282ec,_0x3dcce1){var_0x456351=CryptoJS['enc'][_0x18ac('0x4a','iLY[')][_0x18ac('0x4b','3p8G')](_0x3dcce1);var_0x3c5437=CryptoJS[_0x18ac('0x4c','uyw)')][_0x18ac('0x4d','E%Rr')]({'ciphertext':CryptoJS[_0x18ac('0x4e','bCC&')][_0x18ac('0x4f','O))T')][_0x18ac('0x50','[MHn')](_0x3282ec)},_0x456351,{'mode':CryptoJS[_0x18ac('0x51','*UPX')][_0x18ac('0x52','0)^d')],'padding':CryptoJS[_0x18ac('0x53','Tv0C')]['Pkcs7']});return_0x3c5437['toString'](CryptoJS[_0x18ac('0xd','SIkZ')][_0x18ac('0x54','6iOW')]);}vardes_secret="L0j+JvbeVM0svSpjIwXdE7yTu78wiEszrmb+M9iS8yad8pD3zsjrP1EXPc8D4B3kuNoTYLtXYX+ESOkGU1YwM8ddEuuoTg5uPsqQ9/SuNds="vardes_key="Ctpsp@884*"vardes_descrypt_str=decryptByDES(des_secret,des_key)console.log("数据解密成功!:",des_descrypt_str)使用deepseek还原成python代码:
importbase64fromCrypto.CipherimportDESfromCrypto.Util.Paddingimportunpaddefdecrypt_by_des(ciphertext_b64:str,key:str)->str:# CryptoJS 的 DES 实际只使用前 8 字节作为 DES keykey_bytes=key.encode("utf-8")[:8]ciphertext=base64.b64decode(ciphertext_b64)cipher=DES.new(key_bytes,DES.MODE_ECB)plaintext=cipher.decrypt(ciphertext)plaintext=unpad(plaintext,DES.block_size)returnplaintext.decode("utf-8")des_secret="L0j+JvbeVM0svSpjIwXdE7yTu78wiEszrmb+M9iS8yad8pD3zsjrP1EXPc8D4B3kuNoTYLtXYX+ESOkGU1YwM8ddEuuoTg5uPsqQ9/SuNds="des_key="Ctpsp@884*"des_decrypt_str=decrypt_by_des(des_secret,des_key)print("数据解密成功!:",des_decrypt_str)安装依赖:
pip install pycryptodome关键点:
- 算法:DES
- 模式:ECB
- 填充:PKCS7
- 密文编码:Base64
- 明文编码:UTF-8