*杀编辑器公测版签名破解

Security Classification: 【C-1】 | Publish Time:2024-11-14 | Category:Test Notes | Edit

AI Summary: 文章描述了如何通过分析一个答题系统的接口请求来绕过答题限制。作者首先尝试修改分数提交请求中的分数，但遭遇签名验证错误。接着，他们通过查找JavaScript代码中的签名生成方法，发现了需要的密钥和参数。经过修改和测试，成功获取了有效的签名，从而在后续访问中避免了答题提示。 --- (From Model:gpt-4o-mini-2024-07-18)

## 拦截提示

进入后让我答题，我怎么可能会知道贝蒂小熊是谁呢？

![](https://ipfs.rce.ink/bafkreid2vg4bkocbxdu5bqs7tulek5gxhm3m2jorptby4jnmaqm4unkpke)

## 基础分析

两个思路去绕过

- 在前端找到每道题的正确答案
- 在分数提交结算的时候去篡改数据

先试试第二种。于是就随便点乱按，到最后肯定会有个答题总分结算的接口请求，果然在第30次答案错误后，捕获到一个POST请求包

```
POST /api/user/updateGuide HTTP/2
Host: editor.xx.com
Content-Length: 579
Sec-Ch-Ua: "Google Chrome";v="111", "Not(A:Brand";v="8", "Chromium";v="111"
Sec-Ch-Ua-Platform: "macOS"
Sec-Ch-Ua-Mobile: ?0
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarylk2DUH6cimNdzeTG
Accept: */*
Origin: http://diy.xx.com
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: cors
Sec-Fetch-Dest: empty
Referer: http://diy.xx.com/
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9

------WebKitFormBoundarylk2DUH6cimNdzeTG
Content-Disposition: form-data; name="account"

***
------WebKitFormBoundarylk2DUH6cimNdzeTG
Content-Disposition: form-data; name="timestamp"

1679383948
------WebKitFormBoundarylk2DUH6cimNdzeTG
Content-Disposition: form-data; name="editor_guide"

0
------WebKitFormBoundarylk2DUH6cimNdzeTG
Content-Disposition: form-data; name="editor_point"

12
------WebKitFormBoundarylk2DUH6cimNdzeTG
Content-Disposition: form-data; name="sign"

***
------WebKitFormBoundarylk2DUH6cimNdzeTG--
```

formdata里的数据一下子就能明白含义：

- account 账户id
- timestamp 当前时间戳
- editor_guide 编辑指南？但是不知道干啥用的
- editor_point 我的分数
- sign 签名

这里可以发现editor_point 就是我的分数，当我的分数超过24分的时候就不会被答题界面拦截了。直接修改成30满分。

![](https://ipfs.rce.ink/bafkreignmz77zle5nltny4p2swh4g45e3tmwrywriuis25kcg67buymry4)

服务器无法保存我们的分数，提示签名错误

## 签名破解

在js中我们找到了这个接口地址

![](https://ipfs.rce.ink/bafkreie6js4p7s6c32aah6aomiqrpfnkjuc5jhoyexs7eyked7m42tfgzi)

他把这个接口地址保存成networkforhttp的属性 我们在下面可以看到交叉引用

![](https://ipfs.rce.ink/bafkreie3ptgfmztcakserpucihe7gqnbuf2pqoarxrnbsa7cnuvdd2s6vy)

这里用post请求发送formdata 刚好就是我们的请求包形式 可以观察到这段代码

`formData.append("sign", NetWorkForHttp.instance.getSign(vo));`

调用NetWorkForHttp实例的getsign方法，参数为vo，在上方找到有关定义

![](https://ipfs.rce.ink/bafkreie7ptu4idjm6htrvxwsrfeulkbbwi4y22pft6yfpo3u3vzcxa22la)

方法内用了一个变量  NetWorkForHttp.secret 找到这个值

![](https://ipfs.rce.ink/bafkreichwueqy3qlpalfypqux6cdmw5g2nd4q5jcscjs4r7ip2iwrjhu5a)

改一下方法 并作测试

![](https://ipfs.rce.ink/bafkreifikyr6ocvtcsr6abh3qyezhlojzpelqitpd3zjeuu44kxnasr2pm)

没问题 原版是用了vo做参数 它是一个对象 相关代码如下

```
let vo = {};
vo.account = PublicSetManager.instance.account;
vo.timestamp = NetWorkForHttp.instance.getTimestamp();
vo.editor_guide = QuestionManager.instance.editor_guide;
vo.editor_point = QuestionManager.instance.editor_point;
```

修改值 获取签名

![](https://ipfs.rce.ink/bafkreifgc3sta556dmfxaflqvkb5m2uvwjlqkmucwy55xhgthubsymikue)

![](https://ipfs.rce.ink/bafkreigiqsxcz22k7kmgn3zozzb2tosqr45cc3l4dgfa7m7s2hfrlr72mm)

后续再进入网站就不会提示需要做题了

Web3 Info

The ownership of the data in this article is secured by blockchain encryption technology and smart contracts, and is solely owned by the creator.

Comment List

Comment

© Copyright: This article is an original work and the copyright belongs to the Depy's docs unless marked as Reproduced

Please contact the blogger for authorization to reprint

*杀编辑器公测版签名破解

© Copyright: This article is an original work and the copyright belongs to the Depy's docs unless marked as ReproducedPlease contact the blogger for authorization to reprint

© Copyright: This article is an original work and the copyright belongs to the Depy's docs unless marked as Reproduced

Please contact the blogger for authorization to reprint