关于qq农场登陆的密码加密问题

2010-01-02 11:08 和尚释然阅读(984) 评论(0) 编辑收藏举报

最近女友在玩qq农场

老说自己的菜老师被人偷，老让我帮他偷菜啊，摘菜什么的东东

作为堂堂程序员的我，本来时间就少，连写日志的时间都没有还要手动帮她玩qq农场那是件多么丢人的事情啊。。。。

于是我打算做一个外挂，这样我就解放了哈哈

说做就做现在开始

我使用的是windows，mfc的wininet的通信模式

可是一开始就碰到了个棘手的问题，当我在网页上输入密码123456，验证码1234提交的时候

qq的网页竟然将其加密为了7C688807CF6938E65F182C7CC6CCAE4D

这是如何加密的呢？百思不的其解，

于是查看xiaoyou.qq.com网页的源代码，找他的加密函数

发现其加密函数放置于Mlogin.js这个脚本中，由于我对网页的代码实在是不了解

于是我大概的把这个脚本文件下载下来查看

发现加密其实用的是这个函数

function preprocess(form)
{

var str="";

str+=form.verifycode.value;

str=str.toUpperCase();

form.p.value=md5(md5_3(form.p.value)+str);

return true;

}

发现是把我们提交的密码经过3次md5加密后加上验证码在进行一次加密

于是我按照这个思路在线md5加密了一次，怎么加密的结果都和我提交的不一样~难道qq的md5加密不是标准的？

这样的话只有一个思路了就是利用qq脚本中的加密函数了

VC中如何调用？即使我调用了也不知道这个函数的上下文如何建立。。。

于是只有曲线实现了

自己写一个网页调用这个脚本，来算出加密后的文件

由于上下文不会建立，所以即使调用这个函数，也只能改装下了

我把上面所提到的函数改装为

function preprocess(form)
{
var str="123456";
str=md5(md5_3(str)+form);
alert(str);
return true;
}

然后将修改后的Mlogin.js文件另存到D:\Mlogin.js

然后用editplus这个软件写一个网页，我对网页实在是不了解啊，只能利用模板自己乱写了

写好的网页代码如下所示

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML>
<HEAD>
<TITLE> New Document </TITLE>
<META NAME="Generator" CONTENT="EditPlus">
<META NAME="Author" CONTENT="">
<META NAME="Keywords" CONTENT="">
<META NAME="Description" CONTENT="">
</HEAD>
<script type="text/javascript" src="d:\Mlogin.js"></script>
<BODY>

<INPUT TYPE="button" VALUE="aaa" ONCLICK="preprocess(1234)">
</BODY>
</HTML>
这样运行这个网页，单击button按钮

嘿嘿，密码123456，验证码为1234的加密代码出来啦

和截获的提交加密文一样都是7C688807CF6938E65F182C7CC6CCAE4D

外挂的第一步成功了~~~~~

后补充===================================================================

由于很多朋友来看，发了很多问题，虽然我没继续做这个外挂了，但是我还是把发到博客里的东西给大家解释清楚哈

回复Koma：

没想到会有这么多人看这篇帖子。。。受宠若惊

这样，我吧d:\Mlogin.js的代码复制过来吧，用的时候复制到相对路径保证文件名一样，后面是代码

   // Open the file for output.
    //var filename = "c:\\testfile.txt";
   // var f = fso.OpenTextFile(filename, ForWriting, true);

    // Write to the file.
   //f.WriteLine("Hello world!");
   //f.WriteLine("JScript is fun");
   //f.Close();
return true;
}
function md5_3(s)
{var tmp=new Array;tmp=core_md5(str2binl(s),s.length*chrsz);tmp=core_md5(tmp,16*chrsz);tmp=core_md5(tmp,16*chrsz);return binl2hex(tmp);}
function md5(s)
{return hex_md5(s);}
function hex_md5(s)
{return binl2hex(core_md5(str2binl(s),s.length*chrsz));}
function b64_md5(s)
{return binl2b64(core_md5(str2binl(s),s.length*chrsz));}
function str_md5(s)
{return binl2str(core_md5(str2binl(s),s.length*chrsz));}
function hex_hmac_md5(key,data)
{return binl2hex(core_hmac_md5(key,data));}
function b64_hmac_md5(key,data)
{return binl2b64(core_hmac_md5(key,data));}
function str_hmac_md5(key,data)
{return binl2str(core_hmac_md5(key,data));}
function md5_vm_test()
{return hex_md5("abc")=="900150983cd24fb0d6963f7d28e17f72";}
function core_md5(x,len)
{x[len>>5]|=0x80<<((len)%32);x[(((len+64)>>>9)<<4)+14]=len;var a=1732584193;var b=-271733879;var c=-1732584194;var d=271733878;for(var i=0;i<x.length;i+=16)
{var olda=a;var oldb=b;var oldc=c;var oldd=d;a=md5_ff(a,b,c,d,x[i+0],7,-680876936);d=md5_ff(d,a,b,c,x[i+1],12,-389564586);c=md5_ff(c,d,a,b,x[i+2],17,606105819);b=md5_ff(b,c,d,a,x[i+3],22,-1044525330);a=md5_ff(a,b,c,d,x[i+4],7,-176418897);d=md5_ff(d,a,b,c,x[i+5],12,1200080426);c=md5_ff(c,d,a,b,x[i+6],17,-1473231341);b=md5_ff(b,c,d,a,x[i+7],22,-45705983);a=md5_ff(a,b,c,d,x[i+8],7,1770035416);d=md5_ff(d,a,b,c,x[i+9],12,-1958414417);c=md5_ff(c,d,a,b,x[i+10],17,-42063);b=md5_ff(b,c,d,a,x[i+11],22,-1990404162);a=md5_ff(a,b,c,d,x[i+12],7,1804603682);d=md5_ff(d,a,b,c,x[i+13],12,-40341101);c=md5_ff(c,d,a,b,x[i+14],17,-1502002290);b=md5_ff(b,c,d,a,x[i+15],22,1236535329);a=md5_gg(a,b,c,d,x[i+1],5,-165796510);d=md5_gg(d,a,b,c,x[i+6],9,-1069501632);c=md5_gg(c,d,a,b,x[i+11],14,643717713);b=md5_gg(b,c,d,a,x[i+0],20,-373897302);a=md5_gg(a,b,c,d,x[i+5],5,-701558691);d=md5_gg(d,a,b,c,x[i+10],9,38016083);c=md5_gg(c,d,a,b,x[i+15],14,-660478335);b=md5_gg(b,c,d,a,x[i+4],20,-405537848);a=md5_gg(a,b,c,d,x[i+9],5,568446438);d=md5_gg(d,a,b,c,x[i+14],9,-1019803690);c=md5_gg(c,d,a,b,x[i+3],14,-187363961);b=md5_gg(b,c,d,a,x[i+8],20,1163531501);a=md5_gg(a,b,c,d,x[i+13],5,-1444681467);d=md5_gg(d,a,b,c,x[i+2],9,-51403784);c=md5_gg(c,d,a,b,x[i+7],14,1735328473);b=md5_gg(b,c,d,a,x[i+12],20,-1926607734);a=md5_hh(a,b,c,d,x[i+5],4,-378558);d=md5_hh(d,a,b,c,x[i+8],11,-2022574463);c=md5_hh(c,d,a,b,x[i+11],16,1839030562);b=md5_hh(b,c,d,a,x[i+14],23,-35309556);a=md5_hh(a,b,c,d,x[i+1],4,-1530992060);d=md5_hh(d,a,b,c,x[i+4],11,1272893353);c=md5_hh(c,d,a,b,x[i+7],16,-155497632);b=md5_hh(b,c,d,a,x[i+10],23,-1094730640);a=md5_hh(a,b,c,d,x[i+13],4,681279174);d=md5_hh(d,a,b,c,x[i+0],11,-358537222);c=md5_hh(c,d,a,b,x[i+3],16,-722521979);b=md5_hh(b,c,d,a,x[i+6],23,76029189);a=md5_hh(a,b,c,d,x[i+9],4,-640364487);d=md5_hh(d,a,b,c,x[i+12],11,-421815835);c=md5_hh(c,d,a,b,x[i+15],16,530742520);b=md5_hh(b,c,d,a,x[i+2],23,-995338651);a=md5_ii(a,b,c,d,x[i+0],6,-198630844);d=md5_ii(d,a,b,c,x[i+7],10,1126891415);c=md5_ii(c,d,a,b,x[i+14],15,-1416354905);b=md5_ii(b,c,d,a,x[i+5],21,-57434055);a=md5_ii(a,b,c,d,x[i+12],6,1700485571);d=md5_ii(d,a,b,c,x[i+3],10,-1894986606);c=md5_ii(c,d,a,b,x[i+10],15,-1051523);b=md5_ii(b,c,d,a,x[i+1],21,-2054922799);a=md5_ii(a,b,c,d,x[i+8],6,1873313359);d=md5_ii(d,a,b,c,x[i+15],10,-30611744);c=md5_ii(c,d,a,b,x[i+6],15,-1560198380);b=md5_ii(b,c,d,a,x[i+13],21,1309151649);a=md5_ii(a,b,c,d,x[i+4],6,-145523070);d=md5_ii(d,a,b,c,x[i+11],10,-1120210379);c=md5_ii(c,d,a,b,x[i+2],15,718787259);b=md5_ii(b,c,d,a,x[i+9],21,-343485551);a=safe_add(a,olda);b=safe_add(b,oldb);c=safe_add(c,oldc);d=safe_add(d,oldd);}
if(mode==16)
{return Array(b,c);}
else
{return Array(a,b,c,d);}}
function md5_cmn(q,a,b,x,s,t)
{return safe_add(bit_rol(safe_add(safe_add(a,q),safe_add(x,t)),s),b);}
function md5_ff(a,b,c,d,x,s,t)
{return md5_cmn((b&c)|((~b)&d),a,b,x,s,t);}
function md5_gg(a,b,c,d,x,s,t)
{return md5_cmn((b&d)|(c&(~d)),a,b,x,s,t);}
function md5_hh(a,b,c,d,x,s,t)
{return md5_cmn(b^c^d,a,b,x,s,t);}
function md5_ii(a,b,c,d,x,s,t)
{return md5_cmn(c^(b|(~d)),a,b,x,s,t);}
function core_hmac_md5(key,data)
{var bkey=str2binl(key);if(bkey.length>16)
bkey=core_md5(bkey,key.length*chrsz);var ipad=Array(16),opad=Array(16);for(var i=0;i<16;i++)
{ipad[i]=bkey[i]^0x36363636;opad[i]=bkey[i]^0x5C5C5C5C;}
var hash=core_md5(ipad.concat(str2binl(data)),512+data.length*chrsz);return core_md5(opad.concat(hash),512+128);}
function safe_add(x,y)
{var lsw=(x&0xFFFF)+(y&0xFFFF);var msw=(x>>16)+(y>>16)+(lsw>>16);return(msw<<16)|(lsw&0xFFFF);}
function bit_rol(num,cnt)
{return(num<<cnt)|(num>>>(32-cnt));}
function str2binl(str)
{var bin=Array();var mask=(1<<chrsz)-1;for(var i=0;i<str.length*chrsz;i+=chrsz)
bin[i>>5]|=(str.charCodeAt(i/chrsz)&mask)<<(i%32);return bin;}
function binl2str(bin)
{var str="";var mask=(1<<chrsz)-1;for(var i=0;i<bin.length*32;i+=chrsz)
str+=String.fromCharCode((bin[i>>5]>>>(i%32))&mask);return str;}
function binl2hex(binarray)
{var hex_tab=hexcase?"0123456789ABCDEF":"0123456789abcdef";var str="";for(var i=0;i<binarray.length*4;i++)
{str+=hex_tab.charAt((binarray[i>>2]>>((i%4)*8+4))&0xF)+
hex_tab.charAt((binarray[i>>2]>>((i%4)*8))&0xF);}
return str;}
function binl2b64(binarray)
{var tab="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";var str="";for(var i=0;i<binarray.length*4;i+=3)
{var triplet=(((binarray[i>>2]>>8*(i%4))&0xFF)<<16)|(((binarray[i+1>>2]>>8*((i+1)%4))&0xFF)<<8)|((binarray[i
+2>>2]>>8*((i+2)%4))&0xFF);for(var j=0;j<4;j++)
{if(i*8+j*6>binarray.length*32)
str+=b64pad;else
str+=tab.charAt((triplet>>6*(3-j))&0x3F);}}
return str;}
var gqbardomain="qbar.qq.com";function HtmlFilter(str)
{str=str.replace(/\<(.*?)\>/g,'',str);str=str.replace(/\<\/(.*?)\>/g,'',str);return str;}
function get_split_time(ts)
{var cur_ts=Math.floor(new Date().getTime()/1000);var split_ts=Math.abs(cur_ts-ts);if(split_ts<=(5*60))
return'刚刚';else if(split_ts>(5*60)&&split_ts<=(60*60))
return Math.round(split_ts/60)+'分钟前';else if(split_ts>(60*60)&&split_ts<=(24*60*60))
return Math.round(split_ts/3600)+'小时前';else if(split_ts>(24*60*60)&&split_ts<=(7*24*60*60))
return Math.round(split_ts/86400)+'天前';else if(split_ts>(7*24*60*60)&&split_ts<=(4*7*24*60*60))
return Math.round(split_ts/604800)+'星期前';else{var t=new Date(ts*1000);function y2k(number){return(number<1000)?number+1900:number;}
return y2k(t.getYear())+'-'+(t.getMonth()+1)+'-'+t.getDate();}}
function isChEnNumUnderline(str)
{if(str.trim().length==0)
{return true;}
str=str.trim().replace(/[\u4e00-\u9fa5a-zA-z0-9\x21-\x7e\ufe30-\uffa0\u3000-\u303F\uFE10-\uFE1F\uFE30-\uFE4F。（）――+%#￥@……&×～【】\s《》“”？！-]/gi,"");return(str.length==0);}
function clearFile(fileid)
{var obj=Fid(fileid);if(obj)obj.outerHTML=obj.outerHTML;}
var g_post_Iframe_div_id='g_post_iframe',g_Iframe_div;function g_post_Iframe(id,get){this.id=id;if(!this.iframe_div){this.init_post_div();}
this.busy=false;this.mothod=(undefined==get)?'post':get;}
g_post_Iframe.prototype.set=function(callback,url,params)
{var input_html=('post'==this.mothod)?g_make_inputs(params):'';document.body.appendChild(this.iframe_div);this.iframe_div.innerHTML='<form target="'+this.id+'_post_iframe" id="'+this.id+'_post_form" method="'+this.mothod+'" action="'+url+'">'+input_html+'</form><iframe id="'+this.id+'_post_iframe" name="'+this.id+'_post_iframe"></iframe>';var self=this;this.form=Fid(this.id+'_post_form');this.iframe=Fid(this.id+'_post_iframe');this.cb=callback;if(typeof document.addEventListener=="function")
{self.iframe.addEventListener("load",function(){self.callback();return true;},false);}
else
{self.iframe.attachEvent("onload",function(){self.callback();return true;});}}
g_post_Iframe.prototype.callback=function()
{if(true==this.busy)
{this.busy=false;this.cb(this.iframe.contentWindow);}
var self=this;if(typeof document.addEventListener=="function")
{self.iframe.removeEventListener("load",function(){self.callback();return true;},false);}
else
{self.iframe.detachEvent("onload",function(){self.callback();return true;});}}
g_post_Iframe.prototype.send=function()
{if(false==this.busy)
{this.busy=true;this.form.submit();return true;}else
{return false;}}
g_post_Iframe.prototype.init_post_div=function()
{this.iframe_div=document.createElement("div");this.iframe_div.style.display="none";}
function g_make_inputs(params)
{params='&'+params+'&r='+Math.random();var html_str=params.replace(/=/gi,'" value="');html_str=html_str.replace(/&/gi,'" ><input type="hidden" name="');html_str=html_str.substr(3,html_str.length)+html_str.substr(0,3);html_str=decodeURIComponent(html_str);return html_str;}
var img_id_unique=0;function switch_imgs()
{var imgs=document.getElementsByTagName('IMG');for(var i=0;i<imgs.length;i++)
{var rel=imgs[i].getAttribute('rel')
if(rel)
{img_id_unique++;imgs[i].id='img_id_unique_'+img_id_unique;var img=new Image();img.src=rel;img.id=imgs[i].id+'_tmp';img.onload=function(){document.getElementById(this.id.replace('_tmp','')).src=this.src;}}}}/* |xGv00|d604454b49876c23fd1e9d9fdde44096 */

之后建立一个html文件，用记事本打开里面写上<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML>
<HEAD>
<TITLE> New Document </TITLE>
<META NAME="Generator" CONTENT="EditPlus">
<META NAME="Author" CONTENT="">
<META NAME="Keywords" CONTENT="">
<META NAME="Description" CONTENT="">
</HEAD>
<script type="text/javascript" src="d:\Mlogin.js"></script>
<BODY>

<INPUT TYPE="button" VALUE="aaa" ONCLICK="preprocess(1234)">
</BODY>
</HTML

这样的就可以了哈

会员力量，点亮园子希望

刷新页面返回顶部

和尚释然和尚不看佛经,改看编程宝典.