绵阳城市学院校园网 Srun Portal 认证逆向分析

1
function encode(str, key) {
2
  if (str === '') return '';
3

4
  var v = s(str, true);   // 字符串 → uint32 数组，追加长度
5
  var k = s(key, false);  // key → uint32 数组
6

7
  if (k.length < 4) k.length = 4;
8

9
  var n = v.length - 1,
10
      z = v[n], y = v[0],
11
      c = 0x86014019 | 0x183639A0,  // delta = 0x9E3779B9
12
      q = Math.floor(6 + 52 / (n + 1)),
13
      d = 0;
14

15
  while (0 < q--) {
16
    d = d + c & (0x8CE0D9BF | 0x731F2640);
17
    e = d >>> 2 & 3;
18
    for (p = 0; p < n; p++) {
19
      y = v[p + 1];
20
      m = z >>> 5 ^ y << 2;
21
      m += (y >>> 3 ^ z << 4) ^ (d ^ y);
22
      m += k[p & 3 ^ e] ^ z;
23
      z = v[p] = v[p] + m & (0xEFB8D130 | 0x10472ECF);
24
    }
25
    y = v[0];
26
    m = z >>> 5 ^ y << 2;
27
    m += (y >>> 3 ^ z << 4) ^ (d ^ y);
28
    m += k[p & 3 ^ e] ^ z;
29
    z = v[n] = v[n] + m & (0xBB390742 | 0x44C6F8BD);
30
  }
31

32
  return l(v, false);
33
}

1
func srunBase64(data []byte) string {
2
    alphabet := "LVoJPiCN2R8G90yg+hmFHuacZ1OWMnrsSTXkYpUq/3dlbfKwv6xztjI7DeBE45QA"
3
    pad := byte('=')
4

5
    var result strings.Builder
6
    for i := 0; i < len(data); i += 3 {
7
        b1 := data[i]
8
        var b2, b3 byte
9
        if i+1 < len(data) { b2 = data[i+1] }
10
        if i+2 < len(data) { b3 = data[i+2] }
11

12
        result.WriteByte(alphabet[b1>>2])
13
        result.WriteByte(alphabet[((b1&0x03)<<4)|(b2>>4)])
14
        if i+1 < len(data) {
15
            result.WriteByte(alphabet[((b2&0x0f)<<2)|(b3>>6)])
16
        } else {
17
            result.WriteByte(pad)
18
        }
19
        if i+2 < len(data) {
20
            result.WriteByte(alphabet[b3&0x3f])
21
        } else {
22
            result.WriteByte(pad)
23
        }
24
    }
25
    return result.String()
26
}

1
package main
2

3
import (
4
  "crypto/hmac"
5
  "crypto/md5"
6
  "crypto/sha1"
7
  "encoding/hex"
8
  "encoding/json"
9
  "fmt"
10
  "io"
11
  "net/http"
12
  "net/url"
13
  "strconv"
14
  "strings"
15
  "time"
16
)
17

18
const (
19
  baseURL  = "http://10.8.8.117"
20
  username = "23131313@test_sl"
21
  password = "12345"
22

23
  acID = "0"
24
  n    = "200"
25
  typ  = "1"
26
)
27

28
var ip = "10.103.26.135"
29

30
type ChallengeResp struct {
31
  Challenge string `json:"challenge"`
32
  ClientIP  string `json:"client_ip"`
33
  OnlineIP  string `json:"online_ip"`
34
  Error     string `json:"error"`
35
  Ecode     int    `json:"ecode"`
36
}
37

38
// HMAC-MD5：password 参数使用
39
func hmacMD5(pass, token string) string {
40
  h := hmac.New(md5.New, []byte(token))
41
  h.Write([]byte(pass))
42
  return hex.EncodeToString(h.Sum(nil))
43
}
44

45
// SHA1：chksum 参数使用
46
func sha1Hex(s string) string {
47
  h := sha1.Sum([]byte(s))
48
  return hex.EncodeToString(h[:])
49
}
50

51
// 获取 challenge / token
52
func getChallenge(useIP string) (ChallengeResp, error) {
53
  callback := fmt.Sprintf("jQuery%d", time.Now().UnixMilli())
54

55
  v := url.Values{}
56
  v.Set("callback", callback)
57
  v.Set("username", username)
58
  if useIP != "" {
59
    v.Set("ip", useIP)
60
  }
61
  v.Set("_", strconv.FormatInt(time.Now().UnixMilli(), 10))
62

63
  resp, err := http.Get(baseURL + "/cgi-bin/get_challenge?" + v.Encode())
64
  if err != nil {
65
    return ChallengeResp{}, err
66
  }
67
  defer resp.Body.Close()
68

69
  body, _ := io.ReadAll(resp.Body)
70
  text := strings.TrimSpace(string(body))
71

72
  start := strings.Index(text, "(")
73
  end := strings.LastIndex(text, ")")
74
  if start < 0 || end <= start {
75
    return ChallengeResp{}, fmt.Errorf("解析 JSONP 失败: %s", text)
76
  }
77

78
  var cr ChallengeResp
79
  if err := json.Unmarshal([]byte(text[start+1:end]), &cr); err != nil {
80
    return ChallengeResp{}, err
81
  }
82
  if cr.Challenge == "" {
83
    return ChallengeResp{}, fmt.Errorf("未获取到 challenge: %s", text)
84
  }
85
  return cr, nil
86
}
87

88
// 构造 info 参数：{SRBX1} + srunBase64(xEncode(JSON, token))
89
func srunInfo(token string) string {
90
  info := fmt.Sprintf(
91
    `{"username":"%s","password":"%s","ip":"%s","acid":"%s","enc_ver":"srun_bx1"}`,
92
    username, password, ip, acID,
93
  )
94
  return "{SRBX1}" + srunBase64(xEncode(info, token))
95
}
96

97
// Srun 自定义 Base64（字符表与标准不同）
98
func srunBase64(data []byte) string {
99
  alphabet := "LVoJPiCN2R8G90yg+hmFHuacZ1OWMnrsSTXkYpUq/3dlbfKwv6xztjI7DeBE45QA"
100
  pad := byte('=')
101

102
  var result strings.Builder
103
  for i := 0; i < len(data); i += 3 {
104
    b1 := data[i]
105
    var b2, b3 byte
106
    if i+1 < len(data) {
107
      b2 = data[i+1]
108
    }
109
    if i+2 < len(data) {
110
      b3 = data[i+2]
111
    }
112
    result.WriteByte(alphabet[b1>>2])
113
    result.WriteByte(alphabet[((b1&0x03)<<4)|(b2>>4)])
114
    if i+1 < len(data) {
115
      result.WriteByte(alphabet[((b2&0x0f)<<2)|(b3>>6)])
116
    } else {
117
      result.WriteByte(pad)
118
    }
119
    if i+2 < len(data) {
120
      result.WriteByte(alphabet[b3&0x3f])
121
    } else {
122
      result.WriteByte(pad)
123
    }
124
  }
125
  return result.String()
126
}
127

128
// XXTEA 加密（xEncode）
129
func xEncode(str, key string) []byte {
130
  if str == "" {
131
    return []byte{}
132
  }
133

134
  v := strToLong(str, true)
135
  k := strToLong(key, false)
136
  for len(k) < 4 {
137
    k = append(k, 0)
138
  }
139

140
  nn := len(v) - 1
141
  z := v[nn]
142
  y := v[0]
143
  c := uint32(0x86014019 | 0x183639A0)
144
  mask := uint32(0x8CE0D9BF | 0x731F2640)
145
  q := uint32(6 + 52/(nn+1))
146
  d := uint32(0)
147

148
  for q > 0 {
149
    q--
150
    d = (d + c) & mask
151
    e := (d >> 2) & 3
152
    var p int
153
    for p = 0; p < nn; p++ {
154
      y = v[p+1]
155
      m := (z>>5 ^ y<<2) + ((y>>3 ^ z<<4) ^ (d ^ y)) + (k[(p&3)^int(e)] ^ z)
156
      v[p] = (v[p] + m) & mask
157
      z = v[p]
158
    }
159
    y = v[0]
160
    m := (z>>5 ^ y<<2) + ((y>>3 ^ z<<4) ^ (d ^ y)) + (k[(p&3)^int(e)] ^ z)
161
    v[nn] = (v[nn] + m) & mask
162
    z = v[nn]
163
  }
164
  return longToStr(v, false)
165
}
166

167
func strToLong(s string, includeLength bool) []uint32 {
168
  b := []byte(s)
169
  v := make([]uint32, (len(b)+3)/4)
170
  for i, c := range b {
171
    v[i>>2] |= uint32(c) << uint((i&3)*8)
172
  }
173
  if includeLength {
174
    v = append(v, uint32(len(b)))
175
  }
176
  return v
177
}
178

179
func longToStr(v []uint32, includeLength bool) []byte {
180
  length := len(v) * 4
181
  if includeLength {
182
    length = int(v[len(v)-1])
183
    v = v[:len(v)-1]
184
  }
185
  b := make([]byte, len(v)*4)
186
  for i, val := range v {
187
    b[i*4] = byte(val)
188
    b[i*4+1] = byte(val >> 8)
189
    b[i*4+2] = byte(val >> 16)
190
    b[i*4+3] = byte(val >> 24)
191
  }
192
  if length > len(b) {
193
    length = len(b)
194
  }
195
  return b[:length]
196
}
197

198
func login() error {
199
  useIP := ip
200

201
  // 未手动填写 IP 时，先自动获取 client_ip
202
  if useIP == "" {
203
    cr, err := getChallenge("")
204
    if err != nil {
205
      return err
206
    }
207
    if cr.ClientIP == "" {
208
      return fmt.Errorf("自动获取 IP 失败")
209
    }
210
    useIP = cr.ClientIP
211
    fmt.Println("自动获取 IP:", useIP)
212
  }
213

214
  cr, err := getChallenge(useIP)
215
  if err != nil {
216
    return err
217
  }
218

219
  token := cr.Challenge
220
  ip = useIP
221

222
  hmd5 := hmacMD5(password, token)
223
  info := srunInfo(token)
224

225
  chkStr := token + username +
226
    token + hmd5 +
227
    token + acID +
228
    token + ip +
229
    token + n +
230
    token + typ +
231
    token + info
232
  chksum := sha1Hex(chkStr)
233

234
  v := url.Values{}
235
  v.Set("callback", fmt.Sprintf("jQuery%d", time.Now().UnixMilli()))
236
  v.Set("action", "login")
237
  v.Set("username", username)
238
  v.Set("password", "{MD5}"+hmd5)
239
  v.Set("os", "Mac OS")
240
  v.Set("name", "Macintosh")
241
  v.Set("double_stack", "0")
242
  v.Set("chksum", chksum)
243
  v.Set("info", info)
244
  v.Set("ac_id", acID)
245
  v.Set("ip", ip)
246
  v.Set("n", n)
247
  v.Set("type", typ)
248
  v.Set("_", strconv.FormatInt(time.Now().UnixMilli(), 10))
249

250
  resp, err := http.Get(baseURL + "/cgi-bin/srun_portal?" + v.Encode())
251
  if err != nil {
252
    return err
253
  }
254
  defer resp.Body.Close()
255

256
  body, _ := io.ReadAll(resp.Body)
257
  fmt.Println(strings.TrimSpace(string(body)))
258
  return nil
259
}
260

261
func main() {
262
  if err := login(); err != nil {
263
    fmt.Println("登录失败:", err)
264
  }
265
}