某写真网站前端解密问题求助

tooooony

网站地址：https://www.x%sx%mm.com，移除网址中的%
该网站采用forge.min.js加密：解密部分代码翻译如下：

[JavaScript] 纯文本查看 复制代码

    window['onload'] = function() {
        var start_time = Date['now']();
        var decipher = forge['cipher']['createDecipher']('AES-CTR', raw_key);
        decipher['start']({
            'iv': iv
        });
        var data = new Uint8Array(encrypted['match'](/.{1,2}/g)['map'](x => parseInt(x, 10)));
        decipher['update'](forge['util']['createBuffer'](data));
        var pass = decipher['finish']();
        if (pass) {
            var dom = new DOMParser()['parseFromString'](decipher['output'], 'text/html');
            var end_time = Date['now']();
            if (!has_cookie('btwaf-21cb7f37099ce405e82768674d54a499-0711fc5487872cd6')) {
                document['querySelector']('.btbox')['style']['display'] = 'block';
                var ua = window['navigator']['userAgent'];
                var sha256 = forge['md']['sha256']['create']();
                var ua_sha256 = sha256['update'](ua);
                set_cookie('btwaf-21cb7f37099ce405e82768674d54a499-0711fc5487872cd6', ua_sha256['digest']()['toHex'](), 86400 * 30, '/');
                setTimeout(function() {
                    write_html(dom['head']['innerHTML']);
                }, Math['max'](3000 - (end_time - start_time), 0));
            } else {
                setTimeout(function() {
                    write_html(dom['head']['innerHTML']);
                }, 0x0);
            }
        } else {
            document['querySelector']('.btbox')['style']['display'] = 'block';
            window['location']['reload']();
        }

        function write_html(html) {
            document['head']['innerHTML'] = html;
            document['open']();
            document['write'](decipher['output']);
            document['close']();
        }

        function has_cookie(key) {
            const key = encodeURIComponent(key) + '=';
            const arr = document['cookie']['split'](';');
            for (let i = 0; i < arr['length']; i++) {
                let value = arr[i]['trim']();
                if (value['indexOf'](key) === 0) {
                    return true;
                }
            }
            return false;
        }

        function set_cookie(key, value, expires, path) {
            var date = new Date();
            date['setTime'](date['getTime']() + expires * 1000);
            var expires = 'expires=' + date['toUTCString']();
            document['cookie'] = encodeURIComponent(key) + '=' + encodeURIComponent(value) + ';\x20' + expires + '; path=' + path;
        }
    };

注意js加密代码中AES加密模式每次都会变化。

尝试python代码解密：

[Python] 纯文本查看 复制代码

from Crypto.Cipher import AES
import base64
from requests import Session
import re
import json
from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes
from cryptography.hazmat.backends import default_backend


def decrypt2(key: str, iv: str, encrypted: str):
    # 创建解密器
    cipher = AES.new(key.encode(), AES.MODE_OFB, iv.encode())
    # 解密
    plaintext = cipher.decrypt(encrypted.encode())
    return plaintext


def decrypt(key: str, iv: str, encrypted: str) -> bytes:
    cipher = Cipher(
        algorithms.AES(key.encode()),
        modes.OFB(iv.encode()),
        backend=default_backend()
    )
    decryptor = cipher.decryptor()
    
    # 执行解密操作
    decrypted = decryptor.update(encrypted.encode()) + decryptor.finalize()
    return decrypted


# 示例用法
if __name__ == "__main__":
    s = Session()
    r = s.get('https://www.xsxmm.com/', headers={
        'User-Agent': 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36',
        'Referer': 'https://www.xsxmm.com/',
    })
    html = r.text
    raw_key = re.search(r'var raw_key=(.*?);', html).group(1)
    raw_iv = re.search(r'var iv=(.*?);', html).group(1)
    encrypted = re.search(r'var encrypted="(.*?)";', html).group(1)
    hex_pairs = re.findall(r'.{1,2}', encrypted)
    encrypted = ''.join([chr(int(x, 16)) for x in hex_pairs])

    raw_key = json.loads(raw_key)
    key = ''.join(chr(key) for key in raw_key)
    raw_iv = json.loads(raw_iv)
    iv = ''.join(chr(key) for key in raw_iv)

    result = decrypt(key, iv, encrypted)
    print(result)

输出只是一堆无法识别的字节，有大佬来看看问题出在哪里？

tooooony

这个帖子为啥又不通过？

漁滒

单从展示出来的代码看，key和iv等这些对不对，或者有没有二次加密先不说。js中使用的模式是AES-CTR，但是python中使用的模式时AES-OFB

tooooony

漁滒 发表于 2025-9-10 17:23
单从展示出来的代码看，key和iv等这些对不对，或者有没有二次加密先不说。js中使用的模式是AES-CTR，但是py ...

感谢回复！主贴里有说js加密代码中AES加密模式每次都会变化，python代码里写了OFB模式只是一个示例，因为从js里无法解析出加密模式