博客字典爆破尝试
起因 碎碎念 这已经是我第二次遇到加密的博客了，有了经验，那就是这玩意是不上传服务器的。 既然是在前端，那怎么确保安全性呢？ 翻阅源代码可知，作者也是挺聪明的。 已经知道放在前端的东西会被各种手段操作，但是如果是用的AES-CBC加密，并且密码完全不放在前端，又当如何？ 只剩下一条路了 爆破，或者用字典，这其实是同一条路。 摆在面前的是类似于压缩包的东西，那就爆破一下，博文应该不会设置太难的密码。。。。吧？ 把代码丢给ai喂一下，让ai把python版本的代码吐出来，顺便加一下多线程什么的。 就变成了下面这样： 点击查看代码 import threading from Crypto.Cipher import AES from Crypto.Hash import SHA256 from Crypto.Protocol.KDF import PBKDF2 from Crypto.Util.Padding import unpad def hex_to_array(s): data = [] for i in range(0, len(s), 2): num = int(s[i:i + 2], 16) data.append(num) return bytes(data) def get_hmac_key(key_material, key_salt): return PBKDF2(key_material, key_salt, dkLen=32, count=1024, hmac_hash_module=SHA256) def get_iv(key_material, iv_salt): return PBKDF2(key_material, iv_salt, dkLen=16, count=512, hmac_hash_module=SHA256) def get_key_material(password): return password.encode() known_prefix = "<hbe-prefix></hbe-prefix>" def decrypt(ciphertext, password): key_salt = "hexo-blog-encrypt的作者们都是大帅比!".encode() iv_salt = "hexo-blog-encrypt是地表最强Hexo加密插件!".encode() try: key_material = get_key_material(password) hmac_key = get_hmac_key(key_material, key_salt) iv = get_iv(key_material, iv_salt) ciphertext_bytes = hex_to_array(ciphertext) cipher = AES.new(hmac_key, AES.MODE_CBC, iv) decrypted_data = cipher.decrypt(ciphertext_bytes) unpadded_data = unpad(decrypted_data, AES.block_size) if not unpadded_data.decode().startswith(known_prefix): return None except ValueError as e: return None return unpadded_data.decode() def worker(ciphertext, password_chunk, event): for password in password_chunk: password = password.strip() if event.is_set(): return result = decrypt(ciphertext, password) if result: print(f"Decrypted successfully with password: {password.strip()}") event.set() return def brute_force(ciphertext, passwords, max_threads=5): results = [] threads = [] password_chunks = [[] for _ in range(max_threads)] for index, password in enumerate(passwords): chunk_index = index % max_threads password_chunks[chunk_index].append(password) stop_event = threading.Event() for password_chunk in password_chunks: if password_chunk: t = threading.Thread(target=lambda chunk=password_chunk: worker(ciphertext, chunk, stop_event)) threads.append(t) t.start() for t in threads: t.join() if not stop_event.is_set(): print("No valid password found.") try: with open('enData.txt', 'r') as f: ciphertext = f.read().strip() with open(r"你应该有自己的字典8", 'r', encoding="utf-8") as f: passwords = f.readlines() brute_force(ciphertext, passwords, max_threads=200) except FileNotFoundError as e: print(f"Error: {e}") 爆破 也许你不相信，但是真的有人会用超长的密码去加密一篇博客，有鬼吧。 我没有加进度条，但是200个进程跑那么久跑不出来已经很说明问题了。 ...