致远A6 V8.0SP1 代码审计
2021-2-3 22:35:37 Author: guage.cool(查看原文) 阅读量:2 收藏

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
public class test {
static String n = "21989813755621156293273501389493103170478328865382851535119108650514578230710085815320625775002099957978047341520630619620968646687641136648474885196527432975032680128867461330713312410713852757543371126481833686429634246895522221843242400928239808073984384986341957082609978353191102506262999820889287314940454068736561332035836375947373095017281035332790078205824154732301582606749476995280424823282151268108966524365305986387988471004945472743386691892679883533938532545175617206571176967648832197838471513091863241277420160655821470900975715819210425380750123100541143689073853835049178798646417287183721931874617";
static String e = "6333852850525055576973677246890478791356324122126922020056508750717361082458981795562925565019983229423861325142819235036468333056481098257675212595249223374119839217428796977888447722310227787420025584854320071085527346058665684754182931814431280910212601055696432913444749704337831179497484590672857723791526397236422992667259948858815644211642076355254409538306069722345612392012915604981881367144586134958548638622059431200740663401535386954787142318402161407062367658834129067730124799206565784982639002519538994476859475051193413032441802655895182311620992722743521812713033355316618340286163976059545102169473";
static String d = "65537";

public static void main(String[] args) throws Exception {

StringBuilder sb = new StringBuilder();
sb.append("AL:3,AM:0,AA:gg,AJ:");
sb.append("00-0C-29-50-21-D5,");
sb.append(
"AD:A6V5,AG:9999,AR:9999,AC:9999,AF:A6V5-1,AE:V8.0,AB:2021-01-01,");
sb.append("AI:2222-02-02,AH:2222-02-02,BA:base64Z2c=,news:1,addressbook:1,");
sb.append("v_culture:1,officeOcx:1,doc:1,v_mbo:1,webmail:1,lbs:1,bulletin:1,Mx:<sl><l><key>Mx1</key><value>0</value></l><l><key>Mx2</key><value>5</value></l><l><key>Mx4</key><value>2222-02-02</value></l></sl>");
makelic(sb.toString());
}

public static void makelic(String lic) throws Exception {

java.security.Key privkey = getPrivateKey(e, n);
StringBuilder sb = new StringBuilder();
java.security.KeyPair kp = generateKeyPair(2048);
String dog = Base64Encode(encode(kp.getPrivate(), lic.getBytes()));
java.security.interfaces.RSAPublicKey puk = (java.security.interfaces.RSAPublicKey) kp.getPublic();

sb.append("dogMsg=");
sb.append(dog);
sb.append("\nmodules=");
sb.append(puk.getModulus().toString());
sb.append("0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000");
sb.append("\nproductLine=A6V5\ndogNo=www.seeyom.com");
System.out.println(Base64Encode(encode(privkey, sb.toString().getBytes())));

}
public static String Base64Encode(byte[] data){
return new sun.misc.BASE64Encoder().encodeBuffer(data).replaceAll("\r\n", "");
}
public static java.security.KeyPair generateKeyPair(int keySize) {
try {
java.security.KeyPairGenerator keyPairGen = java.security.KeyPairGenerator.getInstance("RSA");
keyPairGen.initialize(keySize, new java.security.SecureRandom());
return keyPairGen.genKeyPair();
} catch (java.security.NoSuchAlgorithmException nsae) {
return null;
}
}

public static java.security.Key getPrivateKey(java.lang.String privatekeyStr, java.lang.String moduleStr) {
try {
return (java.security.interfaces.RSAPrivateKey) java.security.KeyFactory.getInstance("RSA")
.generatePrivate(new java.security.spec.RSAPrivateKeySpec(new java.math.BigInteger(moduleStr),
new java.math.BigInteger(privatekeyStr)));
} catch (java.lang.Exception e) {
e.printStackTrace();
return null;
}
}
public static byte[] encode(java.security.Key key, byte[] data) throws Exception {
int blocksize = 245;
java.io.ByteArrayOutputStream out = new java.io.ByteArrayOutputStream(data.length);
try {
javax.crypto.Cipher cipher = javax.crypto.Cipher.getInstance("RSA");
cipher.init(1, key);
int position = 0;
int length = data.length;
boolean more = true;
while (more) {
if (position + blocksize <= length) {
out.write(cipher.doFinal(data, position, blocksize));
position += blocksize;
} else {
more = false;
}
}
if (position < length) {
out.write(cipher.doFinal(data, position, length - position));
}
return out.toByteArray();
} catch (java.lang.Exception e) {
throw e;
}
}

}

文章来源: https://guage.cool/seeyon/
如有侵权请联系:admin#unsafe.sh