授权测试记录-虚拟机

仅供学习使用

本教程仅用于个人学习和技术交流，不构成任何商业推荐或投资建议。教程中涉及的工具、软件或服务仅供参考，作者不对其实际效果、安全性或合法性做任何保证。

请用户根据自身情况审慎判断，并自行承担使用本教程及其中提到的任何工具、软件或服务可能带来的风险（包括但不限于数据丢失、系统损坏、法律纠纷等）。

本教程文字内容由作者[开心ucu]创作，版权归属作者本人。

严禁转载，如果转载造成的任何问题，后果请自行承担

快照是个好东西，建议合理使用，这些镜像等情况都能通过快照形式接着用，无非是有些会掉用ntp或定时同步系统时间
实现了授权到期的情况，虚拟机运行时将同步系统时间关闭，不联网（无法连接到ntp服务器）等操作，可实现一直用

---

20250727 增加深信服AC，安恒漏扫 内容

网御星云

漏扫

系统为ova格式，使用Vmware安装，会发现，将此虚拟机换到另一台电脑运行时，授权码会出现变化。

使用Vmware的cpuID模拟，模拟cpuID和cpu型号可以跳过校验,实现“通用”

如果觉得麻烦，直接使用快照即可，关闭Vmware设置的时间同步功能等，做完的时候使用快照，需要用到的时候恢复快照，或挂起。

查看cpuID和型号

下载一个ubuntu的镜像文件（Desktop），用Try模式，在安装界面这里不安装，打开终端，使用如下命令查看cpu型号(lscpu也能看)

cat /proc/cpuinfo

返回如下数据

# cat /proc/cpuinfo 
processor       : 0
vendor_id       : GenuineIntel
cpu family      : 6
model           : 79
model name      : Intel(R) Xeon(R) CPU E5-2660 v4 @ 2.00GHz
stepping        : 1
microcode       : 0xb00003a
cpu MHz         : 1995.500
cache size      : 35840 KB
physical id     : 0
siblings        : 28
core id         : 3
cpu cores       : 14
apicid          : 6
initial apicid  : 6
fpu             : yes
fpu_exception   : yes
cpuid level     : 20
wp              : yes
flags           : fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm pbe syscall nx pdpe1gb rdtscp lm constant_tsc arch_perfmon pebs bts rep_good nopl xtopology nonstop_tsc cpuid aperfmperf pni pclmulqdq dtes64 ds_cpl vmx smx est tm2 ssse3 sdbg fma cx16 xtpr pdcm pcid dca sse4_1 sse4_2 x2apic movbe popcnt tsc_deadline_timer aes xsave avx f16c rdrand lahf_lm abm 3dnowprefetch cpuid_fault epb cat_l3 cdp_l3 pti intel_ppin ssbd ibrs ibpb stibp tpr_shadow flexpriority ept vpid ept_ad fsgsbase tsc_adjust bmi1 hle avx2 smep bmi2 erms invpcid rtm cqm rdt_a rdseed adx smap intel_pt xsaveopt cqm_llc cqm_occup_llc cqm_mbm_total cqm_mbm_local dtherm arat pln pts vnmi md_clear flush_l1d
vmx flags       : vnmi preemption_timer posted_intr invvpid ept_x_only ept_ad ept_1gb flexpriority apicv tsc_offset vtpr mtf vapic ept vpid unrestricted_guest vapic_reg vid ple shadow_vmcs pml
bugs            : cpu_meltdown spectre_v1 spectre_v2 spec_store_bypass l1tf mds swapgs taa itlb_multihit mmio_stale_data
bogomips        : 3991.00
clflush size    : 64
cache_alignment : 64
address sizes   : 46 bits physical, 48 bits virtual
power management:

其中cpu型号为model name数据：Intel(R) Xeon(R) CPU E5-2660 v4 @ 2.00GHz

查看cpuID如下

dmidecode -t 4 | grep ID | sort -u | awk -F': ' '{print $2}'

丰富点的如下

dmidecode -t 4 

执行结果如下

root@hcss-ecs-6975:~#  dmidecode -t 4 
# dmidecode 3.4
Getting SMBIOS data from sysfs.
SMBIOS 2.8 present.

Handle 0x0400, DMI type 4, 42 bytes
Processor Information
        Socket Designation: CPU 0
        Type: Central Processor
        Family: Other
        Manufacturer: QEMU
        ID: 57 06 05 00 FF FB 8B 0F
        Version: pc-i440fx-2.8
        Voltage: Unknown
        External Clock: Unknown
        Max Speed: 2000 MHz
        Current Speed: 2000 MHz
        Status: Populated, Enabled
        Upgrade: Other
        L1 Cache Handle: Not Provided
        L2 Cache Handle: Not Provided
        L3 Cache Handle: Not Provided
        Serial Number: Not Specified
        Asset Tag: Not Specified
        Part Number: Not Specified
        Core Count: 1
        Core Enabled: 1
        Thread Count: 2
        Characteristics: None

root@hcss-ecs-6975:~# 

其中cpuID为57 06 05 00 FF FB 8B 0F

修改vmware的信息参考这个地址：https://luotianyi.vc/8375.html

进底层

有个挑战码，这个可以直接拨打400拿到进底层

我找到个0day，可以通过这个0day直接进底层，暂不公开

授权时间

经测试，过去后，修改时间为授权时间范围内，可以正常使用

进底层，将ntp相关服务删了，同时更改系统时间为授权时间范围

然后呢，基线等正常，包括xxx都正常的

EDR

安装，使用openEuler进行安装

安装过程中，可以通过ps -aux查看进程得到***的密码
解包后可进行内容分析

当然了，EDR装好后也可以直接登录系统openEuler看的。

能够定位到使用了tomcat，且调用了war包，通过逆向war包，测试，能够拿到xxx的逻辑

其中，java中调用了so文件来解密授权文件，逆向so文件（C#）按照这个逻辑，弄到授权的加密逻辑，可根据逻辑编写加密及解密的方法实现自己开授权

经测试xx后正常，且xx等都能实现。

安恒信息

漏洞扫描

快照

改Vmware模拟cpuid等

和网御星云的楼扫一样，实际上嘛，用不用这个方法无所谓，多的不好描述

部分授权信息

[
  "license": {
    "number": "xxxxxxXXxx",
    "serviceCode": "xxxxxxxxxxxxxxxxxxxx",
    "licenseStartDate": "xxxx-xx-xx 00:00:00",
    "licenseMainDate": "xxxx-xx-xx 00:00:00",
    "licenseSubject": "xxxx",
    "licenseVersion": "正式版",
    "licenseEndDate": "xxxx-xx-xx 00:00:00"
  },
  "modules": [
    {
      "name": "task_concurrent_num",
      "text": "任务授权信息",
      "label": "任务并发数",
      "value": 15,
      "option": 15
    },
    {
      "name": "webscan",
      "text": "网站扫描",
      "label": "授权数",
      "id": 0,
      "value": "无限制"
    },
    {
      "name": "dbscan",
      "text": "数据库扫描",
      "label": "授权数",
      "id": 1,
      "value": "无限制"
    },
    {
      "name": "hostscan",
      "text": "主机扫描",
      "label": "授权数",
      "id": 8,
      "value": "无限制"
    },
    {
      "name": "baseline",
      "text": "基线扫描",
      "label": "授权数",
      "id": 5,
      "value": "无限制"
    }
  ]
]

部分代码

部分授权信息

public abstract class XXXX {
   public static final String SYS_START_TIME = "SYS_START_TIME";
   public static final String SYS_END_TIME = "SYS_END_TIME";
   public static final String SYS_MAIN_TIME = "SYS_MAIN_TIME";
   public static final String SYS_USER = "SYS_USER";
   public static final String SYS_PRODUCT_CODE = "SYS_PRODUCT_CODE";
   public static final String SYS_VERSION = "SYS_VERSION";
   public static final String SYS_MODELS = "SYS_MODELS";
   public static final String MODELS = "MODELS";
   public static final String RUNTIME_ENV_OS = "OS";
   public static final String RUNTIME_ENV_RAM = "RAM";
   public static final String RUNTIME_ENV_HWADDR = "HWADDR";
   public static final int L_OK = 0;
   public static final int L_FILE_ERROR = 32;
   public static final int L_TIME_ERROR = 64;
   public static final int L_RENV_ERROR = 128;
   public static final int L_CODE_ERROR = 256;
   public static final int L_OTHER_ERROR = 512;
   public static final int L_FILE_NOT_EXIST = 33;
   public static final int L_FILE_ERR_FORMAT = 34;
   public static final int L_TIME_AHEAD_START = 65;
   public static final int L_TIME_EXCEED_MAIN = 66;
   public static final int L_TIME_EXCEED_END = 67;
   public static final int L_RENV_RAM = 129;
   public static final int L_RENV_OS = 130;
   public static final int L_RENV_HWADDR = 131;
   protected Map delegate = new LinkedHashMap();
   private _L.StringCryption stringCryption;
   private _L.StringIO stringIO;
   private _L.StringConverter stringConverter;

   protected Map getRuntimeEnv() {
      Map renv = new LinkedHashMap();
      String default_value = "ERROR";
      String ram = default_value;

      try {
         ram = SIGather.getRamMB() + "MB";
      } catch (Throwable var8) {
         var8.printStackTrace();
      }

      renv.put("RAM", ram);
      Map os = new HashMap();
      os.put("os.name", SIGather.getOSName());
      os.put("os.version", SIGather.getOSVersion());
      os.put("os.arch", SIGather.getOSArch());
      renv.put("OS", os);
      String hwaddr = default_value;

      try {
         hwaddr = SIGather.getMAC();
      } catch (Throwable var7) {
         var7.printStackTrace();
      }

      renv.put("HWADDR", hwaddr);
      return renv;
   }

   protected void log(String msg, Exception e) {
      if (msg != null && !msg.isEmpty()) {
         System.err.println(msg);
      }

      if (e != null) {
         e.printStackTrace(System.err);
      }

   }

   public _L.StringIO getStringIO() {
      return (_L.StringIO)(this.stringIO == null ? new _L.DefaultStringIO() : this.stringIO);
   }

   public void setStringIO(_L.StringIO stringIO) {
      this.stringIO = stringIO;
   }

   _L.StringConverter getStringConverter() {
      return this.stringConverter;
   }

   public void setStringConverter(_L.StringConverter stringConverter) {
      this.stringConverter = stringConverter;
   }

   public _L.StringCryption getStringCryption() {
      return (_L.StringCryption)(this.stringCryption == null ? new _L.DefaultStringCryption() : this.stringCryption);
   }

   public void setStringCryption(_L.StringCryption stringCryption) {
      this.stringCryption = stringCryption;
   }

   private class DefaultStringIO implements _L.StringIO {
      private DefaultStringIO() {
      }

      public String read(InputStream inputStream) {
         ByteArrayOutputStream byteArrayOutputStream = new ByteArrayOutputStream();
         byte[] buffer = new byte[4096];
         boolean var4 = false;

         try {
            int k;
            while((k = inputStream.read(buffer)) > 0) {
               byteArrayOutputStream.write(buffer, 0, k);
            }

            return new String(byteArrayOutputStream.toByteArray());
         } catch (IOException var6) {
            throw new RuntimeException(var6);
         }
      }

      public void wirte(OutputStream outputStream, String content) {
         byte[] bytes = content.getBytes();

         try {
            outputStream.write(bytes);
            outputStream.flush();
         } catch (IOException var5) {
            throw new RuntimeException(var5);
         }
      }

      // $FF: synthetic method
      DefaultStringIO(Object x1) {
         this();
      }
   }

   private class DefaultStringCryption implements _L.StringCryption {
      private String key;

      private DefaultStringCryption() {
         this.key = "XXXXXXXXXXXX";
      }

      public String encrypt(String source) {
         if (source != null && !source.trim().isEmpty()) {
            try {
               byte[] bytes = source.getBytes("utf-8");
               byte[] bytes1 = this.encryByRC4(bytes, this.key);
               return this.Bytes2HexString(bytes1);
            } catch (UnsupportedEncodingException var4) {
               throw new RuntimeException(var4);
            }
         } else {
            return source;
         }
      }

      public String decrypt(String source) {
         if (source != null && !source.trim().isEmpty()) {
            try {
               byte[] bytes = this.HexString2Bytes(source);
               byte[] bytes1 = this.decryByRC4(bytes, this.key);
               return new String(bytes1, "utf-8");
            } catch (UnsupportedEncodingException var4) {
               throw new RuntimeException(var4);
            }
         } else {
            return source;
         }
      }

      private byte[] decryByRC4(byte[] data, String key) {
         return data != null && key != null ? this.RC4Base(data, key) : null;
      }

      private byte[] encryByRC4(byte[] data, String key) {
         return data != null && key != null ? this.RC4Base(data, key) : null;
      }

      private String asString(byte[] buf) {
         StringBuffer strbuf = new StringBuffer(buf.length);

         for(int i = 0; i < buf.length; ++i) {
            strbuf.append((char)buf[i]);
         }

         return strbuf.toString();
      }

      private byte[] initKey(String aKey) {
         byte[] b_key = aKey.getBytes();
         byte[] state = new byte[256];

         int index1;
         for(index1 = 0; index1 < 256; ++index1) {
            state[index1] = (byte)index1;
         }

         index1 = 0;
         int index2 = 0;
         if (b_key != null && b_key.length != 0) {
            for(int i = 0; i < 256; ++i) {
               index2 = (b_key[index1] & 255) + (state[i] & 255) + index2 & 255;
               byte tmp = state[i];
               state[i] = state[index2];
               state[index2] = tmp;
               index1 = (index1 + 1) % b_key.length;
            }

            return state;
         } else {
            return null;
         }
      }

      private String Bytes2HexString(byte[] data) {
         String s = this.asString(data);
         int sLen = (int)Math.ceil((double)s.length() / 2.0D);
         StringBuffer str = new StringBuffer();
         StringBuffer str1 = new StringBuffer();

         for(int i = 0; i < sLen; ++i) {
            int ch = s.charAt(i);
            String s4 = Integer.toHexString(ch & 255);
            if (s4.length() == 1) {
               str.append('0');
            }

            str.append(s4);
            if (sLen + i < s.length()) {
               int ch1 = s.charAt(sLen + i);
               String s44 = Integer.toHexString(ch1 & 255);
               if (s44.length() == 1) {
                  str1.append('0');
               }

               str1.append(s44);
            }
         }

         return str.append(str1).toString();
      }

      private byte[] HexString2Bytes(String src) {
         int size = src.length();
         byte[] ret = new byte[size / 2];
         byte[] tmp = src.getBytes();

         for(int i = 0; i < size / 2; ++i) {
            ret[i] = this.uniteBytes(tmp[i * 2], tmp[i * 2 + 1]);
         }

         return ret;
      }

      private byte uniteBytes(byte src0, byte src1) {
         char _b0 = (char)Byte.decode("0x" + new String(new byte[]{src0}));
         _b0 = (char)(_b0 << 4);
         char _b1 = (char)Byte.decode("0x" + new String(new byte[]{src1}));
         byte ret = (byte)(_b0 ^ _b1);
         return ret;
      }

      private byte[] RC4Base(byte[] input, String mKkey) {
         int x = 0;
         int y = 0;
         byte[] key = this.initKey(mKkey);
         byte[] result = new byte[input.length];

         for(int i = 0; i < input.length; ++i) {
            x = x + 1 & 255;
            y = (key[x] & 255) + y & 255;
            byte tmp = key[x];
            key[x] = key[y];
            key[y] = tmp;
            int xorIndex = (key[x] & 255) + (key[y] & 255) & 255;
            result[i] = (byte)(input[i] ^ key[xorIndex]);
         }

         return result;
      }

      // $FF: synthetic method
      DefaultStringCryption(Object x1) {
         this();
      }
   }

   public interface StringConverter {
      String toString(Object var1);

      Object fromString(String var1, Class var2);
   }

   public interface StringIO {
      String read(InputStream var1);

      void wirte(OutputStream var1, String var2);
   }

   public interface StringCryption {
      String encrypt(String var1);

      String decrypt(String var1);
   }
}

部分网络请求

@RestController
@RequestMapping({"/"})
@Guarded
public class AuthAction {
   private static final Logger log = LogManager.getLogger(AuthAction.class);
   private static final LoadingCache verificationCodeMap;
   @Autowired
   private IUser userService;
   @Autowired
   private ILog logService;
   @Autowired
   public RedisTemplate redisTemplate;
   @Autowired
   public IUpgrade upgradeService;
   @Autowired
   public IRole roleService;
   public static final String IPADDR_LOCK = "ipaddrLock";
   public static final String USER_ATTRIBUTE_KEY = "user";

   @RequestMapping(
      value = {"settings"},
      method = {RequestMethod.GET}
   )
   public Object setting(HttpServletRequest request) throws Exception {
      return ProductUtil.isSecret() ? this.setting_secret(request) : this.setting_default();
   }

   private Object setting_default() throws Exception {
      JsonObj obj = new JsonObj(true);
      Map settings = new HashMap();
      Object licInfo = new HashMap();

      try {
         licInfo = (Map)LicenseUIData.readInfo().get("license");
      } catch (Exception var8) {
         log.error("read license error", var8);
      }

      StringBuilder version = new StringBuilder();
      version.append(CurrentLocale.getMessage("auth.get.normal.msg1-1", MapUtils.getString((Map)licInfo, "licenseSubject", "-")));
      StringBuilder version2 = new StringBuilder();
      if (ProductUtil.isSecret()) {
         String licenseVersion = org.apache.commons.collections4.MapUtils.getString(Constant.CONF, "license_version");
         if (!Strings.isNullOrEmpty(licenseVersion)) {
            version2.append(licenseVersion);
         } else {
            version2.append(MapUtils.getString((Map)licInfo, "licenseVersion", "正式版"));
         }
      } else {
         version.append(MapUtils.getString((Map)licInfo, "licenseVersion", "正式版"));
         version.append(" v");
      }

      Map others = new HashMap();
      settings.put("logo", "/logo/logo-cra.png");
      version.append(UpgradeHelper.currentVersion());
      others.put("title", "");
      settings.put("version", version.toString());
      settings.put("copyright", Constant.CONF.getProperty("product_copyright"));
      settings.put("supportUrl", Constant.CONF.getProperty("company_website"));
      settings.put("contact", Constant.CONF.getProperty("produc_contact"));
      settings.put("encrypt", "true");
      settings.put("login", true);
      String productName;
      if (ProductUtil.isSecret()) {
         productName = SysConfig.INFO.get("product_name", CurrentLocale.getMessage("product_name_secret"));
         if (Strings.isNullOrEmpty(productName)) {
            productName = CurrentLocale.getMessage(Constant.CONF.getProperty("product_name_scan"));
            settings.put("property", true);
            settings.put("series", CurrentLocale.getMessage("product_series"));
            settings.put("support", CurrentLocale.getMessage("product_company"));
            settings.put("holder", CurrentLocale.getMessage("product_series"));
         } else {
            settings.put("property", false);
            settings.put("series", "");
            settings.put("support", CurrentLocale.getMessage("product_company"));
            settings.put("holder", "");
         }

         settings.put("title", productName + " " + version2.toString());
      } else {
         productName = SysConfig.INFO.get("product_name", "");
         if (Strings.isNullOrEmpty(productName) && !ProductUtil.isSecret()) {
            productName = CurrentLocale.getMessage(Constant.CONF.getProperty("product_name_scan"));
            settings.put("property", false);
            settings.put("series", "");
            settings.put("support", CurrentLocale.getMessage("product_company"));
            settings.put("holder", "");
         } else {
            settings.put("property", false);
            settings.put("series", "");
            settings.put("support", SysConfig.INFO.get("product_company", CurrentLocale.getMessage("product_company")));
            settings.put("holder", "");
         }

         settings.put("title", productName);
      }

      others.put("type", "form");
      others.put("link", false);
      others.put("slogan", "");
      others.put("forgot_pass", false);
      others.put("signup", false);
      Map auth = new HashMap();
      auth.put("admin", others);
      settings.put("auth", auth);
      settings.put("product_type", SysConfig.INFO.getAsInt("system_type", 1));
      settings.put("lang", CurrentLocale.getLocale().toLanguageTag());
      obj.put("setting", settings);
      return obj;
   }

   private Object setting_secret(HttpServletRequest request) {
      JsonObj obj = new JsonObj(true);
      Map settings = new HashMap();
      Object licInfo = new HashMap();

      try {
         licInfo = (Map)LicenseUIData.readInfo().get("license");
      } catch (Exception var11) {
         log.error("read license error", var11);
      }

      StringBuilder version = new StringBuilder();
      version.append(CurrentLocale.getMessage("auth.get.normal.msg1-1", MapUtils.getString((Map)licInfo, "licenseSubject", "-")));
      StringBuilder version2 = new StringBuilder();
      String licenseVersion = org.apache.commons.collections4.MapUtils.getString(Constant.CONF, "license_version");
      if (!Strings.isNullOrEmpty(licenseVersion)) {
         version2.append(licenseVersion);
      } else {
         version2.append(MapUtils.getString((Map)licInfo, "licenseVersion", "正式版"));
      }

      version2.append(" V");
      Map others = new HashMap();
      settings.put("logo", "/logo/logo-cra.png");
      version2.append(Constant.CONF.getProperty("product_version"));
      others.put("title", CurrentLocale.getMessage("auth.get.normal.msg1-2"));
      settings.put("version", version.toString());
      settings.put("copyright", Constant.CONF.getProperty("product_copyright"));
      settings.put("supportUrl", Constant.CONF.getProperty("company_website"));
      settings.put("contact", Constant.CONF.getProperty("produc_contact"));
      settings.put("encrypt", "true");
      settings.put("login", true);
      String productName = SysConfig.INFO.get("product_name", CurrentLocale.getMessage("product_name_secret"));
      if (Strings.isNullOrEmpty(productName)) {
         productName = CurrentLocale.getMessage("product_name_secret");
         settings.put("property", true);
         settings.put("series", CurrentLocale.getMessage("product_series"));
         settings.put("support", CurrentLocale.getMessage("product_company"));
         settings.put("holder", CurrentLocale.getMessage("product_series"));
      } else {
         settings.put("property", false);
         settings.put("series", "");
         settings.put("support", SysConfig.INFO.get("product_company", ""));
         settings.put("holder", "");
      }

      settings.put("title", productName + " " + version2.toString());
      others.put("type", "form");
      others.put("link", false);
      others.put("slogan", "");
      others.put("forgot_pass", false);
      others.put("signup", false);
      Map auth = new HashMap();
      auth.put("admin", others);
      settings.put("auth", auth);
      settings.put("product_type", SysConfig.INFO.getAsInt("system_type", 1));
      settings.put("lang", CurrentLocale.getLocale().toLanguageTag());
      obj.put("setting", settings);
      return obj;
   }

   @IgnoreTokenRestful
   @RequestMapping(
      value = {"config"},
      method = {RequestMethod.GET}
   )
   public Object config() {
      Map configMap = new HashMap();
      JsonObj obj = new JsonObj(true);
      obj.appendData(configMap);
      configMap.put("monitor", true);
      configMap.put("http401", true);
      configMap.put("http502", true);
      configMap.put("monitor_time", 1000);
      if (this.isCasLoginModel()) {
         configMap.put("monitor", true);
         configMap.put("http401", false);
         configMap.put("http502", false);
         configMap.put("monitor_time", 10000);
      }

      return obj;
   }

   private boolean isCasLoginModel() {
      return CasModelManager.isCasModel();
   }

   @BaseLineAssetAdapterAdvisor.BaseLineLimit
   @RequestMapping(
      value = {"profile"},
      method = {RequestMethod.GET}
   )
   public Object profile(HttpServletRequest request) throws Exception {
      Integer userId = (Integer)IdentitySupplier.userIdFromRequest.supplyWith(request);
      User u = (User)this.userService.queryById(userId);
      Validate.notNull(u, "user.login.error.notExist");
      JsonObj obj = new JsonObj(true);
      obj.put("name", u.getUsername());
      obj.put("role", this.userService.queryRole(userId).getName());
      obj.put("avatar", "");
      return obj;
   }

   @PostConstruct
   void init() {
      UserSessionManagerFactory.getInstance().registerSessionCallback((sid, e) -> {
         switch(e) {
         case expiration:
            try {
               Integer uid = (Integer)IdentitySupplier.userIdFromSessionId.supplyWith(sid);
               UserService bean = (UserService)SpringContext.getBean(UserService.class);
               User u = (User)bean.queryById(uid);
               LogAdder.add(u.getUsername(), u.getId(), (String)null, "access.log.system.event.65", "access.log.system.desct.65", true, 3);
            } catch (Exception var5) {
            }
         default:
         }
      });
   }

   @IgnoreTokenRestful
   @RequestMapping(
      value = {"auth/tokens"},
      method = {RequestMethod.POST}
   )
   public Object postTokens(HttpServletRequest req, @RequestHeader String times, @RequestHeader String hash, String username, String password, String captcha, Integer type, String dynamic) throws Exception {
      Integer product_type = SysConfig.INFO.getAsInt("system_type", 1);
      SYSTEMTYPE systemtype;
      if (type == null) {
         systemtype = SYSTEMTYPE.valueOf(product_type);
         switch(systemtype) {
         case DEFAULT:
         case SECRET:
            type = LOGIN.TRADITION.getValue();
            break;
         case FACTOR:
            type = LOGIN.TWOFACTOR.getValue();
         }
      }

      systemtype = null;
      LOGIN login = LOGIN.fromByValue(type);
      Object o;
      switch(login) {
      case TRADITION:
         o = this.loginByTradition(req, times, hash, username, password, captcha);
         break;
      case TWOFACTOR:
         o = this.loginByTwoFactor(req, username, password, dynamic, times, hash);
         break;
      default:
         throw new AppException("user.login.error.unknownLogin", "user.login.error.unknownLogin");
      }

      req.getSession().invalidate();
      if (ArrayUtils.isNotEmpty(req.getCookies())) {
         Cookie cookie = req.getCookies()[0];
         cookie.setMaxAge(0);
      }

      return o;
   }

   private Object loginByTradition(HttpServletRequest req, String times, String hash, String username, String password, String captcha) throws Exception {
      String logEvent = "access.log.system.55.event";

      try {
         boolean code = SysConfig.DEFAULT.getAsInt(SysSetAction.SetItem.verification_code.name(), 1) == 1;
         if (!code || !((String)verificationCodeMap.get(hash)).equals("") && captcha.toLowerCase().equals(((String)verificationCodeMap.get(hash)).toLowerCase())) {
            return this.logining(req, username, password, times, hash, logEvent, "access.log.system.55.desct");
         } else {
            verificationCodeMap.invalidate(hash);
            throw new AppException("user.login.warn.codeError");
         }
      } catch (Exception var14) {
         String msg = "access.log.system.56.desct";
         if (var14 instanceof AppException) {
            msg = var14.getMessage();
            StringBuffer sb = new StringBuffer();
            Object[] params = ((AppException)var14).getParams();
            if (params != null && params.length > 0) {
               msg = msg + "____";

               for(int i = 0; i < params.length; ++i) {
                  Object ob = params[i];
                  sb.append(ob).append(",");
               }

               msg = msg + sb.substring(0, sb.length() - 1);
            }
         }

         if (Strings.isNullOrEmpty(username)) {
            username = "access.log.system.57.event";
         }

         LogAdder.add(username, -1, req.getRemoteHost(), logEvent, msg, false, 3);
         throw var14;
      }
   }

   private Object logining(HttpServletRequest req, String username, String password, String times, String hash, String logEvent, String logDesct) throws Exception {
      new JsonObj(true);
      JsonObj token = new JsonObj(true);

      JsonObj user;
      try {
         user = this.login(req, username, password, "", times);
      } catch (Exception var17) {
         verificationCodeMap.invalidate(hash);
         if (var17 instanceof AppException) {
            throw var17;
         }

         throw new AppException(var17.getMessage());
      }

      Integer userId = (Integer)user.get("userId");
      User user1 = (User)this.userService.queryById(userId);
      if (user1 == null) {
         throw new AppException("system.common.error.illegalLogin", "system.common.error.illegalLogin");
      } else {
         Integer roleId = user1.getRoleId();
         String sid = (String)IdentitySupplier.userIdToSessionId.supplyWith(userId);
         token.put("token", sid);
         verificationCodeMap.invalidate(hash);
         if (SysConfig.DEFAULT.getAsLong("last_modify_pwd_" + userId, 0L) == 0L) {
            SysConfig.DEFAULT.set("last_modify_pwd_" + userId, System.currentTimeMillis());
         }

         req.setAttribute("userId", userId);
         LogAdder.add(user1.getUsername(), userId, req.getRemoteHost(), logEvent, logDesct, true, 3);
         int timeout = SysConfig.DEFAULT.getAsInt(SysSetAction.SetItem.timeout_exit.name(), 30);
         String k_currLoginClient = "currLoginClient";
         UserSessionManager instance = UserSessionManagerFactory.getInstance();
         ((Set)IdentitySupplier.sameUserSessionIdsByUid.supplyWith(userId)).forEach((otherSid) -> {
            log.debug("invalid other sid '{}' with same uid '{}'", otherSid, userId);
            instance.invalidateSession(otherSid);
         });
         instance.initailizeSession(() -> {
            return sid;
         }, (long)timeout, TimeUnit.MINUTES);
         instance.putIntoSession(sid, "user", user1);
         instance.putIntoSession(sid, k_currLoginClient, req.getRemoteHost());
         return token;
      }
   }

   private Object loginByTwoFactor(HttpServletRequest request, String username, String password, String dynamic, String times, String hash) throws Exception {
      String logEvent = "access.log.system.55.event";

      try {
         if (!this.checkCode(dynamic, times, username)) {
            throw new AppException("user.login.error.failiedCode", "user.login.error.failiedCode");
         } else {
            return this.logining(request, username, password, times, hash, logEvent, "access.log.system.55.desct2");
         }
      } catch (Exception var10) {
         String msg = var10 instanceof AppException ? var10.getMessage() : "access.log.system.56.desct";
         if (Strings.isNullOrEmpty(username)) {
            username = "access.log.system.57.event";
         }

         LogAdder.add(username, -1, request.getRemoteHost(), logEvent, msg, false, 3);
         throw var10;
      }
   }

   private boolean checkCode(String code, String times, String username) {
      boolean flag = false;
      Validate.notEmpty(code, "user.login.error.codeEmpty");
      User user = new User();
      user.setUsername(username);
      user = (User)this.userService.queryOne(user);
      Validate.notNull(user, "user.login.error.notExist");
      File seed = null;
      Role role = (Role)this.roleService.queryById(user.getRoleId());
      if (role.getName().contains(CurrentLocale.getMessage("role.admin"))) {
         seed = new File(Constant.FEITIANCHENGXIN_DIR, "seed.txt");
      } else if (role.getName().contains(CurrentLocale.getMessage("role.operator"))) {
         seed = new File(Constant.FEITIANCHENGXIN_DIR, "seed_oper.txt");
      } else if (role.getName().contains(CurrentLocale.getMessage("role.auditor"))) {
         seed = new File(Constant.FEITIANCHENGXIN_DIR, "seed_auditor.txt");
      }

      if (seed != null && seed.exists()) {
         try {
            code = UserHelper.getInputPassword(username, code, times);
            FeitianchengxinCode.load();
            int validate = FeitianchengxinCode.validate(seed.getAbsolutePath(), code);
            if (validate == 0) {
               flag = true;
            }

            return flag;
         } catch (Exception var9) {
            log.error(var9.getMessage());
            throw new AppException("动态口令验证错误", "user.login.error.verifyError");
         }
      } else {
         throw new AppException("miss seed file !");
      }
   }

   @RequestMapping(
      value = {"auth/tokens"},
      method = {RequestMethod.GET}
   )
   public Object getTokens(HttpServletRequest req) throws Exception {
      UserSessionManagerFactory.getInstance().touchSession(IdentitySupplier.sessionIdFromRequest.supplyWith(req));
      return new JsonObj(true);
   }

   @RequestMapping(
      value = {"auth/tokens"},
      method = {RequestMethod.DELETE}
   )
   public Object deleteTokens(HttpServletRequest req) throws Exception {
      synchronized(this) {
         UserSessionManager instance = UserSessionManagerFactory.getInstance();
         String sid = (String)IdentitySupplier.sessionIdFromRequest.supplyWith(req);
         log.warn("request delete sid:{}", sid);
         if (instance.touchSession(sid)) {
            User u = (User)JSON.parse(instance.getFromSession(sid, "user"), User.class);
            if (u != null) {
               LogAdder.add(u.getUsername(), u.getId(), req.getRemoteAddr(), "access.log.system.58.event", "access.log.system.58.desct", true, 3);
            }

            instance.invalidateSession(sid);
         }
      }

      return new JsonObj(true);
   }

   @IgnoreTokenRestful
   @RequestMapping(
      value = {"auth/captcha"},
      method = {RequestMethod.GET}
   )
   public Object verificationCode() throws Exception {
      JsonObj obj = new JsonObj(true);
      boolean code = SysConfig.DEFAULT.getAsInt(SysSetAction.SetItem.verification_code.name(), 1) == 1;
      if (!ProductUtil.isSeed() && code) {
         obj.put("has_captcha", true);
         String uuid = UUID.randomUUID().toString();
         obj.put("hash", uuid);
         Object[] info = VerificationCodeUtils.generate();
         BASE64Encoder encoder = new BASE64Encoder();
         obj.put("base64", encoder.encode((byte[])((byte[])info[1])));
         verificationCodeMap.put(uuid, info[0].toString());
      } else {
         obj.put("has_captcha", false);
      }

      return obj;
   }

   public JsonObj login(HttpServletRequest req, @NotNull(message = "oval.verify.normal.msg4-1") String username, @NotNull(message = "oval.verify.normal.msg4-1") String password, @NotNull(message = "oval.verify.normal.msg4-1") String vcode, @NotNull(message = "oval.verify.normal.msg4-1") String times) throws Exception {
      SysConfig sysConfig = SysConfig.DEFAULT;
      User u = new User(username);
      u = (User)this.userService.queryOne(u);
      if (u == null) {
         throw new AppException("user.login.error.hasError");
      } else {
         int userId = u.getId();
         int lockWay = SysConfig.DEFAULT.getAsInt(SysSetAction.SetItem.login_lock_way.name(), ProductUtil.isSecret() ? 1 : 0);
         Long timeout = SysConfig.DEFAULT.getAsLong(SysSetAction.SetItem.max_time_loginfailed.name(), 5L) * 60L;
         if (u.getDisabled() == 1) {
            throw (new AppException("user.login.error.disableLogin")).setParams(username);
         } else {
            if (lockWay == 1) {
               Long lockTime = u.getLockTime();
               if (lockTime != null) {
                  long leftTime = (System.currentTimeMillis() - lockTime) / 1000L - timeout;
                  if (leftTime <= 0L) {
                     throw (new AppException("user.login.error.lockUser")).setParams(Math.abs(leftTime));
                  }
               }
            }

            if (lockWay == 2) {
               Map map = this.redisTemplate.boundHashOps("ipaddrLock").entries();
               Long lockTime = map == null ? null : (Long)map.get(req.getRemoteAddr());
               if (lockTime != null) {
                  long leftTime = (System.currentTimeMillis() - lockTime) / 1000L - timeout;
                  if (leftTime <= 0L) {
                     throw (new AppException("user.login.error.lockIp")).setParams(Math.abs(leftTime));
                  }

                  this.setRedisIpaddr(new HashMap());
               }
            }

            if (!UserHelper.decryptGeneratePwd(username, password, times).equals(u.getPassword())) {
               if (lockWay != 0) {
                  Object obj = WebContextUtil.getObjInSession(req, "lock_times");
                  int errorTimes = obj == null ? 0 : Integer.parseInt(obj.toString());
                  ++errorTimes;
                  if (errorTimes == sysConfig.getAsInt(SysSetAction.SetItem.max_num_loginfailed.name(), 5)) {
                     String errorTips = "用户名或者密码错误，";
                     String msgCode = "user.login.error.hasError";
                     Long currentTime = System.currentTimeMillis();
                     u.setLockTime(currentTime);
                     if (lockWay == 1) {
                        errorTips = errorTips + "该账户已被锁定！";
                        msgCode = "user.login.error.lockUser2";
                     } else {
                        errorTips = errorTips + "该地址已被锁定！";
                        msgCode = "user.login.error.lockIp2";
                        Map newHash = Maps.newHashMap();
                        newHash.put(req.getRemoteAddr(), currentTime);
                        this.setRedisIpaddr(newHash);
                     }

                     this.userService.updateById(userId, u);
                     req.getSession().setAttribute("lock_times", 0);
                     throw new AppException(msgCode, msgCode);
                  }

                  req.getSession().setAttribute("lock_times", errorTimes);
               }

               throw new LoginException("user.login.error.hasError");
            } else {
               this.updateConfig(u);
               req.getSession().removeAttribute("lock_times");
               u.setLastLoginTime(System.currentTimeMillis());
               u.setLockTime((Long)null);
               u.setLastLoginClient(req.getRemoteAddr());
               this.userService.updateById(userId, u);
               JsonObj obj = new JsonObj(true);

               try {
                  obj.put("userId", userId);
               } catch (Exception var17) {
                  log.error("", var17);
               }

               return obj;
            }
         }
      }
   }

   private void updateConfig(User user) {
      Integer userId = user.getId();
      if (userId == 1 && user.getLastLoginTime() == null) {
         SysConfig.INFO.set("password_modify_AD", 1);
      } else if (userId == 2 && user.getLastLoginTime() == null) {
         SysConfig.INFO.set("password_modify_AU", 1);
      } else if (userId == 3 && user.getLastLoginTime() == null) {
         SysConfig.INFO.set("password_modify_OP", 1);
      }

   }

   public void setRedisIpaddr(Map newHash) {
      Map map = this.redisTemplate.boundHashOps("ipaddrLock").entries();
      Long timeout = SysConfig.DEFAULT.getAsLong(SysSetAction.SetItem.max_time_loginfailed.name(), 5L) * 60L;
      map.forEach((k, v) -> {
         long leftTime = timeout - (System.currentTimeMillis() - v) / 1000L;
         if (leftTime > 0L) {
            newHash.put(k, v);
         }

      });
      if (newHash.size() > 0) {
         this.redisTemplate.boundHashOps("ipaddrLock").putAll(newHash);
      } else {
         this.redisTemplate.delete("ipaddrLock");
      }

   }

   static {
      verificationCodeMap = CacheBuilder.newBuilder().softValues().maximumSize(20L).expireAfterAccess(3L, TimeUnit.MINUTES).build(new CacheLoader() {
         public String load(String str) throws Exception {
            return "";
         }
      });
   }
}

深信服

AF（下一代防火墙）

和上面的方法接近，我用PVE，使用备份形式能够实现多设备同网关，然后再申请一个测试授权。

经测试，同一镜像文件下8095、8075，如果管理网口(第一个网口)的MAC地址一样，则网关ID一样。

授权相关验证程序拿到，但没时间做逆向分析，且存在大量的so库调用。

具体过程不便透露

AC（上网/全网 行为管理系统）

底层密码为当前密码sangfornetwork

---

未完待续