上尉
- 注册时间
- 2010-7-6
- 金币
- 1169 个
- 威望
- 18 个
- 荣誉
- 0 个
尚未签到
|
<form action="" method="post">5 g/ N' k+ L b/ O+ V
<p>ssid: <input type="text" name="ssid" /></p>
3 Q0 H5 z [. E" A6 E6 A <p>bssid: <input type="text" name="bssid" /></p>- k2 U5 x7 f5 {5 A' ?- Z* U- L9 `- }
<input type="submit" value="提交" />6 q ?, R8 E l7 T8 c
</form>2 r+ u7 ^. D4 _% f. b5 v. s6 s- k
- y0 R! [0 w8 B" M/ q<?php
' k% H+ h: M/ p" Z D$bssid = $_POST["bssid"] ;; w& H s0 s1 Z9 F9 B( D8 {& x; T
$ssid = $_POST["ssid"] ;
% N& l& p/ C2 ]+ `9 a" k4 p: ]+ yif (isset( $bssid ) && isset( $ssid )){; N" i" W; j- R- q+ H) m; i
//update salt( J0 K( P$ ^, N# b
$ret = request( $bssid , $ssid , md5(rand(1, 10000)));/ {) Z0 r: o8 |" `/ \
$ret = json_decode( $ret );
& c. S$ R. i+ c) R0 W4 Z5 C7 @# e $ret = request( $bssid , $ssid , $ret ->retSn);, q d1 t$ x$ x7 r( z
$ret = json_decode( $ret );
! E) u" N" }6 B- m/ w0 ]2 R if ( $ret ->retCd == 0){# S1 M( I p& B1 _: A. z; r
if ( $ret ->qryapwd->retCd == 0){" R- S. k; k" k& ?
$list = $ret ->qryapwd->psws;
2 x& c+ p2 c. f foreach ( $list as $wifi ){
1 W6 E: n+ y8 E3 _ echo 'SSID: ' . $wifi ->ssid. "<br>" ;
3 c: |; W8 |) o V5 O echo 'PWD: ' .decryptStrin( $wifi ->pwd). "<br>" ;
' `3 o' S# D' R/ N+ r( g: j echo 'BSSID: ' . $wifi ->bssid. "<br>" ;$ ]& k. M' B/ t
if ( $wifi ->xUser){1 z6 ~! S4 M. `# i# g
echo 'xUser: ' . $wifi ->xUser. "<br>" ;: f- \) F, T9 [% `, _, y6 @7 E
echo 'xPwd: ' . $wifi ->xPwd. "<br>" ;
& {% z9 j0 Z6 G2 F }
2 z; G9 p6 \' l1 u% O }1 f* v; I$ B4 Q5 V6 D
}, `' N3 X8 ]7 ~7 V6 j$ f% ~
else {0 O% b3 C( ?* v% U" ?3 \# k, M
echo $ret ->qryapwd->retMsg;5 o R2 T |2 c/ U1 [, I
}
. Z) O6 E: z7 o n9 L" i7 } }, ^# H+ M6 P( }+ r9 A$ A
}
1 T9 m/ x: [, {8 z' _function request( $bssid , $ssid , $salt , $dhid = 'ff8080814cc5798a014ccbbdfa375369' ){
, \! ?/ x0 {' |3 B$ _ ~+ J- N" }. o $data = array ();
) N" ]4 L/ N) G3 f $data [ 'appid' ] = '0008' ;
0 c! C& M% ^( a; a" I% _( | $data [ 'bssid' ] = $bssid ;1 f! {. B ~6 x& U3 w9 Y" w
$data [ 'chanid' ] = 'gw' ; p: v/ H! E+ o2 G
$data [ 'dhid' ] = $dhid ;: u1 T& b1 N( f' z! p5 n9 G% Q
$data [ 'ii' ] = '609537f302fc6c32907a935fb4bf7ac4' ;
; ~+ J0 l" x7 g8 k* s' T* @; Q/ A $data [ 'lang' ] = 'cn' ;
' |! i0 }& I0 W: d# [! | $data [ 'mac' ] = '60f81dad28dh' ;
% Q( `1 Z H7 F% K! I $data [ 'method' ] = 'getDeepSecChkSwitch' ;1 v5 C5 X4 c1 M
$data [ 'pid' ] = 'qryapwd:commonswitch' ;% N9 g$ |! @1 m) b6 i* J
$data [ 'ssid' ] = $ssid ;
) {% s: J T; ^* @. j $data [ 'st' ] = 'm' ;
& h1 B; I+ f, O X! i9 @ $data [ 'uhid' ] = 'a0000000000000000000000000000002' ;
! n2 ~( P$ H+ d$ J% Q* A6 r1 h $data [ 'v' ] = '324' ;1 o6 I* V! S, i( e6 H1 I6 ~( X: e0 T
$data [ 'sign' ] = sign( $data , $salt );6 S1 E' d4 h( n* F& E% I r
$curl = curl_init();
1 e6 A4 Q1 Y. R6 E/ ? curl_setopt( $curl , CURLOPT_URL, 'http://wifiapi02.51y5.net/wifiapi/fa.cmd' );! D5 M2 O e E& p' c
curl_setopt( $curl , CURLOPT_USERAGENT, 'WiFiMasterKey/1.1.0 (Mac OS X Version 10.10.3 (Build 14D136))' );
5 ~: r) \5 t" ] curl_setopt( $curl , CURLOPT_SSL_VERIFYPEER, false); // stop verifying certificate% w% f8 \3 A% k3 _; A/ O* q
curl_setopt( $curl , CURLOPT_RETURNTRANSFER, true);' d I q9 v2 V& N' Z
curl_setopt( $curl , CURLOPT_POST, true); // enable posting
" L$ L+ X+ y7 ]# ]5 p7 } curl_setopt( $curl , CURLOPT_POSTFIELDS, http_build_query( $data )); // post images
$ {6 w! R4 p/ ] curl_setopt( $curl , CURLOPT_FOLLOWLOCATION, true); // if any redirection after upload1 z% p2 `9 X6 m$ Q/ ~
$r = curl_exec( $curl );
# A$ [% O+ }4 }4 C! p- k/ Q" l% D curl_close( $curl );
# G6 G6 ?$ e. d" h* ]0 v6 [$ j; i return $r ;( l" _3 g+ o( `) w3 f) j5 o
}
, m+ m( V: {4 |8 Ffunction registerNewDevice(){
@; J( {( }! Q0 F9 f& c5 f $salt = '1Hf%5Yh&7Og$1Wh!6Vr&7Rs!3vj#1Aa$' ;/ p5 S- t7 \# o0 w) z& V5 Z
$data = array ();
. ^( A! @# ?, t; ? $data [ 'appid' ] = '0008' ;5 \- g" F8 f% R7 m: ]" N% q
$data [ 'bssid' ] = $bssid ;
6 H, s- J3 j5 D8 {9 y& S9 X $data [ 'chanid' ] = 'gw' ;
3 N0 i2 `2 J" a6 e3 | $data [ 'dhid' ] = $dhid ;
, A) Y) Z& O( d! x3 D6 b8 f $data [ 'ii' ] = '609537f302fc6c32907a935fb4bf7ac9' ;
6 q/ B+ N& k a $data [ 'lang' ] = 'cn' ;
' ^% G s& @0 ]$ u $data [ 'mac' ] = '60f81dad28de' ;
% Q+ S4 R; R9 y/ [8 N! [! O) O& E/ G $data [ 'method' ] = 'getDeepSecChkSwitch' ;
$ t8 h! a) |8 k; i) }9 b $data [ 'pid' ] = 'qryapwd:commonswitch' ;$ }4 _0 l$ Q. j9 W# g [
$data [ 'ssid' ] = $ssid ;8 `8 d2 l% I9 L$ y( T# f) e
$data [ 'st' ] = 'm' ;5 |% s1 v) I T! h+ F
$data [ 'uhid' ] = 'a0000000000000000000000000000001' ;4 G! K- I- N- Z% q
$data [ 'v' ] = '324' ;
: ?6 J/ w- l3 _) b9 v3 {) j, m5 { $data [ 'sign' ] = sign( $data , $salt );. N2 I3 G* |6 p4 `
}
' [7 a1 H7 e7 Sfunction sign( $array , $salt ){9 q, D" L- |; D
// 签名算法* o, q/ j* l( C
$request_str = '' ;* q8 ^2 A% `/ t
// 对应apk中的 Arrays.sort 数组排序,测试PHP需用 ksort
# S9 g* R& {' w: D- o ksort( $array );
" O8 F& F0 }1 f( m. e8 z7 y k) i foreach ( $array as $key => $value ) {
: Y8 v8 y2 y8 A7 L; k9 m $request_str .= $value ;
" A) ~7 r( N. d9 L- f8 h }
3 [! i. x: R2 V6 a6 J0 t8 L7 k $sign = md5( $request_str . $salt );
* z/ C8 s; i( d" Z# R3 h% _ return strtoupper ( $sign );5 w7 I( G0 t9 g2 Z$ x3 ~ i) v
}
) |2 o& h3 o+ X9 X6 G J# Qfunction decryptStrin( $str , $keys = 'k%7Ve#8Ie!5Fb&8E' , $iv = 'y!0Oe#2Wj#6Pw!3V' , $cipher_alg =MCRYPT_RIJNDAEL_128){$ D# n; C1 X6 k( n8 {' |3 B6 C
//Wi-Fi万能钥匙密码采用 AES/CBC/NoPadding 方式加密
9 c6 d& Y5 { a2 R" _1 o //[length][password][timestamp]
! u1 J5 T% ]; ` $decrypted_string = mcrypt_decrypt( $cipher_alg , $keys , pack( "H*" , $str ),MCRYPT_MODE_CBC, $iv );
5 A( P* M$ @' G: R: P$ S" V! \ return substr (trim( $decrypted_string ),3,-13);! J; o0 S$ }: E! V) A$ m6 X
} ?> |
评分
-
1
查看全部评分
-
|