今日校园自动提交信息表单抓包分析【支持教务统一验证】

╰半夏微凉° 2022-12-20 02:18 149阅读 0赞

刚开始没什么感觉，突然换了一个导员，某天忘填了还要跑办公室一趟，很是心烦，班长还跑来寝室一个个提醒，于是诞生了这篇文章。

这个应该不是我第一个分析的软件了，原理都很简单，莫过于后台交互，模拟提交即可，首先第一步当然是抓包分析了。笔者是手机IOS系统，其实抓包的分析的方式非常多，我首先打开了Fiddler，但是到填信息的页面，显示未认证的证书，于是我我就是用了burpsuite，成功抓取，分析了一波，发现数据在我们学校的服务器上，顺着域名，找到了今日校园的web后台。这套系统大概就是今日校园给各大高校的提供的后台管理了。

盲猜一波，所有高校都是一套后台系统，也就是今日校园提供的系统，所以下面我的分析对于这套系统是适用的，唯一的区别就是域名不一样。

过程不是很顺利，不连续大概花了我一天的时间吧。

其他高校的兄弟有需要的可以自行测试！  
![fiddler证书认证报错][fiddler]  
随便贴两张照片…  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80MzgzMzY0Mg_size_16_color_FFFFFF_t_70_pic_center]

抓包过程就不分析了吧… 有问题建议参考我之前写的[文章1][1]，[文章2][2]，[文章3][3]  
![burpsuite正常抓包][burpsuite]  
最后直接上代码吧

#!/usr/bin/env python
    # -*- coding: utf-8 -*-
    # author： moddemod
    # datetime： 2020/11/9 0009 下午 3:27 
    # ide： PyCharm
    
    import requests
    import os
    # import ssl
    import json
    import platform
    import time
    # from PIL import Image
    # import threading
    from Crypto.Cipher import AES
    import base64
    
    # ssl._create_default_https_context = ssl._create_unverified_context
    
    requests = requests.session()
    
    headers = { 
        'user-agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.83 Safari/537.36'
    }
    headers_form = { 
        'X-Requested-With': 'XMLHttpRequest',
        'Content-Type': 'application/json;charset=utf-8'
    }
    
    domain_name = 'https://hfut.campusphere.net'
    
    
    def get_stamp():
        return int(round(time.time() * 1000))
    
    
    def jump_auth_with_key():
        """ 获取cookie :return: """
        jump_auth_url = domain_name + '/portal/login'
        requests.get(url=jump_auth_url, headers=headers)
        JSESSIONID_url = 'https://cas.hfut.edu.cn/cas/vercode'
        requests.get(url=JSESSIONID_url, headers=headers)
    
        LOGIN_FLAVORING_url = 'https://cas.hfut.edu.cn/cas/checkInitVercode?_=' + get_stamp().__str__()
        response = requests.get(url=LOGIN_FLAVORING_url, headers=headers)
        return response.cookies.values()[0]
    
    
    def get_school_id():
        url = domain_name + '/iap/tenant/basicInfo'
        headers = { 
            'Content-Type': 'application/json'
        }
        data = { }
        data = json.dumps(data)
        response = requests.post(url=url, headers=headers, data=data)
        print(response.text)
        j_data = json.loads(response.text)
        school_id = j_data['result']['schoolId']
        print(school_id)
    
    
    # get_school_id()
    
    
    # 获取验证码
    # def get_captcha():
    # captcha_url = domain_name + '/iap/generateCaptcha?ltId=' + r.url.split('=')[1]
    # resp_cap = requests.get(url=captcha_url, headers=headers)
    # with open('test.png', 'wb') as f:
    # f.write(resp_cap.content)
    # img = Image.open('test.png')
    # img.show()
    # captcha = input('请输入验证码：')
    # return captcha
    # captcha = get_captcha()
    
    
    def add_to_16(s):
        while len(s) % 16 != 0:
            s += (16 - len(s) % 16) * chr(16 - len(s) % 16)
        return str.encode(s)  # 返回bytes
    
    
    def encrypt(text, key):
        aes = AES.new(str.encode(key), AES.MODE_ECB)
        encrypted_text = str(base64.encodebytes(aes.encrypt(add_to_16(text))), encoding='utf8').replace('\n', '')
        return encrypted_text
    
    
    def check_user_identy(username, password, key):
        password = encrypt(password, key)
        url = 'https://cas.hfut.edu.cn/cas/policy/checkUserIdenty?username=' + username + '&password=' + password + '&_=' + get_stamp().__str__()
        r = requests.get(url=url, headers=headers)
        # print(r.headers)
        # print(r.request.headers)
        # print(r.text)
        return password
    
    
    def get_post_url():
        url = 'https://hfut.campusphere.net/portal/login'
        response = requests.get(url=url, headers=headers)
        return response.url.split('?')[1]
    
    
    def login(username, password):
        url = 'https://cas.hfut.edu.cn/cas/login?' + get_post_url()
        data = { 
            'username': username,
            'captcha': '',
            'execution': 'e2s1',  # 随意
            '_eventId': 'submit',
            'password': password,
            'geolocation': '',
            'submit': '登录'
        }
        # proxy = { 
        # 'http': 'http://192.168.3.14:8888',
        # 'https': 'http://192.168.3.14:8888'
        # }
        headers = { 
            'Content-Type': 'application/x-www-form-urlencoded',
            'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.83 Safari/537.36',
        }
    
        # response = requests.post(url=url, data=data, headers=headers, proxies=proxy, verify=False)
        response = requests.post(url=url, data=data, headers=headers)
        # print(response.text)
        # print(response.status_code)
        # print(response.headers)
        # print(response.url)
        # print(response.headers)
        # print(response.request.headers)
    
        # j_data = json.loads(response.text)
        # try:
        # cookie_url = j_data['url']
        # except:
        # print('登录失败...')
        # return False
        # # print(cookie_url)
        # requests.get(url=cookie_url) # 获取关键cookie
    
        check_login_state_url = domain_name + '/portal/guest/portal/portalSettingInfo'
        response = requests.post(url=check_login_state_url)
        # print(response.text)
        j_data = json.loads(response.text)
        has_login = j_data['datas']['hasLogin']
        if has_login:
            print('登录成功...')
            print_user_info()
            return True
        print('登录失败...')
        return False
    
    
    def print_user_info():
        url = domain_name + '/portal/desktop/userDesktopInfo'
        data = { 
            'type': ''
        }
        response = requests.post(url=url, headers=headers, data=data)
        json_data = json.loads(response.text)
        real_name = json_data['datas']['userName']
        department = json_data['datas']['userDepartment']
        print('你好，来自{}的{}！'.format(department, real_name))
        print()
        time.sleep(1)
    
    
    # 自动提交
    def auto_submit(data):
        url = domain_name + '/wec-counselor-collector-apps/stu/collector/submitForm'
        headers = { 
            'Content-Type': 'application/json',
            'Cpdaily-Extension': '64JITpWPkKut+YRGo4AT3C+00Xlutn2x6CEymZBHGv3BB3a7UiUBqy5MuSGE xoY0Jd6RuqRwQcJBwKWbAhDA/uaE'
                                 'lTmZuMs/A5KZp9E98jAqtepGWgoypbHP hLzl7SV8yRKKgY1Dk+6kTQkzyuHcDN/yLolnJS1Dd+OsikAd+TlYx1q+A'
                                 'cTS qjd2YnfRN1qP8mdxZSOOii8LMK/NrN3FtM6etzP1Q0I7qwzEe1jzHKxpzRxd QYxPD1mmepm2omxwCk5KEwHux'
                                 'g5aM6TcxPSXzJL47xajKG8B' # 这里如果不添加会提示今日校园版本过低
        }
        data = json.dumps(data)
        # print(json.loads(data))
        response = requests.post(url=url, headers=headers, data=data)
        # print(response.text)
        j_data = json.loads(response.text)
        code = j_data['code']
        message = j_data['message']
        os.system('color 1c')
        logout()
        if code == 0:
            print('恭喜，提交成功啦，打开今日校园app看看惊喜吧！！！')
            return True
        print(message)
        print('打开今日校园看看吧！')
        return True
    
    
    # 监控收集, 正在进行的任务
    # 这里直接返回最最新的任务
    def watch_collection():
        url = domain_name + '/wec-counselor-collector-apps/stu/collector/queryCollectorProcessingList'
        data = { 
            'pageNumber': 1,
            'pageSize': 20
        }
        data = json.dumps(data)
        response = requests.post(url=url, headers=headers_form, data=data)
        # print(response.text)
        # 解析数据
    
        j_data = json.loads(response.text)
    
        datas = j_data['datas']
        data_number = datas['totalSize']
        if data_number == 0:
            return False, '', '', '', ''
        rows = datas['rows']
    
        print('你当前有正在进行的表单填写共计' + data_number.__str__() + '个...')
        for i in range(data_number):
            info = rows[i]
            # 解析每个表单数据
            wid = info['wid']
            form_wid = info['formWid']
            subject = info['subject']
            print(subject)
            sender_username = info['senderUserName']
            return True, wid, form_wid, subject, sender_username
    
    
    # 历史填表查询
    def query_history_form(page_number=1, page_size=20):
        url = domain_name + '/wec-counselor-collector-apps/stu/collector/queryCollectorHistoryList'
        """ X-Requested-With: XMLHttpRequest Accept-Language: en-us Accept-Encoding: gzip, deflate Content-Type: application/json;charset=utf-8 """
        data = { 
            'pageNumber': page_number,
            'pageSize': page_size
        }
        data = json.dumps(data)
        response = requests.post(url=url, headers=headers_form, data=data)
        print(response.text)
    
    
    # query_history_form()
    
    # 获取表格所有问题
    def get_form_fields(wid, form_wid):
        url = domain_name + '/wec-counselor-collector-apps/stu/collector/getFormFields'
        data = { 
            'pageNumber': 1,
            'pageSize': 20,
            'formWid': form_wid,
            'collectorWid': wid
        }
        data = json.dumps(data)
        response = requests.post(url=url, headers=headers_form, data=data)
        # print(response.text)
        return response.text
    
    
    def parse_form(text: str, select):
        """ 解析处理表单数据作为post数据 :param text 服务器返回的表单数据 :param select 1 老区 0 新区 :return: """
        form = []
        j_data = json.loads(text)
        datas = j_data['datas']
        question_number = datas['totalSize']  # 问题总数
        question_list = datas['rows']  # 问题列表
        print('共计{}个问题...'.format(question_number))
    
        def handle_question(idx, select, *args):
            """ 问题处理 :param idx: 题号 0, 1, 2 :param select: 选中答案 :param args: 删除答案 :return: """
            question_detail = question_list[idx]
            title = question_detail['title']
            print(title)
            question_detail['fieldItems'][select]['isSelected'] = 1  # 选项
            # 删除其他选项
            for i in args:
                del question_detail['fieldItems'][i]
                # print(question_detail)
            form.append(question_detail)
    
        def handle_area(idx, select):
            """ 所在地区 这里手动填一下就行了, 这里提供包河区和蜀山区的选项 :param idx: 问题序号 :param select: 1 老区 0 新区 :return: """
            area = ''
            if select:
                area = '包河区'
            else:
                area = '蜀山区'
    
            question_detail = question_list[idx]
            title = question_detail['title']
            print(title)
            question_detail['value'] = '安徽省/合肥市/' + area
            question_detail['area1'] = '安徽省'
            question_detail['area2'] = '合肥市'
            question_detail['area3'] = area
            form.append(question_detail)
    
        # 下面的表单处理就是恶心的事了，如果学校发布的表单改变了，需要手动修改，什么时候有时间再回来适配这里吧
    
        for i in range(4):  # 处理前4个问题
            question_detail = question_list[i]
            title = question_detail['title']
            print(title)
            question_detail['fieldItems'][0]['isSelected'] = 1  # 选0 即第一个选项
            del question_detail['fieldItems'][1:]  # 删除后面选项
            # print(question_detail)
            form.append(question_detail)
        # handle_question(4, 1, 0) # 今天是否发热
        handle_area(4, 1)  # 目前所在地区 1 老区 0 新区
        # print(form)
        return form
    
    
    def make_post_data(form_wid, address, wid, form, school_task_wid=116116):
        """ :param form_wid: :param address: 签到的地址，可随意填写 :param wid: :param form: :param school_task_wid: 默认为我学校的 :return: """
        new_answer = { 
            "formWid": form_wid,
            "address": address,
            "collectWid": wid,
            "schoolTaskWid": school_task_wid,
            "form": form,
            "uaIsCpadaily": True
        }
        return new_answer
    
    
    def logout():
        url = domain_name + '/portal/logout'
        requests.get(url=url)
    
    
    def print_ui():
        if platform.system() == 'Windows':
            os.system('chcp 65001 2>nul 1>nul')
            os.system('title 今日校园自动提交工具 by:moddemod blog:moddemod.blog.csdn.net')
            os.system('mode con: cols=80 lines=25 1>nul 2>nul')
            os.system('color 7a')
    
    
    # def main():
    # print_ui()
    # area = input('老区扣666，新区摸摸头（直接回车即可:\n')
    # select = 0
    # if area == '666':
    # select = 1
    # username = input('请输入账号：\n')
    # password = input('请输入密码：\n')
    # address = input('请输入你当前位置，月亮火星都可以，随意....(被导员传呼不关我事嘿嘿... 正规模板：安徽省/合肥市/包河区/亲民路\n') # 安徽省/合肥市/包河区/亲民路
    # if username == '' or password == '':
    # print('用户和密码不能为空...')
    # os.system('pause')
    # main()
    # return
    #
    # ok = login(lt, username, password)
    # if not ok:
    # os.system('pause')
    # return
    # state, wid, form_id, _, _ = watch_collection()
    # if not state:
    # print('当前没有需要提交的任务哦....')
    # os.system('pause')
    # return
    # qa = get_form_fields(wid, form_id)
    # form = parse_form(qa, select)
    # answer_data = make_post_data(form_id, address, wid, form)
    # # print(answer_data)
    # auto_submit(answer_data)
    # os.system('pause')
    
    
    def batch_operation():
        print_ui()
        file_name = 'user.txt'
    
        def post(username, password, address, specious):
            key = jump_auth_with_key()
            password = check_user_identy(username, password, key)
            ok = login(username, password)
            if not ok:
                os.system('pause')
                return
            state, wid, form_id, _, _ = watch_collection()
            if not state:
                print('当前没有需要提交的任务哦....')
                os.system('pause')
                return
            qa = get_form_fields(wid, form_id)
            select = 0
            if specious == '老区':
                select = 1
            form = parse_form(qa, select)
            answer_data = make_post_data(form_id, address, wid, form)
            # print(answer_data)
            return auto_submit(answer_data)
    
        if not os.path.exists(file_name):
            fp = open(file_name, 'w')
            fp.write('201xxxxx 123xxxxx 安徽省/合肥市/包河区/亲民路 老区 [模板示例，请删除该行]')
            fp.close()
            print('第一次使用，请在user.txt文件中按照格式添加信息哦！')
            print()
            print('地址是你在今日校园上的定位信息，所以这里你可以任意填写，火星月亮都可，（建议最好填个地址）')
            print('新区就写新区，老区就写老区')
            print('中间记得用一个空格隔开。。。')
            print('下面给一个模板.....')
            print('201xxxxx 123xxxxx 安徽省/合肥市/包河区/亲民路 老区')
            print()
            print('所以你可以在user.txt文件中添加n个人的信息，这样就可以实现批量填写了...')
            print('github:https://github.com/moddemod/Campus-daily-crack')
            os.system('pause')
            return
        with open(file_name, 'r', encoding='utf-8') as f:
            count = 0
            while True:
                os.system('color 7a')
                message = f.readline().strip('\n')
                if len(message) == 0:
                    if count == 0:
                        print('请在user.txt中填写登录信息...')
                        return
                    break
                try:
                    username, password, address, specious = tuple(message.split(' '))
                except:
                    print('请安装格式填写信息哦....')
                    break
                count += 1
                print('{}: [{} {} {} {}]'.format(count, username, password, address, specious))
                if not post(username, password, address, specious):
                    break
                time.sleep(2)
                os.system('cls 2>nul')
    
    
    from apscheduler.schedulers.blocking import BlockingScheduler
    from datetime import datetime
    
    if __name__ == '__main__':
        # os.system('pause')
        # main()
        # print(win32console.AllocConsole())
        # winreg.CreateKey(winreg.HKEY_LOCAL_MACHINE,)
        # win32console.SetConsoleTitle('moddemod')
    
        # def job():
        # print(datetime.now().strftime('%Y-%m-%d %H:%M:%S'))
        # batch_operation()
        # print('over...')
        # scheduler = BlockingScheduler()
        # scheduler.add_job(job, 'cron', day_of_week='0-6', hour=20, minute=1)
        # scheduler.start()
        batch_operation()
        # os.system('pause')

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80MzgzMzY0Mg_size_16_color_FFFFFF_t_70_pic_center 1]  
![在这里插入图片描述][202011092213537.png_pic_center]  
这里就不建议直接使用python的定时器，如果你需要定时提交，windows和linux下都有很多解决方案，任务计划以及crontab等等，不建议直接使用thread.Timer()当然你要使用也没问题…

提交后记得打开今日校园的App看看…

*github:*[https://github.com/moddemod/Campus-daily-crack][https_github.com_moddemod_Campus-daily-crack]

## 2021年1月4日更新 ##

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80MzgzMzY0Mg_size_16_color_FFFFFF_t_70]

因为教务统一验证，所以重写了登录逻辑…  
大半夜的，更新完了，注意需要设置手机号和邮箱后才能正常登录…  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80MzgzMzY0Mg_size_16_color_FFFFFF_t_70 1]

[fiddler]: /images/20221120/7963072bb05e47728812c04c9c4c1a97.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80MzgzMzY0Mg_size_16_color_FFFFFF_t_70_pic_center]: /images/20221120/a4641113556e451098501092fd179713.png
[1]: https://moddemod.blog.csdn.net/article/details/106140682
[2]: https://moddemod.blog.csdn.net/article/details/105741261
[3]: https://moddemod.blog.csdn.net/article/details/105650392
[burpsuite]: https://img-blog.csdnimg.cn/20201109234650544.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80MzgzMzY0Mg==,size_16,color_FFFFFF,t_70
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80MzgzMzY0Mg_size_16_color_FFFFFF_t_70_pic_center 1]: https://img-blog.csdnimg.cn/20201109235010412.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80MzgzMzY0Mg==,size_16,color_FFFFFF,t_70#pic_center
[202011092213537.png_pic_center]: https://img-blog.csdnimg.cn/202011092213537.png#pic_center
[https_github.com_moddemod_Campus-daily-crack]: https://github.com/moddemod/Campus-daily-crack
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80MzgzMzY0Mg_size_16_color_FFFFFF_t_70]: https://img-blog.csdnimg.cn/20210104010523201.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80MzgzMzY0Mg==,size_16,color_FFFFFF,t_70
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80MzgzMzY0Mg_size_16_color_FFFFFF_t_70 1]: https://img-blog.csdnimg.cn/20210104010408368.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80MzgzMzY0Mg==,size_16,color_FFFFFF,t_70