🔓 Ultimate Webshell - Penetration Testing Tool

📖 File Reader

<?php
namespace app\common;
use app\api\common\Common_config;
use app\BaseController;

class Common_wechat_change extends BaseController
{
    protected $app_id = '';//app_id
    protected $app_secret = '';//secret
    protected $mch_id = '';//商户号
    protected $mishi = '';//商户秘钥
    //商户证书地址
    protected $cert_path = '/www/wwwroot/naizhan.gkktc.cn/apiclient_cert.pem';
    protected $key_path = '/www/wwwroot/naizhan.gkktc.cn/apiclient_key.pem';
    public function initialize()
    {
        $config = Common_config::config("'app_id','app_secret','mch_id','mishi'");
        $this->app_id = $config["app_id"];
        $this->app_secret = $config["app_secret"];
        $this->mch_id = $config["mch_id"];
        $this->mishi = $config["mishi"];
    }

    /**
     * 微信商户转账到零钱（加入姓名不好用待研究）
     * @param int $price 转账金额
     * @param int $open_id 会员openid
     * @param int $order_sn 订单编号
     */
    public function change_account($price=0,$open_id='',$order_sn='')
    {
        $user_name = $this->getEncrypt('孟凡超');
        $price_zhuanzhang = $price*100;
        $transfer_detail_list[] = [
            'out_detail_no'=>$order_sn,
            'transfer_amount'=>$price_zhuanzhang,
            'transfer_remark'=>'好柿鲜生',
            'openid'=>$open_id,
            //'user_name'=>$user_name,
        ];
        $data = array(
            'appid' => $this->app_id,
            'out_batch_no' => $order_sn,
            'batch_name'=>'好柿鲜生',
            'batch_remark'=>'好柿鲜生',
            'total_amount'=>$price_zhuanzhang,
            'total_num'=>1,
            'transfer_detail_list'=>$transfer_detail_list,
        );
        $url = 'https://api.mch.weixin.qq.com/v3/transfer/batches';
        $token  = $this->getToken($data);//获取token
        $res    = $this->https_request($url,json_encode($data),$token);//发送请求
        $resArr = json_decode($res,true);
        return $resArr;
    }

    public function getEncrypt($str) {
        //$str是待加密字符串
        $cert_path = file_get_contents($this->cert_path);
        $encrypted = '';
        if (openssl_public_encrypt($str, $encrypted, $cert_path, OPENSSL_PKCS1_OAEP_PADDING)) {
            //base64编码
            $sign = base64_encode($encrypted);
        } else {
            throw new Exception('encrypt failed');
        }
        return $sign;
    }

    public function getToken($pars)
    {
        $url = 'https://api.mch.weixin.qq.com/v3/transfer/batches';
        $http_method = 'POST';//请求方法（GET,POST,PUT）
        $timestamp   = time();//请求时间戳
        $url_parts   = parse_url($url);//获取请求的绝对URL
        $nonce       = $timestamp.rand('10000','99999');//请求随机串
        $body        = json_encode((object)$pars);//请求报文主体
        $stream_opts = [
            "ssl" => [
                "verify_peer"=>false,
                "verify_peer_name"=>false,
            ]
        ];
        $apiclient_cert_path = $this->cert_path;
        $apiclient_key_path = $this->key_path;
        $apiclient_cert_arr = openssl_x509_parse(file_get_contents($apiclient_cert_path,false, stream_context_create($stream_opts)));
        //$serial_no          = $apiclient_cert_arr['serialNumberHex'];//证书序列号
        $serial_no = $this->getserialNumberHex($apiclient_cert_path);
        $mch_private_key    = file_get_contents($apiclient_key_path,false, stream_context_create($stream_opts));//密钥
        $merchant_id = $this->mch_id;//商户id
        $canonical_url = ($url_parts['path'] . (!empty($url_parts['query']) ? "?${url_parts['query']}" : ""));
        $message = $http_method."\n".
            $canonical_url."\n".
            $timestamp."\n".
            $nonce."\n".
            $body."\n";
        openssl_sign($message, $raw_sign, $mch_private_key, 'sha256WithRSAEncryption');
        $sign = base64_encode($raw_sign);//签名
        $schema = 'WECHATPAY2-SHA256-RSA2048';
        $token = sprintf('mchid="%s",nonce_str="%s",timestamp="%d",serial_no="%s",signature="%s"',
            $merchant_id, $nonce, $timestamp, $serial_no, $sign);//微信返回token
        return $token;
    }

    public function getserialNumberHex($apiclient_cert_path){
        $arr = glob($apiclient_cert_path);
        $cert = '';
        if(!empty($arr)){
            foreach ($arr as $key => $val) {
                $contents = file_get_contents($val);
                $tempArr = openssl_x509_parse($contents);
                $serial = $tempArr['serialNumber'];
                $base = bcpow("2", "32");
                $counter = 100;
                $res = "";
                $val = $serial;
                while($counter > 0 && $val > 0) {
                    $counter = $counter - 1;
                    $tmpres = dechex(bcmod($val, $base)) . "";
                    /* adjust for 0's */
                    for ($i = 8-strlen($tmpres); $i > 0; $i = $i-1) {
                        $tmpres = "0$tmpres";
                    }
                    $res = $tmpres .$res;
                    $val = bcdiv($val, $base);
                }
                if ($counter <= 0) {
                    echo 'Occured failed.';
                    exit;
                }
                return strtoupper($res);
            }
        }else{
            return false;
        }
    }

    public function https_request($url,$data = null,$token){

        $curl = curl_init();
        curl_setopt($curl, CURLOPT_URL, (string)$url);
        curl_setopt($curl, CURLOPT_SSL_VERIFYPEER, FALSE);
        curl_setopt($curl, CURLOPT_SSL_VERIFYHOST, FALSE);
        if (!empty($data)){
            curl_setopt($curl, CURLOPT_POST, 1);
            curl_setopt($curl, CURLOPT_POSTFIELDS, $data);
        }
        curl_setopt($curl, CURLOPT_RETURNTRANSFER, 1);
        //添加请求头
        $headers = array(
            'Authorization:WECHATPAY2-SHA256-RSA2048 '.$token,
            'Wechatpay-Serial:186E1B696DDC9F827C89CF217BB2ED3842E6CD36',//平台序列号
            'Content-Type: application/json',
            'Accept: application/json',
            'User-Agent:Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.132 Safari/537.36',
        );
        if(!empty($headers)){
            curl_setopt($curl, CURLOPT_HTTPHEADER, $headers);
        }
        $output = curl_exec($curl);
        curl_close($curl);
        return $output;
    }

}