🔓 Ultimate Webshell - Penetration Testing Tool

📖 File Reader

<?php
namespace app\common;
use app\BaseController;
use app\api\common\Common_config;
use think\facade\Db;

/*微信其他接口*/
class Common_wechat extends BaseController
{
    protected $app_id = '';//app_id
    protected $app_secret = '';//secret

    public function initialize()
    {
        $config = Common_config::config("'app_id','app_secret','mch_id','mishi'");
        $this->app_id = $config["app_id"];
        $this->app_secret = $config["app_secret"];
    }

    /**
     * 生成跳转到小程序地址
     * @param string $link 小程序地址
     * @param string $query 参数
     */
    public function create_link($link = '', $query = '')
    {
        header('content-type:text/html;charset=utf-8');
        //获取access_token
        $access_token = "https://api.weixin.qq.com/cgi-bin/token?grant_type=client_credential&appid=$this->app_id&secret=$this->app_secret";
        //缓存access_token
        session_start();
        $_SESSION['access_token'] = "";
        $_SESSION['expires_in'] = 0;
        $ACCESS_TOKEN = "";
        if (!isset($_SESSION['access_token']) || (isset($_SESSION['expires_in']) && time() > $_SESSION['expires_in'])) {
            $json = $this->httpRequest($access_token);
            $json = json_decode($json, true);
            $_SESSION['access_token'] = $json['access_token'];
            $_SESSION['expires_in'] = time() + 7200;
            $ACCESS_TOKEN = $json["access_token"];
        } else {
            $ACCESS_TOKEN = $_SESSION["access_token"];
        }
        $param = array(
            'path' => $link,
            'query' => $query,
            'env_version' => 'release'//正式release、体验trial、开发develop
        );
        $param = json_encode($param);
        $qcode = "https://api.weixin.qq.com/wxa/generate_urllink?access_token=" . $ACCESS_TOKEN;
        $result = $this->httpRequest($qcode, $param, "POST");
        $result_arr = json_decode($result, true);
        $result_arr = [
            'url_link' => $result_arr["url_link"],
        ];
        return $result_arr;
    }

    /**
     * 小程序二维码生成
     * @param $path 小程序访问地址
     */
    public function create_xcx($path)
    {
        header('content-type:text/html;charset=utf-8');
        //获取access_token
        $access_token = "https://api.weixin.qq.com/cgi-bin/token?grant_type=client_credential&appid=$this->app_id&secret=$this->app_secret";
        //缓存access_token
        session_start();
        $_SESSION['access_token'] = "";
        $_SESSION['expires_in'] = 0;
        $ACCESS_TOKEN = "";
        if (!isset($_SESSION['access_token']) || (isset($_SESSION['expires_in']) && time() > $_SESSION['expires_in'])) {
            $json = $this->httpRequest($access_token);
            $json = json_decode($json, true);
            // var_dump($json);
            $_SESSION['access_token'] = $json['access_token'];
            $_SESSION['expires_in'] = time() + 7200;
            $ACCESS_TOKEN = $json["access_token"];
        } else {
            $ACCESS_TOKEN = $_SESSION["access_token"];
        }
        //构建请求二维码参数
        //path是扫描二维码跳转的小程序路径，可以带参数?id=xxx
        //width是二维码宽度
        //$qcode = "https://api.weixin.qq.com/cgi-bin/wxaapp/createwxaqrcode?access_token=$ACCESS_TOKEN";//正方形二维码
        $qcode = "https://api.weixin.qq.com/wxa/getwxacode?access_token=$ACCESS_TOKEN";//圆形二维码
        $param = json_encode(array("path" => $path, "width" => 150));

        //POST参数
        $result = $this->httpRequest($qcode, $param, "POST");
        //生成二维码L
        file_put_contents("qrcode.png", $result);
        $base64_image = "data:image/jpeg;base64," . base64_encode($result);
        return $base64_image;
    }

    //把请求发送到微信服务器换取二维码
    public function httpRequest($url, $data = '', $method = 'GET')
    {
        $curl = curl_init();
        curl_setopt($curl, CURLOPT_URL, $url);
        curl_setopt($curl, CURLOPT_SSL_VERIFYPEER, 0);
        curl_setopt($curl, CURLOPT_SSL_VERIFYHOST, 0);
        curl_setopt($curl, CURLOPT_USERAGENT, $_SERVER['HTTP_USER_AGENT']);
        curl_setopt($curl, CURLOPT_FOLLOWLOCATION, 1);
        curl_setopt($curl, CURLOPT_AUTOREFERER, 1);
        if ($method == 'POST') {
            curl_setopt($curl, CURLOPT_POST, 1);
            if ($data != '') {
                curl_setopt($curl, CURLOPT_POSTFIELDS, $data);
            }
        }
        curl_setopt($curl, CURLOPT_TIMEOUT, 30);
        curl_setopt($curl, CURLOPT_HEADER, 0);
        curl_setopt($curl, CURLOPT_RETURNTRANSFER, 1);
        $result = curl_exec($curl);
        curl_close($curl);
        return $result;
    }

    /**
     * 公众号参数二维码
     * @param array $data 参数
     * @return string
     */
    public function erweima_parameter($data=[])
    {
        //获取access_token
        $access_token = "https://api.weixin.qq.com/cgi-bin/token?grant_type=client_credential&appid=$this->app_id&secret=$this->app_secret";
        //缓存access_token
        session_start();
        $_SESSION['access_token'] = "";
        $_SESSION['expires_in'] = 0;
        $ACCESS_TOKEN = "";
        if (!isset($_SESSION['access_token']) || (isset($_SESSION['expires_in']) && time() > $_SESSION['expires_in'])) {
            $json = $this->httpRequest($access_token);
            $json = json_decode($json, true);
            $_SESSION['access_token'] = $json['access_token'];
            $_SESSION['expires_in'] = time() + 7200;
            $ACCESS_TOKEN = $json["access_token"];
        } else {
            $ACCESS_TOKEN = $_SESSION["access_token"];
        }
        $data=json_encode($data);
        $arr=['action_name'=>'QR_LIMIT_STR_SCENE','action_info'=>['scene'=>['scene_str'=>$data]]];
        $url='https://api.weixin.qq.com/cgi-bin/qrcode/create?access_token='.$ACCESS_TOKEN;
        $result= $this->https_request($url,json_encode($arr));
        $results=json_decode($result,true);
        $qecodeUrl='https://mp.weixin.qq.com/cgi-bin/showqrcode?ticket='.UrlEncode($results['ticket']);
        return $qecodeUrl;
    }

    /**
     * 公众号调用扫一扫
     * @param string $user_miyao
     * @param string $url 页面URL地址（如uniapp打包成的h5直接获取不好用 例：http://zhanhui.jiboshimr.cn/h5/#/）
     * @return array
     */
    public function getConfig($user_miyao = '',$url='')
    {
        //微信 JS 接口签名校验工具: https://mp.weixin.qq.com/debug/cgi-bin/sandbox?t=jsapisign
        $appid = $this->app_id;
        $secret = $this->app_secret;
        //获取token
        $token = $this->get_token($appid, $secret, $user_miyao);
        //获取ticket
        $ticket = $this->get_ticket($token, $user_miyao);
        //进行sha1签名
        $timestamp = time();
        $nonceStr = $this->createNonceStr();
        if (empty($url)){
            //注意 URL 建议动态获取(也可以写死).
            $protocol = (!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off' || $_SERVER['SERVER_PORT'] == 443) ? "https://" : "http://";
            $url = "$protocol$_SERVER[HTTP_HOST]$_SERVER[REQUEST_URI]"; // 调用JSSDK的页面地址
        }
        $str = "jsapi_ticket={$ticket}&noncestr={$nonceStr}&timestamp={$timestamp}&url={$url}";
        $sha_str = sha1($str);
        return ['appid' => $appid, 'timestamp' => $timestamp, 'nonceStr' => $nonceStr, 'sha_str' => $sha_str];
    }

    /**
     * 公众号自定义分享
     * @param string $url 分享地址
     */
    public function wechat_share($url = '')
    {
        //获取access_token
        $access_token = "https://api.weixin.qq.com/cgi-bin/token?grant_type=client_credential&appid=$this->app_id&secret=$this->app_secret";
        //缓存access_token
        session_start();
        $_SESSION['access_token'] = "";
        $_SESSION['expires_in'] = 0;
        $ACCESS_TOKEN = "";
        if (!isset($_SESSION['access_token']) || (isset($_SESSION['expires_in']) && time() > $_SESSION['expires_in'])) {
            $json = $this->httpRequest($access_token);
            $json = json_decode($json, true);
            $_SESSION['access_token'] = $json['access_token'];
            $_SESSION['expires_in'] = time() + 7200;
            $ACCESS_TOKEN = $json["access_token"];
        } else {
            $ACCESS_TOKEN = $_SESSION["access_token"];
        }
        $curl = "https://api.weixin.qq.com/cgi-bin/ticket/getticket?access_token=" . $ACCESS_TOKEN . "&type=jsapi";
        $curl1 = curl_init(); // 启动一个CURL会话
        curl_setopt($curl1, CURLOPT_URL, $curl); // 要访问的地址
        curl_setopt($curl1, CURLOPT_SSL_VERIFYPEER, 0); // 对认证证书来源的检查
        curl_setopt($curl1, CURLOPT_SSL_VERIFYHOST, 0); // 从证书中检查SSL加密算法是否存在
        curl_setopt($curl1, CURLOPT_TIMEOUT, 30); // 设置超时限制防止死循环
        curl_setopt($curl1, CURLOPT_HEADER, 0); // 显示返回的Header区域内容
        curl_setopt($curl1, CURLOPT_RETURNTRANSFER, 1); // 获取的信息以文件流的形式返回
        $response1 = curl_exec($curl1);// 执行操作
        $err = curl_error($curl1);
        curl_close($curl1);// 关闭请求
        $response1 = json_decode($response1, true);
        $nonceStr = $this->createNonceStr(32);
        $timestamp = time();
        $string = "jsapi_ticket=" . $response1['ticket'] . "&noncestr=" . $nonceStr . "&timestamp=" . $timestamp . "&url=" . $url;
        $signature = sha1($string);
        $signPackage = array(
            "appId" => $this->app_id,
            "nonceStr" => $nonceStr,
            "timestamp" => $timestamp,
            "url" => $url,
            "signature" => $signature,
            "rawString" => $string
        );
        return $signPackage;
    }

    /**
     * 设置公众号自定义菜单栏
     * @param array $jsonmenu 菜单栏数据
     * @return bool|string
     */
    public function menu_bar($jsonmenu = [])
    {
        //获取token
        $access_token = $this->get_token($this->app_id, $this->app_secret);
        $url = "https://api.weixin.qq.com/cgi-bin/menu/create?access_token=" . $access_token;
        $result = $this->https_request($url, $jsonmenu);
        return $result;
    }

    /**
     * 公众号消息发送（群发）
     * @param array $data 发送数据
     */
    public function message_push_all($data=[])
    {
        //获取access_token
        $access_token = "https://api.weixin.qq.com/cgi-bin/token?grant_type=client_credential&appid=$this->app_id&secret=$this->app_secret";
        //缓存access_token
        session_start();
        $_SESSION['access_token'] = "";
        $_SESSION['expires_in'] = 0;
        $ACCESS_TOKEN = "";
        if (!isset($_SESSION['access_token']) || (isset($_SESSION['expires_in']) && time() > $_SESSION['expires_in'])) {
            $json = $this->httpRequest($access_token);
            $json = json_decode($json, true);
            $_SESSION['access_token'] = $json['access_token'];
            $_SESSION['expires_in'] = time() + 7200;
            $ACCESS_TOKEN = $json["access_token"];
        } else {
            $ACCESS_TOKEN = $_SESSION["access_token"];
        }
        // 构造群发消息的URL
        $url = 'https://api.weixin.qq.com/cgi-bin/message/mass/sendall?access_token=' . $ACCESS_TOKEN;
        // 构造消息数据
        $result = $this->https_request($url, $data);
        return $result;
    }

    /**
     * 公众号消息发送（单独）
     * @param array $data 发送数据
     */
    public function message_push($data=[])
    {
        //获取access_token
        $access_token = "https://api.weixin.qq.com/cgi-bin/token?grant_type=client_credential&appid=$this->app_id&secret=$this->app_secret";
        //缓存access_token
        session_start();
        $_SESSION['access_token'] = "";
        $_SESSION['expires_in'] = 0;
        $ACCESS_TOKEN = "";
        if (!isset($_SESSION['access_token']) || (isset($_SESSION['expires_in']) && time() > $_SESSION['expires_in'])) {
            $json = $this->httpRequest($access_token);
            $json = json_decode($json, true);
            $_SESSION['access_token'] = $json['access_token'];
            $_SESSION['expires_in'] = time() + 7200;
            $ACCESS_TOKEN = $json["access_token"];
        } else {
            $ACCESS_TOKEN = $_SESSION["access_token"];
        }
        $url = 'https://api.weixin.qq.com/cgi-bin/message/custom/send?access_token=' . $ACCESS_TOKEN;
        $result = $this->https_request($url, $data);
        return $result;
    }

    /**
     * 公众号模板消息
     * @param string $open_id 用户openid
     * @param string $template_id 公众号模板id
     * @param array $data 发送参数
     * @param string $url 点击模板跳转路径
     */
    public function message_template($open_id='',$template_id='',$data=[],$url='')
    {
        //获取access_token
        $access_token = "https://api.weixin.qq.com/cgi-bin/token?grant_type=client_credential&appid=$this->app_id&secret=$this->app_secret";
        //缓存access_token
        session_start();
        $_SESSION['access_token'] = "";
        $_SESSION['expires_in'] = 0;
        $ACCESS_TOKEN = "";
        if (!isset($_SESSION['access_token']) || (isset($_SESSION['expires_in']) && time() > $_SESSION['expires_in'])) {
            $json = $this->httpRequest($access_token);
            $json = json_decode($json, true);
            $_SESSION['access_token'] = $json['access_token'];
            $_SESSION['expires_in'] = time() + 7200;
            $ACCESS_TOKEN = $json["access_token"];
        } else {
            $ACCESS_TOKEN = $_SESSION["access_token"];
        }
        $url="https://api.weixin.qq.com/cgi-bin/message/template/send?access_token=".$ACCESS_TOKEN;
        $data_request = [
            'touser'=>$open_id,
            'template_id'=>$template_id,
            'url'=>'',//点击模板消息会跳转的链接
            'topcolor'=>"#7B68EE",
            'data'=>$data,
        ];
        $data_request = urldecode(json_encode($data_request));
        $ch1 = curl_init();
        curl_setopt($ch1, CURLOPT_URL, $url);
        curl_setopt($ch1, CURLOPT_RETURNTRANSFER, 1);
        curl_setopt($ch1, CURLOPT_SSL_VERIFYPEER, FALSE);
        curl_setopt($ch1, CURLOPT_SSL_VERIFYHOST, FALSE);
        curl_setopt($ch1, CURLOPT_POST, 1);
        curl_setopt($ch1, CURLOPT_POSTFIELDS, $data_request);
        $output = curl_exec($ch1);
        curl_close($ch1);
        return $output;
    }

    /**
     * 小程序订阅模板消息
     * @param string $open_id 用户openid
     * @param string $template_id 公众号模板id
     * @param array $data 发送参数
     * @param string $url 点击模板跳转路径
     */
    public function message_subscribe($open_id='',$template_id='',$data=[],$url='')
    {
        //获取access_token
        $access_token = "https://api.weixin.qq.com/cgi-bin/token?grant_type=client_credential&appid=$this->app_id&secret=$this->app_secret";
        //缓存access_token
        session_start();
        $_SESSION['access_token'] = "";
        $_SESSION['expires_in'] = 0;
        $ACCESS_TOKEN = "";
        if (!isset($_SESSION['access_token']) || (isset($_SESSION['expires_in']) && time() > $_SESSION['expires_in'])) {
            $json = $this->httpRequest($access_token);
            $json = json_decode($json, true);
            $_SESSION['access_token'] = $json['access_token'];
            $_SESSION['expires_in'] = time() + 7200;
            $ACCESS_TOKEN = $json["access_token"];
        } else {
            $ACCESS_TOKEN = $_SESSION["access_token"];
        }
        $url="https://api.weixin.qq.com/cgi-bin/message/subscribe/send?access_token=".$ACCESS_TOKEN;
        $data_request = [
            'touser'=>$open_id,
            'template_id'=>$template_id,
            'url'=>'',//点击模板消息会跳转的链接
            'topcolor'=>"#7B68EE",
            'data'=>$data,
        ];
        $data_request = urldecode(json_encode($data_request));
        $ch1 = curl_init();
        curl_setopt($ch1, CURLOPT_URL, $url);
        curl_setopt($ch1, CURLOPT_RETURNTRANSFER, 1);
        curl_setopt($ch1, CURLOPT_SSL_VERIFYPEER, FALSE);
        curl_setopt($ch1, CURLOPT_SSL_VERIFYHOST, FALSE);
        curl_setopt($ch1, CURLOPT_POST, 1);
        curl_setopt($ch1, CURLOPT_POSTFIELDS, $data_request);
        $output = curl_exec($ch1);
        curl_close($ch1);
        return $output;
    }

    /**
     * 获取token
     * @param int $appid
     * @param int $secret
     * @param int $user_miyao 会员秘钥（用于文件创建）
     * @return mixed
     */
    public function get_token($appid = '', $secret = '', $user_miyao = '')
    {
        $url = dirname(dirname(dirname(__FILE__))) . '/public/uploads/wechat/wechat_token_' . $user_miyao . '.txt';
        $token_data = @file_get_contents($url);
        if (!empty($token_data)) {
            $token_data = json_decode($token_data, true);
            $time = time() - $token_data['time'];
            if ($time > 3600) {
                $token_url = "https://api.weixin.qq.com/cgi-bin/token?grant_type=client_credential&appid={$appid}&secret={$secret}";
                $token_res = $this->https_request($token_url);
                $token_res = json_decode($token_res, true);
                $token = $token_res['access_token'];
                $data = array(
                    'time' => time(),
                    'token' => $token
                );
                file_put_contents($url, json_encode($data));
            } else {
                $token = $token_data['token'];
            }
        } else {
            $token_url = "https://api.weixin.qq.com/cgi-bin/token?grant_type=client_credential&appid={$appid}&secret={$secret}";
            $token_res = $this->https_request($token_url);
            $token_res = json_decode($token_res, true);
            $token = $token_res['access_token'];
            $data = array(
                'time' => time(),
                'token' => $token
            );
            file_put_contents($url, json_encode($data));
        }
        return $token;
    }

    /**
     * 获取ticket
     * @param string $token
     * @param string $user_miyao 会员秘钥（用于文件创建）
     * @return mixed
     */
    function get_ticket($token = '', $user_miyao = '')
    {
        $url = dirname(dirname(dirname(__FILE__))) . '/public/uploads/wechat/wechat_ticket_' . $user_miyao . '.txt';
        $ticket_data = @file_get_contents($url);
        if (!empty($ticket_data)) {
            $ticket_data = json_decode($ticket_data, true);
            $time = time() - $ticket_data['time'];
            if ($time > 3600) {
                $ticket_url = "https://api.weixin.qq.com/cgi-bin/ticket/getticket?access_token={$token}&type=jsapi";
                $ticket_res = $this->https_request($ticket_url);
                $ticket_res = json_decode($ticket_res, true);
                $ticket = $ticket_res['ticket'];
                $data = array(
                    'time' => time(),
                    'ticket' => $ticket
                );
                file_put_contents($url, json_encode($data));
            } else {
                $ticket = $ticket_data['ticket'];
            }
        } else {
            $ticket_url = "https://api.weixin.qq.com/cgi-bin/ticket/getticket?access_token={$token}&type=jsapi";
            $ticket_res = $this->https_request($ticket_url);
            $ticket_res = json_decode($ticket_res, true);
            $ticket = $ticket_res['ticket'];
            $data = array(
                'time' => time(),
                'ticket' => $ticket
            );
            file_put_contents($url, json_encode($data));
        }
        return $ticket;
    }

    function createNonceStr($length = 16)
    {
        $chars = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789";
        $str = "";
        for ($i = 0; $i < $length; $i++) {
            $str .= substr($chars, mt_rand(0, strlen($chars) - 1), 1);
        }
        return $str;
    }

    /**
     * 模拟 http 请求
     * @param String $url 请求网址
     * @param Array $data 数据
     */
    function https_request($url, $data = null)
    {
        // curl 初始化
        $curl = curl_init();
        // curl 设置
        curl_setopt($curl, CURLOPT_URL, $url);
        curl_setopt($curl, CURLOPT_SSL_VERIFYPEER, FALSE);
        curl_setopt($curl, CURLOPT_SSL_VERIFYHOST, FALSE);
        // 判断 $data get  or post
        if (!empty($data)) {
            curl_setopt($curl, CURLOPT_POST, 1);
            curl_setopt($curl, CURLOPT_POSTFIELDS, $data);
        }
        curl_setopt($curl, CURLOPT_RETURNTRANSFER, 1);
        // 执行
        $res = curl_exec($curl);
        curl_close($curl);
        return $res;
    }
}