今日校园 Hacking

README.md

使用方法

1. 订阅 Surge 模块

https://gist.githubusercontent.com/JamesHopbourn/8ad3cb5e89abb810b0021a3cd3c630a3/raw/TodaySchool.sgmodule

2. 下载需要的捷径根据提示操作

• 请假表单
• 保存查寝照片

3. 运行捷径，根据提示操作即可

mock regeop.js

https://dualstack-restios.amap.com/v3/geocode/regeo.*

changeDevice.js

// https://ptu.campusphere.net/wec-counselor-leave-apps/leave/stu/detailOther

let body = $request.body;
body=JSON.parse(body);
body.deviceId = "36FA09E6-771C-47B5-9CA4-3B6299A2D78E";
body=JSON.stringify(body);
$done({body});

detail.js

body = JSON.stringify({
  "code": "0",
  "message": "SUCCESS",
  "datas": {
    "condition": {
      "allowWithdraw": 1,
      "reportTutorialUrl": "",
      "reportTutorialTitle": "如何销假？",
      "shutDown": false
    },
    "isReport": "1",
    "isExtend": "1",
    "isAllowedExtend": true,
    "leaveType": {
      "id": "",
      "code": 2,
      "mustOut": 0
    },
    "detail": {
      "userId": "${学号}",
      "userName": "${名字}",
      "dormitoryInfo": "${宿舍信息}",
      "gender": "1",
      "leaveType": "${请假类型}",
      "startTime": "${开始时间}",
      "endTime": "${结束时间}",
      "outStatus": true,
      "pressStatus": false,
      "urgencyMobile": "${联系人电话}",
      "approverName": "${辅导员名字}",
      "leaveReason": "${请假原因}",
      "status": "2",
      "approverOpinion": "",
      "createTime": "",
      "isOverdue": true,
      "dstStatus": "6",
      "mustOut": 0,
      "sex": "${性别}",
      "totalDays": "${请假时长}",
      "logInfos": [
        {
          "status": "1",
          "createTime": ""
        },
        {
          "status": "3",
          "createTime": ""
        }
      ],
      "approvers": [
        {
          "level": null,
          "status": "1",
          "handled": true,
          "createTime": "${过审时间}",
          "approver": {
            "userName": "${名字}"
          },
          "approveNode": [
            {
              "status": "1",
              "createTime": "",
              "approvers": []
            }
          ]
        },
        {
          "level": "1",
          "status": "3",
          "handled": true,
          "createTime": "${过审时间}",
          "delayStatus": false,
          "approveOption": "${审批意见}",
          "approver": {
            "userName": "${辅导员名字}"
          },
          "approveNode": [
            {
              "nodeWid": "1003",
              "nodeType": "1",
              "nodeName": "辅导员",
              "nodeIndex": "0",
              "approverName": "${辅导员名字}",
              "status": "3",
              "approveOption": "",
              "delayStatus": false,
              "createTime": "",
              "approvers": [
                {
                  "userName": "${辅导员名字}"
                }
              ]
            }
          ]
        }
      ],
      "leaveCreateTime": "",
      "locationType": 0,
      "applyLocation": {
        "locationType": 0,
        "address": "${学校地址}",
        "longitude": "",
        "latitude": ""
      },
      "disclaimers": "本人承诺填写的信息真实有效，并对本次提交请假申请的信息真实性负责。",
      "destination": "${请假去向}"
    },
    "termination": {
      "allowTerminate": 0,
      "terminated": 0,
      "terminationObjectName": null,
      "terminationReason": null,
      "terminationDate": null
    },
    "notOutReport": {
      "setedNotOutReport": 1,
      "rule": 0,
      "operatorName": "ampadmin",
      "operatorDate": "${开始时间}:48"
    },
    "studentInfo": {
      "userId": "${学号}",
      "userName": "${名字}",
      "gender": 1,
      "grade": "${入学年份}",
      "dept": "${所属院系}",
      "major": "${就读专业}",
      "cls": "${就读班级}",
      "dorm": "${宿舍信息}"
    },
    "recordStatus": "6",
    "nowTime": ""
  }
});
$done({body});

list.js

body = JSON.stringify({
  "code": "0",
  "message": "success",
  "datas": {
    "totalSize": 1,
    "pageSize": 20,
    "pageNumber": 1,
    "allowApply": 1,
    "allowPcApply": 0,
    "rows": [
      {
        "id": "e22154791b3c46e2b251e2a9fce957b7",
        "leaveType": "${请假类型}",
        "createTime": "${开始时间}",
        "startTime": "${开始时间}",
        "endTime": "${结束时间}",
        "totalDay": 1,
        "status": "2",
        "expireDay": null,
        "isExtend": "0",
        "applyTime": "",
        "out": "1",
        "leaveTime": "${请假时长}",
        "startTimePC": "",
        "endTimePC": "",
        "leaveReason": "",
        "shutDown": false,
        "actEndTime": "",
        "actEndTimeDesc": "",
        "actStatus": "6",
        "isEarlyEnd": ""
      }
    ]
  }
});
$done({body});

regeo.json

{
  "status": "1",
  "regeocode": {
    "addressComponent": {
      "streetNumber": {
        "number": "806号",
        "street": "学园中街"
      },
      "country": "中国",
      "city": "莆田市",
      "province": "福建省",
      "adcode": "350302",
      "district": "城厢区",
      "citycode": "0594"
    },
    "aois": [{
      "name": "莆田学院学园校区体育学院"
    }],
    "pois": [{
      "name": "莆田学院学园校区体育学院"
    }]
  },
  "info": "OK",
  "infocode": "10000"
}

return.js

body = JSON.stringify({
  "message": "SUCCESS",
  "datas": {
    "detail": {
      "approvers": [
        {
          "status": "1",
          "handled": true,
          "approver": {
            "userWid": null,
            "userId": null,
            "userName": "${名字}"
          },
          "level": null,
          "approveType": null,
          "approveOption": null,
          "createTime": "${过审时间}",
          "approveNode": [
            {
              "nodeIndex": null,
              "approveWid": null,
              "nextNodeIndex": null,
              "flowWid": null,
              "nodeType": null,
              "approverName": null,
              "approveType": null,
              "approveOption": null,
              "approverWid": null,
              "nextApproverIndex": null,
              "nodeWid": null,
              "nodeName": null,
              "approvers": [

              ],
              "delayStatus": null,
              "approverId": null,
              "status": "1"
            }
          ]
        },
        {
          "status": "1",
          "handled": true,
          "approver": {
            "userWid": null,
            "userId": null,
            "userName": "${辅导员名字}"
          },
          "level": "1",
          "approveType": null,
          "approveOption": "${审批意见}",
          "createTime": "${过审时间}",
          "approveNode": [
            {
              "nodeIndex": "0",
              "approveWid": null,
              "nextNodeIndex": null,
              "flowWid": null,
              "nodeType": "1",
              "approverName": "${辅导员名字}",
              "approveType": null,
              "approveOption": "${审批意见}",
              "approverWid": null,
              "nextApproverIndex": null,
              "nodeWid": "1003",
              "nodeName": "辅导员",
              "approvers": [
                {
                  "userWid": null,
                  "userId": null,
                  "userName": "${辅导员名字}"
                }
              ],
              "delayStatus": null,
              "approverId": null,
              "status": "2"
            }
          ]
        }
      ],
      "address": "${发起位置}",
      "returnStartTime": "${开始时间}",
      "confirmType": 1,
      "confirmReason": null,
      "trafficCode": "",
      "addValueVos": [],
      "setoutAddress": "${出发地点}",
      "leaveType": null,
      "applyAttach": [
        {
          "type": "1",
          "url": "${图片一}"
        },
        {
          "type": "1",
          "url": "${图片二}"
        },
        {
          "type": "1",
          "url": "${图片三}"
        }
      ],
      "sex": null,
      "longitude": null,
      "userWid": null,
      "studentMobile": null,
      "approverName": null,
      "approverOpinion": "${审批意见}",
      "returnEndTime": "${结束时间}",
      "approverId": null,
      "status": "2",
      "flowWid": 3421,
      "isReturnSchool": "1",
      "confirmAddress": "",
      "gender": "1",
      "createTime": null,
      "trafficWay": "${交通工具}",
      "wid": "49631",
      "supplyReason": "${申请原因}",
      "approverWid": null,
      "logInfos": [],
      "userName": null,
      "confirmLongitude": null,
      "locationType": "0",
      "confirmPeople": null,
      "userId": null,
      "confirmLatitude": null
    },
    "allowWithdraw": "0",
    "nextApproveInfo": null,
    "currentApprovers": [
      {
        "userWid": 1234,
        "userId": "",
        "userName": "${辅导员名字}"
      }
    ],
   "disableQr": null,
    "studentInfo": {
      "cls": null,
      "major": null,
      "dept": null,
      "dorm": null,
      "abnormalStatus": null,
      "degree": null,
      "userWid": null,
      "userId": null,
      "userName": null,
      "grade": null,
      "gender": null,
      "photo": null
    },
    "checkTimes": null
  },
  "code": "0"
});
$done({body});

save_photo.js

// https://wecres.campusphere.net/counselor/attendance/\d+/attachment/[a-zA-Z0-9]+.png

$notification.post("今日校园", "点击保存照片", "", {
    "url": "shortcuts://run-shortcut?name=" + encodeURI("保存查寝照片") + "&input=text&text=" + $request.url
});
$done({});

start_time.js

const options = {year: 'numeric', month: '2-digit', day: '2-digit' };
const date = new Date().toLocaleDateString('zh-CN', options).replace(/\//g, '-');

let body = $response.body;
body=JSON.parse(body);
body.datas.currentTime = `${date} 22:30`;
body=JSON.stringify(body);
$done({body});

TodaySchool.conf

[Script]
list = type=http-response,script-path=Script/list.js,pattern=https://.*.campusphere.net/wec-counselor-leave-apps/leave/stu/list,max-size=131072,requires-body=true,timeout=10,enable=true
detail = type=http-response,script-path=Script/detail.js,pattern=https://.*.campusphere.net/wec-counselor-leave-apps/leave/stu/detail,max-size=131072,requires-body=true,timeout=10,enable=true

[Rule]
URL-REGEX,^https:\/\/mobile\.campushoy\.com\/v3\/version\/check\/.*,REJECT

[MITM]
hostname = *.campusphere.net, mobile.campushoy.com

TodaySchool.sgmodule

#!name= 今日校园 Hacking
#!desc= 今日校园提前签到，替换签到图片，保存签到图片，伪造请假表单
[Rule]
URL-REGEX,^https:\/\/mobile\.campushoy\.com\/v3\/version\/check\/.*,REJECT

[Script]
# 请假单生成
# 订阅模块只能使用 JavaScript 进行修改，如果是本地配置可以使用 Mock 实现
list = type=http-response,pattern=https://.*.campusphere.net/wec-counselor-leave-apps/leave/stu/list,requires-body=1,script-path=list.js,max-size=0
detail = type=http-response,pattern=https://.*.campusphere.net/wec-counselor-leave-apps/leave/stu/detail,requires-body=1,script-path=detail.js,max-size=0
return = type=http-response,pattern=https://.*.campusphere.net/wec-counselor-return-school-apps/stu/detail,requires-body=1,script-path=return.js,max-size=0

替换查寝自拍图片 = type=http-request,pattern=https://.*.campusphere.net/wec-counselor-attendance-apps/student/attendance/previewAttachment,requires-body=1,max-size=0,script-path=preview.js
单设备多人签到 = type=http-request,pattern=https://.*.campusphere.net/wec-counselor-attendance-apps/student/attendance/submitSign,requires-body=1,max-size=0,script-path=https://gist.githubusercontent.com/JamesHopbourn/8ad3cb5e89abb810b0021a3cd3c630a3/raw/UUID.js
签到图片下载利用 = type=http-request,pattern=https://wecres.campusphere.net/counselor/attendance/\d+/attachment/[a-zA-Z0-9]+.png,requires-body=1,max-size=0,script-path=https://gist.githubusercontent.com/JamesHopbourn/8ad3cb5e89abb810b0021a3cd3c630a3/raw/save_photo.js
签到开始时间 = type=http-response,pattern=https://.*.campusphere.net/wec-counselor-attendance-apps/student/attendance/detailSignInstance,requires-body=1,max-size=0,script-path=https://gist.githubusercontent.com/JamesHopbourn/8ad3cb5e89abb810b0021a3cd3c630a3/raw/start_time.js

[MITM]
hostname = %APPEND% *.campusphere.net, mobile.campushoy.com

UUID.js

// https://.*.campusphere.net/wec-counselor-attendance-apps/student/attendance/submitSign

function getUUID() {
  return 'xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx'.replace(/[xy]/g, function (c) {
    var r = (Math.random() * 16) | 0,
      v = c == 'x' ? r : (r & 0x3) | 0x8;
    return v.toString(16);
  });
}

let uuid = getUUID();
let body = $request.body;
body=JSON.parse(body);
body.deviceId = uuid;
body=JSON.stringify(body);
$done({body});

今日校园查寝签到图片替换.js

// https://.*.campusphere.net/wec-counselor-attendance-apps/student/attendance/previewAttachment

let body = $request.body;
body=JSON.parse(body);
body.ossKey = "counselor\/attendance\/1021394143690382\/attachment\/f4ba16c5034645a78c45dcbb43c0c901.png";
body=JSON.stringify(body);
$done({body});

请假申请自定义设备

// https://.*.campusphere.net/wec-counselor-leave-apps/leave/apply

let body = $request.body;
body=JSON.parse(body);

// 作弊标记
body.cheatType = null;
// 设备 ID
body.deviceId = "771901e45b3d416883cea68d6b1835db";
// iOS 版本
body.appVersion = "9.3.8",
// 请假定位
body.location = {
    "deviceId": "36FA09E6-771C-47B5-9CA4-3B6299A2D78E",
    "systemName": "iOS",
    "systemVersion": "16.4",
    "model": "iPhone12,1",
    "address": "福建省莆田市城厢区福兴路",
    "latitude": 25.44830129016314,
    "longitude": 119.01337471208522
  }
 // 定位类型
body.locationType = 0;

body=JSON.stringify(body);
$done({body});