WooYun.org

<?php





$secretkey = '308c6c43a*****279dd61dd80e8d59bd';


$c = 'user';


$a = 'get';





$data = array('uid'=>'658925');


$time = time();


$key = appKey('1', time(), $secretkey, array('userid'=>658925), $data);





echo post('http://**.**.**.**/windid/index.php?m=api&c='.$c.'&a='.$a.'&windidkey='.$key.'&time='.$time .'&clientid=1&userid=658925',$data);





function post($uri,$data) {


	$ch = curl_init ();


	curl_setopt ( $ch, CURLOPT_URL, $uri );


	curl_setopt ( $ch, CURLOPT_POST, 1 );


	curl_setopt ( $ch, CURLOPT_HEADER, 0 );


	curl_setopt ( $ch, CURLOPT_RETURNTRANSFER, 1 );


	curl_setopt ( $ch, CURLOPT_POSTFIELDS, $data );


	$return = curl_exec ( $ch );


	curl_close ( $ch );


	return $return;


}





function appKey($apiId, $time, $secretkey, $get, $post) {


	$array = array('m', 'c', 'a', 'windidkey', 'clientid', 'time', '_json', 'jcallback', 'csrf_token', 'Filename', 'Upload', 'token');


	$str = '';


	ksort($get);


	ksort($post);


	foreach ($get AS $k=>$v) {


		if (in_array($k, $array)) continue;


		$str .=$k.$v;


	}


	foreach ($post AS $k=>$v) {


		if (in_array($k, $array)) continue;


		$str .=$k.$v;


	}


	return md5(md5($apiId.'||'.$secretkey).$time.$str);


		


}





?>