7B2 PRO主题5.2.0版本hosts方式绕过方法

1.www下新建7b2目录, 添加index.php文件:

<?php
$url = $_SERVER['REQUEST_URI'];

header('Content-Type: application/json; charset=UTF-8');

if(strpos($url, '/check/verify') !== false){
    if(empty($_POST['d']) || empty($_POST['u']) || empty($_POST['t'])) exit('0');
    $str = $_POST['t'].'.b2_token_token'.$_POST['u'].$_POST['d'];
    $encstr = authcode($str, 'ENCODE', $_POST['t']);
    $encstr = base64_encode($encstr);
    $encarr = str_split($encstr);
    $saltarr = str_split('b2file');
    for($i=0;$i<count($saltarr);$i++){
        $encarr[$i] = $encarr[$i].$saltarr[$i];
    }
    $result = implode('', $encarr);
    exit($result);
}

function authcode($string, $operation = 'DECODE', $key = '', $expiry = 0) {
    $ckey_length = 4;
    $key = md5($key);
    $keya = md5(substr($key, 0, 16));
    $keyb = md5(substr($key, 16, 16));
    $keyc = $ckey_length ? ($operation == 'DECODE' ? substr($string, 0, $ckey_length): substr(md5(microtime()), -$ckey_length)) : '';
    $cryptkey = $keya.md5($keya.$keyc);
    $key_length = strlen($cryptkey);
    $string = $operation == 'DECODE' ? base64_decode(substr($string, $ckey_length)) : sprintf('%010d', $expiry ? $expiry + time() : 0).substr(md5($string.$keyb), 0, 16).$string;
    $string_length = strlen($string);
    $result = '';
    $box = range(0, 255);
    $rndkey = array();
    for($i = 0; $i <= 255; $i++) {
        $rndkey[$i] = ord($cryptkey[$i % $key_length]);
    }
    for($j = $i = 0; $i < 256; $i++) {
        $j = ($j + $box[$i] + $rndkey[$i]) % 256;
        $tmp = $box[$i];
        $box[$i] = $box[$j];
        $box[$j] = $tmp;
    }
    for($a = $j = $i = 0; $i < $string_length; $i++) {
        $a = ($a + 1) % 256;
        $j = ($j + $box[$a]) % 256;
        $tmp = $box[$a];
        $box[$a] = $box[$j];
        $box[$j] = $tmp;
        $result .= chr(ord($string[$i]) ^ ($box[($box[$a] + $box[$j]) % 256]));
    }
    if($operation == 'DECODE') {
        if(((int)substr($result, 0, 10) == 0 || (int)substr($result, 0, 10) - time() > 0) && substr($result, 10, 16) == substr(md5(substr($result, 26).$keyb), 0, 16)) {
            return substr($result, 26);
        } else {
            return '';
        }
    } else {
        return $keyc.str_replace('=', '', base64_encode($result));
    }
}

<IfModule mod_rewrite.c>
  Options +FollowSymlinks
  RewriteEngine On

  RewriteCond %{REQUEST_FILENAME} !-d
  RewriteCond %{REQUEST_FILENAME} !-f
  RewriteRule ^(.*)$ index.php/$1 [QSA,PT,L]
</IfModule>

nano /etc/apache2/sites-enabled/000-default.conf
## 添加7b2.com
<VirtualHost *:80>
    ServerAdmin webmaster@localhost
    ServerName 7b2.com
    DocumentRoot /var/www/zibll

    ErrorLog ${APACHE_LOG_DIR}/error.log
    #CustomLog ${APACHE_LOG_DIR}/access.log combined
</VirtualHost>
nano /etc/apache2/sites-enabled/