![image](https://private-user-images.githubusercontent.com/38202442/267937960-a7a198da-0662-4daf-961a-2f3c7f60c6bb.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjI3MzE4NjYsIm5iZiI6MTcyMjczMTU2NiwicGF0aCI6Ii8zODIwMjQ0Mi8yNjc5Mzc5NjAtYTdhMTk4ZGEtMDY2Mi00ZGFmLTk2MWEtMmYzYzdmNjBjNmJiLnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNDA4MDQlMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjQwODA0VDAwMzI0NlomWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPTFhMmI3MmQxMzY5M2QwODJmYmU1ZTFmNGRkNjJmZmJiMGVkOGQzYTI2ODM2OTVlYjliOGU4NjI0NDlkYWI5MTAmWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0wIn0.1yBuXswJ1-mK03bW6ij-mOBagXlh1zpdmiaeDMBLpFM)
![image](https://private-user-images.githubusercontent.com/38202442/267534121-8f4369fe-867f-4791-845e-38edf6104796.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjI3MzE4NjYsIm5iZiI6MTcyMjczMTU2NiwicGF0aCI6Ii8zODIwMjQ0Mi8yNjc1MzQxMjEtOGY0MzY5ZmUtODY3Zi00NzkxLTg0NWUtMzhlZGY2MTA0Nzk2LnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNDA4MDQlMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjQwODA0VDAwMzI0NlomWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPWZiM2ZmMWE0Yzg2NzBiY2VmNGQ5OWVlZjZjNjg1OTQ1MzQ0MGQwOGU0MzMzOTk2MDk3Njg1NDliN2I2ZDJiZDAmWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0wIn0.QkdqkVoNJJSNKEkDUu9n5LVhPh-sTVRqQ5nHuqfnB2U)
期望是针对互联网各大API泄露的利用工具,包含钉钉、企业微信、飞书等。目前只做出了钉钉和企业微信,别问,就是懒。特别鸣谢chatgpt,代码好帮手。 目前界面长这样,布局拉胯,能用就行。
![image](https://private-user-images.githubusercontent.com/38202442/267281613-1b77da79-bcef-424e-a3f2-8d544696b2e3.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjI3MzE4NjYsIm5iZiI6MTcyMjczMTU2NiwicGF0aCI6Ii8zODIwMjQ0Mi8yNjcyODE2MTMtMWI3N2RhNzktYmNlZi00MjRlLWEzZjItOGQ1NDQ2OTZiMmUzLnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNDA4MDQlMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjQwODA0VDAwMzI0NlomWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPTM4YjY5YjE0OGUwOGYzMWY1N2Q4MzIyODkwYWJjMDRjZDgxN2VjNTFmN2NhMzY0NjQ3NGYyNjM1MDIwOGFiMzcmWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0wIn0.qf6Pi1_J_RsQWbTwGLC5ZaEuu58qIPxP99qd14zIYN8)
![image](https://private-user-images.githubusercontent.com/38202442/267688080-0ac3ba1a-b780-4515-9d41-a4eff9694506.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjI3MzE4NjYsIm5iZiI6MTcyMjczMTU2NiwicGF0aCI6Ii8zODIwMjQ0Mi8yNjc2ODgwODAtMGFjM2JhMWEtYjc4MC00NTE1LTlkNDEtYTRlZmY5Njk0NTA2LnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNDA4MDQlMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjQwODA0VDAwMzI0NlomWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPWQ4ZWFiMTQ2M2U5NmZmMzM3MmYxNTJlMGUxMjc5NzUzMzkyMmYyODk5MWUzZTA2NmJhMzY1ZWExNGQzZjYyZWQmWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0wIn0.bSKgs83u8tAuJ_MkyVCaNOutIghxZP4QYThs90sbtcc)
最简单的做法,直接填入有效手机号,加入组织中可以直接用手机号登录该企业。 userid不要重了,写大点。 删除按钮是根据userid来删除的
获取管理员信息,得到管理员userid。
查userid可以得到部门id dept_id,这里只做了对部门发公告,实际操作中针对个人发公告效果不如直接加用户钓鱼好使。
进一步可以发公告钓鱼
企业微信相对于钉钉,限制较多,22年后获取的应用Corpsecret需要设置白名单,且无法绕过。并且对于通讯录的Corpsecret需要单独获取。
![image](https://private-user-images.githubusercontent.com/38202442/267279462-a7531ef6-d7a3-4ad3-9441-c8f341d4f091.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjI3MzE4NjYsIm5iZiI6MTcyMjczMTU2NiwicGF0aCI6Ii8zODIwMjQ0Mi8yNjcyNzk0NjItYTc1MzFlZjYtZDdhMy00YWQzLTk0NDEtYzhmMzQxZDRmMDkxLnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNDA4MDQlMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjQwODA0VDAwMzI0NlomWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPTRiNDUzOGFiNWJlYjVhZTRmOTBlYjA2Zjg3NTdmZTI1MWIwNDgwZGM0ZWZlZmVlYjNmNWFkOGJjMzJiMjQyNmMmWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0wIn0.h0zFE5iVTjdT1IkOkrxqwnlv8XWd2ZULyyyMa5eNBrk)
而且加进去就分配邮箱,可通过邮箱和企业微信钓鱼。
![image](https://private-user-images.githubusercontent.com/38202442/267277972-a6696792-4a83-4c1d-8997-260f99900a70.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjI3MzE4NjYsIm5iZiI6MTcyMjczMTU2NiwicGF0aCI6Ii8zODIwMjQ0Mi8yNjcyNzc5NzItYTY2OTY3OTItNGE4My00YzFkLTg5OTctMjYwZjk5OTAwYTcwLnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNDA4MDQlMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjQwODA0VDAwMzI0NlomWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPTg3YTI5Zjk5ZDBhZmU0ZDI0YWM4NGFhYmJkZGJjNWJmNmI0YzE2Y2YzNDM1NzJkNDEzYjhiMTZhMTA4YmViMWEmWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0wIn0.O46AC4S4nhXFJpaBhWwZJkk4w8Ip-D5poIGiFABlNXc)
![image](https://private-user-images.githubusercontent.com/38202442/267278072-cc60e6b7-177b-4c29-b0e9-4c26b8bee14d.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjI3MzE4NjYsIm5iZiI6MTcyMjczMTU2NiwicGF0aCI6Ii8zODIwMjQ0Mi8yNjcyNzgwNzItY2M2MGU2YjctMTc3Yi00YzI5LWIwZTktNGMyNmI4YmVlMTRkLnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNDA4MDQlMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjQwODA0VDAwMzI0NlomWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPWJlMTQ0ZDU4NjU0ZmRjNDc4YmI1NmNhOGRhNjI1YWYxMTMwMjY3NTMyNTU2YzFkNmVkMjkyYTZkZjQxYmNlOTImWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0wIn0.Z-naJ_0EAhK1LN6wsKVMrnIqjg0uJZUErS29LqIxDFU)
![image](https://private-user-images.githubusercontent.com/38202442/267278373-a9203c39-14b2-4ee0-a2e4-6c4b59626893.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjI3MzE4NjYsIm5iZiI6MTcyMjczMTU2NiwicGF0aCI6Ii8zODIwMjQ0Mi8yNjcyNzgzNzMtYTkyMDNjMzktMTRiMi00ZWUwLWEyZTQtNmM0YjU5NjI2ODkzLnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNDA4MDQlMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjQwODA0VDAwMzI0NlomWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPTQwYTQ0NDZkMmRkZmUxOGIzMzE5MjhjNzFkNDA1MTM4ZTE0ZGQ0MzVkNTQ0YmQ1ZmZkY2VlMzg5ZTVlNjg3NDkmWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0wIn0.cQOnuic6rjq3NRNwOu9KSgz_YlwyCM52-UpuUeYrwQU)
实际利用的较少,一般都是劫持cookie做钓鱼用。
需要注意,open_department_id为查询到的部门id,用户默认是放根部门,比较明显。可以放小部门里。
![image](https://private-user-images.githubusercontent.com/38202442/267940075-e6ca4650-d93c-4c5f-b087-7e2ea880f18c.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjI3MzE4NjYsIm5iZiI6MTcyMjczMTU2NiwicGF0aCI6Ii8zODIwMjQ0Mi8yNjc5NDAwNzUtZTZjYTQ2NTAtZDkzYy00YzVmLWIwODctN2UyZWE4ODBmMThjLnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNDA4MDQlMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjQwODA0VDAwMzI0NlomWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPTJjYWUwNjMxMmViYzE5MTIyMDg2ZmUyNzg5NDQ2MDIzZDY3YTRhNjE1N2M3ZDFjYWU4YTk2MTcwNGE1MDBhOWEmWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0wIn0.vekFgRreaDi-1BOq1ojGGqRMQy28nIReCmrPz0jN9Cs)
![image](https://private-user-images.githubusercontent.com/38202442/267939569-90e2b5f4-535e-4ead-a526-6d18d4b4d5ee.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjI3MzE4NjYsIm5iZiI6MTcyMjczMTU2NiwicGF0aCI6Ii8zODIwMjQ0Mi8yNjc5Mzk1NjktOTBlMmI1ZjQtNTM1ZS00ZWFkLWE1MjYtNmQxOGQ0YjRkNWVlLnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNDA4MDQlMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjQwODA0VDAwMzI0NlomWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPWVlYmQ3YjM2NmQzNDViODVmYjQ1ODU5ZjRjMTMwYjdkZGU2NWIzZjEzMDMyZmU2MTgwNjNmZjZhY2Y2YWQzMmEmWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0wIn0.HDIeH17836EiK6lBgm1j5KyFUsiaJ4gReBy4pGTWDjI)