GPT Plus 订阅漏洞深度分析 - Google Play Billing 鉴权缺失导致 0 元订阅

1
{
2
  "eligible_promo_campaigns": {
3
    "plus": {
4
      "id": "plus-1-month-free",
5
      "metadata": {
6
        "plan_name": "chatgptplusplan",
7
        "title": "linux.do",
8
        "summary": "你已获得 1 个月的 Plus 套餐优惠促销代码。",
9
        "discount": {
10
          "percentage": 100
11
        },
12
        "credit_grant": null,
13
        "duration": {
14
          "num_periods": 1,
15
          "period": "month"
16
        },
17
        "schedule": null,
18
        "price_period": "recurring",
19
        "promotion_type": "discount",
20
        "promotion_type_label": "1-month free trial",
21
        "no_auto_renewal_at_discount_end": true,
22
        "plan_type_change": null
23
      }
24
    }
25
  }
26
}

1
/**
2
 * GPT Plus 免费订阅 Hook 脚本 - 简化版
3
 * 用途：Hook Google Play Billing，直接替换 offerToken 为免费试用
4
 *
5
 * 使用方法：
6
 * 1. 手机 Root 并安装 Magisk
7
 * 2. 推送 frida-server 到手机并运行
8
 * 3. 电脑端运行：frida -U -f com.openai.chatgpt -l hook.js
9
 * 4. 在 ChatGPT App 中点击订阅
10
 * 5. 自动替换为免费试用，扣费 0 元
11
 */
12

13
"use strict";
14

15
// 配置区域：免费试用 offerToken（GPT Plus 1 个月）
16
var OFFER_TOKEN = "AdummIvzNOk965s/0UOf08hi8zE1QBQA0qHs28TasLNjkP+H9peebMqSzAJF85XTHZsGLhCLb8sUqKa79ScsbZ1UI8MnOiU9VvkCLLFXKQHE1K9KRT9pYVT2qZz0SC9N9IEs3jhI+hkaTkvc/Vc=";
17

18
var _keepAlive = setInterval(function() {}, 1000);
19
function log(msg) { console.log("[GPT] " + msg); }
20

21
Java.perform(function() {
22
    log("启动 — 注入 plus-1-month-free-trial");
23

24
    // SSL 解除（防止证书验证失败）
25
    try {
26
        var TM = Java.use("com.android.org.conscrypt.TrustManagerImpl");
27
        TM.checkTrustedRecursive.overload(
28
            "[Ljava.security.cert.X509Certificate;", "java.net.Socket",
29
            "boolean", "boolean", "boolean",
30
            "java.util.Collection", "java.util.Collection"
31
        ).implementation = function() { return Java.use("java.util.ArrayList").$new(); };
32
    } catch(_) {}
33

34
    try {
35
        Java.use("android.security.net.config.NetworkSecurityTrustManager")
36
            .checkPins.implementation = function() {};
37
    } catch(_) {}
38

39
    try {
40
        Java.use("android.net.http.X509TrustManagerExtensions")
41
            .checkServerTrusted.overload(
42
                "[Ljava.security.cert.X509Certificate;",
43
                "java.lang.String", "java.lang.String"
44
            ).implementation = function() { return Java.use("java.util.ArrayList").$new(); };
45
    } catch(_) {}
46

47
    // 注入 offerToken（Bundle 层）
48
    var JStr = Java.use("java.lang.String");
49
    try {
50
        var Bundle = Java.use("android.os.Bundle");
51
        Bundle.putStringArrayList
52
            .overload("java.lang.String", "java.util.ArrayList")
53
            .implementation = function(key, value) {
54
                if ((key === "SKU_OFFER_ID_TOKEN_LIST" ||
55
                     key === "OFFER_ID_TOKEN_LIST") && value) {
56
                    for (var i = 0; i < value.size(); i++)
57
                        value.set(i, JStr.$new(OFFER_TOKEN));
58
                    log("offerToken 已注入");
59
                }
60
                return this.putStringArrayList(key, value);
61
            };
62
    } catch(_) {}
63

64
    // 注入 offerToken（JSONObject 层）
65
    try {
66
        var JSONObj = Java.use("org.json.JSONObject");
67
        JSONObj.$init.overload("java.lang.String").implementation = function(s) {
68
            if (s && s.indexOf("oai.chatgpt.plus") !== -1 &&
69
                s.indexOf("offerToken") !== -1) {
70
                var patched = s.replace(
71
                    /"offerToken"\s*:\s*"[^"]+"/g,
72
                    '"offerToken":"' + OFFER_TOKEN + '"'
73
                );
74
                return this.$init(patched);
75
            }
76
            return this.$init(s);
77
        };
78
    } catch(_) {}
79

80
    log("就绪。请在 ChatGPT 中点击订阅按钮。");
81
});

1
// Dynamic offerToken — 1 MONTH FREE Plus trial
2
Java.perform(function () {
3
    console.log('[*] plus-1-month-free-trial');
4
    var TARGET_OFFER_ID = "plus-1-month-free-trial";
5

6
    var capturedToken = null;
7

8
    function scanC3qInstances() {
9
        try {
10
            Java.choose('c3q', {
11
                onMatch: function (inst) {
12
                    try {
13
                        var clazz = inst.getClass();
14
                        var bF = clazz.getDeclaredField('b'); bF.setAccessible(true);
15
                        var cF = clazz.getDeclaredField('c'); cF.setAccessible(true);
16
                        var offerId = bF.get(inst);
17
                        var offerToken = cF.get(inst);
18
                        var oidStr = (offerId === null) ? '(default)' : ('' + offerId);
19
                        var tokStr = (offerToken === null) ? 'null' : ('' + offerToken);
20
                        if (tokStr.indexOf('Adumm') === 0 && oidStr === TARGET_OFFER_ID) {
21
                            capturedToken = tokStr;
22
                            console.log('  >>> FOUND ' + TARGET_OFFER_ID + ' <<<');
23
                        }
24
                    } catch (e) {}
25
                },
26
                onComplete: function () {}
27
            });
28
        } catch (e) {}
29
    }
30

31
    setInterval(function () {
32
        if (!capturedToken) Java.perform(scanC3qInstances);
33
    }, 3000);
34

35
    var Intent = Java.use('android.content.Intent');
36
    var Bundle = Java.use('android.os.Bundle');
37

38
    function maybeSwap(orig, ctx) {
39
        if (!orig || orig.indexOf('Adumm') !== 0) return orig;
40
        if (!capturedToken) Java.perform(scanC3qInstances);
41
        if (capturedToken) {
42
            console.log('[' + ctx + '] SWAP -> ' + TARGET_OFFER_ID);
43
            return capturedToken;
44
        }
45
        return orig;
46
    }
47

48
    Intent.putExtra.overload('java.lang.String', 'java.lang.String').implementation = function (k, v) {
49
        return this.putExtra(k, (v && v.indexOf && v.indexOf('Adumm') === 0) ? maybeSwap(v, 'Intent') : v);
50
    };
51
    Bundle.putString.implementation = function (k, v) {
52
        return this.putString(k, (v && v.indexOf && v.indexOf('Adumm') === 0) ? maybeSwap(v, 'Bundle') : v);
53
    };
54
    Bundle.putStringArrayList.implementation = function (k, list) {
55
        try {
56
            if (list !== null) for (var i = 0; i < list.size(); i++) {
57
                var v = list.get(i), sv = '' + v;
58
                if (sv.indexOf('Adumm') === 0) list.set(i, maybeSwap(sv, 'BundleArr'));
59
            }
60
        } catch (e) {}
61
        return this.putStringArrayList(k, list);
62
    };
63

64
    console.log('[+] Open subscription page first.');
65
});