GPT Plus 订阅漏洞深度分析 - Google Play Billing 鉴权缺失导致 0 元订阅

{
 "eligible_promo_campaigns": {
 "plus": {
 "id": "plus-1-month-free",
 "metadata": {
 "plan_name": "chatgptplusplan",
 "title": "linux.do",
 "summary": "你已获得 1 个月的 Plus 套餐优惠促销代码。",
 "discount": {
 "percentage": 100
 },
 "credit_grant": null,
 "duration": {
 "num_periods": 1,
 "period": "month"
 },
 "schedule": null,
 "price_period": "recurring",
 "promotion_type": "discount",
 "promotion_type_label": "1-month free trial",
 "no_auto_renewal_at_discount_end": true,
 "plan_type_change": null
 }
 }
 }
}

{
 "fetch_token": "xxxx",
 ...
}

/**
 * GPT Plus 免费订阅 Hook 脚本 - 简化版
 * 用途：Hook Google Play Billing，直接替换 offerToken 为免费试用
 * 
 * 使用方法：
 * 1. 手机 Root 并安装 Magisk
 * 2. 推送 frida-server 到手机并运行
 * 3. 电脑端运行：frida -U -f com.openai.chatgpt -l hook.js
 * 4. 在 ChatGPT App 中点击订阅
 * 5. 自动替换为免费试用，扣费 0 元
 */

"use strict";

// 配置区域：免费试用 offerToken（GPT Plus 1 个月）
var OFFER_TOKEN = "AdummIvzNOk965s/0UOf08hi8zE1QBQA0qHs28TasLNjkP+H9peebMqSzAJF85XTHZsGLhCLb8sUqKa79ScsbZ1UI8MnOiU9VvkCLLFXKQHE1K9KRT9pYVT2qZz0SC9N9IEs3jhI+hkaTkvc/Vc=";

var _keepAlive = setInterval(function() {}, 1000);
function log(msg) { console.log("[GPT] " + msg); }

Java.perform(function() {
 log("启动 — 注入 plus-1-month-free-trial");

 // SSL 解除（防止证书验证失败）
 try {
 var TM = Java.use("com.android.org.conscrypt.TrustManagerImpl");
 TM.checkTrustedRecursive.overload(
 "[Ljava.security.cert.X509Certificate;", "java.net.Socket",
 "boolean", "boolean", "boolean",
 "java.util.Collection", "java.util.Collection"
 ).implementation = function() { return Java.use("java.util.ArrayList").$new(); };
 } catch(_) {}

 try {
 Java.use("android.security.net.config.NetworkSecurityTrustManager")
 .checkPins.implementation = function() {};
 } catch(_) {}

 try {
 Java.use("android.net.http.X509TrustManagerExtensions")
 .checkServerTrusted.overload(
 "[Ljava.security.cert.X509Certificate;",
 "java.lang.String", "java.lang.String"
 ).implementation = function() { return Java.use("java.util.ArrayList").$new(); };
 } catch(_) {}

 // 注入 offerToken（Bundle 层）
 var JStr = Java.use("java.lang.String");
 try {
 var Bundle = Java.use("android.os.Bundle");
 Bundle.putStringArrayList
 .overload("java.lang.String", "java.util.ArrayList")
 .implementation = function(key, value) {
 if ((key === "SKU_OFFER_ID_TOKEN_LIST" ||
 key === "OFFER_ID_TOKEN_LIST") && value) {
 for (var i = 0; i < value.size(); i++)
 value.set(i, JStr.$new(OFFER_TOKEN));
 log("offerToken 已注入");
 }
 return this.putStringArrayList(key, value);
 };
 } catch(_) {}

 // 注入 offerToken（JSONObject 层）
 try {
 var JSONObj = Java.use("org.json.JSONObject");
 JSONObj.$init.overload("java.lang.String").implementation = function(s) {
 if (s && s.indexOf("oai.chatgpt.plus") !== -1 &&
 s.indexOf("offerToken") !== -1) {
 var patched = s.replace(
 /"offerToken"\s*:\s*"[^"]+"/g,
 '"offerToken":"' + OFFER_TOKEN + '"'
 );
 return this.$init(patched);
 }
 return this.$init(s);
 };
 } catch(_) {}

 log("就绪。请在 ChatGPT 中点击订阅按钮。");
});

// Dynamic offerToken — 1 MONTH FREE Plus trial
Java.perform(function () {
 console.log('[*] plus-1-month-free-trial');
 var TARGET_OFFER_ID = "plus-1-month-free-trial";

 var capturedToken = null;

 function scanC3qInstances() {
 try {
 Java.choose('c3q', {
 onMatch: function (inst) {
 try {
 var clazz = inst.getClass();
 var bF = clazz.getDeclaredField('b'); bF.setAccessible(true);
 var cF = clazz.getDeclaredField('c'); cF.setAccessible(true);
 var offerId = bF.get(inst);
 var offerToken = cF.get(inst);
 var oidStr = (offerId === null) ? '(default)' : ('' + offerId);
 var tokStr = (offerToken === null) ? 'null' : ('' + offerToken);
 if (tokStr.indexOf('Adumm') === 0 && oidStr === TARGET_OFFER_ID) {
 capturedToken = tokStr;
 console.log(' >>> FOUND ' + TARGET_OFFER_ID + ' <<<');
 }
 } catch (e) {}
 },
 onComplete: function () {}
 });
 } catch (e) {}
 }

 setInterval(function () {
 if (!capturedToken) Java.perform(scanC3qInstances);
 }, 3000);

 var Intent = Java.use('android.content.Intent');
 var Bundle = Java.use('android.os.Bundle');

 function maybeSwap(orig, ctx) {
 if (!orig || orig.indexOf('Adumm') !== 0) return orig;
 if (!capturedToken) Java.perform(scanC3qInstances);
 if (capturedToken) {
 console.log('[' + ctx + '] SWAP -> ' + TARGET_OFFER_ID);
 return capturedToken;
 }
 return orig;
 }

 Intent.putExtra.overload('java.lang.String', 'java.lang.String').implementation = function (k, v) {
 return this.putExtra(k, (v && v.indexOf && v.indexOf('Adumm') === 0) ? maybeSwap(v, 'Intent') : v);
 };
 Bundle.putString.implementation = function (k, v) {
 return this.putString(k, (v && v.indexOf && v.indexOf('Adumm') === 0) ? maybeSwap(v, 'Bundle') : v);
 };
 Bundle.putStringArrayList.implementation = function (k, list) {
 try {
 if (list !== null) for (var i = 0; i < list.size(); i++) {
 var v = list.get(i), sv = '' + v;
 if (sv.indexOf('Adumm') === 0) list.set(i, maybeSwap(sv, 'BundleArr'));
 }
 } catch (e) {}
 return this.putStringArrayList(k, list);
 };

 console.log('[+] Open subscription page first.');
});