Реверс роутера Ростелеком Sercomm S1010

#!/usr/bin/env python3
import re, sys, hmac, hashlib, http.cookiejar, urllib.request, urllib.parse, os

HOST = sys.argv[1] if len(sys.argv) > 1 else '192.168.0.1'
USER = sys.argv[2] if len(sys.argv) > 2 else 'admin'
PASS = sys.argv[3] if len(sys.argv) > 3 else '***'
BASE = f'http://{HOST}'

ARTIFACTS = '/root/router/artifacts'
os.makedirs(ARTIFACTS, exist_ok=True)

cj = http.cookiejar.CookieJar()
op = urllib.request.build_opener(urllib.request.HTTPCookieProcessor(cj))

UA = ('Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 '
      '(KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36')
HDRS = {
    'User-Agent': UA,
    'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8',
    'Accept-Language': 'en-US,en;q=0.9',
    'Accept-Encoding': 'identity',
    'Connection': 'close',
}

def save(name, content):
    path = os.path.join(ARTIFACTS, name)
    with open(path, 'w', encoding='utf-8', errors='replace') as f:
        f.write(content)
    print(f'[+] saved {name}')

def get(url, save_as=None):
    r = op.open(urllib.request.Request(url, headers=HDRS), timeout=10)
    content = r.read().decode('latin1')
    if save_as:
        save(save_as, content)
    return content

def post(url, data, save_as=None):
    h = dict(HDRS)
    h['Content-Type'] = 'application/x-www-form-urlencoded'
    req = urllib.request.Request(url, data=data.encode(), headers=h)
    r = op.open(req, timeout=10)
    content = r.read().decode('latin1')
    if save_as:
        save(save_as, content)
    return content

html = get(f'{BASE}/login.html', save_as='login.html')
m = re.search(r"csrf_token = '([^']+)'", html)
csrf = m.group(1)
print(f'[+] csrf_token = {csrf}')

j = get(f'{BASE}/data/user_lang.json?csrf_token={csrf}', save_as='user_lang.json')
enc = re.search(r'"encryption_key":\s*"([^"]+)"', j).group(1)
print(f'[+] encryption_key = {enc}')

h1 = hmac.new(b'$1$SERCOMM$', PASS.encode('utf-8'), hashlib.sha256).hexdigest()
pwd = hmac.new(enc.encode(), h1.encode(), hashlib.sha256).hexdigest()
uname = urllib.parse.quote(urllib.parse.quote(USER, safe=''), safe='')
body = f'LoginName={uname}&LoginPWD={pwd}'
print(f'[+] hash1 = {h1}')
print(f'[+] LoginPWD = {pwd}')

url = f'{BASE}/data/login.json?_={urllib.parse.quote("0.0")}&csrf_token={csrf}'
resp = post(url, body, save_as='login_response.txt')
print(f'[+] login response: {resp!r}')
print('[+] cookies:', [(c.name, c.value) for c in cj])

#!/usr/bin/env python3
import re, hmac, hashlib, http.cookiejar, urllib.request, time, zlib, struct

BASE = 'http://192.168.0.1'
USER = 'admin'
PASS = '***'
UA = 'Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 Chrome/120 Safari/537.36'

H = {
    'User-Agent': UA,
    'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8',
    'Accept-Language': 'en-US,en;q=0.9',
    'Accept-Encoding': 'identity',
    'Connection': 'close',
}

cj = http.cookiejar.CookieJar()
op = urllib.request.build_opener(urllib.request.HTTPCookieProcessor(cj))

# 1. login.html -> csrf
h = op.open(urllib.request.Request(BASE + '/login.html', headers=H)).read().decode('latin1')
csrf = re.search(r"csrf_token = '([^']+)'", h).group(1)
print('csrf_token =', csrf)

# 2. encryption_key
j = op.open(urllib.request.Request(
    BASE + f'/data/user_lang.json?csrf_token={csrf}',
    headers={**H, 'Referer': BASE + '/login.html'}
)).read().decode()
enc = re.search(r'"encryption_key":\s*"([^"]+)"', j).group(1)
print('encryption_key =', enc)

# 3. Loginpwd
h1 = hmac.new(b'$1$SERCOMM$', PASS.encode(), hashlib.sha256).hexdigest()
pwd = hmac.new(enc.encode(), h1.encode(), hashlib.sha256).hexdigest()
print('LoginPWD =', pwd)

# 4. login
body = f'LoginName={USER}&LoginPWD={pwd}'.encode()
req = urllib.request.Request(
    BASE + f'/data/login.json?csrf_token={csrf}',
    data=body,
    headers={**H, 'Content-Type': 'application/x-www-form-urlencoded',
             'Referer': BASE + '/login.html'}
)
r = op.open(req).read()
print('login response =', r)

# 5. используем тот же csrf, что и при логине
print('using same csrf_token =', csrf)

# 6. post для бэкапа
ts = int(time.time() * 1000)
body = b'ConfigurationSaveType=user_computer'
req = urllib.request.Request(
    BASE + f'/data/settings_configuration.json?_={ts}&csrf_token={csrf}',
    data=body,
    headers={**H, 'Content-Type': 'application/x-www-form-urlencoded',
             'Referer': BASE + '/settings_configuration.html'}
)
r = op.open(req).read()
print('POST response =', r)

# 7. get скачивание
ts = int(time.time() * 1000)
req = urllib.request.Request(
    BASE + f'/settings_page/configurationBackup.cfg?_={ts}&csrf_token={csrf}',
    headers={**H, 'Referer': BASE + '/settings_configuration.html'}
)
r = op.open(req).read()
print('downloaded bytes =', len(r))

open('configurationBackup.cfg', 'wb').write(r)

# 8. распоковка
declared = struct.unpack('<I', r[:4])[0]
print('declared length =', declared)
xml = zlib.decompress(r[4:])
open('configurationBackup.xml', 'wb').write(xml)
print('XML size =', len(xml))

# 9. секреты
print()
for line in xml.decode('utf-8', errors='replace').split('\n'):
    if any(x in line for x in ['Password', 'KeyPassphrase', 'ConnectionRequest', 'Username', 'CustomPassword']):
        print(line.strip())