#!/usr/bin/env python from httplib2 import Http from md5 import md5 import re from urllib import urlencode URL = 'http://192.168.88.1/login' output = '/tmp/login.html' salt_pattern = '\\\\\d*' h = Http() def truncate_file(file): f = open(file, 'w+') for line in f.readlines(): line = line.replace(line, '') f.writelines(line) f.flush() print 'file: "%s" truncated' % f.name def extract_salt(file): f = open(file, 'r') li = '' for line in f.readlines(): if line.find('hexMD5') != -1: li = line break r = re.compile("\\\\\d*") salt = r.findall(li) if not salt: print 'seems to be already logged in' exit() x = chr(int(salt[0][1:], 8)) rest = salt[1:] y = ''.join(chr(int(d[1:], 8)) for d in rest) return x, y def login(username, password): data = {'username':username, 'password':password, 'dst':'', 'popup':'true'} payload = urlencode(data) headers = {} headers.update({'Content-Type':'application/x-www-form-urlencoded'}) response, _ = h.request(URL, method='POST', body=payload, headers=headers) assert(response.status==200) try: response['set-cookie'] response['set-cookie'] except KeyError: raise Exception('Login Failed') def main(): import sys argz = sys.argv[1:] try: username = argz[0] password = argz[1] except Exception: print 'could not parse arguments\nusage: python main.py username password' exit() response, content = h.request(URL) assert(response.status==200) truncate_file(output) f = open(output, 'w') f.write(content) f.flush() x, y = extract_salt(output) salted = x + password + y # print 'salted password: %s' % salted hashed_password = md5(salted) hex_hash_password = hashed_password.hexdigest() print 'hashed password: %s' % hex_hash_password login(username, hex_hash_password) print 'Successfully logged in ;)' if __name__ == '__main__': main()