Skip to content

Commit 9cdf977

Browse files
author
Nathan
authored
Merge pull request #3 from BoLaMN/random-port
get random port for http server
2 parents c24cc76 + 0dc0db3 commit 9cdf977

File tree

3 files changed

+130
-111
lines changed

3 files changed

+130
-111
lines changed

‎package.json

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
{
22
"name": "tch-exploit",
3-
"version": "1.0.7",
3+
"version": "1.0.8",
44
"main": "dist/index.js",
55
"bin": "dist/index.js",
66
"scripts": {

‎src/index.coffee

+115-110
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,7 @@ route = require './router'
2222
cwmp = require './cwmp'
2323
file = require './file'
2424
args = require './args'
25+
http = require './port'
2526

2627
if args.sts
2728
try
@@ -72,125 +73,129 @@ ask (intr) ->
7273
ip.pop()
7374
ip = ip.join '.'
7475

75-
dhcpd
76-
.createServer
77-
range: [
78-
ip + '.10'
79-
ip + '.15'
80-
]
81-
forceOptions: [ 'router', 'hostname', 'vendor' ]
82-
randomIP: true
83-
vendor: [
84-
1,
85-
18,
86-
104,
87-
116,
88-
116,
89-
112,
90-
58,
91-
47,
92-
47,
93-
53,
94-
56,
95-
46,
96-
49,
97-
54,
98-
50,
99-
46,
100-
48,
101-
46,
102-
49,
103-
47,
104-
2,
105-
7,
106-
84,
107-
101,
108-
108,
109-
115,
110-
116,
111-
114,
112-
97
113-
]
114-
netmask: '255.255.255.0'
115-
router: [ ip + '.1' ]
116-
hostname: 'second.gateway'
117-
broadcast: ip + '.255'
118-
#bootFile: args.bootp
119-
server: ip + '.1'
120-
.on 'message', (data) ->
121-
console.log '### MESSAGE', JSON.stringify data
122-
.on 'bound', (state, ans) ->
123-
console.log '### BOUND', JSON.stringify state
124-
.on 'error', (err, data) ->
125-
return unless data
126-
127-
console.log '!!! ERROR', err, data
128-
.listen 67
129-
130-
route
131-
.get '/file.sts', (req, res) ->
132-
console.log '>>> STS REQUEST'
133-
134-
file = file.custom or file.sts
135-
136-
headers =
137-
'Content-Type': 'text/plain'
138-
'Content-Length': file.length
139-
140-
console.log '>>> STS RESPONSE'
141-
console.dir [headers, file.toString('utf8')]
142-
143-
res.writeHead 200, headers
144-
145-
stream = new Duplex()
146-
stream.push file
147-
stream.push null
148-
stream.pipe res
149-
.get '/done', (req, res) ->
150-
console.log '>>> WPS CALLBACK'
151-
console.log """\n
152-
All done,
153-
154-
- change network card settings back to dhcp and move the cable back to a lan port
155-
- try ssh connection to the gateways ip (usually 192.168.0.1) with username root and password root (change password immediately with passwd!)
156-
157-
ssh [email protected]"""
158-
159-
setTimeout ->
160-
process.exit 1
161-
, 20000
162-
163-
res.writeHead 200
164-
res.end()
165-
.get '/{rbi}(.*?).rbi', (req, res) ->
166-
console.log '>>> RBI REQUEST'
167-
168-
fp = path.join process.cwd(), req.params.rbi, '.rbi'
169-
170-
if existsSync fp
171-
stats = statSync fp
76+
http().then (port) ->
77+
78+
dhcpd
79+
.createServer
80+
range: [
81+
ip + '.10'
82+
ip + '.15'
83+
]
84+
forceOptions: [ 'router', 'hostname', 'vendor' ]
85+
randomIP: true
86+
vendor: [
87+
1,
88+
18,
89+
104,
90+
116,
91+
116,
92+
112,
93+
58,
94+
47,
95+
47,
96+
53,
97+
56,
98+
46,
99+
49,
100+
54,
101+
50,
102+
46,
103+
48,
104+
46,
105+
49,
106+
47,
107+
2,
108+
7,
109+
84,
110+
101,
111+
108,
112+
115,
113+
116,
114+
114,
115+
97
116+
]
117+
netmask: '255.255.255.0'
118+
router: [ ip + '.1' ]
119+
hostname: 'second.gateway'
120+
broadcast: ip + '.255'
121+
#bootFile: args.bootp
122+
server: ip + '.1'
123+
.on 'listening', (sock, type) ->
124+
address = sock.address()
125+
126+
console.log "Waiting for DHCP#{type} request...", address.address + ':' + address.port
127+
.on 'message', (data) ->
128+
console.log '### MESSAGE', JSON.stringify data
129+
.on 'bound', (state, ans) ->
130+
console.log '### BOUND', JSON.stringify state
131+
.on 'error', (err, data) ->
132+
return unless data
133+
134+
console.log '!!! ERROR', err, data
135+
.listen 67
136+
137+
route
138+
.get '/file.sts', (req, res) ->
139+
console.log '>>> STS REQUEST'
140+
141+
file = file.custom or file.sts
172142

173143
headers =
174144
'Content-Type': 'text/plain'
175-
'Content-Length': stats.size
145+
'Content-Length': file.length
176146

177-
stream = createReadStream fp
178-
179-
console.log '>>> RBI RESPONSE'
180-
console.dir [headers, fp]
147+
console.log '>>> STS RESPONSE'
148+
console.dir [headers, file.toString('utf8')]
181149

182150
res.writeHead 200, headers
151+
152+
stream = new Duplex()
153+
stream.push file
154+
stream.push null
183155
stream.pipe res
184-
else
185-
res.writeHead 404
156+
.get '/done', (req, res) ->
157+
console.log '>>> WPS CALLBACK'
158+
console.log """\n
159+
All done,
160+
161+
- change network card settings back to dhcp and move the cable back to a lan port
162+
- try ssh connection to the gateways ip (usually 192.168.0.1) with username root and password root (change password immediately with passwd!)
163+
164+
ssh [email protected]"""
165+
166+
setTimeout ->
167+
process.exit 1
168+
, 20000
169+
170+
res.writeHead 200
171+
res.end()
172+
.get '/{rbi}(.*?).rbi', (req, res) ->
173+
console.log '>>> RBI REQUEST'
174+
175+
fp = path.join process.cwd(), req.params.rbi, '.rbi'
176+
177+
if existsSync fp
178+
stats = statSync fp
179+
180+
headers =
181+
'Content-Type': 'text/plain'
182+
'Content-Length': stats.size
183+
184+
stream = createReadStream fp
185+
186+
console.log '>>> RBI RESPONSE'
187+
console.dir [headers, fp]
186188

187-
.post '/', cwmp(intr.ip)
189+
res.writeHead 200, headers
190+
stream.pipe res
191+
else
192+
res.writeHead 404
188193

189-
srv = createServer route
190-
srv.keepAliveTimeout = 30000
194+
.post '/', cwmp(intr.ip + ':' + port)
191195

192-
srv.listen 80, intr.ip
196+
srv = createServer route
197+
srv.keepAliveTimeout = 30000
193198

194-
readline.close()
199+
srv.listen port, intr.ip
195200

196-
console.log 'Waiting for DHCP request... ', intr.ip
201+
readline.close()

‎src/port.coffee

+14
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
net = require 'net'
2+
3+
module.exports = ->
4+
new Promise (resolve, reject) ->
5+
server = net.createServer()
6+
server.unref()
7+
8+
server.on 'error', reject
9+
10+
server.listen 0, ->
11+
port = server.address().port
12+
13+
server.close ->
14+
resolve port

0 commit comments

Comments
 (0)