FilesExpand file tree

master

/

test_tendaac15_httpd.py

Copy path

Blame

More file actions

Blame

More file actions

Latest commit

 

History

History

History

108 lines (83 loc) · 3.11 KB

master

/

test_tendaac15_httpd.py

Copy path

Top

File metadata and controls

• Code
• Blame

108 lines (83 loc) · 3.11 KB

Raw

Copy raw file

Download raw file

Open symbols panel

Edit and raw actions

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

64

65

66

67

68

69

70

71

72

73

74

75

76

77

78

79

80

81

82

83

84

85

86

87

88

89

90

91

92

93

94

95

96

97

98

99

100

101

102

103

104

105

106

107

108

#!/usr/bin/env python3

#

# Cross Platform and Multi Architecture Advanced Binary Emulation Framework

# Built on top of Unicorn emulator (www.unicorn-engine.org)

# 1. Download AC15 Firmware from https://down.tenda.com.cn/uploadfile/AC15/US_AC15V1.0BR_V15.03.05.19_multi_TD01.zip

# 2. unzip

# 3. binwalk -e US_AC15V1.0BR_V15.03.05.19_multi_TD01.bin

# 4. locate squashfs-root

# 5. rm -rf webroot && mv webroot_ro webroot

#

# notes: we are using rootfs in this example, so rootfs = squashfs-root

#

import http.client

import json

import os

import socket

import sys

import time

import threading

import unittest

sys.path.append("..")

from qiling import Qiling

from qiling.const import QL_VERBOSE

class ELFTest(unittest.TestCase):

def test_tenda_ac15_arm(self):

def nvram_listener():

server_address = '../examples/rootfs/arm_tendaac15/var/cfm_socket'

try:

os.unlink(server_address)

except OSError:

if os.path.exists(server_address):

raise

# Create UDS socket

sock = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)

sock.bind(server_address)

sock.listen(1)

data = bytearray()

connection, _ = sock.accept()

try:

while True:

data += connection.recv(1024)

if b"lan.webiplansslen" in data:

connection.send(b'192.168.170.169')

else:

break

data.clear()

finally:

connection.close()

def patcher(ql: Qiling):

br0_addr = ql.mem.search(b'br0\x00')

for addr in br0_addr:

ql.mem.write(addr, b'lo\x00')

def my_tenda():

ql = Qiling(["../examples/rootfs/arm_tendaac15/bin/httpd"], "../examples/rootfs/arm_tendaac15", verbose=QL_VERBOSE.DEBUG)

ql.add_fs_mapper("/dev/urandom", "/dev/urandom")

ql.hook_address(patcher, ql.loader.elf_entry)

ql.run(count=825000)

if __name__ == "__main__":

threads = [

threading.Thread(target=nvram_listener, daemon=True),

threading.Thread(target=my_tenda, daemon=True)

]

for th in threads:

th.start()

time.sleep(5)

headers = {

'X-Requested-With': 'XMLHttpRequest',

'Content-Type': 'application/x-www-form-urlencoded'

}

web_data = {

'page': 'CCCCAAAA',

'entrys': 'sync'

}

json_data = json.dumps(web_data)

conn = http.client.HTTPConnection('localhost', 8080, timeout=10)

conn.request('POST', '/goform/addressNat', json_data, headers)

response = conn.getresponse()

self.assertIn(b"Please update your documents to reflect the new location.", response.read())

for th in threads:

th.join(timeout=20.0)

self.assertFalse(th.is_alive())

if __name__ == "__main__":

unittest.main()