HUST-WIRELESS自动登录/登出脚本 ; 论野生技术&二次元

这里有编译好的win32程序http://t.cn/zQAJ6do

研究了下HUST WIRELESS的网页登录；抓了几个包看了下，后台是锐捷的SAM无误，界面的js竟然用的是中国移动的-。-

工作方式很诡异：

访问任意网址时AP返回一个页面，用js跳转到index.jsp；通过GET方式提交了一堆参数，大概是SHA1过的，大概还是加了盐的，反正没试出来；嘛，╮(╯-╰)╭

<script>self.location.href='http://172.18.18.35/eportal/index.jsp?wlanuserip=c46ad9a5e36dc394ffdd85f37470f595&wlanacname=18260f9e92a595cf3d778ed7f6ead8a8&ssid=37ac66ecf843a939bdf3991faaee1a4c&nasip=8df3b80e79b397a516656c1e9cf9cb08&mac=e8349ecfc6e6b9de758d2ff9054f6449&t=wireless-v2&url=93b5fca3367a258ead66aae840fda10f'</script>
<HTML xmlns="http://www.w3.org/1999/xhtml">
<HEAD>
<!--
<?xml version="1.0" encoding="UTF-8"?>
<WISPAccessGatewayParam    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="http://www.acmewisp.com/WISPAccessGatewayParam.xsd">
<Proxy>
<MessageType>110</MessageType>
<NextURL>http://172.18.18.35/eportal/index.jsp?wlanuserip=c46ad9a5e36dc394ffdd85f37470f595&wlanacname=18260f9e92a595cf3d778ed7f6ead8a8&ssid=37ac66ecf843a939bdf3991faaee1a4c&nasip=8df3b80e79b397a516656c1e9cf9cb08&mac=e8349ecfc6e6b9de758d2ff9054f6449&t=wireless-v2&url=93b5fca3367a258ead66aae840fda10f</NextURL>
<ResponseCode>200</ResponseCode>
</Proxy>
</WISPAccessGatewayParam>
-->
</HEAD>
<BODY>
<input type="hidden" name="wlanacname" value="Ruijie_Ac_001aa9">
<input type="hidden" name="wlanuserip" value="10.10.50.167">
<input type="hidden" name="portalurl" value="http://172.18.18.35/eportal/index.jsp">
</BODY>
</HTML>

<HEAD>

<!--

<?xml version="1.0" encoding="UTF-8"?>

<Proxy>

<NextURL>http://172.18.18.35/eportal/index.jsp?wlanuserip=c46ad9a5e36dc394ffdd85f37470f595&wlanacname=18260f9e92a595cf3d778ed7f6ead8a8&ssid=37ac66ecf843a939bdf3991faaee1a4c&nasip=8df3b80e79b397a516656c1e9cf9cb08&mac=e8349ecfc6e6b9de758d2ff9054f6449&t=wireless-v2&url=93b5fca3367a258ead66aae840fda10f</NextURL>

</Proxy>

</WISPAccessGatewayParam>

-->

</HEAD>

<BODY>

</BODY>

</HTML>

这个index.jsp再重定向到./eportal/userV2.do?method=login，并且将GET方式传递给index.jsp的参数都以隐藏表单元素的方式藏在了返回的网页里：

<form name="userV2Form" method="post" action="/eportal/userV2.do?method=login" onsubmit="return checkForm();" id="loginForm">
		<input type="hidden" name="wlanuserip" value="1a6ff81049ec892dd2d9e3a55609efe2" id="wlanuserip">
		<input type="hidden" name="wlanacname" value="18260f9e92a595cf3d778ed7f6ead8a8" id="wlanacname">
		<input type="hidden" name="nasip" value="8df3b80e79b397a516656c1e9cf9cb08" id="nasip">
		<input type="hidden" name="url" value="http://www.baidu.com/" id="url">
		<input type="hidden" name="ssid" value="37ac66ecf843a939bdf3991faaee1a4c" id="ssid">
		<input type="hidden" name="mac" value="e8349ecfc6e6b9de758d2ff9054f6449" id="mac">
		<input type="hidden" name="t" value="wireless-v2" id="t">

submit时将隐藏表单元素和用户输入的用户名密码都POST到/eportal/userV2.do?method=login，都特么是明文的0.0，你特么把ip啊mac啊都加密了，用户名密码都特么是明文的搞毛啊(*￣▽￣*)
若登陆成功则返回一个成功结果页，包含一个重定向（貌似用的也是中国移动的），告诉你上线成功

下线是GET方式，提交到./eportal/userV2.do?method=logout，网页提交的只有三个参数（nasip, mac, ），反正我是把上一步隐藏的input里的所有的参数都提交了，好像没出问题- -正常下线了。

finally，python脚本，方便命令行操作，可以加-s保存密码，-c清除保存的密码

窝的python依然写得非常丑，请笑纳www；之所以用httplib2而不是urllib2是因为那个用得不顺手而且不能gzip → →这里用urllib2的版本http://t.cn/zQAJ6do

#!/usr/bin/python
# -*- coding:utf-8 -*-
# HUST-WIRELESS autologin script
# Contributor:
#      fffonion        <fffonion#gmail.com>

import re
import os
import sys
import base64
import getpass
try:
	import httplib2
except:
	raw_input('Error: httplib2 not found.\nTry \'pip install httplib2\' to install, or copy httplib2.pyc to your PYTHON_PATH folder.')
	os._exit(1)
__version__=1.3
uid,pswd,save_pswd='','',False
session_file='.HUST-WIRELESS.session'
id_file='.HUST-WIRELESS.id'
testurl='http://www.baidu.com/'
login_uri='/eportal/userV2.do?method=login'
logout_uri='/eportal/userV2.do?method=logout'
header={'Content-Type':'application/x-www-form-urlencoded'}
#handle sys.argv
if os.path.exists(id_file):
	uid,pswd=base64.decodestring(open(id_file).read()).split(',')
	if pswd!='':
		save_pswd=True
if len(sys.argv)>1:
	if sys.argv[1]=='help' or sys.argv[1]=='-h' or sys.argv[1]=='--help':
		#help message
		print('HUST-WIRELESS login utilty writing in python using httplib2\nUsage:\tloginHUST-WIRELESS.py [-sc]\n\tloginHUST-WIRELESS.py username [-sc]\n\tloginHUST-WIRELESS.py username pswd [-sc]\nArgs:\t-s\tSave password (username is automatically saved)\n\t-c\tClean saved username and password\nNotes:\tSaved pswd is only softly protected, be cautious!\n\tCLI input overrides saved account.')
		os._exit(0)	
	if len(sys.argv)>2 and not sys.argv[2].startswith('-'):
		pswd= sys.argv[2]
	if not sys.argv[1].startswith('-'):#judge if is extra args
		if uid!=sys.argv[1]:#new username?
			pswd=''#clean saved
			uid=sys.argv[1]
	if sys.argv[-1].startswith('-'):
		if 's' in sys.argv[-1]:#save
			save_pswd=True
		if 'c' in sys.argv[-1]:#clean
			if os.path.exists(id_file):
				os.remove(id_file)
				print('Account info deleted.')
			else:
				print('No account info to delete.')
#test some url
ht=httplib2.Http()
resp,ct=ht.request(testurl)
#open('z:\\123.htm','a').write(ct)
# url being wanted is encrypted here, need more research
url=re.findall('self.location.href=\'([^\']+)\'',ct)
if url==[]:
	#logout process
	#read session file
	if not os.path.exists(session_file):
		print('You\'ve connected to Internet, but it seems you are not using HUST-WIRELESS ?')
	else:
		host_url,args=open(session_file,'r').read().split(',')
		#logout
		resp,ct=ht.request('%s%s&%s'%(host_url,logout_uri,args),method='GET')
		if re.findall('window\.location\.replace\("\.\/userV2\.do\?method=goToLogout"\);',ct)!=[]:
			print('Logout succeed!')
			#session no longer avaliable
			if os.path.exists(session_file):
				os.remove(session_file)
else:
	#login process
	url=url[0]
	#split ip and path
	post_url,query_args=url.split('?')
	host_url=post_url.replace('/eportal/index.jsp','')#ip address
	#prompt for input
	uid=uid or raw_input('username >')
	pswd=pswd or getpass.getpass('password for %s >'%uid)
	#save pswd and id
	open(id_file,'w').write(base64.encodestring(','.join([uid,save_pswd and pswd or ''])))
	#POST args without url, we don't need that
	formdata='username=%s&pwd=%s&validcode=no_check&phone=&authorizationCode=&regist_validcode=&phonenum=&regist_validcode_sm='%(uid,pswd)
	#do the POST
	resp,ct=ht.request('%s%s&aram=true&fromHtml=true&userAgentForLogin=0&%s'%(host_url,login_uri,query_args),method='POST',headers=header,body=formdata)
	#test if successful
	cryptarg=re.findall('window.location.replace\("\.\/userV2\.do\?method=goToAuthResult&(\mac\=.+\&wlanuserip\=.+&nasip=.+)\&t',ct)
	if cryptarg!=[]:
		print('Login succeed!')
		#write session args to file for logout
		open(session_file,'w').write(','.join([host_url,cryptarg[0]]))
	else:
		errmsg=re.findall('errorMessage.innerHTML = \'<strong>(.+)</strong>',ct)[0]
		print('Login failed: %s'%errmsg)
if len(sys.argv)==1:
	raw_input('Press Enter to exit...')

#!/usr/bin/python

# -*- coding:utf-8 -*-

# HUST-WIRELESS autologin script

# Contributor:

# fffonion <fffonion#gmail.com>

import re

import os

import sys

import base64

import getpass

try:

import httplib2

except:

raw_input('Error: httplib2 not found.\nTry \'pip install httplib2\' to install, or copy httplib2.pyc to your PYTHON_PATH folder.')

os._exit(1)

__version__=1.3

uid,pswd,save_pswd='','',False

session_file='.HUST-WIRELESS.session'

id_file='.HUST-WIRELESS.id'

testurl='http://www.baidu.com/'

login_uri='/eportal/userV2.do?method=login'

logout_uri='/eportal/userV2.do?method=logout'

header={'Content-Type':'application/x-www-form-urlencoded'}

#handle sys.argv

if os.path.exists(id_file):

uid,pswd=base64.decodestring(open(id_file).read()).split(',')

if pswd!='':

save_pswd=True

if len(sys.argv)>1:

if sys.argv[1]=='help' or sys.argv[1]=='-h' or sys.argv[1]=='--help':

#help message

print('HUST-WIRELESS login utilty writing in python using httplib2\nUsage:\tloginHUST-WIRELESS.py [-sc]\n\tloginHUST-WIRELESS.py username [-sc]\n\tloginHUST-WIRELESS.py username pswd [-sc]\nArgs:\t-s\tSave password (username is automatically saved)\n\t-c\tClean saved username and password\nNotes:\tSaved pswd is only softly protected, be cautious!\n\tCLI input overrides saved account.')

os._exit(0)

if len(sys.argv)>2 and not sys.argv[2].startswith('-'):

pswd= sys.argv[2]

if not sys.argv[1].startswith('-'):#judge if is extra args

if uid!=sys.argv[1]:#new username?

pswd=''#clean saved

uid=sys.argv[1]

if sys.argv[-1].startswith('-'):

if 's' in sys.argv[-1]:#save

save_pswd=True

if 'c' in sys.argv[-1]:#clean

if os.path.exists(id_file):

os.remove(id_file)

print('Account info deleted.')

else:

print('No account info to delete.')

#test some url

ht=httplib2.Http()

resp,ct=ht.request(testurl)

#open('z:\\123.htm','a').write(ct)

# url being wanted is encrypted here, need more research

url=re.findall('self.location.href=\'([^\']+)\'',ct)

if url==[]:

#logout process

#read session file

if not os.path.exists(session_file):

print('You\'ve connected to Internet, but it seems you are not using HUST-WIRELESS ?')

else:

host_url,args=open(session_file,'r').read().split(',')

#logout

resp,ct=ht.request('%s%s&%s'%(host_url,logout_uri,args),method='GET')

if re.findall('window\.location\.replace\("\.\/userV2\.do\?method=goToLogout"\);',ct)!=[]:

print('Logout succeed!')

#session no longer avaliable

if os.path.exists(session_file):

os.remove(session_file)

else:

#login process

url=url[0]

#split ip and path

post_url,query_args=url.split('?')

host_url=post_url.replace('/eportal/index.jsp','')#ip address

#prompt for input

uid=uid or raw_input('username >')

pswd=pswd or getpass.getpass('password for %s >'%uid)

#save pswd and id

open(id_file,'w').write(base64.encodestring(','.join([uid,save_pswd and pswd or ''])))

#POST args without url, we don't need that

formdata='username=%s&pwd=%s&validcode=no_check&phone=&authorizationCode=&regist_validcode=&phonenum=&regist_validcode_sm='%(uid,pswd)

#do the POST

resp,ct=ht.request('%s%s&aram=true&fromHtml=true&userAgentForLogin=0&%s'%(host_url,login_uri,query_args),method='POST',headers=header,body=formdata)

#test if successful

cryptarg=re.findall('window.location.replace\("\.\/userV2\.do\?method=goToAuthResult&(\mac\=.+\&wlanuserip\=.+&nasip=.+)\&t',ct)

if cryptarg!=[]:

print('Login succeed!')

#write session args to file for logout

open(session_file,'w').write(','.join([host_url,cryptarg[0]]))

else:

errmsg=re.findall('errorMessage.innerHTML = \'<strong>(.+)</strong>',ct)[0]

print('Login failed: %s'%errmsg)

if len(sys.argv)==1:

raw_input('Press Enter to exit...')