我是非常厌烦学校校园网的iptable,每次上网都要输入账号密码,而且IP池租期又短才十几分钟。所以我就想有没有什么方法可以跳过这个过程。我一想,POST肯定避免不了的的,如果用电脑去实现这个过程,我特么每次都要开着电脑,我还不如手动输入。我一开始想到用单片机,但是后来发现单片机那几K的运存运行100多K的C程序是不太现实的,主要是我对这种KB级别的内存控制不懂。然后我就想到ARM如何,百度查了一下肯定能运行,而且性能强大。但是淘宝ARM开发板,稍微好一点的开发板都要800多,果断放弃了这个想法。后来很长时间搁置了这个计划。
后来,当我在淘宝搜路由器的时候,我就想路由器有独立mac,能不能通过编程路由器去实现这个过程。搜一下还真有这种路由器,而且还开源的,我直接开心的跳了起来。这个强大的系统就是Openwrt,一个精简版的Linux系统。很开心,因为我对Linux系统之间很友好(毕竟跑过挺长时间的Linux),搭建Linux下的编译环境根本不是问题,因为我笔记本没有安装Linux,于是我下载了Ubuntu16.04发行版,传统模式进入U盘进行安装双系统(Ubuntu安装教程很多,我就不多展示了)。安装完之后,打开终端输入命令安装eclipse,这款优秀的代码编辑工具我就不多说了,接下来安装C/C++编译环境,编译环境配置完之后,我们开始抓包
POST http://172.31.252.71:801/eportal/?c=ACSetting&a=Login&protocol=http:&hostname=172.31.252.71&iTermType=1&wlanuserip=172.27.180.94&wlanacip=192.168.252.254&wlanacname=drcom&mac=d4-5f-25-eb-d0-09&ip=172.27.180.94&session=ac1bb45e-000000000000-0000&enAdvert=0&queryACIP=0&loginMethod=1& HTTP/1.1
Accept: application/x-ms-application, image/jpeg, application/xaml+xml, image/gif, image/pjpeg, application/x-ms-xbap, */*
Referer: http://172.31.252.71/a70.htm?wlanuserip=172.27.180.94&wlanacip=192.168.252.254&wlanacname=drcom&session=ac1bb45e-000000000000-0000&vlanid=7&ip=172.27.180.94&ssid=drcom2&areaID=beijing&mac=00-00-00-00-00-00
Accept-Language: zh-CNUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C; .NET4.0E)
DDDDD=%2C0%2CID&upass=PASSWORD&R1=0&R2=0&R3=0&R6=0¶=00&0MKKey=123456&buttonClicked=&redirect_url=&err_flag=&username=&password=&user=&cmd=&Login=
Content-Type: application/x-www-form-urlencodedAccept-Encoding: gzip, deflateHost: 172.31.252.71:801Content-Length: 157Connection: Keep-AlivePragma: no-cacheCookie: md5_login2=jii7Ith232Yse7hOl805i
上面几处下划线分别是:
①Post的地址以及端口 ②本地mac地址 ③本地ip地址
绿色的那一长串是Post的内容,分别对应ID和Password..
分析完之后我们开始写代码:
#include "stdafx.h"
#include "stdio.h"
#include "stdlib.h"
#include "winsock2.h"
#include <iostream>
#include <httpext.h>
#include <windef.h>
#include <Nb30.h>
#include <string>
#pragma comment(lib,"ws2_32.lib")
#pragma comment(lib,"netapi32.lib")s
using namespace std;
void findIP(char *ip, int size) ;
int getMAC(char * mac);
int main(int argc, char* argv[])
{
char ip[20] = {0};
char mac[30];
findIP(ip, sizeof(ip));
getMAC(mac);
printf("%s\n", ip);
printf("%s\n", mac);
SOCKET hsocket;
SOCKADDR_IN saServer;
WSADATA wsadata;
int nRet;
//char* host_name="www.baidu.com";
char reqHead1[3000]="POST http://172.31.252.71:801/eportal/?c=ACSetting&a=Login&protocol=http:&hostname=172.31.252.71&iTermType=1&wlanuserip=";
strcat(reqHead1,ip);
strcat(reqHead1,"&wlanacip=192.168.252.254&wlanacname=drcom&mac=");
strcat(reqHead1,mac);
strcat(reqHead1,"&ip=");
strcat(reqHead1,ip);
// f8-a9-63-48-be-ef
char *reqHead2="&session=ac1bb3c1-000000000000-0000&enAdvert=0&queryACIP=0&loginMethod=1 HTTP/1.1\r\n"//此为要发送的数据包
"Host: 172.31.252.71:801\r\n"
"Connection: keep-alive\r\n"
"Content-Length: 157\r\n"
"Cache-Control: max-age=0\r\n"
"Origin: http://172.31.252.71\r\n"
"Upgrade-Insecure-Requests: 1\r\n"
"User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 SE 2.X MetaSr 1.0\r\n"
"Content-Type: application/x-www-form-urlencoded\r\n"
"Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8\r\n"
"Accept-Encoding: gzip, deflate\r\n"
"Accept-Language: zh-CN,zh;q=0.8\r\n"
"Cookie: md5_login2=jii7Ith232Yse7hOl805i\r\n"
"\r\n"
"DDDDD=%2C0%2CID&upass=PASSWORD&R1=0&R2=0&R3=0&R6=0¶=00&0MKKey=123456&buttonClicked=&redirect_url=&err_flag=&username=&password=&user=&cmd=&Login=\r\n"
"\r\n";
strcat(reqHead1,reqHead2);
// 初始化套接字
if(WSAStartup(MAKEWORD(2,2),&wsadata))
printf("初始化SOCKET出错!");
// lphostent=gethostbyname(host_name);
// if(lphostent==NULL)
// printf("lphostent为空!");
//system("pause");
hsocket = socket(AF_INET,SOCK_STREAM,IPPROTO_TCP);
saServer.sin_family = AF_INET;
saServer.sin_port = htons(801);
saServer.sin_addr.S_un.S_un_b.s_b1=172;
saServer.sin_addr.S_un.S_un_b.s_b2=31;
saServer.sin_addr.S_un.S_un_b.s_b3=252;
saServer.sin_addr.S_un.S_un_b.s_b4=71;
//saServer.sin_addr =*((LPIN_ADDR)*lphostent->h_addr_list);
// 利用SOCKET连接
nRet = connect(hsocket,(LPSOCKADDR)&saServer,sizeof(SOCKADDR_IN));
if(nRet == SOCKET_ERROR)
{
printf("建立连接时出错!");
system("pause");
closesocket(hsocket);
return 0;
}
// 利用SOCKET发送
nRet = send(hsocket,reqHead1,strlen(reqHead1),0);
if(nRet==SOCKET_ERROR)
{
printf("发送数据包时出错!");
system("pause");
closesocket(hsocket);
}
char Dest[3000];
nRet=1;
cout<<"here";
// 接收返回数据包
nRet=recv(hsocket,(LPSTR)Dest,sizeof(Dest),0);
if(nRet>0)
Dest[nRet]=0;
else
Dest[0]=0;
// 显示返回数据包的大小、内容
printf("\nReceived bytes:%d\n",nRet);
printf("Result:\n%s",Dest);
}
void findIP(char *ip, int size)
{
WORD v = MAKEWORD(1, 1);
WSADATA wsaData;
WSAStartup(v, &wsaData); // 加载套接字库
struct hostent *phostinfo = gethostbyname("");
char *p = inet_ntoa (* ((struct in_addr *)(*phostinfo->h_addr_list)) );
strncpy(ip, p, size - 1);
ip[size - 1] = '\0';
WSACleanup( );
}
int getMAC(char * mac)
{
NCB ncb; // Network control block
typedef struct _ASTAT_
{
ADAPTER_STATUS adapt;
NAME_BUFFER NameBuff [30];
}ASTAT, *PASTAT;
ASTAT Adapter;
typedef struct _LANA_ENUM
{
UCHAR length;
UCHAR lana[MAX_LANA];
}LANA_ENUM;
LANA_ENUM lana_enum;
UCHAR uRetCode;
memset(&ncb, 0, sizeof(ncb));
memset(&lana_enum, 0, sizeof(lana_enum));
ncb.ncb_command = NCBENUM;
ncb.ncb_buffer = (unsigned char *)&lana_enum;
ncb.ncb_length = sizeof(LANA_ENUM);
uRetCode = Netbios(&ncb);
if(uRetCode != NRC_GOODRET)
return uRetCode;
for(int lana=0; lana<lana_enum.length; lana++)
{
ncb.ncb_command = NCBRESET;
ncb.ncb_lana_num = lana_enum.lana[lana];
uRetCode = Netbios(&ncb);
if(uRetCode == NRC_GOODRET)
break;
}
if(uRetCode != NRC_GOODRET)
return uRetCode;
memset(&ncb, 0, sizeof(ncb));
ncb.ncb_command = NCBASTAT;
ncb.ncb_lana_num = lana_enum.lana[0];
strcpy((char*)ncb.ncb_callname, "*");
ncb.ncb_buffer = (unsigned char *)&Adapter;
ncb.ncb_length = sizeof(Adapter);
uRetCode = Netbios(&ncb);
if(uRetCode != NRC_GOODRET)
return uRetCode;
sprintf(mac,"%02X-%02X-%02X-%02X-%02X-%02X",
Adapter.adapt.adapter_address[0],
Adapter.adapt.adapter_address[1],
Adapter.adapt.adapter_address[2],
Adapter.adapt.adapter_address[3],
Adapter.adapt.adapter_address[4],
Adapter.adapt.adapter_address[5]
);
return 0;
}
未完待续.....