广东工业大学p版

[neophack]

广东工业大学crc校检部分是八字节，例如9ae9cef84b020aa3，心跳认证错误
报文http://pan.baidu.com/s/1boGuS6F

请求
076f080001000000
返回
076f100002030000a3e2f3000a1e84a7a8a80000e659f16700000000dc020000

请求
0770600003000000000000000a1e84a70062002aa3e2f3009ae9cef84b020aa3
000000000000008b0a3c123dffffffff00000000000040000000000000000000
0000000000000000000000000000000000000000000000000000000000000000
返回
077030000400200066ba33be000000004439d8eda0000c04f64a82c3483d04b6b0820060000000000000000000000000

请求
#074428000b01dc02e90300000000000043e1f3000000000000000000000000000000000000000000
#074428000b02dc02e903000000000000b5e2f3000000000000000000000000000000000000000000
#074528000b03dc02e903000000000000b5e2f30000000000af1e50000a1e84a70000000000000000
#074528000b04dc02e903000000000000b6e2f3000000000000000000000000000000000000000000

[mchome]

错误信息贴一下，还有哪个包是正常的，哪个包是错误的标记下

[yinweizhehd1]

[neophack]

上面贴请求的是555那个文件里面的，三个包都是用官方拨号软件抓的，5.2.1(p)版。问题主要是使用了加密，所以未加密的都不能用，拨号后两分钟断一次网。01、02、03几种加密都可以，可以在received challenge response看到。

[13610367034]

同问。。。
某次的抓包生成的配置居然是
server = '10.0.3.2'
pppoe_flag = '\x69'
keep_alive2_flag = '\xdc'，
后来再抓包生成的还是最初的那种配置

[blb2514235934]

大神可以救救5.2.1（x）版本的吗？？路由器上不了网

[neophack]

@blb2514235934 我们学校都是p版吧。@13610367034 你可以试试这个配置，但应该不是留下的后路。

[JerryChaox]

我也是广工这边的 几分钟就会断一次网 楼主解决了吗

[ly0]

猜测是有8个字节启动了加密

[JerryChaox]

所以要解码吗

[ly0]

我先把相关的代码发出来，我这边没测试条件
之前有过相关研究，供参考
https://github.com/drcoms/drcom-generic/blob/master/tests/pppoe_heartbeat_analysis.py
还有之前疑似泄漏代码
https://github.com/drcoms/AndroidPPPoE/blob/master/jni/drppoe/DrppoePlugin.cpp#L517

[JerryChaox]

这个代码要怎么用

[JerryChaox]

请问@ly0 这个代码要怎么测试 这边有环境

[JerryChaox]

运行心跳分析有以下结果：
075660000300000000000000ac15050f00620014cf89a8030000007e000000000000008bac2a1478ffffffff00a0590600200003c0512508ffffff0000a0590600010003c0512b08ffffff0000000000000000000000000000000000 0x345c286aL
0x3d6b70216af22cL
0x216af22cL

[ly0]

#!/usr/bin/env python
# -*- coding: utf-8 -*-
"""
I want to express my great thanks to the following friends
they brought me hope of this version (in QQ Group 318495368)
@Countdown to Heaven
@djj
"""
import socket
import struct
import time
import sys
import random
import os
import hashlib

# CONFIG
server = '61.142.108.96'
pppoe_flag = '\x00'
keep_alive2_flag = '\xdc'
# CONFIG_END

host_ip = server
IS_TEST = True
CONF = "/etc/drcom.conf"
DEBUG = False #log saves to file
if IS_TEST:
    CONF = ''
    DEBUG = True
    LOG_PATH = 'drcom_client.log'

def log(*args, **kwargs):
    s = ' '.join(args)
    if 'pkt' in kwargs and DEBUG == True:
        s += '\n\tpacket:' + kwargs['pkt'].encode('hex')
    print '[*] ', s
    if DEBUG:
        with open(LOG_PATH,'ab') as f:
            try:
                f.write(s)
                f.write('\n')
            except:
                f.write('FUCK WINDOWS' + '\n')

def md4(val=None):
    raise Exception('oops..md4 hitted.')

def dump(n):
    s = '%x' % n
    if len(s) & 1:
        s = '0' + s
    return s.decode('hex')

def gbk2utf8(string):
    try:
        import platform
        if platform.uname()[0] != 'Windows':
            return string.decode('gb2312').encode().decode()
        else:
            return string.decode('gb2312')
    except Exception as e:
        return 'You have witnessed too much...'

class Socket:
    def __init__(self, server, port=61440):
        self.s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
        self.s.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
        self.s.bind(("0.0.0.0", 61440))
        log("open local port:" + str(port))
        log("DEBUG MODE:"+ str(DEBUG))
        self.server = server
        self.port = port
        self.s.settimeout(3)

    def send(self, data):
        self.s.sendto(data, (self.server, self.port))

    def recv(self):
        while True:
            data, address = self.s.recvfrom(1024)
            if data[0] == '\x4d':
                log('received message packet, dropped. message: ' + gbk2utf8(data[4:]))
                continue
            return data, address

    def get_socket(self):
        return self.s

    def sendto(self, data, *args):
        self.send(data)

    def recvfrom(self, *args):
        return self.recv()

class PPPOEHeartbeat:
    def __init__(self, num=1):
        self.count = num # 计数器
    def _make_challenge(self):
        data = '\x07'
        data += chr(self.count)
        data += '\x08\x00\x01\x00'
        data+= '\x00\x00'
        return data

    def _DrcomCRC32(self, data, init = 0):
      ret = init
      for i in range(len(data))[::4]:
          ret ^= struct.unpack('<I', data[i:i+4])[0]
          ret &= 0xFFFFFFFF
      return ret

    def _gen_crc(self, data, encrypt_type):
        DRCOM_DIAL_EXT_PROTO_CRC_INIT = 20000711
        ret = ''
        if encrypt_type == 0:
            # 加密方式无
            return struct.pack('!I',DRCOM_DIAL_EXT_PROTO_CRC_INIT) + struct.pack('!I',126)
        elif encrypt_type == 1:
            # 加密方式为 md5
            foo = hashlib.md5(data).digest()
            ret += foo[2]
            ret += foo[3]
            ret += foo[8]
            ret += foo[9]
            ret += foo[5]
            ret += foo[6]
            ret += foo[13]
            ret += foo[14]
            return ret
        elif encrypt_type == 2:
            # md4
            foo = md4(data)
            ret += foo[1]
            ret += foo[2]
            ret += foo[8]
            ret += foo[9]
            ret += foo[4]
            ret += foo[5]
            ret += foo[11]
            ret += foo[12]
            return ret
        elif encrypt_type == 3:
            # sha1
            foo = hashlib.sha1(data).digest()   
            ret += foo[2]
            ret += foo[3]
            ret += foo[9]
            ret += foo[10]
            ret += foo[5]
            ret += foo[6]
            ret += foo[15]
            ret += foo[16]  
            return ret

    def _make_heartbeat(self, sip, challenge_seed, first=False):
        # DrcomDialExtProtoHeader - 5 bytes
        data = '\x07' # code
        data += chr(self.count) # id
        data += '\x60\x00' # length
        data += '\x03' # type
        data += '\x00' # uid length
        data += '\x00\x00\x00\x00\x00\x00' # mac
        data += sip # AuthHostIP
        if first:
            data += '\x00\x62\x00' + pppoe_flag # 非第一次则是 data += '\x00\x62\x00\x14' 
        else:
            data += '\x00\x63\x00' + pppoe_flag
        data += challenge_seed # Challenge Seed
        data += struct.pack('<I',20000711) # DRCOM_DIAL_EXT_PROTO_CRC_INIT
        data += struct.pack('<I',126)
        crc = (self._DrcomCRC32(data) * 19680126) & 0xFFFFFFFF
        data = data[:-8] + struct.pack('<I', crc) + '\x00\x00\x00\x00'
        # data += '\x7e\x00\x00\x00'
        #   data += '\x00\x00\x00\x7e'
        # - DrcomDialExtProtoHeader end -
        data += '\x00'*16 # ip1
        data += '\x00'*16 # ip2
        data += '\x00'*16 # ip3
        data += '\x00'*16 # ip4
        return data

    def send(self, s):
        while True:
            #1. challenge
            data = self._make_challenge()
            log('pppoe: send challenge request', pkt=data)
            s.send(data)
            data, address = s.recv()
            log('pppoe: received challenge response', pkt=data)

            self.count += 1
            self.count %= 0xFF

            #2. heartbeat
            seed = data[8:12]
            sip = data[12:16]
            if self.count != 2 and self.count != 1:
                data = self._make_heartbeat(sip=sip, challenge_seed=seed)
            else:
                data = self._make_heartbeat(sip=sip, challenge_seed=seed, first=True)
            log('pppoe: send heartbeat request', pkt=data)
            s.send(data)
            try:
                data, address = s.recv()
                log('pppoe: received heartbeat response', pkt=data)
                break
            except:
                log('pppoe: heartbeat response failed, retry')
                log('pppoe: reset idx to 0x01')
                self.count = 1
                continue

            self.count += 1
            self.count %= 0xFF


def keep_alive_package_builder(number,random,tail,type=1,first=False):
    data = '\x07'+ chr(number) + '\x28\x00\x0b' + chr(type)
    if first :
        data += '\x0f\x27'
    else:
        data += keep_alive2_flag + '\x02'
    data += '\x2f\x12' + '\x00' * 6
    data += tail
    #data += '\x00' * 4
    #data += struct.pack("!H",0xdc02)
    if type == 3:
        foo = ''.join([chr(int(i)) for i in host_ip.split('.')]) # host_ip
        #CRC
        # edited on 2014/5/12, filled zeros to checksum
        # crc = packet_CRC(data+foo)
        encrypt_mode = struct.unpack('>I', tail) & 3
        crc = self._gen_crc(data, encrypt_mode)
        #crc = '\x00' * 4
        #data += struct.pack("!I",crc) + foo + '\x00' * 8
        data += crc + foo + '\x00' * 8
    else: #packet type = 1
        data += '\x00' * 16
    return data

def keep_alive2(s, pppoe):
    tail = ''
    packet = ''
    svr = server

    ran = random.randint(0,0xFFFF)
    ran += random.randint(1,10)   
    # 2014/10/15 add by latyas, maybe svr sends back a file packet
    svr_num = 0
    packet = keep_alive_package_builder(svr_num,dump(ran),'\x00'*4,1,True)
    while True:
        log('[keep-alive2] send1', pkt=packet)
        s.sendto(packet, (svr, 61440))
        data, address = s.recvfrom(1024)
        if data[0] == '\x07' and data[2] == '\x28':
            break
        elif data[0] == '\x07' and data[2] == '\x10':
            log('[keep-alive2] recv file, resending..')
            svr_num = svr_num + 1
            packet = keep_alive_package_builder(svr_num,dump(ran),'\x00'*4,svr_num,False)
        else:
            log('[keep-alive2] recv1/unexpected', pkt=data)
    log('[keep-alive2] recv1', pkt=data)

    ran += random.randint(1,10)   
    packet = keep_alive_package_builder(svr_num, dump(ran),'\x00'*4,1,False)
    log('[keep-alive2] send2', pkt=packet)
    s.sendto(packet, (svr, 61440))
    while True:
        data, address = s.recvfrom(1024)
        if data[0] == '\x07':
            svr_num = svr_num + 1
            break
        else:
            log('[keep-alive2] recv2/unexpected', pkt=data)
    log('[keep-alive2] recv2', pkt=data)
    tail = data[16:20]


    ran += random.randint(1,10)   
    packet = keep_alive_package_builder(svr_num,dump(ran),tail,3,False)
    log('[keep-alive2] send3', pkt=packet)
    s.sendto(packet, (svr, 61440))
    while True:
        data, address = s.recvfrom(1024)
        if data[0] == '\x07':
            svr_num = svr_num + 1
            break
        else:
            log('[keep-alive2] recv3/unexpected', pkt=data)
    log('[keep-alive2] recv3', pkt=data)
    tail = data[16:20]
    log("[keep-alive2] keep-alive2 loop was in daemon.")

    i = svr_num
    while True:
        try:
            ran += random.randint(1,10)   
            packet = keep_alive_package_builder(i,dump(ran),tail,1,False)
            log('[keep_alive2] send',str(i), pkt=packet)
            s.sendto(packet, (svr, 61440))
            data, address = s.recvfrom(1024)
            log('[keep_alive2] recv', pkt=data)
            tail = data[16:20]

            ran += random.randint(1,10)   
            packet = keep_alive_package_builder(i+1,dump(ran),tail,3,False)
            s.sendto(packet, (svr, 61440))
            log('[keep_alive2] send',str(i+1), pkt=packet)
            data, address = s.recvfrom(1024)
            log('[keep_alive2] recv', pkt=data)
            tail = data[16:20]
            i = (i+2) % 0xFF
            time.sleep(10)
            #send pppoe heartbeat once
            pppoe.send(s)
        except:
            pass

def daemon():
    with open('/var/run/drcom_p.pid','w') as f:
        f.write(str(os.getpid()))

def main():
    if not IS_TEST:
        daemon()
        execfile(CONF, globals())
    log('auth svr:' + server + '\npppoe_flag:' + pppoe_flag.encode('hex') + '\nkeep_alive2_flag:' + keep_alive2_flag.encode('hex'))
    while True:
        s = Socket(server)
        pppoe = PPPOEHeartbeat(1)
        pppoe.send(s)
        keep_alive2(s, pppoe)

if __name__ == '__main__':
    main()

试试这个

[JerryChaox]

广东工业大学又换了x版 5.2.1