119 lines
4.2 KiB
Python
119 lines
4.2 KiB
Python
import socket, hashlib
|
|
|
|
class R:
|
|
def __init__(self,h,p=8728): self.h=h; self.p=p; self.s=None
|
|
def c(self,u,p):
|
|
self.s=socket.socket(socket.AF_INET,socket.SOCK_STREAM); self.s.settimeout(10)
|
|
self.s.connect((self.h,self.p))
|
|
self._ws('/login','=name='+u,'=password='+p)
|
|
r=self._rr()
|
|
if any(isinstance(x,tuple) and x[0]=='!trap' for x in r):
|
|
for x in r:
|
|
if isinstance(x,dict) and 'ret' in x: ch=x['ret']
|
|
if ch and len(ch)==32:
|
|
h=hashlib.md5(b'\x00'+p.encode()+bytes.fromhex(ch)).hexdigest()
|
|
self._ws('/login','=name='+u,'=response=00'+h)
|
|
self._rr()
|
|
return self
|
|
def _el(self,l):
|
|
if l<0x80: return bytes([l])
|
|
elif l<0x4000: l|=0x8000; return bytes([(l>>8)&0xFF,l&0xFF])
|
|
elif l<0x200000: l|=0xC00000; return bytes([(l>>16)&0xFF,(l>>8)&0xFF,l&0xFF])
|
|
elif l<0x10000000: l|=0xE0000000; return bytes([(l>>24)&0xFF,(l>>16)&0xFF,(l>>8)&0xFF,l&0xFF])
|
|
else: return bytes([0xF0,(l>>24)&0xFF,(l>>16)&0xFF,(l>>8)&0xFF,l&0xFF])
|
|
def _ww(self,w): self.s.sendall(self._el(len(w))+w.encode('utf-8'))
|
|
def _ws(self,c,*ws): self._ww(c); [self._ww(w) for w in ws]; self.s.sendall(b'\x00')
|
|
def _rb(self): return self.s.recv(1)
|
|
def _rw(self):
|
|
f=self._rb()
|
|
if f==b'\x00': return None
|
|
lb=f[0]
|
|
if lb&0x80:
|
|
if (lb&0xC0)==0x80: l=((lb&0x3F)<<8)+self._rb()[0]
|
|
elif (lb&0xE0)==0xC0: l=((lb&0x1F)<<16)+(self._rb()[0]<<8)+self._rb()[0]
|
|
elif (lb&0xF0)==0xE0: l=((lb&0x0F)<<24)+(self._rb()[0]<<16)+(self._rb()[0]<<8)+self._rb()[0]
|
|
else: l=(self._rb()[0]<<24)+(self._rb()[0]<<16)+(self._rb()[0]<<8)+self._rb()[0]
|
|
else: l=lb
|
|
d=b''
|
|
while len(d)<l:
|
|
c=self.s.recv(l-len(d))
|
|
if not c: break
|
|
d+=c
|
|
return d.decode('utf-8',errors='replace')
|
|
def _rss(self):
|
|
ws=[]
|
|
while True:
|
|
w=self._rw()
|
|
if w is None: break
|
|
ws.append(w)
|
|
return ws
|
|
def _rr(self):
|
|
rs=[]
|
|
while True:
|
|
s=self._rss()
|
|
if not s: break
|
|
r=s[0]; t=s[1:]
|
|
if r=='!done': break
|
|
elif r=='!re':
|
|
d={}
|
|
for w in t:
|
|
if '=' in w:
|
|
p=w.split('=',2)
|
|
d[p[1]]=p[2] if len(p)>=3 else ''
|
|
else: d[w]=''
|
|
rs.append(d)
|
|
elif r=='!trap':
|
|
print(f'TRAP: {t}')
|
|
rs.append(('!trap',t))
|
|
return rs
|
|
def cmd(self,c,**a):
|
|
ws=[c]
|
|
for k,v in a.items():
|
|
if k.startswith('?'): ws.append(f'{k}={v}')
|
|
else: ws.append(f'={k}={v}')
|
|
self._ws(*ws)
|
|
return self._rr()
|
|
def close(self):
|
|
if self.s: self.s.close(); self.s=None
|
|
|
|
api=R('192.168.100.2').c('mi4','m14')
|
|
|
|
# Try set with type=regular (RouterOS keyword)
|
|
for b in api.cmd('/ip/hotspot/ip-binding/print'):
|
|
mac = b.get('mac-address', '')
|
|
if 'CA:1A:02:C2:8C:1E' in mac:
|
|
bid = b['.id']
|
|
print(f'Found: {bid} Type={b.get("type")}')
|
|
|
|
# Try setting type to empty string
|
|
r = api.cmd('/ip/hotspot/ip-binding/set', **{'.id': bid, 'type': ''})
|
|
print(f'Set type=\"\" result: {r}')
|
|
break
|
|
|
|
# Check again
|
|
print()
|
|
for b in api.cmd('/ip/hotspot/ip-binding/print'):
|
|
mac = b.get('mac-address', '')
|
|
if 'CA:1A:02:C2:8C:1E' in mac:
|
|
print(f'After set: MAC={mac} Type="{b.get("type")}"')
|
|
|
|
# If still bypassed, remove it entirely
|
|
if b.get('type') == 'bypassed' or not b.get('type'):
|
|
bid = b['.id']
|
|
print(f'Still bypassed/empty. Removing binding {bid}...')
|
|
r = api.cmd('/ip/hotspot/ip-binding/remove', **{'.id': bid})
|
|
print(f'Remove result: {r}')
|
|
break
|
|
|
|
# Verify removal
|
|
print()
|
|
found = False
|
|
for b in api.cmd('/ip/hotspot/ip-binding/print'):
|
|
if 'CA:1A:02:C2:8C:1E' in b.get('mac-address', ''):
|
|
print(f'STILL EXISTS! MAC={b.get("mac-address")} Type={b.get("type")}')
|
|
found = True
|
|
if not found:
|
|
print('Binding CA:1A:02:C2:8C:1E removed successfully')
|
|
|
|
api.close()
|