124 lines
4.5 KiB
Python
124 lines
4.5 KiB
Python
import socket, hashlib
|
|
|
|
class R:
|
|
def __init__(self,h,p=8728): self.h=h; self.p=p; self.s=None
|
|
def c(self,u,p):
|
|
self.s=socket.socket(socket.AF_INET,socket.SOCK_STREAM); self.s.settimeout(15)
|
|
self.s.connect((self.h,self.p))
|
|
self._ws('/login','=name='+u,'=password='+p)
|
|
r=self._rr()
|
|
if any(isinstance(x,tuple) and x[0]=='!trap' for x in r):
|
|
for x in r:
|
|
if isinstance(x,dict) and 'ret' in x: ch=x['ret']
|
|
if ch and len(ch)==32:
|
|
h=hashlib.md5(b'\x00'+p.encode()+bytes.fromhex(ch)).hexdigest()
|
|
self._ws('/login','=name='+u,'=response=00'+h)
|
|
self._rr()
|
|
return self
|
|
def _el(self,l):
|
|
if l<0x80: return bytes([l])
|
|
elif l<0x4000: l|=0x8000; return bytes([(l>>8)&0xFF,l&0xFF])
|
|
elif l<0x200000: l|=0xC00000; return bytes([(l>>16)&0xFF,(l>>8)&0xFF,l&0xFF])
|
|
elif l<0x10000000: l|=0xE0000000; return bytes([(l>>24)&0xFF,(l>>16)&0xFF,(l>>8)&0xFF,l&0xFF])
|
|
else: return bytes([0xF0,(l>>24)&0xFF,(l>>16)&0xFF,(l>>8)&0xFF,l&0xFF])
|
|
def _ww(self,w): self.s.sendall(self._el(len(w))+w.encode('utf-8'))
|
|
def _ws(self,c,*ws): self._ww(c); [self._ww(w) for w in ws]; self.s.sendall(b'\x00')
|
|
def _rb(self): return self.s.recv(1)
|
|
def _rw(self):
|
|
f=self._rb()
|
|
if f==b'\x00': return None
|
|
lb=f[0]
|
|
if lb&0x80:
|
|
if (lb&0xC0)==0x80: l=((lb&0x3F)<<8)+self._rb()[0]
|
|
elif (lb&0xE0)==0xC0: l=((lb&0x1F)<<16)+(self._rb()[0]<<8)+self._rb()[0]
|
|
elif (lb&0xF0)==0xE0: l=((lb&0x0F)<<24)+(self._rb()[0]<<16)+(self._rb()[0]<<8)+self._rb()[0]
|
|
else: l=(self._rb()[0]<<24)+(self._rb()[0]<<16)+(self._rb()[0]<<8)+self._rb()[0]
|
|
else: l=lb
|
|
d=b''
|
|
while len(d)<l:
|
|
c=self.s.recv(l-len(d))
|
|
if not c: break
|
|
d+=c
|
|
return d.decode('utf-8',errors='replace')
|
|
def _rss(self):
|
|
ws=[]
|
|
while True:
|
|
w=self._rw()
|
|
if w is None: break
|
|
ws.append(w)
|
|
return ws
|
|
def _rr(self):
|
|
rs=[]
|
|
while True:
|
|
s=self._rss()
|
|
if not s: break
|
|
r=s[0]; t=s[1:]
|
|
if r=='!done': break
|
|
elif r=='!re':
|
|
d={}
|
|
for w in t:
|
|
if '=' in w:
|
|
p=w.split('=',2)
|
|
d[p[1]]=p[2] if len(p)>=3 else ''
|
|
else: d[w]=''
|
|
rs.append(d)
|
|
elif r=='!trap': rs.append(('!trap',t))
|
|
return rs
|
|
def cmd(self,c,**a):
|
|
ws=[c]
|
|
for k,v in a.items():
|
|
if k.startswith('?'): ws.append(f'{k}={v}')
|
|
else: ws.append(f'={k}={v}')
|
|
self._ws(*ws)
|
|
return self._rr()
|
|
def close(self):
|
|
if self.s: self.s.close(); self.s=None
|
|
|
|
api=R('192.168.100.2').c('mi4','m14')
|
|
|
|
# 1. Cek script untuk key/token
|
|
print("=== Script dengan API key / token ===")
|
|
for sc in api.cmd('/system/script/print'):
|
|
src = sc.get('source', '')
|
|
name = sc['name']
|
|
# Cari kata kunci: key, token, api, secret
|
|
keywords = ['key', 'token', 'api', 'secret', 'password', 'sk-', 'dahl', 'hc-']
|
|
found = []
|
|
for kw in keywords:
|
|
if kw.lower() in src.lower():
|
|
found.append(kw)
|
|
if found:
|
|
print(f" {name}: keywords={found}")
|
|
# Tampilkan baris yg mengandung keyword
|
|
for line in src.split('\n'):
|
|
for kw in keywords:
|
|
if kw.lower() in line.lower():
|
|
print(f" -> {line.strip()[:150]}")
|
|
break
|
|
|
|
# 2. Cek scheduler on-event Family, dump bagian bot
|
|
print("\n=== Family scheduler - Telegram config ===")
|
|
for si in api.cmd('/system/scheduler/print'):
|
|
if si['name'] == 'Family':
|
|
oe = si.get('on-event', '')
|
|
# Extract bot/chat lines
|
|
for line in oe.split(';'):
|
|
if '5115036608' in line or 'bot' in line.lower() or 'chat' in line.lower():
|
|
print(f" {line.strip()[:150]}")
|
|
break
|
|
|
|
# 3. Cek file di router
|
|
print("\n=== Files on router ===")
|
|
for f in api.cmd('/file/print'):
|
|
name = f.get('name', '')
|
|
size = f.get('size', '0')
|
|
if int(size) > 0 and name.endswith('.txt') or name.endswith('.conf') or name.endswith('.rsc'):
|
|
print(f" {name} ({size} bytes)")
|
|
|
|
# 4. Cek env vars
|
|
print("\n=== Env vars ===")
|
|
for env in api.cmd('/system/script/environment/print'):
|
|
print(f" {env.get('name')} = {env.get('value', '').strip()[:100]}")
|
|
|
|
api.close()
|