好,接着上一篇。
威斯汀没去成,关键是现在脸有点火辣辣的。Linux 的RPC服务暂时不打算去研究,看看有没有其他的路子。一个正常的脑子设计的系统,通常来说,需要留下一些调试工具,方便需要的时候获取的信息的吧。Wait,我TM在干什么,linux不是有查看网卡吞吐的么,ifconfig啊,我TM是猪,忘记这茬了。
WAP(Dopra Linux) # ifconfig
br0 Link encap:Ethernet HWaddr 94:DB:DA:62:81:F2
inet addr:172.16.1.1 Bcast:172.16.1.255 Mask:255.255.255.0
inet6 addr: fe80::96db:daff:fe62:81f2/64 Scope:Link
inet6 addr: fe80::1/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:37743 errors:0 dropped:203 overruns:0 frame:0
TX packets:32428 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:3690191 (3.5 MiB) TX bytes:9395626 (8.9 MiB)
eth0 Link encap:Ethernet HWaddr 00:E0:FC:55:55:88
inet6 addr: fe80::2e0:fcff:fe55:5588/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:39110 errors:0 dropped:0 overruns:0 frame:0
TX packets:122600 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:4630428 (4.4 MiB) TX bytes:11409811 (10.8 MiB)
Interrupt:119
/*中间无关紧要*/
wan1 Link encap:Ethernet HWaddr 94:DB:DA:62:81:F3
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:18900 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:0 (0.0 B) TX bytes:604800 (590.6 KiB)
wlan0 Link encap:Ethernet HWaddr 94:DB:DA:62:81:F8
inet6 addr: fe80::96db:daff:fe62:81f8/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:41 errors:0 dropped:0 overruns:0 frame:0
TX packets:51 errors:12 dropped:4717 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:6355 (6.2 KiB) TX bytes:7905 (7.7 KiB)
Interrupt:91 Base address:0x8000
从这个来看,只有一个br0是网关的,eth0,不知道是不另外一个口子的,wan1有点像光口的,wlan0,应该是无线网关的。
验证一把,在光纤上插上,下文件,wan1口的RX、TX屁都没一个。看来这威斯汀不好进啊。到这里至少证明了我不是猪。
看看/bin下面有些什么鬼。看着这一对*.sh,我的脸又不那么痛了。
全系统搜索这些shell脚本,MD,那么多,那个是啊,不是让我一个一个测试吧。找了几个命令放到百度上,得到一篇这个文章:http://www.chinadsl.net/thread-122965-1-1.html ,这里可以看到在WAP〉状态的时候,有很多命令可以使用的,我这里直接输入?得到如下结果:
amp add policy-stats pon
amp add policy-stats port
amp add stats gemport
amp clear policy-stats pon
amp clear policy-stats port
amp clear stats gemport
amp del policy-stats pon
amp del policy-stats port
amp del stats gemport
ampcmd show car all
ampcmd show car index
ampcmd show emac stat
ampcmd show flow all
ampcmd show flow index
ampcmd show log
ampcmd show queue all
ampcmd show queue index
ampcmd trace all
ampcmd trace cli
ampcmd trace dpoe
ampcmd trace drv
ampcmd trace emac
ampcmd trace emap
ampcmd trace eth
ampcmd trace gmac
ampcmd trace gmap
ampcmd trace onu
ampcmd trace optic
ampcmd trace qos
backup cfg
bbsp add policy-stats btv
bbsp clear policy-stats btv all
bbsp clear policy-stats wan
bbsp del policy-stats btv
bbspcmd
Broadband debug
Broadband display
chipdebug
chipdebug soc drop
chipdebug soc rx
chipdebug soc tx
clear amp pq-stats
clear file
clear lastword
clear pon statistics
clear poncnt dnstatistic
clear poncnt gemport upstatistic
clear poncnt upstatistic
clear port statistics
collect debug info
component delete all
debug dsp down msg
debug dsp msg
debug dsp up msg
debug ifm
debug qoscfg
debug rtp stack
debug sample mediastar
debugging dsp diagnose
debugging dsp para diagnose
debugging dsp record
debugging dsp t38diag
diagnose
display access mode
display amp policy-stats pon
display amp policy-stats port
display amp pq-stats
display amp stats gemport
display apmChipStatus
display apmpolicy
display batteryStatus
display bbsp stats btv
display bbsp stats wan
display bmsxml crc
display boardItem
display cwmp debug
display debug info dhcp6c
display debug info dhcp6s
display debug info pppoev6
display debug info ra
display deviceInfo
display dhcp_em result
display dsp channel para
display dsp channel running status
display dsp channel status
display dsp chip stat
display dsp codec status
display dsp interrupt stat
display epon ont info
display equip test mode
display equipId
display equiptest status
display ethoam ma info
display ethoam md info
display ethoam mep info
display ethoam mep perf
display file
display filter rf
display flashlock status
display flow
display ftp config status
display inner version
display ip6tables filter
display iptables filter
display iptables mangle
display iptables nat
display iptables raw
display jb grid status
display jb para
display lanmac
display lastword
display log info
display macaddress
display machineItem
display memory info
display msg-queue
display oaml2shell ethvlan
display onu info
display optic
display optmode
display patch information
display pon statistics
display poncnt dnstatistic
display poncnt gemport upstatistic
display poncnt upstatistic
display portstatistics
display pppoe_em result
display productId
display productmac
display progress load
display rf config
display rtp stack channel stat
display rtp stack chip stat
display rtp stack para
display rtp stack version
display simcardstatus
display sn
display startup info
display swm bootstate
display swm state
display sysinfo
display syslog
display telnet access
display timeout
display timer
display usb devList
display vendorId
display version
display voip dsp jbdata
display voip dsp para diagnose state
display voip dsp para diagnose statistics
display voip dsp tonedetect
display wan layer all
display wanmac
display wifi multicast
display wifi pa type
display wifichip
display wlanmac
display zsp version
get battery alarm status
get battery-chip status
get ip conntrack
get mac agingtime
get ont oamfrequency
get opm switch
get optic debug info
get optic par info
get optic phy type
get optic txmode
get poncnt upgemport
get port config
get port isolate
get rogue status
get testself
get wlan advance
get wlan associated
get wlan basic
get wlan enable
get wlan stats
get wlan txpower
get wlan wps
ifconfig
igmp clear statistics
igmp get debug switch
igmp get flow info
igmp get global cfg
igmp get iptv
igmp get multilmac
igmp get port multicast config
igmp get statistics
igmp set debug switch
ip -6 neigh
ip -6 route
ip -6 rule
ip neigh
ip route
ip rule
load pack
logout
maintain mode
make ssh hostkey
mgcp mg-config
mgcp mgc 1
mgcp mgc 2
mid get
mid off
mid set
napt cli
netstat -na
oamcmd clear log
oamcmd debug
oamcmd error log
oamcmd pdt show log
oamcmd show flow
oamcmd show log
omcicmd alarm show
omcicmd clear log
omcicmd debug
omcicmd error log
omcicmd mib show
omcicmd pdt show log
omcicmd pm show
omcicmd show flow
omcicmd show log
omcicmd show qos
ping
qoscfg get
quit
reset
restore manufactory
route get default
save data
save log
set cwmp debug
set ethportmirror
set led
set opticdata
set port isolate
set ringchk
set timeout
set userpasswd
set voicedebug
set voicedsploop
set voicelinetest
set voiceportloop
set voicesignalingprint
setconsole
sntp get
stats clear
stats display
su
test monitor interface
traceroute
undo debugging dsp diagnose
undo debugging dsp para diagnose
undo debugging dsp record
undo debugging dsp t38diag
voice remote diagnose server set
voice remote diagnose set
vspa clear rtp statistics
vspa debug
vspa display conference info
vspa display dsp running info
vspa display dsp state
vspa display mg if state
vspa display mg info
vspa display mgcp config
vspa display online user info
vspa display port status
vspa display rtp statistics
vspa display service log
vspa display signal scene info
vspa display signal scene list
vspa display user call state
vspa display user status
vspa reset
vspa set ptcflag
vspa shutdown mg
wap list
wap ps
wap top
又是一通体力劳动,这玩意看上去就是了: display pon statistics
马上验证一下,还真是了,至少看上去各项指标都符合要求了。到了这里。我都在想到底约谁一起去威斯汀了。
剩下的路子就是找到这命令调用的是那个程序或者脚本了。如果我是光猫的架构师,我肯定是找一个单独程序来实现这里面的命令。
第一步,找到当前的shell环境是那个程序在提供服务。Netstat -anp|grep :23 得到这些
进一步在在/bin命令下找到ssmp,IDA,走起。
Nfwcojehgpi3 qjfwpcnvt3gwhi qpjfi 35nrwi gfpe....这TM啥意思?意思就是里面根本没找到有价值的信息,我艹。冷静,一定要冷静。不是这货在干活,那至少也是这货的子进程在干活吧。
啊,不要。面对一个被精简的命令。我把ps的进程一个一个的找出来看,总应该有一个能找到吧。
(无情的体力活...)
终于在/bin/clid找到点眉目。
简直觉得这些字符串亲切啊。F5过去,
应该差不多了,现在还没有找到命令行,按照道理,这些是不会直接写到程序中的,如果这样的话,每增加一个命令就要更新一下bin,X为的设计师又没毛病,理论上会通过一个配置来保存展示的命令及其对应的程序或者脚本,这样的话扩展起来才比较方便嘛。但是这里没看到,bin里也没有明显的线索。尼玛,咋忘记全盘搜索那个命令了。
功夫不负有心人,还真在/etc/wap/hw_cli.xml下面找到一个xml文件,关键如下:
这不就是WAP>展示的命令么?没看到那里指定了程序路径或者sh脚本啊?看看这目录下还有些什么鬼。经过一通筛选,得到一些xml如下:
hw_shell_cli.xml 文件看看再说:
这什么玩意啊,百度 搜索 华为光猫配置破解,找到一篇文章如下,按照里面的步骤操作,成功解密。 Flashcloud.iteye.com/blog/2059189
内容不多,如下:
WAP(Dopra Linux) # cat hw_shell_cli.xml
<CliRoot>
<Restorehwmode CmdStr="restorehwmode.sh" ObjPath="restorehwmode.sh" OpType="0" Help="" CmdGroup="0x00000010">
</Restorehwmode>
<GetCustomInfo CmdStr="getcustominfo.sh" ObjPath="getcustominfo.sh" OpType="1" Help="" CmdGroup="0x00000010">
</GetCustomInfo>
<ExitShell CmdStr="exit" ObjPath="exit.sh" OpType="0" Help="" CmdGroup="0x00000010">
</ExitShell>
</CliRoot>
我艹,支持的命令确实有sh的,不过也太TM少了。继续解密hw_diag_cli.xml,也得到类似上面的,我需要却不在这几个文件中,日狗了。
<AmpShowStatTx CmdStr="chipdebug soc tx" ObjPath="ampcmdStatTx.sh" OpType="1" Help="[Usage]:chipdebug soc tx" CmdGroup="0x00004000"/>
<AmpShowStatRx CmdStr="chipdebug soc rx" ObjPath="ampcmdStatRx.sh" OpType="1" Help="[Usage]:chipdebug soc rx" CmdGroup="0x00004000"/>
<AmpShowStatDrop CmdStr="chipdebug soc drop" ObjPath="ampcmdStatDrop.sh" OpType="1" Help="[Usage]:chipdebug soc drop" CmdGroup="0x00004000"/>
第二回合,休息一下。