{"id":1635,"date":"2022-12-03T13:45:04","date_gmt":"2022-12-03T05:45:04","guid":{"rendered":"https:\/\/www.zhiwanyuzhou.com\/?p=1635"},"modified":"2022-12-03T13:45:06","modified_gmt":"2022-12-03T05:45:06","slug":"hiwifi%e6%9e%81%e8%b7%af%e7%94%b1%e5%bc%80%e5%90%af%e9%9a%90%e8%97%8fssh%e6%8e%a2%e7%a7%98","status":"publish","type":"post","link":"https:\/\/www.zhiwanyuzhou.com\/index.php\/2022\/12\/03\/hiwifi%e6%9e%81%e8%b7%af%e7%94%b1%e5%bc%80%e5%90%af%e9%9a%90%e8%97%8fssh%e6%8e%a2%e7%a7%98\/","title":{"rendered":"hiwifi\u6781\u8def\u7531\u5f00\u542f\u9690\u85cfssh\u63a2\u79d8"},"content":{"rendered":"\n

\u4e00\u3001\u5f15\u8a00<\/h2>\n\n\n\n

\u624b\u91cc\u6709\u53f0\u6781\u8def\u7531\uff0c\u578b\u53f7HC5861\uff0c\u611f\u89c9\u505a\u5de5\u4e0d\u9519\uff0c\u5168\u94dd\u5408\u91d1\u5916\u58f3\uff0c\u6563\u70ed\u529f\u80fd\u826f\u597d\uff0c\u529f\u80fd\u633a\u591a\uff0c\u652f\u6301\u63d2\u4ef6\uff0c\u5b98\u65b9\u5ba3\u79f0\u7684\u53bb\u89c6\u9891\u65e0\u5e7f\u544a\u529f\u80fd\u3001\u51fa\u56fd\u52a0\u901f\u7b49\u4e5f\u662f\u6536\u5230\u5916\u754c\u4e00\u81f4\u597d\u8bc4\u3002<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

\u53ef\u60dc\u6b63\u662f\u7531\u4e8e\u67d0\u4e9b\u63d2\u4ef6\u7684\u539f\u56e0\uff0c\u5bfc\u81f4\u6781\u8def\u7531\u9047\u4e0a\u4e86\u5b83\u6709\u53f2\u4ee5\u6765\u6700\u5927\u7684\u5371\u673a\uff0c\u81f3\u4e8e\u540e\u6765\u867d\u7136\u7ecf\u8fc7\u4e00\u4e9b\u6539\u53d8\uff0c\u4f46\u6700\u7ec8\u7531\u4e8e\u67d0\u4e9b\u539f\u56e0\uff0c\u5931\u53bb\u4e86\u7528\u6237\u53e3\u7891\uff0c\u4ee5\u81f3\u4e8e\u8d70\u4e0b\u5761\u8def\uff0c\u4e0b\u56fe\u662f\u63d2\u4ef6\u529f\u80fd\u7684\u754c\u9762\uff0c\u5df2\u7ecf\u65e0\u6cd5\u4f7f\u7528\u4e86\uff0c\u540c\u65f6\u5b98\u7f51\u4e5f\u88ab\u5176\u4ed6\u670d\u52a1\u5546\u4f7f\u7528\u3002<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

\u4e8c\u3001\u521d\u63a2ssh<\/h2>\n\n\n\n

\u867d\u7136\u6781\u8def\u7531\u5b98\u7f51\u5df2\u7ecf\u65e0\u6cd5\u8fde\u63a5\u4e86\uff0c\u4f46\u662f\u73a9\u5bb6\u4eec\u8fd8\u662f\u6709\u5f88\u591a\u65b9\u5f0f\u8fdb\u884c\u8bbe\u5907\u7684\u6539\u826f\uff0c\u5982\u66f4\u6362\u56fa\u4ef6\uff0c\u4f46\u6781\u8def\u7531\u7684\u56fa\u4ef6\u4e0e\u666e\u901a\u7684\u56fa\u4ef6\u683c\u5f0f\u662f\u4e0d\u4e00\u81f4\u7684\uff0c\u6240\u4ee5\u901a\u5e38\u73a9\u5bb6\u4eec\u5148\u83b7\u53d6root\u6743\u9650\uff0c\u901a\u8fc7\u66f4\u6362\u901a\u7528BootLoader\uff0c\u5982Breed\uff0c\u7136\u540e\u518d\u8fdb\u884c\u5237\u673a\u64cd\u4f5c\u3002\u90a3\u4e48\u5982\u4f55\u83b7\u53d6ssh\u5c31\u662f\u9996\u5148\u8981\u89e3\u51b3\u7684\u95ee\u9898\uff0c\u5f53\u521d\u5b98\u7f51\u80fd\u591f\u4f7f\u7528\u7684\u60c5\u51b5\u4e0b\uff0c\u53ea\u9700\u8981\u7ed1\u5b9a\u5c0f\u6781\u8d26\u53f7\uff0c\u7533\u8bf7\u5f00\u53d1\u8005\u6a21\u5f0f\u5373\u53ef\u4f7f\u7528\u3002<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

\u53ef\u662f\u73b0\u5728\u5b98\u7f51\u5df2\u7ecf\u65e0\u6cd5\u8fde\u63a5\u4e86\uff0c\u60f3\u8981\u4f7f\u7528\u8fd9\u4e2a\u65b9\u5f0f\u4e0d\u592a\u5bb9\u6613\uff0c\u7ecf\u8fc7\u4e92\u8054\u7f51\u641c\u7d22\uff0c\u6709\u5927\u795e\u505a\u4e86\u4e00\u4e2a\u5f00\u542fssh\u7684\u5de5\u5177http:\/\/www.hiwifi.wtf\/<\/a> \uff0c\u514d\u8d39\u63d0\u4f9b\u7ed9\u7528\u6237\u4f7f\u7528\uff0c\u771f\u7684\u5f88\u611f\u8c22\uff01<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

\u6839\u636e\u7f51\u7ad9\u7684\u8bf4\u660e\uff0c\u5f88\u5feb\u5c31\u80fd\u5f00\u542fssh<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

\u6700\u7ec8\u80fd\u591f\u83b7\u53d6\u5230root\u6743\u9650\u3002<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

\u4e09\u3001\u518d\u63a2ssh<\/h2>\n\n\n\n

\u83b7\u53d6\u5230root\u6743\u9650\u4e4b\u540e\uff0c\u6211\u4eec\u5c31\u80fd\u62ff\u5230\u8bbe\u5907\u5185\u7684\u6587\u4ef6\u7cfb\u7edf\u7684\u5185\u5bb9\uff0c\u901a\u8fc7\u641c\u7d22\u5173\u952e\u5b57local-ssh\uff0c\u53ef\u4ee5\u5b9a\u4f4d\u5230\u4e00\u4e9b\u6587\u4ef6\uff0c\u5176\u4e2d\u6709nginx\u7684\u914d\u7f6e\u6587\u4ef6vh.tw.conf<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

\u5206\u6790\u914d\u7f6e\u6587\u4ef6\uff0c\u53ef\u4ee5\u77e5\u6653\u5904\u7406\u903b\u8f91\u5728local_ssh.lua\u4e2d<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

\u4f7f\u7528\u6587\u672c\u7f16\u8f91\u5668\u6253\u5f00lua\u6587\u4ef6\uff0c\u663e\u793a\u4e3a\u4e71\u7801\uff0c\u901a\u8fc7\u8d77\u59cb\u7684\u5b57\u7b26\u4e32LuaQ\u53ef\u4ee5\u786e\u5b9alua\u4ee3\u7801\u4e3a\u7f16\u8bd1\u540e\u7684lua\uff0c\u90a3\u4e48\u9700\u8981\u627e\u5230\u5bf9\u5e94\u7684lua\u7248\u672c\u8fdb\u884c\u53cd\u6c47\u7f16\u3002<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

\u901a\u8fc7\u641c\u7d22liblua.so\u5b57\u7b26\u4e32\u53ef\u4ee5\u77e5\u9053lua\u7684\u7248\u672c\u4e3a5.1.5<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

\u7ecf\u8fc7\u591a\u6b21\u6d4b\u8bd5\uff0c\u5728github\u4e0a\u80fd\u591f\u627e\u5230\u5bf9\u5e94luadec\u53cd\u7f16\u8bd1\u5de5\u5177\uff0c\u4f7f\u7528\u5bf9\u5e94\u7684\u5b89\u88c5\u65b9\u5f0f\u8fdb\u884c\u5b89\u88c5<\/p>\n\n\n\n

git clone https:\/\/github.com\/HandsomeYingyan\/luadec-openwrt.git\ncd luadec-openwrt\ncd lua-5.1\nmake linux\nsudo make install\ncd ..\/luadec\nmake LUAVER=5.1\nsudo cp luadec \/usr\/local\/bin\/<\/code><\/pre>\n\n\n\n
\u9996\u5148\u8bd5\u8bd5local_ssh.lua\u662f\u5426\u80fd\u591f\u6b63\u5e38\u53cd\u7f16\u8bd1\uff0c\u53ef\u4ee5\u770b\u51fa\u6765\u80fd\u591f\u6b63\u5e38\u53cd\u7f16\u8bd1\uff0c\u867d\u7136\u91cc\u9762\u6709\u4e00\u4e9b\u9519\u8bef\uff0c\u4f46\u57fa\u672c\u4e0d\u5f71\u54cd\u903b\u8f91\u7684\u5206\u6790\uff1a<\/p>\n\n\n\n
$ luadec local_ssh.lua\n......\nlocal l_0_0 = require(\"hiwifi.json\")\nlocal l_0_1 = require(\"openapi.utils.utils\")\nlocal l_0_2 = string\nlocal l_0_3 = tostring\nmodule(\"luci.local_ssh.local_ssh\")\ndispatcher = function(l_1_0)\n  -- function num : 0_0 , upvalues : l_0_1, l_0_3, l_0_2, l_0_0\n  local l_1_1 = \"\"\n  local l_1_2 = {}\n  if not l_1_0 then\n    l_1_0 = {}\n  end\n  if l_1_0.method == \"get\" then\n    l_1_2.data = (l_0_1.exec_cmd)(\"sudo \/usr\/lib\/lua\/luci\/local_ssh\/local_ssh_util.lua get<\/mark>\")\n  else\n    -- DECOMPILER ERROR at PC32: Unhandled construct in 'MakeBoolean' P1\n\n    do\n      if not (l_0_1.exec_cmd)(\"sudo \/usr\/lib\/lua\/luci\/local_ssh\/local_ssh_util.lua valid \" .. l_0_3(l_1_0.data)<\/mark>) then\n        local l_1_3 = l_1_0.method ~= \"valid\" or l_1_0.data == nil or \"\"\n      end\n      -- DECOMPILER ERROR at PC34: Confused about usage of register: R3 in 'UnsetPending'\n\n      do\n        local l_1_4 = l_0_3(l_1_3)\n        if (l_0_2.find)(l_1_4, \"Success:\") ~= nil then\n          l_1_2.code = Unknown_Type_Error\n          l_1_2.data = l_1_4\n        else\n          l_1_2.code = Unknown_Type_Error\n          l_1_2.data = l_1_4\n        end\n        if l_1_0.method == \"stop\" then\n          l_1_2.data = (l_0_1.exec_cmd)(\"sudo \/usr\/lib\/lua\/luci\/local_ssh\/local_ssh_util.lua stop<\/mark>\")\n        else\n          l_1_2.code = Unknown_Type_Error\n          l_1_2.data = \"Error: Method does not exist\"\n        end\n        l_1_1 = (l_0_0.encode)(l_1_2)\n        return l_1_1\n      end\n    end\n  end\nend<\/code><\/pre>\n\n\n\n
\u901a\u8fc7\u5206\u6790\u53ef\u4ee5\u77e5\u9053\u4e3b\u8981\u7684\u903b\u8f91\u5b9e\u9645\u4e0a\u5728\u53e6\u5916\u4e00\u4e2alua\u811a\u672clocal_ssh_util.lua\uff0c\u90a3\u4e48\u4f7f\u7528\u540c\u6837\u7684\u65b9\u5f0f\u53cd\u7f16\u8bd1\uff1a<\/p>\n\n\n\n
$ luadec local_ssh_util.lua\n......\nlocal l_0_0 = require(\"tw\")\nlocal l_0_1 = require(\"auth\")\nlocal l_0_2 = require(\"socket\")\nlocal l_0_3 = require(\"luci.util\")\nlocal l_0_4 = require(\"nixio\")\nlocal l_0_5 = require(\"luci.http.protocol\")\nlocal l_0_6 = (math.floor)((l_0_2.gettime)() * Unknown_Type_Error)\nlocal l_0_7 = (l_0_0.get_mac)()\nlocal l_0_8 = \"ssh\"\nlocal l_0_9 = \"\"\nlocal l_0_10 = tostring(l_0_7) .. \",\" .. l_0_8 .. \",\" .. tostring(l_0_6)\nlocal l_0_11 = \"\"\nlocal l_0_12 = \"\/tmp\/local_ssh_ms\"\nlocal l_0_13 = (io.open)(l_0_12, \"r\")\nlocal l_0_14 = Unknown_Type_Error\nlocal l_0_15 = arg[Unknown_Type_Error]\ndo\n  local l_0_16 = arg[Unknown_Type_Error] or \"\"\n  local l_0_17, l_0_18 = , nil\n  if not l_0_13:read(\"*n\") then\n    l_0_13:close()\n    -- DECOMPILER ERROR at PC71: Overwrote pending register: R14 in 'AssignReg'\n\n    l_0_13:close()\n    -- DECOMPILER ERROR at PC83: Overwrote pending register: R13 in 'AssignReg'\n\n    if l_0_15 == \"get\"<\/mark> then\n      l_0_13:write(l_0_6)\n      l_0_13:close()\n      -- DECOMPILER ERROR at PC106: Overwrote pending register: R11 in 'AssignReg'\n\n      print(l_0_11<\/mark>)\n      ;\n      (os.exit)(Unknown_Type_Error)\n    else\n      -- DECOMPILER ERROR at PC136: Overwrote pending register: R11 in 'AssignReg'\n\n      -- DECOMPILER ERROR at PC141: Overwrote pending register: R11 in 'AssignReg'\n\n      if l_0_15 == \"valid\"<\/mark> then\n        if (l_0_1.lua_hmac_sha1_with_uuid)(l_0_10, (string.len)(l_0_10)<\/mark>) or l_0_17<\/mark> == l_0_11<\/mark> then\n          (os.execute)(\"\/etc\/init.d\/dropbear restart;hwf-at 10 \/usr\/lib\/lua\/luci\/local_ssh\/local_ssh_util.lua check_connected<\/mark>\")\n          ;\n          (os.remove)(l_0_12)\n          if l_0_18 == nil then\n            print(\"Error: port file does not exist\")\n            ;\n            (os.exit)(Unknown_Type_Error)\n          end\n          -- DECOMPILER ERROR at PC169: Overwrote pending register: R18 in 'AssignReg'\n\n          if nil == nil then\n            print(\"Error: port does not exist\")\n            ;\n            (os.exit)(Unknown_Type_Error)\n          end\n          l_0_18:close()\n          -- DECOMPILER ERROR at PC183: Confused about usage of register: R18 in 'UnsetPending'\n\n          print(\"Success: ssh port is \" .. nil)\n          ;\n          (os.exit)(Unknown_Type_Error)\n        else\n          print(\"Error: valid token error\")\n          ;\n          (os.exit)(Unknown_Type_Error)\n        end\n      else\n        if l_0_15 == \"stop\" then\n          local l_0_19 = nil\n          local l_0_20 = nil\n          l_0_20:close()\n          if ((io.popen)(\"pidof dropbear | wc -w\")):read(\"*n\") <= Unknown_Type_Error then\n            (os.execute)(\"\/etc\/init.d\/dropbear stop\")\n          else\n            ;\n            (os.execute)(\"hwf-at 5 \/usr\/lib\/lua\/luci\/local_ssh\/local_ssh_util.lua stop\")\n          end\n        else\n          do\n            if l_0_15 == \"check_connected\" then\n              local l_0_21 = nil\n              local l_0_22 = nil\n              l_0_22:close()\n              if ((io.popen)(\"pidof dropbear | wc -w\")):read(\"*n\") <= Unknown_Type_Error then\n                (os.execute)(\"hwf-at 10 \/usr\/lib\/lua\/luci\/local_ssh\/local_ssh_util.lua check_connected\")\n              else\n                ;\n                (os.execute)(\"hwf-at 180 \/usr\/lib\/lua\/luci\/local_ssh\/local_ssh_util.lua stop\")\n              end\n            else\n              do\n                print(\"Error: method does not exist\")\n                ;\n                (os.exit)(Unknown_Type_Error)\n              end\n            end\n          end\n        end\n      end\n    end\n  end\nend<\/code><\/pre>\n\n\n\n
\u901a\u8fc7\u6d4f\u89c8\u5668\u6293\u53d6\u5f00\u542fssh\u7684\u8bf7\u6c42\u5305\uff0c\u53ef\u4ee5\u77e5\u9053method=get\u7684\u65f6\u5019\u4f1a\u751f\u6210\u4e00\u4e32\u5b57\u7b26\u4e32local token\uff0c\u9700\u8981\u5c06\u5b83\u53d1\u9001\u5230\u5b98\u65b9\u5ba2\u670d\uff0c\u7136\u540e\u901a\u8fc7\u8fd9\u6bb5\u5b57\u7b26\u4e32\u8fdb\u884c\u8ba1\u7b97\u5f97\u5230cloud token\uff0c\u5f53method=valid\u7684\u65f6\u5019\uff0c\u8f93\u5165token\u8fdb\u884c\u6821\u9a8c\uff0c\u5c31\u80fd\u5f00\u542fdropbear\uff0c\u4e5f\u5c31\u662fssh\u670d\u52a1\u4e86\u3002\u901a\u8fc7\u7b80\u5355\u7684\u903b\u8f91\u5206\u6790\uff0c\u603b\u7ed3\u5982\u4e0b\uff1a<\/p>\n\n\n\n
method\u503c<\/td>\u4f5c\u7528<\/td><\/tr>
get<\/td>\u5199\u5165\u5f53\u524d\u65f6\u95f4\u6233\u5b58\u5165\/tmp\/local_ssh_ms\uff0c\u5e76\u4e14\u751f\u6210local token\u5b57\u7b26\u4e32<\/td><\/tr>
valid<\/td>\u6821\u9a8ccloud token\uff0c\u5982\u679c\u6b63\u786e\u5219\u91cd\u65b0\u542f\u52a8ssh\u670d\u52a1<\/td><\/tr>
stop<\/td>\u505c\u6b62ssh\u670d\u52a1<\/td><\/tr>
check_connected<\/td>\u68c0\u67e5ssh\u670d\u52a1\u72b6\u6001\uff0c\u5b9e\u9645\u4e0a\u8fd9\u4e2amethod\u662f\u65e0\u6cd5\u8c03\u7528\u5230\u7684<\/strong><\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
\u90a3\u4e48method=valid\u7684\u6821\u9a8c\u65b9\u6cd5\u5c31\u662f\u5173\u952e\uff0c\u7136\u800c\u53cd\u7f16\u8bd1\u7684\u7ed3\u679c\u6709\u4e00\u4e9b\u4e0d\u5b8c\u6574\uff0c\u6574\u4e2a\u903b\u8f91\u65e0\u6cd5\u8fde\u8d2f\u8d77\u6765\uff0c\u90a3\u4e48\u5c31\u5f97\u5206\u6790\u539f\u59cb\u7684lua\u5b57\u8282\u7801\u4e86\uff1a<\/p>\n\n\n\n
$ luac -l local_ssh_util.lua \n1\t[-]\tGETGLOBAL\t0 -1\t; require\n2\t[-]\tLOADK    \t1 -2\t; \"tw\"\n3\t[-]\tCALL     \t0 2 2\n4\t[-]\tGETGLOBAL\t1 -1\t; require\n5\t[-]\tLOADK    \t2 -3\t; \"auth\"\n6\t[-]\tCALL     \t1 2 2\n7\t[-]\tGETGLOBAL\t2 -1\t; require\n8\t[-]\tLOADK    \t3 -4\t; \"socket\"\n9\t[-]\tCALL     \t2 2 2\n10\t[-]\tGETGLOBAL\t3 -1\t; require\n11\t[-]\tLOADK    \t4 -5\t; \"luci.util\"\n12\t[-]\tCALL     \t3 2 2\n13\t[-]\tGETGLOBAL\t4 -1\t; require\n14\t[-]\tLOADK    \t5 -6\t; \"nixio\"\n15\t[-]\tCALL     \t4 2 2\n16\t[-]\tGETGLOBAL\t5 -1\t; require\n17\t[-]\tLOADK    \t6 -7\t; \"luci.http.protocol\"\n18\t[-]\tCALL     \t5 2 2\n19\t[-]\tGETGLOBAL\t6 -8\t; math\n20\t[-]\tGETTABLE \t6 6 -9\t; \"floor\"\n21\t[-]\tGETTABLE \t7 2 -10\t; \"gettime\"\n22\t[-]\tCALL     \t7 1 2\n23\t[-]\tMUL      \t7 7 -11\t; - 1000\n24\t[-]\tCALL     \t6 2 2\n25\t[-]\tGETTABLE \t7 0 -12\t; \"get_mac\"\n26\t[-]\tCALL     \t7 1 2\n27\t[-]\tLOADK    \t8 -13\t; \"ssh\"\n28\t[-]\tLOADK    \t9 -14\t; \"\"\n29\t[-]\tGETGLOBAL\t10 -15\t; tostring\n30\t[-]\tMOVE     \t11 7\n31\t[-]\tCALL     \t10 2 2\n32\t[-]\tLOADK    \t11 -16\t; \",\"\n33\t[-]\tMOVE     \t12 8\n34\t[-]\tLOADK    \t13 -16\t; \",\"\n35\t[-]\tGETGLOBAL\t14 -15\t; tostring\n36\t[-]\tMOVE     \t15 6\n37\t[-]\tCALL     \t14 2 2\n38\t[-]\tCONCAT   \t10 10 14\n39\t[-]\tLOADK    \t11 -14\t; \"\"\n40\t[-]\tLOADK    \t12 -17\t; \"\/tmp\/local_ssh_ms\"\n41\t[-]\tGETGLOBAL\t13 -18\t; io\n42\t[-]\tGETTABLE \t13 13 -19\t; \"open\"\n43\t[-]\tMOVE     \t14 12\n44\t[-]\tLOADK    \t15 -20\t; \"r\"\n45\t[-]\tCALL     \t13 3 2\n46\t[-]\tLOADK    \t14 -21\t; 0\n47\t[-]\tGETGLOBAL\t15 -22\t; arg\n48\t[-]\tGETTABLE \t15 15 -23\t; 1\n49\t[-]\tGETGLOBAL\t16 -22\t; arg\n50\t[-]\tGETTABLE \t16 16 -24\t; 2\n51\t[-]\tTEST     \t16 0 1\n52\t[-]\tJMP      \t1\t; to 54\n53\t[-]\tLOADK    \t16 -14\t; \"\"\n54\t[-]\tLOADNIL  \t17 18\n55\t[-]\tEQ       \t1 13 -25\t; - nil\n56\t[-]\tJMP      \t9\t; to 66\n57\t[-]\tSELF     \t19 13 -26\t; \"read\"\n58\t[-]\tLOADK    \t21 -27\t; \"*n\"\n59\t[-]\tCALL     \t19 3 2\n60\t[-]\tTESTSET  \t14 19 1\n61\t[-]\tJMP      \t1\t; to 63\n62\t[-]\tLOADK    \t14 -21\t; 0\n63\t[-]\tSELF     \t19 13 -28\t; \"close\"\n64\t[-]\tCALL     \t19 2 1\n65\t[-]\tJMP      \t9\t; to 75\n66\t[-]\tGETGLOBAL\t19 -18\t; io\n67\t[-]\tGETTABLE \t19 19 -19\t; \"open\"\n68\t[-]\tMOVE     \t20 12\n69\t[-]\tLOADK    \t21 -29\t; \"a\"\n70\t[-]\tCALL     \t19 3 2\n71\t[-]\tMOVE     \t13 19\n72\t[-]\tLOADK    \t14 -21\t; 0\n73\t[-]\tSELF     \t19 13 -28\t; \"close\"\n74\t[-]\tCALL     \t19 2 1\n75\t[-]\tEQ       \t0 15 -30\t; - \"get\"\n76\t[-]\tJMP      \t39\t; to 116\n77\t[-]\tGETGLOBAL\t19 -31\t; assert\n78\t[-]\tGETGLOBAL\t20 -18\t; io\n79\t[-]\tGETTABLE \t20 20 -19\t; \"open\"\n80\t[-]\tMOVE     \t21 12\n81\t[-]\tLOADK    \t22 -32\t; \"w\"\n82\t[-]\tCALL     \t20 3 0\n83\t[-]\tCALL     \t19 0 2\n84\t[-]\tMOVE     \t13 19\n85\t[-]\tSELF     \t19 13 -33\t; \"write\"\n86\t[-]\tMOVE     \t21 6\n87\t[-]\tCALL     \t19 3 1\n88\t[-]\tSELF     \t19 13 -28\t; \"close\"\n89\t[-]\tCALL     \t19 2 1\n90\t[-]\tGETTABLE \t19 1 -34\t; \"lua_hmac_sha1_with_uuid\"\n91\t[-]\tMOVE     \t20 10\n92\t[-]\tGETGLOBAL\t21 -35\t; string\n93\t[-]\tGETTABLE \t21 21 -36\t; \"len\"\n94\t[-]\tMOVE     \t22 10\n95\t[-]\tCALL     \t21 2 0\n96\t[-]\tCALL     \t19 0 2\n97\t[-]\tTESTSET  \t11 19 1\n98\t[-]\tJMP      \t1\t; to 100\n99\t[-]\tLOADK    \t11 -14\t; \"\"\n100\t[-]\tGETTABLE \t19 4 -37\t; \"bin\"\n101\t[-]\tGETTABLE \t19 19 -38\t; \"b64encode\"\n102\t[-]\tMOVE     \t20 10\n103\t[-]\tLOADK    \t21 -16\t; \",\"\n104\t[-]\tMOVE     \t22 11\n105\t[-]\tCONCAT   \t20 20 22\n106\t[-]\tCALL     \t19 2 2\n107\t[-]\tMOVE     \t11 19\n108\t[-]\tGETGLOBAL\t19 -39\t; print\n109\t[-]\tMOVE     \t20 11\n110\t[-]\tCALL     \t19 2 1\n111\t[-]\tGETGLOBAL\t19 -40\t; os\n112\t[-]\tGETTABLE \t19 19 -41\t; \"exit\"\n113\t[-]\tLOADK    \t20 -23\t; 1\n114\t[-]\tCALL     \t19 2 1\n115\t[-]\tJMP      \t137\t; to 253\n116\t[-]\tEQ       \t0 15 -42\t; - \"valid\"\n117\t[-]\tJMP      \t82\t; to 200\n118\t[-]\tGETGLOBAL\t19 -15\t; tostring\n119\t[-]\tMOVE     \t20 7\n120\t[-]\tCALL     \t19 2 2\n121\t[-]\tLOADK    \t20 -16\t; \",\"\n122\t[-]\tMOVE     \t21 8\n123\t[-]\tLOADK    \t22 -16\t; \",\"\n124\t[-]\tGETGLOBAL\t23 -15\t; tostring\n125\t[-]\tADD      \t24 14 -23\t; - 1\n126\t[-]\tCALL     \t23 2 2\n127\t[-]\tCONCAT   \t10 19 23\n128\t[-]\tGETTABLE \t19 1 -34\t; \"lua_hmac_sha1_with_uuid\"\n129\t[-]\tMOVE     \t20 10\n130\t[-]\tGETGLOBAL\t21 -35\t; string\n131\t[-]\tGETTABLE \t21 21 -36\t; \"len\"\n132\t[-]\tMOVE     \t22 10\n133\t[-]\tCALL     \t21 2 0\n134\t[-]\tCALL     \t19 0 2\n135\t[-]\tTESTSET  \t11 19 1\n136\t[-]\tJMP      \t1\t; to 138\n137\t[-]\tLOADK    \t11 -14\t; \"\"\n138\t[-]\tGETTABLE \t19 4 -37\t; \"bin\"\n139\t[-]\tGETTABLE \t19 19 -38\t; \"b64encode\"\n140\t[-]\tMOVE     \t20 11\n141\t[-]\tCALL     \t19 2 2\n142\t[-]\tMOVE     \t11 19\n143\t[-]\tEQ       \t0 16 11\n144\t[-]\tJMP      \t47\t; to 192\n145\t[-]\tGETGLOBAL\t19 -40\t; os\n146\t[-]\tGETTABLE \t19 19 -43\t; \"execute\"\n147\t[-]\tLOADK    \t20 -44\t; \"\/etc\/init.d\/dropbear restart;hwf-at 10 \/usr\/lib\/lua\/luci\/local_ssh\/local_ssh_util.lua check_connected\"\n148\t[-]\tCALL     \t19 2 1\n149\t[-]\tGETGLOBAL\t19 -40\t; os\n150\t[-]\tGETTABLE \t19 19 -45\t; \"remove\"\n151\t[-]\tMOVE     \t20 12\n152\t[-]\tCALL     \t19 2 1\n153\t[-]\tGETGLOBAL\t19 -18\t; io\n154\t[-]\tGETTABLE \t19 19 -46\t; \"popen\"\n155\t[-]\tLOADK    \t20 -47\t; \"s=`netstat -lntp|grep dropbear | grep '0.0.0.0' | grep -v '127.0.0.1'|awk '{print $4}'`; echo ${s##*:}\"\n156\t[-]\tCALL     \t19 2 2\n157\t[-]\tMOVE     \t17 19\n158\t[-]\tEQ       \t0 17 -25\t; - nil\n159\t[-]\tJMP      \t7\t; to 167\n160\t[-]\tGETGLOBAL\t19 -39\t; print\n161\t[-]\tLOADK    \t20 -48\t; \"Error: port file does not exist\"\n162\t[-]\tCALL     \t19 2 1\n163\t[-]\tGETGLOBAL\t19 -40\t; os\n164\t[-]\tGETTABLE \t19 19 -41\t; \"exit\"\n165\t[-]\tLOADK    \t20 -23\t; 1\n166\t[-]\tCALL     \t19 2 1\n167\t[-]\tSELF     \t19 17 -26\t; \"read\"\n168\t[-]\tLOADK    \t21 -27\t; \"*n\"\n169\t[-]\tCALL     \t19 3 2\n170\t[-]\tMOVE     \t18 19\n171\t[-]\tEQ       \t0 18 -25\t; - nil\n172\t[-]\tJMP      \t7\t; to 180\n173\t[-]\tGETGLOBAL\t19 -39\t; print\n174\t[-]\tLOADK    \t20 -49\t; \"Error: port does not exist\"\n175\t[-]\tCALL     \t19 2 1\n176\t[-]\tGETGLOBAL\t19 -40\t; os\n177\t[-]\tGETTABLE \t19 19 -41\t; \"exit\"\n178\t[-]\tLOADK    \t20 -23\t; 1\n179\t[-]\tCALL     \t19 2 1\n180\t[-]\tSELF     \t19 17 -28\t; \"close\"\n181\t[-]\tCALL     \t19 2 1\n182\t[-]\tGETGLOBAL\t19 -39\t; print\n183\t[-]\tLOADK    \t20 -50\t; \"Success: ssh port is \"\n184\t[-]\tMOVE     \t21 18\n185\t[-]\tCONCAT   \t20 20 21\n186\t[-]\tCALL     \t19 2 1\n187\t[-]\tGETGLOBAL\t19 -40\t; os\n188\t[-]\tGETTABLE \t19 19 -41\t; \"exit\"\n189\t[-]\tLOADK    \t20 -23\t; 1\n190\t[-]\tCALL     \t19 2 1\n191\t[-]\tJMP      \t61\t; to 253\n192\t[-]\tGETGLOBAL\t19 -39\t; print\n193\t[-]\tLOADK    \t20 -51\t; \"Error: valid token error\"\n194\t[-]\tCALL     \t19 2 1\n195\t[-]\tGETGLOBAL\t19 -40\t; os\n196\t[-]\tGETTABLE \t19 19 -41\t; \"exit\"\n197\t[-]\tLOADK    \t20 -23\t; 1\n198\t[-]\tCALL     \t19 2 1\n199\t[-]\tJMP      \t53\t; to 253\n200\t[-]\tEQ       \t0 15 -52\t; - \"stop\"\n201\t[-]\tJMP      \t21\t; to 223\n202\t[-]\tGETGLOBAL\t19 -18\t; io\n203\t[-]\tGETTABLE \t19 19 -46\t; \"popen\"\n204\t[-]\tLOADK    \t20 -53\t; \"pidof dropbear | wc -w\"\n205\t[-]\tCALL     \t19 2 2\n206\t[-]\tSELF     \t20 19 -26\t; \"read\"\n207\t[-]\tLOADK    \t22 -27\t; \"*n\"\n208\t[-]\tCALL     \t20 3 2\n209\t[-]\tSELF     \t21 19 -28\t; \"close\"\n210\t[-]\tCALL     \t21 2 1\n211\t[-]\tLE       \t0 20 -23\t; - 1\n212\t[-]\tJMP      \t5\t; to 218\n213\t[-]\tGETGLOBAL\t21 -40\t; os\n214\t[-]\tGETTABLE \t21 21 -43\t; \"execute\"\n215\t[-]\tLOADK    \t22 -54\t; \"\/etc\/init.d\/dropbear stop\"\n216\t[-]\tCALL     \t21 2 1\n217\t[-]\tJMP      \t35\t; to 253\n218\t[-]\tGETGLOBAL\t21 -40\t; os\n219\t[-]\tGETTABLE \t21 21 -43\t; \"execute\"\n220\t[-]\tLOADK    \t22 -55\t; \"hwf-at 5 \/usr\/lib\/lua\/luci\/local_ssh\/local_ssh_util.lua stop\"\n221\t[-]\tCALL     \t21 2 1\n222\t[-]\tJMP      \t30\t; to 253\n223\t[-]\tEQ       \t0 15 -56\t; - \"check_connected\"\n224\t[-]\tJMP      \t21\t; to 246\n225\t[-]\tGETGLOBAL\t19 -18\t; io\n226\t[-]\tGETTABLE \t19 19 -46\t; \"popen\"\n227\t[-]\tLOADK    \t20 -53\t; \"pidof dropbear | wc -w\"\n228\t[-]\tCALL     \t19 2 2\n229\t[-]\tSELF     \t20 19 -26\t; \"read\"\n230\t[-]\tLOADK    \t22 -27\t; \"*n\"\n231\t[-]\tCALL     \t20 3 2\n232\t[-]\tSELF     \t21 19 -28\t; \"close\"\n233\t[-]\tCALL     \t21 2 1\n234\t[-]\tLE       \t0 20 -23\t; - 1\n235\t[-]\tJMP      \t5\t; to 241\n236\t[-]\tGETGLOBAL\t21 -40\t; os\n237\t[-]\tGETTABLE \t21 21 -43\t; \"execute\"\n238\t[-]\tLOADK    \t22 -57\t; \"hwf-at 10 \/usr\/lib\/lua\/luci\/local_ssh\/local_ssh_util.lua check_connected\"\n239\t[-]\tCALL     \t21 2 1\n240\t[-]\tJMP      \t12\t; to 253\n241\t[-]\tGETGLOBAL\t21 -40\t; os\n242\t[-]\tGETTABLE \t21 21 -43\t; \"execute\"\n243\t[-]\tLOADK    \t22 -58\t; \"hwf-at 180 \/usr\/lib\/lua\/luci\/local_ssh\/local_ssh_util.lua stop\"\n244\t[-]\tCALL     \t21 2 1\n245\t[-]\tJMP      \t7\t; to 253\n246\t[-]\tGETGLOBAL\t19 -39\t; print\n247\t[-]\tLOADK    \t20 -59\t; \"Error: method does not exist\"\n248\t[-]\tCALL     \t19 2 1\n249\t[-]\tGETGLOBAL\t19 -40\t; os\n250\t[-]\tGETTABLE \t19 19 -41\t; \"exit\"\n251\t[-]\tLOADK    \t20 -23\t; 1\n252\t[-]\tCALL     \t19 2 1\n253\t[-]\tRETURN   \t0 1<\/code><\/pre>\n\n\n\n
\u6709\u4e86\u6c47\u7f16\u7684\u57fa\u7840\uff0clua\u5b57\u8282\u7801\u8fd8\u662f\u6bd4\u8f83\u5bb9\u6613\u770b\u61c2\u7684\uff0c\u5173\u952e\u903b\u8f91\u5982\u4e0b\uff1a<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
local token\u751f\u6210\u65b9\u6cd5\uff0c\u5176\u4e2d\u65f6\u95f4\u6233\u5b58\u5165\/tmp\/local_ssh_ms\u6587\u4ef6\uff1a<\/p>\n\n\n\n
mac\u5730\u5740,ssh,timestamp\u65f6\u95f4\u6233,hmac\u54c8\u5e0c\u8ba4\u8bc1\uff08mac\u5730\u5740,ssh,timestamp\u65f6\u95f4\u6233\uff09<\/code><\/pre>\n\n\n\n
cloud token\u751f\u6210\u65b9\u6cd5\uff1a<\/p>\n\n\n\n
hmac\u54c8\u5e0c\u8ba4\u8bc1\uff08local token\u7684timestamp\u65f6\u95f4\u6233+1\uff09<\/code><\/pre>\n\n\n\n
\u5176\u4e2dhmac\u54c8\u5e0c\u8ba4\u8bc1\u7684\u5bc6\u7801\u4e3auuid\u7684sha1\u503c\uff0c\u5177\u4f53\u7684\u7ec6\u8282\u53ef\u4ee5\u9006\u5411\/usr\/lib\/libauth.so\u7684hmac_sha1_with_uuid\u51fd\u6570\u3002<\/p>\n\n\n\n
\u4e09\u3001\u7ec8\u63a2ssh<\/h2>\n\n\n\n
\u6839\u636e\u903b\u8f91\u6211\u4eec\u53ef\u4ee5\u7f16\u5199\u4ee3\u7801\u6765\u5b9e\u73b0\u81ea\u52a8\u5f00\u542fssh\u529f\u80fd\uff0c\u4ee5\u4e0b\u662fpython3\u4ee3\u7801\u5c55\u793a\uff0c\u5982\u679c\u6210\u529f\uff0c\u5219\u4f1a\u663e\u793a\u201cresult >> Success: ssh port is 22\u201d<\/p>\n\n\n\n
import base64,hashlib,hmac,json,urllib.request\n\ndef urlopen(url):\n    r = urllib.request.urlopen(url)\n    j = json.loads(r.read())\n    return j\n\ndef get_hmac_sha1(message, key):\n    result = hmac.new(key, message, hashlib.sha1).digest()\n    return base64.b64encode(result).decode()\n\ndef sha1(data):\n    return hashlib.sha1(data).digest()\n\nif __name__ == '__main__':\n    local_token = urlopen(\"http:\/\/www.4006024680.com\/local-ssh\/api?method=get\")[\"data\"]\n    print(\"local token:\" + local_token)\n    mac, ssh, t, hmacstr = base64.b64decode(local_token).split(b\",\",3)\n    message = \"{},ssh,{}\".format(mac.decode(),int(t)+1).encode()\n\n    uuid = urlopen(\"http:\/\/www.4006024680.com\/cgi-bin\/turbo\/proxy\/router_info\")[\"data\"][\"uuid\"]\n    print(\"uuid:\" + uuid)\n    key  = sha1(uuid.encode())\n    h    = get_hmac_sha1(message, key)\n    print(\"cloud token:\" + h)\n\n    print(\"result >> \" + urlopen(\"http:\/\/www.4006024680.com\/local-ssh\/api?method=valid&data=\" + h)[\"data\"])<\/code><\/pre>\n\n\n\n
\u5f53\u7136\uff0c\u4e3a\u4e86\u65b9\u4fbf\u5927\u5bb6\uff0c\u4e5f\u53ef\u4ee5\u4f7f\u7528\u672c\u7ad9\u7684\u5728\u7ebf\u5de5\u5177<\/a>\u8fdb\u884c\u64cd\u4f5c\uff1a<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\u56db\u3001\u53c2\u8003\u94fe\u63a5<\/h2>\n\n\n\n
https:\/\/baijiahao.baidu.com\/s?id=1607853490223049939<\/a><\/p>\n\n\n\n
https:\/\/www.cnblogs.com\/lsgxeva\/p\/16376971.html<\/a><\/p>\n\n\n\n
https:\/\/zhuanlan.zhihu.com\/p\/108934048<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"
\u4e00\u3001\u5f15\u8a00 \u624b\u91cc\u6709\u53f0\u6781\u8def\u7531\uff0c\u578b\u53f7HC5861\uff0c\u611f\u89c9\u505a\u5de5\u4e0d\u9519\uff0c\u5168\u94dd\u5408\u91d1\u5916\u58f3\uff0c\u6563\u70ed\u529f\u80fd\u826f\u597d\uff0c\u529f\u80fd\u633a\u591a\uff0c\u652f\u6301\u63d2\u4ef6\uff0c\u5b98\u65b9\u5ba3\u79f0\u7684\u53bb\u89c6\u9891\u65e0\u5e7f\u544a\u529f\u80fd\u3001\u51fa\u56fd\u52a0\u901f\u7b49\u4e5f\u662f\u6536\u5230\u5916\u754c\u4e00\u81f4\u597d\u8bc4\u3002 \u53ef\u60dc\u6b63\u662f\u7531\u4e8e\u67d0\u4e9b\u63d2\u4ef6\u7684\u539f\u56e0\uff0c\u5bfc\u81f4\u2026<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[23],"tags":[],"blocksy_meta":{"styles_descriptor":{"styles":{"desktop":"","tablet":"","mobile":""},"google_fonts":[],"version":5}},"_links":{"self":[{"href":"https:\/\/www.zhiwanyuzhou.com\/index.php\/wp-json\/wp\/v2\/posts\/1635"}],"collection":[{"href":"https:\/\/www.zhiwanyuzhou.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.zhiwanyuzhou.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.zhiwanyuzhou.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.zhiwanyuzhou.com\/index.php\/wp-json\/wp\/v2\/comments?post=1635"}],"version-history":[{"count":15,"href":"https:\/\/www.zhiwanyuzhou.com\/index.php\/wp-json\/wp\/v2\/posts\/1635\/revisions"}],"predecessor-version":[{"id":1669,"href":"https:\/\/www.zhiwanyuzhou.com\/index.php\/wp-json\/wp\/v2\/posts\/1635\/revisions\/1669"}],"wp:attachment":[{"href":"https:\/\/www.zhiwanyuzhou.com\/index.php\/wp-json\/wp\/v2\/media?parent=1635"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.zhiwanyuzhou.com\/index.php\/wp-json\/wp\/v2\/categories?post=1635"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.zhiwanyuzhou.com\/index.php\/wp-json\/wp\/v2\/tags?post=1635"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}