3
3
# The script should work on a number of vendors but Crestron seems to be the most popular.
4
4
#
5
5
# Sample usage:
6
- #
6
+ #
7
7
# albinolobster@ubuntu:~/poc/crestron$ python wppcmd_version.py -i 192.168.1.88
8
8
# [+] Attempting connection to 192.168.1.88:389
9
9
# [+] Connected!
15
15
import struct
16
16
import sys
17
17
import time
18
-
18
+ import select
19
+
19
20
top_parser = argparse .ArgumentParser (description = '' )
20
21
top_parser .add_argument ('-i' , '--ip' , action = "store" , dest = "ip" , required = True , help = "The IPv4 address to connect to" )
21
22
top_parser .add_argument ('-p' , '--port' , action = "store" , dest = "port" , type = int , help = "The port to connect to" , default = "389" )
24
25
25
26
sock = socket .socket (socket .AF_INET , socket .SOCK_STREAM )
26
27
sock .settimeout (5 )
27
- print "[+] Attempting connection to " + args .ip + ":" + str (args .port )
28
+ print ( "[+] Attempting connection to " + args .ip + ":" + str (args .port ) )
28
29
sock .connect ((args .ip , args .port ))
29
- print "[+] Connected!"
30
-
31
- wppcmd = "wppcmd\x00 \x00 \x90 "
30
+ print ("[+] Connected!" )
31
+
32
+ wppcmd = bytes ('wppcmd' , 'utf-8' ) + bytes .fromhex ('000090' )
33
+ sock .setblocking (0 )
32
34
sock .sendall (wppcmd )
33
-
34
- resp = sock .recv (1024 )
35
-
36
- if len (resp ) == 0x89 and resp .startswith ("wppcmd\x00 \x00 \x91 AWPP" ) == True :
37
- ip = resp [0x0d :0x12 ]
38
- hostname = resp [0x19 :0x41 ]
39
- hostname = hostname .strip ()
40
- brand = resp [0x41 :0x48 ]
41
- brand = brand .strip ()
42
- version = resp [0x7b :0x7f ]
43
- converted_ip = str (ord (ip [0 ])) + '.' + \
44
- str (ord (ip [1 ])) + '.' + \
45
- str (ord (ip [2 ])) + '.' + \
46
- str (ord (ip [3 ]))
47
- converted_version = str (ord (version [0 ])) + '.' + \
48
- str (ord (version [1 ])) + '.' + \
49
- str (ord (version [2 ])) + '.' + \
50
- str (ord (version [3 ]))
51
-
52
- print converted_ip + "," + hostname + "," + brand + "," + converted_version
53
-
54
- sock .close ()
35
+
36
+ ready = select .select ([sock ], [], [], 5 )
37
+
38
+ if ready [0 ]:
39
+ resp = sock .recv (1024 )
40
+
41
+ if len (resp ) == 0x89 and resp .startswith (bytes ("wppcmd" , 'utf-8' )) == True :
42
+ ip = resp [0x0d :0x12 ]
43
+ hostname = resp [0x19 :0x41 ]
44
+ hostname = hostname .rstrip (b' \t \r \n \0 ' )
45
+ brand = resp [0x41 :0x48 ]
46
+ brand = brand .rstrip (b' \t \r \n \0 ' )
47
+ version = resp [0x7b :0x7f ]
48
+ converted_ip = str (ip [0 ]) + '.' + \
49
+ str (ip [1 ]) + '.' + \
50
+ str (ip [2 ]) + '.' + \
51
+ str (ip [3 ])
52
+ converted_version = str (version [0 ]) + '.' + \
53
+ str (version [1 ]) + '.' + \
54
+ str (version [2 ]) + '.' + \
55
+ str (version [3 ])
56
+
57
+ print (converted_ip )
58
+ print (str (hostname , 'utf-8' ))
59
+ print (str (brand , 'utf-8' ))
60
+ print (converted_version )
61
+
62
+ sock .close ()
0 commit comments