(原创)Openwrt路由器Post登陆校园网全过程(后续再补)

最新推荐文章于 2025-07-11 22:26:20 发布

原创最新推荐文章于 2025-07-11 22:26:20 发布 · 9.7k 阅读

19 ·

CC 4.0 BY-SA版权

文章标签：

#原创

IT 专栏收录该内容

1 篇文章

订阅专栏

本文介绍了一种使用OpenWrt路由器自动登录校园网的方法，并提供了一个简单的C语言示例程序，用于构建POST请求来绕过学校的登录页面。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

我是非常厌烦学校校园网的iptable，每次上网都要输入账号密码，而且IP池租期又短才十几分钟。所以我就想有没有什么方法可以跳过这个过程。我一想，POST肯定避免不了的的，如果用电脑去实现这个过程，我特么每次都要开着电脑，我还不如手动输入。我一开始想到用单片机，但是后来发现单片机那几K的运存运行100多K的C程序是不太现实的，主要是我对这种KB级别的内存控制不懂。然后我就想到ARM如何，百度查了一下肯定能运行，而且性能强大。但是淘宝ARM开发板，稍微好一点的开发板都要800多，果断放弃了这个想法。后来很长时间搁置了这个计划。

后来，当我在淘宝搜路由器的时候，我就想路由器有独立mac,能不能通过编程路由器去实现这个过程。搜一下还真有这种路由器,而且还开源的，我直接开心的跳了起来。这个强大的系统就是Openwrt，一个精简版的Linux系统。很开心，因为我对Linux系统之间很友好（毕竟跑过挺长时间的Linux），搭建Linux下的编译环境根本不是问题，因为我笔记本没有安装Linux，于是我下载了Ubuntu16.04发行版，传统模式进入U盘进行安装双系统（Ubuntu安装教程很多，我就不多展示了）。安装完之后，打开终端输入命令安装eclipse，这款优秀的代码编辑工具我就不多说了，接下来安装C/C++编译环境，编译环境配置完之后，我们开始抓包

POST http://172.31.252.71:801/eportal/?c=ACSetting&a=Login&protocol=http:&hostname=172.31.252.71&iTermType=1&wlanuserip=172.27.180.94&wlanacip=192.168.252.254&wlanacname=drcom&mac=d4-5f-25-eb-d0-09&ip=172.27.180.94&session=ac1bb45e-000000000000-0000&enAdvert=0&queryACIP=0&loginMethod=1& HTTP/1.1
Accept: application/x-ms-application, image/jpeg, application/xaml+xml, image/gif, image/pjpeg, application/x-ms-xbap, */*
Referer: http://172.31.252.71/a70.htm?wlanuserip=172.27.180.94&wlanacip=192.168.252.254&wlanacname=drcom&session=ac1bb45e-000000000000-0000&vlanid=7&ip=172.27.180.94&ssid=drcom2&areaID=beijing&mac=00-00-00-00-00-00
Accept-Language: zh-CNUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C; .NET4.0E)DDDDD=%2C0%2CID&upass=PASSWORD&R1=0&R2=0&R3=0&R6=0¶=00&0MKKey=123456&buttonClicked=&redirect_url=&err_flag=&username=&password=&user=&cmd=&Login=
Content-Type: application/x-www-form-urlencodedAccept-Encoding: gzip, deflateHost: 172.31.252.71:801Content-Length: 157Connection: Keep-AlivePragma: no-cacheCookie: md5_login2=jii7Ith232Yse7hOl805i
     
上面几处下划线分别是:
①Post的地址以及端口  ②本地mac地址 ③本地ip地址 
绿色的那一长串是Post的内容，分别对应ID和Password..分析完之后我们开始写代码:
   
#include "stdafx.h"
#include "stdio.h"
#include "stdlib.h"
#include "winsock2.h"
#include <iostream>
#include <httpext.h>
#include <windef.h>
#include <Nb30.h>
#include <string>
#pragma comment(lib,"ws2_32.lib")
#pragma comment(lib,"netapi32.lib")s
using namespace std;
void findIP(char *ip, int size) ;
int getMAC(char * mac);
int main(int argc, char* argv[])
{
	char ip[20] = {0};
	char mac[30];
	findIP(ip, sizeof(ip));	
	getMAC(mac);
	printf("%s\n", ip);
	printf("%s\n", mac);
  SOCKET hsocket;
  SOCKADDR_IN saServer;
  WSADATA     wsadata;
  int     nRet;
  //char*   host_name="www.baidu.com";
  char   reqHead1[3000]="POST http://172.31.252.71:801/eportal/?c=ACSetting&a=Login&protocol=http:&hostname=172.31.252.71&iTermType=1&wlanuserip=";
  strcat(reqHead1,ip);
  strcat(reqHead1,"&wlanacip=192.168.252.254&wlanacname=drcom&mac=");
  strcat(reqHead1,mac);
  strcat(reqHead1,"&ip=");
  strcat(reqHead1,ip);

	 // f8-a9-63-48-be-ef
		
  char *reqHead2="&session=ac1bb3c1-000000000000-0000&enAdvert=0&queryACIP=0&loginMethod=1 HTTP/1.1\r\n"//此为要发送的数据包		  
        "Host: 172.31.252.71:801\r\n"
		"Connection: keep-alive\r\n"
		"Content-Length: 157\r\n"
		"Cache-Control: max-age=0\r\n"
		"Origin: http://172.31.252.71\r\n"
		"Upgrade-Insecure-Requests: 1\r\n"
		"User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 SE 2.X MetaSr 1.0\r\n"
		"Content-Type: application/x-www-form-urlencoded\r\n"
		"Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8\r\n"
		"Accept-Encoding: gzip, deflate\r\n"
		"Accept-Language: zh-CN,zh;q=0.8\r\n"
		"Cookie: md5_login2=jii7Ith232Yse7hOl805i\r\n"
		"\r\n"
		"DDDDD=%2C0%2CID&upass=PASSWORD&R1=0&R2=0&R3=0&R6=0¶=00&0MKKey=123456&buttonClicked=&redirect_url=&err_flag=&username=&password=&user=&cmd=&Login=\r\n"
		"\r\n";  

  strcat(reqHead1,reqHead2);

// 初始化套接字 
    if(WSAStartup(MAKEWORD(2,2),&wsadata))
        printf("初始化SOCKET出错！");
   // lphostent=gethostbyname(host_name);     
   // if(lphostent==NULL)     
      //  printf("lphostent为空！"); 
	//system("pause");
    hsocket   =   socket(AF_INET,SOCK_STREAM,IPPROTO_TCP);     
    saServer.sin_family = AF_INET;     
    saServer.sin_port = htons(801);     
	saServer.sin_addr.S_un.S_un_b.s_b1=172;
	saServer.sin_addr.S_un.S_un_b.s_b2=31;
	saServer.sin_addr.S_un.S_un_b.s_b3=252;
	saServer.sin_addr.S_un.S_un_b.s_b4=71;
    //saServer.sin_addr =*((LPIN_ADDR)*lphostent->h_addr_list);  

    // 利用SOCKET连接  
    nRet = connect(hsocket,(LPSOCKADDR)&saServer,sizeof(SOCKADDR_IN));     
    if(nRet == SOCKET_ERROR)     
    {
        printf("建立连接时出错！");  
		system("pause");
        closesocket(hsocket);
        return 0;
    }
    // 利用SOCKET发送  

    nRet = send(hsocket,reqHead1,strlen(reqHead1),0);  
    if(nRet==SOCKET_ERROR)  
    {  
        printf("发送数据包时出错！"); 
		system("pause");
        closesocket(hsocket);  
    }  
    char   Dest[3000];     
    nRet=1; 
	cout<<"here";

        // 接收返回数据包  
        nRet=recv(hsocket,(LPSTR)Dest,sizeof(Dest),0);     
        if(nRet>0)
            Dest[nRet]=0;
        else     
            Dest[0]=0;  
        // 显示返回数据包的大小、内容 
        printf("\nReceived   bytes:%d\n",nRet);     
        printf("Result:\n%s",Dest);     
}


void findIP(char *ip, int size) 
{
	WORD v = MAKEWORD(1, 1);
	WSADATA wsaData;
	WSAStartup(v, &wsaData); // 加载套接字库
	struct hostent *phostinfo = gethostbyname("");
	char *p = inet_ntoa (* ((struct in_addr *)(*phostinfo->h_addr_list)) ); 				
	strncpy(ip, p, size - 1);
	ip[size - 1] = '\0';
	WSACleanup( );
}

int getMAC(char * mac)
{
		NCB ncb; // Network control block
		typedef struct _ASTAT_
		{
		ADAPTER_STATUS   adapt;
		NAME_BUFFER   NameBuff   [30];
		}ASTAT, *PASTAT;
 
		ASTAT Adapter;
		typedef struct _LANA_ENUM
		{
		UCHAR length;
		UCHAR lana[MAX_LANA];
		}LANA_ENUM;
		LANA_ENUM lana_enum;
		UCHAR uRetCode;
		memset(&ncb, 0, sizeof(ncb));
		memset(&lana_enum, 0, sizeof(lana_enum));
 
		ncb.ncb_command = NCBENUM;
		ncb.ncb_buffer = (unsigned char *)&lana_enum;
		ncb.ncb_length = sizeof(LANA_ENUM);
		uRetCode = Netbios(&ncb);
		if(uRetCode != NRC_GOODRET)
		return uRetCode;
 
		for(int lana=0; lana<lana_enum.length; lana++)
		{
		ncb.ncb_command = NCBRESET;
		ncb.ncb_lana_num = lana_enum.lana[lana];
		uRetCode = Netbios(&ncb);
		if(uRetCode == NRC_GOODRET)
		break;
		}
		if(uRetCode != NRC_GOODRET)
		return uRetCode;
 
		memset(&ncb, 0, sizeof(ncb));
		ncb.ncb_command = NCBASTAT;
		ncb.ncb_lana_num = lana_enum.lana[0];
		strcpy((char*)ncb.ncb_callname, "*");
		ncb.ncb_buffer = (unsigned char *)&Adapter;
		ncb.ncb_length = sizeof(Adapter);
		uRetCode = Netbios(&ncb);
		if(uRetCode != NRC_GOODRET)
		return uRetCode;
		sprintf(mac,"%02X-%02X-%02X-%02X-%02X-%02X",
		Adapter.adapt.adapter_address[0],
		Adapter.adapt.adapter_address[1],
		Adapter.adapt.adapter_address[2],
		Adapter.adapt.adapter_address[3],
		Adapter.adapt.adapter_address[4],
		Adapter.adapt.adapter_address[5]
		);
		return 0;
}

未完待续.....