Logging into router from command line

michael.wegemer · 03-18-2010, 02:18 PM

I would like to log into my router to get the status page programmatically. I have a dynamic IP address and need to update my dynamic dsl service. The router will not display its address with traceroute (all I get is * * *. Once I am logged into the router I can retrieve the status page with wget and parse the resulting file. I cannot seem to get logged into it with wget. Does anyone know how this might be done? If I posted the HTML page that I log into (from wget of the login page) could someone tell me what I need to code. The router is a Trendnet TEW-652BRP. Their technical support has been no help. I can get it off the internet but if my connection is down it will fail. Thanks

smoker · 03-18-2010, 02:35 PM

Why don't you use the built in DynDNS support ?
http://downloads.trendnet.com/tew-65...brp(v1.0r).pdf

michael.wegemer · 03-18-2010, 08:00 PM

Quote:

Originally Posted by smoker

Why don't you use the built in DynDNS support ?
http://downloads.trendnet.com/tew-65...brp(v1.0r).pdf

Thanks smoker. I looked at that option but my dynamic dns provider is not one of the ones they support. I am using 2mydns.com. If it was a supported one I would simply run ddclient for my distribution. (fedora 12 x86_64)

theNbomr · 03-18-2010, 08:06 PM

It is unclear how the act of logging in affects what wget will allow you to retrieve.
Can you post a recipe for what you do manually that allows you to retrieve the desired information? Some representative fragment of the data containing the information would be helpful, too, if you require help parsing out the useful bits (use '[CODE]' tags to preserve formatting, please).
--- rod.

jschiwal · 03-18-2010, 08:20 PM

Wouldn't your router's status page be on the internal (gateway) address?

If you want to learn which IP address your ISP assigned to the router, you could use traceroute or tracepath and extract the info from that. The line you use depends on whether you have a router between your host and the router.

Example:

Code:

/sbin/tracepath 8.8.8.8 | head -n3 | sed -n '3s/.*(\([[:digit:].]*\)).*/\1/p'

michael.wegemer · 03-18-2010, 08:48 PM

Quote:

Originally Posted by theNbomr

It is unclear how the act of logging in affects what wget will allow you to retrieve.
Can you post a recipe for what you do manually that allows you to retrieve the desired information? Some representative fragment of the data containing the information would be helpful, too, if you require help parsing out the useful bits (use '[CODE]' tags to preserve formatting, please).
--- rod.

The router will not return the status page until I log in. The command I need to execute is wget 192.168.4.2/status.asp If I am already logged into the router it returns the html for the status page. If I am not it returns the html for the login page.
The login page html returned by wget is:
<html>

<head>

<meta http-equiv="Content-Type" content="text/html;">

<title>TRENDNET | TEW-652BRP | Main | LAN & DHCP Server</title>

<link rel="stylesheet" href="style.css" type="text/css">

<script language="JavaScript" src="public_msg.js"></script>

<script language="JavaScript" src="public.js"></script>

<script language="JavaScript">

function encode_base64(psstr) {

return encode(psstr,psstr.length);

}

function encode (psstrs, iLen) {

var map1="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";

var oDataLen = (iLen*4+2)/3;

var oLen = ((iLen+2)/3)*4;

var out='';

var ip = 0;

var op = 0;

while (ip < iLen) {

var xx = psstrs.charCodeAt(ip++);

var yy = ip < iLen ? psstrs.charCodeAt(ip++) : 0;

var zz = ip < iLen ? psstrs.charCodeAt(ip++) : 0;

var aa = xx >>> 2;

var bb = ((xx & 3) << 4) | (yy >>> 4);

var cc = ((yy & 0xf) << 2) | (zz >>> 6);

var dd = zz & 0x3F;

out += map1.charAt(aa);

op++;

out += map1.charAt(bb);

op++;

out += op < oDataLen ? map1.charAt(cc) : '=';

op++;

out += op < oDataLen ? map1.charAt(dd) : '=';

op++;

}

return out;

}

function check()

{

var pwd=get_by_id("login_pass").value;

if(get_by_id("login_n").value=="")

{

alert("Please input the User Name.");

return false;

}

get_by_id("login_name").value=encode_base64(get_by_id("login_n").value);

get_by_id("login_pass").value=encode_base64(pwd);

return true;

}

</script>

<style type="text/css">



</style>

</head>

<body onLoad="MM_preloadImages('but_help1_1.gif')">

<table width="750" border="0" cellpadding="0" cellspacing="0">

<tr>

<td width="21"><img src="c1_tl.gif" width="21" height="21"></td>

<td width="708" background="bg1_t.gif"><img src="top_1.gif" width="390" height="21"></td>

<td width="21"><img src="c1_tr.gif" width="21" height="21"></td>

</tr>

<tr>

<td valign="top" background="bg1_l.gif"><img src="top_2.gif" width="21" height="69"></td>

<td background="bg.gif"><table width="100%" border="0" cellpadding="0" cellspacing="0">

<tr>

<td width="13%"><img src="logo.gif" width="270" height="69"></td>

<td width="87%" align="right"><img src="description.gif"></td>

</tr>

</table>

<table width="100%" border="0" cellpadding="0" cellspacing="0">

<tr>

<td width="78%" valign="top">

<table width="99%" border="0" cellpadding="0" cellspacing="0">

<tr>

<td width="10"><img src="c2_tl.gif" width="10" height="10"></td>

<td width="684" background="bg2_t.gif"><img src="spacer.gif" width="10" height="10"></td>

<td width="10"><img src="c2_tr.gif" width="10" height="10"></td>

</tr>

<tr>

<td background="bg2_l.gif"> </td>

<td height="400" valign="top" background="bg3.gif">

<p> </p>

<table width="80%" border="0" align="center">

<tr>

<td height="10">

<div id=box_header>

<H1 align="left" class="style1">Login</H1>

<div align="left">

Log in to the router<p>

<form name="form1" id="form1" action="login.cgi" method="post">

<input type="hidden" name="html_response_page" value="logout_fail.asp">

<input type="hidden" name="login_name" id="login_name">

<table width="311" border="0" align="center">

<tr>

<td width="102"><strong>User Name :</strong></td>

<td width="193"><input name="login_n" type="text" id="login_n" size="20" maxlength="15"></td>

</tr>

<tr>

<td><strong>Password :</strong></td>

<td><input type="password" name="login_pass" id="login_pass" size="20" maxlength="15">

<input type="submit" name="login" value="Log In" onclick="return check();">

</td>

</tr>

</table></form>

<p> </p>

</div>

</div></td>

</tr>

</table> </td>

<td background="bg2_r.gif"><img src="spacer.gif" width="10" height="10"></td>

</tr>

<tr>

<td><img src="c2_bl.gif" width="10" height="10"></td>

<td background="bg2_b.gif"><img src="spacer.gif" width="10" height="10"></td>

<td><img src="c2_br.gif" width="10" height="10"></td>

</tr>

</table></td>

</tr>

</table>

<br>

<br></td>

<td background="bg1_r.gif"> </td>

</tr>

<tr>

<td><img src="c1_bl.gif" width="21" height="20"></td>

<td align="right" background="bg1_b.gif"><img src="copyright.gif" width="264" height="20"></td>

<td><img src="c1_br.gif" width="21" height="20"></td>

</tr>

</table>

</body>

</html>

The html returned for the status page is:
<html>

<head>

<meta http-equiv="Content-Type" content="text/html;">

<title>TRENDNET | TEW-652BRP | Main | LAN & DHCP Server</title>

<link rel="stylesheet" href="style.css" type="text/css">

<script language="JavaScript" src="public_msg.js"></script>

<script language="JavaScript" src="public.js"></script>

<script language="JavaScript">

function encode_base64(psstr) {

return encode(psstr,psstr.length);

}

function encode (psstrs, iLen) {

var map1="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";

var oDataLen = (iLen*4+2)/3;

var oLen = ((iLen+2)/3)*4;

var out='';

var ip = 0;

var op = 0;

while (ip < iLen) {

var xx = psstrs.charCodeAt(ip++);

var yy = ip < iLen ? psstrs.charCodeAt(ip++) : 0;

var zz = ip < iLen ? psstrs.charCodeAt(ip++) : 0;

var aa = xx >>> 2;

var bb = ((xx & 3) << 4) | (yy >>> 4);

var cc = ((yy & 0xf) << 2) | (zz >>> 6);

var dd = zz & 0x3F;

out += map1.charAt(aa);

op++;

out += map1.charAt(bb);

op++;

out += op < oDataLen ? map1.charAt(cc) : '=';

op++;

out += op < oDataLen ? map1.charAt(dd) : '=';

op++;

}

return out;

}

function check()

{

var pwd=get_by_id("login_pass").value;

if(get_by_id("login_n").value=="")

{

alert("Please input the User Name.");

return false;

}

get_by_id("login_name").value=encode_base64(get_by_id("login_n").value);

get_by_id("login_pass").value=encode_base64(pwd);

return true;

}

</script>

<style type="text/css">



</style>

</head>

<body onLoad="MM_preloadImages('but_help1_1.gif')">

<table width="750" border="0" cellpadding="0" cellspacing="0">

<tr>

<td width="21"><img src="c1_tl.gif" width="21" height="21"></td>

<td width="708" background="bg1_t.gif"><img src="top_1.gif" width="390" height="21"></td>

<td width="21"><img src="c1_tr.gif" width="21" height="21"></td>

</tr>

<tr>

<td valign="top" background="bg1_l.gif"><img src="top_2.gif" width="21" height="69"></td>

<td background="bg.gif"><table width="100%" border="0" cellpadding="0" cellspacing="0">

<tr>

<td width="13%"><img src="logo.gif" width="270" height="69"></td>

<td width="87%" align="right"><img src="description.gif"></td>

</tr>

</table>

<table width="100%" border="0" cellpadding="0" cellspacing="0">

<tr>

<td width="78%" valign="top">

<table width="99%" border="0" cellpadding="0" cellspacing="0">

<tr>

<td width="10"><img src="c2_tl.gif" width="10" height="10"></td>

<td width="684" background="bg2_t.gif"><img src="spacer.gif" width="10" height="10"></td>

<td width="10"><img src="c2_tr.gif" width="10" height="10"></td>

</tr>

<tr>

<td background="bg2_l.gif"> </td>

<td height="400" valign="top" background="bg3.gif">

<p> </p>

<table width="80%" border="0" align="center">

<tr>

<td height="10">

<div id=box_header>

<H1 align="left" class="style1">Login</H1>

<div align="left">

Log in to the router<p>

<form name="form1" id="form1" action="login.cgi" method="post">

<input type="hidden" name="html_response_page" value="logout_fail.asp">

<input type="hidden" name="login_name" id="login_name">

<table width="311" border="0" align="center">

<tr>

<td width="102"><strong>User Name :</strong></td>

<td width="193"><input name="login_n" type="text" id="login_n" size="20" maxlength="15"></td>

</tr>

<tr>

<td><strong>Password :</strong></td>

<td><input type="password" name="login_pass" id="login_pass" size="20" maxlength="15">

<input type="submit" name="login" value="Log In" onclick="return check();">

</td>

</tr>

</table></form>

<p> </p>

</div>

</div></td>

</tr>

</table> </td>

<td background="bg2_r.gif"><img src="spacer.gif" width="10" height="10"></td>

</tr>

<tr>

<td><img src="c2_bl.gif" width="10" height="10"></td>

<td background="bg2_b.gif"><img src="spacer.gif" width="10" height="10"></td>

<td><img src="c2_br.gif" width="10" height="10"></td>

</tr>

</table></td>

</tr>

</table>

<br>

<br></td>

<td background="bg1_r.gif"> </td>

</tr>

<tr>

<td><img src="c1_bl.gif" width="21" height="20"></td>

<td align="right" background="bg1_b.gif"><img src="copyright.gif" width="264" height="20"></td>

<td><img src="c1_br.gif" width="21" height="20"></td>

</tr>

</table>

</body>

</html>

If you look for 53.72.71.68 that is my current IP address.

smoker · 03-18-2010, 08:51 PM

Quote:

Originally Posted by michael.wegemer

Thanks smoker. I looked at that option but my dynamic dns provider is not one of the ones they support. I am using 2mydns.com. If it was a supported one I would simply run ddclient for my distribution. (fedora 12 x86_64)

If your external ip changes it makes no difference to your script updating the dynamic dns service. The script runs on your machine. Why do you need to access the router at all if you can use a script ?

Are you saying that your dynamic dns provider relies on you to tell it your ip ?
Most of them can get your ip from the request you send to update it, which contains your hostname.

michael.wegemer · 03-18-2010, 09:08 PM

Quote:

Originally Posted by smoker

If your external ip changes it makes no difference to your script updating the dynamic dns service. The script runs on your machine. Why do you need to access the router at all if you can use a script ?

Are you saying that your dynamic dns provider relies on you to tell it your ip ?
Most of them can get your ip from the request you send to update it, which contains your hostname.

My dynamic dns provider 2mydns.com asks for the following format:
wget "http://dyn.2mydns.com/dyn.asp?username=myname&password=mypass&hostname=myname.2myip.com&myip=$IP"

Where $IP is my new IP address, myname is my account name, mypass is my password for the account, and myname.2myip.com is my domain name.

theNbomr · 03-18-2010, 09:11 PM

Okay, I misunderstood what you meant by 'log in'; the word commandline in the subject line made me think it was an ssh login or something like that.
From the code sample, it looks like you need to perform a login using the POST method, and with input data that base-64 encodes the username and password. I don't have a good example of a base-64 encoder, but I'm sure there are plenty out there. Alternatively, you can probably use what any self-respecting hacker would use, and capture the data on the wire (wireshark). It should be the same string always until the password and/or username are changed. My manpage for wget shows a good example of how to solicit an HTTP POST request, using username and password example.
(Note code posted in [CODE] tags...)

Code:

           This example shows how to log to a server using POST and then proceed to download the
           desired pages, presumably only accessible to authorized users:

                   # Log in to the server.  This can be done only once.
                   wget --save-cookies cookies.txt \
                        --post-data ’user=foo&password=bar’ \
                        http://server.com/auth.php

                   # Now grab the page or pages we care about.
                   wget --load-cookies cookies.txt \
                        -p http://server.com/interesting/article.php

Your form uses the fields 'login_name' and 'login_pass'. I see now that the base64 encoder is written in javascript right in the HTML page. You should be able to translate it into the language of your choice, if you want a more dynamic solution.

--- rod.

michael.wegemer · 03-19-2010, 06:05 AM

Quote:

Originally Posted by theNbomr

Okay, I misunderstood what you meant by 'log in'; the word commandline in the subject line made me think it was an ssh login or something like that.
From the code sample, it looks like you need to perform a login using the POST method, and with input data that base-64 encodes the username and password. I don't have a good example of a base-64 encoder, but I'm sure there are plenty out there. Alternatively, you can probably use what any self-respecting hacker would use, and capture the data on the wire (wireshark). It should be the same string always until the password and/or username are changed. My manpage for wget shows a good example of how to solicit an HTTP POST request, using username and password example.
(Note code posted in [CODE] tags...)

Code:

           This example shows how to log to a server using POST and then proceed to download the
           desired pages, presumably only accessible to authorized users:

                   # Log in to the server.  This can be done only once.
                   wget --save-cookies cookies.txt \
                        --post-data ’user=foo&password=bar’ \
                        http://server.com/auth.php

                   # Now grab the page or pages we care about.
                   wget --load-cookies cookies.txt \
                        -p http://server.com/interesting/article.php

Your form uses the fields 'login_name' and 'login_pass'. I see now that the base64 encoder is written in javascript right in the HTML page. You should be able to translate it into the language of your choice, if you want a more dynamic solution.

--- rod.

Thanks VERY much Rod. When I issued the WGET for login it gave no response
[wegemer@Linux04 ~]$ wget --save-cookies cookies.txt --post-data 'login_name=admin&login_pass=??????????' 192.168.4.1/login.asp
--2010-03-19 06:48:40-- http://192.168.4.1/login.asp
Connecting to 192.168.4.1:80... connected.
HTTP request sent, awaiting response... No data received.
Retrying.

I thought I would try the retrieve status command in any case.
[wegemer@Linux04 ~]$ wget --load-cookies cookies.txt 192.168.4.1/status.asp
Cannot open cookies file “cookies.txt”: No such file or directory
--2010-03-19 06:53:56-- http://192.168.4.1/status.asp
Connecting to 192.168.4.1:80... connected.
HTTP request sent, awaiting response... 200 Ok
Length: unspecified [text/html]
Saving to: “status.asp.1”

[ <=> ] 38,869 --.-K/s in 0.08s

2010-03-19 06:53:56 (455 KB/s) - “status.asp” saved [38869]

This gave me exactly what I wanted. When I used the -p option it created a folder 192.168.4.1 and downloaded all of the routers pages in that folder.

I am sure I can find a way to cause the WGET used for login to stop after one attempt and everything will work well.

Sorry about my code post. I do not know what CODE tabs are or how to use them.

michael.wegemer · 03-19-2010, 07:23 AM

Quote:

Originally Posted by michael.wegemer

Thanks VERY much Rod. When I issued the WGET for login it gave no response
[wegemer@Linux04 ~]$ wget --save-cookies cookies.txt --post-data 'login_name=admin&login_pass=??????????' 192.168.4.1/login.asp
--2010-03-19 06:48:40-- http://192.168.4.1/login.asp
Connecting to 192.168.4.1:80... connected.
HTTP request sent, awaiting response... No data received.
Retrying.

I thought I would try the retrieve status command in any case.
[wegemer@Linux04 ~]$ wget --load-cookies cookies.txt 192.168.4.1/status.asp
Cannot open cookies file “cookies.txt”: No such file or directory
--2010-03-19 06:53:56-- http://192.168.4.1/status.asp
Connecting to 192.168.4.1:80... connected.
HTTP request sent, awaiting response... 200 Ok
Length: unspecified [text/html]
Saving to: “status.asp.1”

[ <=> ] 38,869 --.-K/s in 0.08s

2010-03-19 06:53:56 (455 KB/s) - “status.asp” saved [38869]

This gave me exactly what I wanted. When I used the -p option it created a folder 192.168.4.1 and downloaded all of the routers pages in that folder.

I am sure I can find a way to cause the WGET used for login to stop after one attempt and everything will work well.

Sorry about my code post. I do not know what CODE tabs are or how to use them.

I have it working now. It is very clumsy because of my lack of understanding of SED. The line in question is:
NEWIP="`pr status.asp | \
grep 'wan_current_ipaddr' | \
awk '{print $5}' | \
sed -e 's/^.*value="//' -e 's/255.*$//' | \
sed -e 's%/% %'`"

I used PR because CAT seems to have trouble with the HTML characters. I cannot get SED to isolate the IP address in one attempt. The first SED gives me the IP address with a slash on the end (from /255.255.255) and the second SED replaces the slash with a blank. The other thing that appears funny is that the length of NEWIP (echo "${#NEWIP}") is showing as 21.

catkin · 03-19-2010, 08:16 AM

Thanks for asking this question, michael.wegemer

With routers' firmware increasingly disabling the telnet functionality of their chipsets, this wget-with-login-step technique will be very useful for scripted data retrieval from routers and, perhaps by extension of the login step, for scripted router configuration changes.

jschiwal · 03-19-2010, 05:53 PM

Could you post the results of:
pr status.asp | grep 'wan_current_ipaddr' | awk '{print $5}'

michael.wegemer · 03-19-2010, 07:42 PM

Quote:

Originally Posted by jschiwal

Could you post the results of:
pr status.asp | grep 'wan_current_ipaddr' | awk '{print $5}'

I think this is what you are asking for:
[wegemer@Linux04 ~]$ ./routerIP.sh

value="72.53.71.68/255.255.255.224/72.53.71.65/209.197.128.2/209.195.95.95">
[wegemer@Linux04 ~]$

jschiwal · 03-24-2010, 09:21 AM

It looks like value contains IP/netmask/gateway/nameserver/nameserver.

Try this sed command.
sed -n '/value=/s#value="$[[:digit:].]*$/.*$#\1#p'