cocagne / pysrp

Python implementation of the Secure Remote Password protocol (SRP)
MIT License
113 stars 42 forks source link

NOT WORK #50

Closed gianfelicevincenzo closed 2 years ago

gianfelicevincenzo commented 2 years ago

My script python2 for login router:

def login(r,user,passwd,token):
    __process=srp.User(user,passwd)
    A=__process.start_authentication()[1].encode('hex')

    data = {'CSRFtoken' : token, 'I' : user, 'A' : A}
    verify_srp=json.loads(r.post('https://192.168.1.1/authenticate', data=data, verify=False, allow_redirects=True).text)

    s=verify_srp['s'].lower().encode('utf8')
    B=verify_srp['B'].lower().encode('utf8')

    M=__process.process_challenge(s,B).encode('hex')

    data = {'CSRFtoken' : token, 'M' : M}
    verify_srp=json.loads(r.post('https://192.168.1.1/authenticate', data=data, verify=False, allow_r

Response router:

{u'error': {u'msg': u"M didn't match"}}
cocagne commented 2 years ago

That description doesn't provide much information. Are you trying to authenticate with some other SRP implementation or is your server also pysrp based? If it's not pysrp based you'll want to first call the rfc5054_compat() method to enable interoperability.

gianfelicevincenzo commented 2 years ago

It is a Technicolor AGMY2020 (branded TIM, Italy). It is based on JS/Jquery and has a webui. Use the srp-min.js (webui) library. I show you the various screens taken from the various POST requests (firefox console) In order of appearance:

1) Request 1

2) Response 2

3) Request (verify) 3

4) Response (verify) 4

PS. I have already tried with rfc5054_compat() but it doesn't work ...