NOTE: Because a bug(You can't inject packet using python version of
pcap
after sleep or reboot.) exists in my modified fork of YaH3C. Thus, I rewrote H3C in C to avoid the bug ofpcap
in python. Tested in OSX.
- Download this repository
- Install
libpcap
- Change the username, password, device_name in
main.c
cd
into this directory andmake
- Run
sysuh3c
, you are ready to go
# Login
---> Start
<--- Request, Identity
---> Response, Identity
<--- Request, EAP-MD5-CHALLENGE
---> Response, EAP-MD5-CHALLENGE
<--- Some unknown code
<--- Success
# Then enter random check loop
<--- Request, Identity
---> Response, Identity
# Logoff
# Not responding to random check loop also results in auto-logoff
---> Logoff
<--- Failure
Request ID,
version hash
+username
EAP-MD5-CHALLENGE,
num
+username
num
is calculated by ( (first 16 character of case-sensitive password) xor (16 bytes md5 data converted to decimal) )