FullSiemensScan.py 文件源码

def getInfoViaCOTP(device):
    sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    sock.settimeout(1) # 1 second timeout
    sock.connect((device['ip_address'], 102)) ## Will setup TCP/SYN with port 102
    cotpconnectresponse = hexlify(send_and_recv(sock, '03000016'+'11e00000000500c1020600c2020600c0010a'))
    if not cotpconnectresponse[10:12] == 'd0':
        print('COTP Connection Request failed, no route to IP '+device['ip_address']+'?')
        return []

    data = '720100b131000004ca0000000200000120360000011d00040000000000a1000000d3821f0000a3816900151653657276657253657373696f6e5f3742363743433341a3822100150b313a3a3a362e303a3a3a12a3822800150d4f4d532b204465627567676572a38229001500a3822a001500a3822b00048480808000a3822c001211e1a304a3822d001500a1000000d3817f0000a38169001515537562736372697074696f6e436f6e7461696e6572a2a20000000072010000'
    tpktlength = str(hex((len(data)+14)/2))[2:] ## Dynamically find out the data length
    cotpdata = send_and_recv(sock, '030000'+tpktlength+'02f080'+data)

    ## It is sure that the CPU state is NOT in this response
    print('Hardware: '+cotpdata.split(';')[2])
    print('Firmware: '+filter(lambda x: x in string.printable, cotpdata.split(';')[3].replace('@','.')))

    sock.close()