Padavan网络信息页面分析

ssh 到路由，找到Main_WStatus_Content.asp，发现这一段是动态生成的:

<% nvram_dump("wlan11b.log",""); %>

关键是nvram_dump，在github https://github.com/hiboyhiboy/rt-n56u/ 上全文搜索源码，发现来源是rt-n56u/trunk/user/httpd/web_ex.c

struct ej_handler ej_handlers[] =
{
	{ "nvram_get_x", ej_nvram_get_x},
	{ "nvram_get_list_x", ej_nvram_get_list_x},
	{ "nvram_get_buf_x", ej_nvram_get_buf_x},
	{ "nvram_get_table_x", ej_nvram_get_table_x},
	{ "nvram_match_x", ej_nvram_match_x},
	{ "nvram_double_match_x", ej_nvram_double_match_x},
	{ "nvram_match_both_x", ej_nvram_match_both_x},
	{ "nvram_match_list_x", ej_nvram_match_list_x},
	{ "uptime", ej_uptime},
	{ "nvram_dump", ej_dump},
......

没办法，只能构建一个asp文件来获取这些信息

<!-- 5GStatus.asp --> 
<% nvram_dump("wlan11b.log",""); %>

然后配合脚本 curl 127.0.0.1/custom/5GStatus.asp