我对无客户端破解WEP的理解 --后续破解成功（二）(内网渗透篇)

接  我对无客户端破解WEP的理解 --后续破解成功（一）

先把图片发了来,今天实在是太累了..... 过两天来码字....

坐的凳子和放电脑的一点都不符合人体工程... 我肩膀早都开始 撕裂般的疼痛了....

这个是他们的 嵌入式设备的开机画面


 1111111  1111     11111111  111111     111111     1111     11111111 11111  1111
 11   11    11   11    11    11    11   11  11   11    11   11        11    11
 11   11    11     1111      11    11   11         111111     1111    11   11
 11   11    11   11          11    11   11    11 11    11         11    1111
111   111 111111 11111111  111111  111 111111111   11111111 11111111    11
                 11      11                                             11
                   111111                                            1111

设备的  dmesg 

又见MIPS 框架. ARM那里去了呢?  :)

Linux version 2.6.11.6PNX8550 (root@stb810) (gcc version 3.3.4) #73 Tue Jun 12 14:41:14 CST 2007
CPU revision is: 00061200
Determined physical RAM map:
 memory: 03800000 @ 00000000 (usable)
On node 0 totalpages: 14336
  DMA zone: 14336 pages, LIFO batch:3
  Normal zone: 0 pages, LIFO batch:1
  HighMem zone: 0 pages, LIFO batch:1
Built 1 zonelists
Kernel command line: rootflags=noatime rootfstype=jffs2 root=/dev/mtdblock4 rw mtdparts=Flash:16K(microBTM),240K(bootloader),5888K(ROMFS-Tools),10M(ROMFS-User),-(User)
Primary instruction cache 16kB, physically tagged, 2-way, linesize 32 bytes.
Primary data cache 16kB, 4-way, linesize 32 bytes.
Synthesized TLB refill handler (34 instructions).
Synthesized TLB load handler fastpath (31 instructions).
Synthesized TLB store handler fastpath (31 instructions).
Synthesized TLB modify handler fastpath (30 instructions).
PID hash table entries: 256 (order: 8, 4096 bytes)
PLL0_n = 63, PLL0_m = 7, PLL0_p = 0, mips_hpt_frequency = 243000000
Using 243.000 MHz high precision timer.
Console: colour dummy device 80x25
Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
Memory: 51840k/57344k available (3382k kernel code, 5444k reserved, 866k data, 152k init, 0k highmem)
Calibrating delay loop... 240.12 BogoMIPS (lpj=120064)
Mount-cache hash table entries: 512 (order: 0, 4096 bytes)
Checking for 'wait' instruction...  available.
NET: Registered protocol family 16
Can't analyze prologue code at 803ab75c
SCSI subsystem initialized
usbcore: registered new driver usbfs
usbcore: registered new driver hub
PNX8550 PCI fixup vendor 10ec, device 8139
REALTEK 8139 Ethernet Card [irq = 55]
NTFS driver 2.1.22 [Flags: R/O].
JFFS2 version 2.2. (NAND) (C) 2001-2003 Red Hat, Inc.
HDLC line discipline: version $Revision: 4.8 $, maxframe=4096
N_HDLC line discipline registered.
8550 Serial driver registered......
Generic MIPS RTC Driver v1.0
io scheduler noop registered
io scheduler anticipatory registered
io scheduler deadline registered
io scheduler cfq registered
RAMDISK driver initialized: 16 RAM disks of 8192K size 1024 blocksize
loop: loaded (max 8 devices)
PPP generic driver version 2.4.2
PPP Deflate Compression module registered
PPP BSD Compression module registered
NET: Registered protocol family 24
8139too Fast Ethernet driver 0.9.27
eth0: RealTek RTL8139 at 0xc20ac000, 00:00:2a:18:e7:19, IRQ 55
eth0:  Identified 8139 chip type 'RTL-8100B/8139D'
Uniform Multi-Platform E-IDE driver Revision: 7.00alpha2
ide: Assuming 33MHz system bus speed for PIO modes; override with idebus=xx
libata version 1.10 loaded.
Driver for NAND Flash on the PNX8550 XIO bus (May 17 2007-14:28:09)
Auto detected a >= 64MByte device on a 8 bit bus
NAND device: Manufacturer ID: 0xad, Chip ID: 0x76 (Unknown NAND 64MiB 3,3V 8-bit)
Scanning device for bad blocks
Bad eraseblock 2181 at 0x02214000
Bad eraseblock 2909 at 0x02d74000
Bad eraseblock 3687 at 0x0399c000
Creating 5 MTD partitions on "NAND 64MiB 3,3V 8-bit":
0x00000000-0x00004000 : "microBTM"
0x00004000-0x00040000 : "bootloader"
0x00040000-0x00600000 : "ROMFS-Tools"
0x00600000-0x01000000 : "ROMFS-User"
0x01000000-0x04000000 : "User"
ehci_hcd: block sizes: qh 128 qtd 96 itd 192 sitd 96
ohci_hcd: 2004 Nov 08 USB 1.1 'Open' Host Controller (OHCI) Driver (PCI)
ohci_hcd: block sizes: ed 64 td 64
2004 Nov 08 USB 1.1 'Open' Host Controller (OHCI) Driver (pnx8550)<7>block sizes: ed 64 td 64
In ohci_hcd_pnx8550_drv_probe<7>drivers/usb/host/ohci-pnx8550.c: starting pnx8550 OHCI USB Controller
drivers/usb/host/ohci-pnx8550.c: Clock to USB host has been enabled
ohci_hcd (pnx8550) at 0xbbe48000, irq 13<6>pnx8550-ohci pnx8550-ohci0: new USB bus registered, assigned bus number 1
pnx8550-ohci pnx8550-ohci0: ohci_pnx8550_start, ohci:811e88f0<7>pnx8550-ohci pnx8550-ohci0: resetting from state 'reset', control = 0x0
pnx8550-ohci pnx8550-ohci0: OHCI controller state
pnx8550-ohci pnx8550-ohci0: OHCI 1.0, with legacy support registers
pnx8550-ohci pnx8550-ohci0: control 0x083 HCFS=operational CBSR=3
pnx8550-ohci pnx8550-ohci0: cmdstatus 0x00000 SOC=0
pnx8550-ohci pnx8550-ohci0: intrstatus 0x00000044 RHSC SF
pnx8550-ohci pnx8550-ohci0: intrenable 0x8000001a MIE UE RD WDH
pnx8550-ohci pnx8550-ohci0: hcca frame #0005
pnx8550-ohci pnx8550-ohci0: roothub.a 02000202 POTPGT=2 NPS NDP=2
pnx8550-ohci pnx8550-ohci0: roothub.b 00000000 PPCM=0000 DR=0000
pnx8550-ohci pnx8550-ohci0: roothub.status 00008000 DRWE
pnx8550-ohci pnx8550-ohci0: roothub.portstatus [0] 0x00000100 PPS
pnx8550-ohci pnx8550-ohci0: roothub.portstatus [1] 0x00000100 PPS
usb usb1: new device strings: Mfr=3, Product=2, SerialNumber=1
usb usb1: default language 0x0409
usb usb1: Product: pnx8550 OHCI
usb usb1: Manufacturer: Linux 2.6.11.6PNX8550 ohci_hcd
usb usb1: SerialNumber: pnx8550
usb usb1: hotplug
usb usb1: adding 1-0:1.0 (config #1, interface 0)
usb 1-0:1.0: hotplug
hub 1-0:1.0: usb_probe_interface
hub 1-0:1.0: usb_probe_interface - got id
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 2 ports detected
hub 1-0:1.0: standalone hub
hub 1-0:1.0: no power switching (usb 1.0)
hub 1-0:1.0: global over-current protection
hub 1-0:1.0: power on to power good time: 4ms
hub 1-0:1.0: local power source is good
hub 1-0:1.0: no over-current condition exists
pnx8550-ohci pnx8550-ohci0: created debug files
sl811: driver sl811-hcd, 15 Dec 2004
hub 1-0:1.0: state 5 ports 2 chg 0006 evt 0007
hub 1-0:1.0: port 1, status 0100, change 0000, 12 Mb/s
hub 1-0:1.0: port 2, status 0100, change 0000, 12 Mb/s
Initializing USB Mass Storage driver...
usbcore: registered new driver usb-storage
USB Mass Storage support registered.
usbcore: registered new driver hiddev
usbcore: registered new driver usbhid
drivers/usb/input/hid-core.c: v2.0:USB HID core driver
mice: PS/2 mouse device common for all mice
i2c /dev entries driver
i2c-core: driver dev_driver registered.
i2c-core: driver dev_driver registered.
PNX8550 I2C: <7>i2c_adapter i2c-0: Registered as minor 0
i2c_adapter i2c-0: registered as adapter #0
initialized.
i2c-core: driver RTC8564 registered.
i2c-core: driver RTC8564 registered.
i2c_adapter i2c-0: found normal i2c entry for adapter 0, addr 51
i2c_adapter i2c-0: master_xfer: with 1 msgs.
i2c-chip : RTC8563 I2C chip found!
i2c_adapter i2c-0: master_xfer: with 1 msgs.
i2c_adapter i2c-0: master_xfer: with 2 msgs.
i2c_adapter i2c-0: client [RTC8564] registered to adapter
registering 0-0051
NET: Registered protocol family 2
IP: routing cache hash table of 512 buckets, 4Kbytes
TCP established hash table entries: 2048 (order: 2, 16384 bytes)
TCP bind hash table entries: 2048 (order: 1, 8192 bytes)
TCP: Hash tables configured (established 2048 bind 2048)
NET: Registered protocol family 1
NET: Registered protocol family 17
Checking BoardEncrypt info...done
jffs2: Erase block size too small (16KiB). Using virtual blocks size (32KiB) instead
Empty flash at 0x015a2914 ends at 0x015a2a00
jffs2_scan_eraseblock(): Node at 0x015a67f8 {0x1985, 0xe002, 0x00000107) has invalid CRC 0xe0021985 (calculated 0x109466f9)
Empty flash at 0x015a7934 ends at 0x015a7a00
Empty flash at 0x01de9450 ends at 0x01de9600
Empty flash at 0x01dec104 ends at 0x01dec200
Empty flash at 0x01e86b84 ends at 0x01e86c00
Empty flash at 0x02ec9098 ends at 0x02ec9200
Empty flash at 0x02ecad74 ends at 0x02ecae00
Empty flash at 0x02ececbc ends at 0x02ecee00
Empty flash at 0x02fb1834 ends at 0x02fb1a00
Empty flash at 0x02fb2454 ends at 0x02fb2600
Empty flash at 0x02fb3fec ends at 0x02fb4000
VFS: Mounted root (jffs2 filesystem).
Freeing unused kernel memory: 152k freed
Warning: unable to open an initial console.
Algorithmics/MIPS FPU Emulator v1.5
jffs2_get_inode_nodes(): Data CRC failed on node at 0x02fb2170: Read 0x8729f06a, calculated 0x1d1f4034
jffs2_get_inode_nodes(): Data CRC failed on node at 0x02fb1550: Read 0x8729f06a, calculated 0x1be7f0f7
jffs2_get_inode_nodes(): Data CRC failed on node at 0x02ecebac: Read 0x1c1f14b8, calculated 0x08e934db
jffs2_get_inode_nodes(): Data CRC failed on node at 0x02eca7bc: Read 0xda02d757, calculated 0x002856da
jffs2_get_inode_nodes(): Data CRC failed on node at 0x02ec8ae0: Read 0xda02d757, calculated 0x561c5e8d
jffs2_get_inode_nodes(): Data CRC failed on node at 0x01debf6c: Read 0x73269789, calculated 0x4e0c6480
jffs2_get_inode_nodes(): Data CRC failed on node at 0x02fb3d50: Read 0xea27f4fc, calculated 0x9c4c1b27
eth0: link up, 100Mbps, full-duplex, lpa 0x41E1
i2c_adapter i2c-0: master_xfer: with 2 msgs.
i2c_adapter i2c-0: master_xfer: with 2 msgs.
i2c_adapter i2c-0: master_xfer: with 2 msgs.
i2c_adapter i2c-0: master_xfer: with 2 msgs.
i2c_adapter i2c-0: master_xfer: with 2 msgs.
i2c_adapter i2c-0: master_xfer: with 2 msgs.
i2c_adapter i2c-0: master_xfer: with 2 msgs.
i2c_adapter i2c-0: master_xfer: with 2 msgs.
i2c_adapter i2c-0: master_xfer: with 2 msgs.
i2c_adapter i2c-0: master_xfer: with 2 msgs.
i2c_adapter i2c-0: master_xfer: with 2 msgs.
i2c_adapter i2c-0: master_xfer: with 2 msgs.
i2c_adapter i2c-0: master_xfer: with 2 msgs.
i2c_adapter i2c-0: master_xfer: with 2 msgs.
i2c_adapter i2c-0: master_xfer: with 2 msgs.
i2c_adapter i2c-0: master_xfer: with 2 msgs.
i2c_adapter i2c-0: master_xfer: with 2 msgs.
i2c_adapter i2c-0: master_xfer: with 2 msgs.
i2c_adapter i2c-0: master_xfer: with 2 msgs.
i2c_adapter i2c-0: master_xfer: with 2 msgs.
i2c_adapter i2c-0: master_xfer: with 2 msgs.
i2c_adapter i2c-0: master_xfer: with 2 msgs.
i2c_adapter i2c-0: master_xfer: with 2 msgs.
i2c_adapter i2c-0: master_xfer: with 2 msgs.
i2c_adapter i2c-0: master_xfer: with 2 msgs.
i2c_adapter i2c-0: master_xfer: with 2 msgs.
i2c_adapter i2c-0: master_xfer: with 2 msgs.
i2c_adapter i2c-0: master_xfer: with 2 msgs.
i2c_adapter i2c-0: master_xfer: with 2 msgs.
i2c_adapter i2c-0: master_xfer: with 2 msgs.
i2c_adapter i2c-0: master_xfer: with 2 msgs.
i2c_adapter i2c-0: master_xfer: with 2 msgs.
i2c_adapter i2c-0: master_xfer: with 2 msgs.
i2c_adapter i2c-0: master_xfer: with 2 msgs.
i2c_adapter i2c-0: master_xfer: with 2 msgs.
i2c_adapter i2c-0: master_xfer: with 2 msgs.
i2c_adapter i2c-0: master_xfer: with 2 msgs.
i2c_adapter i2c-0: master_xfer: with 2 msgs.
tmdriver: ===== loading driver 1.0.0, built on Aug 23 2006 at 18:56:42...

DPF::::::::::tmmanInitKernel end....

DPF::::::::::tmmanInitKernel end....

DPF::::::::::tmmanInitKernel end....

DPF::::::::::tmmanInitKernel end....
tmdriver: ===== driver loaded
pnx8550 gpio driver, version 0.01
jffs2_get_inode_nodes(): Data CRC failed on node at 0x01e86604: Read 0x3c453a62, calculated 0x210e93aa
ClientCount = 0
ClientCount = 1
jffs2_get_inode_nodes(): Data CRC failed on node at 0x015a72d0: Read 0x5c194c89, calculated 0x14616214
jffs2_get_inode_nodes(): Data CRC failed on node at 0x01de9234: Read 0x2da8f928, calculated 0x353299a6