From ad6ba2b2c6f1f806d3bc0725e366d22d92f156bb Mon Sep 17 00:00:00 2001
From: Nasir Hafeez <38311694+nasirhafeez@users.noreply.github.com>
Date: Sun, 7 Aug 2022 08:41:15 +0500
Subject: [PATCH] Create connect.php

---
 Cradlepoint/connect.php | 49 +++++++++++++++++++++++++++++++++++++++++
 1 file changed, 49 insertions(+)
 create mode 100644 Cradlepoint/connect.php

diff --git a/Cradlepoint/connect.php b/Cradlepoint/connect.php
new file mode 100644
index 0000000..96381ff
--- /dev/null
+++ b/Cradlepoint/connect.php
@@ -0,0 +1,49 @@
+<?php
+
+$uam_secret = "secret";
+
+function encode_password($plain, $challenge, $secret) {
+        if ((strlen($challenge) % 2) != 0 ||
+            strlen($challenge) == 0)
+            return FALSE;
+
+        $hexchall = hex2bin($challenge);
+        if ($hexchall === FALSE)
+                return FALSE;
+
+        if (strlen($secret) > 0) {
+                $crypt_secret = md5($hexchall . $secret, TRUE);
+                $len_secret = 16;
+        } else {
+                $crypt_secret = $hexchall;
+                $len_secret = strlen($hexchall);
+        }
+
+        /* simulate C style \0 terminated string */
+        $plain .= "\x00";
+        $crypted = '';
+        for ($i = 0; $i < strlen($plain); $i++)
+                $crypted .= $plain[$i] ^ $crypt_secret[$i % $len_secret];
+
+        $extra_bytes = 0;//rand(0, 16);
+        for ($i = 0; $i < $extra_bytes; $i++)
+                $crypted .= chr(rand(0, 255));
+
+        return bin2hex($crypted);
+}
+
+$username = $_POST["username"];
+$password = $_POST["password"];
+$uamip = $_POST["uamip"];
+$uamport = $_POST["uamport"];
+$challenge = $_POST["challenge"];
+
+$encoded_password = encode_password($password, $challenge, $uam_secret);
+
+$redirect_url = "http://$uamip:$uamport/logon?" .
+"username=" . urlencode($username) .
+"&response=" . urlencode($encoded_password);
+
+header('Location: ' . $redirect_url);
+
+?>