1

I am trying to write a "simple" PHP program that should write and read string to/from a socket (telnet on port 23).

Socket Connection is made using pfsockopen (or socket_connect) function and it seems to work properly (verified with wireshark). The problem is when I try to read from socket using fread or socket_read. The buffer returned by these two functions is unreadable (no text but special ascii characters).

Consider that php script is running on a Windows XP PC. Do you know about any limitation in using these libraries on windows PC and telnet protocol?

    $header1=chr(0xFF).chr(0xFB).chr(0x1F).chr(0xFF).chr(0xFB).chr(0x20).chr(0xFF).chr(0xFB).chr(0x18).chr(0xFF).chr(0xFB).chr(0x27).chr(0xFF).chr(0xFD).chr(0x01).chr(0xFF).chr(0xFB).chr(0x03).chr(0xFF).chr(0xFD).chr(0x03).chr(0xFF).chr(0xFC).chr(0x23).chr(0xFF).chr(0xFC).chr(0x24).chr(0xFF).chr(0xFA).chr(0x1F).chr(0x00).chr(0x50).chr(0x00).chr(0x18).chr(0xFF).chr(0xF0).chr(0xFF).chr(0xFA).chr(0x20).chr(0x00).chr(0x33).chr(0x38).chr(0x34).chr(0x30).chr(0x30).chr(0x2C).chr(0x33).chr(0x38).chr(0x34).chr(0x30).chr(0x30).chr(0xFF).chr(0xF0).chr(0xFF).chr(0xFA).chr(0x27).chr(0x00).chr(0xFF).chr(0xF0).chr(0xFF).chr(0xFA).chr(0x18).chr(0x00).chr(0x58).chr(0x54).chr(0x45).chr(0x52).chr(0x4D).chr(0xFF).chr(0xF0);

$fp=pfsockopen("10.129.127.33",23);
fputs($fp,$header1);
sleep(1);
$output=fread($fp,8164); 
echo $output;
  • 1
    Can you post some code.. especially how you connect and how you read the connection – bart s May 29 '12 at 13:13
  • $fp=pfsockopen("10.129.127.33",23); fputs($fp,$TELNETHEADER); sleep(1); $output=fread($fp,1024); $stat=socket_get_status($fp); $output.=fread($fp, $stat["unread_bytes"]); – Luca Carangelo May 29 '12 at 13:26
  • Are you connecting to actual `telnet` server? – Nikolai Fetissov May 29 '12 at 13:29
  • yes of course. The problem is the fread. These are the characted printed out  ²% ²▼ ■  ²↑ ²' ¹☺ ²♥ ¹♥ – Luca Carangelo May 29 '12 at 13:34
  • Have you looked into telnet protocol (http://en.wikipedia.org/wiki/Telnet)? I think it's expected to get bytes with high bit set. – Nikolai Fetissov May 29 '12 at 13:39
  • Are you referring to fread function? tested using $output=fread($fp,8164); same result. – Luca Carangelo May 29 '12 at 13:52
  • I am referring to telnet protocol. You are sending non-printable characters to the server, why do you expect printable characters back? – Nikolai Fetissov May 29 '12 at 14:09
  • You are right, $header1 are the characters used to set telnet negotiation and probably the answer is returned in ascii code. Having a look to this post, it seems that someone has make it working in some way http://stackoverflow.com/questions/905348/telnet-connection-using-php – Luca Carangelo May 29 '12 at 14:44
  • I have done a wireshark again and it seems that telnet negotiation via php script is wrong or incomplete. – Luca Carangelo May 29 '12 at 14:58
  • I don't think PHP has anything to do with it. Make sure you are sending bytes that are correct according to the protocol, then read back *in a loop* until you get enough bytes to be able to parse the response, again according to the protocol (remember that TCP connection gives you a *stream* and it's your job to split it into "messages"). – Nikolai Fetissov May 29 '12 at 15:09

2 Answers2

1
  1. Is the the connection Successful?
  2. Does the server allow connection on port 23?
  3. This might help you

fputs($fp,"string");

do 
{ 
$output.=fread($fp, 80); 
// read line by line, or at least small chunks
$stat=socket_get_status($fp);
}
while($stat["unread_bytes"]);

$output = str_replace("\n", "<br>", $output);\\for new line in HTML
echo $output;
  1. Following is the TELNET header i have used

    $header1=chr(0xFF).chr(0xFB).chr(0x1F).chr(0xFF).chr(0xFB).chr(0x20).chr(0xFF).chr(0xFB).chr(0x18).chr(0xFF).chr(0xFB).chr(0x27).chr(0xFF).chr(0xFD).ch.(0x01).chr(0xFF).chr(0xFB).chr(0x03).chr(0xFF).chr(0xFD).chr(0x03).chr(0xFF).chr(0xFC).chr(0x23).chr(0xFF).chr(0xFC).chr(0x24).chr(0xFF).chr(0xFA).chr(0x1F).chr(0x00).chr(0x50).chr(0x00).chr(0x18).chr(0xFF).chr(0xF0).chr(0xFF).chr(0xFA).chr(0x20).chr(0x00).chr(0x33).chr(0x38).chr(0x34).chr(0x30).chr(0x30).chr(0x2C).chr(0x33).chr(0x38).chr(0x34).chr(0x30).chr(0x30).chr(0xFF).chr(0xF0).chr(0xFF).chr(0xFA).chr(0x27).chr(0x00).chr(0xFF).chr(0xF0).chr(0xFF).chr(0xFA).chr(0x18).chr(0x00).chr(0x58).chr(0x54).chr(0x45).chr(0x52).chr(0x4D).chr(0xFF).chr(0xF0);
            $header2=chr(0xFF).chr(0xFC).chr(0x01).chr(0xFF).chr(0xFC).chr(0x22).chr(0xFF).chr(0xFE).chr(0x05).chr(0xFF).chr(0xFC).chr(0x21);
    
    $fp=fsockopen("192.168.125.6",23);  
    
    
    //**********Send telnet header****************
    
    fputs($fp,$header1);
    
    usleep(1000);
    
    fputs($fp,$header2);
    
    usleep(1000);
    
0
<?php
# Generating output by telneting a router

$username='myusername';
$password='mypassword';
$ip="192.168.0.1";

    $Telnet_Header = chr(0xFF).chr(0xFB).chr(0x1F).chr(0xFF).chr(0xFB).chr(0x20).chr(0xFF).chr(0xFB).chr(0x18).chr(0xFF).chr(0xFB).chr(0x27).chr(0xFF).chr(0xFD).chr(0x01).chr(0xFF).chr(0xFB).chr(0x03).chr(0xFF).chr(0xFD).chr(0x03).chr(0xFF).chr(0xFC).chr(0x23).chr(0xFF).chr(0xFC).chr(0x24).chr(0xFF).chr(0xFA).chr(0x1F).chr(0x00).chr(0x50).chr(0x00).chr(0x18).chr(0xFF).chr(0xF0).chr(0xFF).chr(0xFA).chr(0x20).chr(0x00).chr(0x33).chr(0x38).chr(0x34).chr(0x30).chr(0x30).chr(0x2C).chr(0x33).chr(0x38).chr(0x34).chr(0x30).chr(0x30).chr(0xFF).chr(0xF0).chr(0xFF).chr(0xFA).chr(0x27).chr(0x00).chr(0xFF).chr(0xF0).chr(0xFF).chr(0xFA).chr(0x18).chr(0x00).chr(0x58).chr(0x54).chr(0x45).chr(0x52).chr(0x4D).chr(0xFF).chr(0xF0);
$Telnet_Header2 = chr(0xFF).chr(0xFC).chr(0x01).chr(0xFF).chr(0xFC).chr(0x22).chr(0xFF).chr(0xFE).chr(0x05).chr(0xFF).chr(0xFC).chr(0x21);
$Port = 23;
$Conn = fsockopen($ip, $Port);
fputs($Conn,$Telnet_Header);
sleep(1);
fputs($Conn,$Telnet_Header2);
sleep(1);
fputs($Conn,$username."\r");
sleep(5);
fputs($Conn,$password."\r");
sleep(1);
fputs($Conn,$username."\r");
sleep(5);
fputs($Conn,$password."\r");
sleep(5);
fputs($Conn,"en \r"); 
   sleep(3);
fputs($Conn,"conf t\r"); 
   sleep(3);
fputs($Conn,"terminal length 0\r"); 
   sleep(3);
fputs($Conn,"sh run\r"); 

   $output="";
do
{
    $output.=fread($Conn, 1000);
    $stat=socket_get_status($Conn);
}while($stat["unread_bytes"]);
$output = explode("\n", $output);
for ($i=6;$i<count($output)-1;$i++)
    {
    echo ($output[$i]."\n");
    }

?>