General Questions

This applies to m0n0wall version 1.34 and above.

The first thing that needs to be done is to obtain a token. An HTTP GET command must be sent to /exec_raw.php. This will generate the token that you need. Curl example:

Code:

curl -o token.txt http://<name>:<password>@<ip address>:<port>/exec_raw.php

The curl command above will result in file called token.txt which contains the generated token. Here is what an entire token will look like:

Code:

sid:70069e1d0782126d2e463f5142da1bf8607b26c3,1387092162;ip:8e447dcc1cd71469dba85ac18884c648299d67c8,1387092162

Now for example to reboot m0n0wall you would issue the following curl command (HTTP POST command) along with the generated token:

Code:

curl --user <name>:<password> --data Submit=" Yes " --data "__csrf_magic=<token>" http://<ip address>:<port>/reboot.php

This is another example of the last curl command with everything filled in:

Code:

curl --user azdps:78kd038 --data Submit=" Yes " --data "__csrf_magic=sid:70069e1d0782126d2e463f5142da1bf8607b26c3,1387092162;ip:8e447dcc1cd71469dba85ac18884c648299d67c8,1387092162" http://192.168.1.1:80/reboot.php

And finally an example of how to download the m0n0wall config file:

Code:

curl --user admin:78kd038 --data Submit="Download configuration" --data "__csrf_magic=sid:70069e1d0782126d2e463f5142da1bf8607b26c3,1387092162;ip:8e447dcc1cd71469dba85ac18884c648299d67c8,1387092162" http://192.168.1.1:80/diag_backup.php -o config_backup.xml

I generally don't use curl or wget for anything. I started playing around with curl to see the http responses from the commands I was sending. I'm not knowledgeable enough with curl to place the returned token in the second curl command without manually adding it to the command. I'm sure a script can easily be made though.

I just wanted to share this since there seems to be some confusion regarding this.

*note* - The curl commands above work with the Windows curl binary. There appears to be minor differences between the Windows and Linux version of curl.