Skip to content

R
routersploit
Commit 0b8359ce by Vinicius Henrique Marangoni
Options

Merge branch 'master' of https://github.com/reverse-shell/routersploit 

Upgrading forked repository
parents 682240dc 677863ca
Showing with 138 additions and 25 deletions
README.md
...@@ -14,8 +14,9 @@ It consists of various modules that aids penetration testing operations: ...@@ -14,8 +14,9 @@ It consists of various modules that aids penetration testing operations:
# Installation # Installation
sudo apt-get install python-requests python-paramiko python-netsnmp
git clone https://github.com/reverse-shell/routersploit git clone https://github.com/reverse-shell/routersploit
cd routersploit
pip install -r requirements.txt
./rsf.py ./rsf.py
# Update # Update
......
routersploit/interpreter.py
...@@ -86,7 +86,7 @@ class BaseInterpreter(object): ...@@ -86,7 +86,7 @@ class BaseInterpreter(object):
command_handler(args) command_handler(args)
except RoutersploitException as err: except RoutersploitException as err:
utils.print_error(err) utils.print_error(err)
except KeyboardInterrupt: except (KeyboardInterrupt, EOFError):
print() print()
utils.print_status("routersploit stopped") utils.print_status("routersploit stopped")
break break
......
routersploit/modules/creds/http_form_bruteforce.py
...@@ -34,8 +34,9 @@ class Exploit(exploits.Exploit): ...@@ -34,8 +34,9 @@ class Exploit(exploits.Exploit):
threads = exploits.Option(8, 'Number of threads') threads = exploits.Option(8, 'Number of threads')
usernames = exploits.Option('admin', 'Username or file with usernames (file://)') usernames = exploits.Option('admin', 'Username or file with usernames (file://)')
passwords = exploits.Option(wordlists.passwords, 'Password or file with passwords (file://)') passwords = exploits.Option(wordlists.passwords, 'Password or file with passwords (file://)')
form = exploits.Option('auto', 'Post Data: auto or in form login={{LOGIN}}&password={{PASS}}&submit') form = exploits.Option('auto', 'Post Data: auto or in form login={{USER}}&password={{PASS}}&submit')
path = exploits.Option('/login.php', 'URL Path') path = exploits.Option('/login.php', 'URL Path')
form_path = exploits.Option('same', 'same as path or URL Form Path')
verbosity = exploits.Option('yes', 'Display authentication attempts') verbosity = exploits.Option('yes', 'Display authentication attempts')
credentials = [] credentials = []
...@@ -46,9 +47,15 @@ class Exploit(exploits.Exploit): ...@@ -46,9 +47,15 @@ class Exploit(exploits.Exploit):
self.credentials = [] self.credentials = []
self.attack() self.attack()
def get_form_path(self):
if self.form_path == 'same':
return self.path
else:
return self.form_path
@multi @multi
def attack(self): def attack(self):
url = sanitize_url("{}:{}{}".format(self.target, self.port, self.path)) url = sanitize_url("{}:{}{}".format(self.target, self.port, self.get_form_path()))
try: try:
requests.get(url, verify=False) requests.get(url, verify=False)
...@@ -61,11 +68,15 @@ class Exploit(exploits.Exploit): ...@@ -61,11 +68,15 @@ class Exploit(exploits.Exploit):
# authentication type # authentication type
if self.form == 'auto': if self.form == 'auto':
self.data = self.detect_form() form_data = self.detect_form()
if self.data is None: if form_data is None:
print_error("Could not detect form") print_error("Could not detect form")
return return
(form_action, self.data) = form_data
if form_action:
self.path = form_action
else: else:
self.data = self.form self.data = self.form
...@@ -116,7 +127,7 @@ class Exploit(exploits.Exploit): ...@@ -116,7 +127,7 @@ class Exploit(exploits.Exploit):
self.invalid["max"] = l self.invalid["max"] = l
def detect_form(self): def detect_form(self):
url = sanitize_url("{}:{}{}".format(self.target, self.port, self.path)) url = sanitize_url("{}:{}{}".format(self.target, self.port, self.get_form_path()))
r = requests.get(url, verify=False) r = requests.get(url, verify=False)
soup = BeautifulSoup(r.text, "lxml") soup = BeautifulSoup(r.text, "lxml")
...@@ -125,20 +136,22 @@ class Exploit(exploits.Exploit): ...@@ -125,20 +136,22 @@ class Exploit(exploits.Exploit):
if form is None: if form is None:
return None return None
action = form.attrs.get('action', None)
if len(form) > 0: if len(form) > 0:
res = [] res = []
for inp in form.findAll("input"): for inp in form.findAll("input"):
if 'name' in inp.attrs.keys(): if 'name' in inp.attrs.keys():
if inp.attrs['name'].lower() in ["username", "user", "login"]: if inp.attrs['name'].lower() in ["username", "user", "login", "username_login"]:
res.append(inp.attrs['name'] + "=" + "{{USER}}") res.append(inp.attrs['name'] + "=" + "{{USER}}")
elif inp.attrs['name'].lower() in ["password", "pass"]: elif inp.attrs['name'].lower() in ["password", "pass", "password_login"]:
res.append(inp.attrs['name'] + "=" + "{{PASS}}") res.append(inp.attrs['name'] + "=" + "{{PASS}}")
else: else:
if 'value' in inp.attrs.keys(): if 'value' in inp.attrs.keys():
res.append(inp.attrs['name'] + "=" + inp.attrs['value']) res.append(inp.attrs['name'] + "=" + inp.attrs['value'])
else: else:
res.append(inp.attrs['name'] + "=") res.append(inp.attrs['name'] + "=")
return '&'.join(res) return (action, '&'.join(res))
def target_function(self, running, data): def target_function(self, running, data):
module_verbosity = boolify(self.verbosity) module_verbosity = boolify(self.verbosity)
......
routersploit/modules/creds/http_form_default.py
...@@ -32,8 +32,9 @@ class Exploit(exploits.Exploit): ...@@ -32,8 +32,9 @@ class Exploit(exploits.Exploit):
port = exploits.Option(80, 'Target port') port = exploits.Option(80, 'Target port')
threads = exploits.Option(8, 'Number of threads') threads = exploits.Option(8, 'Number of threads')
defaults = exploits.Option(wordlists.defaults, 'User:Pass or file with default credentials (file://)') defaults = exploits.Option(wordlists.defaults, 'User:Pass or file with default credentials (file://)')
form = exploits.Option('auto', 'Post Data: auto or in form login={{LOGIN}}&password={{PASS}}&submit') form = exploits.Option('auto', 'Post Data: auto or in form login={{USER}}&password={{PASS}}&submit')
path = exploits.Option('/login.php', 'URL Path') path = exploits.Option('/login.php', 'URL Path')
form_path = exploits.Option('same', 'same as path or URL Form Path')
verbosity = exploits.Option('yes', 'Display authentication attempts') verbosity = exploits.Option('yes', 'Display authentication attempts')
credentials = [] credentials = []
...@@ -44,9 +45,15 @@ class Exploit(exploits.Exploit): ...@@ -44,9 +45,15 @@ class Exploit(exploits.Exploit):
self.credentials = [] self.credentials = []
self.attack() self.attack()
def get_form_path(self):
if self.form_path == 'same':
return self.path
else:
return self.form_path
@multi @multi
def attack(self): def attack(self):
url = sanitize_url("{}:{}{}".format(self.target, self.port, self.path)) url = sanitize_url("{}:{}{}".format(self.target, self.port, self.get_form_path()))
try: try:
requests.get(url, verify=False) requests.get(url, verify=False)
...@@ -59,11 +66,15 @@ class Exploit(exploits.Exploit): ...@@ -59,11 +66,15 @@ class Exploit(exploits.Exploit):
# authentication type # authentication type
if self.form == 'auto': if self.form == 'auto':
self.data = self.detect_form() form_data = self.detect_form()
if self.data is None: if form_data is None:
print_error("Could not detect form") print_error("Could not detect form")
return return
(form_action, self.data) = form_data
if form_action:
self.path = form_action
else: else:
self.data = self.form self.data = self.form
...@@ -109,7 +120,7 @@ class Exploit(exploits.Exploit): ...@@ -109,7 +120,7 @@ class Exploit(exploits.Exploit):
self.invalid["max"] = l self.invalid["max"] = l
def detect_form(self): def detect_form(self):
url = sanitize_url("{}:{}{}".format(self.target, self.port, self.path)) url = sanitize_url("{}:{}{}".format(self.target, self.port, self.get_form_path()))
r = requests.get(url, verify=False) r = requests.get(url, verify=False)
soup = BeautifulSoup(r.text, "lxml") soup = BeautifulSoup(r.text, "lxml")
...@@ -118,20 +129,22 @@ class Exploit(exploits.Exploit): ...@@ -118,20 +129,22 @@ class Exploit(exploits.Exploit):
if form is None: if form is None:
return None return None
action = form.attrs.get('action', None)
if len(form) > 0: if len(form) > 0:
res = [] res = []
for inp in form.findAll("input"): for inp in form.findAll("input"):
if 'name' in inp.attrs.keys(): if 'name' in inp.attrs.keys():
if inp.attrs['name'].lower() in ["username", "user", "login"]: if inp.attrs['name'].lower() in ["username", "user", "login", "username_login"]:
res.append(inp.attrs['name'] + "=" + "{{USER}}") res.append(inp.attrs['name'] + "=" + "{{USER}}")
elif inp.attrs['name'].lower() in ["password", "pass"]: elif inp.attrs['name'].lower() in ["password", "pass", "password_login"]:
res.append(inp.attrs['name'] + "=" + "{{PASS}}") res.append(inp.attrs['name'] + "=" + "{{PASS}}")
else: else:
if 'value' in inp.attrs.keys(): if 'value' in inp.attrs.keys():
res.append(inp.attrs['name'] + "=" + inp.attrs['value']) res.append(inp.attrs['name'] + "=" + inp.attrs['value'])
else: else:
res.append(inp.attrs['name'] + "=") res.append(inp.attrs['name'] + "=")
return '&'.join(res) return (action, '&'.join(res))
def target_function(self, running, data): def target_function(self, running, data):
module_verbosity = boolify(self.verbosity) module_verbosity = boolify(self.verbosity)
......
routersploit/modules/scanners/autopwn.py
...@@ -17,9 +17,9 @@ class Exploit(exploits.Exploit): ...@@ -17,9 +17,9 @@ class Exploit(exploits.Exploit):
__info__ = { __info__ = {
'name': 'AutoPwn', 'name': 'AutoPwn',
'description': 'Scanner module for all vulnerabilities.', 'description': 'Scanner module for all vulnerabilities.',
'author': [ 'authors': [
'Marcin Bury <marcin.bury[at]reverse-shell.com>', # routersploit module 'Marcin Bury <marcin.bury[at]reverse-shell.com>', # routersploit module
], ],
} }
target = exploits.Option('', 'Target IP address e.g. 192.168.1.1') # target address target = exploits.Option('', 'Target IP address e.g. 192.168.1.1') # target address
......
routersploit/modules/scanners/dlink_scan.py
...@@ -17,7 +17,7 @@ class Exploit(exploits.Exploit): ...@@ -17,7 +17,7 @@ class Exploit(exploits.Exploit):
__info__ = { __info__ = {
'name': 'D-Link Scanner', 'name': 'D-Link Scanner',
'description': 'Scanner module for D-Link devices', 'description': 'Scanner module for D-Link devices',
'author': [ 'authors': [
'Marcin Bury <marcin.bury[at]reverse-shell.com>', # routersploit module 'Marcin Bury <marcin.bury[at]reverse-shell.com>', # routersploit module
], ],
} }
......
routersploit/utils.py
...@@ -314,7 +314,7 @@ def pprint_dict_in_order(dictionary, order=None): ...@@ -314,7 +314,7 @@ def pprint_dict_in_order(dictionary, order=None):
prettyprint(rest_keys, dictionary[rest_keys]) prettyprint(rest_keys, dictionary[rest_keys])
def random_text(length, alph=string.letters+string.digits): def random_text(length, alph=string.ascii_letters+string.digits):
""" Random text generator. NOT crypto safe. """ Random text generator. NOT crypto safe.
Generates random text with specified length and alphabet. Generates random text with specified length and alphabet.
......
routersploit/wordlists/defaults.txt
...@@ -166,6 +166,7 @@ admin:rmnetlm ...@@ -166,6 +166,7 @@ admin:rmnetlm
admin:root admin:root
admin:secure admin:secure
admin:setup admin:setup
admin:sky
admin:smallbusiness admin:smallbusiness
admin:smcadmin admin:smcadmin
admin:superuser admin:superuser
......
routersploit/wordlists/passwords.txt
...@@ -3,22 +3,40 @@ $chwarzepumpe ...@@ -3,22 +3,40 @@ $chwarzepumpe
$secure$ $secure$
(brak) (brak)
0 0
000000
0P3N 0P3N
10023 10023
102030
1064 1064
Test1234!
1111 1111
111111
11111111
112233
121212
123 123
123123
123123123
123321
1234 1234
12345 12345
123456 123456
1234567
12345678
123456789
1234567890
1234admin 1234admin
123654
123qwe
12871 12871
1502 1502
166816 166816
1q2w3e
1q2w3e4r
1qaz2wsx
21241036 21241036
2222 2222
22222 22222
222222
240653C9467E45 240653C9467E45
266344 266344
31994 31994
...@@ -29,12 +47,18 @@ Test1234! ...@@ -29,12 +47,18 @@ Test1234!
456 456
4getme2 4getme2
4tas 4tas
555555
561384 561384
5678 5678
56789 56789
5777364 5777364
654321
666666
753951
7777777
8111 8111
8429 8429
987654321
9999 9999
@dsl_xilno @dsl_xilno
ADMINISTRATOR ADMINISTRATOR
...@@ -122,6 +146,7 @@ RSX ...@@ -122,6 +146,7 @@ RSX
SECURITY SECURITY
SERVICE SERVICE
SESAME SESAME
sky
SKY_FOX SKY_FOX
SMDR SMDR
SSA SSA
...@@ -140,6 +165,7 @@ TELESUP ...@@ -140,6 +165,7 @@ TELESUP
TENmanUFactOryPOWER TENmanUFactOryPOWER
TJM TJM
Telecom Telecom
Test1234!
UI-PSWD-01 UI-PSWD-01
UI-PSWD-02 UI-PSWD-02
User User
...@@ -148,7 +174,11 @@ WORD ...@@ -148,7 +174,11 @@ WORD
Wireless Wireless
XLSERVER XLSERVER
_Cisco _Cisco
aaaaaa
abc
abc123 abc123
abcd1234
abcdef
acc acc
access access
adfexc adfexc
...@@ -163,6 +193,9 @@ adress ...@@ -163,6 +193,9 @@ adress
adslolitec adslolitec
adslroot adslroot
adtran adtran
alexander
andrea
andrew
anicust anicust
any@ any@
apc apc
...@@ -170,12 +203,19 @@ articon ...@@ -170,12 +203,19 @@ articon
asante asante
ascend ascend
asd asd
asdasd
asdfasdf
asdfgh
asdfghj
asdfghjkl
at4400 at4400
atc123 atc123
atlantis atlantis
attack attack
azerty
backdoor backdoor
barricade barricade
baseball
bciimpw bciimpw
bcimpw bcimpw
bcmspw bcmspw
...@@ -186,6 +226,7 @@ blank ...@@ -186,6 +226,7 @@ blank
blender blender
bluepw bluepw
browsepw browsepw
buster
cacadmin cacadmin
calvin calvin
cascade cascade
...@@ -195,6 +236,8 @@ cgadmin ...@@ -195,6 +236,8 @@ cgadmin
changeme changeme
changeme(exclamation) changeme(exclamation)
changeme2 changeme2
charlie
chocolate
cisco cisco
citel citel
client client
...@@ -202,6 +245,7 @@ cmaker ...@@ -202,6 +245,7 @@ cmaker
cms500 cms500
col1ma col1ma
comcomcom comcomcom
computer
connect connect
corecess corecess
craft craft
...@@ -211,6 +255,7 @@ custpw ...@@ -211,6 +255,7 @@ custpw
d1scovery d1scovery
dadmin01 dadmin01
danger danger
daniel
davox davox
default default
detmond detmond
...@@ -219,6 +264,7 @@ dhs3mt ...@@ -219,6 +264,7 @@ dhs3mt
dhs3pms dhs3pms
diamond diamond
draadloos draadloos
dragon
e250changeme e250changeme
e500changeme e500changeme
engineer engineer
...@@ -228,16 +274,22 @@ epicrouter ...@@ -228,16 +274,22 @@ epicrouter
expert expert
expert03 expert03
extendnet extendnet
fdsa
field field
fivranne fivranne
football
freedom
friend friend
fuckyou
ganteng ganteng
gen1 gen1
gen2 gen2
ggdaseuaimhrke ggdaseuaimhrke
ginger
guest guest
h179350 h179350
hagpolm1 hagpolm1
hannah
hawk201 hawk201
hello hello
help help
...@@ -247,6 +299,7 @@ hp.com ...@@ -247,6 +299,7 @@ hp.com
hs7mwxkk hs7mwxkk
hsadb hsadb
iDirect iDirect
iloveyou
images images
imss7.0 imss7.0
inads inads
...@@ -256,11 +309,17 @@ initpw ...@@ -256,11 +309,17 @@ initpw
installer installer
intel intel
intermec intermec
internet
ironport ironport
isee isee
isp isp
jannie jannie
jennifer
jessica
jordan
joshua
kermit kermit
killer
kilo1987 kilo1987
l2 l2
l3 l3
...@@ -271,6 +330,7 @@ letmein ...@@ -271,6 +330,7 @@ letmein
leviton leviton
linga linga
live live
liverpool
llatsni llatsni
locatepw locatepw
looker looker
...@@ -278,18 +338,23 @@ lp ...@@ -278,18 +338,23 @@ lp
lucenttech1 lucenttech1
lucenttech2 lucenttech2
m1122 m1122
maggie
maint maint
maintpw maintpw
manager manager
master master
masterkey masterkey
matrix
mediator mediator
medion medion
mercury mercury
michael
michelangelo michelangelo
michelle
microbusiness microbusiness
mlusr mlusr
monitor monitor
monkey
mono mono
motorola motorola
mtch mtch
...@@ -304,6 +369,7 @@ netgear1 ...@@ -304,6 +369,7 @@ netgear1
netman netman
netopia netopia
netscreen netscreen
nicole
nimdaten nimdaten
nmspw nmspw
nokai nokai
...@@ -324,15 +390,21 @@ passwort ...@@ -324,15 +390,21 @@ passwort
patrol patrol
pbxk1064 pbxk1064
pento pento
pepper
permit permit
pfsense pfsense
pilou pilou
piranha piranha
princess
private private
public public
public/private/secret public/private/secret
purple
pwp pwp
q q
qazwsx
qwerty
qwertyuiop
r@p8p0r+ r@p8p0r+
radius radius
radware radware
...@@ -348,6 +420,7 @@ router ...@@ -348,6 +420,7 @@ router
rw rw
rwa rwa
rwmaint rwmaint
samsung
scmchangeme scmchangeme
scout scout
secret secret
...@@ -356,18 +429,24 @@ security ...@@ -356,18 +429,24 @@ security
serial# serial#
service service
setup setup
shadow
sitecom sitecom
smallbusiness smallbusiness
smcadmin smcadmin
smile smile
snmp-Trap snmp-Trap
snoopy1
soccer
software01 software01
specialist specialist
speedxess speedxess
star star
stratauser stratauser
su@psir su@psir
summer
sunshine
super super
superman
superuser superuser
supervisor supervisor
support support
...@@ -387,14 +466,18 @@ tech ...@@ -387,14 +466,18 @@ tech
telco telco
telecom telecom
tellabs#1 tellabs#1
test
thomas
tiaranet tiaranet
tiger123 tiger123
tigger
timely timely
tini tini
tivonpw tivonpw
tlah tlah
trancell trancell
truetime truetime
trustno1
tslinux tslinux
tuxalize tuxalize
ubnt ubnt
...@@ -406,7 +489,9 @@ w0rkplac3rul3s ...@@ -406,7 +489,9 @@ w0rkplac3rul3s
w2402 w2402
wampp wampp
webadmin webadmin
welcome
wg wg
whatever
winterm winterm
wlsedb wlsedb
wlsepassword wlsepassword
...@@ -418,4 +503,5 @@ xbox ...@@ -418,4 +503,5 @@ xbox
xd xd
xdfk9874t3 xdfk9874t3
xxyyzz xxyyzz
zoomadsl zoomadsl
\ No newline at end of file zxcvbnm
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment