@@ -17,7 +17,7 @@ class Exploit(exploits.Exploit):
...
@@ -17,7 +17,7 @@ class Exploit(exploits.Exploit):
If the tharget is vulnerable it allows to download configuration files which contains sensitive data like password hashes, firewall rules and other network related configurations.
If the tharget is vulnerable it allows to download configuration files which contains sensitive data like password hashes, firewall rules and other network related configurations.
"""
"""
__info__={
__info__={
'name':'ZyXEL ZyWALL USG',
'name':'Zyxel ZyWALL USG Extract Hashes',
'description':'Exploit implementation for ZyWall USG 20 Authentication Bypass In Configuration Import/Export.'
'description':'Exploit implementation for ZyWall USG 20 Authentication Bypass In Configuration Import/Export.'
'If the tharget is vulnerable it allows to download configuration files which contains sensitive data like password hashes, firewall rules and other network related configurations.',
'If the tharget is vulnerable it allows to download configuration files which contains sensitive data like password hashes, firewall rules and other network related configurations.',
'authors':[
'authors':[
...
@@ -27,20 +27,21 @@ class Exploit(exploits.Exploit):
...
@@ -27,20 +27,21 @@ class Exploit(exploits.Exploit):
'https://www.exploit-db.com/exploits/17244/',
'https://www.exploit-db.com/exploits/17244/',
],
],
'devices':[
'devices':[
'ZyWALL USG-20',
'ZyXEL ZyWALL USG-20',
'ZyWALL USG-20W',
'ZyXEL ZyWALL USG-20W',
'ZyWALL USG-50',
'ZyXEL ZyWALL USG-50',
'ZyWALL USG-100',
'ZyXEL ZyWALL USG-100',
'ZyWALL USG-200',
'ZyXEL ZyWALL USG-200',
'ZyWALL USG-300',
'ZyXEL ZyWALL USG-300',
'ZyWALL USG-1000',
'ZyXEL ZyWALL USG-1000',
'ZyWALL USG-1050'
'ZyXEL ZyWALL USG-1050'
'ZyWALL USG-2000'
'ZyXEL ZyWALL USG-2000'
],
],
}
}
target=exploits.Option('','Target address e.g. https://192.168.1.1',validators=validators.url)# target address
target=exploits.Option('','Target address e.g. https://192.168.1.1',validators=validators.url)# target address
port=exploits.Option(443,'Target port')# default port
port=exploits.Option(443,'Target port')# default port
script_content=None
defrun(self):
defrun(self):
...
@@ -64,16 +65,10 @@ class Exploit(exploits.Exploit):
...
@@ -64,16 +65,10 @@ class Exploit(exploits.Exploit):