1. 10 May, 2018 1 commit
    • tc7200_password_disclosure_v2: fix vulnerability check and wrong pycrypto call (#406) · 050bb861
      * Fix vulnerability check in tc7200_password_disclosure_v2
      
      Use an encrypted zero block to identify the binary settings backup data.
      
      * Make tc7200_password_disclosure_v2 compatible with new pycrypto
      
      The decryption routine uses AES in ECB mode. The pycrypto module is used for this routine. ECB does not involve any initialization vector (IV). However routersploit uses one that is 16 NUL bytes. Older pycrypto versions just ignored this, but newer versions (at least since 2.6) error on using an IV with ECB.
      
      * tc7200_password_disclosure_v2: adapt test to the binary check
      
      * add missing import
      bgermann authored
  2. 09 May, 2018 4 commits
  3. 08 May, 2018 7 commits
  4. 07 May, 2018 6 commits
  5. 06 May, 2018 5 commits
  6. 03 May, 2018 1 commit
  7. 28 Apr, 2018 1 commit
  8. 27 Feb, 2018 1 commit
  9. 24 Feb, 2018 1 commit
  10. 22 Feb, 2018 1 commit
  11. 05 Feb, 2018 1 commit
  12. 28 Jan, 2018 2 commits
  13. 14 Jan, 2018 2 commits
  14. 14 Nov, 2017 1 commit
  15. 10 Nov, 2017 1 commit
    • Rom-0 exploit - check error (#342) · f8f7d65e
      The HTTP HEAD method in general doesn't return the content of the body, unless it is a redirection page, so line `and len(response.text) > 500:` will never be true if second line of check `response = http_request(method="HEAD", url=url)` get a response.
      
      As result, devices seem no vulnerable when actually it is.
      
      Data:
      ```
      HEAD /rom-0 HTTP/1.1
      Host: 192.168.254.254
      Connection: keep-alive
      Accept-Encoding: gzip, deflate
      Accept: */*
      User-Agent: python-requests/2.18.4
      
      
      HTTP/1.1 200 OK
      Content-Type: application/octet-stream
      Date: Sat, 01 Jan 2000 00:18:54 GMT
      Last-Modified: Wed, 01 Jan 1930 00:18:54 GMT
      Content-Length: 16384
      Server: RomPager/4.07 UPnP/1.0
      EXT:
      ```
      
      My suggestion is just to check whether content type doesn't return "text/html" as value, so it correct this issue and keep the previous false positive fixed.
      
      `and "html" not in response.headers['Content-Type']:`
      or
      `and response.headers['Content-Type'] == "application/octet-stream":
      
      That'is it.
      Alex Hilgert authored
  16. 25 Oct, 2017 3 commits
  17. 24 Oct, 2017 1 commit
  18. 23 Oct, 2017 1 commit