search

threat9 / routersploit

Exploitation Framework for Embedded Devices
Other
12.19k stars 2.32k forks source link

exploits/thomson/twg849_info_disclosure.py incompatible with py-snmp matching requirements.txt #356

Closed mulander closed 6 years ago

mulander commented 6 years ago

On OpenBSD/amd64 -current I'm running routersploit v2.2.1 scanners/autopwnwhich results in the following backtrace:

rsf > use scanners/autopwn
rsf (AutoPwn) > help
Global commands:
    help                        Print this help menu
    use <module>                Select a module for usage
    exec <shell command> <args> Execute a command in a shell
    exit                        Exit RouterSploit

 Module commands:
    run                                 Run the selected module with the given options
    back                                De-select the current module
    set <option name> <option value>    Set an option for the selected module
    setg <option name> <option value>   Set an option for all of the modules
    unsetg <option name>                Unset option that was set globally
    show [info|options|devices]         Print information, options, or target devices for a module
    check                               Check if a given target is vulnerable to a selected module's exploit
rsf (AutoPwn) > set target 192.168.100.1
[+] {'target': '192.168.100.1'}
rsf (AutoPwn) > run
[*] Running module...
[-] exploits/2wire/4011g_5012nv_path_traversal is not vulnerable
[-] exploits/2wire/gateway_auth_bypass is not vulnerable
[-] exploits/3com/ap8760_password_disclosure is not vulnerable
[-] exploits/3com/imc_path_traversal is not vulnerable
[-] exploits/asmax/ar_804_gu_rce is not vulnerable
[-] exploits/asmax/ar_1004g_password_disclosure is not vulnerable
[-] exploits/asus/rt_n16_password_disclosure is not vulnerable
[-] exploits/belkin/g_plus_info_disclosure is not vulnerable
[-] exploits/belkin/g_n150_password_disclosure is not vulnerable
[-] exploits/belkin/n750_rce is not vulnerable
[-] exploits/3com/officeconnect_rce is not vulnerable
[-] exploits/belkin/n150_path_traversal is not vulnerable
[-] exploits/cisco/dpc2420_info_disclosure is not vulnerable
[-] exploits/cisco/unified_multi_path_traversal is not vulnerable
[-] exploits/3com/imc_info_disclosure is not vulnerable
[-] exploits/cisco/ucs_manager_rce is not vulnerable
[-] exploits/3com/officeconnect_info_disclosure is not vulnerable
[-] exploits/cisco/video_surv_path_traversal is not vulnerable
[-] exploits/comtrend/ct_5361t_password_disclosure is not vulnerable
[-] exploits/dlink/dir_300_645_815_upnp_rce is not vulnerable
[-] exploits/dlink/dcs_930l_auth_rce is not vulnerable
[-] exploits/dlink/dir_300_600_rce is not vulnerable
[-] exploits/dlink/dir_645_815_rce is not vulnerable
[-] exploits/dlink/dir_300_320_600_615_info_disclosure is not vulnerable
[*] exploits/dlink/dsl_2640b_dns_change could not be verified
[*] exploits/dlink/dsl_2730b_2780b_526b_dns_change could not be verified
[*] exploits/dlink/dsl_2740r_dns_change could not be verified
[-] exploits/3com/3cradsl72_info_disclosure is not vulnerable
[-] exploits/dlink/dir_300_320_615_auth_bypass is not vulnerable
[-] exploits/dlink/dvg_n5402sp_path_traversal is not vulnerable
[-] exploits/dlink/dir_825_path_traversal is not vulnerable
[-] exploits/dlink/dns_320l_327l_rce is not vulnerable
[-] exploits/fortinet/fortigate_os_backdoor is not vulnerable
[-] exploits/dlink/dwr_932_info_disclosure is not vulnerable
[-] exploits/dlink/dir_645_password_disclosure is not vulnerable
[-] exploits/dlink/dsl_2750b_info_disclosure is not vulnerable
[-] exploits/multi/misfortune_cookie is not vulnerable
[-] exploits/juniper/screenos_backdoor is not vulnerable
[-] exploits/dlink/multi_hnap_rce is not vulnerable
[-] exploits/multi/tcp_32764_info_disclosure is not vulnerable
[-] exploits/multi/tcp_32764_rce is not vulnerable
[-] exploits/linksys/1500_2500_rce is not vulnerable
[-] exploits/multi/heartbleed is not vulnerable
[-] exploits/linksys/wap54gv3_rce is not vulnerable
[-] exploits/netgear/prosafe_rce is not vulnerable
[-] exploits/multi/shellshock is not vulnerable
[-] exploits/technicolor/tc7200_password_disclosure is not vulnerable
[-] exploits/zte/f609_config_disclosure is not vulnerable
[-] exploits/zte/f660_config_disclosure is not vulnerable
[-] exploits/zte/f6xx_default_root is not vulnerable
[-] exploits/multi/ssh_auth_keys is not vulnerable
[-] exploits/zte/f460_f660_backdoor is not vulnerable
[-] exploits/huawei/hg630a_default_creds is not vulnerable
[-] exploits/huawei/hg530_hg520b_password_disclosure is not vulnerable
[-] exploits/huawei/e5331_mifi_info_disclosure is not vulnerable
[-] exploits/huawei/hg866_password_change is not vulnerable
[-] exploits/netgear/n300_auth_bypass is not vulnerable
[-] exploits/ipfire/ipfire_proxy_rce is not vulnerable
[-] exploits/ipfire/ipfire_shellshock is not vulnerable
[*] exploits/shuttle/915wm_dns_change could not be verified
[-] exploits/ubiquiti/airos_6_x is not vulnerable
[-] exploits/thomson/twg850_password_disclosure is not vulnerable
Exception in thread worker-5:
Traceback (most recent call last):
  File "/usr/local/lib/python2.7/threading.py", line 801, in __bootstrap_inner
    self.run()
  File "/usr/local/lib/python2.7/site-packages/routersploit/threads.py", line 31, in run
    target(*args)
  File "/usr/local/lib/python2.7/site-packages/routersploit/modules/scanners/autopwn.py", line 58, in target_function
    response = exploit.check()
  File "/usr/local/lib/python2.7/site-packages/routersploit/utils.py", line 169, in wrapper
    return fn(self, *args, **kwargs)
  File "/usr/local/lib/python2.7/site-packages/routersploit/modules/exploits/thomson/twg849_info_disclosure.py", line 76, in check
    cmdGen = cmdgen.CommandGenerator()
  File "/usr/local/lib/python2.7/site-packages/pysnmp/entity/rfc3413/oneliner/cmdgen.py", line 166, in __init__
    self.snmpEngine = snmpEngine or SnmpEngine()
  File "/usr/local/lib/python2.7/site-packages/pysnmp/entity/engine.py", line 61, in __init__
    self.msgAndPduDsp = MsgAndPduDispatcher()
  File "/usr/local/lib/python2.7/site-packages/pysnmp/proto/rfc3412.py", line 29, in __init__
    'SNMP-TARGET-MIB', 'SNMP-USER-BASED-SM-MIB'
  File "/usr/local/lib/python2.7/site-packages/pysnmp/smi/builder.py", line 337, in loadModules
    self.loadModule(modName, **userCtx)
  File "/usr/local/lib/python2.7/site-packages/pysnmp/smi/builder.py", line 306, in loadModule
    'MIB module \"%s\" load error: %s' % (modPath, traceback.format_exception(*sys.exc_info()))
MibLoadError: MIB module "/usr/local/lib/python2.7/site-packages/pysnmp/smi/mibs/SNMPv2-MIB.pyc" load error: ['Traceback (most recent call last):\n', '  File "/usr/local/lib/python2.7/site-packages/pysnmp/smi/builder.py", line 301, in loadModule\n    exec(modData, g)\n', '  File "/usr/local/lib/python2.7/site-packages/pysnmp/smi/mibs/SNMPv2-MIB.py", line 26, in <module>\n    sysDescr = MibScalar((1, 3, 6, 1, 2, 1, 1, 1), DisplayString().subtype(subtypeSpec=ValueSizeConstraint(0,255))).setMaxAccess("readonly")\n', '  File "/usr/local/lib/python2.7/site-packages/pysnmp/proto/rfc1902.py", line 201, in subtype\n    self, value, implicitTag, explicitTag, subtypeSpec\n', 'TypeError: subtype() takes at most 2 arguments (5 given)\n']

[-] exploits/tplink/wdr740nd_wdr740n_backdoor is not vulnerable
[-] exploits/netsys/multi_rce is not vulnerable
[-] exploits/netgear/multi_rce is not vulnerable
[-] exploits/tplink/wdr740nd_wdr740n_path_traversal is not vulnerable
[-] exploits/asus/infosvr_backdoor_rce is not vulnerable
[-] exploits/cisco/ucm_info_disclosure is not vulnerable
[-] exploits/huawei/hg520_info_dislosure is not vulnerable
[-] exploits/netcore/udp_53413_rce is not vulnerable
[*] Elapsed time:  10.6610248089 seconds

[-] Device is not vulnerable to any exploits!

rsf (AutoPwn) >

the system installed py-snmp is

fishtank$ pkg_info | grep py-snmp
py-snmp-4.3.2       SNMP framework for Python

which matches what is pointed out in requirements.txt

pysnmp>=4.3.2
lucyoa commented 6 years ago

We have switched to python 3 and changed architecture. It doesn't seem to be accurate anymore.

mulander commented 6 years ago

Will you tag a release then? I would like to package an updated version but you don't seem to be doing release any longer?