pjlantz/findings

Various write-ups and exploits

findings's Issues

Python3 Issues with WDR4300.py

Was this ever tested with python3 (tried running on 3.4+)? There's quite a few errors that occur while running.

For example, in Python 3.x, hashlib.md5() expects a byte-like object as input, rather than a string.

So credentials = "admin" + ":" + hashlib.md5(password).hexdigest() should be credentials = "admin" + ":" + hashlib.md5(password.encode('utf-8')).hexdigest()

The binascii.b2a_base64() method also expects a bytes-like object as its input, so auth = base64.b64encode(credentials) should be auth = base64.b64encode(credentials.encode('utf-8')).

h["Cookie"] = "Authorization=Basic%20" + auth needs to be h["Cookie"] = "Authorization=Basic%20" + auth.decode()

All of the reverse tcp shellcode (and anywhere it gets used) need to be byte string objects.

However, after making all those changes, it seems like this succeeds with just crashing the httpd service on the wdr4300 (tested on 3.14.3 Build 150518 ) and never actually succeeding in getting a reverse shell (have nc running and listening on 31337 per the shell code, and even popped open wireshark and never see it even attempt to connect back).