Learning how to use exploit in BT4

[edi318]

Hi there,

at first i want to ask you to point any part of this text that you can't understand. English is not my language but i try my best to communicate with you.

I have router Sagem Fast, BT4 and EW-7318USg card. Succesfully cracked WEP and wanted to learn something new.

On milworm i found this Sagem Routers F@ST Remote CSRF Exploit

I copied text and saved as dhcpattack.py, changed eth0 to wlan0, installed scapy library, but still it doesn't work and i got the message that "Ether isn't defined"

Is the problem with library or should i change some options in router soft first?

Thanks for any help

bump with addition data.

This is what i got after typing

python dhcpattack.py -i wlan0 -t 192.168.1.1 -p "<IFRAME height=0 width=0 src='http://192.168.1.1/restoreinfo.cgi'></IFRAME>"

V:
�



Starting....

Traceback (most recent call last):
  
File "dhcpattack.py", line 203, in <module>
    
ether = Ether(src= srcmac,dst="ff:ff:ff:ff:ff:ff")

NameError: name 'Ether' is not defined

[crweedon]

i think it's saying that the ethernet frame type is not defined, i didn't look to closely at the exploit code but check for fields to input the mac addys for your router, interface and general tcp packet/arp info

[Gitsnik]

i think it's saying that the ethernet frame type is not defined

The perl programmer in me is reading that error message more along the lines that Ether() is not defined, probably that scapy is not properly loaded in fact. Could be wrong.

[purehate]

I agree with Gitsnik, Looks like Scapy is not properly loading the mac addy of the adapter so there fore Ether remains undefined.

[edi318]

thanks guys.

Indeed the problem was with scapy.

I changed the line

from scapy import *

to

from scapy.all import *

bacause i found that scapy devs changed that import command in newest version.

After that everything worked like a miracle.

[crweedon]

well done, that'll teach me to ctrl-f the code instead of just reading through it. thank you guys for the correction, like i said, i didn't look to closely at the code