로컬 IoT UPnP 서비스가 취약한지 확인하는 Python 코드

from scapy.all import *
from colorama import Fore
import os
import sys
import requests
from bs4 import BeautifulSoup
 
 
if len(sys.argv) is 1 or len(sys.argv) > 3: // 인자 개수 확인
    print("Example Reference")
    sys.exit()
 
SSDPserver=sys.argv[1]
 
description = r"""
         ,
         )\
        /  \
       '  # '
       ',  ,'
         `'

         ,
         )\
        /  \
       '  ~ '
       ',  ,'
         `'
upnp.py - UPnP Vulnerability Check
Example: python upnpcheck.py <Target IP>"""
 
print (description)
 
def ssdp(): // ssdp 패킷을 만들어보내어 UPnP가 존재하는지 확인하는 function
    payload = "M-SEARCH * HTTP/1.1\r\n" \
    "HOST:"+SSDPserver+":1900\r\n" \
    "ST:upnp:rootdevice\r\n" \
    "MAN: \"ssdp:discover\"\r\n" \
    "MX:2\r\n\r\n"
 
    ssdpRequest = IP(dst=SSDPserver) / UDP(sport=1900, dport= 1900) / payload
    resp=sr1(ssdpRequest, timeout=1, verbose=0)
    print(Fore.LIGHTBLUE_EX+'-------------------------------- UPnP Service Checking... ------------------------------'+Fore.RESET)
    if resp:
        print('************ '+SSDPserver+' : '+Fore.RED+'UPnP Service is Open!!!' + Fore.RESET)
        str1=str(resp[Raw])
        return str1
    else:
        print('************ '+SSDPserver +Fore.LIGHTBLUE_EX+": UPnP Service is not open"+Fore.RESET)
        sys.exit()
 
def filecontrol(location): // Raw 데이터에서 URL을 추출하여 저장 변수에 저장하는 function
    f=open("service.txt",'w')
    f.write(location)
    f.close()
    os.system("cat service.txt | grep -i location| awk '{print $2}' > service2.txt; rm service.txt")
    a=os.system("cat service2.txt | grep -i http > /dev/null") // UPnP 서비스는 있는데 URL이 존재하지 않을때 점검하는 루틴
    if a is not 0: // a의 값이 True가 아닐시에 취약점이 존재하지 않음으로 종료
        print(Fore.LIGHTBLUE_EX+'---------------------------------------- Result --------------------------------------'+Fore.RESET)
        print('************ '+Fore.LIGHTBLUE_EX+"The UPnP service is not vulnerable." + Fore.RESET)
        sys.exit()
    f2=open("service2.txt",'r')
    url=f2.readline().replace("\r\n",'')
    f.close()
    os.system("rm service2.txt")
    return url
 
def packet(url): // UPnP URL을 요청하는 패킷을 만들어 보내 response 패킷에서 취약점이 존재하는지 확인하는 fucntion
    login_url=url
    s=requests.session()
    resp=s.get(login_url)
    soup=BeautifulSoup(resp.text,'lxml')
    print(Fore.LIGHTBLUE_EX+'---------------------------------------- Result --------------------------------------'+Fore.RESET)
    if re.search('WANIPConnection', str(soup)):
        print('************ '+Fore.RED+"The UPnP service is vulnerable." + Fore.RESET)
    else:
        print('************ '+Fore.LIGHTBLUE_EX+"The UPnP service is not vulnerable." + Fore.RESET)
 
if __name__ == "__main__":
    location=ssdp()
    url=filecontrol(location)
    packet(url)